xref: /titanic_41/usr/src/cmd/fs.d/nfs/mountd/nfsauth.c (revision a6322b5e872ecb7d6d38ce9d2e5362540d3f8b03)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
24  */
25 
26 /*
27  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
28  * Use is subject to license terms.
29  */
30 
31 #include <stdio.h>
32 #include <stdlib.h>
33 #include <sys/types.h>
34 #include <string.h>
35 #include <sys/param.h>
36 #include <sys/stat.h>
37 #include <sys/file.h>
38 #include <sys/time.h>
39 #include <sys/errno.h>
40 #include <rpcsvc/mount.h>
41 #include <sys/pathconf.h>
42 #include <sys/systeminfo.h>
43 #include <sys/utsname.h>
44 #include <arpa/inet.h>
45 #include <signal.h>
46 #include <syslog.h>
47 #include <locale.h>
48 #include <unistd.h>
49 #include <thread.h>
50 #include <netdir.h>
51 #include <nfs/auth.h>
52 #include <sharefs/share.h>
53 #include <alloca.h>
54 #include "../lib/sharetab.h"
55 #include "mountd.h"
56 
57 static void
nfsauth_access(auth_req * argp,auth_res * result)58 nfsauth_access(auth_req *argp, auth_res *result)
59 {
60 	struct netbuf nbuf;
61 	struct share *sh;
62 
63 	struct cln cln;
64 
65 	result->auth_perm = NFSAUTH_DENIED;
66 
67 	nbuf.len = argp->req_client.n_len;
68 	nbuf.buf = argp->req_client.n_bytes;
69 
70 	if (nbuf.len == 0 || nbuf.buf == NULL)
71 		return;
72 
73 	/*
74 	 * Find the export
75 	 */
76 	sh = findentry(argp->req_path);
77 	if (sh == NULL) {
78 		syslog(LOG_ERR, "%s not exported", argp->req_path);
79 		return;
80 	}
81 
82 	cln_init_lazy(&cln, argp->req_netid, &nbuf);
83 
84 	result->auth_perm = check_client(sh, &cln, argp->req_flavor,
85 	    argp->req_clnt_uid, argp->req_clnt_gid, argp->req_clnt_gids.len,
86 	    argp->req_clnt_gids.val, &result->auth_srv_uid,
87 	    &result->auth_srv_gid, &result->auth_srv_gids.len,
88 	    &result->auth_srv_gids.val);
89 
90 	sharefree(sh);
91 
92 	if (result->auth_perm == NFSAUTH_DENIED) {
93 		char *host = cln_gethost(&cln);
94 		if (host != NULL)
95 			syslog(LOG_ERR, "%s denied access to %s", host,
96 			    argp->req_path);
97 	}
98 
99 	cln_fini(&cln);
100 }
101 
102 void
nfsauth_func(void * cookie,char * dataptr,size_t arg_size,door_desc_t * dp,uint_t n_desc)103 nfsauth_func(void *cookie, char *dataptr, size_t arg_size,
104 	door_desc_t *dp, uint_t n_desc)
105 
106 {
107 	nfsauth_arg_t	*ap;
108 	nfsauth_res_t	 res = {0};
109 	XDR		 xdrs_a;
110 	XDR		 xdrs_r;
111 	size_t		 rbsz;
112 	caddr_t		 rbuf;
113 	varg_t		 varg = {0};
114 
115 	/*
116 	 * Decode the inbound door data, so we can look at the cmd.
117 	 */
118 	xdrmem_create(&xdrs_a, dataptr, arg_size, XDR_DECODE);
119 	if (!xdr_varg(&xdrs_a, &varg)) {
120 		/*
121 		 * If the arguments can't be decoded, bail.
122 		 */
123 		if (varg.vers == V_ERROR)
124 			syslog(LOG_ERR, gettext("Arg version mismatch"));
125 		res.stat = NFSAUTH_DR_DECERR;
126 		goto encres;
127 	}
128 
129 	/*
130 	 * Now set the args pointer to the proper version of the args
131 	 */
132 	switch (varg.vers) {
133 	case V_PROTO:
134 		ap = &varg.arg_u.arg;
135 		break;
136 
137 	/* Additional arguments versions go here */
138 
139 	default:
140 		syslog(LOG_ERR, gettext("Invalid args version"));
141 		res.stat = NFSAUTH_DR_DECERR;
142 		goto encres;
143 	}
144 
145 	/*
146 	 * Call the specified cmd
147 	 */
148 	switch (ap->cmd) {
149 	case NFSAUTH_ACCESS:
150 		nfsauth_access(&ap->areq, &res.ares);
151 		res.stat = NFSAUTH_DR_OKAY;
152 		break;
153 	default:
154 		res.stat = NFSAUTH_DR_BADCMD;
155 		break;
156 	}
157 
158 encres:
159 	/*
160 	 * Free space used to decode the args
161 	 */
162 	xdr_free(xdr_varg, (char *)&varg);
163 	xdr_destroy(&xdrs_a);
164 
165 	/*
166 	 * Encode the results before passing thru door.
167 	 */
168 	rbsz = xdr_sizeof(xdr_nfsauth_res, &res);
169 	if (rbsz == 0)
170 		goto failed;
171 	rbuf = alloca(rbsz);
172 
173 	xdrmem_create(&xdrs_r, rbuf, rbsz, XDR_ENCODE);
174 	if (!xdr_nfsauth_res(&xdrs_r, &res)) {
175 		xdr_destroy(&xdrs_r);
176 failed:
177 		xdr_free(xdr_nfsauth_res, (char *)&res);
178 		/*
179 		 * return only the status code
180 		 */
181 		res.stat = NFSAUTH_DR_EFAIL;
182 		rbsz = sizeof (uint_t);
183 		rbuf = (caddr_t)&res.stat;
184 
185 		goto out;
186 	}
187 	xdr_destroy(&xdrs_r);
188 	xdr_free(xdr_nfsauth_res, (char *)&res);
189 
190 out:
191 	(void) door_return((char *)rbuf, rbsz, NULL, 0);
192 	(void) door_return(NULL, 0, NULL, 0);
193 	/* NOTREACHED */
194 }
195