From: "J. Bruce Fields" <bfields@fieldses.org>
To: Neil Brown <neilb@cse.unsw.edu.au>
Cc: nfs@lists.sourceforge.net
Subject: [PATCH 3 of 6] svcrpc: move export table checks to a per-program pg_add_client method
Date: Tue, 18 Jan 2005 13:06:25 -0500 [thread overview]
Message-ID: <1106070956.b175e53d.3@fieldses.org> (raw)
In-Reply-To: <1106070956.b175e53d.2@fieldses.org>
svcauth_null_accept() and svcauth_unix_accept() are currently hard-wired to
check the source ip address on an incoming request against the export table,
which make sense for nfsd but not necessarily for other rpc-based services.
So instead we have the accept() method call a program-specific
pg_authenticate() method. We also move the call to this method into
svc_process instead of calling it from the flavor-specific accept() routines.
Signed-off-by: J. Bruce Fields <bfields@citi.umich.edu>
---
linux-2.6.11-rc1-bfields/fs/lockd/svc.c | 15 ++++++++++
linux-2.6.11-rc1-bfields/fs/nfsd/nfssvc.c | 2 +
linux-2.6.11-rc1-bfields/include/linux/sunrpc/svc.h | 1
linux-2.6.11-rc1-bfields/net/sunrpc/auth_gss/svcauth_gss.c | 9 +-----
linux-2.6.11-rc1-bfields/net/sunrpc/svc.c | 12 +++++++-
linux-2.6.11-rc1-bfields/net/sunrpc/svcauth_unix.c | 18 +------------
6 files changed, 33 insertions(+), 24 deletions(-)
diff -puN fs/lockd/svc.c~svcrpc_unix_ip_mapping_method fs/lockd/svc.c
--- linux-2.6.11-rc1/fs/lockd/svc.c~svcrpc_unix_ip_mapping_method 2005-01-17 12:04:01.000000000 -0500
+++ linux-2.6.11-rc1-bfields/fs/lockd/svc.c 2005-01-18 12:50:53.000000000 -0500
@@ -403,6 +403,20 @@ static int param_set_##name(const char *
return 0; \
}
+static int lockd_authenticate(struct svc_rqst *rqstp)
+{
+ rqstp->rq_client = NULL;
+ switch (rqstp->rq_authop->flavour) {
+ case RPC_AUTH_NULL:
+ case RPC_AUTH_UNIX:
+ if (rqstp->rq_proc == 0)
+ return SVC_OK;
+ return svc_set_client(rqstp);
+ }
+ return SVC_DENIED;
+}
+
+
param_set_min_max(port, int, simple_strtol, 0, 65535)
param_set_min_max(grace_period, unsigned long, simple_strtoul,
nlm_grace_period_min, nlm_grace_period_max)
@@ -483,4 +497,5 @@ static struct svc_program nlmsvc_program
.pg_name = "lockd", /* service name */
.pg_class = "nfsd", /* share authentication with nfsd */
.pg_stats = &nlmsvc_stats, /* stats table */
+ .pg_authenticate = &lockd_authenticate /* export authentication */
};
diff -puN fs/nfsd/nfssvc.c~svcrpc_unix_ip_mapping_method fs/nfsd/nfssvc.c
--- linux-2.6.11-rc1/fs/nfsd/nfssvc.c~svcrpc_unix_ip_mapping_method 2005-01-17 12:04:02.000000000 -0500
+++ linux-2.6.11-rc1-bfields/fs/nfsd/nfssvc.c 2005-01-17 12:04:02.000000000 -0500
@@ -378,4 +378,6 @@ struct svc_program nfsd_program = {
.pg_name = "nfsd", /* program name */
.pg_class = "nfsd", /* authentication class */
.pg_stats = &nfsd_svcstats, /* version table */
+ .pg_authenticate = &svc_set_client, /* export authentication */
+
};
diff -puN include/linux/sunrpc/svc.h~svcrpc_unix_ip_mapping_method include/linux/sunrpc/svc.h
--- linux-2.6.11-rc1/include/linux/sunrpc/svc.h~svcrpc_unix_ip_mapping_method 2005-01-17 12:04:02.000000000 -0500
+++ linux-2.6.11-rc1-bfields/include/linux/sunrpc/svc.h 2005-01-18 12:50:52.000000000 -0500
@@ -253,6 +253,7 @@ struct svc_program {
struct svc_stat * pg_stats; /* rpc statistics */
/* Override authentication. NULL means use default */
int (*pg_authenticate_obsolete)(struct svc_rqst *, u32 *);
+ int (*pg_authenticate)(struct svc_rqst *);
};
/*
diff -puN net/sunrpc/auth_gss/svcauth_gss.c~svcrpc_unix_ip_mapping_method net/sunrpc/auth_gss/svcauth_gss.c
--- linux-2.6.11-rc1/net/sunrpc/auth_gss/svcauth_gss.c~svcrpc_unix_ip_mapping_method 2005-01-17 12:04:02.000000000 -0500
+++ linux-2.6.11-rc1-bfields/net/sunrpc/auth_gss/svcauth_gss.c 2005-01-18 12:54:13.000000000 -0500
@@ -906,11 +906,6 @@ svcauth_gss_accept(struct svc_rqst *rqst
svc_putu32(resv, rpc_success);
goto complete;
case RPC_GSS_PROC_DATA:
- *authp = rpc_autherr_badcred;
- rqstp->rq_client =
- find_gss_auth_domain(rsci->mechctx, gc->gc_svc);
- if (rqstp->rq_client == NULL)
- goto auth_err;
*authp = rpcsec_gsserr_ctxproblem;
if (gss_write_verf(rqstp, rsci->mechctx, gc->gc_seq))
goto auth_err;
@@ -924,8 +919,6 @@ svcauth_gss_accept(struct svc_rqst *rqst
if (unwrap_integ_data(&rqstp->rq_arg,
gc->gc_seq, rsci->mechctx))
goto auth_err;
- svcdata->rsci = rsci;
- cache_get(&rsci->h);
/* placeholders for length and seq. number: */
svcdata->body_start = resv->iov_base + resv->iov_len;
svc_putu32(resv, 0);
@@ -936,6 +929,8 @@ svcauth_gss_accept(struct svc_rqst *rqst
default:
goto auth_err;
}
+ svcdata->rsci = rsci;
+ cache_get(&rsci->h);
ret = SVC_OK;
goto out;
}
diff -puN net/sunrpc/svcauth_unix.c~svcrpc_unix_ip_mapping_method net/sunrpc/svcauth_unix.c
--- linux-2.6.11-rc1/net/sunrpc/svcauth_unix.c~svcrpc_unix_ip_mapping_method 2005-01-17 12:04:02.000000000 -0500
+++ linux-2.6.11-rc1-bfields/net/sunrpc/svcauth_unix.c 2005-01-18 12:44:10.000000000 -0500
@@ -368,7 +368,6 @@ svcauth_null_accept(struct svc_rqst *rqs
struct kvec *argv = &rqstp->rq_arg.head[0];
struct kvec *resv = &rqstp->rq_res.head[0];
struct svc_cred *cred = &rqstp->rq_cred;
- int rv=0;
cred->cr_group_info = NULL;
rqstp->rq_client = NULL;
@@ -394,19 +393,11 @@ svcauth_null_accept(struct svc_rqst *rqs
if (cred->cr_group_info == NULL)
return SVC_DROP; /* kmalloc failure - client must retry */
- rv = svcauth_unix_set_client(rqstp);
- if (rv == SVC_DENIED)
- goto badcred;
-
/* Put NULL verifier */
svc_putu32(resv, RPC_AUTH_NULL);
svc_putu32(resv, 0);
- return rv;
-
-badcred:
- *authp = rpc_autherr_badcred;
- return SVC_DENIED;
+ return SVC_OK;
}
static int
@@ -441,7 +432,6 @@ svcauth_unix_accept(struct svc_rqst *rqs
struct svc_cred *cred = &rqstp->rq_cred;
u32 slen, i;
int len = argv->iov_len;
- int rv=0;
cred->cr_group_info = NULL;
rqstp->rq_client = NULL;
@@ -473,15 +463,11 @@ svcauth_unix_accept(struct svc_rqst *rqs
return SVC_DENIED;
}
- rv = svcauth_unix_set_client(rqstp);
- if (rv == SVC_DENIED)
- goto badcred;
-
/* Put NULL verifier */
svc_putu32(resv, RPC_AUTH_NULL);
svc_putu32(resv, 0);
- return rv;
+ return SVC_OK;
badcred:
*authp = rpc_autherr_badcred;
diff -puN net/sunrpc/svc.c~svcrpc_unix_ip_mapping_method net/sunrpc/svc.c
--- linux-2.6.11-rc1/net/sunrpc/svc.c~svcrpc_unix_ip_mapping_method 2005-01-17 12:04:02.000000000 -0500
+++ linux-2.6.11-rc1-bfields/net/sunrpc/svc.c 2005-01-18 12:50:52.000000000 -0500
@@ -264,6 +264,7 @@ svc_process(struct svc_serv *serv, struc
u32 dir, prog, vers, proc,
auth_stat, rpc_stat;
int auth_res;
+ u32 *accept_statp;
rpc_stat = rpc_success;
@@ -299,6 +300,9 @@ svc_process(struct svc_serv *serv, struc
if (vers != 2) /* RPC version number */
goto err_bad_rpc;
+ /* Save position in case we later decide to reject: */
+ accept_statp = resv->iov_base + resv->iov_len;
+
svc_putu32(resv, xdr_zero); /* ACCEPT */
rqstp->rq_prog = prog = ntohl(svc_getu32(argv)); /* program number */
@@ -315,6 +319,11 @@ svc_process(struct svc_serv *serv, struc
auth_res = progp->pg_authenticate_obsolete(rqstp, &auth_stat);
else
auth_res = svc_authenticate(rqstp, &auth_stat);
+ /* Also give the program a chance to reject this call: */
+ if (auth_res == SVC_OK) {
+ auth_stat = rpc_autherr_badcred;
+ auth_res = progp->pg_authenticate(rqstp);
+ }
switch (auth_res) {
case SVC_OK:
break;
@@ -437,7 +446,8 @@ err_bad_rpc:
err_bad_auth:
dprintk("svc: authentication failed (%d)\n", ntohl(auth_stat));
serv->sv_stats->rpcbadauth++;
- resv->iov_len -= 4;
+ /* Restore write pointer to location of accept status: */
+ xdr_ressize_check(rqstp, accept_statp);
svc_putu32(resv, xdr_one); /* REJECT */
svc_putu32(resv, xdr_one); /* AUTH_ERROR */
svc_putu32(resv, auth_stat); /* status */
_
-------------------------------------------------------
The SF.Net email is sponsored by: Beat the post-holiday blues
Get a FREE limited edition SourceForge.net t-shirt from ThinkGeek.
It's fun and FREE -- well, almost....http://www.thinkgeek.com/sfshirt
_______________________________________________
NFS maillist - NFS@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/nfs
next prev parent reply other threads:[~2005-01-18 18:06 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-01-18 18:06 6 patches J. Bruce Fields
2005-01-18 18:06 ` [PATCH 1 of 6] svcrpc: add a per-flavor set_client method J. Bruce Fields
2005-01-18 18:06 ` [PATCH 2 of 6] svcrpc: rename pg_authenticate J. Bruce Fields
2005-01-18 18:06 ` J. Bruce Fields [this message]
2005-01-18 18:06 ` [PATCH 4 of 6] nfs4: use new pg_set_client method to simplify nfs4 callback authentication J. Bruce Fields
2005-01-18 18:06 ` [PATCH 5 of 6] lockd: don't try to match callback requests against export table J. Bruce Fields
2005-01-18 18:06 ` [PATCH 6 of 6] nfsd: remove pg_authenticate field J. Bruce Fields
-- strict thread matches above, loose matches on Subject: below --
2004-12-09 22:28 [PATCH 2 of 6] svcrpc: rename pg_authenticate J. Bruce Fields
2004-12-09 22:28 ` [PATCH 3 of 6] svcrpc: move export table checks to a per-program pg_add_client method J. Bruce Fields
2004-09-16 23:16 [PATCH 2 of 6] svcrpc: share code duplicated between auth_unix and auth_null J. Bruce Fields
2004-09-16 23:16 ` [PATCH 3 of 6] svcrpc: move export table checks to a per-program pg_add_client method J. Bruce Fields
2004-09-16 23:38 ` Trond Myklebust
2004-09-17 1:11 ` J. Bruce Fields
2004-09-17 1:18 ` Trond Myklebust
2004-09-17 2:20 ` J. Bruce Fields
2004-09-22 6:54 ` Neil Brown
2004-09-23 21:46 ` J. Bruce Fields
2004-09-24 4:04 ` Neil Brown
2004-09-28 22:00 ` J. Bruce Fields
2004-09-28 22:11 ` Trond Myklebust
2004-09-28 22:37 ` Trond Myklebust
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1106070956.b175e53d.3@fieldses.org \
--to=bfields@fieldses.org \
--cc=neilb@cse.unsw.edu.au \
--cc=nfs@lists.sourceforge.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox