From: Olaf Kirch <okir@suse.de>
To: Neil Brown <neilb@cse.unsw.edu.au>
Cc: "J. Bruce Fields" <bfields@fieldses.org>,
Trond Myklebust <trond.myklebust@fys.uio.no>,
nfs@lists.sourceforge.net
Subject: Re: Re: [PATCH 3 of 6] svcrpc: move export table checks to a per-program pg_add_client method
Date: Wed, 22 Sep 2004 12:10:24 +0200 [thread overview]
Message-ID: <20040922101024.GC1528@suse.de> (raw)
In-Reply-To: <16721.8596.980204.899779@cse.unsw.edu.au>
On Wed, Sep 22, 2004 at 04:54:12PM +1000, Neil Brown wrote:
> One approach is the patches you produced. Another might be a
> per-svc_procedure flag to say whether auth was required or not. There
> are doubtlessly others.
I think the code in svcauth*.c should not concern itself with
authorization and make security policy decisions. It should parse the
credentials and verifier and call service specific routines that
make this decision. Specifically, stuff like ip_map_lookup() should
occur inside the policy routine, not in svcauth_unix_accept().
I also see no problem with having specific callback routines per
authentication flavor:
int (*pg_auth_null)(struct svc_rqst *);
int (*pg_auth_unix)(struct svc_rqst *, struct svc_auth_unix_data *);
int (*pg_auth_gss)(struct svc_rqst *, struct svc_auth_gss_data *);
If a program leaves one of these pointers NULL means "reject any request
with this auth flavor"
Of course, it makes sense to provide default implementations for all
auth flavors so that you don't have to cut'n'paste them for every
rpc service.
Olaf
--
Olaf Kirch | Things that make Monday morning interesting, #1:
okir@suse.de | "I want to use NFS over AX25, can you help me?"
---------------+
-------------------------------------------------------
This SF.Net email is sponsored by: YOU BE THE JUDGE. Be one of 170
Project Admins to receive an Apple iPod Mini FREE for your judgement on
who ports your project to Linux PPC the best. Sponsored by IBM.
Deadline: Sept. 24. Go here: http://sf.net/ppc_contest.php
_______________________________________________
NFS maillist - NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs
next prev parent reply other threads:[~2004-09-22 10:13 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20040916230555.GA13415@fieldses.org>
2004-09-16 23:07 ` 6 svcauth_unix patches to make export table lookups optional J. Bruce Fields
2004-09-16 23:16 ` [PATCH 1 of 6] svcrpc: auth_null fixes J. Bruce Fields
2004-09-16 23:16 ` [PATCH 2 of 6] svcrpc: share code duplicated between auth_unix and auth_null J. Bruce Fields
2004-09-16 23:16 ` [PATCH 3 of 6] svcrpc: move export table checks to a per-program pg_add_client method J. Bruce Fields
2004-09-16 23:16 ` [PATCH 4 of 6] nfs4: use new pg_set_client method to simplify nfs4 callback authentication J. Bruce Fields
2004-09-16 23:16 ` [PATCH 5 of 6] lockd: don't try to match callback requests against export table J. Bruce Fields
2004-09-16 23:16 ` [PATCH 6 of 6] nfsd: remove pg_authenticate field J. Bruce Fields
2004-09-16 23:34 ` [PATCH 5 of 6] lockd: don't try to match callback requests against export table Trond Myklebust
2004-09-24 3:55 ` Neil Brown
2004-09-16 23:38 ` [PATCH 3 of 6] svcrpc: move export table checks to a per-program pg_add_client method Trond Myklebust
2004-09-17 1:11 ` J. Bruce Fields
2004-09-17 1:18 ` Trond Myklebust
2004-09-17 2:20 ` J. Bruce Fields
2004-09-22 6:54 ` Neil Brown
2004-09-22 10:10 ` Olaf Kirch [this message]
2004-09-23 21:46 ` J. Bruce Fields
2004-09-24 4:04 ` Neil Brown
2004-09-24 7:42 ` Olaf Kirch
2004-09-24 20:58 ` J. Bruce Fields
2004-09-28 22:00 ` J. Bruce Fields
2004-09-28 22:11 ` Trond Myklebust
2004-09-28 22:37 ` Trond Myklebust
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20040922101024.GC1528@suse.de \
--to=okir@suse.de \
--cc=bfields@fieldses.org \
--cc=neilb@cse.unsw.edu.au \
--cc=nfs@lists.sourceforge.net \
--cc=trond.myklebust@fys.uio.no \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.