1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright 2015 Nexenta Systems, Inc. All rights reserved.
24 */
25
26 /*
27 * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
28 * Use is subject to license terms.
29 */
30
31 #include <stdio.h>
32 #include <stdlib.h>
33 #include <sys/types.h>
34 #include <string.h>
35 #include <sys/param.h>
36 #include <sys/stat.h>
37 #include <sys/file.h>
38 #include <sys/time.h>
39 #include <sys/errno.h>
40 #include <rpcsvc/mount.h>
41 #include <sys/pathconf.h>
42 #include <sys/systeminfo.h>
43 #include <sys/utsname.h>
44 #include <arpa/inet.h>
45 #include <signal.h>
46 #include <syslog.h>
47 #include <locale.h>
48 #include <unistd.h>
49 #include <thread.h>
50 #include <netdir.h>
51 #include <nfs/auth.h>
52 #include <sharefs/share.h>
53 #include <alloca.h>
54 #include "../lib/sharetab.h"
55 #include "mountd.h"
56
57 static void
nfsauth_access(auth_req * argp,auth_res * result)58 nfsauth_access(auth_req *argp, auth_res *result)
59 {
60 struct netbuf nbuf;
61 struct share *sh;
62
63 struct cln cln;
64
65 result->auth_perm = NFSAUTH_DENIED;
66
67 nbuf.len = argp->req_client.n_len;
68 nbuf.buf = argp->req_client.n_bytes;
69
70 if (nbuf.len == 0 || nbuf.buf == NULL)
71 return;
72
73 /*
74 * Find the export
75 */
76 sh = findentry(argp->req_path);
77 if (sh == NULL) {
78 syslog(LOG_ERR, "%s not exported", argp->req_path);
79 return;
80 }
81
82 cln_init_lazy(&cln, argp->req_netid, &nbuf);
83
84 result->auth_perm = check_client(sh, &cln, argp->req_flavor,
85 argp->req_clnt_uid, argp->req_clnt_gid, argp->req_clnt_gids.len,
86 argp->req_clnt_gids.val, &result->auth_srv_uid,
87 &result->auth_srv_gid, &result->auth_srv_gids.len,
88 &result->auth_srv_gids.val);
89
90 sharefree(sh);
91
92 if (result->auth_perm == NFSAUTH_DENIED) {
93 char *host = cln_gethost(&cln);
94 if (host != NULL)
95 syslog(LOG_ERR, "%s denied access to %s", host,
96 argp->req_path);
97 }
98
99 cln_fini(&cln);
100 }
101
102 void
nfsauth_func(void * cookie,char * dataptr,size_t arg_size,door_desc_t * dp,uint_t n_desc)103 nfsauth_func(void *cookie, char *dataptr, size_t arg_size,
104 door_desc_t *dp, uint_t n_desc)
105
106 {
107 nfsauth_arg_t *ap;
108 nfsauth_res_t res = {0};
109 XDR xdrs_a;
110 XDR xdrs_r;
111 size_t rbsz;
112 caddr_t rbuf;
113 varg_t varg = {0};
114
115 /*
116 * Decode the inbound door data, so we can look at the cmd.
117 */
118 xdrmem_create(&xdrs_a, dataptr, arg_size, XDR_DECODE);
119 if (!xdr_varg(&xdrs_a, &varg)) {
120 /*
121 * If the arguments can't be decoded, bail.
122 */
123 if (varg.vers == V_ERROR)
124 syslog(LOG_ERR, gettext("Arg version mismatch"));
125 res.stat = NFSAUTH_DR_DECERR;
126 goto encres;
127 }
128
129 /*
130 * Now set the args pointer to the proper version of the args
131 */
132 switch (varg.vers) {
133 case V_PROTO:
134 ap = &varg.arg_u.arg;
135 break;
136
137 /* Additional arguments versions go here */
138
139 default:
140 syslog(LOG_ERR, gettext("Invalid args version"));
141 res.stat = NFSAUTH_DR_DECERR;
142 goto encres;
143 }
144
145 /*
146 * Call the specified cmd
147 */
148 switch (ap->cmd) {
149 case NFSAUTH_ACCESS:
150 nfsauth_access(&ap->areq, &res.ares);
151 res.stat = NFSAUTH_DR_OKAY;
152 break;
153 default:
154 res.stat = NFSAUTH_DR_BADCMD;
155 break;
156 }
157
158 encres:
159 /*
160 * Free space used to decode the args
161 */
162 xdr_free(xdr_varg, (char *)&varg);
163 xdr_destroy(&xdrs_a);
164
165 /*
166 * Encode the results before passing thru door.
167 */
168 rbsz = xdr_sizeof(xdr_nfsauth_res, &res);
169 if (rbsz == 0)
170 goto failed;
171 rbuf = alloca(rbsz);
172
173 xdrmem_create(&xdrs_r, rbuf, rbsz, XDR_ENCODE);
174 if (!xdr_nfsauth_res(&xdrs_r, &res)) {
175 xdr_destroy(&xdrs_r);
176 failed:
177 xdr_free(xdr_nfsauth_res, (char *)&res);
178 /*
179 * return only the status code
180 */
181 res.stat = NFSAUTH_DR_EFAIL;
182 rbsz = sizeof (uint_t);
183 rbuf = (caddr_t)&res.stat;
184
185 goto out;
186 }
187 xdr_destroy(&xdrs_r);
188 xdr_free(xdr_nfsauth_res, (char *)&res);
189
190 out:
191 (void) door_return((char *)rbuf, rbsz, NULL, 0);
192 (void) door_return(NULL, 0, NULL, 0);
193 /* NOTREACHED */
194 }
195