1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
24 * Use is subject to license terms.
25 * Copyright 2016 Nexenta Systems, Inc.
26 */
27
28 #include <stdio.h>
29 #include <stdlib.h>
30 #include <sys/types.h>
31 #include <string.h>
32 #include <sys/param.h>
33 #include <sys/stat.h>
34 #include <sys/file.h>
35 #include <sys/time.h>
36 #include <sys/errno.h>
37 #include <rpcsvc/mount.h>
38 #include <sys/pathconf.h>
39 #include <sys/systeminfo.h>
40 #include <sys/utsname.h>
41 #include <arpa/inet.h>
42 #include <signal.h>
43 #include <syslog.h>
44 #include <locale.h>
45 #include <unistd.h>
46 #include <thread.h>
47 #include <netdir.h>
48 #include <nfs/auth.h>
49 #include <sharefs/share.h>
50 #include <alloca.h>
51 #include "../lib/sharetab.h"
52 #include "mountd.h"
53
54 static void
55 nfsauth_access(auth_req *argp, auth_res *result)
56 {
57 struct netbuf nbuf;
58 struct share *sh;
59
60 struct cln cln;
61
62 result->auth_perm = NFSAUTH_DENIED;
63
64 nbuf.len = argp->req_client.n_len;
65 nbuf.buf = argp->req_client.n_bytes;
66
67 if (nbuf.len == 0 || nbuf.buf == NULL)
68 return;
69
70 /*
71 * Find the export
72 */
73 sh = findentry(argp->req_path);
74 if (sh == NULL) {
75 syslog(LOG_ERR, "%s not exported", argp->req_path);
76 return;
77 }
78
79 cln_init_lazy(&cln, argp->req_netid, &nbuf);
80
81 result->auth_perm = check_client(sh, &cln, argp->req_flavor,
82 argp->req_clnt_uid, argp->req_clnt_gid, argp->req_clnt_gids.len,
83 argp->req_clnt_gids.val, &result->auth_srv_uid,
84 &result->auth_srv_gid, &result->auth_srv_gids.len,
85 &result->auth_srv_gids.val);
86
87 sharefree(sh);
88
89 if (result->auth_perm == NFSAUTH_DENIED) {
90 syslog(LOG_ERR, "%s denied access to %s", cln_gethost(&cln),
91 argp->req_path);
92 }
93
94 cln_fini(&cln);
95 }
96
97 void
98 nfsauth_func(void *cookie, char *dataptr, size_t arg_size, door_desc_t *dp,
99 uint_t n_desc)
100 {
101 nfsauth_arg_t *ap;
102 nfsauth_res_t res = {0};
103 XDR xdrs_a;
104 XDR xdrs_r;
105 size_t rbsz;
106 caddr_t rbuf;
107 varg_t varg = {0};
108
109 /*
110 * Decode the inbound door data, so we can look at the cmd.
111 */
112 xdrmem_create(&xdrs_a, dataptr, arg_size, XDR_DECODE);
113 if (!xdr_varg(&xdrs_a, &varg)) {
114 /*
115 * If the arguments can't be decoded, bail.
116 */
117 if (varg.vers == V_ERROR)
118 syslog(LOG_ERR, gettext("Arg version mismatch"));
119 res.stat = NFSAUTH_DR_DECERR;
120 goto encres;
121 }
122
123 /*
124 * Now set the args pointer to the proper version of the args
125 */
126 switch (varg.vers) {
127 case V_PROTO:
128 ap = &varg.arg_u.arg;
129 break;
130
131 /* Additional arguments versions go here */
132
133 default:
134 syslog(LOG_ERR, gettext("Invalid args version"));
135 res.stat = NFSAUTH_DR_DECERR;
136 goto encres;
137 }
138
139 /*
140 * Call the specified cmd
141 */
142 switch (ap->cmd) {
143 case NFSAUTH_ACCESS:
144 nfsauth_access(&ap->areq, &res.ares);
145 res.stat = NFSAUTH_DR_OKAY;
146 break;
147 default:
148 res.stat = NFSAUTH_DR_BADCMD;
149 break;
150 }
151
152 encres:
153 /*
154 * Free space used to decode the args
155 */
156 xdr_free(xdr_varg, (char *)&varg);
157 xdr_destroy(&xdrs_a);
158
159 /*
160 * Encode the results before passing thru door.
161 */
162 rbsz = xdr_sizeof(xdr_nfsauth_res, &res);
163 if (rbsz == 0)
164 goto failed;
165 rbuf = alloca(rbsz);
166
167 xdrmem_create(&xdrs_r, rbuf, rbsz, XDR_ENCODE);
168 if (!xdr_nfsauth_res(&xdrs_r, &res)) {
169 xdr_destroy(&xdrs_r);
170 failed:
171 xdr_free(xdr_nfsauth_res, (char *)&res);
172 /*
173 * return only the status code
174 */
175 res.stat = NFSAUTH_DR_EFAIL;
176 rbsz = sizeof (uint_t);
177 rbuf = (caddr_t)&res.stat;
178
179 goto out;
180 }
181 xdr_destroy(&xdrs_r);
182 xdr_free(xdr_nfsauth_res, (char *)&res);
183
184 out:
185 (void) door_return((char *)rbuf, rbsz, NULL, 0);
186 (void) door_return(NULL, 0, NULL, 0);
187 /* NOTREACHED */
188 }