From: neilbrown Date: Fri, 26 Aug 2005 01:36:14 +0000 (+0000) Subject: 2005-08-26 Kevin Coffman X-Git-Tag: nfs-utils-1-0-7-post2~2 X-Git-Url: https://git.decadent.org.uk/gitweb/?p=nfs-utils.git;a=commitdiff_plain;h=53c5bd65c74e032947d8fb5b140024be008aaa6b;ds=sidebyside 2005-08-26 Kevin Coffman *utils/mountd/mountd.c: mountd currently always returns AUTH_NULL and AUTH_SYS as the allowable flavors in mount replies. We want it to also return gss flavors when appropriate. For now as a hack we just have it always return the KRB5 flavors as well. *utils/mountd/cache.c: When attempting to mount an NFSv4 pseudofilesystem (fsid=0) and the actual exported directory does not exist on the server, rpc.mountd doesn't check the directory exists (when fsidtype=1, i.e. using fsid, but does check for fsidtype=0, i.e. using dev/ino). The non-existent exported directory path with fsid=0 is written to the kernel via /proc/net/rpc/nfsd.export/channel, which leads to path_lookup() to return ENOENT (seems appropriate). Unfortunately, the new_cache approach ignores errors returned when writing via the channel file so that particular error is lost and the mount request is silently ignored. Assuming it doesn't make sense to revamp the new_cache/up-call method to not ignore returned errors, it seems appropriate to fix the case where rpc.mountd doesn't check for the existence of an exported directory with fsid= semantics. The following patch does this by moving the stat() up so it is done for both fsidtype's. I'm not certain whether the other tests need to be executed for fsidtype=1, but it doesn't appear to hurt [Not exactly true: the comparison of inode numbers caused problems so now it's kept for fsidtype=0 only]. Would it be also desirable to log a warning for every error, if any, returned by a write to any of the /proc/net/rpc/*/channel files which would otherwise be ignored (maybe under a debug flag)? * gssd/mountd/svcgssd: Changes gssd, svcgssd, and mountd to ignore a SIGHUP rather than dying. * many: Remove the gssapi code and rely on an external library instead. --- diff --git a/ChangeLog b/ChangeLog index 6cff0f9..4a2a933 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,40 @@ +2005-08-26 Kevin Coffman + *utils/mountd/mountd.c: + mountd currently always returns AUTH_NULL and AUTH_SYS as the + allowable flavors in mount replies. We want it to also return gss + flavors when appropriate. For now as a hack we just have it always + return the KRB5 flavors as well. + + *utils/mountd/cache.c: + + When attempting to mount an NFSv4 pseudofilesystem (fsid=0) and the + actual exported directory does not exist on the server, rpc.mountd + doesn't check the directory exists (when fsidtype=1, i.e. using fsid, + but does check for fsidtype=0, i.e. using dev/ino). The non-existent + exported directory path with fsid=0 is written to the kernel via + /proc/net/rpc/nfsd.export/channel, which leads to path_lookup() to + return ENOENT (seems appropriate). Unfortunately, the new_cache + approach ignores errors returned when writing via the channel file so + that particular error is lost and the mount request is silently ignored. + + Assuming it doesn't make sense to revamp the new_cache/up-call method to + not ignore returned errors, it seems appropriate to fix the case where + rpc.mountd doesn't check for the existence of an exported directory with + fsid= semantics. The following patch does this by moving the stat() up + so it is done for both fsidtype's. I'm not certain whether the other + tests need to be executed for fsidtype=1, but it doesn't appear to hurt + [Not exactly true: the comparison of inode numbers caused problems so + now it's kept for fsidtype=0 only]. + + Would it be also desirable to log a warning for every error, if any, + returned by a write to any of the /proc/net/rpc/*/channel files which + would otherwise be ignored (maybe under a debug flag)? + + * gssd/mountd/svcgssd: Changes gssd, svcgssd, and mountd to ignore a + SIGHUP rather than dying. + + * many: Remove the gssapi code and rely on an external library instead. + 2005-08-26 Kevin Coffman * utils/exportfs/exports.man: Document the "crossmnt" export export option * utils/gssd/krb5_util.c: diff --git a/debian/nfs-common.conffiles b/debian/nfs-common.conffiles index 70e74f5..9e5647c 100644 --- a/debian/nfs-common.conffiles +++ b/debian/nfs-common.conffiles @@ -1,4 +1,3 @@ /etc/default/nfs-common /etc/init.d/nfs-common /etc/idmapd.conf -/etc/gssapi_mech.conf diff --git a/debian/nfs-common.install b/debian/nfs-common.install index 8d81caa..72c8f3b 100644 --- a/debian/nfs-common.install +++ b/debian/nfs-common.install @@ -1,2 +1 @@ debian/idmapd.conf etc -debian/gssapi_mech.conf etc diff --git a/support/gssapi/Makefile b/support/gssapi/Makefile index bc14647..e69de29 100644 --- a/support/gssapi/Makefile +++ b/support/gssapi/Makefile @@ -1,24 +0,0 @@ -# -# libgssapi.a -# gssapi mechanism-switching layer -# -TOP = ../../ -LIBNAME = libgssapi.a -SRCS = g_accept_sec_context.c g_acquire_cred.c g_compare_name.c \ - g_context_time.c g_delete_sec_context.c g_dsp_name.c g_dsp_status.c \ - g_dup_name.c gen_oids.c g_exp_sec_context.c g_glue.c g_imp_name.c \ - g_imp_sec_context.c g_indicate_mechs.c g_initialize.c \ - g_init_sec_context.c g_inq_context.c g_inq_cred.c g_inq_names.c \ - g_mechname.c g_mit_krb5_mech.c g_oid_ops.c g_process_context.c \ - g_rel_buffer.c g_rel_cred.c g_rel_name.c g_rel_oid_set.c g_seal.c \ - g_sign.c gssd_pname_to_uid.c g_unseal.c g_verify.c oid_ops.c \ - g_set_allowable_enctypes.c - -OBJS = $(SRCS:.c=.o) - -include $(TOP)rules.mk - -CFLAGS += -DKRB5_VERSION=$(KRB5_VERSION) -I$(TOP)/support/include - -install:: - @: diff --git a/utils/gssd/Makefile b/utils/gssd/Makefile index 55c8516..a8ff867 100644 --- a/utils/gssd/Makefile +++ b/utils/gssd/Makefile @@ -7,7 +7,7 @@ PROGRAM = gssd PREFIX = rpc. OBJS = gssd.o gssd_main_loop.o gssd_proc.o err_util.o gss_util.o \ gss_oids.o context.o context_heimdal.o krb5_util.o -LIBDEPS = $(TOP)support/lib/librpc.a $(TOP)support/lib/libgssapi.a +LIBDEPS = $(TOP)support/lib/librpc.a LIBS = -Wl,-rpath=$(KRBDIR)/lib -lrpc -lgssapi -ldl $(KRBLIB) MAN8 = gssd diff --git a/utils/gssd/gssd.c b/utils/gssd/gssd.c index 0f7a7e5..7f28320 100644 --- a/utils/gssd/gssd.c +++ b/utils/gssd/gssd.c @@ -63,6 +63,14 @@ sig_die(int signal) exit(1); } +void +sig_hup(int signal) +{ + /* don't exit on SIGHUP */ + printerr(1, "Received SIGHUP... Ignoring.\n"); + return; +} + static void usage(char *progname) { @@ -123,7 +131,7 @@ main(int argc, char *argv[]) signal(SIGINT, sig_die); signal(SIGTERM, sig_die); - signal(SIGHUP, sig_die); + signal(SIGHUP, sig_hup); /* Process keytab file and get machine credentials */ gssd_refresh_krb5_machine_creds(); diff --git a/utils/mountd/cache.c b/utils/mountd/cache.c index 77029f4..e8bb991 100644 --- a/utils/mountd/cache.c +++ b/utils/mountd/cache.c @@ -145,21 +145,22 @@ void nfsd_fh(FILE *f) /* Now determine export point for this fsid/domain */ for (i=0 ; i < MCL_MAXTYPES; i++) { for (exp = exportlist[i]; exp; exp = exp->m_next) { + struct stat stb; + if (!client_member(dom, exp->m_client->m_hostname)) continue; + if (exp->m_export.e_mountpoint && + !is_mountpoint(exp->m_export.e_mountpoint[0]? + exp->m_export.e_mountpoint: + exp->m_export.e_path)) + dev_missing ++; + if (stat(exp->m_export.e_path, &stb) != 0) + continue; if (fsidtype == 1 && ((exp->m_export.e_flags & NFSEXP_FSID) == 0 || exp->m_export.e_fsid != fsidnum)) continue; if (fsidtype == 0) { - struct stat stb; - if (exp->m_export.e_mountpoint && - !is_mountpoint(exp->m_export.e_mountpoint[0]? - exp->m_export.e_mountpoint: - exp->m_export.e_path)) - dev_missing ++; - if (stat(exp->m_export.e_path, &stb) != 0) - continue; if (stb.st_ino != inode) continue; if (major != major(stb.st_dev) || diff --git a/utils/mountd/mountd.c b/utils/mountd/mountd.c index 14dac41..7325b25 100644 --- a/utils/mountd/mountd.c +++ b/utils/mountd/mountd.c @@ -74,6 +74,14 @@ killer (int sig) xlog (L_FATAL, "Caught signal %d, un-registering and exiting.", sig); } +static void +sig_hup (int sig) +{ + /* don't exit on SIGHUP */ + xlog (L_NOTICE, "Received SIGHUP... Ignoring.\n", sig); + return; +} + bool_t mount_null_1_svc(struct svc_req *rqstp, void *argp, void *resp) { @@ -234,7 +242,10 @@ mount_pathconf_2_svc(struct svc_req *rqstp, dirpath *path, ppathcnf *res) bool_t mount_mnt_3_svc(struct svc_req *rqstp, dirpath *path, mountres3 *res) { - static int flavors[] = { AUTH_NULL, AUTH_UNIX }; +#define AUTH_GSS_KRB5 390003 +#define AUTH_GSS_KRB5I 390004 +#define AUTH_GSS_KRB5P 390005 + static int flavors[] = { AUTH_NULL, AUTH_UNIX, AUTH_GSS_KRB5, AUTH_GSS_KRB5I, AUTH_GSS_KRB5P}; struct nfs_fh_len *fh; xlog(D_CALL, "MNT3(%s) called", *path); @@ -243,7 +254,8 @@ mount_mnt_3_svc(struct svc_req *rqstp, dirpath *path, mountres3 *res) ok->fhandle.fhandle3_len = fh->fh_size; ok->fhandle.fhandle3_val = fh->fh_handle; - ok->auth_flavors.auth_flavors_len = 2; + ok->auth_flavors.auth_flavors_len + = sizeof(flavors)/sizeof(flavors[0]); ok->auth_flavors.auth_flavors_val = flavors; } return 1; @@ -566,9 +578,10 @@ main(int argc, char **argv) mount_dispatch, port); sa.sa_handler = killer; - sigaction(SIGHUP, &sa, NULL); sigaction(SIGINT, &sa, NULL); sigaction(SIGTERM, &sa, NULL); + sa.sa_handler = sig_hup; + sigaction(SIGHUP, &sa, NULL); auth_init(export_file); diff --git a/utils/svcgssd/Makefile b/utils/svcgssd/Makefile index 6d1405b..b09e194 100644 --- a/utils/svcgssd/Makefile +++ b/utils/svcgssd/Makefile @@ -7,7 +7,7 @@ PROGRAM = svcgssd PREFIX = rpc. OBJS = svcgssd.o svcgssd_main_loop.o svcgssd_proc.o err_util.o gss_util.o \ gss_oids.o context.o context_heimdal.o cacheio.o svcgssd_mech2file.o -LIBDEPS = $(TOP)support/lib/librpc.a $(TOP)support/lib/libgssapi.a +LIBDEPS = $(TOP)support/lib/librpc.a LIBS = -Wl,-rpath=$(KRBDIR)/lib -lrpc -lgssapi -ldl $(KRBLIB) -lnfsidmap MAN8 = svcgssd diff --git a/utils/svcgssd/svcgssd.c b/utils/svcgssd/svcgssd.c index 9dd5a3a..8e5cc99 100644 --- a/utils/svcgssd/svcgssd.c +++ b/utils/svcgssd/svcgssd.c @@ -143,6 +143,14 @@ sig_die(int signal) exit(1); } +void +sig_hup(int signal) +{ + /* don't exit on SIGHUP */ + printerr(1, "Received SIGHUP... Ignoring.\n"); + return; +} + static void usage(char *progname) { @@ -190,7 +198,7 @@ main(int argc, char *argv[]) signal(SIGINT, sig_die); signal(SIGTERM, sig_die); - signal(SIGHUP, sig_die); + signal(SIGHUP, sig_hup); if (get_creds && !gssd_acquire_cred(GSSD_SERVICE_NAME)) { printerr(0, "unable to obtain root (machine) credentials\n");