summaryrefslogtreecommitdiff
path: root/support
Commit message (Collapse)AuthorAgeFilesLines
* fsidd: provide better default socket name.NeilBrown2023-05-113-5/+10
| | | | | | | | | | | | | | | | | | | | | | | | Having the default socket name be in the current directory is a poor choice for a daemon that is expected to run as root. It is also likely better to use an "abstract" socket name. abstract names do not exist in the filesystem namespace and are local to a network namespace. Using an abstract name ensures that the nfsd, mountd, and fsidd are all in the same network namespace. This patch: - uses a single #define for the default socket name, rather than 2; - allows the socket name to start with '@' which is interpreted to be a request to use the abstract name space (systemd uses the same convention). - changes the default to "@/run/fsid.sock". I don't know of a formal standard for choosing names in the abstract name space, the defacto standard (seen in "ss -xa|grep @") is to use a name similar to what might be used in the filesystem. Acked-by: Richard Weinberger <richard@nod.at> Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Steve Dickson <steved@redhat.com>
* fsidd: don't use assert() on expr with side-effect.NeilBrown2023-05-112-13/+69
| | | | | | | | | | | | | assert() is not guaranteed to evaluate its arg. When compiled with -DNDEBUG, the evaluation is skipped. We don't currently compile with -DNDEBUG, but relying on that is poor form, particularly as this is described as "sample code" in the git log. So introduce assert_safe() and use that when there are side-effects. Acked-by: Richard Weinberger <richard@nod.at> Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Steve Dickson <steved@redhat.com>
* mountd: don't advertise krb5 for v4root when not configured.nfs-utils-2-6-3-rc9NeilBrown2023-04-193-7/+10
| | | | | | | | | | | | | | | | | | | | | | | If /etc/krb5.keytab does not exist, then krb5 cannot work, so advertising it as an option for v4root is pointless. Since linux commit 676e4ebd5f2c ("NFSD: SECINFO doesn't handle unsupported pseudoflavors correctly") this can result in an unhelpful warning if the krb5 code is not built, or built as a module which is not installed. [ 161.668635] NFS: SECINFO: security flavor 390003 is not supported [ 161.668655] NFS: SECINFO: security flavor 390004 is not supported [ 161.668670] NFS: SECINFO: security flavor 390005 is not supported So avoid advertising krb5 security options when krb5.keytab cannot be found. Note that testing for /etc/krb5.keytab is what we already do in a couple of systemd unit file to determine if krb5 is enabled. Link: https://lore.kernel.org/linux-nfs/20170104190327.v3wbpcbqtfa5jy7d@codemonkey.org.uk/ Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Steve Dickson <steved@redhat.com>
* export: Add fsiddRichard Weinberger2023-04-192-0/+210
| | | | | | | | | | | | The fsidnum daemon offers a local UNIX domain socket interface for all NFS userspace to query the reexport database. Currently fsidd just uses the SQlite backend. fsidd serves also as an example on how to implement more complex backends for the load balancing use case. Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Steve Dickson <steved@redhat.com>
* reexport: Add sqlite backendRichard Weinberger2023-04-192-0/+314
| | | | | | | | | The reexport database code is designed to support multiple ways to store the state. So far only SQlite is implemented. Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Steve Dickson <steved@redhat.com>
* export: Uncover NFS subvolume after rebootRichard Weinberger2023-04-191-0/+6
| | | | | | | | | | | | When a re-exporting NFS server reboots, none of the subvolumes are present. This is because the NFS client code will mount only upon first access. So, when we see an NFS handle with an yet unknown fsidnum, lookup in the reexport database for it. If one is found, stat the path to trigger the mount. That way stale NFS handles are avoided after a reboot. Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Steve Dickson <steved@redhat.com>
* export: Wireup reexport mechanismRichard Weinberger2023-04-191-6/+62
| | | | | | | | | Detect the case when a NFS share is re-exported and assign an fsidnum to it. The fsidnum is read (or created) from the reexport database. Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Steve Dickson <steved@redhat.com>
* Implement reexport= export optionRichard Weinberger2023-04-193-0/+83
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When re-exporting a NFS volume it is mandatory to specify either a UUID or numerical fsid= option because nfsd is unable to derive an identifier on its own. For NFS cross mounts this becomes a problem because nfsd also needs an identifier for every crossed mount. A common workaround is stating every single subvolume in the exports list too. But this defeats the purpose of the crossmnt option and is tedious. This is where the reexport= tries to help. It offers various strategies to automatically derive a identifier for NFS volumes and sub volumes. Currently two strategies are implemented: 1. auto-fsidnum In this mode mountd/exportd will create a new numerical fsid for a NFS volume and subvolume. The numbers are stored in a database, via fsidd, such that the server will always use the same fsid. The entry in the exports file allowed to skip the fsid= option but stating a UUID is allowed, if needed. This mode has the obvious downside that load balancing is by default not possible since multiple re-exporting NFS servers would generate different ids. It is possible if all load balancers use the same database. This can be achieved by using nfs-utils' fsidd and placing it's sqlit database on a network share which supports file locks or by implementing your own fsidd which is able to provide consistent fsids across multiple re-exporting nfs servers. 2. predefined-fsidnum This mode works just like auto-fsidnum but does not generate ids for you. It helps in the load balancing case. A system administrator has to manually maintain the database and install it on all re-exporting NFS servers. If you have a massive amount of subvolumes this mode will help because you don't have to bloat the exports list. Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Steve Dickson <steved@redhat.com>
* Add reexport helper libraryRichard Weinberger2023-04-196-1/+354
| | | | | | | | Add some helper functions which will be used by the reexport mechanism to create and find fsidnums for re-exported NFS shares. Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Steve Dickson <steved@redhat.com>
* exports: Add an xprtsec= export optionChuck Lever2023-04-154-0/+128
| | | | | | | | | | | The overall goal is to enable administrators to require the use of transport layer security when clients access particular exports. This patch adds support to exportfs to parse, display, and push into the kernel a new xprtsec= export option. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* libexports: Fix whitespace damage in support/nfs/exports.cChuck Lever2023-04-151-8/+7
| | | | | | | Clean up. Signed-off-by: Chuck Lever <chuck.lever@oracle.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* export: Fix rootdir corner case in next_mnt()Richard Weinberger2023-04-051-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | Currently the following setup causes failure: 1. /etc/exports: / *(rw,crossmnt,no_subtree_check,fsid=root) 2. /etc/nfs.conf: [exports] rootdir=/nfs_srv 3. Mounts: /root/fs1.ext4 on /nfs_srv type ext4 (rw,relatime) /root/fs2.ext4 on /nfs_srv/fs2 type ext4 (rw,relatime) 4. On the client: $ ls /nfs_client/fs2 ls: cannot open directory '/nfs_client/fs2': Stale file handle The problem is that next_mnt() misses the corner case that every mount is a sub-mount of "/". So it fails to see that /nfs_srv/fs2 is a mountpoint when the client asks for fs2 it and as consequence the crossmnt mechanism fails. Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Steve Dickson <steved@redhat.com>
* Covscan Scan: Wrong Check of Return ValueSteve Dickson2023-01-101-0/+3
| | | | | Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2151966 Signed-off-by: Steve Dickson <steved@redhat.com>
* Replace statfs64 with statfsKhem Raj2023-01-103-22/+22
| | | | | | | | | | | | | | autoconf AC_SYS_LARGEFILE is used by configure to add needed defines when needed for enabling 64bit off_t, therefore replacing statfs64 with statfs should be functionally same. Additionally this helps compiling with latest musl where 64bit LFS functions like statfs64 and friends are now moved under _LARGEFILE64_SOURCE feature test macro, this works on glibc systems because _GNU_SOURCE macros also enables _LARGEFILE64_SOURCE indirectly. This is not case with musl and this latest issue is exposed. Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* nfs-utils: Don't allow junction tests to trigger automountsJeff Layton2023-01-101-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | JianHong reported some strange behavior with automounts on an nfs server without an explicit pseudoroot. When clients issued a readdir in the pseudoroot, automounted directories that were not yet mounted would show up even if they weren't exported, though the clients wouldn't be able to do anything with them. The issue was that triggering the automount on a directory would cause the mountd upcall to time out, which would cause nfsd to include the automounted dentry in the readdir response. Eventually, the automount would work and report that it wasn't exported and subsequent attempts to access the dentry would (properly) fail. We never want mountd to trigger an automount. The kernel should do that if it wants to use it. Change the junction checks to do an O_PATH open and use fstatat with AT_NO_AUTOMOUNT. Cc: Chuck Lever <chuck.lever@oracle.com> Link: https://bugzilla.redhat.com/show_bug.cgi?id=2148353 Link: https://bugzilla.kernel.org/show_bug.cgi?id=216777 Reported-by: JianHong Yin <jiyin@redhat.com> Signed-off-by: Jeff Layton <jlayton@kernel.org> Signed-off-by: Steve Dickson <steved@redhat.com>
* Allow 'debug' configuration option to accept '0' and '1'Frank Sorenson2022-10-171-2/+5
| | | | | | | | | | | | | | | | | | In the example /etc/nfs.conf file, most sections include a commented-out 'debug = 0' line, suggesting that '0' is the default. In addition, the manpages for some of the utilities state that debugging can be enabled by setting 'debug = 1' in the nfs.conf file. However, neither '0' nor '1' is accepted as a valid option for 'debug' while parsing the nfs.conf file. Add '0' and '1' to the valid strings when parsing 'debug', with '0' not changing any debugging settings, and '1' enabling all debugging. Signed-off-by: Frank Sorenson <sorenson@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* Fix more function prototypesSam James2022-09-271-1/+1
| | | | | | | | | | regex.c:545:43: error: a function declaration without a prototype is deprecated in all versions of C [-Werror,-Wstrict-prototypes] struct trans_func *libnfsidmap_plugin_init() ^ void See: 167f2336b06e1bcbf26f45f2ddc4a535fed4d393 Signed-off-by: Sam James <sam@gentoo.org> Signed-off-by: Steve Dickson <steved@redhat.com>
* Fix function prototypesKhem Raj2022-09-133-3/+3
| | | | | | | | | | Clang is now erroring out on functions with out parameter types Fixes errors like error: a function declaration without a prototype is deprecated in all versions of C [-Werror,-Wstrict-prototypes] Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* mountd: Check for return of stat functionKhem Raj2022-09-131-1/+1
| | | | | | | | | | | | | simplify the check, stat() return 0 on success -1 on failure Fixes clang reported errors e.g. | v4clients.c:29:6: error: logical not is only applied to the left hand side of this comparison [-Werror,-Wlogical-not-parentheses] | if (!stat("/proc/fs/nfsd/clients", &sb) == 0 || | ^ ~~ Signed-off-by: Khem Raj <raj.khem@gmail.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* mountd: Check 'nfsd/clients' directory presence instead of kernel versionKonstantin Khorenko2022-05-261-2/+5
| | | | | | | | | | | | | | | Kernel major version does not always provide 100% certainty about presence or absence of a feature, for example: - some distros backport feature from mainstream kernel to older kernels - if NFS server is run inside a system container the reported kernel version inside the container may be faked So let's determine the feature presence by checking '/proc/fs/nfsd/clients/' directory presence instead of checking the kernel version. Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* mountd: Fix potential data corrupternfs-utils-2-6-2-rc3Steve Dickson2022-02-281-2/+3
| | | | | | | | | | | | | | Commit 9c99b463 typecast an uint into a int to fix a Coverity warning. Potentially this could cause a very large rogue value to be negative allow the rouge value to index into a table causing corruption. A check has been added to detect this type of situation. Reported-by: Richard Weinberger <richard@nod.at> Signed-off-by: Steve Dickson <steved@redhat.com>
* Manpages: Fix man page syntax errorsBen Hutchings2022-01-311-2/+2
| | | | | | | | | | | | | | | | | | In idmapd.conf.5, there is a line of what should be literal text beginning with ".", which makes it an (invalid) command. It can be escaped, but then there will be a space before it. Instead, Move it to the previous line and use the .BR macro so there's no space. In idmapd.man, the .I (italic) macro is used. However, this manual page uses the mdoc macro package that does not include it. Use the .Em (emphasis) macro instead. In nfsmount.conf.man, the first line should be a comment but it is actually an invalid command. Fix it to be a comment. Signed-off-by: Ben Hutchings <benh@debian.org> Signed-off-by: Salvatore Bonaccorso <carnil@debian.org> Signed-off-by: Steve Dickson <steved@redhat.com>
* mountd: only do NFSv4 logging on supported kernels.Steve Dickson2021-09-231-0/+3
| | | | | Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1979816 Signed-off-by: Steve Dickson <steved@redhat.com>
* Move version.h into a common include directorySteve Dickson2021-09-231-0/+1
| | | | Signed-off-by: Steve Dickson <steved@redhat.com>
* cacheio.c:216:21: warning: unused variable 'stb' [-Wunused-variable]Steve Dickson2021-09-231-1/+0
| | | | Signed-off-by: Steve Dickson <steved@redhat.com>
* nfs-utils: Fix potential memory leaks in idmapAlice Mitchell2021-08-212-4/+3
| | | | | | | | | | regex.c: regex_getpwnam() would leak memory if the name was not found. nss.c: nss_name_to_gid() the conditional frees look like a potential memory leak, removed the unnecessary conditions. Signed-off-by: Alice Mitchell <ajmitchell@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* Move declaration of etab and rmtab into librariesnfs-utils-2-5-4-rc4NeilBrown2021-05-225-4/+4
| | | | | | | | | | | | | | | | | | There are two global "struct stat_paths" structures: etab and rmtab. They are currently needed by some library code so any program which is linked with that library code needs to declare the structures even if it doesn't use the functionality. This is clumsy and error-prone. Instead: have the library declare the structure and put the definition in a header file. Now programs only need to know about these structures if they use the functionality. 'rmtab' is now declared in libnfs.a (rmtab.c). 'etab' is declared in export.a (xtab.c). Reviewed-by: Petr Vorel <pvorel@suse.cz> Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Steve Dickson <steved@redhat.com>
* Remove 'force' arg from cache_flush()NeilBrown2021-05-223-11/+10
| | | | | | | | | | | | | | | | | | | | Since v4.17 the timestamp written to 'flush' is ignored, so there isn't much point choosing too precisely. For kernels since v4.3-rc3-13-g778620364ef5 it is safe to write 1 second beyond the current time. For earlier kernels, nothing is really safe (even the current behaviour), but writing one second beyond the current time isn't too bad in the unlikely case the people use a new nfs-utils on a 5 year old kernel. This remove a dependency for libnfs.a on 'etab' being declare, so svcgssd no longer needs to declare it. Reviewed-by: Petr Vorel <pvorel@suse.cz> Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Steve Dickson <steved@redhat.com>
* Fix NFSv4 export of tmpfs filesystemsNeilBrown2021-05-224-2/+54
| | | | | | | | | | | | | | | | | | | | | | | | | | | Some filesystems cannot be exported without an fsid or uuid. tmpfs is the main example. When mountd (or exportd) creates nfsv4 pseudo-root exports for the path leading down to an export point it exports each directory without any fsid or uuid. If one of these directories is on tmpfs, that will fail. The net result is that exporting a subdirectory of a tmpfs filesystem will not work over NFSv4 as the parents within the filesystem cannot be exported. It will either fail, or fall-back to NFSv3 (depending on the version of the mount.nfs program). To fix this we need to provide an fsid or uuid for these pseudo-root exports. This patch does that by creating an RFC-4122 V5 compatible UUID based on an arbitrary seed and the path to the export. To check if an export needs a uuid, text_export() is moved from exportfs to libexport.a, modified slightly and renamed to export_test(). Reported-by: Petr Vorel <pvorel@suse.cz> Reviewed-by: Petr Vorel <pvorel@suse.cz> Tested-by: Petr Vorel <pvorel@suse.cz> Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Steve Dickson <steved@redhat.com>
* nfs-utils: Enable the retrieval of raw config settings without expansionnfs-utils-2-5-4-rc3Alice Mitchell2021-05-062-0/+24
| | | | | | | | Config entries sometimes contain variable expansions, this adds options to retrieve the config entry rather than its current expanded value. Signed-off-by: Alice Mitchell <ajmitchell@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* nfs-utils: Factor out common structure cleanup callsAlice Mitchell2021-05-061-43/+41
| | | | | Signed-off-by: Alice Mitchell <ajmitchell@redhat.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* Replace all /var/run with /runNeilBrown2021-05-061-1/+1
| | | | | | | | | | | FHS 3.0 deprecated /var/run in favour of /run. FHS 3.0 was released over 5 years ago. I think it is time for nfs-utils to catch up. Note that some places, particularly systemd unit files, already use just "/run". Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Steve Dickson <steved@redhat.com>
* Fix `statx()` emulation breaking exportsPatrick Steinhardt2021-05-061-0/+2
| | | | | | | | | | | | | | | | | | | | | | | Ever since commit 76c21e3f (mountd: Check the stat() return values in match_fsid(), 2020-05-08), it wasn't possible to export filesystems on my musl based system anymore. The root cause of this is the innocuous-looking change to decide based on `errno` whether `is_mountpoint()` raised a real error or whether it simply didn't match. The issue is that `is_mountpoint()` transitively calls into our `xlstat()` wrapper, which either executes `statx()` if the system supports it or otherwise falls back to `fstatat()`. But if `statx()` is not supported, then we'll always first set `errno = ENOSYS` before calling `fstatat()`. So effectively, all systems which do not have `statx()` and whose `fstatat()` doesn't reset `errno` will cause us to end up with errno set to `ENOSYS`. Fix the issue by resetting `errno` before calling `fstatat()` in both `xlstat()` and `xstat()`. Fixes: 76c21e3f (mountd: Check the stat() return values in match_fsid(), 2020-05-08) Signed-off-by: Patrick Steinhardt <ps@pks.im> Signed-off-by: Steve Dickson <steved@redhat.com>
* mountd/exportd: only log confirmed clients, and poll for updatesNeilBrown2021-04-061-19/+67
| | | | | | | | | | | | | | | | | | | | | | It is possible (and common with the Linux NFS client) for the nfs server to receive multiple SET_CLIENT_ID or EXCHANGE_ID requests when starting a connection. This results in some clients appearing in /proc/fs/nfsd/clients which never get confirmed. mountd currently logs these, but they aren't really helpful. If the kernel supports the reporting of the confirmation status of clients, we can suppress the message until a client is confirmed. With this patch we: - record if the client is confirmed, assuming it is if the status is not reported - don't log unconfirmed clients - request MODIFY notification from unconfirmed clients. - recheck an info file when it is modified. Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Steve Dickson <steved@redhat.com>
* mountd: add logging of NFSv4 clients attaching and detaching.NeilBrown2021-03-154-9/+191
| | | | | | | | | | | | | | | | | | | | | | | | NFSv4 does not have a MOUNT request like NFSv3 does (via the MOUNT protocol). So these cannot be logged. NFSv4 does have SETCLIENTID and EXCHANGE_ID. These are indirectly visible though changes in /proc/fs/nfsd/clients. When a new client attaches, a directory appears. When the client detaches, through a timeout (v4.0) or DESTROY_SESSION (v4.1+) the directory disappears. This patch adds tracking of these changes using inotify, with log messages when a client attaches or detaches. Unfortuantely clients are created in two steps, the second being a confirmation. This results in a temporary client appearing and disappearing. It is not possible (in Linux 5.10) to detect the unconfirmed client, so extra attach/detach messages are generated. This patch also moves some cache* function declarations into a header file, and makes a few related changes to #includes. Signed-off-by: NeilBrown <neilb@suse.de> Signed-off-by: Steve Dickson <steved@redhat.com>
* mountd: make default ttl settable by optionNeilBrown2021-03-154-6/+10
| | | | | | | | | | | | The DEFAULT_TTL affects the rate at which authentication messages are logged. So it is useful to make it settable. Add "-ttl" and "-T", and add clear statement in the documentation of both the benefits and the possible negative effects of choosing a larger value Signed-off-by: NeilBrown <neil@brown.name> Signed-off-by: Steve Dickson <steved@redhat.com>
* mountd: add --cache-use-ipaddr option to force use_ipaddrNeilBrown2021-03-151-0/+4
| | | | | | | | | | | | When logging authentication requests, it can be easier to read the logs if clients are always identified by IP address, not intermediate names like netgroups or subnets. To allow this, add --cache-use-ipaddr or -i which tell mountd to always enable use_ipaddr. Signed-off-by: NeilBrown <neil@brown.name> Signed-off-by: Steve Dickson <steved@redhat.com>
* mountd: add logging for authentication results for accesses.NeilBrown2021-03-151-1/+17
| | | | | | | | | | | | | | | | | | | When NFSv3 is used to mount a filesystem, success/failure messages are logged by mountd and can be used for auditing. When NFSv4 is used, there is no distinct "MOUNT" request, and nothing is logged. We can instead log authentication requests from the kernel. These will happen regularly - typically every 15 minutes of ongoing access - so they may be too noisy, or might be more useful. As they might not be wanted, make them selectable with the "AUTH" facility in xlog(). Add a "-l" to enable these logs. Alternately "debug = auth" will have the same effect. The same changes are made to both rpc.mountd and nfsv4.exportd. Signed-off-by: NeilBrown <neil@brown.name> Signed-off-by: Steve Dickson <steved@redhat.com>
* mountd: Don't proactively add export info when fh info is requested.NeilBrown2021-03-151-7/+1
| | | | | | | | | | | | | | | | | | | | | | | | | When an "nfsd.fh" request is received from the kernel, we map the file-handle prefix to a path name and report that (as required) and then also add "nfsd.export" information with export flags applicable to that path. This is not necessary and was added as a perceived optimisation. When updating data already in the kernel, it is unlikely to help as the kernel can be expected to ask for both details at much the same time. With NFSv3, new information is normally added by a MOUNT rpc request, so this is irrelevant. With NFSv4, the kernel requests the "nfsd.export" information when walking down from ROOT, *before* requesting the nfsd.fh information, so this "optimisation" causes unnecessary work. A future patch will add logging of authentication requests, and this double-handling would result in extra unnecessary log messages. As this "optimisation" appears to have no practical value and some (small) cost, let's remove it. Signed-off-by: NeilBrown <neil@brown.name> Signed-off-by: Steve Dickson <steved@redhat.com>
* mountd: reject unknown client IP when !use_ipaddr.NeilBrown2021-03-151-10/+7
| | | | | | | | | | | | | | | | | | | When use_ipaddr is not in effect, an auth_unix_ip lookup request from the kernel for an unknown client will be rejected. When it IS in effect, these requests are always granted with the IP address being mapped to a string form of the address, preceded by a '$'. This is inconsistent behaviour and could present a small information leak. It means that, for example, a SETCLIENT NFSv4 request may or may not succeed depending on an internal setting in rpc.mountd. This is easily rectified by always checking if the client is known. Signed-off-by: NeilBrown <neil@brown.name> Signed-off-by: Steve Dickson <steved@redhat.com>
* exportd: Enabled junction supportSteve Dickson2021-02-183-1/+254
| | | | | | | Moved the junction support from mountd to libexport.a so both exportd and mountd can use the code. Signed-off-by: Steve Dickson <steved@redhat.com>
* exportd: Moved cache upcalls routines into libexport.aSteve Dickson2021-02-185-1/+2254
| | | | | | | | | | Move the cache management code into libexport.a so both mountd and exportd can use it. Introduce cache_proccess_loop() which will be used by exportd, instead of my_svc_run(). Signed-off-by: Steve Dickson <steved@redhat.com>
* nfs-utils: rename xlog_from_conffile() to xlog_set_debug()Steve Dickson2021-02-182-2/+2
| | | | | | | Standardized how config setting are set as well as the rename Signed-off-by: Steve Dickson <steved@redhat.com>
* conffile: Only process files in the config.d dirs that end with ".conf"Steve Dickson2020-11-101-2/+23
| | | | | | | To allow admins or admin systems to change configurations by renaming the files, only process file that end with ".conf" Signed-off-by: Steve Dickson <steved@redhat.com>
* conffile: process config.d directory config files.Steve Dickson2020-11-101-3/+121
| | | | | | | | | When a /etc/nfs.conf.d or /etc/nfsmount.conf.d directory exists and config file(s) do exist in those directories, those file(s) will be used and will override the same settings that are set in the main config files. Signed-off-by: Steve Dickson <steved@redhat.com>
* nfs-utils: remove leftover debugging messagesHolger Hoffst?tte2020-10-311-1/+1
| | | | | | | | | After updating to nfs-utils-2.5.2 I noticed extra output on the console when exporting mounts. Apparently commit 482e72ba04 forgot to remove some debugging messages and accidentally committed them. Signed-off-by: Holger Hoffst?tte <holger@applied-asynchrony.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* nfsidmap:umich_ldap return success only if attributes are found in ldap resp.Srikrishan Malik2020-09-172-1/+3
| | | | | | | Return ENOENT if the UID/GID attributes are not found in ldap response. Signed-off-by: Srikrishan Malik <srikrishanmalik@gmail.com> Signed-off-by: Steve Dickson <steved@redhat.com>
* nfsidmap: Allow overriding location of method librariesnfs-utils-2-5-2-rc3Doug Nazar2020-07-271-12/+28
| | | | | Signed-off-by: Doug Nazar <nazard@nazar.ca> Signed-off-by: Steve Dickson <steved@redhat.com>
* exportfs: Fix a few valgrind warningsDoug Nazar2020-07-231-0/+1
| | | | | Signed-off-by: Doug Nazar <nazard@nazar.ca> Signed-off-by: Steve Dickson <steved@redhat.com>
* nfsidmap: Add support to cleanup resources on exitDoug Nazar2020-07-225-1/+36
| | | | | Signed-off-by: Doug Nazar <nazard@nazar.ca> Signed-off-by: Steve Dickson <steved@redhat.com>
View Lorry Controller Status