Print this page
2988 nfssrv: need ability to go to submounts for v3 and v2 protocols
Portions contributed by: Marcel Telka <marcel.telka@nexenta.com>
Portions contributed by: Jean McCormack <jean.mccormack@nexenta.com>
Reviewed by: Yuri Pankov <yuri.pankov@nexenta.com>
Reviewed by: Alek Pinchuk <alek.pinchuk@nexenta.com>
Reviewed by: Dan Fields <dan.fields@nexenta.com>
Reviewed by: Dan McDonald <danmcd@joyent.com>
Change-Id: I6fdf110cc17e789353c4442b83a46cb80643456e
| Split |
Close |
| Expand all |
| Collapse all |
--- old/usr/src/lib/libshare/nfs/libshare_nfs.c
+++ new/usr/src/lib/libshare/nfs/libshare_nfs.c
1 1 /*
2 2 * CDDL HEADER START
3 3 *
4 4 * The contents of this file are subject to the terms of the
5 5 * Common Development and Distribution License (the "License").
6 6 * You may not use this file except in compliance with the License.
7 7 *
8 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 9 * or http://www.opensolaris.org/os/licensing.
10 10 * See the License for the specific language governing permissions
11 11 * and limitations under the License.
12 12 *
13 13 * When distributing Covered Code, include this CDDL HEADER in each
14 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 15 * If applicable, add the following below this CDDL HEADER, with the
16 16 * fields enclosed by brackets "[]" replaced with your own identifying
17 17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 18 *
19 19 * CDDL HEADER END
20 20 */
21 21
22 22 /*
23 23 * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
24 24 * Copyright 2016 Nexenta Systems, Inc.
25 25 * Copyright (c) 2014, 2016 by Delphix. All rights reserved.
26 26 */
27 27
28 28 /*
29 29 * NFS specific functions
30 30 */
31 31 #include <stdio.h>
32 32 #include <string.h>
33 33 #include <ctype.h>
34 34 #include <stdlib.h>
35 35 #include <unistd.h>
36 36 #include <zone.h>
37 37 #include <errno.h>
38 38 #include <locale.h>
39 39 #include <signal.h>
40 40 #include <strings.h>
41 41 #include "libshare.h"
42 42 #include "libshare_impl.h"
43 43 #include <nfs/export.h>
44 44 #include <pwd.h>
45 45 #include <grp.h>
46 46 #include <limits.h>
47 47 #include <libscf.h>
48 48 #include <syslog.h>
49 49 #include <rpcsvc/daemon_utils.h>
50 50 #include "nfslog_config.h"
51 51 #include "nfslogtab.h"
52 52 #include "libshare_nfs.h"
53 53 #include <nfs/nfs.h>
54 54 #include <nfs/nfssys.h>
55 55 #include <netconfig.h>
56 56 #include "smfcfg.h"
57 57
58 58 /* should really be in some global place */
59 59 #define DEF_WIN 30000
60 60 #define OPT_CHUNK 1024
61 61
62 62 int debug = 0;
63 63
64 64 #define NFS_SERVER_SVC "svc:/network/nfs/server:default"
65 65 #define NFS_CLIENT_SVC (char *)"svc:/network/nfs/client:default"
66 66
67 67 /* internal functions */
68 68 static int nfs_init();
69 69 static void nfs_fini();
70 70 static int nfs_enable_share(sa_share_t);
71 71 static int nfs_disable_share(sa_share_t, char *);
72 72 static int nfs_validate_property(sa_handle_t, sa_property_t, sa_optionset_t);
73 73 static int nfs_validate_security_mode(char *);
74 74 static int nfs_is_security_opt(char *);
75 75 static int nfs_parse_legacy_options(sa_group_t, char *);
76 76 static char *nfs_format_options(sa_group_t, int);
77 77 static int nfs_set_proto_prop(sa_property_t);
78 78 static sa_protocol_properties_t nfs_get_proto_set();
79 79 static char *nfs_get_status();
80 80 static char *nfs_space_alias(char *);
81 81 static uint64_t nfs_features();
82 82
83 83 /*
84 84 * ops vector that provides the protocol specific info and operations
85 85 * for share management.
86 86 */
87 87
88 88 struct sa_plugin_ops sa_plugin_ops = {
89 89 SA_PLUGIN_VERSION,
90 90 "nfs",
91 91 nfs_init,
92 92 nfs_fini,
93 93 nfs_enable_share,
94 94 nfs_disable_share,
95 95 nfs_validate_property,
96 96 nfs_validate_security_mode,
97 97 nfs_is_security_opt,
98 98 nfs_parse_legacy_options,
99 99 nfs_format_options,
100 100 nfs_set_proto_prop,
101 101 nfs_get_proto_set,
102 102 nfs_get_status,
103 103 nfs_space_alias,
104 104 NULL, /* update_legacy */
105 105 NULL, /* delete_legacy */
106 106 NULL, /* change_notify */
107 107 NULL, /* enable_resource */
108 108 NULL, /* disable_resource */
109 109 nfs_features,
110 110 NULL, /* transient shares */
111 111 NULL, /* notify resource */
112 112 NULL, /* rename_resource */
113 113 NULL, /* run_command */
114 114 NULL, /* command_help */
115 115 NULL /* delete_proto_section */
116 116 };
117 117
118 118 /*
119 119 * list of support services needed
120 120 * defines should come from head/rpcsvc/daemon_utils.h
121 121 */
122 122
123 123 static char *service_list_default[] =
124 124 { STATD, LOCKD, MOUNTD, NFSD, NFSMAPID, RQUOTAD, REPARSED, NULL };
125 125 static char *service_list_logging[] =
126 126 { STATD, LOCKD, MOUNTD, NFSD, NFSMAPID, RQUOTAD, NFSLOGD, REPARSED,
127 127 NULL };
128 128
129 129 /*
130 130 * option definitions. Make sure to keep the #define for the option
131 131 * index just before the entry it is the index for. Changing the order
132 132 * can cause breakage. E.g OPT_RW is index 1 and must precede the
133 133 * line that includes the SHOPT_RW and OPT_RW entries.
134 134 */
135 135
136 136 struct option_defs optdefs[] = {
137 137 #define OPT_RO 0
138 138 {SHOPT_RO, OPT_RO, OPT_TYPE_ACCLIST},
139 139 #define OPT_RW 1
140 140 {SHOPT_RW, OPT_RW, OPT_TYPE_ACCLIST},
141 141 #define OPT_ROOT 2
142 142 {SHOPT_ROOT, OPT_ROOT, OPT_TYPE_ACCLIST},
143 143 #define OPT_SECURE 3
144 144 {SHOPT_SECURE, OPT_SECURE, OPT_TYPE_DEPRECATED},
145 145 #define OPT_ANON 4
146 146 {SHOPT_ANON, OPT_ANON, OPT_TYPE_USER},
147 147 #define OPT_WINDOW 5
148 148 {SHOPT_WINDOW, OPT_WINDOW, OPT_TYPE_NUMBER},
149 149 #define OPT_NOSUID 6
150 150 {SHOPT_NOSUID, OPT_NOSUID, OPT_TYPE_BOOLEAN},
151 151 #define OPT_ACLOK 7
152 152 {SHOPT_ACLOK, OPT_ACLOK, OPT_TYPE_BOOLEAN},
153 153 #define OPT_NOSUB 8
154 154 {SHOPT_NOSUB, OPT_NOSUB, OPT_TYPE_BOOLEAN},
155 155 #define OPT_SEC 9
156 156 {SHOPT_SEC, OPT_SEC, OPT_TYPE_SECURITY},
157 157 #define OPT_PUBLIC 10
158 158 {SHOPT_PUBLIC, OPT_PUBLIC, OPT_TYPE_BOOLEAN, OPT_SHARE_ONLY},
159 159 #define OPT_INDEX 11
160 160 {SHOPT_INDEX, OPT_INDEX, OPT_TYPE_FILE},
161 161 #define OPT_LOG 12
162 162 {SHOPT_LOG, OPT_LOG, OPT_TYPE_LOGTAG},
163 163 #define OPT_CKSUM 13
164 164 {SHOPT_CKSUM, OPT_CKSUM, OPT_TYPE_STRINGSET},
165 165 #define OPT_NONE 14
166 166 {SHOPT_NONE, OPT_NONE, OPT_TYPE_ACCLIST},
|
↓ open down ↓ |
166 lines elided |
↑ open up ↑ |
167 167 #define OPT_ROOT_MAPPING 15
168 168 {SHOPT_ROOT_MAPPING, OPT_ROOT_MAPPING, OPT_TYPE_USER},
169 169 #define OPT_CHARSET_MAP 16
170 170 {"", OPT_CHARSET_MAP, OPT_TYPE_ACCLIST},
171 171 #define OPT_NOACLFAB 17
172 172 {SHOPT_NOACLFAB, OPT_NOACLFAB, OPT_TYPE_BOOLEAN},
173 173 #define OPT_UIDMAP 18
174 174 {SHOPT_UIDMAP, OPT_UIDMAP, OPT_TYPE_MAPPING},
175 175 #define OPT_GIDMAP 19
176 176 {SHOPT_GIDMAP, OPT_GIDMAP, OPT_TYPE_MAPPING},
177 +#define OPT_NOHIDE 20
178 + {SHOPT_NOHIDE, OPT_NOHIDE, OPT_TYPE_BOOLEAN},
177 179 #ifdef VOLATILE_FH_TEST /* XXX added for testing volatile fh's only */
178 -#define OPT_VOLFH 20
180 +#define OPT_VOLFH 21
179 181 {SHOPT_VOLFH, OPT_VOLFH},
180 182 #endif /* VOLATILE_FH_TEST */
181 183 NULL
182 184 };
183 185
184 186 /*
185 187 * Codesets that may need to be converted to UTF-8 for file paths.
186 188 * Add new names here to add new property support. If we ever get a
187 189 * way to query the kernel for character sets, this should become
188 190 * dynamically loaded. Make sure changes here are reflected in
189 191 * cmd/fs.d/nfs/mountd/nfscmd.c
190 192 */
191 193
192 194 static char *legal_conv[] = {
193 195 "euc-cn",
194 196 "euc-jp",
195 197 "euc-jpms",
196 198 "euc-kr",
197 199 "euc-tw",
198 200 "iso8859-1",
199 201 "iso8859-2",
200 202 "iso8859-5",
201 203 "iso8859-6",
202 204 "iso8859-7",
203 205 "iso8859-8",
204 206 "iso8859-9",
205 207 "iso8859-13",
206 208 "iso8859-15",
207 209 "koi8-r",
208 210 NULL
209 211 };
210 212
211 213 /*
212 214 * list of properties that are related to security flavors.
213 215 */
214 216 static char *seclist[] = {
215 217 SHOPT_RO,
216 218 SHOPT_RW,
217 219 SHOPT_ROOT,
218 220 SHOPT_WINDOW,
219 221 SHOPT_NONE,
220 222 SHOPT_ROOT_MAPPING,
221 223 SHOPT_UIDMAP,
222 224 SHOPT_GIDMAP,
223 225 NULL
224 226 };
225 227
226 228 /* structure for list of securities */
227 229 struct securities {
228 230 sa_security_t security;
229 231 struct securities *next;
230 232 };
231 233
232 234 /*
233 235 * findcharset(charset)
234 236 *
235 237 * Returns B_TRUE if the charset is a legal conversion otherwise
236 238 * B_FALSE. This will need to be rewritten to be more efficient when
237 239 * we have a dynamic list of legal conversions.
238 240 */
239 241
240 242 static boolean_t
241 243 findcharset(char *charset)
242 244 {
243 245 int i;
244 246
245 247 for (i = 0; legal_conv[i] != NULL; i++)
246 248 if (strcmp(charset, legal_conv[i]) == 0)
247 249 return (B_TRUE);
248 250 return (B_FALSE);
249 251 }
250 252
251 253 /*
252 254 * findopt(name)
253 255 *
254 256 * Lookup option "name" in the option table and return the table
255 257 * index.
256 258 */
257 259
258 260 static int
259 261 findopt(char *name)
260 262 {
261 263 int i;
262 264 if (name != NULL) {
263 265 for (i = 0; optdefs[i].tag != NULL; i++) {
264 266 if (strcmp(optdefs[i].tag, name) == 0)
265 267 return (optdefs[i].index);
266 268 }
267 269 if (findcharset(name))
268 270 return (OPT_CHARSET_MAP);
269 271 }
270 272 return (-1);
271 273 }
272 274
273 275 /*
274 276 * gettype(name)
275 277 *
276 278 * Return the type of option "name".
277 279 */
278 280
279 281 static int
280 282 gettype(char *name)
281 283 {
282 284 int optdef;
283 285
284 286 optdef = findopt(name);
285 287 if (optdef != -1)
286 288 return (optdefs[optdef].type);
287 289 return (OPT_TYPE_ANY);
288 290 }
289 291
290 292 /*
291 293 * nfs_validate_security_mode(mode)
292 294 *
293 295 * is the specified mode string a valid one for use with NFS?
294 296 */
295 297
296 298 static int
297 299 nfs_validate_security_mode(char *mode)
298 300 {
299 301 seconfig_t secinfo;
300 302 int err;
301 303
302 304 (void) memset(&secinfo, '\0', sizeof (secinfo));
303 305 err = nfs_getseconfig_byname(mode, &secinfo);
304 306 if (err == SC_NOERROR)
305 307 return (1);
306 308 return (0);
307 309 }
308 310
309 311 /*
310 312 * nfs_is_security_opt(tok)
311 313 *
312 314 * check to see if tok represents an option that is only valid in some
313 315 * security flavor.
314 316 */
315 317
316 318 static int
317 319 nfs_is_security_opt(char *tok)
318 320 {
319 321 int i;
320 322
321 323 for (i = 0; seclist[i] != NULL; i++) {
322 324 if (strcmp(tok, seclist[i]) == 0)
323 325 return (1);
324 326 }
325 327 return (0);
326 328 }
327 329
328 330 /*
329 331 * find_security(seclist, sec)
330 332 *
331 333 * Walk the current list of security flavors and return true if it is
332 334 * present, else return false.
333 335 */
334 336
335 337 static int
336 338 find_security(struct securities *seclist, sa_security_t sec)
337 339 {
338 340 while (seclist != NULL) {
339 341 if (seclist->security == sec)
340 342 return (1);
341 343 seclist = seclist->next;
342 344 }
343 345 return (0);
344 346 }
345 347
346 348 /*
347 349 * make_security_list(group, securitymodes, proto)
348 350 * go through the list of securitymodes and add them to the
349 351 * group's list of security optionsets. We also keep a list of
350 352 * those optionsets so we don't have to find them later. All of
351 353 * these will get copies of the same properties.
352 354 */
353 355
354 356 static struct securities *
355 357 make_security_list(sa_group_t group, char *securitymodes, char *proto)
356 358 {
357 359 char *tok, *next = NULL;
358 360 struct securities *curp, *headp = NULL, *prev;
359 361 sa_security_t check;
360 362 int freetok = 0;
361 363
362 364 for (tok = securitymodes; tok != NULL; tok = next) {
363 365 next = strchr(tok, ':');
364 366 if (next != NULL)
365 367 *next++ = '\0';
366 368 if (strcmp(tok, "default") == 0) {
367 369 /* resolve default into the real type */
368 370 tok = nfs_space_alias(tok);
369 371 freetok = 1;
370 372 }
371 373 check = sa_get_security(group, tok, proto);
372 374
373 375 /* add to the security list if it isn't there already */
374 376 if (check == NULL || !find_security(headp, check)) {
375 377 curp = (struct securities *)calloc(1,
376 378 sizeof (struct securities));
377 379 if (curp != NULL) {
378 380 if (check == NULL) {
379 381 curp->security = sa_create_security(
380 382 group, tok, proto);
381 383 } else {
382 384 curp->security = check;
383 385 }
384 386 /*
385 387 * note that the first time through the loop,
386 388 * headp will be NULL and prev will be
387 389 * undefined. Since headp is NULL, we set
388 390 * both it and prev to the curp (first
389 391 * structure to be allocated).
390 392 *
391 393 * later passes through the loop will have
392 394 * headp not being NULL and prev will be used
393 395 * to allocate at the end of the list.
394 396 */
395 397 if (headp == NULL) {
396 398 headp = curp;
397 399 prev = curp;
398 400 } else {
399 401 prev->next = curp;
400 402 prev = curp;
401 403 }
402 404 }
403 405 }
404 406
405 407 if (freetok) {
406 408 freetok = 0;
407 409 sa_free_attr_string(tok);
408 410 }
409 411 }
410 412 return (headp);
411 413 }
412 414
413 415 static void
414 416 free_security_list(struct securities *sec)
415 417 {
416 418 struct securities *next;
417 419 if (sec != NULL) {
418 420 for (next = sec->next; sec != NULL; sec = next) {
419 421 next = sec->next;
420 422 free(sec);
421 423 }
422 424 }
423 425 }
424 426
425 427 /*
426 428 * nfs_alistcat(str1, str2, sep)
427 429 *
428 430 * concatenate str1 and str2 into a new string using sep as a separate
429 431 * character. If memory allocation fails, return NULL;
430 432 */
431 433
432 434 static char *
433 435 nfs_alistcat(char *str1, char *str2, char sep)
434 436 {
435 437 char *newstr;
436 438 size_t len;
437 439
438 440 len = strlen(str1) + strlen(str2) + 2;
439 441 newstr = (char *)malloc(len);
440 442 if (newstr != NULL)
441 443 (void) snprintf(newstr, len, "%s%c%s", str1, sep, str2);
442 444 return (newstr);
443 445 }
444 446
445 447 /*
446 448 * add_security_prop(sec, name, value, persist, iszfs)
447 449 *
448 450 * Add the property to the securities structure. This accumulates
449 451 * properties for as part of parsing legacy options.
450 452 */
451 453
452 454 static int
453 455 add_security_prop(struct securities *sec, char *name, char *value,
454 456 int persist, int iszfs)
455 457 {
456 458 sa_property_t prop;
457 459 int ret = SA_OK;
458 460
459 461 for (; sec != NULL; sec = sec->next) {
460 462 if (value == NULL) {
461 463 if (strcmp(name, SHOPT_RW) == 0 ||
462 464 strcmp(name, SHOPT_RO) == 0)
463 465 value = "*";
464 466 else
465 467 value = "true";
466 468 }
467 469
468 470 /*
469 471 * Get the existing property, if it exists, so we can
470 472 * determine what to do with it. The ro/rw/root
471 473 * properties can be merged if multiple instances of
472 474 * these properies are given. For example, if "rw"
473 475 * exists with a value "host1" and a later token of
474 476 * rw="host2" is seen, the values are merged into a
475 477 * single rw="host1:host2".
476 478 */
477 479 prop = sa_get_property(sec->security, name);
478 480
479 481 if (prop != NULL) {
480 482 char *oldvalue;
481 483 char *newvalue;
482 484
483 485 /*
484 486 * The security options of ro/rw/root/uidmap/gidmap
485 487 * might appear multiple times. If they do, the values
486 488 * need to be merged. If it was previously empty, the
487 489 * new value alone is added.
488 490 */
489 491 oldvalue = sa_get_property_attr(prop, "value");
490 492 if (oldvalue != NULL) {
491 493 char sep = ':';
492 494
493 495 if (strcmp(name, SHOPT_UIDMAP) == 0 ||
494 496 strcmp(name, SHOPT_GIDMAP) == 0)
495 497 sep = '~';
496 498
497 499 /*
498 500 * The general case is to concatenate the new
499 501 * value onto the old value for multiple
500 502 * rw(ro/root/uidmap/gidmap) properties. For
501 503 * rw/ro/root a special case exists when either
502 504 * the old or new is the "all" case. In the
503 505 * special case, if both are "all", then it is
504 506 * "all", else if one is an access-list, that
505 507 * replaces the "all".
506 508 */
507 509 if (strcmp(oldvalue, "*") == 0) {
508 510 /* Replace old value with new value. */
509 511 newvalue = strdup(value);
510 512 } else if (strcmp(value, "*") == 0 ||
511 513 strcmp(oldvalue, value) == 0) {
512 514 /*
513 515 * Keep old value and ignore
514 516 * the new value.
515 517 */
516 518 newvalue = NULL;
517 519 } else {
518 520 /*
519 521 * Make a new list of old plus new
520 522 * access-list.
521 523 */
522 524 newvalue = nfs_alistcat(oldvalue,
523 525 value, sep);
524 526 }
525 527
526 528 if (newvalue != NULL) {
527 529 (void) sa_remove_property(prop);
528 530 prop = sa_create_property(name,
529 531 newvalue);
530 532 ret = sa_add_property(sec->security,
531 533 prop);
532 534 free(newvalue);
533 535 }
534 536
535 537 sa_free_attr_string(oldvalue);
536 538 }
537 539 } else {
538 540 prop = sa_create_property(name, value);
539 541 ret = sa_add_property(sec->security, prop);
540 542 }
541 543 if (ret == SA_OK && !iszfs) {
542 544 ret = sa_commit_properties(sec->security, !persist);
543 545 }
544 546 }
545 547 return (ret);
546 548 }
547 549
548 550 /*
549 551 * check to see if group/share is persistent.
550 552 */
551 553 static int
552 554 is_persistent(sa_group_t group)
553 555 {
554 556 char *type;
555 557 int persist = 1;
556 558
557 559 type = sa_get_group_attr(group, "type");
558 560 if (type != NULL && strcmp(type, "persist") != 0)
559 561 persist = 0;
560 562 if (type != NULL)
561 563 sa_free_attr_string(type);
562 564 return (persist);
563 565 }
564 566
565 567 /*
566 568 * invalid_security(options)
567 569 *
568 570 * search option string for any invalid sec= type.
569 571 * return true (1) if any are not valid else false (0)
570 572 */
571 573 static int
572 574 invalid_security(char *options)
573 575 {
574 576 char *copy, *base, *token, *value;
575 577 int ret = 0;
576 578
577 579 copy = strdup(options);
578 580 token = base = copy;
579 581 while (token != NULL && ret == 0) {
580 582 token = strtok(base, ",");
581 583 base = NULL;
582 584 if (token != NULL) {
583 585 value = strchr(token, '=');
584 586 if (value != NULL)
585 587 *value++ = '\0';
586 588 if (strcmp(token, SHOPT_SEC) == 0) {
587 589 /* HAVE security flavors so check them */
588 590 char *tok, *next;
589 591 for (next = NULL, tok = value; tok != NULL;
590 592 tok = next) {
591 593 next = strchr(tok, ':');
592 594 if (next != NULL)
593 595 *next++ = '\0';
594 596 ret = !nfs_validate_security_mode(tok);
595 597 if (ret)
596 598 break;
597 599 }
598 600 }
599 601 }
600 602 }
601 603 if (copy != NULL)
602 604 free(copy);
603 605 return (ret);
604 606 }
605 607
606 608 /*
607 609 * nfs_parse_legacy_options(group, options)
608 610 *
609 611 * Parse the old style options into internal format and store on the
610 612 * specified group. Group could be a share for full legacy support.
611 613 */
612 614
613 615 static int
614 616 nfs_parse_legacy_options(sa_group_t group, char *options)
615 617 {
616 618 char *dup;
617 619 char *base;
618 620 char *token;
619 621 sa_optionset_t optionset;
620 622 struct securities *security_list = NULL;
621 623 sa_property_t prop;
622 624 int ret = SA_OK;
623 625 int iszfs = 0;
624 626 sa_group_t parent;
625 627 int persist = 0;
626 628 char *lasts;
627 629
628 630 /* do we have an existing optionset? */
629 631 optionset = sa_get_optionset(group, "nfs");
630 632 if (optionset == NULL) {
631 633 /* didn't find existing optionset so create one */
632 634 optionset = sa_create_optionset(group, "nfs");
633 635 } else {
634 636 /*
635 637 * Have an existing optionset . Ideally, we would need
636 638 * to compare options in order to detect errors. For
637 639 * now, we assume that the first optionset is the
638 640 * correct one and the others will be the same. An
639 641 * empty optionset is the same as no optionset so we
640 642 * don't want to exit in that case. Getting an empty
641 643 * optionset can occur with ZFS property checking.
642 644 */
643 645 if (sa_get_property(optionset, NULL) != NULL)
644 646 return (ret);
645 647 }
646 648
647 649 if (strcmp(options, SHOPT_RW) == 0) {
648 650 /*
649 651 * there is a special case of only the option "rw"
650 652 * being the default option. We don't have to do
651 653 * anything.
652 654 */
653 655 return (ret);
654 656 }
655 657
656 658 /*
657 659 * check if security types are present and validate them. If
658 660 * any are not legal, fail.
659 661 */
660 662
661 663 if (invalid_security(options)) {
662 664 return (SA_INVALID_SECURITY);
663 665 }
664 666
665 667 /*
666 668 * in order to not attempt to change ZFS properties unless
667 669 * absolutely necessary, we never do it in the legacy parsing.
668 670 */
669 671 if (sa_is_share(group)) {
670 672 char *zfs;
671 673 parent = sa_get_parent_group(group);
672 674 if (parent != NULL) {
673 675 zfs = sa_get_group_attr(parent, "zfs");
674 676 if (zfs != NULL) {
675 677 sa_free_attr_string(zfs);
676 678 iszfs++;
677 679 }
678 680 }
679 681 } else {
680 682 iszfs = sa_group_is_zfs(group);
681 683 }
682 684
683 685 /* We need a copy of options for the next part. */
684 686 dup = strdup(options);
685 687 if (dup == NULL)
686 688 return (SA_NO_MEMORY);
687 689
688 690 /*
689 691 * we need to step through each option in the string and then
690 692 * add either the option or the security option as needed. If
691 693 * this is not a persistent share, don't commit to the
692 694 * repository. If there is an error, we also want to abort the
693 695 * processing and report it.
694 696 */
695 697 persist = is_persistent(group);
696 698 base = dup;
697 699 token = dup;
698 700 lasts = NULL;
699 701 while (token != NULL && ret == SA_OK) {
700 702 token = strtok_r(base, ",", &lasts);
701 703 base = NULL;
702 704 if (token != NULL) {
703 705 char *value;
704 706 /*
705 707 * if the option has a value, it will have an '=' to
706 708 * separate the name from the value. The following
707 709 * code will result in value != NULL and token
708 710 * pointing to just the name if there is a value.
709 711 */
710 712 value = strchr(token, '=');
711 713 if (value != NULL) {
712 714 *value++ = '\0';
713 715 }
714 716 if (strcmp(token, SHOPT_SEC) == 0 ||
715 717 strcmp(token, SHOPT_SECURE) == 0) {
716 718 /*
717 719 * Once in security parsing, we only
718 720 * do security. We do need to move
719 721 * between the security node and the
720 722 * toplevel. The security tag goes on
721 723 * the root while the following ones
722 724 * go on the security.
723 725 */
724 726 if (security_list != NULL) {
725 727 /*
726 728 * have an old list so close it and
727 729 * start the new
728 730 */
729 731 free_security_list(security_list);
730 732 }
731 733 if (strcmp(token, SHOPT_SECURE) == 0) {
732 734 value = "dh";
733 735 } else {
734 736 if (value == NULL) {
735 737 ret = SA_SYNTAX_ERR;
736 738 break;
737 739 }
738 740 }
739 741 security_list = make_security_list(group,
740 742 value, "nfs");
741 743 } else {
742 744 /*
743 745 * Note that the "old" syntax allowed a
744 746 * default security model. This must be
745 747 * accounted for and internally converted to
746 748 * "standard" security structure.
747 749 */
748 750 if (nfs_is_security_opt(token)) {
749 751 if (security_list == NULL) {
750 752 /*
751 753 * need to have a
752 754 * security
753 755 * option. This will
754 756 * be "closed" when a
755 757 * defined "sec="
756 758 * option is
757 759 * seen. This is
758 760 * technically an
759 761 * error but will be
760 762 * allowed with
761 763 * warning.
762 764 */
763 765 security_list =
764 766 make_security_list(group,
765 767 "default",
766 768 "nfs");
767 769 }
768 770 if (security_list != NULL) {
769 771 ret = add_security_prop(
770 772 security_list, token,
771 773 value, persist, iszfs);
772 774 } else {
773 775 ret = SA_NO_MEMORY;
774 776 }
775 777 } else {
776 778 /* regular options */
777 779 if (value == NULL) {
778 780 if (strcmp(token, SHOPT_RW) ==
779 781 0 || strcmp(token,
780 782 SHOPT_RO) == 0) {
781 783 value = "*";
782 784 } else {
783 785 value = "global";
784 786 if (strcmp(token,
785 787 SHOPT_LOG) != 0) {
786 788 value = "true";
787 789 }
788 790 }
789 791 }
790 792 /*
791 793 * In all cases, create the
792 794 * property specified. If the
793 795 * value was NULL, the default
794 796 * value will have been
795 797 * substituted.
796 798 */
797 799 prop = sa_create_property(token, value);
798 800 ret = sa_add_property(optionset, prop);
799 801 if (ret != SA_OK)
800 802 break;
801 803
802 804 if (!iszfs) {
803 805 ret = sa_commit_properties(
804 806 optionset, !persist);
805 807 }
806 808 }
807 809 }
808 810 }
809 811 }
810 812 if (security_list != NULL)
811 813 free_security_list(security_list);
812 814
813 815 free(dup);
814 816 return (ret);
815 817 }
816 818
817 819 /*
818 820 * is_a_number(number)
819 821 *
820 822 * is the string a number in one of the forms we want to use?
821 823 */
822 824
823 825 static int
824 826 is_a_number(char *number)
825 827 {
826 828 int ret = 1;
827 829 int hex = 0;
828 830
829 831 if (strncmp(number, "0x", 2) == 0) {
830 832 number += 2;
831 833 hex = 1;
832 834 } else if (*number == '-') {
833 835 number++; /* skip the minus */
834 836 }
835 837 while (ret == 1 && *number != '\0') {
836 838 if (hex) {
837 839 ret = isxdigit(*number++);
838 840 } else {
839 841 ret = isdigit(*number++);
840 842 }
841 843 }
842 844 return (ret);
843 845 }
844 846
845 847 /*
846 848 * Look for the specified tag in the configuration file. If it is found,
847 849 * enable logging and set the logging configuration information for exp.
848 850 */
849 851 static void
850 852 configlog(struct exportdata *exp, char *tag)
851 853 {
852 854 nfsl_config_t *configlist = NULL, *configp;
853 855 int error = 0;
854 856 char globaltag[] = DEFAULTTAG;
855 857
856 858 /*
857 859 * Sends config errors to stderr
858 860 */
859 861 nfsl_errs_to_syslog = B_FALSE;
860 862
861 863 /*
862 864 * get the list of configuration settings
863 865 */
864 866 error = nfsl_getconfig_list(&configlist);
865 867 if (error) {
866 868 (void) fprintf(stderr,
867 869 dgettext(TEXT_DOMAIN, "Cannot get log configuration: %s\n"),
868 870 strerror(error));
869 871 }
870 872
871 873 if (tag == NULL)
872 874 tag = globaltag;
873 875 if ((configp = nfsl_findconfig(configlist, tag, &error)) == NULL) {
874 876 nfsl_freeconfig_list(&configlist);
875 877 (void) fprintf(stderr,
876 878 dgettext(TEXT_DOMAIN, "No tags matching \"%s\"\n"), tag);
877 879 /* bad configuration */
878 880 error = ENOENT;
879 881 goto err;
880 882 }
881 883
882 884 if ((exp->ex_tag = strdup(tag)) == NULL) {
883 885 error = ENOMEM;
884 886 goto out;
885 887 }
886 888 if ((exp->ex_log_buffer = strdup(configp->nc_bufferpath)) == NULL) {
887 889 error = ENOMEM;
888 890 goto out;
889 891 }
890 892 exp->ex_flags |= EX_LOG;
891 893 if (configp->nc_rpclogpath != NULL)
892 894 exp->ex_flags |= EX_LOG_ALLOPS;
893 895 out:
894 896 if (configlist != NULL)
895 897 nfsl_freeconfig_list(&configlist);
896 898
897 899 err:
898 900 if (error != 0) {
899 901 free(exp->ex_tag);
900 902 free(exp->ex_log_buffer);
901 903 (void) fprintf(stderr,
902 904 dgettext(TEXT_DOMAIN, "Cannot set log configuration: %s\n"),
903 905 strerror(error));
904 906 }
905 907 }
906 908
907 909 /*
908 910 * fill_export_from_optionset(export, optionset)
909 911 *
910 912 * In order to share, we need to set all the possible general options
911 913 * into the export structure. Share info will be filled in by the
912 914 * caller. Various property values get turned into structure specific
913 915 * values.
914 916 */
915 917
916 918 static int
917 919 fill_export_from_optionset(struct exportdata *export, sa_optionset_t optionset)
918 920 {
919 921 sa_property_t option;
920 922 int ret = SA_OK;
921 923
922 924 for (option = sa_get_property(optionset, NULL);
923 925 option != NULL; option = sa_get_next_property(option)) {
924 926 char *name;
925 927 char *value;
926 928 uint32_t val;
927 929
928 930 /*
929 931 * since options may be set/reset multiple times, always do an
930 932 * explicit set or clear of the option. This allows defaults
931 933 * to be set and then the protocol specific to override.
932 934 */
933 935
934 936 name = sa_get_property_attr(option, "type");
935 937 value = sa_get_property_attr(option, "value");
936 938 switch (findopt(name)) {
937 939 case OPT_ANON:
938 940 if (value != NULL && is_a_number(value)) {
939 941 val = strtoul(value, NULL, 0);
940 942 } else {
941 943 struct passwd *pw;
942 944 pw = getpwnam(value != NULL ? value : "nobody");
943 945 if (pw != NULL) {
944 946 val = pw->pw_uid;
945 947 } else {
946 948 val = UID_NOBODY;
947 949 }
948 950 endpwent();
949 951 }
950 952 export->ex_anon = val;
951 953 break;
952 954 case OPT_NOSUID:
953 955 if (value != NULL && (strcasecmp(value, "true") == 0 ||
954 956 strcmp(value, "1") == 0))
955 957 export->ex_flags |= EX_NOSUID;
956 958 else
957 959 export->ex_flags &= ~EX_NOSUID;
958 960 break;
959 961 case OPT_ACLOK:
960 962 if (value != NULL && (strcasecmp(value, "true") == 0 ||
961 963 strcmp(value, "1") == 0))
962 964 export->ex_flags |= EX_ACLOK;
963 965 else
964 966 export->ex_flags &= ~EX_ACLOK;
965 967 break;
966 968 case OPT_NOSUB:
967 969 if (value != NULL && (strcasecmp(value, "true") == 0 ||
968 970 strcmp(value, "1") == 0))
969 971 export->ex_flags |= EX_NOSUB;
970 972 else
971 973 export->ex_flags &= ~EX_NOSUB;
972 974 break;
973 975 case OPT_PUBLIC:
974 976 if (value != NULL && (strcasecmp(value, "true") == 0 ||
975 977 strcmp(value, "1") == 0))
976 978 export->ex_flags |= EX_PUBLIC;
977 979 else
978 980 export->ex_flags &= ~EX_PUBLIC;
979 981 break;
980 982 case OPT_INDEX:
981 983 if (value != NULL && (strcmp(value, "..") == 0 ||
982 984 strchr(value, '/') != NULL)) {
983 985 /* this is an error */
984 986 (void) printf(dgettext(TEXT_DOMAIN,
985 987 "NFS: index=\"%s\" not valid;"
986 988 "must be a filename.\n"),
987 989 value);
988 990 break;
989 991 }
990 992 if (value != NULL && *value != '\0' &&
991 993 strcmp(value, ".") != 0) {
992 994 /* valid index file string */
993 995 if (export->ex_index != NULL) {
994 996 /* left over from "default" */
995 997 free(export->ex_index);
996 998 }
997 999 /* remember to free */
998 1000 export->ex_index = strdup(value);
999 1001 if (export->ex_index == NULL) {
1000 1002 (void) printf(dgettext(TEXT_DOMAIN,
1001 1003 "NFS: out of memory setting "
1002 1004 "index property\n"));
1003 1005 break;
1004 1006 }
1005 1007 export->ex_flags |= EX_INDEX;
1006 1008 }
1007 1009 break;
1008 1010 case OPT_LOG:
1009 1011 if (value == NULL)
1010 1012 value = strdup("global");
1011 1013 if (value != NULL)
1012 1014 configlog(export,
1013 1015 strlen(value) ? value : "global");
1014 1016 break;
1015 1017 case OPT_CHARSET_MAP:
1016 1018 /*
1017 1019 * Set EX_CHARMAP when there is at least one
1018 1020 * charmap conversion property. This will get
1019 1021 * checked by the nfs server when it needs to.
|
↓ open down ↓ |
831 lines elided |
↑ open up ↑ |
1020 1022 */
1021 1023 export->ex_flags |= EX_CHARMAP;
1022 1024 break;
1023 1025 case OPT_NOACLFAB:
1024 1026 if (value != NULL && (strcasecmp(value, "true") == 0 ||
1025 1027 strcmp(value, "1") == 0))
1026 1028 export->ex_flags |= EX_NOACLFAB;
1027 1029 else
1028 1030 export->ex_flags &= ~EX_NOACLFAB;
1029 1031 break;
1032 + case OPT_NOHIDE:
1033 + if (value != NULL && (strcasecmp(value, "true") == 0 ||
1034 + strcmp(value, "1") == 0))
1035 + export->ex_flags |= EX_NOHIDE;
1036 + else
1037 + export->ex_flags &= ~EX_NOHIDE;
1038 +
1039 + break;
1030 1040 default:
1031 1041 /* have a syntactic error */
1032 1042 (void) printf(dgettext(TEXT_DOMAIN,
1033 1043 "NFS: unrecognized option %s=%s\n"),
1034 1044 name != NULL ? name : "",
1035 1045 value != NULL ? value : "");
1036 1046 break;
1037 1047 }
1038 1048 if (name != NULL)
1039 1049 sa_free_attr_string(name);
1040 1050 if (value != NULL)
1041 1051 sa_free_attr_string(value);
1042 1052 }
1043 1053 return (ret);
1044 1054 }
1045 1055
1046 1056 /*
1047 1057 * cleanup_export(export)
1048 1058 *
1049 1059 * Cleanup the allocated areas so we don't leak memory
1050 1060 */
1051 1061
1052 1062 static void
1053 1063 cleanup_export(struct exportdata *export)
1054 1064 {
1055 1065 int i;
1056 1066
1057 1067 free(export->ex_index);
1058 1068
1059 1069 for (i = 0; i < export->ex_seccnt; i++) {
1060 1070 struct secinfo *s = &export->ex_secinfo[i];
1061 1071
1062 1072 while (s->s_rootcnt > 0)
1063 1073 free(s->s_rootnames[--s->s_rootcnt]);
1064 1074
1065 1075 free(s->s_rootnames);
1066 1076 }
1067 1077 free(export->ex_secinfo);
1068 1078 }
1069 1079
1070 1080 /*
1071 1081 * Given a seconfig entry and a colon-separated
1072 1082 * list of names, allocate an array big enough
1073 1083 * to hold the root list, then convert each name to
1074 1084 * a principal name according to the security
1075 1085 * info and assign it to an array element.
1076 1086 * Return the array and its size.
1077 1087 */
1078 1088 static caddr_t *
1079 1089 get_rootnames(seconfig_t *sec, char *list, int *count)
1080 1090 {
1081 1091 caddr_t *a;
1082 1092 int c, i;
1083 1093 char *host, *p;
1084 1094
1085 1095 /*
1086 1096 * Count the number of strings in the list.
1087 1097 * This is the number of colon separators + 1.
1088 1098 */
1089 1099 c = 1;
1090 1100 for (p = list; *p; p++)
1091 1101 if (*p == ':')
1092 1102 c++;
1093 1103 *count = c;
1094 1104
1095 1105 a = (caddr_t *)malloc(c * sizeof (char *));
1096 1106 if (a == NULL) {
1097 1107 (void) printf(dgettext(TEXT_DOMAIN,
1098 1108 "get_rootnames: no memory\n"));
1099 1109 *count = 0;
1100 1110 } else {
1101 1111 for (i = 0; i < c; i++) {
1102 1112 host = strtok(list, ":");
1103 1113 if (!nfs_get_root_principal(sec, host, &a[i])) {
1104 1114 while (i > 0)
1105 1115 free(a[--i]);
1106 1116 free(a);
1107 1117 a = NULL;
1108 1118 *count = 0;
1109 1119 break;
1110 1120 }
1111 1121 list = NULL;
1112 1122 }
1113 1123 }
1114 1124
1115 1125 return (a);
1116 1126 }
1117 1127
1118 1128 /*
1119 1129 * fill_security_from_secopts(sp, secopts)
1120 1130 *
1121 1131 * Fill the secinfo structure from the secopts optionset.
1122 1132 */
1123 1133
1124 1134 static int
1125 1135 fill_security_from_secopts(struct secinfo *sp, sa_security_t secopts)
1126 1136 {
1127 1137 sa_property_t prop;
1128 1138 char *type;
1129 1139 int longform;
1130 1140 int err = SC_NOERROR;
1131 1141 uint32_t val;
1132 1142
1133 1143 type = sa_get_security_attr(secopts, "sectype");
1134 1144 if (type != NULL) {
1135 1145 /* named security type needs secinfo to be filled in */
1136 1146 err = nfs_getseconfig_byname(type, &sp->s_secinfo);
1137 1147 sa_free_attr_string(type);
1138 1148 if (err != SC_NOERROR)
1139 1149 return (err);
1140 1150 } else {
1141 1151 /* default case */
1142 1152 err = nfs_getseconfig_default(&sp->s_secinfo);
1143 1153 if (err != SC_NOERROR)
1144 1154 return (err);
1145 1155 }
1146 1156
1147 1157 err = SA_OK;
1148 1158 for (prop = sa_get_property(secopts, NULL);
1149 1159 prop != NULL && err == SA_OK;
1150 1160 prop = sa_get_next_property(prop)) {
1151 1161 char *name;
1152 1162 char *value;
1153 1163
1154 1164 name = sa_get_property_attr(prop, "type");
1155 1165 value = sa_get_property_attr(prop, "value");
1156 1166
1157 1167 longform = value != NULL && strcmp(value, "*") != 0;
1158 1168
1159 1169 switch (findopt(name)) {
1160 1170 case OPT_RO:
1161 1171 sp->s_flags |= longform ? M_ROL : M_RO;
1162 1172 break;
1163 1173 case OPT_RW:
1164 1174 sp->s_flags |= longform ? M_RWL : M_RW;
1165 1175 break;
1166 1176 case OPT_ROOT:
1167 1177 sp->s_flags |= M_ROOT;
1168 1178 /*
1169 1179 * if we are using AUTH_UNIX, handle like other things
1170 1180 * such as RO/RW
1171 1181 */
1172 1182 if (sp->s_secinfo.sc_rpcnum == AUTH_UNIX)
1173 1183 break;
1174 1184 /* not AUTH_UNIX */
1175 1185 if (value != NULL) {
1176 1186 sp->s_rootnames = get_rootnames(&sp->s_secinfo,
1177 1187 value, &sp->s_rootcnt);
1178 1188 if (sp->s_rootnames == NULL) {
1179 1189 err = SA_BAD_VALUE;
1180 1190 (void) fprintf(stderr,
1181 1191 dgettext(TEXT_DOMAIN,
1182 1192 "Bad root list\n"));
1183 1193 }
1184 1194 }
1185 1195 break;
1186 1196 case OPT_NONE:
1187 1197 sp->s_flags |= M_NONE;
1188 1198 break;
1189 1199 case OPT_WINDOW:
1190 1200 if (value != NULL) {
1191 1201 sp->s_window = atoi(value);
1192 1202 /* just in case */
1193 1203 if (sp->s_window < 0)
1194 1204 sp->s_window = DEF_WIN;
1195 1205 }
1196 1206 break;
1197 1207 case OPT_ROOT_MAPPING:
1198 1208 if (value != NULL && is_a_number(value)) {
1199 1209 val = strtoul(value, NULL, 0);
1200 1210 } else {
1201 1211 struct passwd *pw;
1202 1212 pw = getpwnam(value != NULL ? value : "nobody");
1203 1213 if (pw != NULL) {
1204 1214 val = pw->pw_uid;
1205 1215 } else {
1206 1216 val = UID_NOBODY;
1207 1217 }
1208 1218 endpwent();
1209 1219 }
1210 1220 sp->s_rootid = val;
1211 1221 break;
1212 1222 case OPT_UIDMAP:
1213 1223 case OPT_GIDMAP:
1214 1224 sp->s_flags |= M_MAP;
1215 1225 break;
1216 1226 default:
1217 1227 break;
1218 1228 }
1219 1229 if (name != NULL)
1220 1230 sa_free_attr_string(name);
1221 1231 if (value != NULL)
1222 1232 sa_free_attr_string(value);
1223 1233 }
1224 1234 /* if rw/ro options not set, use default of RW */
1225 1235 if ((sp->s_flags & NFS_RWMODES) == 0)
1226 1236 sp->s_flags |= M_RW;
1227 1237 return (err);
1228 1238 }
1229 1239
1230 1240 /*
1231 1241 * This is for testing only
1232 1242 * It displays the export structure that
1233 1243 * goes into the kernel.
1234 1244 */
1235 1245 static void
1236 1246 printarg(char *path, struct exportdata *ep)
1237 1247 {
1238 1248 int i, j;
1239 1249 struct secinfo *sp;
1240 1250
1241 1251 if (debug == 0)
1242 1252 return;
1243 1253
1244 1254 (void) printf("%s:\n", path);
1245 1255 (void) printf("\tex_version = %d\n", ep->ex_version);
1246 1256 (void) printf("\tex_path = %s\n", ep->ex_path);
1247 1257 (void) printf("\tex_pathlen = %ld\n", (ulong_t)ep->ex_pathlen);
1248 1258 (void) printf("\tex_flags: (0x%02x) ", ep->ex_flags);
1249 1259 if (ep->ex_flags & EX_NOSUID)
1250 1260 (void) printf("NOSUID ");
1251 1261 if (ep->ex_flags & EX_ACLOK)
1252 1262 (void) printf("ACLOK ");
1253 1263 if (ep->ex_flags & EX_PUBLIC)
1254 1264 (void) printf("PUBLIC ");
1255 1265 if (ep->ex_flags & EX_NOSUB)
1256 1266 (void) printf("NOSUB ");
1257 1267 if (ep->ex_flags & EX_LOG)
1258 1268 (void) printf("LOG ");
1259 1269 if (ep->ex_flags & EX_CHARMAP)
1260 1270 (void) printf("CHARMAP ");
1261 1271 if (ep->ex_flags & EX_LOG_ALLOPS)
1262 1272 (void) printf("LOG_ALLOPS ");
1263 1273 if (ep->ex_flags == 0)
1264 1274 (void) printf("(none)");
1265 1275 (void) printf("\n");
1266 1276 if (ep->ex_flags & EX_LOG) {
1267 1277 (void) printf("\tex_log_buffer = %s\n",
1268 1278 (ep->ex_log_buffer ? ep->ex_log_buffer : "(NULL)"));
1269 1279 (void) printf("\tex_tag = %s\n",
1270 1280 (ep->ex_tag ? ep->ex_tag : "(NULL)"));
1271 1281 }
1272 1282 (void) printf("\tex_anon = %d\n", ep->ex_anon);
1273 1283 (void) printf("\tex_seccnt = %d\n", ep->ex_seccnt);
1274 1284 (void) printf("\n");
1275 1285 for (i = 0; i < ep->ex_seccnt; i++) {
1276 1286 sp = &ep->ex_secinfo[i];
1277 1287 (void) printf("\t\ts_secinfo = %s\n", sp->s_secinfo.sc_name);
1278 1288 (void) printf("\t\ts_flags: (0x%02x) ", sp->s_flags);
1279 1289 if (sp->s_flags & M_ROOT) (void) printf("M_ROOT ");
1280 1290 if (sp->s_flags & M_RO) (void) printf("M_RO ");
1281 1291 if (sp->s_flags & M_ROL) (void) printf("M_ROL ");
1282 1292 if (sp->s_flags & M_RW) (void) printf("M_RW ");
1283 1293 if (sp->s_flags & M_RWL) (void) printf("M_RWL ");
1284 1294 if (sp->s_flags & M_NONE) (void) printf("M_NONE ");
1285 1295 if (sp->s_flags & M_MAP) (void) printf("M_MAP ");
1286 1296 if (sp->s_flags == 0) (void) printf("(none)");
1287 1297 (void) printf("\n");
1288 1298 (void) printf("\t\ts_window = %d\n", sp->s_window);
1289 1299 (void) printf("\t\ts_rootid = %d\n", sp->s_rootid);
1290 1300 (void) printf("\t\ts_rootcnt = %d ", sp->s_rootcnt);
1291 1301 (void) fflush(stdout);
1292 1302 for (j = 0; j < sp->s_rootcnt; j++)
1293 1303 (void) printf("%s ", sp->s_rootnames[j] ?
1294 1304 sp->s_rootnames[j] : "<null>");
1295 1305 (void) printf("\n\n");
1296 1306 }
1297 1307 }
1298 1308
1299 1309 /*
1300 1310 * count_security(opts)
1301 1311 *
1302 1312 * Count the number of security types (flavors). The optionset has
1303 1313 * been populated with the security flavors as a holding mechanism.
1304 1314 * We later use this number to allocate data structures.
1305 1315 */
1306 1316
1307 1317 static int
1308 1318 count_security(sa_optionset_t opts)
1309 1319 {
1310 1320 int count = 0;
1311 1321 sa_property_t prop;
1312 1322 if (opts != NULL) {
1313 1323 for (prop = sa_get_property(opts, NULL); prop != NULL;
1314 1324 prop = sa_get_next_property(prop)) {
1315 1325 count++;
1316 1326 }
1317 1327 }
1318 1328 return (count);
1319 1329 }
1320 1330
1321 1331 /*
1322 1332 * nfs_sprint_option(rbuff, rbuffsize, incr, prop, sep)
1323 1333 *
1324 1334 * provides a mechanism to format NFS properties into legacy output
1325 1335 * format. If the buffer would overflow, it is reallocated and grown
1326 1336 * as appropriate. Special cases of converting internal form of values
1327 1337 * to those used by "share" are done. this function does one property
1328 1338 * at a time.
1329 1339 */
1330 1340
1331 1341 static int
1332 1342 nfs_sprint_option(char **rbuff, size_t *rbuffsize, size_t incr,
1333 1343 sa_property_t prop, int sep)
1334 1344 {
1335 1345 char *name;
1336 1346 char *value;
1337 1347 int curlen;
1338 1348 char *buff = *rbuff;
1339 1349 size_t buffsize = *rbuffsize;
1340 1350 int printed = B_FALSE;
1341 1351
1342 1352 name = sa_get_property_attr(prop, "type");
1343 1353 value = sa_get_property_attr(prop, "value");
1344 1354 if (buff != NULL)
1345 1355 curlen = strlen(buff);
1346 1356 else
1347 1357 curlen = 0;
1348 1358 if (name != NULL) {
1349 1359 int len;
1350 1360 len = strlen(name) + sep;
1351 1361
1352 1362 /*
1353 1363 * A future RFE would be to replace this with more
1354 1364 * generic code and to possibly handle more types.
1355 1365 */
1356 1366 switch (gettype(name)) {
1357 1367 case OPT_TYPE_BOOLEAN:
1358 1368 /*
1359 1369 * For NFS, boolean value of FALSE means it
1360 1370 * doesn't show up in the option list at all.
1361 1371 */
1362 1372 if (value != NULL && strcasecmp(value, "false") == 0)
1363 1373 goto skip;
1364 1374 if (value != NULL) {
1365 1375 sa_free_attr_string(value);
1366 1376 value = NULL;
1367 1377 }
1368 1378 break;
1369 1379 case OPT_TYPE_ACCLIST:
1370 1380 if (value != NULL && strcmp(value, "*") == 0) {
1371 1381 sa_free_attr_string(value);
1372 1382 value = NULL;
1373 1383 } else {
1374 1384 if (value != NULL)
1375 1385 len += 1 + strlen(value);
1376 1386 }
1377 1387 break;
1378 1388 case OPT_TYPE_LOGTAG:
1379 1389 if (value != NULL && strlen(value) == 0) {
1380 1390 sa_free_attr_string(value);
1381 1391 value = NULL;
1382 1392 } else {
1383 1393 if (value != NULL)
1384 1394 len += 1 + strlen(value);
1385 1395 }
1386 1396 break;
1387 1397 default:
1388 1398 if (value != NULL)
1389 1399 len += 1 + strlen(value);
1390 1400 break;
1391 1401 }
1392 1402 while (buffsize <= (curlen + len)) {
1393 1403 /* need more room */
1394 1404 buffsize += incr;
1395 1405 buff = realloc(buff, buffsize);
1396 1406 if (buff == NULL) {
1397 1407 /* realloc failed so free everything */
1398 1408 if (*rbuff != NULL)
1399 1409 free(*rbuff);
1400 1410 }
1401 1411 *rbuff = buff;
1402 1412 *rbuffsize = buffsize;
1403 1413 if (buff == NULL)
1404 1414 goto skip;
1405 1415
1406 1416 }
1407 1417
1408 1418 if (buff == NULL)
1409 1419 goto skip;
1410 1420
1411 1421 if (value == NULL) {
1412 1422 (void) snprintf(buff + curlen, buffsize - curlen,
1413 1423 "%s%s", sep ? "," : "", name);
1414 1424 } else {
1415 1425 (void) snprintf(buff + curlen, buffsize - curlen,
1416 1426 "%s%s=%s", sep ? "," : "",
1417 1427 name, value != NULL ? value : "");
1418 1428 }
1419 1429 printed = B_TRUE;
1420 1430 }
1421 1431 skip:
1422 1432 if (name != NULL)
1423 1433 sa_free_attr_string(name);
1424 1434 if (value != NULL)
1425 1435 sa_free_attr_string(value);
1426 1436 return (printed);
1427 1437 }
1428 1438
1429 1439 /*
1430 1440 * nfs_format_options(group, hier)
1431 1441 *
1432 1442 * format all the options on the group into an old-style option
1433 1443 * string. If hier is non-zero, walk up the tree to get inherited
1434 1444 * options.
1435 1445 */
1436 1446
1437 1447 static char *
1438 1448 nfs_format_options(sa_group_t group, int hier)
1439 1449 {
1440 1450 sa_optionset_t options = NULL;
1441 1451 sa_optionset_t secoptions = NULL;
1442 1452 sa_property_t prop, secprop;
1443 1453 sa_security_t security = NULL;
1444 1454 char *buff;
1445 1455 size_t buffsize;
1446 1456 char *sectype = NULL;
1447 1457 int sep = 0;
1448 1458
1449 1459
1450 1460 buff = malloc(OPT_CHUNK);
1451 1461 if (buff == NULL) {
1452 1462 return (NULL);
1453 1463 }
1454 1464
1455 1465 buff[0] = '\0';
1456 1466 buffsize = OPT_CHUNK;
1457 1467
1458 1468 /*
1459 1469 * We may have a an optionset relative to this item. format
1460 1470 * these if we find them and then add any security definitions.
1461 1471 */
1462 1472
1463 1473 options = sa_get_derived_optionset(group, "nfs", hier);
1464 1474
1465 1475 /*
1466 1476 * do the default set first but skip any option that is also
1467 1477 * in the protocol specific optionset.
1468 1478 */
1469 1479 if (options != NULL) {
1470 1480 for (prop = sa_get_property(options, NULL);
1471 1481 prop != NULL; prop = sa_get_next_property(prop)) {
1472 1482 /*
1473 1483 * use this one since we skipped any
1474 1484 * of these that were also in
1475 1485 * optdefault
1476 1486 */
1477 1487 if (nfs_sprint_option(&buff, &buffsize, OPT_CHUNK,
1478 1488 prop, sep))
1479 1489 sep = 1;
1480 1490 if (buff == NULL) {
1481 1491 /*
1482 1492 * buff could become NULL if there
1483 1493 * isn't enough memory for
1484 1494 * nfs_sprint_option to realloc()
1485 1495 * as necessary. We can't really
1486 1496 * do anything about it at this
1487 1497 * point so we return NULL. The
1488 1498 * caller should handle the
1489 1499 * failure.
1490 1500 */
1491 1501 if (options != NULL)
1492 1502 sa_free_derived_optionset(
1493 1503 options);
1494 1504 return (buff);
1495 1505 }
1496 1506 }
1497 1507 }
1498 1508 secoptions = (sa_optionset_t)sa_get_all_security_types(group,
1499 1509 "nfs", hier);
1500 1510 if (secoptions != NULL) {
1501 1511 for (secprop = sa_get_property(secoptions, NULL);
1502 1512 secprop != NULL;
1503 1513 secprop = sa_get_next_property(secprop)) {
1504 1514 sectype = sa_get_property_attr(secprop, "type");
1505 1515 security =
1506 1516 (sa_security_t)sa_get_derived_security(
1507 1517 group, sectype, "nfs", hier);
1508 1518 if (security != NULL) {
1509 1519 if (sectype != NULL) {
1510 1520 prop = sa_create_property(
1511 1521 "sec", sectype);
1512 1522 if (prop == NULL)
1513 1523 goto err;
1514 1524 if (nfs_sprint_option(&buff,
1515 1525 &buffsize, OPT_CHUNK, prop, sep))
1516 1526 sep = 1;
1517 1527 (void) sa_remove_property(prop);
1518 1528 if (buff == NULL)
1519 1529 goto err;
1520 1530 }
1521 1531 for (prop = sa_get_property(security,
1522 1532 NULL); prop != NULL;
1523 1533 prop = sa_get_next_property(prop)) {
1524 1534 if (nfs_sprint_option(&buff,
1525 1535 &buffsize, OPT_CHUNK, prop, sep))
1526 1536 sep = 1;
1527 1537 if (buff == NULL)
1528 1538 goto err;
1529 1539 }
1530 1540 sa_free_derived_optionset(security);
1531 1541 }
1532 1542 if (sectype != NULL)
1533 1543 sa_free_attr_string(sectype);
1534 1544 }
1535 1545 sa_free_derived_optionset(secoptions);
1536 1546 }
1537 1547
1538 1548 if (options != NULL)
1539 1549 sa_free_derived_optionset(options);
1540 1550 return (buff);
1541 1551
1542 1552 err:
1543 1553 /*
1544 1554 * If we couldn't allocate memory for option printing, we need
1545 1555 * to break out of the nested loops, cleanup and return NULL.
1546 1556 */
1547 1557 if (secoptions != NULL)
1548 1558 sa_free_derived_optionset(secoptions);
1549 1559 if (security != NULL)
1550 1560 sa_free_derived_optionset(security);
1551 1561 if (sectype != NULL)
1552 1562 sa_free_attr_string(sectype);
1553 1563 if (options != NULL)
1554 1564 sa_free_derived_optionset(options);
1555 1565 return (buff);
1556 1566 }
1557 1567
1558 1568 /*
1559 1569 * Append an entry to the nfslogtab file
1560 1570 */
1561 1571 static int
1562 1572 nfslogtab_add(char *dir, char *buffer, char *tag)
1563 1573 {
1564 1574 FILE *f;
1565 1575 struct logtab_ent lep;
1566 1576 int error = 0;
1567 1577
1568 1578 /*
1569 1579 * Open the file for update and create it if necessary.
1570 1580 * This may leave the I/O offset at the end of the file,
1571 1581 * so rewind back to the beginning of the file.
1572 1582 */
1573 1583 f = fopen(NFSLOGTAB, "a+");
1574 1584 if (f == NULL) {
1575 1585 error = errno;
1576 1586 goto out;
1577 1587 }
1578 1588 rewind(f);
1579 1589
1580 1590 if (lockf(fileno(f), F_LOCK, 0L) < 0) {
1581 1591 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1582 1592 "share complete, however failed to lock %s "
1583 1593 "for update: %s\n"), NFSLOGTAB, strerror(errno));
1584 1594 error = -1;
1585 1595 goto out;
1586 1596 }
1587 1597
1588 1598 if (logtab_deactivate_after_boot(f) == -1) {
1589 1599 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1590 1600 "share complete, however could not deactivate "
1591 1601 "entries in %s\n"), NFSLOGTAB);
1592 1602 error = -1;
1593 1603 goto out;
1594 1604 }
1595 1605
1596 1606 /*
1597 1607 * Remove entries matching buffer and sharepoint since we're
1598 1608 * going to replace it with perhaps an entry with a new tag.
1599 1609 */
1600 1610 if (logtab_rement(f, buffer, dir, NULL, -1)) {
1601 1611 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1602 1612 "share complete, however could not remove matching "
1603 1613 "entries in %s\n"), NFSLOGTAB);
1604 1614 error = -1;
1605 1615 goto out;
1606 1616 }
1607 1617
1608 1618 /*
1609 1619 * Deactivate all active entries matching this sharepoint
1610 1620 */
1611 1621 if (logtab_deactivate(f, NULL, dir, NULL)) {
1612 1622 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1613 1623 "share complete, however could not deactivate matching "
1614 1624 "entries in %s\n"), NFSLOGTAB);
1615 1625 error = -1;
1616 1626 goto out;
1617 1627 }
1618 1628
1619 1629 lep.le_buffer = buffer;
1620 1630 lep.le_path = dir;
1621 1631 lep.le_tag = tag;
1622 1632 lep.le_state = LES_ACTIVE;
1623 1633
1624 1634 /*
1625 1635 * Add new sharepoint / buffer location to nfslogtab
1626 1636 */
1627 1637 if (logtab_putent(f, &lep) < 0) {
1628 1638 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1629 1639 "share complete, however could not add %s to %s\n"),
1630 1640 dir, NFSLOGTAB);
1631 1641 error = -1;
1632 1642 }
1633 1643
1634 1644 out:
1635 1645 if (f != NULL)
1636 1646 (void) fclose(f);
1637 1647 return (error);
1638 1648 }
1639 1649
1640 1650 /*
1641 1651 * Deactivate an entry from the nfslogtab file
1642 1652 */
1643 1653 static int
1644 1654 nfslogtab_deactivate(char *path)
1645 1655 {
1646 1656 FILE *f;
1647 1657 int error = 0;
1648 1658
1649 1659 f = fopen(NFSLOGTAB, "r+");
1650 1660 if (f == NULL) {
1651 1661 error = errno;
1652 1662 goto out;
1653 1663 }
1654 1664 if (lockf(fileno(f), F_LOCK, 0L) < 0) {
1655 1665 error = errno;
1656 1666 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1657 1667 "share complete, however could not lock %s for "
1658 1668 "update: %s\n"), NFSLOGTAB, strerror(error));
1659 1669 goto out;
1660 1670 }
1661 1671 if (logtab_deactivate(f, NULL, path, NULL) == -1) {
1662 1672 error = -1;
1663 1673 (void) fprintf(stderr,
1664 1674 dgettext(TEXT_DOMAIN,
1665 1675 "share complete, however could not "
1666 1676 "deactivate %s in %s\n"), path, NFSLOGTAB);
1667 1677 goto out;
1668 1678 }
1669 1679
1670 1680 out: if (f != NULL)
1671 1681 (void) fclose(f);
1672 1682
1673 1683 return (error);
1674 1684 }
1675 1685
1676 1686 /*
1677 1687 * check_public(group, skipshare)
1678 1688 *
1679 1689 * Check the group for any shares that have the public property
1680 1690 * enabled. We skip "skipshare" since that is the one we are
1681 1691 * working with. This is a separate function to make handling
1682 1692 * subgroups simpler. Returns true if there is a share with public.
1683 1693 */
1684 1694 static int
1685 1695 check_public(sa_group_t group, sa_share_t skipshare)
1686 1696 {
1687 1697 int exists = B_FALSE;
1688 1698 sa_share_t share;
1689 1699 sa_optionset_t opt;
1690 1700 sa_property_t prop;
1691 1701 char *shared;
1692 1702
1693 1703 for (share = sa_get_share(group, NULL); share != NULL;
1694 1704 share = sa_get_next_share(share)) {
1695 1705 if (share == skipshare)
1696 1706 continue;
1697 1707
1698 1708 opt = sa_get_optionset(share, "nfs");
1699 1709 if (opt == NULL)
1700 1710 continue;
1701 1711 prop = sa_get_property(opt, "public");
1702 1712 if (prop == NULL)
1703 1713 continue;
1704 1714 shared = sa_get_share_attr(share, "shared");
1705 1715 if (shared != NULL) {
1706 1716 exists = strcmp(shared, "true") == 0;
1707 1717 sa_free_attr_string(shared);
1708 1718 if (exists == B_TRUE)
1709 1719 break;
1710 1720 }
1711 1721 }
1712 1722
1713 1723 return (exists);
1714 1724 }
1715 1725
1716 1726 /*
1717 1727 * public_exists(handle, skipshare)
1718 1728 *
1719 1729 * check to see if public option is set on any other share than the
1720 1730 * one specified. Need to check zfs sub-groups as well as the top
1721 1731 * level groups.
1722 1732 */
1723 1733 static int
1724 1734 public_exists(sa_handle_t handle, sa_share_t skipshare)
1725 1735 {
1726 1736 sa_group_t group = NULL;
1727 1737
1728 1738 /*
1729 1739 * If we don't have a handle, we can only do syntax check. We
1730 1740 * can't check against other shares so we assume OK and will
1731 1741 * catch the problem only when we actually try to apply it.
1732 1742 */
1733 1743 if (handle == NULL)
1734 1744 return (SA_OK);
1735 1745
1736 1746 if (skipshare != NULL) {
1737 1747 group = sa_get_parent_group(skipshare);
1738 1748 if (group == NULL)
1739 1749 return (SA_NO_SUCH_GROUP);
1740 1750 }
1741 1751
1742 1752 for (group = sa_get_group(handle, NULL); group != NULL;
1743 1753 group = sa_get_next_group(group)) {
1744 1754 /* Walk any ZFS subgroups as well as all standard groups */
1745 1755 if (sa_group_is_zfs(group)) {
1746 1756 sa_group_t subgroup;
1747 1757 for (subgroup = sa_get_sub_group(group);
1748 1758 subgroup != NULL;
1749 1759 subgroup = sa_get_next_group(subgroup)) {
1750 1760 if (check_public(subgroup, skipshare))
1751 1761 return (B_TRUE);
1752 1762 }
1753 1763 } else {
1754 1764 if (check_public(group, skipshare))
1755 1765 return (B_TRUE);
1756 1766 }
1757 1767 }
1758 1768 return (B_FALSE);
1759 1769 }
1760 1770
1761 1771 /*
1762 1772 * sa_enable_share at the protocol level, enable_share must tell the
1763 1773 * implementation that it is to enable the share. This entails
1764 1774 * converting the path and options into the appropriate ioctl
1765 1775 * calls. It is assumed that all error checking of paths, etc. were
1766 1776 * done earlier.
1767 1777 */
1768 1778 static int
1769 1779 nfs_enable_share(sa_share_t share)
1770 1780 {
1771 1781 struct exportdata export;
1772 1782 sa_optionset_t secoptlist;
1773 1783 struct secinfo *sp;
1774 1784 int num_secinfo;
1775 1785 sa_optionset_t opt;
1776 1786 sa_security_t sec;
1777 1787 sa_property_t prop;
1778 1788 char *path;
1779 1789 int err = SA_OK;
1780 1790 int i;
1781 1791 int iszfs;
1782 1792 sa_handle_t handle;
1783 1793
1784 1794 /* Don't drop core if the NFS module isn't loaded. */
1785 1795 (void) signal(SIGSYS, SIG_IGN);
1786 1796
1787 1797 /* get the path since it is important in several places */
1788 1798 path = sa_get_share_attr(share, "path");
1789 1799 if (path == NULL)
1790 1800 return (SA_NO_SUCH_PATH);
1791 1801
1792 1802 iszfs = sa_path_is_zfs(path);
1793 1803 /*
1794 1804 * find the optionsets and security sets. There may not be
1795 1805 * any or there could be one or two for each of optionset and
1796 1806 * security may have multiple, one per security type per
1797 1807 * protocol type.
1798 1808 */
1799 1809 opt = sa_get_derived_optionset(share, "nfs", 1);
1800 1810 secoptlist = (sa_optionset_t)sa_get_all_security_types(share, "nfs", 1);
1801 1811 if (secoptlist != NULL)
1802 1812 num_secinfo = MAX(1, count_security(secoptlist));
1803 1813 else
1804 1814 num_secinfo = 1;
1805 1815
1806 1816 /*
1807 1817 * walk through the options and fill in the structure
1808 1818 * appropriately.
1809 1819 */
1810 1820
1811 1821 (void) memset(&export, '\0', sizeof (export));
1812 1822
1813 1823 /*
1814 1824 * do non-security options first since there is only one after
1815 1825 * the derived group is constructed.
1816 1826 */
1817 1827 export.ex_version = EX_CURRENT_VERSION;
1818 1828 export.ex_anon = UID_NOBODY; /* this is our default value */
1819 1829 export.ex_index = NULL;
1820 1830 export.ex_path = path;
1821 1831 export.ex_pathlen = strlen(path) + 1;
1822 1832
1823 1833 if (opt != NULL)
1824 1834 err = fill_export_from_optionset(&export, opt);
1825 1835
1826 1836 /*
1827 1837 * check to see if "public" is set. If it is, then make sure
1828 1838 * no other share has it set. If it is already used, fail.
1829 1839 */
1830 1840
1831 1841 handle = sa_find_group_handle((sa_group_t)share);
1832 1842 if (export.ex_flags & EX_PUBLIC && public_exists(handle, share)) {
1833 1843 (void) printf(dgettext(TEXT_DOMAIN,
1834 1844 "NFS: Cannot share more than one file "
1835 1845 "system with 'public' property\n"));
1836 1846 err = SA_NOT_ALLOWED;
1837 1847 goto out;
1838 1848 }
1839 1849
1840 1850 sp = calloc(num_secinfo, sizeof (struct secinfo));
1841 1851 if (sp == NULL) {
1842 1852 err = SA_NO_MEMORY;
1843 1853 (void) printf(dgettext(TEXT_DOMAIN,
1844 1854 "NFS: NFS: no memory for security\n"));
1845 1855 goto out;
1846 1856 }
1847 1857 export.ex_secinfo = sp;
1848 1858 /* get default secinfo */
1849 1859 export.ex_seccnt = num_secinfo;
1850 1860 /*
1851 1861 * since we must have one security option defined, we
1852 1862 * init to the default and then override as we find
1853 1863 * defined security options. This handles the case
1854 1864 * where we have no defined options but we need to set
1855 1865 * up one.
1856 1866 */
1857 1867 sp[0].s_window = DEF_WIN;
1858 1868 sp[0].s_rootnames = NULL;
1859 1869 /* setup a default in case no properties defined */
1860 1870 if (nfs_getseconfig_default(&sp[0].s_secinfo)) {
1861 1871 (void) printf(dgettext(TEXT_DOMAIN,
1862 1872 "NFS: nfs_getseconfig_default: failed to "
1863 1873 "get default security mode\n"));
1864 1874 err = SA_CONFIG_ERR;
1865 1875 }
1866 1876 if (secoptlist != NULL) {
1867 1877 for (i = 0, prop = sa_get_property(secoptlist, NULL);
1868 1878 prop != NULL && i < num_secinfo;
1869 1879 prop = sa_get_next_property(prop), i++) {
1870 1880 char *sectype;
1871 1881 sectype = sa_get_property_attr(prop, "type");
1872 1882 /*
1873 1883 * if sectype is NULL, we probably
1874 1884 * have a memory problem and can't get
1875 1885 * the correct values. Rather than
1876 1886 * exporting with incorrect security,
1877 1887 * don't share it.
1878 1888 */
1879 1889 if (sectype == NULL) {
1880 1890 err = SA_NO_MEMORY;
1881 1891 (void) printf(dgettext(TEXT_DOMAIN,
1882 1892 "NFS: Cannot share %s: "
1883 1893 "no memory\n"), path);
1884 1894 goto out;
1885 1895 }
1886 1896 sec = (sa_security_t)sa_get_derived_security(
1887 1897 share, sectype, "nfs", 1);
1888 1898 sp[i].s_window = DEF_WIN;
1889 1899 sp[i].s_rootcnt = 0;
1890 1900 sp[i].s_rootnames = NULL;
1891 1901 (void) fill_security_from_secopts(&sp[i], sec);
1892 1902 if (sec != NULL)
1893 1903 sa_free_derived_security(sec);
1894 1904 if (sectype != NULL)
1895 1905 sa_free_attr_string(sectype);
1896 1906 }
1897 1907 }
1898 1908 /*
1899 1909 * when we get here, we can do the exportfs system call and
1900 1910 * initiate things. We probably want to enable the
1901 1911 * svc:/network/nfs/server service first if it isn't running.
1902 1912 */
1903 1913 /* check svc:/network/nfs/server status and start if needed */
1904 1914 /* now add the share to the internal tables */
1905 1915 printarg(path, &export);
1906 1916 /*
1907 1917 * call the exportfs system call which is implemented
1908 1918 * via the nfssys() call as the EXPORTFS subfunction.
1909 1919 */
1910 1920 if (iszfs) {
1911 1921 struct exportfs_args ea;
1912 1922 share_t sh;
1913 1923 char *str;
1914 1924 priv_set_t *priv_effective;
1915 1925 int privileged;
1916 1926
1917 1927 /*
1918 1928 * If we aren't a privileged user
1919 1929 * and NFS server service isn't running
1920 1930 * then print out an error message
1921 1931 * and return EPERM
1922 1932 */
1923 1933
1924 1934 priv_effective = priv_allocset();
1925 1935 (void) getppriv(PRIV_EFFECTIVE, priv_effective);
1926 1936
1927 1937 privileged = (priv_isfullset(priv_effective) == B_TRUE);
1928 1938 priv_freeset(priv_effective);
1929 1939
1930 1940 if (!privileged &&
1931 1941 (str = smf_get_state(NFS_SERVER_SVC)) != NULL) {
1932 1942 err = 0;
1933 1943 if (strcmp(str, SCF_STATE_STRING_ONLINE) != 0) {
1934 1944 (void) printf(dgettext(TEXT_DOMAIN,
1935 1945 "NFS: Cannot share remote "
1936 1946 "filesystem: %s\n"), path);
1937 1947 (void) printf(dgettext(TEXT_DOMAIN,
1938 1948 "NFS: Service needs to be enabled "
1939 1949 "by a privileged user\n"));
1940 1950 err = SA_SYSTEM_ERR;
1941 1951 errno = EPERM;
1942 1952 }
1943 1953 free(str);
1944 1954 }
1945 1955
1946 1956 if (err == 0) {
1947 1957 ea.dname = path;
1948 1958 ea.uex = &export;
1949 1959
1950 1960 (void) sa_sharetab_fill_zfs(share, &sh, "nfs");
1951 1961 err = sa_share_zfs(share, NULL, path, &sh,
1952 1962 &ea, ZFS_SHARE_NFS);
1953 1963 if (err != SA_OK) {
1954 1964 errno = err;
1955 1965 err = -1;
1956 1966 }
1957 1967 sa_emptyshare(&sh);
1958 1968 }
1959 1969 } else {
1960 1970 err = exportfs(path, &export);
1961 1971 }
1962 1972
1963 1973 if (err < 0) {
1964 1974 err = SA_SYSTEM_ERR;
1965 1975 switch (errno) {
1966 1976 case EREMOTE:
1967 1977 (void) printf(dgettext(TEXT_DOMAIN,
1968 1978 "NFS: Cannot share filesystems "
1969 1979 "in non-global zones: %s\n"), path);
1970 1980 err = SA_NOT_SUPPORTED;
1971 1981 break;
1972 1982 case EPERM:
1973 1983 if (getzoneid() != GLOBAL_ZONEID) {
1974 1984 (void) printf(dgettext(TEXT_DOMAIN,
1975 1985 "NFS: Cannot share file systems "
1976 1986 "in non-global zones: %s\n"), path);
1977 1987 err = SA_NOT_SUPPORTED;
1978 1988 break;
1979 1989 }
1980 1990 err = SA_NO_PERMISSION;
1981 1991 break;
1982 1992 case EEXIST:
1983 1993 err = SA_SHARE_EXISTS;
1984 1994 break;
1985 1995 default:
1986 1996 break;
1987 1997 }
1988 1998 } else {
1989 1999 /* update sharetab with an add/modify */
1990 2000 if (!iszfs) {
1991 2001 (void) sa_update_sharetab(share, "nfs");
1992 2002 }
1993 2003 }
1994 2004
1995 2005 if (err == SA_OK) {
1996 2006 /*
1997 2007 * enable services as needed. This should probably be
1998 2008 * done elsewhere in order to minimize the calls to
1999 2009 * check services.
2000 2010 */
2001 2011 /*
2002 2012 * check to see if logging and other services need to
2003 2013 * be triggered, but only if there wasn't an
2004 2014 * error. This is probably where sharetab should be
2005 2015 * updated with the NFS specific entry.
2006 2016 */
2007 2017 if (export.ex_flags & EX_LOG) {
2008 2018 /* enable logging */
2009 2019 if (nfslogtab_add(path, export.ex_log_buffer,
2010 2020 export.ex_tag) != 0) {
2011 2021 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
2012 2022 "Could not enable logging for %s\n"),
2013 2023 path);
2014 2024 }
2015 2025 _check_services(service_list_logging);
2016 2026 } else {
2017 2027 /*
2018 2028 * don't have logging so remove it from file. It might
2019 2029 * not be thre, but that doesn't matter.
2020 2030 */
2021 2031 (void) nfslogtab_deactivate(path);
2022 2032 _check_services(service_list_default);
2023 2033 }
2024 2034 }
2025 2035
2026 2036 out:
2027 2037 if (path != NULL)
2028 2038 free(path);
2029 2039
2030 2040 cleanup_export(&export);
2031 2041 if (opt != NULL)
2032 2042 sa_free_derived_optionset(opt);
2033 2043 if (secoptlist != NULL)
2034 2044 (void) sa_destroy_optionset(secoptlist);
2035 2045 return (err);
2036 2046 }
2037 2047
2038 2048 /*
2039 2049 * nfs_disable_share(share, path)
2040 2050 *
2041 2051 * Unshare the specified share. Note that "path" is the same path as
2042 2052 * what is in the "share" object. It is passed in to avoid an
2043 2053 * additional lookup. A missing "path" value makes this a no-op
2044 2054 * function.
2045 2055 */
2046 2056 static int
2047 2057 nfs_disable_share(sa_share_t share, char *path)
2048 2058 {
2049 2059 int err;
2050 2060 int ret = SA_OK;
2051 2061 int iszfs;
2052 2062 sa_group_t parent;
2053 2063 sa_handle_t handle;
2054 2064
2055 2065 if (path == NULL)
2056 2066 return (ret);
2057 2067
2058 2068 /*
2059 2069 * If the share is in a ZFS group we need to handle it
2060 2070 * differently. Just being on a ZFS file system isn't
2061 2071 * enough since we may be in a legacy share case.
2062 2072 */
2063 2073 parent = sa_get_parent_group(share);
2064 2074 iszfs = sa_group_is_zfs(parent);
2065 2075 if (iszfs) {
2066 2076 struct exportfs_args ea;
2067 2077 share_t sh = { 0 };
2068 2078 ea.dname = path;
2069 2079 ea.uex = NULL;
2070 2080 sh.sh_path = path;
2071 2081 sh.sh_fstype = "nfs";
2072 2082
2073 2083 err = sa_share_zfs(share, NULL, path, &sh,
2074 2084 &ea, ZFS_UNSHARE_NFS);
2075 2085 if (err != SA_OK) {
2076 2086 errno = err;
2077 2087 err = -1;
2078 2088 }
2079 2089 } else {
2080 2090 err = exportfs(path, NULL);
2081 2091 }
2082 2092 if (err < 0) {
2083 2093 /*
2084 2094 * TBD: only an error in some
2085 2095 * cases - need better analysis
2086 2096 */
2087 2097 switch (errno) {
2088 2098 case EPERM:
2089 2099 case EACCES:
2090 2100 ret = SA_NO_PERMISSION;
2091 2101 if (getzoneid() != GLOBAL_ZONEID) {
2092 2102 ret = SA_NOT_SUPPORTED;
2093 2103 }
2094 2104 break;
2095 2105 case EINVAL:
2096 2106 case ENOENT:
2097 2107 ret = SA_NO_SUCH_PATH;
2098 2108 break;
2099 2109 default:
2100 2110 ret = SA_SYSTEM_ERR;
2101 2111 break;
2102 2112 }
2103 2113 }
2104 2114 if (ret == SA_OK || ret == SA_NO_SUCH_PATH) {
2105 2115 handle = sa_find_group_handle((sa_group_t)share);
2106 2116 if (!iszfs)
2107 2117 (void) sa_delete_sharetab(handle, path, "nfs");
2108 2118 /* just in case it was logged */
2109 2119 (void) nfslogtab_deactivate(path);
2110 2120 }
2111 2121 return (ret);
2112 2122 }
2113 2123
2114 2124 static int
2115 2125 check_user(char *value)
2116 2126 {
2117 2127 int ret = SA_OK;
2118 2128
2119 2129 if (!is_a_number(value)) {
2120 2130 struct passwd *pw;
2121 2131 /*
2122 2132 * in this case it would have to be a
2123 2133 * user name
2124 2134 */
2125 2135 pw = getpwnam(value);
2126 2136 if (pw == NULL)
2127 2137 ret = SA_BAD_VALUE;
2128 2138 endpwent();
2129 2139 } else {
2130 2140 uint64_t intval;
2131 2141 intval = strtoull(value, NULL, 0);
2132 2142 if (intval > UID_MAX && intval != -1)
2133 2143 ret = SA_BAD_VALUE;
2134 2144 }
2135 2145
2136 2146 return (ret);
2137 2147 }
2138 2148
2139 2149 static int
2140 2150 check_group(char *value)
2141 2151 {
2142 2152 int ret = SA_OK;
2143 2153
2144 2154 if (!is_a_number(value)) {
2145 2155 struct group *gr;
2146 2156 /*
2147 2157 * in this case it would have to be a
2148 2158 * group name
2149 2159 */
2150 2160 gr = getgrnam(value);
2151 2161 if (gr == NULL)
2152 2162 ret = SA_BAD_VALUE;
2153 2163 endgrent();
2154 2164 } else {
2155 2165 uint64_t intval;
2156 2166 intval = strtoull(value, NULL, 0);
2157 2167 if (intval > UID_MAX && intval != -1)
2158 2168 ret = SA_BAD_VALUE;
2159 2169 }
2160 2170
2161 2171 return (ret);
2162 2172 }
2163 2173
2164 2174 /*
2165 2175 * check_rorwnone(v1, v2, v3)
2166 2176 *
2167 2177 * check ro vs rw vs none values. Over time this may get beefed up.
2168 2178 * for now it just does simple checks. v1 is never NULL but v2 or v3
2169 2179 * could be.
2170 2180 */
2171 2181
2172 2182 static int
2173 2183 check_rorwnone(char *v1, char *v2, char *v3)
2174 2184 {
2175 2185 int ret = SA_OK;
2176 2186 if (v2 != NULL && strcmp(v1, v2) == 0)
2177 2187 ret = SA_VALUE_CONFLICT;
2178 2188 else if (v3 != NULL && strcmp(v1, v3) == 0)
2179 2189 ret = SA_VALUE_CONFLICT;
2180 2190
2181 2191 return (ret);
2182 2192 }
2183 2193
2184 2194 /*
2185 2195 * nfs_validate_property(handle, property, parent)
2186 2196 *
2187 2197 * Check that the property has a legitimate value for its type.
2188 2198 */
2189 2199
2190 2200 static int
2191 2201 nfs_validate_property(sa_handle_t handle, sa_property_t property,
2192 2202 sa_optionset_t parent)
2193 2203 {
2194 2204 int ret = SA_OK;
2195 2205 char *propname;
2196 2206 char *other1;
2197 2207 char *other2;
2198 2208 int optindex;
2199 2209 nfsl_config_t *configlist;
2200 2210 sa_group_t parent_group;
2201 2211 char *value;
2202 2212
2203 2213 propname = sa_get_property_attr(property, "type");
2204 2214
2205 2215 if ((optindex = findopt(propname)) < 0)
2206 2216 ret = SA_NO_SUCH_PROP;
2207 2217
2208 2218 /* need to validate value range here as well */
2209 2219
2210 2220 if (ret == SA_OK) {
2211 2221 parent_group = sa_get_parent_group((sa_share_t)parent);
2212 2222 if (optdefs[optindex].share && parent_group != NULL &&
2213 2223 !sa_is_share(parent_group))
2214 2224 ret = SA_PROP_SHARE_ONLY;
2215 2225 }
2216 2226 if (ret == SA_OK) {
2217 2227 if (optdefs[optindex].index == OPT_PUBLIC) {
2218 2228 /*
2219 2229 * Public is special in that only one instance can
2220 2230 * be in the repository at the same time.
2221 2231 */
2222 2232 if (public_exists(handle, parent_group)) {
2223 2233 sa_free_attr_string(propname);
2224 2234 return (SA_VALUE_CONFLICT);
2225 2235 }
2226 2236 }
2227 2237 value = sa_get_property_attr(property, "value");
2228 2238 if (value != NULL) {
2229 2239 /* first basic type checking */
2230 2240 switch (optdefs[optindex].type) {
2231 2241
2232 2242 case OPT_TYPE_NUMBER:
2233 2243 /* check that the value is all digits */
2234 2244 if (!is_a_number(value))
2235 2245 ret = SA_BAD_VALUE;
2236 2246 break;
2237 2247
2238 2248 case OPT_TYPE_BOOLEAN:
2239 2249 if (strlen(value) == 0 ||
2240 2250 strcasecmp(value, "true") == 0 ||
2241 2251 strcmp(value, "1") == 0 ||
2242 2252 strcasecmp(value, "false") == 0 ||
2243 2253 strcmp(value, "0") == 0) {
2244 2254 ret = SA_OK;
2245 2255 } else {
2246 2256 ret = SA_BAD_VALUE;
2247 2257 }
2248 2258 break;
2249 2259
2250 2260 case OPT_TYPE_USER:
2251 2261 ret = check_user(value);
2252 2262 break;
2253 2263
2254 2264 case OPT_TYPE_FILE:
2255 2265 if (strcmp(value, "..") == 0 ||
2256 2266 strchr(value, '/') != NULL) {
2257 2267 ret = SA_BAD_VALUE;
2258 2268 }
2259 2269 break;
2260 2270
2261 2271 case OPT_TYPE_ACCLIST: {
2262 2272 sa_property_t oprop1;
2263 2273 sa_property_t oprop2;
2264 2274 char *ovalue1 = NULL;
2265 2275 char *ovalue2 = NULL;
2266 2276
2267 2277 if (parent == NULL)
2268 2278 break;
2269 2279 /*
2270 2280 * access list handling. Should eventually
2271 2281 * validate that all the values make sense.
2272 2282 * Also, ro and rw may have cross value
2273 2283 * conflicts.
2274 2284 */
2275 2285 if (strcmp(propname, SHOPT_RO) == 0) {
2276 2286 other1 = SHOPT_RW;
2277 2287 other2 = SHOPT_NONE;
2278 2288 } else if (strcmp(propname, SHOPT_RW) == 0) {
2279 2289 other1 = SHOPT_RO;
2280 2290 other2 = SHOPT_NONE;
2281 2291 } else if (strcmp(propname, SHOPT_NONE) == 0) {
2282 2292 other1 = SHOPT_RO;
2283 2293 other2 = SHOPT_RW;
2284 2294 } else {
2285 2295 other1 = NULL;
2286 2296 other2 = NULL;
2287 2297 }
2288 2298 if (other1 == NULL && other2 == NULL)
2289 2299 break;
2290 2300
2291 2301 /* compare rw(ro) with ro(rw) */
2292 2302
2293 2303 oprop1 = sa_get_property(parent, other1);
2294 2304 oprop2 = sa_get_property(parent, other2);
2295 2305 if (oprop1 == NULL && oprop2 == NULL)
2296 2306 break;
2297 2307 /*
2298 2308 * Only potential confusion if other1
2299 2309 * or other2 exists. Check the values
2300 2310 * and run the check if there is a
2301 2311 * value other than the one we are
2302 2312 * explicitly looking at.
2303 2313 */
2304 2314 ovalue1 = sa_get_property_attr(oprop1, "value");
2305 2315 ovalue2 = sa_get_property_attr(oprop2, "value");
2306 2316 if (ovalue1 != NULL || ovalue2 != NULL)
2307 2317 ret = check_rorwnone(value, ovalue1,
2308 2318 ovalue2);
2309 2319
2310 2320 if (ovalue1 != NULL)
2311 2321 sa_free_attr_string(ovalue1);
2312 2322 if (ovalue2 != NULL)
2313 2323 sa_free_attr_string(ovalue2);
2314 2324 break;
2315 2325 }
2316 2326
2317 2327 case OPT_TYPE_LOGTAG:
2318 2328 if (nfsl_getconfig_list(&configlist) == 0) {
2319 2329 int error;
2320 2330 if (value == NULL ||
2321 2331 strlen(value) == 0) {
2322 2332 if (value != NULL)
2323 2333 sa_free_attr_string(
2324 2334 value);
2325 2335 value = strdup("global");
2326 2336 }
2327 2337 if (value != NULL &&
2328 2338 nfsl_findconfig(configlist, value,
2329 2339 &error) == NULL) {
2330 2340 ret = SA_BAD_VALUE;
2331 2341 }
2332 2342 /* Must always free when done */
2333 2343 nfsl_freeconfig_list(&configlist);
2334 2344 } else {
2335 2345 ret = SA_CONFIG_ERR;
2336 2346 }
2337 2347 break;
2338 2348
2339 2349 case OPT_TYPE_STRING:
2340 2350 /* whatever is here should be ok */
2341 2351 break;
2342 2352
2343 2353 case OPT_TYPE_SECURITY:
2344 2354 /*
2345 2355 * The "sec" property isn't used in the
2346 2356 * non-legacy parts of sharemgr. We need to
2347 2357 * reject it here. For legacy, it is pulled
2348 2358 * out well before we get here.
2349 2359 */
2350 2360 ret = SA_NO_SUCH_PROP;
2351 2361 break;
2352 2362
2353 2363 case OPT_TYPE_MAPPING: {
2354 2364 char *p;
2355 2365 char *n;
2356 2366 char *c;
2357 2367 int (*f)(char *);
2358 2368
2359 2369 sa_security_t security;
2360 2370
2361 2371 /*
2362 2372 * mapping is only supported for sec=sys
2363 2373 */
2364 2374 ret = SA_CONFIG_ERR;
2365 2375 if (parent_group == NULL)
2366 2376 break;
2367 2377
2368 2378 for (security = sa_get_security(parent_group,
2369 2379 NULL, NULL); security != NULL;
2370 2380 security = sa_get_next_security(security)) {
2371 2381 char *type;
2372 2382 char *sectype;
2373 2383
2374 2384 type = sa_get_security_attr(security,
2375 2385 "type");
2376 2386 if (type == NULL)
2377 2387 continue;
2378 2388
2379 2389 if (strcmp(type, "nfs") != 0) {
2380 2390 sa_free_attr_string(type);
2381 2391 continue;
2382 2392 }
2383 2393 sa_free_attr_string(type);
2384 2394
2385 2395 sectype = sa_get_security_attr(security,
2386 2396 "sectype");
2387 2397 if (sectype == NULL)
2388 2398 continue;
2389 2399
2390 2400 if (strcmp(sectype, "sys") != 0) {
2391 2401 sa_free_attr_string(sectype);
2392 2402 ret = SA_CONFIG_ERR;
2393 2403 break;
2394 2404 }
2395 2405 sa_free_attr_string(sectype);
2396 2406 ret = SA_OK;
2397 2407 }
2398 2408
2399 2409 if (ret != SA_OK)
2400 2410 break;
2401 2411
2402 2412 assert(optindex == OPT_UIDMAP ||
2403 2413 optindex == OPT_GIDMAP);
2404 2414 f = optindex == OPT_UIDMAP ? check_user :
2405 2415 check_group;
2406 2416
2407 2417
2408 2418 p = strdup(value);
2409 2419 if (p == NULL)
2410 2420 ret = SA_BAD_VALUE;
2411 2421
2412 2422 for (c = p; ret == SA_OK && c != NULL; c = n) {
2413 2423 char *s;
2414 2424 char *t;
2415 2425
2416 2426 n = strchr(c, '~');
2417 2427 if (n != NULL)
2418 2428 *n++ = '\0';
2419 2429
2420 2430 s = strchr(c, ':');
2421 2431 if (s != NULL) {
2422 2432 *s++ = '\0';
2423 2433 t = strchr(s, ':');
2424 2434 if (t != NULL)
2425 2435 *t = '\0';
2426 2436 }
2427 2437
2428 2438 if (s == NULL || t == NULL)
2429 2439 ret = SA_BAD_VALUE;
2430 2440
2431 2441 if (ret == SA_OK && *c != '\0' &&
2432 2442 strcmp(c, "*") != 0)
2433 2443 ret = f(c);
2434 2444
2435 2445 if (ret == SA_OK && *s != '\0' &&
2436 2446 strcmp(s, "-1") != 0)
2437 2447 ret = f(s);
2438 2448 }
2439 2449
2440 2450 free(p);
2441 2451
2442 2452 break;
2443 2453 }
2444 2454
2445 2455 default:
2446 2456 break;
2447 2457 }
2448 2458
2449 2459 if (value != NULL)
2450 2460 sa_free_attr_string(value);
2451 2461
2452 2462 if (ret == SA_OK && optdefs[optindex].check != NULL) {
2453 2463 /* do the property specific check */
2454 2464 ret = optdefs[optindex].check(handle, property);
2455 2465 }
2456 2466 }
2457 2467 }
2458 2468
2459 2469 if (propname != NULL)
2460 2470 sa_free_attr_string(propname);
2461 2471 return (ret);
2462 2472 }
2463 2473
2464 2474 /*
2465 2475 * Protocol management functions
2466 2476 *
2467 2477 * Properties defined in the default files are defined in
2468 2478 * proto_option_defs for parsing and validation. If "other" and
2469 2479 * "compare" are set, then the value for this property should be
2470 2480 * compared against the property specified in "other" using the
2471 2481 * "compare" check (either <= or >=) in order to ensure that the
2472 2482 * values are in the correct range. E.g. setting server_versmin
2473 2483 * higher than server_versmax should not be allowed.
2474 2484 */
2475 2485
2476 2486 struct proto_option_defs {
2477 2487 char *tag;
2478 2488 char *name; /* display name -- remove protocol identifier */
2479 2489 int index;
2480 2490 int type;
2481 2491 union {
2482 2492 int intval;
2483 2493 char *string;
2484 2494 } defvalue;
2485 2495 uint32_t svcs;
2486 2496 int32_t minval;
2487 2497 int32_t maxval;
2488 2498 char *other;
2489 2499 int compare;
2490 2500 #define OPT_CMP_GE 0
2491 2501 #define OPT_CMP_LE 1
2492 2502 int (*check)(char *);
2493 2503 } proto_options[] = {
2494 2504 #define PROTO_OPT_NFSD_SERVERS 0
2495 2505 {"nfsd_servers",
2496 2506 "servers", PROTO_OPT_NFSD_SERVERS, OPT_TYPE_NUMBER, 1024, SVC_NFSD,
2497 2507 1, INT32_MAX},
2498 2508 #define PROTO_OPT_LOCKD_LISTEN_BACKLOG 1
2499 2509 {"lockd_listen_backlog",
2500 2510 "lockd_listen_backlog", PROTO_OPT_LOCKD_LISTEN_BACKLOG,
2501 2511 OPT_TYPE_NUMBER, 32, SVC_LOCKD, 32, INT32_MAX},
2502 2512 #define PROTO_OPT_LOCKD_SERVERS 2
2503 2513 {"lockd_servers",
2504 2514 "lockd_servers", PROTO_OPT_LOCKD_SERVERS, OPT_TYPE_NUMBER, 256,
2505 2515 SVC_LOCKD, 1, INT32_MAX},
2506 2516 #define PROTO_OPT_LOCKD_RETRANSMIT_TIMEOUT 3
2507 2517 {"lockd_retransmit_timeout",
2508 2518 "lockd_retransmit_timeout", PROTO_OPT_LOCKD_RETRANSMIT_TIMEOUT,
2509 2519 OPT_TYPE_NUMBER, 5, SVC_LOCKD, 0, INT32_MAX},
2510 2520 #define PROTO_OPT_GRACE_PERIOD 4
2511 2521 {"grace_period",
2512 2522 "grace_period", PROTO_OPT_GRACE_PERIOD, OPT_TYPE_NUMBER, 90,
2513 2523 SVC_LOCKD, 0, INT32_MAX},
2514 2524 #define PROTO_OPT_NFS_SERVER_VERSMIN 5
2515 2525 {"nfs_server_versmin",
2516 2526 "server_versmin", PROTO_OPT_NFS_SERVER_VERSMIN, OPT_TYPE_NUMBER,
2517 2527 (int)NFS_VERSMIN_DEFAULT, SVC_NFSD|SVC_MOUNTD, NFS_VERSMIN,
2518 2528 NFS_VERSMAX, "server_versmax", OPT_CMP_LE},
2519 2529 #define PROTO_OPT_NFS_SERVER_VERSMAX 6
2520 2530 {"nfs_server_versmax",
2521 2531 "server_versmax", PROTO_OPT_NFS_SERVER_VERSMAX, OPT_TYPE_NUMBER,
2522 2532 (int)NFS_VERSMAX_DEFAULT, SVC_NFSD|SVC_MOUNTD, NFS_VERSMIN,
2523 2533 NFS_VERSMAX, "server_versmin", OPT_CMP_GE},
2524 2534 #define PROTO_OPT_NFS_CLIENT_VERSMIN 7
2525 2535 {"nfs_client_versmin",
2526 2536 "client_versmin", PROTO_OPT_NFS_CLIENT_VERSMIN, OPT_TYPE_NUMBER,
2527 2537 (int)NFS_VERSMIN_DEFAULT, SVC_CLIENT, NFS_VERSMIN, NFS_VERSMAX,
2528 2538 "client_versmax", OPT_CMP_LE},
2529 2539 #define PROTO_OPT_NFS_CLIENT_VERSMAX 8
2530 2540 {"nfs_client_versmax",
2531 2541 "client_versmax", PROTO_OPT_NFS_CLIENT_VERSMAX, OPT_TYPE_NUMBER,
2532 2542 (int)NFS_VERSMAX_DEFAULT, SVC_CLIENT, NFS_VERSMIN, NFS_VERSMAX,
2533 2543 "client_versmin", OPT_CMP_GE},
2534 2544 #define PROTO_OPT_NFS_SERVER_DELEGATION 9
2535 2545 {"nfs_server_delegation",
2536 2546 "server_delegation", PROTO_OPT_NFS_SERVER_DELEGATION,
2537 2547 OPT_TYPE_ONOFF, NFS_SERVER_DELEGATION_DEFAULT, SVC_NFSD, 0, 0},
2538 2548 #define PROTO_OPT_NFSMAPID_DOMAIN 10
2539 2549 {"nfsmapid_domain",
2540 2550 "nfsmapid_domain", PROTO_OPT_NFSMAPID_DOMAIN, OPT_TYPE_DOMAIN,
2541 2551 0, SVC_NFSMAPID, 0, 0},
2542 2552 #define PROTO_OPT_NFSD_MAX_CONNECTIONS 11
2543 2553 {"nfsd_max_connections",
2544 2554 "max_connections", PROTO_OPT_NFSD_MAX_CONNECTIONS,
2545 2555 OPT_TYPE_NUMBER, -1, SVC_NFSD, -1, INT32_MAX},
2546 2556 #define PROTO_OPT_NFSD_PROTOCOL 12
2547 2557 {"nfsd_protocol",
2548 2558 "protocol", PROTO_OPT_NFSD_PROTOCOL, OPT_TYPE_PROTOCOL, 0,
2549 2559 SVC_NFSD, 0, 0},
2550 2560 #define PROTO_OPT_NFSD_LISTEN_BACKLOG 13
2551 2561 {"nfsd_listen_backlog",
2552 2562 "listen_backlog", PROTO_OPT_NFSD_LISTEN_BACKLOG,
2553 2563 OPT_TYPE_NUMBER, 0, SVC_NFSD, 0, INT32_MAX},
2554 2564 #define PROTO_OPT_NFSD_DEVICE 14
2555 2565 {"nfsd_device",
2556 2566 "device", PROTO_OPT_NFSD_DEVICE,
2557 2567 OPT_TYPE_STRING, 0, SVC_NFSD, 0, 0},
2558 2568 #define PROTO_OPT_MOUNTD_LISTEN_BACKLOG 15
2559 2569 {"mountd_listen_backlog",
2560 2570 "mountd_listen_backlog", PROTO_OPT_MOUNTD_LISTEN_BACKLOG,
2561 2571 OPT_TYPE_NUMBER, 64, SVC_NFSD|SVC_MOUNTD, 1, INT32_MAX},
2562 2572 #define PROTO_OPT_MOUNTD_MAX_THREADS 16
2563 2573 {"mountd_max_threads",
2564 2574 "mountd_max_threads", PROTO_OPT_MOUNTD_MAX_THREADS,
2565 2575 OPT_TYPE_NUMBER, 16, SVC_NFSD|SVC_MOUNTD, 1, INT32_MAX},
2566 2576 #define PROTO_OPT_MOUNTD_PORT 17
2567 2577 {"mountd_port",
2568 2578 "mountd_port", PROTO_OPT_MOUNTD_PORT,
2569 2579 OPT_TYPE_NUMBER, 0, SVC_MOUNTD, 1, UINT16_MAX},
2570 2580 #define PROTO_OPT_STATD_PORT 18
2571 2581 {"statd_port",
2572 2582 "statd_port", PROTO_OPT_STATD_PORT,
2573 2583 OPT_TYPE_NUMBER, 0, SVC_STATD, 1, UINT16_MAX},
2574 2584 {NULL}
2575 2585 };
2576 2586
2577 2587 /*
2578 2588 * the protoset holds the defined options so we don't have to read
2579 2589 * them multiple times
2580 2590 */
2581 2591 static sa_protocol_properties_t protoset;
2582 2592
2583 2593 static int
2584 2594 findprotoopt(char *name, int whichname)
2585 2595 {
2586 2596 int i;
2587 2597 for (i = 0; proto_options[i].tag != NULL; i++) {
2588 2598 if (whichname == 1) {
2589 2599 if (strcasecmp(proto_options[i].name, name) == 0)
2590 2600 return (i);
2591 2601 } else {
2592 2602 if (strcasecmp(proto_options[i].tag, name) == 0)
2593 2603 return (i);
2594 2604 }
2595 2605 }
2596 2606 return (-1);
2597 2607 }
2598 2608
2599 2609 /*
2600 2610 * fixcaselower(str)
2601 2611 *
2602 2612 * convert a string to lower case (inplace).
2603 2613 */
2604 2614
2605 2615 static void
2606 2616 fixcaselower(char *str)
2607 2617 {
2608 2618 while (*str) {
2609 2619 *str = tolower(*str);
2610 2620 str++;
2611 2621 }
2612 2622 }
2613 2623
2614 2624 /*
2615 2625 * skipwhitespace(str)
2616 2626 *
2617 2627 * Skip leading white space. It is assumed that it is called with a
2618 2628 * valid pointer.
2619 2629 */
2620 2630
2621 2631 static char *
2622 2632 skipwhitespace(char *str)
2623 2633 {
2624 2634 while (*str && isspace(*str))
2625 2635 str++;
2626 2636
2627 2637 return (str);
2628 2638 }
2629 2639
2630 2640 /*
2631 2641 * extractprop()
2632 2642 *
2633 2643 * Extract the property and value out of the line and create the
2634 2644 * property in the optionset.
2635 2645 */
2636 2646 static int
2637 2647 extractprop(char *name, char *value)
2638 2648 {
2639 2649 sa_property_t prop;
2640 2650 int index;
2641 2651 int ret = SA_OK;
2642 2652 /*
2643 2653 * Remove any leading
2644 2654 * white space.
2645 2655 */
2646 2656 name = skipwhitespace(name);
2647 2657
2648 2658 index = findprotoopt(name, 1);
2649 2659 if (index >= 0) {
2650 2660 fixcaselower(name);
2651 2661 prop = sa_create_property(proto_options[index].name, value);
2652 2662 if (prop != NULL)
2653 2663 ret = sa_add_protocol_property(protoset, prop);
2654 2664 else
2655 2665 ret = SA_NO_MEMORY;
2656 2666 }
2657 2667 return (ret);
2658 2668 }
2659 2669
2660 2670 scf_type_t
2661 2671 getscftype(int type)
2662 2672 {
2663 2673 scf_type_t ret;
2664 2674
2665 2675 switch (type) {
2666 2676 case OPT_TYPE_NUMBER:
2667 2677 ret = SCF_TYPE_INTEGER;
2668 2678 break;
2669 2679 case OPT_TYPE_BOOLEAN:
2670 2680 ret = SCF_TYPE_BOOLEAN;
2671 2681 break;
2672 2682 default:
2673 2683 ret = SCF_TYPE_ASTRING;
2674 2684 }
2675 2685 return (ret);
2676 2686 }
2677 2687
2678 2688 char *
2679 2689 getsvcname(uint32_t svcs)
2680 2690 {
2681 2691 char *service;
2682 2692 switch (svcs) {
2683 2693 case SVC_LOCKD:
2684 2694 service = LOCKD;
2685 2695 break;
2686 2696 case SVC_STATD:
2687 2697 service = STATD;
2688 2698 break;
2689 2699 case SVC_NFSD:
2690 2700 service = NFSD;
2691 2701 break;
2692 2702 case SVC_CLIENT:
2693 2703 service = NFS_CLIENT_SVC;
2694 2704 break;
2695 2705 case SVC_NFS4CBD:
2696 2706 service = NFS4CBD;
2697 2707 break;
2698 2708 case SVC_NFSMAPID:
2699 2709 service = NFSMAPID;
2700 2710 break;
2701 2711 case SVC_RQUOTAD:
2702 2712 service = RQUOTAD;
2703 2713 break;
2704 2714 case SVC_NFSLOGD:
2705 2715 service = NFSLOGD;
2706 2716 break;
2707 2717 case SVC_REPARSED:
2708 2718 service = REPARSED;
2709 2719 break;
2710 2720 default:
2711 2721 service = NFSD;
2712 2722 }
2713 2723 return (service);
2714 2724 }
2715 2725
2716 2726 /*
2717 2727 * initprotofromsmf()
2718 2728 *
2719 2729 * Read NFS SMF properties and add the defined values to the
2720 2730 * protoset. Note that default values are known from the built in
2721 2731 * table in case SMF doesn't have a definition. Not having
2722 2732 * SMF properties is OK since we have builtin default
2723 2733 * values.
2724 2734 */
2725 2735 static int
2726 2736 initprotofromsmf()
2727 2737 {
2728 2738 char name[PATH_MAX];
2729 2739 char value[PATH_MAX];
2730 2740 int ret = SA_OK, bufsz = 0, i;
2731 2741
2732 2742 protoset = sa_create_protocol_properties("nfs");
2733 2743 if (protoset != NULL) {
2734 2744 for (i = 0; proto_options[i].tag != NULL; i++) {
2735 2745 scf_type_t ptype;
2736 2746 char *svc_name;
2737 2747
2738 2748 bzero(value, PATH_MAX);
2739 2749 (void) strncpy(name, proto_options[i].name, PATH_MAX);
2740 2750 /* Replace NULL with the correct instance */
2741 2751 ptype = getscftype(proto_options[i].type);
2742 2752 svc_name = getsvcname(proto_options[i].svcs);
2743 2753 bufsz = PATH_MAX;
2744 2754 ret = nfs_smf_get_prop(name, value,
2745 2755 (char *)DEFAULT_INSTANCE, ptype,
2746 2756 svc_name, &bufsz);
2747 2757 if (ret == SA_OK) {
2748 2758 ret = extractprop(name, value);
2749 2759 }
2750 2760 }
2751 2761 } else {
2752 2762 ret = SA_NO_MEMORY;
2753 2763 }
2754 2764
2755 2765 return (ret);
2756 2766 }
2757 2767
2758 2768 /*
2759 2769 * add_defaults()
2760 2770 *
2761 2771 * Add the default values for any property not defined
2762 2772 * in NFS SMF repository.
2763 2773 * Values are set according to their defined types.
2764 2774 */
2765 2775
2766 2776 static void
2767 2777 add_defaults()
2768 2778 {
2769 2779 int i;
2770 2780 char number[MAXDIGITS];
2771 2781
2772 2782 for (i = 0; proto_options[i].tag != NULL; i++) {
2773 2783 sa_property_t prop;
2774 2784 prop = sa_get_protocol_property(protoset,
2775 2785 proto_options[i].name);
2776 2786 if (prop == NULL) {
2777 2787 /* add the default value */
2778 2788 switch (proto_options[i].type) {
2779 2789 case OPT_TYPE_NUMBER:
2780 2790 (void) snprintf(number, sizeof (number), "%d",
2781 2791 proto_options[i].defvalue.intval);
2782 2792 prop = sa_create_property(proto_options[i].name,
2783 2793 number);
2784 2794 break;
2785 2795
2786 2796 case OPT_TYPE_BOOLEAN:
2787 2797 prop = sa_create_property(proto_options[i].name,
2788 2798 proto_options[i].defvalue.intval ?
2789 2799 "true" : "false");
2790 2800 break;
2791 2801
2792 2802 case OPT_TYPE_ONOFF:
2793 2803 prop = sa_create_property(proto_options[i].name,
2794 2804 proto_options[i].defvalue.intval ?
2795 2805 "on" : "off");
2796 2806 break;
2797 2807
2798 2808 default:
2799 2809 /* treat as strings of zero length */
2800 2810 prop = sa_create_property(proto_options[i].name,
2801 2811 "");
2802 2812 break;
2803 2813 }
2804 2814 if (prop != NULL)
2805 2815 (void) sa_add_protocol_property(protoset, prop);
2806 2816 }
2807 2817 }
2808 2818 }
2809 2819
2810 2820 static void
2811 2821 free_protoprops()
2812 2822 {
2813 2823 if (protoset != NULL) {
2814 2824 xmlFreeNode(protoset);
2815 2825 protoset = NULL;
2816 2826 }
2817 2827 }
2818 2828
2819 2829 /*
2820 2830 * nfs_init()
2821 2831 *
2822 2832 * Initialize the NFS plugin.
2823 2833 */
2824 2834
2825 2835 static int
2826 2836 nfs_init()
2827 2837 {
2828 2838 int ret = SA_OK;
2829 2839
2830 2840 if (sa_plugin_ops.sa_init != nfs_init) {
2831 2841 (void) printf(dgettext(TEXT_DOMAIN,
2832 2842 "NFS plugin not properly initialized\n"));
2833 2843 return (SA_CONFIG_ERR);
2834 2844 }
2835 2845
2836 2846 ret = initprotofromsmf();
2837 2847 if (ret != SA_OK) {
2838 2848 (void) printf(dgettext(TEXT_DOMAIN,
2839 2849 "NFS plugin problem with SMF repository: %s\n"),
2840 2850 sa_errorstr(ret));
2841 2851 ret = SA_OK;
2842 2852 }
2843 2853 add_defaults();
2844 2854
2845 2855 return (ret);
2846 2856 }
2847 2857
2848 2858 /*
2849 2859 * nfs_fini()
2850 2860 *
2851 2861 * uninitialize the NFS plugin. Want to avoid memory leaks.
2852 2862 */
2853 2863
2854 2864 static void
2855 2865 nfs_fini()
2856 2866 {
2857 2867 free_protoprops();
2858 2868 }
2859 2869
2860 2870 /*
2861 2871 * nfs_get_proto_set()
2862 2872 *
2863 2873 * Return an optionset with all the protocol specific properties in
2864 2874 * it.
2865 2875 */
2866 2876
2867 2877 static sa_protocol_properties_t
2868 2878 nfs_get_proto_set()
2869 2879 {
2870 2880 return (protoset);
2871 2881 }
2872 2882
2873 2883 /*
2874 2884 * service_in_state(service, chkstate)
2875 2885 *
2876 2886 * Want to know if the specified service is in the desired state
2877 2887 * (chkstate) or not. Return true (1) if it is and false (0) if it
2878 2888 * isn't.
2879 2889 */
2880 2890 static int
2881 2891 service_in_state(char *service, const char *chkstate)
2882 2892 {
2883 2893 char *state;
2884 2894 int ret = B_FALSE;
2885 2895
2886 2896 state = smf_get_state(service);
2887 2897 if (state != NULL) {
2888 2898 /* got the state so get the equality for the return value */
2889 2899 ret = strcmp(state, chkstate) == 0 ? B_TRUE : B_FALSE;
2890 2900 free(state);
2891 2901 }
2892 2902 return (ret);
2893 2903 }
2894 2904
2895 2905 /*
2896 2906 * restart_service(svcs)
2897 2907 *
2898 2908 * Walk through the bit mask of services that need to be restarted in
2899 2909 * order to use the new property values. Some properties affect
2900 2910 * multiple daemons. Should only restart a service if it is currently
2901 2911 * enabled (online).
2902 2912 */
2903 2913
2904 2914 static void
2905 2915 restart_service(uint32_t svcs)
2906 2916 {
2907 2917 uint32_t mask;
2908 2918 int ret;
2909 2919 char *service;
2910 2920
2911 2921 for (mask = 1; svcs != 0; mask <<= 1) {
2912 2922 switch (svcs & mask) {
2913 2923 case SVC_LOCKD:
2914 2924 service = LOCKD;
2915 2925 break;
2916 2926 case SVC_STATD:
2917 2927 service = STATD;
2918 2928 break;
2919 2929 case SVC_NFSD:
2920 2930 service = NFSD;
2921 2931 break;
2922 2932 case SVC_MOUNTD:
2923 2933 service = MOUNTD;
2924 2934 break;
2925 2935 case SVC_NFS4CBD:
2926 2936 service = NFS4CBD;
2927 2937 break;
2928 2938 case SVC_NFSMAPID:
2929 2939 service = NFSMAPID;
2930 2940 break;
2931 2941 case SVC_RQUOTAD:
2932 2942 service = RQUOTAD;
2933 2943 break;
2934 2944 case SVC_NFSLOGD:
2935 2945 service = NFSLOGD;
2936 2946 break;
2937 2947 case SVC_REPARSED:
2938 2948 service = REPARSED;
2939 2949 break;
2940 2950 case SVC_CLIENT:
2941 2951 service = NFS_CLIENT_SVC;
2942 2952 break;
2943 2953 default:
2944 2954 continue;
2945 2955 }
2946 2956
2947 2957 /*
2948 2958 * Only attempt to restart the service if it is
2949 2959 * currently running. In the future, it may be
2950 2960 * desirable to use smf_refresh_instance if the NFS
2951 2961 * services ever implement the refresh method.
2952 2962 */
2953 2963 if (service_in_state(service, SCF_STATE_STRING_ONLINE)) {
2954 2964 ret = smf_restart_instance(service);
2955 2965 /*
2956 2966 * There are only a few SMF errors at this point, but
2957 2967 * it is also possible that a bad value may have put
2958 2968 * the service into maintenance if there wasn't an
2959 2969 * SMF level error.
2960 2970 */
2961 2971 if (ret != 0) {
2962 2972 (void) fprintf(stderr,
2963 2973 dgettext(TEXT_DOMAIN,
2964 2974 "%s failed to restart: %s\n"),
2965 2975 service, scf_strerror(scf_error()));
2966 2976 } else {
2967 2977 /*
2968 2978 * Check whether it has gone to "maintenance"
2969 2979 * mode or not. Maintenance implies something
2970 2980 * went wrong.
2971 2981 */
2972 2982 if (service_in_state(service,
2973 2983 SCF_STATE_STRING_MAINT)) {
2974 2984 (void) fprintf(stderr,
2975 2985 dgettext(TEXT_DOMAIN,
2976 2986 "%s failed to restart\n"),
2977 2987 service);
2978 2988 }
2979 2989 }
2980 2990 }
2981 2991 svcs &= ~mask;
2982 2992 }
2983 2993 }
2984 2994
2985 2995 /*
2986 2996 * nfs_minmax_check(name, value)
2987 2997 *
2988 2998 * Verify that the value for the property specified by index is valid
2989 2999 * relative to the opposite value in the case of a min/max variable.
2990 3000 * Currently, server_minvers/server_maxvers and
2991 3001 * client_minvers/client_maxvers are the only ones to check.
2992 3002 */
2993 3003
2994 3004 static int
2995 3005 nfs_minmax_check(int index, int value)
2996 3006 {
2997 3007 int val;
2998 3008 char *pval;
2999 3009 sa_property_t prop;
3000 3010 sa_optionset_t opts;
3001 3011 int ret = B_TRUE;
3002 3012
3003 3013 if (proto_options[index].other != NULL) {
3004 3014 /* have a property to compare against */
3005 3015 opts = nfs_get_proto_set();
3006 3016 prop = sa_get_property(opts, proto_options[index].other);
3007 3017 /*
3008 3018 * If we don't find the property, assume default
3009 3019 * values which will work since the max will be at the
3010 3020 * max and the min at the min.
3011 3021 */
3012 3022 if (prop != NULL) {
3013 3023 pval = sa_get_property_attr(prop, "value");
3014 3024 if (pval != NULL) {
3015 3025 val = strtoul(pval, NULL, 0);
3016 3026 if (proto_options[index].compare ==
3017 3027 OPT_CMP_LE) {
3018 3028 ret = value <= val ? B_TRUE : B_FALSE;
3019 3029 } else if (proto_options[index].compare ==
3020 3030 OPT_CMP_GE) {
3021 3031 ret = value >= val ? B_TRUE : B_FALSE;
3022 3032 }
3023 3033 sa_free_attr_string(pval);
3024 3034 }
3025 3035 }
3026 3036 }
3027 3037 return (ret);
3028 3038 }
3029 3039
3030 3040 /*
3031 3041 * nfs_validate_proto_prop(index, name, value)
3032 3042 *
3033 3043 * Verify that the property specified by name can take the new
3034 3044 * value. This is a sanity check to prevent bad values getting into
3035 3045 * the default files. All values need to be checked against what is
3036 3046 * allowed by their defined type. If a type isn't explicitly defined
3037 3047 * here, it is treated as a string.
3038 3048 *
3039 3049 * Note that OPT_TYPE_NUMBER will additionally check that the value is
3040 3050 * within the range specified and potentially against another property
3041 3051 * value as well as specified in the proto_options members other and
3042 3052 * compare.
3043 3053 */
3044 3054
3045 3055 static int
3046 3056 nfs_validate_proto_prop(int index, char *name, char *value)
3047 3057 {
3048 3058 int ret = SA_OK;
3049 3059 char *cp;
3050 3060 #ifdef lint
3051 3061 name = name;
3052 3062 #endif
3053 3063 switch (proto_options[index].type) {
3054 3064 case OPT_TYPE_NUMBER:
3055 3065 if (!is_a_number(value))
3056 3066 ret = SA_BAD_VALUE;
3057 3067 else {
3058 3068 int val;
3059 3069 val = strtoul(value, NULL, 0);
3060 3070 if (val < proto_options[index].minval ||
3061 3071 val > proto_options[index].maxval)
3062 3072 ret = SA_BAD_VALUE;
3063 3073 /*
3064 3074 * For server_versmin/server_versmax and
3065 3075 * client_versmin/client_versmax, the value of the
3066 3076 * min(max) should be checked to be correct relative
3067 3077 * to the current max(min).
3068 3078 */
3069 3079 if (!nfs_minmax_check(index, val)) {
3070 3080 ret = SA_BAD_VALUE;
3071 3081 }
3072 3082 }
3073 3083 break;
3074 3084
3075 3085 case OPT_TYPE_DOMAIN:
3076 3086 /*
3077 3087 * needs to be a qualified domain so will have at
3078 3088 * least one period and other characters on either
3079 3089 * side of it. A zero length string is also allowed
3080 3090 * and is the way to turn off the override.
3081 3091 */
3082 3092 if (strlen(value) == 0)
3083 3093 break;
3084 3094 cp = strchr(value, '.');
3085 3095 if (cp == NULL || cp == value || strchr(value, '@') != NULL)
3086 3096 ret = SA_BAD_VALUE;
3087 3097 break;
3088 3098
3089 3099 case OPT_TYPE_BOOLEAN:
3090 3100 if (strlen(value) == 0 ||
3091 3101 strcasecmp(value, "true") == 0 ||
3092 3102 strcmp(value, "1") == 0 ||
3093 3103 strcasecmp(value, "false") == 0 ||
3094 3104 strcmp(value, "0") == 0) {
3095 3105 ret = SA_OK;
3096 3106 } else {
3097 3107 ret = SA_BAD_VALUE;
3098 3108 }
3099 3109 break;
3100 3110
3101 3111 case OPT_TYPE_ONOFF:
3102 3112 if (strcasecmp(value, "on") != 0 &&
3103 3113 strcasecmp(value, "off") != 0) {
3104 3114 ret = SA_BAD_VALUE;
3105 3115 }
3106 3116 break;
3107 3117
3108 3118 case OPT_TYPE_PROTOCOL: {
3109 3119 struct netconfig *nconf;
3110 3120 void *nc;
3111 3121 boolean_t pfound = B_FALSE;
3112 3122
3113 3123 if (strcasecmp(value, "all") == 0)
3114 3124 break;
3115 3125
3116 3126 if ((nc = setnetconfig()) == NULL) {
3117 3127 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
3118 3128 "setnetconfig failed: %s\n"), strerror(errno));
3119 3129 } else {
3120 3130 while ((nconf = getnetconfig(nc)) != NULL) {
3121 3131 if (strcmp(nconf->nc_proto, value) == 0) {
3122 3132 pfound = B_TRUE;
3123 3133 break;
3124 3134 }
3125 3135 }
3126 3136 (void) endnetconfig(nc);
3127 3137 }
3128 3138
3129 3139 if (!pfound)
3130 3140 ret = SA_BAD_VALUE;
3131 3141 break;
3132 3142 }
3133 3143
3134 3144 default:
3135 3145 /* treat as a string */
3136 3146 break;
3137 3147 }
3138 3148 return (ret);
3139 3149 }
3140 3150
3141 3151 /*
3142 3152 * nfs_set_proto_prop(prop)
3143 3153 *
3144 3154 * check that prop is valid.
3145 3155 */
3146 3156
3147 3157 static int
3148 3158 nfs_set_proto_prop(sa_property_t prop)
3149 3159 {
3150 3160 int ret = SA_OK;
3151 3161 char *name;
3152 3162 char *value;
3153 3163
3154 3164 name = sa_get_property_attr(prop, "type");
3155 3165 value = sa_get_property_attr(prop, "value");
3156 3166 if (name != NULL && value != NULL) {
3157 3167 scf_type_t sctype;
3158 3168 char *svc_name;
3159 3169 char *instance = NULL;
3160 3170 int index = findprotoopt(name, 1);
3161 3171
3162 3172 ret = nfs_validate_proto_prop(index, name, value);
3163 3173 if (ret == SA_OK) {
3164 3174 sctype = getscftype(proto_options[index].type);
3165 3175 svc_name = getsvcname(proto_options[index].svcs);
3166 3176 if (sctype == SCF_TYPE_BOOLEAN) {
3167 3177 if (value != NULL)
3168 3178 sa_free_attr_string(value);
3169 3179 if (string_to_boolean(value) == 0)
3170 3180 value = strdup("0");
3171 3181 else
3172 3182 value = strdup("1");
3173 3183 }
3174 3184 ret = nfs_smf_set_prop(name, value, instance, sctype,
3175 3185 svc_name);
3176 3186 if (ret == SA_OK) {
3177 3187 restart_service(proto_options[index].svcs);
3178 3188 } else {
3179 3189 (void) printf(dgettext(TEXT_DOMAIN,
3180 3190 "Cannot restart NFS services : %s\n"),
3181 3191 sa_errorstr(ret));
3182 3192 }
3183 3193 }
3184 3194 }
3185 3195 if (name != NULL)
3186 3196 sa_free_attr_string(name);
3187 3197 if (value != NULL)
3188 3198 sa_free_attr_string(value);
3189 3199 return (ret);
3190 3200 }
3191 3201
3192 3202 /*
3193 3203 * nfs_get_status()
3194 3204 *
3195 3205 * What is the current status of the nfsd? We use the SMF state here.
3196 3206 * Caller must free the returned value.
3197 3207 */
3198 3208
3199 3209 static char *
3200 3210 nfs_get_status()
3201 3211 {
3202 3212 return (smf_get_state(NFSD));
3203 3213 }
3204 3214
3205 3215 /*
3206 3216 * nfs_space_alias(alias)
3207 3217 *
3208 3218 * Lookup the space (security) name. If it is default, convert to the
3209 3219 * real name.
3210 3220 */
3211 3221
3212 3222 static char *
3213 3223 nfs_space_alias(char *space)
3214 3224 {
3215 3225 char *name = space;
3216 3226 seconfig_t secconf;
3217 3227
3218 3228 /*
3219 3229 * Only the space named "default" is special. If it is used,
3220 3230 * the default needs to be looked up and the real name used.
3221 3231 * This is normally "sys" but could be changed. We always
3222 3232 * change default to the real name.
3223 3233 */
3224 3234 if (strcmp(space, "default") == 0 &&
3225 3235 nfs_getseconfig_default(&secconf) == 0) {
3226 3236 if (nfs_getseconfig_bynumber(secconf.sc_nfsnum, &secconf) == 0)
3227 3237 name = secconf.sc_name;
3228 3238 }
3229 3239 return (strdup(name));
3230 3240 }
3231 3241
3232 3242 /*
3233 3243 * nfs_features()
3234 3244 *
3235 3245 * Return a mask of the features required.
3236 3246 */
3237 3247
3238 3248 static uint64_t
3239 3249 nfs_features()
3240 3250 {
3241 3251 return ((uint64_t)SA_FEATURE_DFSTAB | SA_FEATURE_SERVER);
3242 3252 }
|
↓ open down ↓ |
2203 lines elided |
↑ open up ↑ |
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX