Print this page
*** NO COMMENTS ***
| Split |
Close |
| Expand all |
| Collapse all |
--- old/usr/src/lib/libshare/nfs/libshare_nfs.c
+++ new/usr/src/lib/libshare/nfs/libshare_nfs.c
1 1 /*
2 2 * CDDL HEADER START
3 3 *
4 4 * The contents of this file are subject to the terms of the
5 5 * Common Development and Distribution License (the "License").
6 6 * You may not use this file except in compliance with the License.
7 7 *
8 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 9 * or http://www.opensolaris.org/os/licensing.
10 10 * See the License for the specific language governing permissions
11 11 * and limitations under the License.
12 12 *
13 13 * When distributing Covered Code, include this CDDL HEADER in each
14 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 15 * If applicable, add the following below this CDDL HEADER, with the
16 16 * fields enclosed by brackets "[]" replaced with your own identifying
17 17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 18 *
19 19 * CDDL HEADER END
20 20 */
21 21
22 22 /*
23 23 * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
24 24 */
25 25
26 26 /*
27 27 * NFS specific functions
28 28 */
29 29 #include <stdio.h>
30 30 #include <string.h>
31 31 #include <ctype.h>
32 32 #include <stdlib.h>
33 33 #include <unistd.h>
34 34 #include <zone.h>
35 35 #include <errno.h>
36 36 #include <locale.h>
37 37 #include <signal.h>
38 38 #include <strings.h>
39 39 #include "libshare.h"
40 40 #include "libshare_impl.h"
41 41 #include <nfs/export.h>
42 42 #include <pwd.h>
43 43 #include <limits.h>
44 44 #include <libscf.h>
45 45 #include <syslog.h>
46 46 #include <rpcsvc/daemon_utils.h>
47 47 #include "nfslog_config.h"
48 48 #include "nfslogtab.h"
49 49 #include "libshare_nfs.h"
50 50 #include <nfs/nfs.h>
51 51 #include <nfs/nfssys.h>
52 52 #include "smfcfg.h"
53 53
54 54 /* should really be in some global place */
55 55 #define DEF_WIN 30000
56 56 #define OPT_CHUNK 1024
57 57
58 58 int debug = 0;
59 59
60 60 #define NFS_SERVER_SVC "svc:/network/nfs/server:default"
61 61 #define NFS_CLIENT_SVC (char *)"svc:/network/nfs/client:default"
62 62
63 63 /* internal functions */
64 64 static int nfs_init();
65 65 static void nfs_fini();
66 66 static int nfs_enable_share(sa_share_t);
67 67 static int nfs_disable_share(sa_share_t, char *);
68 68 static int nfs_validate_property(sa_handle_t, sa_property_t, sa_optionset_t);
69 69 static int nfs_validate_security_mode(char *);
70 70 static int nfs_is_security_opt(char *);
71 71 static int nfs_parse_legacy_options(sa_group_t, char *);
72 72 static char *nfs_format_options(sa_group_t, int);
73 73 static int nfs_set_proto_prop(sa_property_t);
74 74 static sa_protocol_properties_t nfs_get_proto_set();
75 75 static char *nfs_get_status();
76 76 static char *nfs_space_alias(char *);
77 77 static uint64_t nfs_features();
78 78
79 79 /*
80 80 * ops vector that provides the protocol specific info and operations
81 81 * for share management.
82 82 */
83 83
84 84 struct sa_plugin_ops sa_plugin_ops = {
85 85 SA_PLUGIN_VERSION,
86 86 "nfs",
87 87 nfs_init,
88 88 nfs_fini,
89 89 nfs_enable_share,
90 90 nfs_disable_share,
91 91 nfs_validate_property,
92 92 nfs_validate_security_mode,
93 93 nfs_is_security_opt,
94 94 nfs_parse_legacy_options,
95 95 nfs_format_options,
96 96 nfs_set_proto_prop,
97 97 nfs_get_proto_set,
98 98 nfs_get_status,
99 99 nfs_space_alias,
100 100 NULL, /* update_legacy */
101 101 NULL, /* delete_legacy */
102 102 NULL, /* change_notify */
103 103 NULL, /* enable_resource */
104 104 NULL, /* disable_resource */
105 105 nfs_features,
106 106 NULL, /* transient shares */
107 107 NULL, /* notify resource */
108 108 NULL, /* rename_resource */
109 109 NULL, /* run_command */
110 110 NULL, /* command_help */
111 111 NULL /* delete_proto_section */
112 112 };
113 113
114 114 /*
115 115 * list of support services needed
116 116 * defines should come from head/rpcsvc/daemon_utils.h
117 117 */
118 118
119 119 static char *service_list_default[] =
120 120 { STATD, LOCKD, MOUNTD, NFSD, NFSMAPID, RQUOTAD, REPARSED, NULL };
121 121 static char *service_list_logging[] =
122 122 { STATD, LOCKD, MOUNTD, NFSD, NFSMAPID, RQUOTAD, NFSLOGD, REPARSED,
123 123 NULL };
124 124
125 125 /*
126 126 * option definitions. Make sure to keep the #define for the option
127 127 * index just before the entry it is the index for. Changing the order
128 128 * can cause breakage. E.g OPT_RW is index 1 and must precede the
129 129 * line that includes the SHOPT_RW and OPT_RW entries.
130 130 */
131 131
132 132 struct option_defs optdefs[] = {
133 133 #define OPT_RO 0
134 134 {SHOPT_RO, OPT_RO, OPT_TYPE_ACCLIST},
135 135 #define OPT_RW 1
136 136 {SHOPT_RW, OPT_RW, OPT_TYPE_ACCLIST},
137 137 #define OPT_ROOT 2
138 138 {SHOPT_ROOT, OPT_ROOT, OPT_TYPE_ACCLIST},
139 139 #define OPT_SECURE 3
140 140 {SHOPT_SECURE, OPT_SECURE, OPT_TYPE_DEPRECATED},
141 141 #define OPT_ANON 4
142 142 {SHOPT_ANON, OPT_ANON, OPT_TYPE_USER},
143 143 #define OPT_WINDOW 5
144 144 {SHOPT_WINDOW, OPT_WINDOW, OPT_TYPE_NUMBER},
145 145 #define OPT_NOSUID 6
146 146 {SHOPT_NOSUID, OPT_NOSUID, OPT_TYPE_BOOLEAN},
147 147 #define OPT_ACLOK 7
148 148 {SHOPT_ACLOK, OPT_ACLOK, OPT_TYPE_BOOLEAN},
149 149 #define OPT_NOSUB 8
150 150 {SHOPT_NOSUB, OPT_NOSUB, OPT_TYPE_BOOLEAN},
151 151 #define OPT_SEC 9
152 152 {SHOPT_SEC, OPT_SEC, OPT_TYPE_SECURITY},
153 153 #define OPT_PUBLIC 10
154 154 {SHOPT_PUBLIC, OPT_PUBLIC, OPT_TYPE_BOOLEAN, OPT_SHARE_ONLY},
155 155 #define OPT_INDEX 11
156 156 {SHOPT_INDEX, OPT_INDEX, OPT_TYPE_FILE},
157 157 #define OPT_LOG 12
158 158 {SHOPT_LOG, OPT_LOG, OPT_TYPE_LOGTAG},
|
↓ open down ↓ |
158 lines elided |
↑ open up ↑ |
159 159 #define OPT_CKSUM 13
160 160 {SHOPT_CKSUM, OPT_CKSUM, OPT_TYPE_STRINGSET},
161 161 #define OPT_NONE 14
162 162 {SHOPT_NONE, OPT_NONE, OPT_TYPE_ACCLIST},
163 163 #define OPT_ROOT_MAPPING 15
164 164 {SHOPT_ROOT_MAPPING, OPT_ROOT_MAPPING, OPT_TYPE_USER},
165 165 #define OPT_CHARSET_MAP 16
166 166 {"", OPT_CHARSET_MAP, OPT_TYPE_ACCLIST},
167 167 #define OPT_NOACLFAB 17
168 168 {SHOPT_NOACLFAB, OPT_NOACLFAB, OPT_TYPE_BOOLEAN},
169 +#define OPT_NOHIDE 18
170 + {SHOPT_NOHIDE, OPT_NOHIDE, OPT_TYPE_BOOLEAN},
171 +
169 172 #ifdef VOLATILE_FH_TEST /* XXX added for testing volatile fh's only */
170 -#define OPT_VOLFH 18
173 +#define OPT_VOLFH 19
171 174 {SHOPT_VOLFH, OPT_VOLFH},
172 175 #endif /* VOLATILE_FH_TEST */
173 176 NULL
174 177 };
175 178
176 179 /*
177 180 * Codesets that may need to be converted to UTF-8 for file paths.
178 181 * Add new names here to add new property support. If we ever get a
179 182 * way to query the kernel for character sets, this should become
180 183 * dynamically loaded. Make sure changes here are reflected in
181 184 * cmd/fs.d/nfs/mountd/nfscmd.c
182 185 */
183 186
184 187 static char *legal_conv[] = {
185 188 "euc-cn",
186 189 "euc-jp",
187 190 "euc-jpms",
188 191 "euc-kr",
189 192 "euc-tw",
190 193 "iso8859-1",
191 194 "iso8859-2",
192 195 "iso8859-5",
193 196 "iso8859-6",
194 197 "iso8859-7",
195 198 "iso8859-8",
196 199 "iso8859-9",
197 200 "iso8859-13",
198 201 "iso8859-15",
199 202 "koi8-r",
200 203 NULL
201 204 };
202 205
203 206 /*
204 207 * list of properties that are related to security flavors.
205 208 */
206 209 static char *seclist[] = {
207 210 SHOPT_RO,
208 211 SHOPT_RW,
209 212 SHOPT_ROOT,
210 213 SHOPT_WINDOW,
211 214 SHOPT_NONE,
212 215 SHOPT_ROOT_MAPPING,
213 216 NULL
214 217 };
215 218
216 219 /* structure for list of securities */
217 220 struct securities {
218 221 sa_security_t security;
219 222 struct securities *next;
220 223 };
221 224
222 225 /*
223 226 * findcharset(charset)
224 227 *
225 228 * Returns B_TRUE if the charset is a legal conversion otherwise
226 229 * B_FALSE. This will need to be rewritten to be more efficient when
227 230 * we have a dynamic list of legal conversions.
228 231 */
229 232
230 233 static boolean_t
231 234 findcharset(char *charset)
232 235 {
233 236 int i;
234 237
235 238 for (i = 0; legal_conv[i] != NULL; i++)
236 239 if (strcmp(charset, legal_conv[i]) == 0)
237 240 return (B_TRUE);
238 241 return (B_FALSE);
239 242 }
240 243
241 244 /*
242 245 * findopt(name)
243 246 *
244 247 * Lookup option "name" in the option table and return the table
245 248 * index.
246 249 */
247 250
248 251 static int
249 252 findopt(char *name)
250 253 {
251 254 int i;
252 255 if (name != NULL) {
253 256 for (i = 0; optdefs[i].tag != NULL; i++) {
254 257 if (strcmp(optdefs[i].tag, name) == 0)
255 258 return (i);
256 259 }
257 260 if (findcharset(name))
258 261 return (OPT_CHARSET_MAP);
259 262 }
260 263 return (-1);
261 264 }
262 265
263 266 /*
264 267 * gettype(name)
265 268 *
266 269 * Return the type of option "name".
267 270 */
268 271
269 272 static int
270 273 gettype(char *name)
271 274 {
272 275 int optdef;
273 276
274 277 optdef = findopt(name);
275 278 if (optdef != -1)
276 279 return (optdefs[optdef].type);
277 280 return (OPT_TYPE_ANY);
278 281 }
279 282
280 283 /*
281 284 * nfs_validate_security_mode(mode)
282 285 *
283 286 * is the specified mode string a valid one for use with NFS?
284 287 */
285 288
286 289 static int
287 290 nfs_validate_security_mode(char *mode)
288 291 {
289 292 seconfig_t secinfo;
290 293 int err;
291 294
292 295 (void) memset(&secinfo, '\0', sizeof (secinfo));
293 296 err = nfs_getseconfig_byname(mode, &secinfo);
294 297 if (err == SC_NOERROR)
295 298 return (1);
296 299 return (0);
297 300 }
298 301
299 302 /*
300 303 * nfs_is_security_opt(tok)
301 304 *
302 305 * check to see if tok represents an option that is only valid in some
303 306 * security flavor.
304 307 */
305 308
306 309 static int
307 310 nfs_is_security_opt(char *tok)
308 311 {
309 312 int i;
310 313
311 314 for (i = 0; seclist[i] != NULL; i++) {
312 315 if (strcmp(tok, seclist[i]) == 0)
313 316 return (1);
314 317 }
315 318 return (0);
316 319 }
317 320
318 321 /*
319 322 * find_security(seclist, sec)
320 323 *
321 324 * Walk the current list of security flavors and return true if it is
322 325 * present, else return false.
323 326 */
324 327
325 328 static int
326 329 find_security(struct securities *seclist, sa_security_t sec)
327 330 {
328 331 while (seclist != NULL) {
329 332 if (seclist->security == sec)
330 333 return (1);
331 334 seclist = seclist->next;
332 335 }
333 336 return (0);
334 337 }
335 338
336 339 /*
337 340 * make_security_list(group, securitymodes, proto)
338 341 * go through the list of securitymodes and add them to the
339 342 * group's list of security optionsets. We also keep a list of
340 343 * those optionsets so we don't have to find them later. All of
341 344 * these will get copies of the same properties.
342 345 */
343 346
344 347 static struct securities *
345 348 make_security_list(sa_group_t group, char *securitymodes, char *proto)
346 349 {
347 350 char *tok, *next = NULL;
348 351 struct securities *curp, *headp = NULL, *prev;
349 352 sa_security_t check;
350 353 int freetok = 0;
351 354
352 355 for (tok = securitymodes; tok != NULL; tok = next) {
353 356 next = strchr(tok, ':');
354 357 if (next != NULL)
355 358 *next++ = '\0';
356 359 if (strcmp(tok, "default") == 0) {
357 360 /* resolve default into the real type */
358 361 tok = nfs_space_alias(tok);
359 362 freetok = 1;
360 363 }
361 364 check = sa_get_security(group, tok, proto);
362 365
363 366 /* add to the security list if it isn't there already */
364 367 if (check == NULL || !find_security(headp, check)) {
365 368 curp = (struct securities *)calloc(1,
366 369 sizeof (struct securities));
367 370 if (curp != NULL) {
368 371 if (check == NULL) {
369 372 curp->security = sa_create_security(
370 373 group, tok, proto);
371 374 } else {
372 375 curp->security = check;
373 376 }
374 377 /*
375 378 * note that the first time through the loop,
376 379 * headp will be NULL and prev will be
377 380 * undefined. Since headp is NULL, we set
378 381 * both it and prev to the curp (first
379 382 * structure to be allocated).
380 383 *
381 384 * later passes through the loop will have
382 385 * headp not being NULL and prev will be used
383 386 * to allocate at the end of the list.
384 387 */
385 388 if (headp == NULL) {
386 389 headp = curp;
387 390 prev = curp;
388 391 } else {
389 392 prev->next = curp;
390 393 prev = curp;
391 394 }
392 395 }
393 396 }
394 397
395 398 if (freetok) {
396 399 freetok = 0;
397 400 sa_free_attr_string(tok);
398 401 }
399 402 }
400 403 return (headp);
401 404 }
402 405
403 406 static void
404 407 free_security_list(struct securities *sec)
405 408 {
406 409 struct securities *next;
407 410 if (sec != NULL) {
408 411 for (next = sec->next; sec != NULL; sec = next) {
409 412 next = sec->next;
410 413 free(sec);
411 414 }
412 415 }
413 416 }
414 417
415 418 /*
416 419 * nfs_alistcat(str1, str2, sep)
417 420 *
418 421 * concatenate str1 and str2 into a new string using sep as a separate
419 422 * character. If memory allocation fails, return NULL;
420 423 */
421 424
422 425 static char *
423 426 nfs_alistcat(char *str1, char *str2, char sep)
424 427 {
425 428 char *newstr;
426 429 size_t len;
427 430
428 431 len = strlen(str1) + strlen(str2) + 2;
429 432 newstr = (char *)malloc(len);
430 433 if (newstr != NULL)
431 434 (void) snprintf(newstr, len, "%s%c%s", str1, sep, str2);
432 435 return (newstr);
433 436 }
434 437
435 438 /*
436 439 * add_security_prop(sec, name, value, persist)
437 440 *
438 441 * Add the property to the securities structure. This accumulates
439 442 * properties for as part of parsing legacy options.
440 443 */
441 444
442 445 static int
443 446 add_security_prop(struct securities *sec, char *name, char *value,
444 447 int persist, int iszfs)
445 448 {
446 449 sa_property_t prop;
447 450 int ret = SA_OK;
448 451
449 452 for (; sec != NULL; sec = sec->next) {
450 453 if (value == NULL) {
451 454 if (strcmp(name, SHOPT_RW) == 0 ||
452 455 strcmp(name, SHOPT_RO) == 0)
453 456 value = "*";
454 457 else
455 458 value = "true";
456 459 }
457 460
458 461 /*
459 462 * Get the existing property, if it exists, so we can
460 463 * determine what to do with it. The ro/rw/root
461 464 * properties can be merged if multiple instances of
462 465 * these properies are given. For example, if "rw"
463 466 * exists with a value "host1" and a later token of
464 467 * rw="host2" is seen, the values are merged into a
465 468 * single rw="host1:host2".
466 469 */
467 470 prop = sa_get_property(sec->security, name);
468 471
469 472 if (prop != NULL) {
470 473 char *oldvalue;
471 474 char *newvalue;
472 475
473 476 /*
474 477 * The security options of ro/rw/root might appear
475 478 * multiple times. If they do, the values need to be
476 479 * merged into an access list. If it was previously
477 480 * empty, the new value alone is added.
478 481 */
479 482 oldvalue = sa_get_property_attr(prop, "value");
480 483 if (oldvalue != NULL) {
481 484 /*
482 485 * The general case is to concatenate the new
483 486 * value onto the old value for multiple
484 487 * rw(ro/root) properties. A special case
485 488 * exists when either the old or new is the
486 489 * "all" case. In the special case, if both
487 490 * are "all", then it is "all", else if one is
488 491 * an access-list, that replaces the "all".
489 492 */
490 493 if (strcmp(oldvalue, "*") == 0) {
491 494 /* Replace old value with new value. */
492 495 newvalue = strdup(value);
493 496 } else if (strcmp(value, "*") == 0 ||
494 497 strcmp(oldvalue, value) == 0) {
495 498 /*
496 499 * Keep old value and ignore
497 500 * the new value.
498 501 */
499 502 newvalue = NULL;
500 503 } else {
501 504 /*
502 505 * Make a new list of old plus new
503 506 * access-list.
504 507 */
505 508 newvalue = nfs_alistcat(oldvalue,
506 509 value, ':');
507 510 }
508 511
509 512 if (newvalue != NULL) {
510 513 (void) sa_remove_property(prop);
511 514 prop = sa_create_property(name,
512 515 newvalue);
513 516 ret = sa_add_property(sec->security,
514 517 prop);
515 518 free(newvalue);
516 519 }
517 520 if (oldvalue != NULL)
518 521 sa_free_attr_string(oldvalue);
519 522 }
520 523 } else {
521 524 prop = sa_create_property(name, value);
522 525 ret = sa_add_property(sec->security, prop);
523 526 }
524 527 if (ret == SA_OK && !iszfs) {
525 528 ret = sa_commit_properties(sec->security, !persist);
526 529 }
527 530 }
528 531 return (ret);
529 532 }
530 533
531 534 /*
532 535 * check to see if group/share is persistent.
533 536 */
534 537 static int
535 538 is_persistent(sa_group_t group)
536 539 {
537 540 char *type;
538 541 int persist = 1;
539 542
540 543 type = sa_get_group_attr(group, "type");
541 544 if (type != NULL && strcmp(type, "persist") != 0)
542 545 persist = 0;
543 546 if (type != NULL)
544 547 sa_free_attr_string(type);
545 548 return (persist);
546 549 }
547 550
548 551 /*
549 552 * invalid_security(options)
550 553 *
551 554 * search option string for any invalid sec= type.
552 555 * return true (1) if any are not valid else false (0)
553 556 */
554 557 static int
555 558 invalid_security(char *options)
556 559 {
557 560 char *copy, *base, *token, *value;
558 561 int ret = 0;
559 562
560 563 copy = strdup(options);
561 564 token = base = copy;
562 565 while (token != NULL && ret == 0) {
563 566 token = strtok(base, ",");
564 567 base = NULL;
565 568 if (token != NULL) {
566 569 value = strchr(token, '=');
567 570 if (value != NULL)
568 571 *value++ = '\0';
569 572 if (strcmp(token, "sec") == 0) {
570 573 /* HAVE security flavors so check them */
571 574 char *tok, *next;
572 575 for (next = NULL, tok = value; tok != NULL;
573 576 tok = next) {
574 577 next = strchr(tok, ':');
575 578 if (next != NULL)
576 579 *next++ = '\0';
577 580 ret = !nfs_validate_security_mode(tok);
578 581 if (ret)
579 582 break;
580 583 }
581 584 }
582 585 }
583 586 }
584 587 if (copy != NULL)
585 588 free(copy);
586 589 return (ret);
587 590 }
588 591
589 592 /*
590 593 * nfs_parse_legacy_options(group, options)
591 594 *
592 595 * Parse the old style options into internal format and store on the
593 596 * specified group. Group could be a share for full legacy support.
594 597 */
595 598
596 599 static int
597 600 nfs_parse_legacy_options(sa_group_t group, char *options)
598 601 {
599 602 char *dup;
600 603 char *base;
601 604 char *token;
602 605 sa_optionset_t optionset;
603 606 struct securities *security_list = NULL;
604 607 sa_property_t prop;
605 608 int ret = SA_OK;
606 609 int iszfs = 0;
607 610 sa_group_t parent;
608 611 int persist = 0;
609 612 char *lasts;
610 613
611 614 /* do we have an existing optionset? */
612 615 optionset = sa_get_optionset(group, "nfs");
613 616 if (optionset == NULL) {
614 617 /* didn't find existing optionset so create one */
615 618 optionset = sa_create_optionset(group, "nfs");
616 619 } else {
617 620 /*
618 621 * Have an existing optionset . Ideally, we would need
619 622 * to compare options in order to detect errors. For
620 623 * now, we assume that the first optionset is the
621 624 * correct one and the others will be the same. An
622 625 * empty optionset is the same as no optionset so we
623 626 * don't want to exit in that case. Getting an empty
624 627 * optionset can occur with ZFS property checking.
625 628 */
626 629 if (sa_get_property(optionset, NULL) != NULL)
627 630 return (ret);
628 631 }
629 632
630 633 if (strcmp(options, SHOPT_RW) == 0) {
631 634 /*
632 635 * there is a special case of only the option "rw"
633 636 * being the default option. We don't have to do
634 637 * anything.
635 638 */
636 639 return (ret);
637 640 }
638 641
639 642 /*
640 643 * check if security types are present and validate them. If
641 644 * any are not legal, fail.
642 645 */
643 646
644 647 if (invalid_security(options)) {
645 648 return (SA_INVALID_SECURITY);
646 649 }
647 650
648 651 /*
649 652 * in order to not attempt to change ZFS properties unless
650 653 * absolutely necessary, we never do it in the legacy parsing.
651 654 */
652 655 if (sa_is_share(group)) {
653 656 char *zfs;
654 657 parent = sa_get_parent_group(group);
655 658 if (parent != NULL) {
656 659 zfs = sa_get_group_attr(parent, "zfs");
657 660 if (zfs != NULL) {
658 661 sa_free_attr_string(zfs);
659 662 iszfs++;
660 663 }
661 664 }
662 665 } else {
663 666 iszfs = sa_group_is_zfs(group);
664 667 }
665 668
666 669 /* We need a copy of options for the next part. */
667 670 dup = strdup(options);
668 671 if (dup == NULL)
669 672 return (SA_NO_MEMORY);
670 673
671 674 /*
672 675 * we need to step through each option in the string and then
673 676 * add either the option or the security option as needed. If
674 677 * this is not a persistent share, don't commit to the
675 678 * repository. If there is an error, we also want to abort the
676 679 * processing and report it.
677 680 */
678 681 persist = is_persistent(group);
679 682 base = dup;
680 683 token = dup;
681 684 lasts = NULL;
682 685 while (token != NULL && ret == SA_OK) {
683 686 ret = SA_OK;
684 687 token = strtok_r(base, ",", &lasts);
685 688 base = NULL;
686 689 if (token != NULL) {
687 690 char *value;
688 691 /*
689 692 * if the option has a value, it will have an '=' to
690 693 * separate the name from the value. The following
691 694 * code will result in value != NULL and token
692 695 * pointing to just the name if there is a value.
693 696 */
694 697 value = strchr(token, '=');
695 698 if (value != NULL) {
696 699 *value++ = '\0';
697 700 }
698 701 if (strcmp(token, "sec") == 0 ||
699 702 strcmp(token, "secure") == 0) {
700 703 /*
701 704 * Once in security parsing, we only
702 705 * do security. We do need to move
703 706 * between the security node and the
704 707 * toplevel. The security tag goes on
705 708 * the root while the following ones
706 709 * go on the security.
707 710 */
708 711 if (security_list != NULL) {
709 712 /*
710 713 * have an old list so close it and
711 714 * start the new
712 715 */
713 716 free_security_list(security_list);
714 717 }
715 718 if (strcmp(token, "secure") == 0) {
716 719 value = "dh";
717 720 } else {
718 721 if (value == NULL) {
719 722 ret = SA_SYNTAX_ERR;
720 723 break;
721 724 }
722 725 }
723 726 security_list = make_security_list(group,
724 727 value, "nfs");
725 728 } else {
726 729 /*
727 730 * Note that the "old" syntax allowed a
728 731 * default security model This must be
729 732 * accounted for and internally converted to
730 733 * "standard" security structure.
731 734 */
732 735 if (nfs_is_security_opt(token)) {
733 736 if (security_list == NULL) {
734 737 /*
735 738 * need to have a
736 739 * security
737 740 * option. This will
738 741 * be "closed" when a
739 742 * defined "sec="
740 743 * option is
741 744 * seen. This is
742 745 * technically an
743 746 * error but will be
744 747 * allowed with
745 748 * warning.
746 749 */
747 750 security_list =
748 751 make_security_list(group,
749 752 "default",
750 753 "nfs");
751 754 }
752 755 if (security_list != NULL) {
753 756 ret = add_security_prop(
754 757 security_list, token,
755 758 value, persist, iszfs);
756 759 } else {
757 760 ret = SA_NO_MEMORY;
758 761 }
759 762 } else {
760 763 /* regular options */
761 764 if (value == NULL) {
762 765 if (strcmp(token, SHOPT_RW) ==
763 766 0 || strcmp(token,
764 767 SHOPT_RO) == 0) {
765 768 value = "*";
766 769 } else {
767 770 value = "global";
768 771 if (strcmp(token,
769 772 SHOPT_LOG) != 0) {
770 773 value = "true";
771 774 }
772 775 }
773 776 }
774 777 /*
775 778 * In all cases, create the
776 779 * property specified. If the
777 780 * value was NULL, the default
778 781 * value will have been
779 782 * substituted.
780 783 */
781 784 prop = sa_create_property(token, value);
782 785 ret = sa_add_property(optionset, prop);
783 786 if (ret != SA_OK)
784 787 break;
785 788
786 789 if (!iszfs) {
787 790 ret = sa_commit_properties(
788 791 optionset, !persist);
789 792 }
790 793 }
791 794 }
792 795 }
793 796 }
794 797 if (security_list != NULL)
795 798 free_security_list(security_list);
796 799
797 800 free(dup);
798 801 return (ret);
799 802 }
800 803
801 804 /*
802 805 * is_a_number(number)
803 806 *
804 807 * is the string a number in one of the forms we want to use?
805 808 */
806 809
807 810 static int
808 811 is_a_number(char *number)
809 812 {
810 813 int ret = 1;
811 814 int hex = 0;
812 815
813 816 if (strncmp(number, "0x", 2) == 0) {
814 817 number += 2;
815 818 hex = 1;
816 819 } else if (*number == '-') {
817 820 number++; /* skip the minus */
818 821 }
819 822 while (ret == 1 && *number != '\0') {
820 823 if (hex) {
821 824 ret = isxdigit(*number++);
822 825 } else {
823 826 ret = isdigit(*number++);
824 827 }
825 828 }
826 829 return (ret);
827 830 }
828 831
829 832 /*
830 833 * Look for the specified tag in the configuration file. If it is found,
831 834 * enable logging and set the logging configuration information for exp.
832 835 */
833 836 static void
834 837 configlog(struct exportdata *exp, char *tag)
835 838 {
836 839 nfsl_config_t *configlist = NULL, *configp;
837 840 int error = 0;
838 841 char globaltag[] = DEFAULTTAG;
839 842
840 843 /*
841 844 * Sends config errors to stderr
842 845 */
843 846 nfsl_errs_to_syslog = B_FALSE;
844 847
845 848 /*
846 849 * get the list of configuration settings
847 850 */
848 851 error = nfsl_getconfig_list(&configlist);
849 852 if (error) {
850 853 (void) fprintf(stderr,
851 854 dgettext(TEXT_DOMAIN, "Cannot get log configuration: %s\n"),
852 855 strerror(error));
853 856 }
854 857
855 858 if (tag == NULL)
856 859 tag = globaltag;
857 860 if ((configp = nfsl_findconfig(configlist, tag, &error)) == NULL) {
858 861 nfsl_freeconfig_list(&configlist);
859 862 (void) fprintf(stderr,
860 863 dgettext(TEXT_DOMAIN, "No tags matching \"%s\"\n"), tag);
861 864 /* bad configuration */
862 865 error = ENOENT;
863 866 goto err;
864 867 }
865 868
866 869 if ((exp->ex_tag = strdup(tag)) == NULL) {
867 870 error = ENOMEM;
868 871 goto out;
869 872 }
870 873 if ((exp->ex_log_buffer = strdup(configp->nc_bufferpath)) == NULL) {
871 874 error = ENOMEM;
872 875 goto out;
873 876 }
874 877 exp->ex_flags |= EX_LOG;
875 878 if (configp->nc_rpclogpath != NULL)
876 879 exp->ex_flags |= EX_LOG_ALLOPS;
877 880 out:
878 881 if (configlist != NULL)
879 882 nfsl_freeconfig_list(&configlist);
880 883
881 884 err:
882 885 if (error != 0) {
883 886 if (exp->ex_flags != NULL)
884 887 free(exp->ex_tag);
885 888 if (exp->ex_log_buffer != NULL)
886 889 free(exp->ex_log_buffer);
887 890 (void) fprintf(stderr,
888 891 dgettext(TEXT_DOMAIN, "Cannot set log configuration: %s\n"),
889 892 strerror(error));
890 893 }
891 894 }
892 895
893 896 /*
894 897 * fill_export_from_optionset(export, optionset)
895 898 *
896 899 * In order to share, we need to set all the possible general options
897 900 * into the export structure. Share info will be filled in by the
898 901 * caller. Various property values get turned into structure specific
899 902 * values.
900 903 */
901 904
902 905 static int
903 906 fill_export_from_optionset(struct exportdata *export, sa_optionset_t optionset)
904 907 {
905 908 sa_property_t option;
906 909 int ret = SA_OK;
907 910
908 911 for (option = sa_get_property(optionset, NULL);
909 912 option != NULL; option = sa_get_next_property(option)) {
910 913 char *name;
911 914 char *value;
912 915 uint32_t val;
913 916
914 917 /*
915 918 * since options may be set/reset multiple times, always do an
916 919 * explicit set or clear of the option. This allows defaults
917 920 * to be set and then the protocol specific to override.
918 921 */
919 922
920 923 name = sa_get_property_attr(option, "type");
921 924 value = sa_get_property_attr(option, "value");
922 925 switch (findopt(name)) {
923 926 case OPT_ANON:
924 927 if (value != NULL && is_a_number(value)) {
925 928 val = strtoul(value, NULL, 0);
926 929 } else {
927 930 struct passwd *pw;
928 931 pw = getpwnam(value != NULL ? value : "nobody");
929 932 if (pw != NULL) {
930 933 val = pw->pw_uid;
931 934 } else {
932 935 val = UID_NOBODY;
933 936 }
934 937 endpwent();
935 938 }
936 939 export->ex_anon = val;
937 940 break;
938 941 case OPT_NOSUID:
939 942 if (value != NULL && (strcasecmp(value, "true") == 0 ||
940 943 strcmp(value, "1") == 0))
941 944 export->ex_flags |= EX_NOSUID;
942 945 else
943 946 export->ex_flags &= ~EX_NOSUID;
944 947 break;
945 948 case OPT_ACLOK:
946 949 if (value != NULL && (strcasecmp(value, "true") == 0 ||
947 950 strcmp(value, "1") == 0))
948 951 export->ex_flags |= EX_ACLOK;
949 952 else
950 953 export->ex_flags &= ~EX_ACLOK;
951 954 break;
952 955 case OPT_NOSUB:
953 956 if (value != NULL && (strcasecmp(value, "true") == 0 ||
954 957 strcmp(value, "1") == 0))
955 958 export->ex_flags |= EX_NOSUB;
956 959 else
957 960 export->ex_flags &= ~EX_NOSUB;
958 961 break;
959 962 case OPT_PUBLIC:
960 963 if (value != NULL && (strcasecmp(value, "true") == 0 ||
961 964 strcmp(value, "1") == 0))
962 965 export->ex_flags |= EX_PUBLIC;
963 966 else
964 967 export->ex_flags &= ~EX_PUBLIC;
965 968 break;
966 969 case OPT_INDEX:
967 970 if (value != NULL && (strcmp(value, "..") == 0 ||
968 971 strchr(value, '/') != NULL)) {
969 972 /* this is an error */
970 973 (void) printf(dgettext(TEXT_DOMAIN,
971 974 "NFS: index=\"%s\" not valid;"
972 975 "must be a filename.\n"),
973 976 value);
974 977 break;
975 978 }
976 979 if (value != NULL && *value != '\0' &&
977 980 strcmp(value, ".") != 0) {
978 981 /* valid index file string */
979 982 if (export->ex_index != NULL) {
980 983 /* left over from "default" */
981 984 free(export->ex_index);
982 985 }
983 986 /* remember to free */
984 987 export->ex_index = strdup(value);
985 988 if (export->ex_index == NULL) {
986 989 (void) printf(dgettext(TEXT_DOMAIN,
987 990 "NFS: out of memory setting "
988 991 "index property\n"));
989 992 break;
990 993 }
991 994 export->ex_flags |= EX_INDEX;
992 995 }
993 996 break;
994 997 case OPT_LOG:
995 998 if (value == NULL)
996 999 value = strdup("global");
997 1000 if (value != NULL)
998 1001 configlog(export,
999 1002 strlen(value) ? value : "global");
1000 1003 break;
1001 1004 case OPT_CHARSET_MAP:
1002 1005 /*
1003 1006 * Set EX_CHARMAP when there is at least one
1004 1007 * charmap conversion property. This will get
1005 1008 * checked by the nfs server when it needs to.
|
↓ open down ↓ |
825 lines elided |
↑ open up ↑ |
1006 1009 */
1007 1010 export->ex_flags |= EX_CHARMAP;
1008 1011 break;
1009 1012 case OPT_NOACLFAB:
1010 1013 if (value != NULL && (strcasecmp(value, "true") == 0 ||
1011 1014 strcmp(value, "1") == 0))
1012 1015 export->ex_flags |= EX_NOACLFAB;
1013 1016 else
1014 1017 export->ex_flags &= ~EX_NOACLFAB;
1015 1018 break;
1019 + case OPT_NOHIDE:
1020 + if (value != NULL && (strcasecmp(value, "true") == 0 ||
1021 + strcmp(value, "1") == 0))
1022 + export->ex_flags |= EX_NOHIDE;
1023 + else
1024 + export->ex_flags &= ~EX_NOHIDE;
1025 +
1026 + break;
1016 1027 default:
1017 1028 /* have a syntactic error */
1018 1029 (void) printf(dgettext(TEXT_DOMAIN,
1019 1030 "NFS: unrecognized option %s=%s\n"),
1020 1031 name != NULL ? name : "",
1021 1032 value != NULL ? value : "");
1022 1033 break;
1023 1034 }
1024 1035 if (name != NULL)
1025 1036 sa_free_attr_string(name);
1026 1037 if (value != NULL)
1027 1038 sa_free_attr_string(value);
1028 1039 }
1029 1040 return (ret);
1030 1041 }
1031 1042
1032 1043 /*
1033 1044 * cleanup_export(export)
1034 1045 *
1035 1046 * Cleanup the allocated areas so we don't leak memory
1036 1047 */
1037 1048
1038 1049 static void
1039 1050 cleanup_export(struct exportdata *export)
1040 1051 {
1041 1052 int i;
1042 1053
1043 1054 if (export->ex_index != NULL)
1044 1055 free(export->ex_index);
1045 1056 if (export->ex_secinfo != NULL) {
1046 1057 for (i = 0; i < export->ex_seccnt; i++)
1047 1058 if (export->ex_secinfo[i].s_rootnames != NULL)
1048 1059 free(export->ex_secinfo[i].s_rootnames);
1049 1060 free(export->ex_secinfo);
1050 1061 }
1051 1062 }
1052 1063
1053 1064 /*
1054 1065 * Given a seconfig entry and a colon-separated
1055 1066 * list of names, allocate an array big enough
1056 1067 * to hold the root list, then convert each name to
1057 1068 * a principal name according to the security
1058 1069 * info and assign it to an array element.
1059 1070 * Return the array and its size.
1060 1071 */
1061 1072 static caddr_t *
1062 1073 get_rootnames(seconfig_t *sec, char *list, int *count)
1063 1074 {
1064 1075 caddr_t *a;
1065 1076 int c, i;
1066 1077 char *host, *p;
1067 1078
1068 1079 /*
1069 1080 * Count the number of strings in the list.
1070 1081 * This is the number of colon separators + 1.
1071 1082 */
1072 1083 c = 1;
1073 1084 for (p = list; *p; p++)
1074 1085 if (*p == ':')
1075 1086 c++;
1076 1087 *count = c;
1077 1088
1078 1089 a = (caddr_t *)malloc(c * sizeof (char *));
1079 1090 if (a == NULL) {
1080 1091 (void) printf(dgettext(TEXT_DOMAIN,
1081 1092 "get_rootnames: no memory\n"));
1082 1093 } else {
1083 1094 for (i = 0; i < c; i++) {
1084 1095 host = strtok(list, ":");
1085 1096 if (!nfs_get_root_principal(sec, host, &a[i])) {
1086 1097 free(a);
1087 1098 a = NULL;
1088 1099 break;
1089 1100 }
1090 1101 list = NULL;
1091 1102 }
1092 1103 }
1093 1104
1094 1105 return (a);
1095 1106 }
1096 1107
1097 1108 /*
1098 1109 * fill_security_from_secopts(sp, secopts)
1099 1110 *
1100 1111 * Fill the secinfo structure from the secopts optionset.
1101 1112 */
1102 1113
1103 1114 static int
1104 1115 fill_security_from_secopts(struct secinfo *sp, sa_security_t secopts)
1105 1116 {
1106 1117 sa_property_t prop;
1107 1118 char *type;
1108 1119 int longform;
1109 1120 int err = SC_NOERROR;
1110 1121 uint32_t val;
1111 1122
1112 1123 type = sa_get_security_attr(secopts, "sectype");
1113 1124 if (type != NULL) {
1114 1125 /* named security type needs secinfo to be filled in */
1115 1126 err = nfs_getseconfig_byname(type, &sp->s_secinfo);
1116 1127 sa_free_attr_string(type);
1117 1128 if (err != SC_NOERROR)
1118 1129 return (err);
1119 1130 } else {
1120 1131 /* default case */
1121 1132 err = nfs_getseconfig_default(&sp->s_secinfo);
1122 1133 if (err != SC_NOERROR)
1123 1134 return (err);
1124 1135 }
1125 1136
1126 1137 err = SA_OK;
1127 1138 for (prop = sa_get_property(secopts, NULL);
1128 1139 prop != NULL && err == SA_OK;
1129 1140 prop = sa_get_next_property(prop)) {
1130 1141 char *name;
1131 1142 char *value;
1132 1143
1133 1144 name = sa_get_property_attr(prop, "type");
1134 1145 value = sa_get_property_attr(prop, "value");
1135 1146
1136 1147 longform = value != NULL && strcmp(value, "*") != 0;
1137 1148
1138 1149 switch (findopt(name)) {
1139 1150 case OPT_RO:
1140 1151 sp->s_flags |= longform ? M_ROL : M_RO;
1141 1152 break;
1142 1153 case OPT_RW:
1143 1154 sp->s_flags |= longform ? M_RWL : M_RW;
1144 1155 break;
1145 1156 case OPT_ROOT:
1146 1157 sp->s_flags |= M_ROOT;
1147 1158 /*
1148 1159 * if we are using AUTH_UNIX, handle like other things
1149 1160 * such as RO/RW
1150 1161 */
1151 1162 if (sp->s_secinfo.sc_rpcnum == AUTH_UNIX)
1152 1163 continue;
1153 1164 /* not AUTH_UNIX */
1154 1165 if (value != NULL) {
1155 1166 sp->s_rootnames = get_rootnames(&sp->s_secinfo,
1156 1167 value, &sp->s_rootcnt);
1157 1168 if (sp->s_rootnames == NULL) {
1158 1169 err = SA_BAD_VALUE;
1159 1170 (void) fprintf(stderr,
1160 1171 dgettext(TEXT_DOMAIN,
1161 1172 "Bad root list\n"));
1162 1173 }
1163 1174 }
1164 1175 break;
1165 1176 case OPT_NONE:
1166 1177 sp->s_flags |= M_NONE;
1167 1178 break;
1168 1179 case OPT_WINDOW:
1169 1180 if (value != NULL) {
1170 1181 sp->s_window = atoi(value);
1171 1182 /* just in case */
1172 1183 if (sp->s_window < 0)
1173 1184 sp->s_window = DEF_WIN;
1174 1185 }
1175 1186 break;
1176 1187 case OPT_ROOT_MAPPING:
1177 1188 if (value != NULL && is_a_number(value)) {
1178 1189 val = strtoul(value, NULL, 0);
1179 1190 } else {
1180 1191 struct passwd *pw;
1181 1192 pw = getpwnam(value != NULL ? value : "nobody");
1182 1193 if (pw != NULL) {
1183 1194 val = pw->pw_uid;
1184 1195 } else {
1185 1196 val = UID_NOBODY;
1186 1197 }
1187 1198 endpwent();
1188 1199 }
1189 1200 sp->s_rootid = val;
1190 1201 break;
1191 1202 default:
1192 1203 break;
1193 1204 }
1194 1205 if (name != NULL)
1195 1206 sa_free_attr_string(name);
1196 1207 if (value != NULL)
1197 1208 sa_free_attr_string(value);
1198 1209 }
1199 1210 /* if rw/ro options not set, use default of RW */
1200 1211 if ((sp->s_flags & NFS_RWMODES) == 0)
1201 1212 sp->s_flags |= M_RW;
1202 1213 return (err);
1203 1214 }
1204 1215
1205 1216 /*
1206 1217 * This is for testing only
1207 1218 * It displays the export structure that
1208 1219 * goes into the kernel.
1209 1220 */
1210 1221 static void
1211 1222 printarg(char *path, struct exportdata *ep)
1212 1223 {
1213 1224 int i, j;
1214 1225 struct secinfo *sp;
1215 1226
1216 1227 if (debug == 0)
1217 1228 return;
1218 1229
1219 1230 (void) printf("%s:\n", path);
1220 1231 (void) printf("\tex_version = %d\n", ep->ex_version);
1221 1232 (void) printf("\tex_path = %s\n", ep->ex_path);
1222 1233 (void) printf("\tex_pathlen = %ld\n", (ulong_t)ep->ex_pathlen);
1223 1234 (void) printf("\tex_flags: (0x%02x) ", ep->ex_flags);
1224 1235 if (ep->ex_flags & EX_NOSUID)
1225 1236 (void) printf("NOSUID ");
1226 1237 if (ep->ex_flags & EX_ACLOK)
1227 1238 (void) printf("ACLOK ");
1228 1239 if (ep->ex_flags & EX_PUBLIC)
1229 1240 (void) printf("PUBLIC ");
1230 1241 if (ep->ex_flags & EX_NOSUB)
1231 1242 (void) printf("NOSUB ");
1232 1243 if (ep->ex_flags & EX_LOG)
1233 1244 (void) printf("LOG ");
1234 1245 if (ep->ex_flags & EX_CHARMAP)
1235 1246 (void) printf("CHARMAP ");
1236 1247 if (ep->ex_flags & EX_LOG_ALLOPS)
1237 1248 (void) printf("LOG_ALLOPS ");
1238 1249 if (ep->ex_flags == 0)
1239 1250 (void) printf("(none)");
1240 1251 (void) printf("\n");
1241 1252 if (ep->ex_flags & EX_LOG) {
1242 1253 (void) printf("\tex_log_buffer = %s\n",
1243 1254 (ep->ex_log_buffer ? ep->ex_log_buffer : "(NULL)"));
1244 1255 (void) printf("\tex_tag = %s\n",
1245 1256 (ep->ex_tag ? ep->ex_tag : "(NULL)"));
1246 1257 }
1247 1258 (void) printf("\tex_anon = %d\n", ep->ex_anon);
1248 1259 (void) printf("\tex_seccnt = %d\n", ep->ex_seccnt);
1249 1260 (void) printf("\n");
1250 1261 for (i = 0; i < ep->ex_seccnt; i++) {
1251 1262 sp = &ep->ex_secinfo[i];
1252 1263 (void) printf("\t\ts_secinfo = %s\n", sp->s_secinfo.sc_name);
1253 1264 (void) printf("\t\ts_flags: (0x%02x) ", sp->s_flags);
1254 1265 if (sp->s_flags & M_ROOT) (void) printf("M_ROOT ");
1255 1266 if (sp->s_flags & M_RO) (void) printf("M_RO ");
1256 1267 if (sp->s_flags & M_ROL) (void) printf("M_ROL ");
1257 1268 if (sp->s_flags & M_RW) (void) printf("M_RW ");
1258 1269 if (sp->s_flags & M_RWL) (void) printf("M_RWL ");
1259 1270 if (sp->s_flags & M_NONE) (void) printf("M_NONE ");
1260 1271 if (sp->s_flags == 0) (void) printf("(none)");
1261 1272 (void) printf("\n");
1262 1273 (void) printf("\t\ts_window = %d\n", sp->s_window);
1263 1274 (void) printf("\t\ts_rootid = %d\n", sp->s_rootid);
1264 1275 (void) printf("\t\ts_rootcnt = %d ", sp->s_rootcnt);
1265 1276 (void) fflush(stdout);
1266 1277 for (j = 0; j < sp->s_rootcnt; j++)
1267 1278 (void) printf("%s ", sp->s_rootnames[j] ?
1268 1279 sp->s_rootnames[j] : "<null>");
1269 1280 (void) printf("\n\n");
1270 1281 }
1271 1282 }
1272 1283
1273 1284 /*
1274 1285 * count_security(opts)
1275 1286 *
1276 1287 * Count the number of security types (flavors). The optionset has
1277 1288 * been populated with the security flavors as a holding mechanism.
1278 1289 * We later use this number to allocate data structures.
1279 1290 */
1280 1291
1281 1292 static int
1282 1293 count_security(sa_optionset_t opts)
1283 1294 {
1284 1295 int count = 0;
1285 1296 sa_property_t prop;
1286 1297 if (opts != NULL) {
1287 1298 for (prop = sa_get_property(opts, NULL); prop != NULL;
1288 1299 prop = sa_get_next_property(prop)) {
1289 1300 count++;
1290 1301 }
1291 1302 }
1292 1303 return (count);
1293 1304 }
1294 1305
1295 1306 /*
1296 1307 * nfs_sprint_option(rbuff, rbuffsize, incr, prop, sep)
1297 1308 *
1298 1309 * provides a mechanism to format NFS properties into legacy output
1299 1310 * format. If the buffer would overflow, it is reallocated and grown
1300 1311 * as appropriate. Special cases of converting internal form of values
1301 1312 * to those used by "share" are done. this function does one property
1302 1313 * at a time.
1303 1314 */
1304 1315
1305 1316 static int
1306 1317 nfs_sprint_option(char **rbuff, size_t *rbuffsize, size_t incr,
1307 1318 sa_property_t prop, int sep)
1308 1319 {
1309 1320 char *name;
1310 1321 char *value;
1311 1322 int curlen;
1312 1323 char *buff = *rbuff;
1313 1324 size_t buffsize = *rbuffsize;
1314 1325 int printed = B_FALSE;
1315 1326
1316 1327 name = sa_get_property_attr(prop, "type");
1317 1328 value = sa_get_property_attr(prop, "value");
1318 1329 if (buff != NULL)
1319 1330 curlen = strlen(buff);
1320 1331 else
1321 1332 curlen = 0;
1322 1333 if (name != NULL) {
1323 1334 int len;
1324 1335 len = strlen(name) + sep;
1325 1336
1326 1337 /*
1327 1338 * A future RFE would be to replace this with more
1328 1339 * generic code and to possibly handle more types.
1329 1340 */
1330 1341 switch (gettype(name)) {
1331 1342 case OPT_TYPE_BOOLEAN:
1332 1343 /*
1333 1344 * For NFS, boolean value of FALSE means it
1334 1345 * doesn't show up in the option list at all.
1335 1346 */
1336 1347 if (value != NULL && strcasecmp(value, "false") == 0)
1337 1348 goto skip;
1338 1349 if (value != NULL) {
1339 1350 sa_free_attr_string(value);
1340 1351 value = NULL;
1341 1352 }
1342 1353 break;
1343 1354 case OPT_TYPE_ACCLIST:
1344 1355 if (value != NULL && strcmp(value, "*") == 0) {
1345 1356 sa_free_attr_string(value);
1346 1357 value = NULL;
1347 1358 } else {
1348 1359 if (value != NULL)
1349 1360 len += 1 + strlen(value);
1350 1361 }
1351 1362 break;
1352 1363 case OPT_TYPE_LOGTAG:
1353 1364 if (value != NULL && strlen(value) == 0) {
1354 1365 sa_free_attr_string(value);
1355 1366 value = NULL;
1356 1367 } else {
1357 1368 if (value != NULL)
1358 1369 len += 1 + strlen(value);
1359 1370 }
1360 1371 break;
1361 1372 default:
1362 1373 if (value != NULL)
1363 1374 len += 1 + strlen(value);
1364 1375 break;
1365 1376 }
1366 1377 while (buffsize <= (curlen + len)) {
1367 1378 /* need more room */
1368 1379 buffsize += incr;
1369 1380 buff = realloc(buff, buffsize);
1370 1381 if (buff == NULL) {
1371 1382 /* realloc failed so free everything */
1372 1383 if (*rbuff != NULL)
1373 1384 free(*rbuff);
1374 1385 }
1375 1386 *rbuff = buff;
1376 1387 *rbuffsize = buffsize;
1377 1388 if (buff == NULL)
1378 1389 goto skip;
1379 1390
1380 1391 }
1381 1392
1382 1393 if (buff == NULL)
1383 1394 goto skip;
1384 1395
1385 1396 if (value == NULL) {
1386 1397 (void) snprintf(buff + curlen, buffsize - curlen,
1387 1398 "%s%s", sep ? "," : "",
1388 1399 name, value != NULL ? value : "");
1389 1400 } else {
1390 1401 (void) snprintf(buff + curlen, buffsize - curlen,
1391 1402 "%s%s=%s", sep ? "," : "",
1392 1403 name, value != NULL ? value : "");
1393 1404 }
1394 1405 printed = B_TRUE;
1395 1406 }
1396 1407 skip:
1397 1408 if (name != NULL)
1398 1409 sa_free_attr_string(name);
1399 1410 if (value != NULL)
1400 1411 sa_free_attr_string(value);
1401 1412 return (printed);
1402 1413 }
1403 1414
1404 1415 /*
1405 1416 * nfs_format_options(group, hier)
1406 1417 *
1407 1418 * format all the options on the group into an old-style option
1408 1419 * string. If hier is non-zero, walk up the tree to get inherited
1409 1420 * options.
1410 1421 */
1411 1422
1412 1423 static char *
1413 1424 nfs_format_options(sa_group_t group, int hier)
1414 1425 {
1415 1426 sa_optionset_t options = NULL;
1416 1427 sa_optionset_t secoptions = NULL;
1417 1428 sa_property_t prop, secprop;
1418 1429 sa_security_t security = NULL;
1419 1430 char *buff;
1420 1431 size_t buffsize;
1421 1432 char *sectype = NULL;
1422 1433 int sep = 0;
1423 1434
1424 1435
1425 1436 buff = malloc(OPT_CHUNK);
1426 1437 if (buff == NULL) {
1427 1438 return (NULL);
1428 1439 }
1429 1440
1430 1441 buff[0] = '\0';
1431 1442 buffsize = OPT_CHUNK;
1432 1443
1433 1444 /*
1434 1445 * We may have a an optionset relative to this item. format
1435 1446 * these if we find them and then add any security definitions.
1436 1447 */
1437 1448
1438 1449 options = sa_get_derived_optionset(group, "nfs", hier);
1439 1450
1440 1451 /*
1441 1452 * do the default set first but skip any option that is also
1442 1453 * in the protocol specific optionset.
1443 1454 */
1444 1455 if (options != NULL) {
1445 1456 for (prop = sa_get_property(options, NULL);
1446 1457 prop != NULL; prop = sa_get_next_property(prop)) {
1447 1458 /*
1448 1459 * use this one since we skipped any
1449 1460 * of these that were also in
1450 1461 * optdefault
1451 1462 */
1452 1463 if (nfs_sprint_option(&buff, &buffsize, OPT_CHUNK,
1453 1464 prop, sep))
1454 1465 sep = 1;
1455 1466 if (buff == NULL) {
1456 1467 /*
1457 1468 * buff could become NULL if there
1458 1469 * isn't enough memory for
1459 1470 * nfs_sprint_option to realloc()
1460 1471 * as necessary. We can't really
1461 1472 * do anything about it at this
1462 1473 * point so we return NULL. The
1463 1474 * caller should handle the
1464 1475 * failure.
1465 1476 */
1466 1477 if (options != NULL)
1467 1478 sa_free_derived_optionset(
1468 1479 options);
1469 1480 return (buff);
1470 1481 }
1471 1482 }
1472 1483 }
1473 1484 secoptions = (sa_optionset_t)sa_get_all_security_types(group,
1474 1485 "nfs", hier);
1475 1486 if (secoptions != NULL) {
1476 1487 for (secprop = sa_get_property(secoptions, NULL);
1477 1488 secprop != NULL;
1478 1489 secprop = sa_get_next_property(secprop)) {
1479 1490 sectype = sa_get_property_attr(secprop, "type");
1480 1491 security =
1481 1492 (sa_security_t)sa_get_derived_security(
1482 1493 group, sectype, "nfs", hier);
1483 1494 if (security != NULL) {
1484 1495 if (sectype != NULL) {
1485 1496 prop = sa_create_property(
1486 1497 "sec", sectype);
1487 1498 if (prop == NULL)
1488 1499 goto err;
1489 1500 if (nfs_sprint_option(&buff,
1490 1501 &buffsize, OPT_CHUNK, prop, sep))
1491 1502 sep = 1;
1492 1503 (void) sa_remove_property(prop);
1493 1504 if (buff == NULL)
1494 1505 goto err;
1495 1506 }
1496 1507 for (prop = sa_get_property(security,
1497 1508 NULL); prop != NULL;
1498 1509 prop = sa_get_next_property(prop)) {
1499 1510 if (nfs_sprint_option(&buff,
1500 1511 &buffsize, OPT_CHUNK, prop, sep))
1501 1512 sep = 1;
1502 1513 if (buff == NULL)
1503 1514 goto err;
1504 1515 }
1505 1516 sa_free_derived_optionset(security);
1506 1517 }
1507 1518 if (sectype != NULL)
1508 1519 sa_free_attr_string(sectype);
1509 1520 }
1510 1521 sa_free_derived_optionset(secoptions);
1511 1522 }
1512 1523
1513 1524 if (options != NULL)
1514 1525 sa_free_derived_optionset(options);
1515 1526 return (buff);
1516 1527
1517 1528 err:
1518 1529 /*
1519 1530 * If we couldn't allocate memory for option printing, we need
1520 1531 * to break out of the nested loops, cleanup and return NULL.
1521 1532 */
1522 1533 if (secoptions != NULL)
1523 1534 sa_free_derived_optionset(secoptions);
1524 1535 if (security != NULL)
1525 1536 sa_free_derived_optionset(security);
1526 1537 if (sectype != NULL)
1527 1538 sa_free_attr_string(sectype);
1528 1539 if (options != NULL)
1529 1540 sa_free_derived_optionset(options);
1530 1541 return (buff);
1531 1542 }
1532 1543
1533 1544 /*
1534 1545 * Append an entry to the nfslogtab file
1535 1546 */
1536 1547 static int
1537 1548 nfslogtab_add(dir, buffer, tag)
1538 1549 char *dir, *buffer, *tag;
1539 1550 {
1540 1551 FILE *f;
1541 1552 struct logtab_ent lep;
1542 1553 int error = 0;
1543 1554
1544 1555 /*
1545 1556 * Open the file for update and create it if necessary.
1546 1557 * This may leave the I/O offset at the end of the file,
1547 1558 * so rewind back to the beginning of the file.
1548 1559 */
1549 1560 f = fopen(NFSLOGTAB, "a+");
1550 1561 if (f == NULL) {
1551 1562 error = errno;
1552 1563 goto out;
1553 1564 }
1554 1565 rewind(f);
1555 1566
1556 1567 if (lockf(fileno(f), F_LOCK, 0L) < 0) {
1557 1568 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1558 1569 "share complete, however failed to lock %s "
1559 1570 "for update: %s\n"), NFSLOGTAB, strerror(errno));
1560 1571 error = -1;
1561 1572 goto out;
1562 1573 }
1563 1574
1564 1575 if (logtab_deactivate_after_boot(f) == -1) {
1565 1576 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1566 1577 "share complete, however could not deactivate "
1567 1578 "entries in %s\n"), NFSLOGTAB);
1568 1579 error = -1;
1569 1580 goto out;
1570 1581 }
1571 1582
1572 1583 /*
1573 1584 * Remove entries matching buffer and sharepoint since we're
1574 1585 * going to replace it with perhaps an entry with a new tag.
1575 1586 */
1576 1587 if (logtab_rement(f, buffer, dir, NULL, -1)) {
1577 1588 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1578 1589 "share complete, however could not remove matching "
1579 1590 "entries in %s\n"), NFSLOGTAB);
1580 1591 error = -1;
1581 1592 goto out;
1582 1593 }
1583 1594
1584 1595 /*
1585 1596 * Deactivate all active entries matching this sharepoint
1586 1597 */
1587 1598 if (logtab_deactivate(f, NULL, dir, NULL)) {
1588 1599 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1589 1600 "share complete, however could not deactivate matching "
1590 1601 "entries in %s\n"), NFSLOGTAB);
1591 1602 error = -1;
1592 1603 goto out;
1593 1604 }
1594 1605
1595 1606 lep.le_buffer = buffer;
1596 1607 lep.le_path = dir;
1597 1608 lep.le_tag = tag;
1598 1609 lep.le_state = LES_ACTIVE;
1599 1610
1600 1611 /*
1601 1612 * Add new sharepoint / buffer location to nfslogtab
1602 1613 */
1603 1614 if (logtab_putent(f, &lep) < 0) {
1604 1615 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1605 1616 "share complete, however could not add %s to %s\n"),
1606 1617 dir, NFSLOGTAB);
1607 1618 error = -1;
1608 1619 }
1609 1620
1610 1621 out:
1611 1622 if (f != NULL)
1612 1623 (void) fclose(f);
1613 1624 return (error);
1614 1625 }
1615 1626
1616 1627 /*
1617 1628 * Deactivate an entry from the nfslogtab file
1618 1629 */
1619 1630 static int
1620 1631 nfslogtab_deactivate(path)
1621 1632 char *path;
1622 1633 {
1623 1634 FILE *f;
1624 1635 int error = 0;
1625 1636
1626 1637 f = fopen(NFSLOGTAB, "r+");
1627 1638 if (f == NULL) {
1628 1639 error = errno;
1629 1640 goto out;
1630 1641 }
1631 1642 if (lockf(fileno(f), F_LOCK, 0L) < 0) {
1632 1643 error = errno;
1633 1644 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1634 1645 "share complete, however could not lock %s for "
1635 1646 "update: %s\n"), NFSLOGTAB, strerror(error));
1636 1647 goto out;
1637 1648 }
1638 1649 if (logtab_deactivate(f, NULL, path, NULL) == -1) {
1639 1650 error = -1;
1640 1651 (void) fprintf(stderr,
1641 1652 dgettext(TEXT_DOMAIN,
1642 1653 "share complete, however could not "
1643 1654 "deactivate %s in %s\n"), path, NFSLOGTAB);
1644 1655 goto out;
1645 1656 }
1646 1657
1647 1658 out: if (f != NULL)
1648 1659 (void) fclose(f);
1649 1660
1650 1661 return (error);
1651 1662 }
1652 1663
1653 1664 /*
1654 1665 * check_public(group, skipshare)
1655 1666 *
1656 1667 * Check the group for any shares that have the public property
1657 1668 * enabled. We skip "skipshare" since that is the one we are
1658 1669 * working with. This is a separate function to make handling
1659 1670 * subgroups simpler. Returns true if there is a share with public.
1660 1671 */
1661 1672 static int
1662 1673 check_public(sa_group_t group, sa_share_t skipshare)
1663 1674 {
1664 1675 int exists = B_FALSE;
1665 1676 sa_share_t share;
1666 1677 sa_optionset_t opt;
1667 1678 sa_property_t prop;
1668 1679 char *shared;
1669 1680
1670 1681 for (share = sa_get_share(group, NULL); share != NULL;
1671 1682 share = sa_get_next_share(share)) {
1672 1683 if (share == skipshare)
1673 1684 continue;
1674 1685
1675 1686 opt = sa_get_optionset(share, "nfs");
1676 1687 if (opt == NULL)
1677 1688 continue;
1678 1689 prop = sa_get_property(opt, "public");
1679 1690 if (prop == NULL)
1680 1691 continue;
1681 1692 shared = sa_get_share_attr(share, "shared");
1682 1693 if (shared != NULL) {
1683 1694 exists = strcmp(shared, "true") == 0;
1684 1695 sa_free_attr_string(shared);
1685 1696 if (exists == B_TRUE)
1686 1697 break;
1687 1698 }
1688 1699 }
1689 1700
1690 1701 return (exists);
1691 1702 }
1692 1703
1693 1704 /*
1694 1705 * public_exists(handle, share)
1695 1706 *
1696 1707 * check to see if public option is set on any other share than the
1697 1708 * one specified. Need to check zfs sub-groups as well as the top
1698 1709 * level groups.
1699 1710 */
1700 1711 static int
1701 1712 public_exists(sa_handle_t handle, sa_share_t skipshare)
1702 1713 {
1703 1714 sa_group_t group = NULL;
1704 1715
1705 1716 /*
1706 1717 * If we don't have a handle, we can only do syntax check. We
1707 1718 * can't check against other shares so we assume OK and will
1708 1719 * catch the problem only when we actually try to apply it.
1709 1720 */
1710 1721 if (handle == NULL)
1711 1722 return (SA_OK);
1712 1723
1713 1724 if (skipshare != NULL) {
1714 1725 group = sa_get_parent_group(skipshare);
1715 1726 if (group == NULL)
1716 1727 return (SA_NO_SUCH_GROUP);
1717 1728 }
1718 1729
1719 1730 for (group = sa_get_group(handle, NULL); group != NULL;
1720 1731 group = sa_get_next_group(group)) {
1721 1732 /* Walk any ZFS subgroups as well as all standard groups */
1722 1733 if (sa_group_is_zfs(group)) {
1723 1734 sa_group_t subgroup;
1724 1735 for (subgroup = sa_get_sub_group(group);
1725 1736 subgroup != NULL;
1726 1737 subgroup = sa_get_next_group(subgroup)) {
1727 1738 if (check_public(subgroup, skipshare))
1728 1739 return (B_TRUE);
1729 1740 }
1730 1741 } else {
1731 1742 if (check_public(group, skipshare))
1732 1743 return (B_TRUE);
1733 1744 }
1734 1745 }
1735 1746 return (B_FALSE);
1736 1747 }
1737 1748
1738 1749 /*
1739 1750 * sa_enable_share at the protocol level, enable_share must tell the
1740 1751 * implementation that it is to enable the share. This entails
1741 1752 * converting the path and options into the appropriate ioctl
1742 1753 * calls. It is assumed that all error checking of paths, etc. were
1743 1754 * done earlier.
1744 1755 */
1745 1756 static int
1746 1757 nfs_enable_share(sa_share_t share)
1747 1758 {
1748 1759 struct exportdata export;
1749 1760 sa_optionset_t secoptlist;
1750 1761 struct secinfo *sp;
1751 1762 int num_secinfo;
1752 1763 sa_optionset_t opt;
1753 1764 sa_security_t sec;
1754 1765 sa_property_t prop;
1755 1766 char *path;
1756 1767 int err = SA_OK;
1757 1768 int i;
1758 1769 int iszfs;
1759 1770 sa_handle_t handle;
1760 1771
1761 1772 /* Don't drop core if the NFS module isn't loaded. */
1762 1773 (void) signal(SIGSYS, SIG_IGN);
1763 1774
1764 1775 /* get the path since it is important in several places */
1765 1776 path = sa_get_share_attr(share, "path");
1766 1777 if (path == NULL)
1767 1778 return (SA_NO_SUCH_PATH);
1768 1779
1769 1780 iszfs = sa_path_is_zfs(path);
1770 1781 /*
1771 1782 * find the optionsets and security sets. There may not be
1772 1783 * any or there could be one or two for each of optionset and
1773 1784 * security may have multiple, one per security type per
1774 1785 * protocol type.
1775 1786 */
1776 1787 opt = sa_get_derived_optionset(share, "nfs", 1);
1777 1788 secoptlist = (sa_optionset_t)sa_get_all_security_types(share, "nfs", 1);
1778 1789 if (secoptlist != NULL)
1779 1790 num_secinfo = MAX(1, count_security(secoptlist));
1780 1791 else
1781 1792 num_secinfo = 1;
1782 1793
1783 1794 /*
1784 1795 * walk through the options and fill in the structure
1785 1796 * appropriately.
1786 1797 */
1787 1798
1788 1799 (void) memset(&export, '\0', sizeof (export));
1789 1800
1790 1801 /*
1791 1802 * do non-security options first since there is only one after
1792 1803 * the derived group is constructed.
1793 1804 */
1794 1805 export.ex_version = EX_CURRENT_VERSION;
1795 1806 export.ex_anon = UID_NOBODY; /* this is our default value */
1796 1807 export.ex_index = NULL;
1797 1808 export.ex_path = path;
1798 1809 export.ex_pathlen = strlen(path) + 1;
1799 1810
1800 1811 if (opt != NULL)
1801 1812 err = fill_export_from_optionset(&export, opt);
1802 1813
1803 1814 /*
1804 1815 * check to see if "public" is set. If it is, then make sure
1805 1816 * no other share has it set. If it is already used, fail.
1806 1817 */
1807 1818
1808 1819 handle = sa_find_group_handle((sa_group_t)share);
1809 1820 if (export.ex_flags & EX_PUBLIC && public_exists(handle, share)) {
1810 1821 (void) printf(dgettext(TEXT_DOMAIN,
1811 1822 "NFS: Cannot share more than one file "
1812 1823 "system with 'public' property\n"));
1813 1824 err = SA_NOT_ALLOWED;
1814 1825 goto out;
1815 1826 }
1816 1827
1817 1828 sp = calloc(num_secinfo, sizeof (struct secinfo));
1818 1829 if (sp == NULL) {
1819 1830 err = SA_NO_MEMORY;
1820 1831 (void) printf(dgettext(TEXT_DOMAIN,
1821 1832 "NFS: NFS: no memory for security\n"));
1822 1833 goto out;
1823 1834 }
1824 1835 export.ex_secinfo = sp;
1825 1836 /* get default secinfo */
1826 1837 export.ex_seccnt = num_secinfo;
1827 1838 /*
1828 1839 * since we must have one security option defined, we
1829 1840 * init to the default and then override as we find
1830 1841 * defined security options. This handles the case
1831 1842 * where we have no defined options but we need to set
1832 1843 * up one.
1833 1844 */
1834 1845 sp[0].s_window = DEF_WIN;
1835 1846 sp[0].s_rootnames = NULL;
1836 1847 /* setup a default in case no properties defined */
1837 1848 if (nfs_getseconfig_default(&sp[0].s_secinfo)) {
1838 1849 (void) printf(dgettext(TEXT_DOMAIN,
1839 1850 "NFS: nfs_getseconfig_default: failed to "
1840 1851 "get default security mode\n"));
1841 1852 err = SA_CONFIG_ERR;
1842 1853 }
1843 1854 if (secoptlist != NULL) {
1844 1855 for (i = 0, prop = sa_get_property(secoptlist, NULL);
1845 1856 prop != NULL && i < num_secinfo;
1846 1857 prop = sa_get_next_property(prop), i++) {
1847 1858 char *sectype;
1848 1859 sectype = sa_get_property_attr(prop, "type");
1849 1860 /*
1850 1861 * if sectype is NULL, we probably
1851 1862 * have a memory problem and can't get
1852 1863 * the correct values. Rather than
1853 1864 * exporting with incorrect security,
1854 1865 * don't share it.
1855 1866 */
1856 1867 if (sectype == NULL) {
1857 1868 err = SA_NO_MEMORY;
1858 1869 (void) printf(dgettext(TEXT_DOMAIN,
1859 1870 "NFS: Cannot share %s: "
1860 1871 "no memory\n"), path);
1861 1872 goto out;
1862 1873 }
1863 1874 sec = (sa_security_t)sa_get_derived_security(
1864 1875 share, sectype, "nfs", 1);
1865 1876 sp[i].s_window = DEF_WIN;
1866 1877 sp[i].s_rootcnt = 0;
1867 1878 sp[i].s_rootnames = NULL;
1868 1879 (void) fill_security_from_secopts(&sp[i], sec);
1869 1880 if (sec != NULL)
1870 1881 sa_free_derived_security(sec);
1871 1882 if (sectype != NULL)
1872 1883 sa_free_attr_string(sectype);
1873 1884 }
1874 1885 }
1875 1886 /*
1876 1887 * when we get here, we can do the exportfs system call and
1877 1888 * initiate thinsg. We probably want to enable the nfs.server
1878 1889 * service first if it isn't running within SMF.
1879 1890 */
1880 1891 /* check nfs.server status and start if needed */
1881 1892 /* now add the share to the internal tables */
1882 1893 printarg(path, &export);
1883 1894 /*
1884 1895 * call the exportfs system call which is implemented
1885 1896 * via the nfssys() call as the EXPORTFS subfunction.
1886 1897 */
1887 1898 if (iszfs) {
1888 1899 struct exportfs_args ea;
1889 1900 share_t sh;
1890 1901 char *str;
1891 1902 priv_set_t *priv_effective;
1892 1903 int privileged;
1893 1904
1894 1905 /*
1895 1906 * If we aren't a privileged user
1896 1907 * and NFS server service isn't running
1897 1908 * then print out an error message
1898 1909 * and return EPERM
1899 1910 */
1900 1911
1901 1912 priv_effective = priv_allocset();
1902 1913 (void) getppriv(PRIV_EFFECTIVE, priv_effective);
1903 1914
1904 1915 privileged = (priv_isfullset(priv_effective) == B_TRUE);
1905 1916 priv_freeset(priv_effective);
1906 1917
1907 1918 if (!privileged &&
1908 1919 (str = smf_get_state(NFS_SERVER_SVC)) != NULL) {
1909 1920 err = 0;
1910 1921 if (strcmp(str, SCF_STATE_STRING_ONLINE) != 0) {
1911 1922 (void) printf(dgettext(TEXT_DOMAIN,
1912 1923 "NFS: Cannot share remote "
1913 1924 "filesystem: %s\n"), path);
1914 1925 (void) printf(dgettext(TEXT_DOMAIN,
1915 1926 "NFS: Service needs to be enabled "
1916 1927 "by a privileged user\n"));
1917 1928 err = SA_SYSTEM_ERR;
1918 1929 errno = EPERM;
1919 1930 }
1920 1931 free(str);
1921 1932 }
1922 1933
1923 1934 if (err == 0) {
1924 1935 ea.dname = path;
1925 1936 ea.uex = &export;
1926 1937
1927 1938 (void) sa_sharetab_fill_zfs(share, &sh, "nfs");
1928 1939 err = sa_share_zfs(share, NULL, path, &sh,
1929 1940 &ea, ZFS_SHARE_NFS);
1930 1941 if (err != SA_OK) {
1931 1942 errno = err;
1932 1943 err = -1;
1933 1944 }
1934 1945 sa_emptyshare(&sh);
1935 1946 }
1936 1947 } else {
1937 1948 err = exportfs(path, &export);
1938 1949 }
1939 1950
1940 1951 if (err < 0) {
1941 1952 err = SA_SYSTEM_ERR;
1942 1953 switch (errno) {
1943 1954 case EREMOTE:
1944 1955 (void) printf(dgettext(TEXT_DOMAIN,
1945 1956 "NFS: Cannot share filesystems "
1946 1957 "in non-global zones: %s\n"), path);
1947 1958 err = SA_NOT_SUPPORTED;
1948 1959 break;
1949 1960 case EPERM:
1950 1961 if (getzoneid() != GLOBAL_ZONEID) {
1951 1962 (void) printf(dgettext(TEXT_DOMAIN,
1952 1963 "NFS: Cannot share file systems "
1953 1964 "in non-global zones: %s\n"), path);
1954 1965 err = SA_NOT_SUPPORTED;
1955 1966 break;
1956 1967 }
1957 1968 err = SA_NO_PERMISSION;
1958 1969 break;
1959 1970 case EEXIST:
1960 1971 err = SA_SHARE_EXISTS;
1961 1972 break;
1962 1973 default:
1963 1974 break;
1964 1975 }
1965 1976 } else {
1966 1977 /* update sharetab with an add/modify */
1967 1978 if (!iszfs) {
1968 1979 (void) sa_update_sharetab(share, "nfs");
1969 1980 }
1970 1981 }
1971 1982
1972 1983 if (err == SA_OK) {
1973 1984 /*
1974 1985 * enable services as needed. This should probably be
1975 1986 * done elsewhere in order to minimize the calls to
1976 1987 * check services.
1977 1988 */
1978 1989 /*
1979 1990 * check to see if logging and other services need to
1980 1991 * be triggered, but only if there wasn't an
1981 1992 * error. This is probably where sharetab should be
1982 1993 * updated with the NFS specific entry.
1983 1994 */
1984 1995 if (export.ex_flags & EX_LOG) {
1985 1996 /* enable logging */
1986 1997 if (nfslogtab_add(path, export.ex_log_buffer,
1987 1998 export.ex_tag) != 0) {
1988 1999 (void) fprintf(stderr, dgettext(TEXT_DOMAIN,
1989 2000 "Could not enable logging for %s\n"),
1990 2001 path);
1991 2002 }
1992 2003 _check_services(service_list_logging);
1993 2004 } else {
1994 2005 /*
1995 2006 * don't have logging so remove it from file. It might
1996 2007 * not be thre, but that doesn't matter.
1997 2008 */
1998 2009 (void) nfslogtab_deactivate(path);
1999 2010 _check_services(service_list_default);
2000 2011 }
2001 2012 }
2002 2013
2003 2014 out:
2004 2015 if (path != NULL)
2005 2016 free(path);
2006 2017
2007 2018 cleanup_export(&export);
2008 2019 if (opt != NULL)
2009 2020 sa_free_derived_optionset(opt);
2010 2021 if (secoptlist != NULL)
2011 2022 (void) sa_destroy_optionset(secoptlist);
2012 2023 return (err);
2013 2024 }
2014 2025
2015 2026 /*
2016 2027 * nfs_disable_share(share, path)
2017 2028 *
2018 2029 * Unshare the specified share. Note that "path" is the same path as
2019 2030 * what is in the "share" object. It is passed in to avoid an
2020 2031 * additional lookup. A missing "path" value makes this a no-op
2021 2032 * function.
2022 2033 */
2023 2034 static int
2024 2035 nfs_disable_share(sa_share_t share, char *path)
2025 2036 {
2026 2037 int err;
2027 2038 int ret = SA_OK;
2028 2039 int iszfs;
2029 2040 sa_group_t parent;
2030 2041 sa_handle_t handle;
2031 2042
2032 2043 if (path == NULL)
2033 2044 return (ret);
2034 2045
2035 2046 /*
2036 2047 * If the share is in a ZFS group we need to handle it
2037 2048 * differently. Just being on a ZFS file system isn't
2038 2049 * enough since we may be in a legacy share case.
2039 2050 */
2040 2051 parent = sa_get_parent_group(share);
2041 2052 iszfs = sa_group_is_zfs(parent);
2042 2053 if (iszfs) {
2043 2054 struct exportfs_args ea;
2044 2055 share_t sh = { 0 };
2045 2056 ea.dname = path;
2046 2057 ea.uex = NULL;
2047 2058 sh.sh_path = path;
2048 2059 sh.sh_fstype = "nfs";
2049 2060
2050 2061 err = sa_share_zfs(share, NULL, path, &sh,
2051 2062 &ea, ZFS_UNSHARE_NFS);
2052 2063 if (err != SA_OK) {
2053 2064 errno = err;
2054 2065 err = -1;
2055 2066 }
2056 2067 } else {
2057 2068 err = exportfs(path, NULL);
2058 2069 }
2059 2070 if (err < 0) {
2060 2071 /*
2061 2072 * TBD: only an error in some
2062 2073 * cases - need better analysis
2063 2074 */
2064 2075 switch (errno) {
2065 2076 case EPERM:
2066 2077 case EACCES:
2067 2078 ret = SA_NO_PERMISSION;
2068 2079 if (getzoneid() != GLOBAL_ZONEID) {
2069 2080 ret = SA_NOT_SUPPORTED;
2070 2081 }
2071 2082 break;
2072 2083 case EINVAL:
2073 2084 case ENOENT:
2074 2085 ret = SA_NO_SUCH_PATH;
2075 2086 break;
2076 2087 default:
2077 2088 ret = SA_SYSTEM_ERR;
2078 2089 break;
2079 2090 }
2080 2091 }
2081 2092 if (ret == SA_OK || ret == SA_NO_SUCH_PATH) {
2082 2093 handle = sa_find_group_handle((sa_group_t)share);
2083 2094 if (!iszfs)
2084 2095 (void) sa_delete_sharetab(handle, path, "nfs");
2085 2096 /* just in case it was logged */
2086 2097 (void) nfslogtab_deactivate(path);
2087 2098 }
2088 2099 return (ret);
2089 2100 }
2090 2101
2091 2102 /*
2092 2103 * check_rorwnone(v1, v2, v3)
2093 2104 *
2094 2105 * check ro vs rw vs none values. Over time this may get beefed up.
2095 2106 * for now it just does simple checks. v1 is never NULL but v2 or v3
2096 2107 * could be.
2097 2108 */
2098 2109
2099 2110 static int
2100 2111 check_rorwnone(char *v1, char *v2, char *v3)
2101 2112 {
2102 2113 int ret = SA_OK;
2103 2114 if (v2 != NULL && strcmp(v1, v2) == 0)
2104 2115 ret = SA_VALUE_CONFLICT;
2105 2116 else if (v3 != NULL && strcmp(v1, v3) == 0)
2106 2117 ret = SA_VALUE_CONFLICT;
2107 2118
2108 2119 return (ret);
2109 2120 }
2110 2121
2111 2122 /*
2112 2123 * nfs_validate_property(handle, property, parent)
2113 2124 *
2114 2125 * Check that the property has a legitimate value for its type.
2115 2126 */
2116 2127
2117 2128 static int
2118 2129 nfs_validate_property(sa_handle_t handle, sa_property_t property,
2119 2130 sa_optionset_t parent)
2120 2131 {
2121 2132 int ret = SA_OK;
2122 2133 char *propname;
2123 2134 char *other1;
2124 2135 char *other2;
2125 2136 int optindex;
2126 2137 nfsl_config_t *configlist;
2127 2138 sa_group_t parent_group;
2128 2139 char *value;
2129 2140
2130 2141 propname = sa_get_property_attr(property, "type");
2131 2142
2132 2143 if ((optindex = findopt(propname)) < 0)
2133 2144 ret = SA_NO_SUCH_PROP;
2134 2145
2135 2146 /* need to validate value range here as well */
2136 2147
2137 2148 if (ret == SA_OK) {
2138 2149 parent_group = sa_get_parent_group((sa_share_t)parent);
2139 2150 if (optdefs[optindex].share && parent_group != NULL &&
2140 2151 !sa_is_share(parent_group))
2141 2152 ret = SA_PROP_SHARE_ONLY;
2142 2153 }
2143 2154 if (ret == SA_OK) {
2144 2155 if (optdefs[optindex].index == OPT_PUBLIC) {
2145 2156 /*
2146 2157 * Public is special in that only one instance can
2147 2158 * be in the repository at the same time.
2148 2159 */
2149 2160 if (public_exists(handle, parent_group)) {
2150 2161 sa_free_attr_string(propname);
2151 2162 return (SA_VALUE_CONFLICT);
2152 2163 }
2153 2164 }
2154 2165 value = sa_get_property_attr(property, "value");
2155 2166 if (value != NULL) {
2156 2167 /* first basic type checking */
2157 2168 switch (optdefs[optindex].type) {
2158 2169 case OPT_TYPE_NUMBER:
2159 2170 /* check that the value is all digits */
2160 2171 if (!is_a_number(value))
2161 2172 ret = SA_BAD_VALUE;
2162 2173 break;
2163 2174 case OPT_TYPE_BOOLEAN:
2164 2175 if (strlen(value) == 0 ||
2165 2176 strcasecmp(value, "true") == 0 ||
2166 2177 strcmp(value, "1") == 0 ||
2167 2178 strcasecmp(value, "false") == 0 ||
2168 2179 strcmp(value, "0") == 0) {
2169 2180 ret = SA_OK;
2170 2181 } else {
2171 2182 ret = SA_BAD_VALUE;
2172 2183 }
2173 2184 break;
2174 2185 case OPT_TYPE_USER:
2175 2186 if (!is_a_number(value)) {
2176 2187 struct passwd *pw;
2177 2188 /*
2178 2189 * in this case it would have to be a
2179 2190 * user name
2180 2191 */
2181 2192 pw = getpwnam(value);
2182 2193 if (pw == NULL)
2183 2194 ret = SA_BAD_VALUE;
2184 2195 endpwent();
2185 2196 } else {
2186 2197 uint64_t intval;
2187 2198 intval = strtoull(value, NULL, 0);
2188 2199 if (intval > UID_MAX && intval != ~0)
2189 2200 ret = SA_BAD_VALUE;
2190 2201 }
2191 2202 break;
2192 2203 case OPT_TYPE_FILE:
2193 2204 if (strcmp(value, "..") == 0 ||
2194 2205 strchr(value, '/') != NULL) {
2195 2206 ret = SA_BAD_VALUE;
2196 2207 }
2197 2208 break;
2198 2209 case OPT_TYPE_ACCLIST: {
2199 2210 sa_property_t oprop1;
2200 2211 sa_property_t oprop2;
2201 2212 char *ovalue1 = NULL;
2202 2213 char *ovalue2 = NULL;
2203 2214
2204 2215 if (parent == NULL)
2205 2216 break;
2206 2217 /*
2207 2218 * access list handling. Should eventually
2208 2219 * validate that all the values make sense.
2209 2220 * Also, ro and rw may have cross value
2210 2221 * conflicts.
2211 2222 */
2212 2223 if (strcmp(propname, SHOPT_RO) == 0) {
2213 2224 other1 = SHOPT_RW;
2214 2225 other2 = SHOPT_NONE;
2215 2226 } else if (strcmp(propname, SHOPT_RW) == 0) {
2216 2227 other1 = SHOPT_RO;
2217 2228 other2 = SHOPT_NONE;
2218 2229 } else if (strcmp(propname, SHOPT_NONE) == 0) {
2219 2230 other1 = SHOPT_RO;
2220 2231 other2 = SHOPT_RW;
2221 2232 } else {
2222 2233 other1 = NULL;
2223 2234 other2 = NULL;
2224 2235 }
2225 2236 if (other1 == NULL && other2 == NULL)
2226 2237 break;
2227 2238
2228 2239 /* compare rw(ro) with ro(rw) */
2229 2240
2230 2241 oprop1 = sa_get_property(parent, other1);
2231 2242 oprop2 = sa_get_property(parent, other2);
2232 2243 if (oprop1 == NULL && oprop2 == NULL)
2233 2244 break;
2234 2245 /*
2235 2246 * Only potential confusion if other1
2236 2247 * or other2 exists. Check the values
2237 2248 * and run the check if there is a
2238 2249 * value other than the one we are
2239 2250 * explicitly looking at.
2240 2251 */
2241 2252 ovalue1 = sa_get_property_attr(oprop1, "value");
2242 2253 ovalue2 = sa_get_property_attr(oprop2, "value");
2243 2254 if (ovalue1 != NULL || ovalue2 != NULL)
2244 2255 ret = check_rorwnone(value, ovalue1,
2245 2256 ovalue2);
2246 2257
2247 2258 if (ovalue1 != NULL)
2248 2259 sa_free_attr_string(ovalue1);
2249 2260 if (ovalue2 != NULL)
2250 2261 sa_free_attr_string(ovalue2);
2251 2262 break;
2252 2263 }
2253 2264 case OPT_TYPE_LOGTAG:
2254 2265 if (nfsl_getconfig_list(&configlist) == 0) {
2255 2266 int error;
2256 2267 if (value == NULL ||
2257 2268 strlen(value) == 0) {
2258 2269 if (value != NULL)
2259 2270 sa_free_attr_string(
2260 2271 value);
2261 2272 value = strdup("global");
2262 2273 }
2263 2274 if (value != NULL &&
2264 2275 nfsl_findconfig(configlist, value,
2265 2276 &error) == NULL) {
2266 2277 ret = SA_BAD_VALUE;
2267 2278 }
2268 2279 /* Must always free when done */
2269 2280 nfsl_freeconfig_list(&configlist);
2270 2281 } else {
2271 2282 ret = SA_CONFIG_ERR;
2272 2283 }
2273 2284 break;
2274 2285 case OPT_TYPE_STRING:
2275 2286 /* whatever is here should be ok */
2276 2287 break;
2277 2288 case OPT_TYPE_SECURITY:
2278 2289 /*
2279 2290 * The "sec" property isn't used in the
2280 2291 * non-legacy parts of sharemgr. We need to
2281 2292 * reject it here. For legacy, it is pulled
2282 2293 * out well before we get here.
2283 2294 */
2284 2295 ret = SA_NO_SUCH_PROP;
2285 2296 break;
2286 2297 default:
2287 2298 break;
2288 2299 }
2289 2300
2290 2301 if (value != NULL)
2291 2302 sa_free_attr_string(value);
2292 2303
2293 2304 if (ret == SA_OK && optdefs[optindex].check != NULL) {
2294 2305 /* do the property specific check */
2295 2306 ret = optdefs[optindex].check(handle, property);
2296 2307 }
2297 2308 }
2298 2309 }
2299 2310
2300 2311 if (propname != NULL)
2301 2312 sa_free_attr_string(propname);
2302 2313 return (ret);
2303 2314 }
2304 2315
2305 2316 /*
2306 2317 * Protocol management functions
2307 2318 *
2308 2319 * Properties defined in the default files are defined in
2309 2320 * proto_option_defs for parsing and validation. If "other" and
2310 2321 * "compare" are set, then the value for this property should be
2311 2322 * compared against the property specified in "other" using the
2312 2323 * "compare" check (either <= or >=) in order to ensure that the
2313 2324 * values are in the correct range. E.g. setting server_versmin
2314 2325 * higher than server_versmax should not be allowed.
2315 2326 */
2316 2327
2317 2328 struct proto_option_defs {
2318 2329 char *tag;
2319 2330 char *name; /* display name -- remove protocol identifier */
2320 2331 int index;
2321 2332 int type;
2322 2333 union {
2323 2334 int intval;
2324 2335 char *string;
2325 2336 } defvalue;
2326 2337 uint32_t svcs;
2327 2338 int32_t minval;
2328 2339 int32_t maxval;
2329 2340 char *other;
2330 2341 int compare;
2331 2342 #define OPT_CMP_GE 0
2332 2343 #define OPT_CMP_LE 1
2333 2344 int (*check)(char *);
2334 2345 } proto_options[] = {
2335 2346 #define PROTO_OPT_NFSD_SERVERS 0
2336 2347 {"nfsd_servers",
2337 2348 "servers", PROTO_OPT_NFSD_SERVERS, OPT_TYPE_NUMBER, 16, SVC_NFSD,
2338 2349 1, INT32_MAX},
2339 2350 #define PROTO_OPT_LOCKD_LISTEN_BACKLOG 1
2340 2351 {"lockd_listen_backlog",
2341 2352 "lockd_listen_backlog", PROTO_OPT_LOCKD_LISTEN_BACKLOG,
2342 2353 OPT_TYPE_NUMBER, 32, SVC_LOCKD, 32, INT32_MAX},
2343 2354 #define PROTO_OPT_LOCKD_SERVERS 2
2344 2355 {"lockd_servers",
2345 2356 "lockd_servers", PROTO_OPT_LOCKD_SERVERS, OPT_TYPE_NUMBER, 20,
2346 2357 SVC_LOCKD, 1, INT32_MAX},
2347 2358 #define PROTO_OPT_LOCKD_RETRANSMIT_TIMEOUT 3
2348 2359 {"lockd_retransmit_timeout",
2349 2360 "lockd_retransmit_timeout", PROTO_OPT_LOCKD_RETRANSMIT_TIMEOUT,
2350 2361 OPT_TYPE_NUMBER, 5, SVC_LOCKD, 0, INT32_MAX},
2351 2362 #define PROTO_OPT_GRACE_PERIOD 4
2352 2363 {"grace_period",
2353 2364 "grace_period", PROTO_OPT_GRACE_PERIOD, OPT_TYPE_NUMBER, 90,
2354 2365 SVC_LOCKD, 0, INT32_MAX},
2355 2366 #define PROTO_OPT_NFS_SERVER_VERSMIN 5
2356 2367 {"nfs_server_versmin",
2357 2368 "server_versmin", PROTO_OPT_NFS_SERVER_VERSMIN, OPT_TYPE_NUMBER,
2358 2369 (int)NFS_VERSMIN_DEFAULT, SVC_NFSD|SVC_MOUNTD, NFS_VERSMIN,
2359 2370 NFS_VERSMAX, "server_versmax", OPT_CMP_LE},
2360 2371 #define PROTO_OPT_NFS_SERVER_VERSMAX 6
2361 2372 {"nfs_server_versmax",
2362 2373 "server_versmax", PROTO_OPT_NFS_SERVER_VERSMAX, OPT_TYPE_NUMBER,
2363 2374 (int)NFS_VERSMAX_DEFAULT, SVC_NFSD|SVC_MOUNTD, NFS_VERSMIN,
2364 2375 NFS_VERSMAX, "server_versmin", OPT_CMP_GE},
2365 2376 #define PROTO_OPT_NFS_CLIENT_VERSMIN 7
2366 2377 {"nfs_client_versmin",
2367 2378 "client_versmin", PROTO_OPT_NFS_CLIENT_VERSMIN, OPT_TYPE_NUMBER,
2368 2379 (int)NFS_VERSMIN_DEFAULT, SVC_CLIENT, NFS_VERSMIN, NFS_VERSMAX,
2369 2380 "client_versmax", OPT_CMP_LE},
2370 2381 #define PROTO_OPT_NFS_CLIENT_VERSMAX 8
2371 2382 {"nfs_client_versmax",
2372 2383 "client_versmax", PROTO_OPT_NFS_CLIENT_VERSMAX, OPT_TYPE_NUMBER,
2373 2384 (int)NFS_VERSMAX_DEFAULT, SVC_CLIENT, NFS_VERSMIN, NFS_VERSMAX,
2374 2385 "client_versmin", OPT_CMP_GE},
2375 2386 #define PROTO_OPT_NFS_SERVER_DELEGATION 9
2376 2387 {"nfs_server_delegation",
2377 2388 "server_delegation", PROTO_OPT_NFS_SERVER_DELEGATION,
2378 2389 OPT_TYPE_ONOFF, NFS_SERVER_DELEGATION_DEFAULT, SVC_NFSD, 0, 0},
2379 2390 #define PROTO_OPT_NFSMAPID_DOMAIN 10
2380 2391 {"nfsmapid_domain",
2381 2392 "nfsmapid_domain", PROTO_OPT_NFSMAPID_DOMAIN, OPT_TYPE_DOMAIN,
2382 2393 NULL, SVC_NFSMAPID, 0, 0},
2383 2394 #define PROTO_OPT_NFSD_MAX_CONNECTIONS 11
2384 2395 {"nfsd_max_connections",
2385 2396 "max_connections", PROTO_OPT_NFSD_MAX_CONNECTIONS,
2386 2397 OPT_TYPE_NUMBER, -1, SVC_NFSD, -1, INT32_MAX},
2387 2398 #define PROTO_OPT_NFSD_PROTOCOL 12
2388 2399 {"nfsd_protocol",
2389 2400 "protocol", PROTO_OPT_NFSD_PROTOCOL, OPT_TYPE_PROTOCOL, 0,
2390 2401 SVC_NFSD, 0, 0},
2391 2402 #define PROTO_OPT_NFSD_LISTEN_BACKLOG 13
2392 2403 {"nfsd_listen_backlog",
2393 2404 "listen_backlog", PROTO_OPT_NFSD_LISTEN_BACKLOG,
2394 2405 OPT_TYPE_NUMBER, 0, SVC_NFSD, 0, INT32_MAX},
2395 2406 #define PROTO_OPT_NFSD_DEVICE 14
2396 2407 {"nfsd_device",
2397 2408 "device", PROTO_OPT_NFSD_DEVICE,
2398 2409 OPT_TYPE_STRING, NULL, SVC_NFSD, 0, 0},
2399 2410 {NULL}
2400 2411 };
2401 2412
2402 2413 /*
2403 2414 * the protoset holds the defined options so we don't have to read
2404 2415 * them multiple times
2405 2416 */
2406 2417 static sa_protocol_properties_t protoset;
2407 2418
2408 2419 static int
2409 2420 findprotoopt(char *name, int whichname)
2410 2421 {
2411 2422 int i;
2412 2423 for (i = 0; proto_options[i].tag != NULL; i++) {
2413 2424 if (whichname == 1) {
2414 2425 if (strcasecmp(proto_options[i].name, name) == 0)
2415 2426 return (i);
2416 2427 } else {
2417 2428 if (strcasecmp(proto_options[i].tag, name) == 0)
2418 2429 return (i);
2419 2430 }
2420 2431 }
2421 2432 return (-1);
2422 2433 }
2423 2434
2424 2435 /*
2425 2436 * fixcaselower(str)
2426 2437 *
2427 2438 * convert a string to lower case (inplace).
2428 2439 */
2429 2440
2430 2441 static void
2431 2442 fixcaselower(char *str)
2432 2443 {
2433 2444 while (*str) {
2434 2445 *str = tolower(*str);
2435 2446 str++;
2436 2447 }
2437 2448 }
2438 2449
2439 2450 /*
2440 2451 * skipwhitespace(str)
2441 2452 *
2442 2453 * Skip leading white space. It is assumed that it is called with a
2443 2454 * valid pointer.
2444 2455 */
2445 2456
2446 2457 static char *
2447 2458 skipwhitespace(char *str)
2448 2459 {
2449 2460 while (*str && isspace(*str))
2450 2461 str++;
2451 2462
2452 2463 return (str);
2453 2464 }
2454 2465
2455 2466 /*
2456 2467 * extractprop()
2457 2468 *
2458 2469 * Extract the property and value out of the line and create the
2459 2470 * property in the optionset.
2460 2471 */
2461 2472 static int
2462 2473 extractprop(char *name, char *value)
2463 2474 {
2464 2475 sa_property_t prop;
2465 2476 int index;
2466 2477 int ret = SA_OK;
2467 2478 /*
2468 2479 * Remove any leading
2469 2480 * white space.
2470 2481 */
2471 2482 name = skipwhitespace(name);
2472 2483
2473 2484 index = findprotoopt(name, 1);
2474 2485 if (index >= 0) {
2475 2486 fixcaselower(name);
2476 2487 prop = sa_create_property(proto_options[index].name, value);
2477 2488 if (prop != NULL)
2478 2489 ret = sa_add_protocol_property(protoset, prop);
2479 2490 else
2480 2491 ret = SA_NO_MEMORY;
2481 2492 }
2482 2493 return (ret);
2483 2494 }
2484 2495
2485 2496 scf_type_t
2486 2497 getscftype(int type)
2487 2498 {
2488 2499 scf_type_t ret;
2489 2500
2490 2501 switch (type) {
2491 2502 case OPT_TYPE_NUMBER:
2492 2503 ret = SCF_TYPE_INTEGER;
2493 2504 break;
2494 2505 case OPT_TYPE_BOOLEAN:
2495 2506 ret = SCF_TYPE_BOOLEAN;
2496 2507 break;
2497 2508 default:
2498 2509 ret = SCF_TYPE_ASTRING;
2499 2510 }
2500 2511 return (ret);
2501 2512 }
2502 2513
2503 2514 char *
2504 2515 getsvcname(uint32_t svcs)
2505 2516 {
2506 2517 char *service;
2507 2518 switch (svcs) {
2508 2519 case SVC_LOCKD:
2509 2520 service = LOCKD;
2510 2521 break;
2511 2522 case SVC_STATD:
2512 2523 service = STATD;
2513 2524 break;
2514 2525 case SVC_NFSD:
2515 2526 service = NFSD;
2516 2527 break;
2517 2528 case SVC_CLIENT:
2518 2529 service = NFS_CLIENT_SVC;
2519 2530 break;
2520 2531 case SVC_NFS4CBD:
2521 2532 service = NFS4CBD;
2522 2533 break;
2523 2534 case SVC_NFSMAPID:
2524 2535 service = NFSMAPID;
2525 2536 break;
2526 2537 case SVC_RQUOTAD:
2527 2538 service = RQUOTAD;
2528 2539 break;
2529 2540 case SVC_NFSLOGD:
2530 2541 service = NFSLOGD;
2531 2542 break;
2532 2543 case SVC_REPARSED:
2533 2544 service = REPARSED;
2534 2545 break;
2535 2546 default:
2536 2547 service = NFSD;
2537 2548 }
2538 2549 return (service);
2539 2550 }
2540 2551
2541 2552 /*
2542 2553 * initprotofromsmf()
2543 2554 *
2544 2555 * Read NFS SMF properties and add the defined values to the
2545 2556 * protoset. Note that default values are known from the built in
2546 2557 * table in case SMF doesn't have a definition. Not having
2547 2558 * SMF properties is OK since we have builtin default
2548 2559 * values.
2549 2560 */
2550 2561 static int
2551 2562 initprotofromsmf()
2552 2563 {
2553 2564 char name[PATH_MAX];
2554 2565 char value[PATH_MAX];
2555 2566 int ret = SA_OK, bufsz = 0, i;
2556 2567
2557 2568 protoset = sa_create_protocol_properties("nfs");
2558 2569 if (protoset != NULL) {
2559 2570 for (i = 0; proto_options[i].tag != NULL; i++) {
2560 2571 scf_type_t ptype;
2561 2572 char *svc_name;
2562 2573
2563 2574 bzero(value, PATH_MAX);
2564 2575 (void) strncpy(name, proto_options[i].name, PATH_MAX);
2565 2576 /* Replace NULL with the correct instance */
2566 2577 ptype = getscftype(proto_options[i].type);
2567 2578 svc_name = getsvcname(proto_options[i].svcs);
2568 2579 bufsz = PATH_MAX;
2569 2580 ret = nfs_smf_get_prop(name, value,
2570 2581 (char *)DEFAULT_INSTANCE, ptype,
2571 2582 svc_name, &bufsz);
2572 2583 if (ret == SA_OK) {
2573 2584 ret = extractprop(name, value);
2574 2585 }
2575 2586 }
2576 2587 } else {
2577 2588 ret = SA_NO_MEMORY;
2578 2589 }
2579 2590
2580 2591 return (ret);
2581 2592 }
2582 2593
2583 2594 /*
2584 2595 * add_defaults()
2585 2596 *
2586 2597 * Add the default values for any property not defined
2587 2598 * in NFS SMF repository.
2588 2599 * Values are set according to their defined types.
2589 2600 */
2590 2601
2591 2602 static void
2592 2603 add_defaults()
2593 2604 {
2594 2605 int i;
2595 2606 char number[MAXDIGITS];
2596 2607
2597 2608 for (i = 0; proto_options[i].tag != NULL; i++) {
2598 2609 sa_property_t prop;
2599 2610 prop = sa_get_protocol_property(protoset,
2600 2611 proto_options[i].name);
2601 2612 if (prop == NULL) {
2602 2613 /* add the default value */
2603 2614 switch (proto_options[i].type) {
2604 2615 case OPT_TYPE_NUMBER:
2605 2616 (void) snprintf(number, sizeof (number), "%d",
2606 2617 proto_options[i].defvalue.intval);
2607 2618 prop = sa_create_property(proto_options[i].name,
2608 2619 number);
2609 2620 break;
2610 2621
2611 2622 case OPT_TYPE_BOOLEAN:
2612 2623 prop = sa_create_property(proto_options[i].name,
2613 2624 proto_options[i].defvalue.intval ?
2614 2625 "true" : "false");
2615 2626 break;
2616 2627
2617 2628 case OPT_TYPE_ONOFF:
2618 2629 prop = sa_create_property(proto_options[i].name,
2619 2630 proto_options[i].defvalue.intval ?
2620 2631 "on" : "off");
2621 2632 break;
2622 2633
2623 2634 default:
2624 2635 /* treat as strings of zero length */
2625 2636 prop = sa_create_property(proto_options[i].name,
2626 2637 "");
2627 2638 break;
2628 2639 }
2629 2640 if (prop != NULL)
2630 2641 (void) sa_add_protocol_property(protoset, prop);
2631 2642 }
2632 2643 }
2633 2644 }
2634 2645
2635 2646 static void
2636 2647 free_protoprops()
2637 2648 {
2638 2649 if (protoset != NULL) {
2639 2650 xmlFreeNode(protoset);
2640 2651 protoset = NULL;
2641 2652 }
2642 2653 }
2643 2654
2644 2655 /*
2645 2656 * nfs_init()
2646 2657 *
2647 2658 * Initialize the NFS plugin.
2648 2659 */
2649 2660
2650 2661 static int
2651 2662 nfs_init()
2652 2663 {
2653 2664 int ret = SA_OK;
2654 2665
2655 2666 if (sa_plugin_ops.sa_init != nfs_init) {
2656 2667 (void) printf(dgettext(TEXT_DOMAIN,
2657 2668 "NFS plugin not properly initialized\n"));
2658 2669 return (SA_CONFIG_ERR);
2659 2670 }
2660 2671
2661 2672 ret = initprotofromsmf();
2662 2673 if (ret != SA_OK) {
2663 2674 (void) printf(dgettext(TEXT_DOMAIN,
2664 2675 "NFS plugin problem with SMF repository: %s\n"),
2665 2676 sa_errorstr(ret));
2666 2677 ret = SA_OK;
2667 2678 }
2668 2679 add_defaults();
2669 2680
2670 2681 return (ret);
2671 2682 }
2672 2683
2673 2684 /*
2674 2685 * nfs_fini()
2675 2686 *
2676 2687 * uninitialize the NFS plugin. Want to avoid memory leaks.
2677 2688 */
2678 2689
2679 2690 static void
2680 2691 nfs_fini()
2681 2692 {
2682 2693 free_protoprops();
2683 2694 }
2684 2695
2685 2696 /*
2686 2697 * nfs_get_proto_set()
2687 2698 *
2688 2699 * Return an optionset with all the protocol specific properties in
2689 2700 * it.
2690 2701 */
2691 2702
2692 2703 static sa_protocol_properties_t
2693 2704 nfs_get_proto_set()
2694 2705 {
2695 2706 return (protoset);
2696 2707 }
2697 2708
2698 2709 /*
2699 2710 * service_in_state(service, chkstate)
2700 2711 *
2701 2712 * Want to know if the specified service is in the desired state
2702 2713 * (chkstate) or not. Return true (1) if it is and false (0) if it
2703 2714 * isn't.
2704 2715 */
2705 2716 static int
2706 2717 service_in_state(char *service, const char *chkstate)
2707 2718 {
2708 2719 char *state;
2709 2720 int ret = B_FALSE;
2710 2721
2711 2722 state = smf_get_state(service);
2712 2723 if (state != NULL) {
2713 2724 /* got the state so get the equality for the return value */
2714 2725 ret = strcmp(state, chkstate) == 0 ? B_TRUE : B_FALSE;
2715 2726 free(state);
2716 2727 }
2717 2728 return (ret);
2718 2729 }
2719 2730
2720 2731 /*
2721 2732 * restart_service(svcs)
2722 2733 *
2723 2734 * Walk through the bit mask of services that need to be restarted in
2724 2735 * order to use the new property values. Some properties affect
2725 2736 * multiple daemons. Should only restart a service if it is currently
2726 2737 * enabled (online).
2727 2738 */
2728 2739
2729 2740 static void
2730 2741 restart_service(uint32_t svcs)
2731 2742 {
2732 2743 uint32_t mask;
2733 2744 int ret;
2734 2745 char *service;
2735 2746
2736 2747 for (mask = 1; svcs != 0; mask <<= 1) {
2737 2748 switch (svcs & mask) {
2738 2749 case SVC_LOCKD:
2739 2750 service = LOCKD;
2740 2751 break;
2741 2752 case SVC_STATD:
2742 2753 service = STATD;
2743 2754 break;
2744 2755 case SVC_NFSD:
2745 2756 service = NFSD;
2746 2757 break;
2747 2758 case SVC_MOUNTD:
2748 2759 service = MOUNTD;
2749 2760 break;
2750 2761 case SVC_NFS4CBD:
2751 2762 service = NFS4CBD;
2752 2763 break;
2753 2764 case SVC_NFSMAPID:
2754 2765 service = NFSMAPID;
2755 2766 break;
2756 2767 case SVC_RQUOTAD:
2757 2768 service = RQUOTAD;
2758 2769 break;
2759 2770 case SVC_NFSLOGD:
2760 2771 service = NFSLOGD;
2761 2772 break;
2762 2773 case SVC_REPARSED:
2763 2774 service = REPARSED;
2764 2775 break;
2765 2776 case SVC_CLIENT:
2766 2777 service = NFS_CLIENT_SVC;
2767 2778 break;
2768 2779 default:
2769 2780 continue;
2770 2781 }
2771 2782
2772 2783 /*
2773 2784 * Only attempt to restart the service if it is
2774 2785 * currently running. In the future, it may be
2775 2786 * desirable to use smf_refresh_instance if the NFS
2776 2787 * services ever implement the refresh method.
2777 2788 */
2778 2789 if (service_in_state(service, SCF_STATE_STRING_ONLINE)) {
2779 2790 ret = smf_restart_instance(service);
2780 2791 /*
2781 2792 * There are only a few SMF errors at this point, but
2782 2793 * it is also possible that a bad value may have put
2783 2794 * the service into maintenance if there wasn't an
2784 2795 * SMF level error.
2785 2796 */
2786 2797 if (ret != 0) {
2787 2798 (void) fprintf(stderr,
2788 2799 dgettext(TEXT_DOMAIN,
2789 2800 "%s failed to restart: %s\n"),
2790 2801 scf_strerror(scf_error()));
2791 2802 } else {
2792 2803 /*
2793 2804 * Check whether it has gone to "maintenance"
2794 2805 * mode or not. Maintenance implies something
2795 2806 * went wrong.
2796 2807 */
2797 2808 if (service_in_state(service,
2798 2809 SCF_STATE_STRING_MAINT)) {
2799 2810 (void) fprintf(stderr,
2800 2811 dgettext(TEXT_DOMAIN,
2801 2812 "%s failed to restart\n"),
2802 2813 service);
2803 2814 }
2804 2815 }
2805 2816 }
2806 2817 svcs &= ~mask;
2807 2818 }
2808 2819 }
2809 2820
2810 2821 /*
2811 2822 * nfs_minmax_check(name, value)
2812 2823 *
2813 2824 * Verify that the value for the property specified by index is valid
2814 2825 * relative to the opposite value in the case of a min/max variable.
2815 2826 * Currently, server_minvers/server_maxvers and
2816 2827 * client_minvers/client_maxvers are the only ones to check.
2817 2828 */
2818 2829
2819 2830 static int
2820 2831 nfs_minmax_check(int index, int value)
2821 2832 {
2822 2833 int val;
2823 2834 char *pval;
2824 2835 sa_property_t prop;
2825 2836 sa_optionset_t opts;
2826 2837 int ret = B_TRUE;
2827 2838
2828 2839 if (proto_options[index].other != NULL) {
2829 2840 /* have a property to compare against */
2830 2841 opts = nfs_get_proto_set();
2831 2842 prop = sa_get_property(opts, proto_options[index].other);
2832 2843 /*
2833 2844 * If we don't find the property, assume default
2834 2845 * values which will work since the max will be at the
2835 2846 * max and the min at the min.
2836 2847 */
2837 2848 if (prop != NULL) {
2838 2849 pval = sa_get_property_attr(prop, "value");
2839 2850 if (pval != NULL) {
2840 2851 val = strtoul(pval, NULL, 0);
2841 2852 if (proto_options[index].compare ==
2842 2853 OPT_CMP_LE) {
2843 2854 ret = value <= val ? B_TRUE : B_FALSE;
2844 2855 } else if (proto_options[index].compare ==
2845 2856 OPT_CMP_GE) {
2846 2857 ret = value >= val ? B_TRUE : B_FALSE;
2847 2858 }
2848 2859 sa_free_attr_string(pval);
2849 2860 }
2850 2861 }
2851 2862 }
2852 2863 return (ret);
2853 2864 }
2854 2865
2855 2866 /*
2856 2867 * nfs_validate_proto_prop(index, name, value)
2857 2868 *
2858 2869 * Verify that the property specified by name can take the new
2859 2870 * value. This is a sanity check to prevent bad values getting into
2860 2871 * the default files. All values need to be checked against what is
2861 2872 * allowed by their defined type. If a type isn't explicitly defined
2862 2873 * here, it is treated as a string.
2863 2874 *
2864 2875 * Note that OPT_TYPE_NUMBER will additionally check that the value is
2865 2876 * within the range specified and potentially against another property
2866 2877 * value as well as specified in the proto_options members other and
2867 2878 * compare.
2868 2879 */
2869 2880
2870 2881 static int
2871 2882 nfs_validate_proto_prop(int index, char *name, char *value)
2872 2883 {
2873 2884 int ret = SA_OK;
2874 2885 char *cp;
2875 2886 #ifdef lint
2876 2887 name = name;
2877 2888 #endif
2878 2889 switch (proto_options[index].type) {
2879 2890 case OPT_TYPE_NUMBER:
2880 2891 if (!is_a_number(value))
2881 2892 ret = SA_BAD_VALUE;
2882 2893 else {
2883 2894 int val;
2884 2895 val = strtoul(value, NULL, 0);
2885 2896 if (val < proto_options[index].minval ||
2886 2897 val > proto_options[index].maxval)
2887 2898 ret = SA_BAD_VALUE;
2888 2899 /*
2889 2900 * For server_versmin/server_versmax and
2890 2901 * client_versmin/client_versmax, the value of the
2891 2902 * min(max) should be checked to be correct relative
2892 2903 * to the current max(min).
2893 2904 */
2894 2905 if (!nfs_minmax_check(index, val)) {
2895 2906 ret = SA_BAD_VALUE;
2896 2907 }
2897 2908 }
2898 2909 break;
2899 2910
2900 2911 case OPT_TYPE_DOMAIN:
2901 2912 /*
2902 2913 * needs to be a qualified domain so will have at
2903 2914 * least one period and other characters on either
2904 2915 * side of it. A zero length string is also allowed
2905 2916 * and is the way to turn off the override.
2906 2917 */
2907 2918 if (strlen(value) == 0)
2908 2919 break;
2909 2920 cp = strchr(value, '.');
2910 2921 if (cp == NULL || cp == value || strchr(value, '@') != NULL)
2911 2922 ret = SA_BAD_VALUE;
2912 2923 break;
2913 2924
2914 2925 case OPT_TYPE_BOOLEAN:
2915 2926 if (strlen(value) == 0 ||
2916 2927 strcasecmp(value, "true") == 0 ||
2917 2928 strcmp(value, "1") == 0 ||
2918 2929 strcasecmp(value, "false") == 0 ||
2919 2930 strcmp(value, "0") == 0) {
2920 2931 ret = SA_OK;
2921 2932 } else {
2922 2933 ret = SA_BAD_VALUE;
2923 2934 }
2924 2935 break;
2925 2936
2926 2937 case OPT_TYPE_ONOFF:
2927 2938 if (strcasecmp(value, "on") != 0 &&
2928 2939 strcasecmp(value, "off") != 0) {
2929 2940 ret = SA_BAD_VALUE;
2930 2941 }
2931 2942 break;
2932 2943
2933 2944 case OPT_TYPE_PROTOCOL:
2934 2945 if (strlen(value) != 0 &&
2935 2946 strcasecmp(value, "all") != 0 &&
2936 2947 strcasecmp(value, "tcp") != 0 &&
2937 2948 strcasecmp(value, "udp") != 0)
2938 2949 ret = SA_BAD_VALUE;
2939 2950 break;
2940 2951
2941 2952 default:
2942 2953 /* treat as a string */
2943 2954 break;
2944 2955 }
2945 2956 return (ret);
2946 2957 }
2947 2958
2948 2959 /*
2949 2960 * nfs_set_proto_prop(prop)
2950 2961 *
2951 2962 * check that prop is valid.
2952 2963 */
2953 2964
2954 2965 static int
2955 2966 nfs_set_proto_prop(sa_property_t prop)
2956 2967 {
2957 2968 int ret = SA_OK;
2958 2969 char *name;
2959 2970 char *value;
2960 2971
2961 2972 name = sa_get_property_attr(prop, "type");
2962 2973 value = sa_get_property_attr(prop, "value");
2963 2974 if (name != NULL && value != NULL) {
2964 2975 scf_type_t sctype;
2965 2976 char *svc_name;
2966 2977 char *instance = NULL;
2967 2978 int index = findprotoopt(name, 1);
2968 2979
2969 2980 ret = nfs_validate_proto_prop(index, name, value);
2970 2981 if (ret == SA_OK) {
2971 2982 sctype = getscftype(proto_options[index].type);
2972 2983 svc_name = getsvcname(proto_options[index].svcs);
2973 2984 if (sctype == SCF_TYPE_BOOLEAN) {
2974 2985 if (value != NULL)
2975 2986 sa_free_attr_string(value);
2976 2987 if (string_to_boolean(value) == 0)
2977 2988 value = strdup("0");
2978 2989 else
2979 2990 value = strdup("1");
2980 2991 }
2981 2992 ret = nfs_smf_set_prop(name, value, instance, sctype,
2982 2993 svc_name);
2983 2994 if (ret == SA_OK) {
2984 2995 restart_service(proto_options[index].svcs);
2985 2996 } else {
2986 2997 (void) printf(dgettext(TEXT_DOMAIN,
2987 2998 "Cannot restart NFS services : %s\n"),
2988 2999 sa_errorstr(ret));
2989 3000 }
2990 3001 }
2991 3002 }
2992 3003 if (name != NULL)
2993 3004 sa_free_attr_string(name);
2994 3005 if (value != NULL)
2995 3006 sa_free_attr_string(value);
2996 3007 return (ret);
2997 3008 }
2998 3009
2999 3010 /*
3000 3011 * nfs_get_status()
3001 3012 *
3002 3013 * What is the current status of the nfsd? We use the SMF state here.
3003 3014 * Caller must free the returned value.
3004 3015 */
3005 3016
3006 3017 static char *
3007 3018 nfs_get_status()
3008 3019 {
3009 3020 char *state;
3010 3021 state = smf_get_state(NFSD);
3011 3022 return (state != NULL ? state : strdup("-"));
3012 3023 }
3013 3024
3014 3025 /*
3015 3026 * nfs_space_alias(alias)
3016 3027 *
3017 3028 * Lookup the space (security) name. If it is default, convert to the
3018 3029 * real name.
3019 3030 */
3020 3031
3021 3032 static char *
3022 3033 nfs_space_alias(char *space)
3023 3034 {
3024 3035 char *name = space;
3025 3036 seconfig_t secconf;
3026 3037
3027 3038 /*
3028 3039 * Only the space named "default" is special. If it is used,
3029 3040 * the default needs to be looked up and the real name used.
3030 3041 * This is normally "sys" but could be changed. We always
3031 3042 * change defautl to the real name.
3032 3043 */
3033 3044 if (strcmp(space, "default") == 0 &&
3034 3045 nfs_getseconfig_default(&secconf) == 0) {
3035 3046 if (nfs_getseconfig_bynumber(secconf.sc_nfsnum, &secconf) == 0)
3036 3047 name = secconf.sc_name;
3037 3048 }
3038 3049 return (strdup(name));
3039 3050 }
3040 3051
3041 3052 /*
3042 3053 * nfs_features()
3043 3054 *
3044 3055 * Return a mask of the features required.
3045 3056 */
3046 3057
3047 3058 static uint64_t
3048 3059 nfs_features()
3049 3060 {
3050 3061 return ((uint64_t)SA_FEATURE_DFSTAB | SA_FEATURE_SERVER);
3051 3062 }
|
↓ open down ↓ |
2026 lines elided |
↑ open up ↑ |
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX