1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 /* 27 * Copyright 2014 Nexenta Systems, Inc. All rights reserved. 28 */ 29 30 #include <stdio.h> 31 #include <stdlib.h> 32 #include <sys/types.h> 33 #include <string.h> 34 #include <sys/param.h> 35 #include <sys/stat.h> 36 #include <sys/file.h> 37 #include <sys/time.h> 38 #include <sys/errno.h> 39 #include <rpcsvc/mount.h> 40 #include <sys/pathconf.h> 41 #include <sys/systeminfo.h> 42 #include <sys/utsname.h> 43 #include <arpa/inet.h> 44 #include <signal.h> 45 #include <syslog.h> 46 #include <locale.h> 47 #include <unistd.h> 48 #include <thread.h> 49 #include <netdir.h> 50 #include <nfs/auth.h> 51 #include <sharefs/share.h> 52 #include "../lib/sharetab.h" 53 #include "mountd.h" 54 55 static void 56 nfsauth_access(auth_req *argp, auth_res *result) 57 { 58 struct netconfig *nconf; 59 struct nd_hostservlist *clnames = NULL; 60 struct netbuf nbuf; 61 struct share *sh; 62 char tmp[MAXIPADDRLEN]; 63 char *host = NULL; 64 65 result->auth_perm = NFSAUTH_DENIED; 66 67 /* 68 * Convert the client's address to a hostname 69 */ 70 nconf = getnetconfigent(argp->req_netid); 71 if (nconf == NULL) { 72 syslog(LOG_ERR, "No netconfig entry for %s", argp->req_netid); 73 return; 74 } 75 76 nbuf.len = argp->req_client.n_len; 77 nbuf.buf = argp->req_client.n_bytes; 78 79 if (nbuf.len == 0 || nbuf.buf == NULL) 80 goto done; 81 82 if (netdir_getbyaddr(nconf, &clnames, &nbuf)) { 83 host = &tmp[0]; 84 if (strcmp(nconf->nc_protofmly, NC_INET) == 0) { 85 struct sockaddr_in *sa; 86 87 /* LINTED pointer alignment */ 88 sa = (struct sockaddr_in *)nbuf.buf; 89 (void) inet_ntoa_r(sa->sin_addr, tmp); 90 } else if (strcmp(nconf->nc_protofmly, NC_INET6) == 0) { 91 struct sockaddr_in6 *sa; 92 /* LINTED pointer */ 93 sa = (struct sockaddr_in6 *)nbuf.buf; 94 (void) inet_ntop(AF_INET6, sa->sin6_addr.s6_addr, 95 tmp, INET6_ADDRSTRLEN); 96 } 97 clnames = anon_client(host); 98 } 99 /* 100 * Both netdir_getbyaddr() and anon_client() can return a NULL 101 * clnames. This has been seen when the DNS entry for the client 102 * name does not have the correct format or a reverse lookup DNS 103 * entry cannot be found for the client's IP address. 104 */ 105 if (clnames == NULL) { 106 syslog(LOG_ERR, "Could not find DNS entry for %s", 107 argp->req_netid); 108 goto done; 109 } 110 111 /* 112 * Now find the export 113 */ 114 sh = findentry(argp->req_path); 115 if (sh == NULL) { 116 syslog(LOG_ERR, "%s not exported", argp->req_path); 117 goto done; 118 } 119 120 result->auth_perm = check_client(sh, &nbuf, clnames, argp->req_flavor, 121 argp->req_clnt_uid, argp->req_clnt_gid, &result->auth_srv_uid, 122 &result->auth_srv_gid); 123 124 sharefree(sh); 125 126 if (result->auth_perm == NFSAUTH_DENIED) { 127 syslog(LOG_ERR, "%s denied access to %s", 128 clnames->h_hostservs[0].h_host, argp->req_path); 129 } 130 131 done: 132 freenetconfigent(nconf); 133 if (clnames) 134 netdir_free(clnames, ND_HOSTSERVLIST); 135 } 136 137 void 138 nfsauth_func(void *cookie, char *dataptr, size_t arg_size, 139 door_desc_t *dp, uint_t n_desc) 140 141 { 142 nfsauth_arg_t *ap; 143 nfsauth_res_t res = {0}; 144 nfsauth_res_t *rp = &res; 145 XDR xdrs_a; 146 XDR xdrs_r; 147 caddr_t abuf = dataptr; 148 size_t absz = arg_size; 149 size_t rbsz = (size_t)(BYTES_PER_XDR_UNIT * 4); 150 char result[BYTES_PER_XDR_UNIT * 4]; 151 caddr_t rbuf = (caddr_t)&result; 152 varg_t varg = {0}; 153 154 /* 155 * Decode the inbound door data, so we can look at the cmd. 156 */ 157 xdrmem_create(&xdrs_a, abuf, absz, XDR_DECODE); 158 if (!xdr_varg(&xdrs_a, &varg)) { 159 /* 160 * If the arguments can't be decoded, bail. 161 */ 162 if (varg.vers == V_ERROR) 163 syslog(LOG_ERR, gettext("Arg version mismatch")); 164 res.stat = NFSAUTH_DR_DECERR; 165 goto encres; 166 } 167 168 /* 169 * Now set the args pointer to the proper version of the args 170 */ 171 switch (varg.vers) { 172 case V_PROTO: 173 ap = &varg.arg_u.arg; 174 break; 175 176 /* Additional arguments versions go here */ 177 178 default: 179 syslog(LOG_ERR, gettext("Invalid args version")); 180 goto encres; 181 } 182 183 /* 184 * Call the specified cmd 185 */ 186 switch (ap->cmd) { 187 case NFSAUTH_ACCESS: 188 nfsauth_access(&ap->areq, &rp->ares); 189 rp->stat = NFSAUTH_DR_OKAY; 190 break; 191 default: 192 rp->stat = NFSAUTH_DR_BADCMD; 193 break; 194 } 195 196 encres: 197 /* 198 * Free space used to decode the args 199 */ 200 xdrs_a.x_op = XDR_FREE; 201 (void) xdr_varg(&xdrs_a, &varg); 202 xdr_destroy(&xdrs_a); 203 204 /* 205 * Encode the results before passing thru door. 206 * 207 * The result (nfsauth_res_t) is always two int's, so we don't 208 * have to dynamically size (or allocate) the results buffer. 209 */ 210 xdrmem_create(&xdrs_r, rbuf, rbsz, XDR_ENCODE); 211 if (!xdr_nfsauth_res(&xdrs_r, rp)) { 212 /* 213 * return only the status code 214 */ 215 rp->stat = NFSAUTH_DR_EFAIL; 216 rbsz = sizeof (uint_t); 217 *rbuf = (uint_t)rp->stat; 218 } 219 xdr_destroy(&xdrs_r); 220 221 (void) door_return((char *)rbuf, rbsz, NULL, 0); 222 (void) door_return(NULL, 0, NULL, 0); 223 /* NOTREACHED */ 224 } 225