From: J. Bruce Fields Date: Thu, 5 Jul 2007 17:45:53 +0000 (-0400) Subject: Support sec= option to specify export security X-Git-Tag: nfs-utils-1-1-1~156 X-Git-Url: https://git.decadent.org.uk/gitweb/?p=nfs-utils.git;a=commitdiff_plain;h=173ac3ccb45cc407336dd363fc15c90bbfdecf6f Support sec= option to specify export security This adds support for reading sec= option and sending security data through cache via "... secinfo n flavor1 flag1 ... flavorN flagN". If sec= is missing, no secinfo option will be passed down. Signed-off-by: Fred Isaman Signed-off-by: "J. Bruce Fields" Signed-off-by: Neil Brown --- diff --git a/support/include/nfslib.h b/support/include/nfslib.h index d4f4150..5af9c30 100644 --- a/support/include/nfslib.h +++ b/support/include/nfslib.h @@ -51,6 +51,14 @@ #define _PATH_PROC_EXPORTS_ALT "/proc/fs/nfsd/exports" #endif +/* Maximum number of security flavors on an export: */ +#define SECFLAVOR_COUNT 8 + +struct sec_entry { + struct flav_info *flav; + int flags; +}; + /* * Data related to a single exports entry as returned by getexportent. * FIXME: export options should probably be parsed at a later time to @@ -76,6 +84,7 @@ struct exportent { int e_fslocmethod; char * e_fslocdata; char * e_uuid; + struct sec_entry e_secinfo[SECFLAVOR_COUNT+1]; }; struct rmtabent { @@ -89,6 +98,7 @@ struct rmtabent { */ void setexportent(char *fname, char *type); struct exportent * getexportent(int,int); +void secinfo_show(FILE *fp, struct exportent *ep); void putexportent(struct exportent *xep); void endexportent(void); struct exportent * mkexportent(char *hname, char *path, char *opts); diff --git a/support/nfs/exports.c b/support/nfs/exports.c index ea96400..c82bb0e 100644 --- a/support/nfs/exports.c +++ b/support/nfs/exports.c @@ -119,6 +119,7 @@ getexportent(int fromkernel, int fromexports) def_ee.e_mountpoint = NULL; def_ee.e_fslocmethod = FSLOC_NONE; def_ee.e_fslocdata = NULL; + def_ee.e_secinfo[0].flav = NULL; def_ee.e_nsquids = 0; def_ee.e_nsqgids = 0; @@ -198,6 +199,27 @@ getexportent(int fromkernel, int fromexports) return ⅇ } +void secinfo_show(FILE *fp, struct exportent *ep) +{ + struct sec_entry *p1, *p2; + int flags; + + for (p1=ep->e_secinfo; p1->flav; p1=p2) { + + fprintf(fp, ",sec=%s", p1->flav->flavour); + for (p2=p1+1; (p2->flav != NULL) && (p1->flags == p2->flags); + p2++) { + fprintf(fp, ":%s", p2->flav->flavour); + } + flags = p1->flags; + fprintf(fp, ",%s", (flags & NFSEXP_READONLY) ? "ro" : "rw"); + fprintf(fp, ",%sroot_squash", (flags & NFSEXP_ROOTSQUASH)? + "" : "no_"); + fprintf(fp, ",%sall_squash", (flags & NFSEXP_ALLSQUASH)? + "" : "no_"); + } +} + void putexportent(struct exportent *ep) { @@ -278,7 +300,9 @@ putexportent(struct exportent *ep) else fprintf(fp, "%d,", id[i]); } - fprintf(fp, "anonuid=%d,anongid=%d)\n", ep->e_anonuid, ep->e_anongid); + fprintf(fp, "anonuid=%d,anongid=%d", ep->e_anonuid, ep->e_anongid); + secinfo_show(fp, ep); + fprintf(fp, ")\n"); } void @@ -326,6 +350,7 @@ mkexportent(char *hname, char *path, char *options) ee.e_mountpoint = NULL; ee.e_fslocmethod = FSLOC_NONE; ee.e_fslocdata = NULL; + ee.e_secinfo[0].flav = NULL; ee.e_nsquids = 0; ee.e_nsqgids = 0; ee.e_uuid = NULL; @@ -368,19 +393,111 @@ static int valid_uuid(char *uuid) return cnt == 32; } +/* + * Append the given flavor to the exportent's e_secinfo array, or + * do nothing if it's already there. Returns the index of flavor + * in the resulting array in any case. + */ +static int secinfo_addflavor(struct flav_info *flav, struct exportent *ep) +{ + struct sec_entry *p; + + for (p=ep->e_secinfo; p->flav; p++) { + if (p->flav == flav) + return p - ep->e_secinfo; + } + if (p - ep->e_secinfo >= SECFLAVOR_COUNT) { + xlog(L_ERROR, "more than %d security flavors on an export\n", + SECFLAVOR_COUNT); + return -1; + } + p->flav = flav; + p->flags = ep->e_flags; + (p+1)->flav = NULL; + return p - ep->e_secinfo; +} + +static struct flav_info *find_flavor(char *name) +{ + struct flav_info *flav; + for (flav = flav_map; flav < flav_map + flav_map_size; flav++) + if (strcmp(flav->flavour, name) == 0) + return flav; + return NULL; +} + +/* @str is a colon seperated list of security flavors. Their order + * is recorded in @ep, and a bitmap corresponding to the list is returned. + * A zero return indicates an error. + */ +static unsigned int parse_flavors(char *str, struct exportent *ep) +{ + unsigned int out=0; + char *flavor; + int bit; + + while ( (flavor=strsep(&str, ":")) ) { + struct flav_info *flav = find_flavor(flavor); + if (flav == NULL) { + xlog(L_ERROR, "unknown flavor %s\n", flavor); + return 0; + } + bit = secinfo_addflavor(flav, ep); + if (bit < 0) + return 0; + out |= 1<e_flags |= mask; + + while (active) { + if (active & 1) + ep->e_secinfo[bit].flags |= mask; + bit++; + active >>= 1; + } +} + +/* Clears the bits in @mask for the appropriate security flavor flags. */ +static void clearflags(int mask, unsigned int active, struct exportent *ep) +{ + int bit=0; + + ep->e_flags &= ~mask; + + while (active) { + if (active & 1) + ep->e_secinfo[bit].flags &= ~mask; + bit++; + active >>= 1; + } +} + +/* options that can vary per flavor: */ +#define NFSEXP_SECINFO_FLAGS (NFSEXP_READONLY | NFSEXP_ROOTSQUASH \ + | NFSEXP_ALLSQUASH) + /* * Parse option string pointed to by cp and set mount options accordingly. */ static int parseopts(char *cp, struct exportent *ep, int warn, int *had_subtree_opt_ptr) { + struct sec_entry *p; int had_subtree_opt = 0; char *flname = efname?efname:"command line"; int flline = efp?efp->x_line:0; + unsigned int active = 0; squids = ep->e_squids; nsquids = ep->e_nsquids; sqgids = ep->e_sqgids; nsqgids = ep->e_nsqgids; - if (!cp) goto out; @@ -399,9 +516,9 @@ parseopts(char *cp, struct exportent *ep, int warn, int *had_subtree_opt_ptr) /* process keyword */ if (strcmp(opt, "ro") == 0) - ep->e_flags |= NFSEXP_READONLY; + setflags(NFSEXP_READONLY, active, ep); else if (strcmp(opt, "rw") == 0) - ep->e_flags &= ~NFSEXP_READONLY; + clearflags(NFSEXP_READONLY, active, ep); else if (!strcmp(opt, "secure")) ep->e_flags &= ~NFSEXP_INSECURE_PORT; else if (!strcmp(opt, "insecure")) @@ -423,13 +540,13 @@ parseopts(char *cp, struct exportent *ep, int warn, int *had_subtree_opt_ptr) else if (!strcmp(opt, "no_wdelay")) ep->e_flags &= ~NFSEXP_GATHERED_WRITES; else if (strcmp(opt, "root_squash") == 0) - ep->e_flags |= NFSEXP_ROOTSQUASH; + setflags(NFSEXP_ROOTSQUASH, active, ep); else if (!strcmp(opt, "no_root_squash")) - ep->e_flags &= ~NFSEXP_ROOTSQUASH; + clearflags(NFSEXP_ROOTSQUASH, active, ep); else if (strcmp(opt, "all_squash") == 0) - ep->e_flags |= NFSEXP_ALLSQUASH; + setflags(NFSEXP_ALLSQUASH, active, ep); else if (strcmp(opt, "no_all_squash") == 0) - ep->e_flags &= ~NFSEXP_ALLSQUASH; + clearflags(NFSEXP_ALLSQUASH, active, ep); else if (strcmp(opt, "subtree_check") == 0) { had_subtree_opt = 1; ep->e_flags &= ~NFSEXP_NOSUBTREECHECK; @@ -517,6 +634,10 @@ bad_option: } else if (strncmp(opt, "replicas=", 9) == 0) { ep->e_fslocmethod = FSLOC_REPLICA; ep->e_fslocdata = strdup(opt+9); + } else if (strncmp(opt, "sec=", 4) == 0) { + active = parse_flavors(opt+4, ep); + if (!active) + goto bad_option; } else { xlog(L_ERROR, "%s:%d: unknown keyword \"%s\"\n", flname, flline, opt); @@ -528,6 +649,8 @@ bad_option: cp++; } + for (p = ep->e_secinfo; p->flav; p++) + p->flags |= ep->e_flags & ~NFSEXP_SECINFO_FLAGS; ep->e_squids = squids; ep->e_sqgids = sqgids; ep->e_nsquids = nsquids; diff --git a/utils/exportfs/exportfs.c b/utils/exportfs/exportfs.c index 99618c9..18dfe5a 100644 --- a/utils/exportfs/exportfs.c +++ b/utils/exportfs/exportfs.c @@ -515,6 +515,7 @@ dump(int verbose) break; #endif } + secinfo_show(stdout, ep); printf("%c\n", (c != '(')? ')' : ' '); } } diff --git a/utils/mountd/cache.c b/utils/mountd/cache.c index d068843..b686318 100644 --- a/utils/mountd/cache.c +++ b/utils/mountd/cache.c @@ -30,6 +30,7 @@ #include "mountd.h" #include "xmalloc.h" #include "fsloc.h" +#include "pseudoflavors.h" #ifdef USE_BLKID #include "blkid/blkid.h" @@ -518,6 +519,25 @@ static void write_fsloc(FILE *f, struct exportent *ep, char *path) release_replicas(servers); } +static void write_secinfo(FILE *f, struct exportent *ep) +{ + struct sec_entry *p; + + for (p = ep->e_secinfo; p->flav; p++) + ; /* Do nothing */ + if (p == ep->e_secinfo) { + /* There was no sec= option */ + return; + } + qword_print(f, "secinfo"); + qword_printint(f, p - ep->e_secinfo); + for (p = ep->e_secinfo; p->flav; p++) { + qword_printint(f, p->flav->fnum); + qword_printint(f, p->flags); + } + +} + static int dump_to_cache(FILE *f, char *domain, char *path, struct exportent *exp) { qword_print(f, domain); @@ -529,6 +549,7 @@ static int dump_to_cache(FILE *f, char *domain, char *path, struct exportent *ex qword_printint(f, exp->e_anongid); qword_printint(f, exp->e_fsid); write_fsloc(f, exp, path); + write_secinfo(f, exp); #if USE_BLKID if (exp->e_uuid == NULL) { char u[16];