[NFS] Nfs4 over Ipv6 patch to fix ipv6 subnetting in /etc/exports

[NFS] Nfs4 over Ipv6 patch to fix ipv6 subnetting in /etc/exports

[Kelly Anderson]

[-- Attachment #1: Type: text/plain, Size: 898 bytes --]

Hopefully this mail gets through to someone who can apply this patch to 
NfsUtils git.

I have been trying on and off for a year or so to get Nfs4 mounts to 
work over Ipv6.  Finally with the latest git it seemed to work.  That 
is, it worked when you wildcard all internet addresses.

/home/nfs4  *(rw,fsid=0,sync,root_squash,no_all_squash,no_subtree_check)

Unfortunately subnetting wasn't working, so I dug into the code to 
figure out why.  It turned out that it was something simple (once I 
managed to get my head into the code).  I've attached a patch against 
the current git that fixes it.  With the patch applied, ipv6 subnetting 
such as the following works.

/home/nfs4  
2001:470:b:3e::/64(rw,fsid=0,sync,root_squash,no_all_squash,no_subtree_check)
/home/nfs4  
2001:470:b:3e::/ffff:ffff:ffff:ffff::(rw,fsid=0,sync,root_squash,no_all_squash,no_subtree_check)

Regards,

Kelly Anderson

[-- Attachment #2: NfsUtils-check_subnet_v6.patch --]
[-- Type: text/x-patch, Size: 884 bytes --]

--- ./support/export/client.c.orig	2009-11-30 08:06:18.000000000 -0700
+++ ./support/export/client.c	2009-12-02 15:16:55.361725808 -0700
@@ -505,16 +505,16 @@ check_subnet_v6(const struct sockaddr_in
 			continue;
 
 		if (mask_match(address->sin6_addr.s6_addr32[0],
-				sin6->sin6_addr.s6_addr[0],
+				sin6->sin6_addr.s6_addr32[0],
 		      		mask->sin6_addr.s6_addr32[0]) &&
 		    mask_match(address->sin6_addr.s6_addr32[1],
-				sin6->sin6_addr.s6_addr[1],
+				sin6->sin6_addr.s6_addr32[1],
 		      		mask->sin6_addr.s6_addr32[1]) &&
 		    mask_match(address->sin6_addr.s6_addr32[2],
-				sin6->sin6_addr.s6_addr[2],
+				sin6->sin6_addr.s6_addr32[2],
 		      		mask->sin6_addr.s6_addr32[2]) &&
 		    mask_match(address->sin6_addr.s6_addr32[3],
-				sin6->sin6_addr.s6_addr[3],
+				sin6->sin6_addr.s6_addr32[3],
 		      		mask->sin6_addr.s6_addr32[3]))
 			return 1;
 	}

[-- Attachment #3: Type: text/plain, Size: 300 bytes --]

------------------------------------------------------------------------------
Join us December 9, 2009 for the Red Hat Virtual Experience,
a free event focused on virtualization and cloud computing. 
Attend in-depth sessions from your desk. Your couch. Anywhere.
http://p.sf.net/sfu/redhat-sfdev2dev

[-- Attachment #4: Type: text/plain, Size: 362 bytes --]

_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs
_______________________________________________
Please note that nfs@lists.sourceforge.net is being discontinued.
Please subscribe to linux-nfs@vger.kernel.org instead.
    http://vger.kernel.org/vger-lists.html#linux-nfs

Re: [NFS] Nfs4 over Ipv6 patch to fix ipv6 subnetting in /etc/exports

[Chuck Lever]

[Cc: correct mailing list]

On Dec 2, 2009, at 5:50 PM, Kelly Anderson wrote:

> Hopefully this mail gets through to someone who can apply this patch  
> to NfsUtils git.
>
> I have been trying on and off for a year or so to get Nfs4 mounts to  
> work over Ipv6.  Finally with the latest git it seemed to work.   
> That is, it worked when you wildcard all internet addresses.
>
> /home/nfs4   
> *(rw,fsid=0,sync,root_squash,no_all_squash,no_subtree_check)
>
> Unfortunately subnetting wasn't working, so I dug into the code to  
> figure out why.  It turned out that it was something simple (once I  
> managed to get my head into the code).  I've attached a patch  
> against the current git that fixes it.  With the patch applied, ipv6  
> subnetting such as the following works.
>
> /home/nfs4  2001:470:b:3e::/ 
> 64(rw,fsid=0,sync,root_squash,no_all_squash,no_subtree_check)
> /home/nfs4  2001:470:b:3e::/ffff:ffff:ffff:ffff:: 
> (rw,fsid=0,sync,root_squash,no_all_squash,no_subtree_check)

IPv6 support in mountd is entirely experimental (ie not guaranteed to  
work), and exists only my personal git repo, not in the official nfs- 
utils git repo.  However, it looks like you are working against my code.

Also, we prefer patches submitted inline, not as attachments, as that  
makes it easy to hit "reply" and comment on the content of the patch.   
A patch description and a Signed-off-by: line is required.  Take a  
look in the archives of this mailing list for examples.

Basically your patch misapplies the address mask in check_subnet_v6,  
so I don't think it's the right fix.  Instead of "sin6 & mask" you  
have "sin6 & sin6" which basically means the mask is ignored, and the  
check will always succeed.

Maybe the mask generation code in init_netmask() is not correct?

> Regards,
>
> Kelly Anderson
> <NfsUtils- 
> check_subnet_v6 
> .patch 
> > 
> ------------------------------------------------------------------------------
> Join us December 9, 2009 for the Red Hat Virtual Experience,
> a free event focused on virtualization and cloud computing.
> Attend in-depth sessions from your desk. Your couch. Anywhere.
> http://p.sf.net/sfu/redhat-sfdev2dev_______________________________________________
> NFS maillist  -  NFS@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/nfs
> _______________________________________________
> Please note that nfs@lists.sourceforge.net is being discontinued.
> Please subscribe to linux-nfs@vger.kernel.org instead.
>    http://vger.kernel.org/vger-lists.html#linux-nfs

-- 
Chuck Lever
chuck[dot]lever[at]oracle[dot]com

Re: [NFS] Nfs4 over Ipv6 patch to fix ipv6 subnetting in /etc/exports

[Kelly Anderson]

On 12/02/2009 04:32 PM, Chuck Lever wrote:
> [Cc: correct mailing list]
>
> IPv6 support in mountd is entirely experimental (ie not guaranteed to 
> work), and exists only my personal git repo, not in the official 
> nfs-utils git repo.  However, it looks like you are working against my 
> code.

I got it from the following.
git://git.linux-nfs.org/projects/cel/nfs-utils.git

>
>
> Also, we prefer patches submitted inline, not as attachments, as that 
> makes it easy to hit "reply" and comment on the content of the patch.  
> A patch description and a Signed-off-by: line is required.  Take a 
> look in the archives of this mailing list for examples.
>
> Basically your patch misapplies the address mask in check_subnet_v6, 
> so I don't think it's the right fix.  Instead of "sin6 & mask" you 
> have "sin6 & sin6" which basically means the mask is ignored, and the 
> check will always succeed.
>
> Maybe the mask generation code in init_netmask() is not correct?

I think you missread the patch. So I posted the complete patched 
function.  The problem was sin6->sin6_addr.s6_addr should be 
sin6->sin6_addr.s6_addr32.  It doesn't make sense to compare an 8 bit 
value with a 32 bit value.  Notice it's really comparing "address" to 
"sin6" so it's really ((address ^ sin6) & mask).  sin6 is a poor choice 
of variable names in this case since it makes it hard to interpret the code.

static int
check_subnet_v6(const struct sockaddr_in6 *address,
         const struct sockaddr_in6 *mask, const struct addrinfo *ai)
{
     for (; ai; ai = ai->ai_next) {
         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)ai->ai_addr;

         if (sin6->sin6_family != AF_INET6)
             continue;

         if (mask_match(address->sin6_addr.s6_addr32[0],
                 sin6->sin6_addr.s6_addr32[0],
                       mask->sin6_addr.s6_addr32[0]) &&
             mask_match(address->sin6_addr.s6_addr32[1],
                 sin6->sin6_addr.s6_addr32[1],
                       mask->sin6_addr.s6_addr32[1]) &&
             mask_match(address->sin6_addr.s6_addr32[2],
                 sin6->sin6_addr.s6_addr32[2],
                       mask->sin6_addr.s6_addr32[2]) &&
             mask_match(address->sin6_addr.s6_addr32[3],
                 sin6->sin6_addr.s6_addr32[3],
                       mask->sin6_addr.s6_addr32[3]))
             return 1;
     }
     return 0;
}


--- ./support/export/client.c.orig    2009-11-30 08:06:18.000000000 -0700
+++ ./support/export/client.c    2009-12-02 15:16:55.361725808 -0700
@@ -505,16 +505,16 @@ check_subnet_v6(const struct sockaddr_in
              continue;

          if (mask_match(address->sin6_addr.s6_addr32[0],
-                sin6->sin6_addr.s6_addr[0],
+                sin6->sin6_addr.s6_addr32[0],
                        mask->sin6_addr.s6_addr32[0]) &&
              mask_match(address->sin6_addr.s6_addr32[1],
-                sin6->sin6_addr.s6_addr[1],
+                sin6->sin6_addr.s6_addr32[1],
                        mask->sin6_addr.s6_addr32[1]) &&
              mask_match(address->sin6_addr.s6_addr32[2],
-                sin6->sin6_addr.s6_addr[2],
+                sin6->sin6_addr.s6_addr32[2],
                        mask->sin6_addr.s6_addr32[2]) &&
              mask_match(address->sin6_addr.s6_addr32[3],
-                sin6->sin6_addr.s6_addr[3],
+                sin6->sin6_addr.s6_addr32[3],
                        mask->sin6_addr.s6_addr32[3]))
              return 1;
      }

Re: [NFS] Nfs4 over Ipv6 patch to fix ipv6 subnetting in /etc/exports

[Chuck Lever]

On Dec 2, 2009, at 7:16 PM, Kelly Anderson wrote:

> On 12/02/2009 04:32 PM, Chuck Lever wrote:
>> [Cc: correct mailing list]
>>
>> IPv6 support in mountd is entirely experimental (ie not guaranteed  
>> to work), and exists only my personal git repo, not in the official  
>> nfs-utils git repo.  However, it looks like you are working against  
>> my code.
>
> I got it from the following.
> git://git.linux-nfs.org/projects/cel/nfs-utils.git
>
>>
>>
>> Also, we prefer patches submitted inline, not as attachments, as  
>> that makes it easy to hit "reply" and comment on the content of the  
>> patch.  A patch description and a Signed-off-by: line is required.   
>> Take a look in the archives of this mailing list for examples.
>>
>> Basically your patch misapplies the address mask in  
>> check_subnet_v6, so I don't think it's the right fix.  Instead of  
>> "sin6 & mask" you have "sin6 & sin6" which basically means the mask  
>> is ignored, and the check will always succeed.
>>
>> Maybe the mask generation code in init_netmask() is not correct?
>
> I think you missread the patch. So I posted the complete patched  
> function.  The problem was sin6->sin6_addr.s6_addr should be sin6- 
> >sin6_addr.s6_addr32.  It doesn't make sense to compare an 8 bit  
> value with a 32 bit value.

A typo.  Patch merged, thanks.  It may be a little while before I  
publish an update.

>  Notice it's really comparing "address" to "sin6" so it's really  
> ((address ^ sin6) & mask).  sin6 is a poor choice of variable names  
> in this case since it makes it hard to interpret the code.
>
> static int
> check_subnet_v6(const struct sockaddr_in6 *address,
>        const struct sockaddr_in6 *mask, const struct addrinfo *ai)
> {
>    for (; ai; ai = ai->ai_next) {
>        struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)ai->ai_addr;
>
>        if (sin6->sin6_family != AF_INET6)
>            continue;
>
>        if (mask_match(address->sin6_addr.s6_addr32[0],
>                sin6->sin6_addr.s6_addr32[0],
>                      mask->sin6_addr.s6_addr32[0]) &&
>            mask_match(address->sin6_addr.s6_addr32[1],
>                sin6->sin6_addr.s6_addr32[1],
>                      mask->sin6_addr.s6_addr32[1]) &&
>            mask_match(address->sin6_addr.s6_addr32[2],
>                sin6->sin6_addr.s6_addr32[2],
>                      mask->sin6_addr.s6_addr32[2]) &&
>            mask_match(address->sin6_addr.s6_addr32[3],
>                sin6->sin6_addr.s6_addr32[3],
>                      mask->sin6_addr.s6_addr32[3]))
>            return 1;
>    }
>    return 0;
> }
>
>
> --- ./support/export/client.c.orig    2009-11-30 08:06:18.000000000  
> -0700
> +++ ./support/export/client.c    2009-12-02 15:16:55.361725808 -0700
> @@ -505,16 +505,16 @@ check_subnet_v6(const struct sockaddr_in
>             continue;
>
>         if (mask_match(address->sin6_addr.s6_addr32[0],
> -                sin6->sin6_addr.s6_addr[0],
> +                sin6->sin6_addr.s6_addr32[0],
>                       mask->sin6_addr.s6_addr32[0]) &&
>             mask_match(address->sin6_addr.s6_addr32[1],
> -                sin6->sin6_addr.s6_addr[1],
> +                sin6->sin6_addr.s6_addr32[1],
>                       mask->sin6_addr.s6_addr32[1]) &&
>             mask_match(address->sin6_addr.s6_addr32[2],
> -                sin6->sin6_addr.s6_addr[2],
> +                sin6->sin6_addr.s6_addr32[2],
>                       mask->sin6_addr.s6_addr32[2]) &&
>             mask_match(address->sin6_addr.s6_addr32[3],
> -                sin6->sin6_addr.s6_addr[3],
> +                sin6->sin6_addr.s6_addr32[3],
>                       mask->sin6_addr.s6_addr32[3]))
>             return 1;
>     }
>
>

-- 
Chuck Lever
chuck[dot]lever[at]oracle[dot]com

Re: [NFS] Nfs4 over Ipv6 patch to fix ipv6 subnetting in /etc/exports

[Steve Dickson]

Hello,

On 12/02/2009 05:50 PM, Kelly Anderson wrote:
> --- ./support/export/client.c.orig	2009-11-30 08:06:18.000000000 -0700
> +++ ./support/export/client.c	2009-12-02 15:16:55.361725808 -0700
> @@ -505,16 +505,16 @@ check_subnet_v6(const struct sockaddr_in
>  			continue;
>  
>  		if (mask_match(address->sin6_addr.s6_addr32[0],
> -				sin6->sin6_addr.s6_addr[0],
> +				sin6->sin6_addr.s6_addr32[0],
>  		      		mask->sin6_addr.s6_addr32[0]) &&
>  		    mask_match(address->sin6_addr.s6_addr32[1],
> -				sin6->sin6_addr.s6_addr[1],
> +				sin6->sin6_addr.s6_addr32[1],
>  		      		mask->sin6_addr.s6_addr32[1]) &&
>  		    mask_match(address->sin6_addr.s6_addr32[2],
> -				sin6->sin6_addr.s6_addr[2],
> +				sin6->sin6_addr.s6_addr32[2],
>  		      		mask->sin6_addr.s6_addr32[2]) &&
>  		    mask_match(address->sin6_addr.s6_addr32[3],
> -				sin6->sin6_addr.s6_addr[3],
> +				sin6->sin6_addr.s6_addr32[3],
>  		      		mask->sin6_addr.s6_addr32[3]))
>  			return 1;
>  	}
I'm a bit confused here... I don't see a check_subnet_v6() routine
in support/export/client.c and from the git logs says there never
was a routine called check_subnet_v6()... what am I missing?

In the future, please add the Signed-off-by: label to the bottom
of the patch description... thanks!


steved.

------------------------------------------------------------------------------
Return on Information:
Google Enterprise Search pays you back
Get the facts.
http://p.sf.net/sfu/google-dev2dev
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs
_______________________________________________
Please note that nfs@lists.sourceforge.net is being discontinued.
Please subscribe to linux-nfs@vger.kernel.org instead.
    http://vger.kernel.org/vger-lists.html#linux-nfs

Re: [NFS] Nfs4 over Ipv6 patch to fix ipv6 subnetting in /etc/exports

[Chuck Lever]

Steve-

This patch is against my private repo, not against upstream nfs-utils.

On Dec 11, 2009, at 1:19 PM, Steve Dickson wrote:

> Hello,
>
> On 12/02/2009 05:50 PM, Kelly Anderson wrote:
>> --- ./support/export/client.c.orig	2009-11-30 08:06:18.000000000  
>> -0700
>> +++ ./support/export/client.c	2009-12-02 15:16:55.361725808 -0700
>> @@ -505,16 +505,16 @@ check_subnet_v6(const struct sockaddr_in
>> 			continue;
>>
>> 		if (mask_match(address->sin6_addr.s6_addr32[0],
>> -				sin6->sin6_addr.s6_addr[0],
>> +				sin6->sin6_addr.s6_addr32[0],
>> 		      		mask->sin6_addr.s6_addr32[0]) &&
>> 		    mask_match(address->sin6_addr.s6_addr32[1],
>> -				sin6->sin6_addr.s6_addr[1],
>> +				sin6->sin6_addr.s6_addr32[1],
>> 		      		mask->sin6_addr.s6_addr32[1]) &&
>> 		    mask_match(address->sin6_addr.s6_addr32[2],
>> -				sin6->sin6_addr.s6_addr[2],
>> +				sin6->sin6_addr.s6_addr32[2],
>> 		      		mask->sin6_addr.s6_addr32[2]) &&
>> 		    mask_match(address->sin6_addr.s6_addr32[3],
>> -				sin6->sin6_addr.s6_addr[3],
>> +				sin6->sin6_addr.s6_addr32[3],
>> 		      		mask->sin6_addr.s6_addr32[3]))
>> 			return 1;
>> 	}
> I'm a bit confused here... I don't see a check_subnet_v6() routine
> in support/export/client.c and from the git logs says there never
> was a routine called check_subnet_v6()... what am I missing?
>
> In the future, please add the Signed-off-by: label to the bottom
> of the patch description... thanks!
>
>
> steved.
>
> ------------------------------------------------------------------------------
> Return on Information:
> Google Enterprise Search pays you back
> Get the facts.
> http://p.sf.net/sfu/google-dev2dev
> _______________________________________________
> NFS maillist  -  NFS@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/nfs
> _______________________________________________
> Please note that nfs@lists.sourceforge.net is being discontinued.
> Please subscribe to linux-nfs@vger.kernel.org instead.
>    http://vger.kernel.org/vger-lists.html#linux-nfs
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-nfs"  
> in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

-- 
Chuck Lever
chuck[dot]lever[at]oracle[dot]com





------------------------------------------------------------------------------
Return on Information:
Google Enterprise Search pays you back
Get the facts.
http://p.sf.net/sfu/google-dev2dev
_______________________________________________
NFS maillist  -  NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs
_______________________________________________
Please note that nfs@lists.sourceforge.net is being discontinued.
Please subscribe to linux-nfs@vger.kernel.org instead.
    http://vger.kernel.org/vger-lists.html#linux-nfs