X-Git-Url: https://git.decadent.org.uk/gitweb/?p=nfs-utils.git;a=blobdiff_plain;f=utils%2Fmountd%2Fauth.c;h=0aac273a9df44b68f4d37be2b2b54c13f2ab2594;hp=183c9ea8c5b27b747925b832405333543eba97f0;hb=250c232f53bce01ffd0696f7a55b1e2b0feca51a;hpb=dbeba43bd33ce41bc3c5c95615176e59eb76f00c diff --git a/utils/mountd/auth.c b/utils/mountd/auth.c index 183c9ea..0aac273 100644 --- a/utils/mountd/auth.c +++ b/utils/mountd/auth.c @@ -14,11 +14,13 @@ #include #include #include +#include #include "misc.h" #include "nfslib.h" #include "exportfs.h" #include "mountd.h" #include "xmalloc.h" +#include "v4root.h" enum auth_error { @@ -36,6 +38,7 @@ static nfs_export my_exp; static nfs_client my_client; extern int new_cache; +extern int use_ipaddr; void auth_init(char *exports) @@ -46,24 +49,120 @@ auth_init(char *exports) xtab_mount_write(); } -time_t +/* + * A client can match many different netgroups and it's tough to know + * beforehand whether it will. If the concatenated string of netgroup + * m_hostnames is >512 bytes, then enable the "use_ipaddr" mode. This + * makes mountd change how it matches a client ip address when a mount + * request comes in. It's more efficient at handling netgroups at the + * expense of larger kernel caches. + */ +static void +check_useipaddr(void) +{ + nfs_client *clp; + int old_use_ipaddr = use_ipaddr; + unsigned int len = 0; + + /* add length of m_hostname + 1 for the comma */ + for (clp = clientlist[MCL_NETGROUP]; clp; clp = clp->m_next) + len += (strlen(clp->m_hostname) + 1); + + if (len > (NFSCLNT_IDMAX / 2)) + use_ipaddr = 1; + else + use_ipaddr = 0; + + if (use_ipaddr != old_use_ipaddr) + cache_flush(1); +} + +unsigned int auth_reload() { struct stat stb; - static time_t last_modified = 0; - - if (stat(_PATH_ETAB, &stb) < 0) + static ino_t last_inode; + static int last_fd; + static unsigned int counter; + int fd; + + if ((fd = open(_PATH_ETAB, O_RDONLY)) < 0) { + xlog(L_FATAL, "couldn't open %s", _PATH_ETAB); + } else if (fstat(fd, &stb) < 0) { xlog(L_FATAL, "couldn't stat %s", _PATH_ETAB); - if (stb.st_mtime == last_modified) - return last_modified; - last_modified = stb.st_mtime; + } else if (stb.st_ino == last_inode) { + close(fd); + return counter; + } else { + close(last_fd); + last_fd = fd; + last_inode = stb.st_ino; + } export_freeall(); memset(&my_client, 0, sizeof(my_client)); - // export_read(export_file); xtab_export_read(); + check_useipaddr(); + v4root_set(); + + ++counter; + + return counter; +} + +static char *get_client_hostname(struct sockaddr_in *caller, struct hostent *hp, enum auth_error *error) +{ + char *n; + + if (use_ipaddr) + return strdup(inet_ntoa(caller->sin_addr)); + n = client_compose(hp); + *error = unknown_host; + if (!n) + return NULL; + if (*n) + return n; + free(n); + return strdup("DEFAULT"); +} + +/* return static nfs_export with details filled in */ +static nfs_export * +auth_authenticate_newcache(char *what, struct sockaddr_in *caller, + char *path, struct hostent *hp, + enum auth_error *error) +{ + nfs_export *exp; + int i; + + free(my_client.m_hostname); - return last_modified; + my_client.m_hostname = get_client_hostname(caller, hp, error); + if (my_client.m_hostname == NULL) + return NULL; + + my_client.m_naddr = 1; + my_client.m_addrlist[0] = caller->sin_addr; + my_exp.m_client = &my_client; + + exp = NULL; + for (i = 0; !exp && i < MCL_MAXTYPES; i++) + for (exp = exportlist[i].p_head; exp; exp = exp->m_next) { + if (strcmp(path, exp->m_export.e_path)) + continue; + if (!use_ipaddr && !client_member(my_client.m_hostname, exp->m_client->m_hostname)) + continue; + if (use_ipaddr && !client_check(exp->m_client, hp)) + continue; + break; + } + *error = not_exported; + if (!exp) + return NULL; + + my_exp.m_export = exp->m_export; + exp = &my_exp; + return exp; } static nfs_export * @@ -71,38 +170,12 @@ auth_authenticate_internal(char *what, struct sockaddr_in *caller, char *path, struct hostent *hp, enum auth_error *error) { - nfs_export *exp; + nfs_export *exp; if (new_cache) { - int i; - /* return static nfs_export with details filled in */ - char *n; - my_client.m_addrlist[0] = caller->sin_addr; - n = client_compose(caller->sin_addr); - *error = unknown_host; - if (!n) - return NULL; - strcpy(my_client.m_hostname, *n?n:"DEFAULT"); - free(n); - my_client.m_naddr = 1; - my_exp.m_client = &my_client; - - exp = NULL; - for (i = 0; !exp && i < MCL_MAXTYPES; i++) - for (exp = exportlist[i]; exp; exp = exp->m_next) { - if (!client_member(my_client.m_hostname, exp->m_client->m_hostname)) - continue; - if (strcmp(path, exp->m_export.e_path)) - continue; - break; - } - *error = not_exported; + exp = auth_authenticate_newcache(what, caller, path, hp, error); if (!exp) - return exp; - - my_exp.m_export = exp->m_export; - exp = &my_exp; - + return NULL; } else { if (!(exp = export_find(hp, path))) { *error = no_entry; @@ -114,8 +187,7 @@ auth_authenticate_internal(char *what, struct sockaddr_in *caller, } } if (!(exp->m_export.e_flags & NFSEXP_INSECURE_PORT) && - (ntohs(caller->sin_port) < IPPORT_RESERVED/2 || - ntohs(caller->sin_port) >= IPPORT_RESERVED)) { + ntohs(caller->sin_port) >= IPPORT_RESERVED) { *error = illegal_port; return NULL; } @@ -132,7 +204,7 @@ auth_authenticate(char *what, struct sockaddr_in *caller, char *path) char *p = NULL; struct hostent *hp = NULL; struct in_addr addr = caller->sin_addr; - enum auth_error error; + enum auth_error error = bad_path; if (path [0] != '/') { xlog(L_WARNING, "bad path in %s request from %s: \"%s\"", @@ -144,11 +216,7 @@ auth_authenticate(char *what, struct sockaddr_in *caller, char *path) epath[sizeof (epath) - 1] = '\0'; auth_fixpath(epath); /* strip duplicate '/' etc */ - hp = get_reliable_hostbyaddr((const char*)&caller->sin_addr, sizeof(struct in_addr), - AF_INET); - if (!hp) - hp = get_hostent((const char*)&caller->sin_addr, sizeof(struct in_addr), - AF_INET); + hp = client_resolve(caller->sin_addr); if (!hp) return exp; @@ -172,7 +240,7 @@ auth_authenticate(char *what, struct sockaddr_in *caller, char *path) break; case unknown_host: - xlog(L_WARNING, "%s request from unknown host %s for %s (%s)", + xlog(L_WARNING, "refused %s request from %s for %s (%s): unmatched host", what, inet_ntoa(addr), path, epath); break;