The complete set of CITI nfs-utils patches rolled into one patch. Changes since 1.0.11-CITI_NFS4_ALL-1: * Update to nfs-utils-1.1.0 * Include patches from git not yet in a release: - Fix mount error messages * Update gssd usage message to include new -n option. * Patches from Bruce Fields to clean up compile warning, and move pseudoflavor code to a common location * Patch from Bruce Fields and Fred Isaman that adds support to exportfs for reading a sec= option and sending server security data through cache via "... secinfo n flavor1 flag1 ... flavorN flagN". --- nfs-utils-1.1.0-kwc/support/include/nfslib.h | 10 + nfs-utils-1.1.0-kwc/support/include/pseudoflavors.h | 17 ++ nfs-utils-1.1.0-kwc/support/nfs/exports.c | 158 ++++++++++++++++++-- nfs-utils-1.1.0-kwc/utils/exportfs/exportfs.c | 1 nfs-utils-1.1.0-kwc/utils/gssd/gssd.c | 2 nfs-utils-1.1.0-kwc/utils/mount/mount.c | 40 ++++- nfs-utils-1.1.0-kwc/utils/mount/nfs4_mount.h | 12 - nfs-utils-1.1.0-kwc/utils/mount/nfs4mount.c | 27 --- nfs-utils-1.1.0-kwc/utils/mountd/cache.c | 21 ++ 10 files changed, 240 insertions(+), 49 deletions(-) diff -puN utils/mount/mount.c~CITI_NFS4_ALL utils/mount/mount.c --- nfs-utils-1.1.0/utils/mount/mount.c~CITI_NFS4_ALL 2007-06-22 10:51:38.885022000 -0400 +++ nfs-utils-1.1.0-kwc/utils/mount/mount.c 2007-06-22 10:52:04.954241000 -0400 @@ -285,22 +285,49 @@ static void parse_opts (const char *opti } } -static void mount_error(char *node) +static void mount_error(char *mntpnt, char *node) { switch(errno) { case ENOTDIR: - fprintf(stderr, "%s: mount point %s is not a directory\n", progname, node); + fprintf(stderr, "%s: mount point %s is not a directory\n", + progname, mntpnt); break; case EBUSY: - fprintf(stderr, "%s: %s is already mounted or busy\n", progname, node); + fprintf(stderr, "%s: %s is already mounted or busy\n", + progname, mntpnt); break; case ENOENT: - fprintf(stderr, "%s: mount point %s does not exist\n", progname, node); + if (node) { + fprintf(stderr, "%s: %s failed, reason given by server: %s\n", + progname, node, strerror(errno)); + } else + fprintf(stderr, "%s: mount point %s does not exist\n", + progname, mntpnt); break; default: fprintf(stderr, "%s: %s\n", progname, strerror(errno)); } } +static int chk_mountpoint(char *mount_point) +{ + struct stat sb; + + if (stat(mount_point, &sb) < 0){ + mount_error(mount_point, NULL); + return 1; + } + if (S_ISDIR(sb.st_mode) == 0){ + errno = ENOTDIR; + mount_error(mount_point, NULL); + return 1; + } + if (access(mount_point, X_OK) < 0) { + mount_error(mount_point, NULL); + return 1; + } + + return 0; +} extern u_short getport( struct sockaddr_in *saddr, @@ -508,6 +535,9 @@ int main(int argc, char *argv[]) } } + if (chk_mountpoint(mount_point)) + exit(EX_FAIL); + if (nfs_mount_vers == 4) mnt_err = nfs4mount(spec, mount_point, &flags, &extra_opts, &mount_opts, 0); else { @@ -538,7 +568,7 @@ int main(int argc, char *argv[]) mount_opts); if (mnt_err) { - mount_error(mount_point); + mount_error(mount_point, spec); exit(EX_FAIL); } } diff -puN utils/gssd/gssd.c~CITI_NFS4_ALL utils/gssd/gssd.c --- nfs-utils-1.1.0/utils/gssd/gssd.c~CITI_NFS4_ALL 2007-06-22 10:51:53.782368000 -0400 +++ nfs-utils-1.1.0-kwc/utils/gssd/gssd.c 2007-06-22 10:51:56.521019000 -0400 @@ -81,7 +81,7 @@ sig_hup(int signal) static void usage(char *progname) { - fprintf(stderr, "usage: %s [-f] [-n] [-v] [-r] [-p pipefsdir] [-k keytab] [-d ccachedir]\n", + fprintf(stderr, "usage: %s [-f] [-M] [-n] [-v] [-r] [-p pipefsdir] [-k keytab] [-d ccachedir]\n", progname); exit(1); } diff -puN /dev/null support/include/pseudoflavors.h --- /dev/null 2007-06-21 19:03:53.875366737 -0400 +++ nfs-utils-1.1.0-kwc/support/include/pseudoflavors.h 2007-06-22 10:52:22.335293000 -0400 @@ -0,0 +1,17 @@ +#define RPC_AUTH_GSS_KRB5 390003 +#define RPC_AUTH_GSS_KRB5I 390004 +#define RPC_AUTH_GSS_KRB5P 390005 +#define RPC_AUTH_GSS_LKEY 390006 +#define RPC_AUTH_GSS_LKEYI 390007 +#define RPC_AUTH_GSS_LKEYP 390008 +#define RPC_AUTH_GSS_SPKM 390009 +#define RPC_AUTH_GSS_SPKMI 390010 +#define RPC_AUTH_GSS_SPKMP 390011 + +struct flav_info { + char *flavour; + int fnum; +}; + +extern struct flav_info flav_map[]; +extern const int flav_map_size; diff -puN support/nfs/exports.c~CITI_NFS4_ALL support/nfs/exports.c --- nfs-utils-1.1.0/support/nfs/exports.c~CITI_NFS4_ALL 2007-06-22 10:52:16.682999000 -0400 +++ nfs-utils-1.1.0-kwc/support/nfs/exports.c 2007-06-22 10:52:40.578175000 -0400 @@ -30,10 +30,29 @@ #include "xmalloc.h" #include "xlog.h" #include "xio.h" +#include "pseudoflavors.h" #define EXPORT_DEFAULT_FLAGS \ (NFSEXP_READONLY|NFSEXP_ROOTSQUASH|NFSEXP_GATHERED_WRITES|NFSEXP_NOSUBTREECHECK) +struct flav_info flav_map[] = { + { "krb5", RPC_AUTH_GSS_KRB5 }, + { "krb5i", RPC_AUTH_GSS_KRB5I }, + { "krb5p", RPC_AUTH_GSS_KRB5P }, + { "lipkey", RPC_AUTH_GSS_LKEY }, + { "lipkey-i", RPC_AUTH_GSS_LKEYI }, + { "lipkey-p", RPC_AUTH_GSS_LKEYP }, + { "spkm3", RPC_AUTH_GSS_SPKM }, + { "spkm3i", RPC_AUTH_GSS_SPKMI }, + { "spkm3p", RPC_AUTH_GSS_SPKMP }, + { "unix", AUTH_UNIX }, + { "sys", AUTH_SYS }, + { "null", AUTH_NULL }, + { "none", AUTH_NONE }, +}; + +const int flav_map_size = sizeof(flav_map)/sizeof(flav_map[0]); + int export_errno; static char *efname = NULL; @@ -100,6 +119,7 @@ getexportent(int fromkernel, int fromexp def_ee.e_mountpoint = NULL; def_ee.e_fslocmethod = FSLOC_NONE; def_ee.e_fslocdata = NULL; + def_ee.e_secinfo[0].flav = NULL; def_ee.e_nsquids = 0; def_ee.e_nsqgids = 0; @@ -179,6 +199,27 @@ getexportent(int fromkernel, int fromexp return ⅇ } +void secinfo_show(FILE *fp, struct exportent *ep) +{ + struct sec_entry *p1, *p2; + int flags; + + for (p1=ep->e_secinfo; p1->flav; p1=p2) { + + fprintf(fp, ",sec=%s", p1->flav->flavour); + for (p2=p1+1; (p2->flav != NULL) && (p1->flags == p2->flags); + p2++) { + fprintf(fp, ":%s", p2->flav->flavour); + } + flags = p1->flags; + fprintf(fp, ",%s", (flags & NFSEXP_READONLY) ? "ro" : "rw"); + fprintf(fp, ",%sroot_squash", (flags & NFSEXP_ROOTSQUASH)? + "" : "no_"); + fprintf(fp, ",%sall_squash", (flags & NFSEXP_ALLSQUASH)? + "" : "no_"); + } +} + void putexportent(struct exportent *ep) { @@ -259,7 +300,9 @@ putexportent(struct exportent *ep) else fprintf(fp, "%d,", id[i]); } - fprintf(fp, "anonuid=%d,anongid=%d)\n", ep->e_anonuid, ep->e_anongid); + fprintf(fp, "anonuid=%d,anongid=%d", ep->e_anonuid, ep->e_anongid); + secinfo_show(fp, ep); + fprintf(fp, ")\n"); } void @@ -307,6 +350,7 @@ mkexportent(char *hname, char *path, cha ee.e_mountpoint = NULL; ee.e_fslocmethod = FSLOC_NONE; ee.e_fslocdata = NULL; + ee.e_secinfo[0].flav = NULL; ee.e_nsquids = 0; ee.e_nsqgids = 0; ee.e_uuid = NULL; @@ -350,18 +394,110 @@ static int valid_uuid(char *uuid) } /* + * Append the given flavor to the exportent's e_secinfo array, or + * do nothing if it's already there. Returns the index of flavor + * in the resulting array in any case. + */ +static int secinfo_addflavor(struct flav_info *flav, struct exportent *ep) +{ + struct sec_entry *p; + + for (p=ep->e_secinfo; p->flav; p++) { + if (p->flav == flav) + return p - ep->e_secinfo; + } + if (p - ep->e_secinfo >= SECFLAVOR_COUNT) { + xlog(L_ERROR, "more than %d security flavors on an export\n", + SECFLAVOR_COUNT); + return -1; + } + p->flav = flav; + p->flags = ep->e_flags; + (p+1)->flav = NULL; + return p - ep->e_secinfo; +} + +static struct flav_info *find_flavor(char *name) +{ + struct flav_info *flav; + for (flav = flav_map; flav < flav_map + flav_map_size; flav++) + if (strcmp(flav->flavour, name) == 0) + return flav; + return NULL; +} + +/* @str is a colon seperated list of security flavors. Their order + * is recorded in @ep, and a bitmap corresponding to the list is returned. + * A zero return indicates an error. + */ +static unsigned int parse_flavors(char *str, struct exportent *ep) +{ + unsigned int out=0; + char *flavor; + int bit; + + while ( (flavor=strsep(&str, ":")) ) { + struct flav_info *flav = find_flavor(flavor); + if (flav == NULL) { + xlog(L_ERROR, "unknown flavor %s\n", flavor); + return 0; + } + bit = secinfo_addflavor(flav, ep); + if (bit < 0) + return 0; + out |= 1<e_flags |= mask; + + while (active) { + if (active & 1) + ep->e_secinfo[bit].flags |= mask; + bit++; + active >>= 1; + } +} + +/* Clears the bits in @mask for the appropriate security flavor flags. */ +static void clearflags(int mask, unsigned int active, struct exportent *ep) +{ + int bit=0; + + ep->e_flags &= ~mask; + + while (active) { + if (active & 1) + ep->e_secinfo[bit].flags &= ~mask; + bit++; + active >>= 1; + } +} + +/* options that can vary per flavor: */ +#define NFSEXP_SECINFO_FLAGS (NFSEXP_READONLY | NFSEXP_ROOTSQUASH \ + | NFSEXP_ALLSQUASH) + +/* * Parse option string pointed to by cp and set mount options accordingly. */ static int parseopts(char *cp, struct exportent *ep, int warn, int *had_subtree_opt_ptr) { + struct sec_entry *p; int had_subtree_opt = 0; char *flname = efname?efname:"command line"; int flline = efp?efp->x_line:0; + unsigned int active = 0; squids = ep->e_squids; nsquids = ep->e_nsquids; sqgids = ep->e_sqgids; nsqgids = ep->e_nsqgids; - if (!cp) goto out; @@ -380,9 +516,9 @@ parseopts(char *cp, struct exportent *ep /* process keyword */ if (strcmp(opt, "ro") == 0) - ep->e_flags |= NFSEXP_READONLY; + setflags(NFSEXP_READONLY, active, ep); else if (strcmp(opt, "rw") == 0) - ep->e_flags &= ~NFSEXP_READONLY; + clearflags(NFSEXP_READONLY, active, ep); else if (!strcmp(opt, "secure")) ep->e_flags &= ~NFSEXP_INSECURE_PORT; else if (!strcmp(opt, "insecure")) @@ -404,13 +540,13 @@ parseopts(char *cp, struct exportent *ep else if (!strcmp(opt, "no_wdelay")) ep->e_flags &= ~NFSEXP_GATHERED_WRITES; else if (strcmp(opt, "root_squash") == 0) - ep->e_flags |= NFSEXP_ROOTSQUASH; + setflags(NFSEXP_ROOTSQUASH, active, ep); else if (!strcmp(opt, "no_root_squash")) - ep->e_flags &= ~NFSEXP_ROOTSQUASH; + clearflags(NFSEXP_ROOTSQUASH, active, ep); else if (strcmp(opt, "all_squash") == 0) - ep->e_flags |= NFSEXP_ALLSQUASH; + setflags(NFSEXP_ALLSQUASH, active, ep); else if (strcmp(opt, "no_all_squash") == 0) - ep->e_flags &= ~NFSEXP_ALLSQUASH; + clearflags(NFSEXP_ALLSQUASH, active, ep); else if (strcmp(opt, "subtree_check") == 0) { had_subtree_opt = 1; ep->e_flags &= ~NFSEXP_NOSUBTREECHECK; @@ -498,6 +634,10 @@ bad_option: } else if (strncmp(opt, "replicas=", 9) == 0) { ep->e_fslocmethod = FSLOC_REPLICA; ep->e_fslocdata = strdup(opt+9); + } else if (strncmp(opt, "sec=", 4) == 0) { + active = parse_flavors(opt+4, ep); + if (!active) + goto bad_option; } else { xlog(L_ERROR, "%s:%d: unknown keyword \"%s\"\n", flname, flline, opt); @@ -509,6 +649,8 @@ bad_option: cp++; } + for (p = ep->e_secinfo; p->flav; p++) + p->flags |= ep->e_flags & ~NFSEXP_SECINFO_FLAGS; ep->e_squids = squids; ep->e_sqgids = sqgids; ep->e_nsquids = nsquids; diff -puN utils/mount/nfs4mount.c~CITI_NFS4_ALL utils/mount/nfs4mount.c --- nfs-utils-1.1.0/utils/mount/nfs4mount.c~CITI_NFS4_ALL 2007-06-22 10:52:18.413097000 -0400 +++ nfs-utils-1.1.0-kwc/utils/mount/nfs4mount.c 2007-06-22 10:52:25.846889000 -0400 @@ -36,6 +36,7 @@ #define nfsstat nfs_stat #endif +#include "pseudoflavors.h" #include "nls.h" #include "conn.h" #include "xcommon.h" @@ -71,26 +72,6 @@ char *GSSDLCK = DEFAULT_DIR "/rpcgssd"; #define NFS_PORT 2049 #endif -struct { - char *flavour; - int fnum; -} flav_map[] = { - { "krb5", RPC_AUTH_GSS_KRB5 }, - { "krb5i", RPC_AUTH_GSS_KRB5I }, - { "krb5p", RPC_AUTH_GSS_KRB5P }, - { "lipkey", RPC_AUTH_GSS_LKEY }, - { "lipkey-i", RPC_AUTH_GSS_LKEYI }, - { "lipkey-p", RPC_AUTH_GSS_LKEYP }, - { "spkm3", RPC_AUTH_GSS_SPKM }, - { "spkm3i", RPC_AUTH_GSS_SPKMI }, - { "spkm3p", RPC_AUTH_GSS_SPKMP }, - { "unix", AUTH_UNIX }, - { "sys", AUTH_SYS }, - { "null", AUTH_NULL }, - { "none", AUTH_NONE }, -}; - -#define FMAPSIZE (sizeof(flav_map)/sizeof(flav_map[0])) #define MAX_USER_FLAVOUR 16 static int parse_sec(char *sec, int *pseudoflavour) @@ -104,13 +85,13 @@ static int parse_sec(char *sec, int *pse "exceeded\n")); return 0; } - for (i = 0; i < FMAPSIZE; i++) { + for (i = 0; i < flav_map_size; i++) { if (strcmp(sec, flav_map[i].flavour) == 0) { pseudoflavour[num_flavour++] = flav_map[i].fnum; break; } } - if (i == FMAPSIZE) { + if (i == flav_map_size) { fprintf(stderr, _("mount: unknown security type %s\n"), sec); return 0; @@ -399,7 +380,7 @@ int nfs4mount(const char *spec, const ch printf("sec = "); for (pf_cnt = 0; pf_cnt < num_flavour; pf_cnt++) { - for (i = 0; i < FMAPSIZE; i++) { + for (i = 0; i < flav_map_size; i++) { if (flav_map[i].fnum == pseudoflavour[pf_cnt]) { printf("%s", flav_map[i].flavour); break; diff -puN utils/mount/nfs4_mount.h~CITI_NFS4_ALL utils/mount/nfs4_mount.h --- nfs-utils-1.1.0/utils/mount/nfs4_mount.h~CITI_NFS4_ALL 2007-06-22 10:52:21.626744000 -0400 +++ nfs-utils-1.1.0-kwc/utils/mount/nfs4_mount.h 2007-06-22 10:52:24.715391000 -0400 @@ -67,18 +67,6 @@ struct nfs4_mount_data { #define NFS4_MOUNT_STRICTLOCK 0x1000 /* 1 */ #define NFS4_MOUNT_FLAGMASK 0xFFFF -/* pseudoflavors: */ - -#define RPC_AUTH_GSS_KRB5 390003 -#define RPC_AUTH_GSS_KRB5I 390004 -#define RPC_AUTH_GSS_KRB5P 390005 -#define RPC_AUTH_GSS_LKEY 390006 -#define RPC_AUTH_GSS_LKEYI 390007 -#define RPC_AUTH_GSS_LKEYP 390008 -#define RPC_AUTH_GSS_SPKM 390009 -#define RPC_AUTH_GSS_SPKMI 390010 -#define RPC_AUTH_GSS_SPKMP 390011 - int nfs4mount(const char *, const char *, int *, char **, char **, int); diff -puN support/include/nfslib.h~CITI_NFS4_ALL support/include/nfslib.h --- nfs-utils-1.1.0/support/include/nfslib.h~CITI_NFS4_ALL 2007-06-22 10:52:31.311234000 -0400 +++ nfs-utils-1.1.0-kwc/support/include/nfslib.h 2007-06-22 10:52:39.718626000 -0400 @@ -51,6 +51,14 @@ #define _PATH_PROC_EXPORTS_ALT "/proc/fs/nfsd/exports" #endif +/* Maximum number of security flavors on an export: */ +#define SECFLAVOR_COUNT 8 + +struct sec_entry { + struct flav_info *flav; + int flags; +}; + /* * Data related to a single exports entry as returned by getexportent. * FIXME: export options should probably be parsed at a later time to @@ -76,6 +84,7 @@ struct exportent { int e_fslocmethod; char * e_fslocdata; char * e_uuid; + struct sec_entry e_secinfo[SECFLAVOR_COUNT+1]; }; struct rmtabent { @@ -89,6 +98,7 @@ struct rmtabent { */ void setexportent(char *fname, char *type); struct exportent * getexportent(int,int); +void secinfo_show(FILE *fp, struct exportent *ep); void putexportent(struct exportent *xep); void endexportent(void); struct exportent * mkexportent(char *hname, char *path, char *opts); diff -puN utils/exportfs/exportfs.c~CITI_NFS4_ALL utils/exportfs/exportfs.c --- nfs-utils-1.1.0/utils/exportfs/exportfs.c~CITI_NFS4_ALL 2007-06-22 10:52:33.386332000 -0400 +++ nfs-utils-1.1.0-kwc/utils/exportfs/exportfs.c 2007-06-22 10:52:40.698175000 -0400 @@ -515,6 +515,7 @@ dump(int verbose) break; #endif } + secinfo_show(stdout, ep); printf("%c\n", (c != '(')? ')' : ' '); } } diff -puN utils/mountd/cache.c~CITI_NFS4_ALL utils/mountd/cache.c --- nfs-utils-1.1.0/utils/mountd/cache.c~CITI_NFS4_ALL 2007-06-22 10:52:38.862018000 -0400 +++ nfs-utils-1.1.0-kwc/utils/mountd/cache.c 2007-06-22 10:52:40.837142000 -0400 @@ -30,6 +30,7 @@ #include "mountd.h" #include "xmalloc.h" #include "fsloc.h" +#include "pseudoflavors.h" #ifdef USE_BLKID #include "blkid/blkid.h" @@ -518,6 +519,25 @@ static void write_fsloc(FILE *f, struct release_replicas(servers); } +static void write_secinfo(FILE *f, struct exportent *ep) +{ + struct sec_entry *p; + + for (p = ep->e_secinfo; p->flav; p++) + ; /* Do nothing */ + if (p == ep->e_secinfo) { + /* There was no sec= option */ + return; + } + qword_print(f, "secinfo"); + qword_printint(f, p - ep->e_secinfo); + for (p = ep->e_secinfo; p->flav; p++) { + qword_printint(f, p->flav->fnum); + qword_printint(f, p->flags); + } + +} + static int dump_to_cache(FILE *f, char *domain, char *path, struct exportent *exp) { qword_print(f, domain); @@ -529,6 +549,7 @@ static int dump_to_cache(FILE *f, char * qword_printint(f, exp->e_anongid); qword_printint(f, exp->e_fsid); write_fsloc(f, exp, path); + write_secinfo(f, exp); #if USE_BLKID if (exp->e_uuid == NULL) { char u[16]; _