static void unexportfs_parsed(char *hname, char *path, int verbose) { nfs_export *exp; struct addrinfo *ai = NULL; int htype; int success = 0; if ((htype = client_gettype(hname)) == MCL_FQDN) { ai = host_addrinfo(hname); if (ai) hname = ai->ai_canonname; } for (exp = exportlist[htype].p_head; exp; exp = exp->m_next) { if (path && strcmp(path, exp->m_export.e_path)) continue; if (htype != exp->m_client->m_type) continue; if (htype == MCL_FQDN && !matchhostname(exp->m_export.e_hostname, hname)) continue; if (htype != MCL_FQDN && strcasecmp(exp->m_export.e_hostname, hname)) continue; if (verbose) { #if 0 if (exp->m_exported) { printf("unexporting %s:%s from kernel\n", exp->m_client->m_hostname, exp->m_export.e_path); } else #endif printf("unexporting %s:%s\n", exp->m_client->m_hostname, exp->m_export.e_path); } #if 0 if (exp->m_exported && !export_unexport(exp)) error(exp, errno); #endif exp->m_xtabent = 0; exp->m_mayexport = 0; success = 1; } if (!success) xlog(L_ERROR, "Could not find '%s:%s' to unexport.", hname, path); freeaddrinfo(ai); }
/* * Services SM_MON requests. */ struct sm_stat_res * sm_mon_1_svc(struct mon *argp, struct svc_req *rqstp) { static sm_stat_res result; char *mon_name = argp->mon_id.mon_name, *my_name = argp->mon_id.my_id.my_name; struct my_id *id = &argp->mon_id.my_id; char *path; char *cp; int fd; notify_list *clnt; struct in_addr my_addr; char *dnsname; struct hostent *hostinfo = NULL; /* Assume that we'll fail. */ result.res_stat = STAT_FAIL; result.state = -1; /* State is undefined for STAT_FAIL. */ /* 1. Reject any remote callers. * Ignore the my_name specified by the caller, and * use "127.0.0.1" instead. */ if (!caller_is_localhost(rqstp)) goto failure; my_addr.s_addr = htonl(INADDR_LOOPBACK); /* 2. Reject any registrations for non-lockd services. * * This is specific to the linux kernel lockd, which * makes the callback procedure part of the lockd interface. * It is also prone to break when lockd changes its callback * procedure number -- which, in fact, has now happened once. * There must be a better way.... XXX FIXME */ if (id->my_prog != 100021 || (id->my_proc != 16 && id->my_proc != 24)) { note(N_WARNING, "Attempt to register callback to %d/%d", id->my_prog, id->my_proc); goto failure; } /* * Check hostnames. If I can't look them up, I won't monitor. This * might not be legal, but it adds a little bit of safety and sanity. */ /* must check for /'s in hostname! See CERT's CA-96.09 for details. */ if (strchr(mon_name, '/') || mon_name[0] == '.') { note(N_CRIT, "SM_MON request for hostname containing '/' " "or starting '.': %s", mon_name); note(N_CRIT, "POSSIBLE SPOOF/ATTACK ATTEMPT!"); goto failure; } else if ((hostinfo = gethostbyname(mon_name)) == NULL) { note(N_WARNING, "gethostbyname error for %s", mon_name); goto failure; } /* my_name must not have white space */ for (cp=my_name ; *cp ; cp++) if (*cp == ' ' || *cp == '\t' || *cp == '\r' || *cp == '\n') *cp = '_'; /* * Hostnames checked OK. * Now choose a hostname to use for matching. We cannot * really trust much in the incoming NOTIFY, so to make * sure that multi-homed hosts work nicely, we get an * FQDN now, and use that for matching */ hostinfo = gethostbyaddr(hostinfo->h_addr, hostinfo->h_length, hostinfo->h_addrtype); if (hostinfo) dnsname = xstrdup(hostinfo->h_name); else dnsname = xstrdup(my_name); /* Now check to see if this is a duplicate, and warn if so. * I will also return STAT_FAIL. (I *think* this is how I should * handle it.) * * Olaf requests that I allow duplicate SM_MON requests for * hosts due to the way he is coding lockd. No problem, * I'll just do a quickie success return and things should * be happy. */ clnt = rtnl; while ((clnt = nlist_gethost(clnt, mon_name, 0))) { if (matchhostname(NL_MY_NAME(clnt), my_name) && NL_MY_PROC(clnt) == id->my_proc && NL_MY_PROG(clnt) == id->my_prog && NL_MY_VERS(clnt) == id->my_vers && memcmp(NL_PRIV(clnt), argp->priv, SM_PRIV_SIZE) == 0) { /* Hey! We already know you guys! */ dprintf(N_DEBUG, "Duplicate SM_MON request for %s " "from procedure on %s", mon_name, my_name); /* But we'll let you pass anyway. */ goto success; } clnt = NL_NEXT(clnt); } /* * We're committed...ignoring errors. Let's hope that a malloc() * doesn't fail. (I should probably fix this assumption.) */ if (!(clnt = nlist_new(my_name, mon_name, 0))) { note(N_WARNING, "out of memory"); goto failure; } NL_ADDR(clnt) = my_addr; NL_MY_PROG(clnt) = id->my_prog; NL_MY_VERS(clnt) = id->my_vers; NL_MY_PROC(clnt) = id->my_proc; memcpy(NL_PRIV(clnt), argp->priv, SM_PRIV_SIZE); clnt->dns_name = dnsname; /* * Now, Create file on stable storage for host. */ path=xmalloc(strlen(SM_DIR)+strlen(dnsname)+2); sprintf(path, "%s/%s", SM_DIR, dnsname); if ((fd = open(path, O_WRONLY|O_SYNC|O_CREAT|O_APPEND, S_IRUSR|S_IWUSR)) < 0) { /* Didn't fly. We won't monitor. */ note(N_ERROR, "creat(%s) failed: %s", path, strerror (errno)); nlist_free(NULL, clnt); free(path); goto failure; } { char buf[LINELEN + 1 + SM_MAXSTRLEN*2 + 4]; char *e; int i; e = buf + sprintf(buf, "%08x %08x %08x %08x ", my_addr.s_addr, id->my_prog, id->my_vers, id->my_proc); for (i=0; i<SM_PRIV_SIZE; i++) e += sprintf(e, "%02x", 0xff & (argp->priv[i])); if (e+1-buf != LINELEN) abort(); e += sprintf(e, " %s %s\n", mon_name, my_name); if (write(fd, buf, e-buf) != (e-buf)) { note(N_WARNING, "writing to %s failed: errno %d (%s)", path, errno, strerror(errno)); } } free(path); /* PRC: do the HA callout: */ ha_callout("add-client", mon_name, my_name, -1); nlist_insert(&rtnl, clnt); close(fd); dprintf(N_DEBUG, "MONITORING %s for %s", mon_name, my_name); success: result.res_stat = STAT_SUCC; /* SUN's sm_inter.x says this should be "state number of local site". * X/Open says '"state" will be contain the state of the remote NSM.' * href=http://www.opengroup.org/onlinepubs/9629799/SM_MON.htm * Linux lockd currently (2.6.21 and prior) ignores whatever is * returned, and given the above contraction, it probably always will.. * So we just return what we always returned. If possible, we * have already told lockd about our state number via a sysctl. * If lockd wants the remote state, it will need to * use SM_STAT (and prayer). */ result.state = MY_STATE; return (&result); failure: note(N_WARNING, "STAT_FAIL to %s for SM_MON of %s", my_name, mon_name); return (&result); }
/* * Services SM_UNMON requests. * * There is no statement in the X/Open spec's about returning an error * for requests to unmonitor a host that we're *not* monitoring. I just * return the state of the NSM when I get such foolish requests for lack * of any better ideas. (I also log the "offense.") */ struct sm_stat * sm_unmon_1_svc(struct mon_id *argp, struct svc_req *rqstp) { static sm_stat result; notify_list *clnt; char *mon_name = argp->mon_name, *my_name = argp->my_id.my_name; struct my_id *id = &argp->my_id; char *cp; result.state = MY_STATE; if (!caller_is_localhost(rqstp)) goto failure; /* my_name must not have white space */ for (cp=my_name ; *cp ; cp++) if (*cp == ' ' || *cp == '\t' || *cp == '\r' || *cp == '\n') *cp = '_'; /* Check if we're monitoring anyone. */ if (rtnl == NULL) { note(N_WARNING, "Received SM_UNMON request from %s for %s while not " "monitoring any hosts.", my_name, argp->mon_name); return (&result); } clnt = rtnl; /* * OK, we are. Now look for appropriate entry in run-time list. * There should only be *one* match on this, since I block "duplicate" * SM_MON calls. (Actually, duplicate calls are allowed, but only one * entry winds up in the list the way I'm currently handling them.) */ while ((clnt = nlist_gethost(clnt, mon_name, 0))) { if (matchhostname(NL_MY_NAME(clnt), my_name) && NL_MY_PROC(clnt) == id->my_proc && NL_MY_PROG(clnt) == id->my_prog && NL_MY_VERS(clnt) == id->my_vers) { /* Match! */ dprintf(N_DEBUG, "UNMONITORING %s for %s", mon_name, my_name); /* PRC: do the HA callout: */ ha_callout("del-client", mon_name, my_name, -1); xunlink(SM_DIR, clnt->dns_name); nlist_free(&rtnl, clnt); return (&result); } else clnt = NL_NEXT(clnt); } failure: note(N_WARNING, "Received erroneous SM_UNMON request from %s for %s", my_name, mon_name); return (&result); }