mountd: auth_authenticate_internal further cleanup

[nfs-utils.git] / utils / mountd / auth.c

diff --git a/utils/mountd/auth.c b/utils/mountd/auth.c
index 84fea30d8415f85e55568e442c78e4a011a372f6..0aac273a9df44b68f4d37be2b2b54c13f2ab2594 100644 (file)
--- a/utils/mountd/auth.c
+++ b/utils/mountd/auth.c
@@ -20,6 +20,7 @@
 #include "exportfs.h"
 #include "mountd.h"
 #include "xmalloc.h"
+#include "v4root.h"
 
 enum auth_error
 {
@@ -37,6 +38,7 @@ static nfs_export my_exp;
 static nfs_client my_client;
 
 extern int new_cache;
+extern int use_ipaddr;
 
 void
 auth_init(char *exports)
@@ -47,6 +49,34 @@ auth_init(char *exports)
        xtab_mount_write();
 }
 
+/*
+ * A client can match many different netgroups and it's tough to know
+ * beforehand whether it will. If the concatenated string of netgroup
+ * m_hostnames is >512 bytes, then enable the "use_ipaddr" mode. This
+ * makes mountd change how it matches a client ip address when a mount
+ * request comes in. It's more efficient at handling netgroups at the
+ * expense of larger kernel caches.
+ */
+static void
+check_useipaddr(void)
+{
+       nfs_client *clp;
+       int old_use_ipaddr = use_ipaddr;
+       unsigned int len = 0;
+
+       /* add length of m_hostname + 1 for the comma */
+       for (clp = clientlist[MCL_NETGROUP]; clp; clp = clp->m_next)
+               len += (strlen(clp->m_hostname) + 1);
+
+       if (len > (NFSCLNT_IDMAX / 2))
+               use_ipaddr = 1;
+       else
+               use_ipaddr = 0;
+
+       if (use_ipaddr != old_use_ipaddr)
+               cache_flush(1);
+}
+
 unsigned int
 auth_reload()
 {
@@ -72,53 +102,80 @@ auth_reload()
        export_freeall();
        memset(&my_client, 0, sizeof(my_client));
        xtab_export_read();
+       check_useipaddr();
+       v4root_set();
+
        ++counter;
 
        return counter;
 }
 
+static char *get_client_hostname(struct sockaddr_in *caller, struct hostent *hp, enum auth_error *error)
+{
+       char *n;
+
+       if (use_ipaddr)
+               return strdup(inet_ntoa(caller->sin_addr));
+       n = client_compose(hp);
+       *error = unknown_host;
+       if (!n)
+               return NULL;
+       if (*n)
+               return n;
+       free(n);
+       return strdup("DEFAULT");
+}
+
+/* return static nfs_export with details filled in */
 static nfs_export *
-auth_authenticate_internal(char *what, struct sockaddr_in *caller,
+auth_authenticate_newcache(char *what, struct sockaddr_in *caller,
                           char *path, struct hostent *hp,
                           enum auth_error *error)
 {
-       nfs_export              *exp;
+       nfs_export *exp;
+       int i;
 
-       if (new_cache) {
-               int i;
-               /* return static nfs_export with details filled in */
-               char *n;
-               my_client.m_addrlist[0] = caller->sin_addr;
-               n = client_compose(hp);
-               *error = unknown_host;
-               if (!n)
-                       return NULL;
-               free(my_client.m_hostname);
-               if (*n) {
-                       my_client.m_hostname = n;
-               } else {
-                       free(n);
-                       my_client.m_hostname = xstrdup("DEFAULT");
+       free(my_client.m_hostname);
+
+       my_client.m_hostname = get_client_hostname(caller, hp, error);
+       if (my_client.m_hostname == NULL)
+               return NULL;
+
+       my_client.m_naddr = 1;
+       my_client.m_addrlist[0] = caller->sin_addr;
+       my_exp.m_client = &my_client;
+
+       exp = NULL;
+       for (i = 0; !exp && i < MCL_MAXTYPES; i++)
+               for (exp = exportlist[i].p_head; exp; exp = exp->m_next) {
+                       if (strcmp(path, exp->m_export.e_path))
+                               continue;
+                       if (!use_ipaddr && !client_member(my_client.m_hostname, exp->m_client->m_hostname))
+                               continue;
+                       if (use_ipaddr && !client_check(exp->m_client, hp))
+                               continue;
+                       break;
                }
-               my_client.m_naddr = 1;
-               my_exp.m_client = &my_client;
-
-               exp = NULL;
-               for (i = 0; !exp && i < MCL_MAXTYPES; i++) 
-                       for (exp = exportlist[i]; exp; exp = exp->m_next) {
-                               if (!client_member(my_client.m_hostname, exp->m_client->m_hostname))
-                                       continue;
-                               if (strcmp(path, exp->m_export.e_path))
-                                       continue;
-                               break;
-                       }
-               *error = not_exported;
-               if (!exp)
-                       return exp;
+       *error = not_exported;
+       if (!exp)
+               return NULL;
 
-               my_exp.m_export = exp->m_export;
-               exp = &my_exp;
+       my_exp.m_export = exp->m_export;
+       exp = &my_exp;
+       return exp;
+}
 
+static nfs_export *
+auth_authenticate_internal(char *what, struct sockaddr_in *caller,
+                          char *path, struct hostent *hp,
+                          enum auth_error *error)
+{
+       nfs_export *exp;
+
+       if (new_cache) {
+               exp = auth_authenticate_newcache(what, caller, path, hp, error);
+               if (!exp)
+                       return NULL;
        } else {
                if (!(exp = export_find(hp, path))) {
                        *error = no_entry;
@@ -130,8 +187,7 @@ auth_authenticate_internal(char *what, struct sockaddr_in *caller,
                }
        }
        if (!(exp->m_export.e_flags & NFSEXP_INSECURE_PORT) &&
-                   (ntohs(caller->sin_port) <  IPPORT_RESERVED/2 ||
-                    ntohs(caller->sin_port) >= IPPORT_RESERVED)) {
+                    ntohs(caller->sin_port) >= IPPORT_RESERVED) {
                *error = illegal_port;
                return NULL;
        }
@@ -148,7 +204,7 @@ auth_authenticate(char *what, struct sockaddr_in *caller, char *path)
        char            *p = NULL;
        struct hostent  *hp = NULL;
        struct in_addr  addr = caller->sin_addr;
-       enum auth_error error;
+       enum auth_error error = bad_path;
 
        if (path [0] != '/') {
                xlog(L_WARNING, "bad path in %s request from %s: \"%s\"",
@@ -184,7 +240,7 @@ auth_authenticate(char *what, struct sockaddr_in *caller, char *path)
                break;
 
        case unknown_host:
-               xlog(L_WARNING, "%s request from unknown host %s for %s (%s)",
+               xlog(L_WARNING, "refused %s request from %s for %s (%s): unmatched host",
                     what, inet_ntoa(addr), path, epath);
                break;