17c478bdstevel@tonic-gate/*
27c478bdstevel@tonic-gate * CDDL HEADER START
37c478bdstevel@tonic-gate *
47c478bdstevel@tonic-gate * The contents of this file are subject to the terms of the
5a237e38th * Common Development and Distribution License (the "License").
6a237e38th * You may not use this file except in compliance with the License.
77c478bdstevel@tonic-gate *
87c478bdstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bdstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bdstevel@tonic-gate * See the License for the specific language governing permissions
117c478bdstevel@tonic-gate * and limitations under the License.
127c478bdstevel@tonic-gate *
137c478bdstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bdstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bdstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bdstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bdstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bdstevel@tonic-gate *
197c478bdstevel@tonic-gate * CDDL HEADER END
207c478bdstevel@tonic-gate */
21a237e38th
227c478bdstevel@tonic-gate/*
2354d3425Marcel Telka * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
2454d3425Marcel Telka */
2554d3425Marcel Telka
2654d3425Marcel Telka/*
27a237e38th * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
287c478bdstevel@tonic-gate * Use is subject to license terms.
297c478bdstevel@tonic-gate */
307c478bdstevel@tonic-gate
317c478bdstevel@tonic-gate#include <stdio.h>
327c478bdstevel@tonic-gate#include <stdlib.h>
337c478bdstevel@tonic-gate#include <sys/types.h>
347c478bdstevel@tonic-gate#include <string.h>
357c478bdstevel@tonic-gate#include <syslog.h>
367c478bdstevel@tonic-gate#include <sys/param.h>
377c478bdstevel@tonic-gate#include <rpc/rpc.h>
387c478bdstevel@tonic-gate#include <sys/stat.h>
397c478bdstevel@tonic-gate#include <netconfig.h>
407c478bdstevel@tonic-gate#include <netdir.h>
417c478bdstevel@tonic-gate#include <sys/file.h>
427c478bdstevel@tonic-gate#include <sys/time.h>
437c478bdstevel@tonic-gate#include <sys/errno.h>
447c478bdstevel@tonic-gate#include <sys/resource.h>
457c478bdstevel@tonic-gate#include <rpcsvc/mount.h>
467c478bdstevel@tonic-gate#include <sys/pathconf.h>
477c478bdstevel@tonic-gate#include <sys/systeminfo.h>
487c478bdstevel@tonic-gate#include <sys/utsname.h>
497c478bdstevel@tonic-gate#include <signal.h>
507c478bdstevel@tonic-gate#include <locale.h>
517c478bdstevel@tonic-gate#include <unistd.h>
527c478bdstevel@tonic-gate#include <thread.h>
53a237e38th#include <sharefs/share.h>
547c478bdstevel@tonic-gate#include "../lib/sharetab.h"
557c478bdstevel@tonic-gate#include "mountd.h"
567c478bdstevel@tonic-gate
577c478bdstevel@tonic-gatestruct cache_entry {
587c478bdstevel@tonic-gate	char	*cache_host;
597c478bdstevel@tonic-gate	time_t	cache_time;
607c478bdstevel@tonic-gate	int	cache_belong;
617c478bdstevel@tonic-gate	char	**cache_grl;
627c478bdstevel@tonic-gate	int	cache_grc;
637c478bdstevel@tonic-gate	struct cache_entry *cache_next;
647c478bdstevel@tonic-gate};
657c478bdstevel@tonic-gate
667c478bdstevel@tonic-gatestatic struct cache_entry *cache_head;
677c478bdstevel@tonic-gate
687c478bdstevel@tonic-gate#define	VALID_TIME	60  /* seconds */
697c478bdstevel@tonic-gate
707c478bdstevel@tonic-gatestatic rwlock_t cache_lock;	/* protect the cache chain */
717c478bdstevel@tonic-gate
727c478bdstevel@tonic-gatestatic void cache_free(struct cache_entry *entry);
737c478bdstevel@tonic-gatestatic int cache_check(char *host, char **grl, int grc, int *belong);
747c478bdstevel@tonic-gatestatic void cache_enter(char *host, char **grl, int grc, int belong);
757c478bdstevel@tonic-gate
767c478bdstevel@tonic-gate
777c478bdstevel@tonic-gatevoid
787c478bdstevel@tonic-gatenetgroup_init()
797c478bdstevel@tonic-gate{
807c478bdstevel@tonic-gate	(void) rwlock_init(&cache_lock, USYNC_THREAD, NULL);
817c478bdstevel@tonic-gate}
827c478bdstevel@tonic-gate
837c478bdstevel@tonic-gate/*
847c478bdstevel@tonic-gate * Check whether any of the hostnames in clnames are
857c478bdstevel@tonic-gate * members (or non-members) of the netgroups in glist.
867c478bdstevel@tonic-gate * Since the innetgr lookup is rather expensive, the
877c478bdstevel@tonic-gate * result is cached. The cached entry is valid only
887c478bdstevel@tonic-gate * for VALID_TIME seconds.  This works well because
897c478bdstevel@tonic-gate * typically these lookups occur in clusters when
907c478bdstevel@tonic-gate * a client is mounting.
917c478bdstevel@tonic-gate *
927c478bdstevel@tonic-gate * Note that this routine establishes a host membership
937c478bdstevel@tonic-gate * in a list of netgroups - we've no idea just which
947c478bdstevel@tonic-gate * netgroup in the list it is a member of.
957c478bdstevel@tonic-gate *
967c478bdstevel@tonic-gate * glist is a character array containing grc strings
977c478bdstevel@tonic-gate * representing netgroup names (optionally prefixed
987c478bdstevel@tonic-gate * with '-'). Each string is ended with '\0'  and
997c478bdstevel@tonic-gate * followed immediately by the next string.
1007c478bdstevel@tonic-gate */
1017c478bdstevel@tonic-gateint
1027c478bdstevel@tonic-gatenetgroup_check(struct nd_hostservlist *clnames, char  *glist, int grc)
1037c478bdstevel@tonic-gate{
1047c478bdstevel@tonic-gate	char **grl;
1057c478bdstevel@tonic-gate	char *gr;
1067c478bdstevel@tonic-gate	int nhosts = clnames->h_cnt;
1077c478bdstevel@tonic-gate	char *host0, *host;
1087c478bdstevel@tonic-gate	int i, j, n;
1097c478bdstevel@tonic-gate	int response;
1107c478bdstevel@tonic-gate	int belong = 0;
1117c478bdstevel@tonic-gate	static char *domain;
1127c478bdstevel@tonic-gate
1137c478bdstevel@tonic-gate	if (domain == NULL) {
1147c478bdstevel@tonic-gate		int	ssize;
1157c478bdstevel@tonic-gate
1167c478bdstevel@tonic-gate		domain = exmalloc(SYS_NMLN);
1177c478bdstevel@tonic-gate		ssize = sysinfo(SI_SRPC_DOMAIN, domain, SYS_NMLN);
1187c478bdstevel@tonic-gate		if (ssize > SYS_NMLN) {
1197c478bdstevel@tonic-gate			free(domain);
1207c478bdstevel@tonic-gate			domain = exmalloc(ssize);
1217c478bdstevel@tonic-gate			ssize = sysinfo(SI_SRPC_DOMAIN, domain, ssize);
1227c478bdstevel@tonic-gate		}
1237c478bdstevel@tonic-gate		/* Check for error in syscall or NULL domain name */
1247c478bdstevel@tonic-gate		if (ssize <= 1) {
1257c478bdstevel@tonic-gate			syslog(LOG_ERR, "No default domain set");
1267c478bdstevel@tonic-gate			return (0);
1277c478bdstevel@tonic-gate		}
1287c478bdstevel@tonic-gate	}
1297c478bdstevel@tonic-gate
1307c478bdstevel@tonic-gate	grl = calloc(grc, sizeof (char *));
1317c478bdstevel@tonic-gate	if (grl == NULL)
1327c478bdstevel@tonic-gate		return (0);
1337c478bdstevel@tonic-gate
1347c478bdstevel@tonic-gate	for (i = 0, gr = glist; i < grc && !belong; ) {
1357c478bdstevel@tonic-gate		/*
1367c478bdstevel@tonic-gate		 * If the netgroup name has a '-' prepended
1377c478bdstevel@tonic-gate		 * then a match of this name implies a failure
1387c478bdstevel@tonic-gate		 * instead of success.
1397c478bdstevel@tonic-gate		 */
1407c478bdstevel@tonic-gate		response = (*gr != '-') ? 1 : 0;
1417c478bdstevel@tonic-gate
1427c478bdstevel@tonic-gate		/*
1437c478bdstevel@tonic-gate		 * Subsequent names with or without a '-' (but no mix)
1447c478bdstevel@tonic-gate		 * can be grouped together for a single check.
1457c478bdstevel@tonic-gate		 */
1467c478bdstevel@tonic-gate		for (n = 0; i < grc; i++, n++, gr += strlen(gr) + 1) {
14754d3425Marcel Telka			if ((response && *gr == '-') ||
14854d3425Marcel Telka			    (!response && *gr != '-'))
1497c478bdstevel@tonic-gate				break;
1507c478bdstevel@tonic-gate
1517c478bdstevel@tonic-gate			grl[n] = response ? gr : gr + 1;
1527c478bdstevel@tonic-gate		}
1537c478bdstevel@tonic-gate
1547c478bdstevel@tonic-gate		host0 = clnames->h_hostservs[0].h_host;
1557c478bdstevel@tonic-gate
1567c478bdstevel@tonic-gate		/*
1577c478bdstevel@tonic-gate		 * If not in cache check the netgroup for each
1587c478bdstevel@tonic-gate		 * of the hosts names (usually just one).
1597c478bdstevel@tonic-gate		 * Enter the result into the cache.
1607c478bdstevel@tonic-gate		 */
1617c478bdstevel@tonic-gate		if (!cache_check(host0, grl, n, &belong)) {
1627c478bdstevel@tonic-gate			for (j = 0; j < nhosts && !belong; j++) {
1637c478bdstevel@tonic-gate				host = clnames->h_hostservs[j].h_host;
1647c478bdstevel@tonic-gate
1657c478bdstevel@tonic-gate				if (__multi_innetgr(n, grl,
16654d3425Marcel Telka				    1, &host,
16754d3425Marcel Telka				    0, NULL,
16854d3425Marcel Telka				    1, &domain))
1697c478bdstevel@tonic-gate					belong = 1;
1707c478bdstevel@tonic-gate			}
1717c478bdstevel@tonic-gate
1727c478bdstevel@tonic-gate			cache_enter(host0, grl, n, belong);
1737c478bdstevel@tonic-gate		}
1747c478bdstevel@tonic-gate	}
1757c478bdstevel@tonic-gate
1767c478bdstevel@tonic-gate	free(grl);
1777c478bdstevel@tonic-gate	return (belong ? response : 0);
1787c478bdstevel@tonic-gate}
1797c478bdstevel@tonic-gate
1807c478bdstevel@tonic-gate/*
1817c478bdstevel@tonic-gate * Free a cache entry and all entries
1827c478bdstevel@tonic-gate * further down the chain since they
1837c478bdstevel@tonic-gate * will also be expired.
1847c478bdstevel@tonic-gate */
1857c478bdstevel@tonic-gatestatic void
1867c478bdstevel@tonic-gatecache_free(struct cache_entry *entry)
1877c478bdstevel@tonic-gate{
1887c478bdstevel@tonic-gate	struct cache_entry *ce, *next;
1897c478bdstevel@tonic-gate	int i;
1907c478bdstevel@tonic-gate
1917c478bdstevel@tonic-gate	for (ce = entry; ce; ce = next) {
1927c478bdstevel@tonic-gate		if (ce->cache_host)
1937c478bdstevel@tonic-gate			free(ce->cache_host);
1947c478bdstevel@tonic-gate		for (i = 0; i < ce->cache_grc; i++)
1957c478bdstevel@tonic-gate			if (ce->cache_grl[i])
1967c478bdstevel@tonic-gate				free(ce->cache_grl[i]);
1977c478bdstevel@tonic-gate		if (ce->cache_grl)
1987c478bdstevel@tonic-gate			free(ce->cache_grl);
1997c478bdstevel@tonic-gate		next = ce->cache_next;
2007c478bdstevel@tonic-gate		free(ce);
2017c478bdstevel@tonic-gate	}
2027c478bdstevel@tonic-gate}
2037c478bdstevel@tonic-gate
2047c478bdstevel@tonic-gate/*
2057c478bdstevel@tonic-gate * Search the entries in the cache chain looking
2067c478bdstevel@tonic-gate * for an entry with a matching hostname and group
2077c478bdstevel@tonic-gate * list.  If a match is found then return the "belong"
2087c478bdstevel@tonic-gate * value which may be 1 or 0 depending on whether the
2097c478bdstevel@tonic-gate * client is a member of the list or not.  This is
2107c478bdstevel@tonic-gate * both a positive and negative cache.
2117c478bdstevel@tonic-gate *
2127c478bdstevel@tonic-gate * Cache entries have a validity of VALID_TIME seconds.
2137c478bdstevel@tonic-gate * If we find an expired entry then blow away the entry
2147c478bdstevel@tonic-gate * and the rest of the chain since entries further down
2157c478bdstevel@tonic-gate * the chain will be expired too because we always add
2167c478bdstevel@tonic-gate * new entries to the head of the chain.
2177c478bdstevel@tonic-gate */
2187c478bdstevel@tonic-gatestatic int
2197c478bdstevel@tonic-gatecache_check(char *host, char **grl, int grc, int *belong)
2207c478bdstevel@tonic-gate{
2217c478bdstevel@tonic-gate	struct cache_entry *ce, *prev;
2227c478bdstevel@tonic-gate	time_t timenow = time(NULL);
2237c478bdstevel@tonic-gate	int i;
2247c478bdstevel@tonic-gate
2257c478bdstevel@tonic-gate	(void) rw_rdlock(&cache_lock);
2267c478bdstevel@tonic-gate
2277c478bdstevel@tonic-gate	for (ce = cache_head; ce; ce = ce->cache_next) {
2287c478bdstevel@tonic-gate
2297c478bdstevel@tonic-gate		/*
2307c478bdstevel@tonic-gate		 * If we find a stale entry, there can't
2317c478bdstevel@tonic-gate		 * be any valid entries from here on.
2327c478bdstevel@tonic-gate		 * Acquire a write lock, search the chain again
2337c478bdstevel@tonic-gate		 * and delete the stale entry and all following
2347c478bdstevel@tonic-gate		 * entries.
2357c478bdstevel@tonic-gate		 */
2367c478bdstevel@tonic-gate		if (timenow > ce->cache_time) {
2377c478bdstevel@tonic-gate			(void) rw_unlock(&cache_lock);
2387c478bdstevel@tonic-gate			(void) rw_wrlock(&cache_lock);
2397c478bdstevel@tonic-gate
2407c478bdstevel@tonic-gate			for (prev = NULL, ce = cache_head; ce;
2417c478bdstevel@tonic-gate			    prev = ce, ce = ce->cache_next)
2427c478bdstevel@tonic-gate				if (timenow > ce->cache_time)
2437c478bdstevel@tonic-gate					break;
2447c478bdstevel@tonic-gate
2457c478bdstevel@tonic-gate			if (ce != NULL) {
2467c478bdstevel@tonic-gate				if (prev)
2477c478bdstevel@tonic-gate					prev->cache_next = NULL;
2487c478bdstevel@tonic-gate				else
2497c478bdstevel@tonic-gate					cache_head = NULL;
2507c478bdstevel@tonic-gate
2517c478bdstevel@tonic-gate				cache_free(ce);
2527c478bdstevel@tonic-gate			}
2537c478bdstevel@tonic-gate			(void) rw_unlock(&cache_lock);
2547c478bdstevel@tonic-gate
2557c478bdstevel@tonic-gate			return (0);
2567c478bdstevel@tonic-gate		}
2577c478bdstevel@tonic-gate		if (ce->cache_grc != grc)
2587c478bdstevel@tonic-gate			continue;	/* no match */
2597c478bdstevel@tonic-gate
2607c478bdstevel@tonic-gate		if (strcasecmp(host, ce->cache_host) != 0)
2617c478bdstevel@tonic-gate			continue;	/* no match */
2627c478bdstevel@tonic-gate
2637c478bdstevel@tonic-gate		for (i = 0; i < grc; i++)
2647c478bdstevel@tonic-gate			if (strcasecmp(ce->cache_grl[i], grl[i]) != 0)
2657c478bdstevel@tonic-gate				break;	/* no match */
2667c478bdstevel@tonic-gate		if (i < grc)
2677c478bdstevel@tonic-gate			continue;
2687c478bdstevel@tonic-gate
2697c478bdstevel@tonic-gate		*belong = ce->cache_belong;
2707c478bdstevel@tonic-gate		(void) rw_unlock(&cache_lock);
2717c478bdstevel@tonic-gate
2727c478bdstevel@tonic-gate		return (1);
2737c478bdstevel@tonic-gate	}
2747c478bdstevel@tonic-gate
2757c478bdstevel@tonic-gate	(void) rw_unlock(&cache_lock);
2767c478bdstevel@tonic-gate
2777c478bdstevel@tonic-gate	return (0);
2787c478bdstevel@tonic-gate}
2797c478bdstevel@tonic-gate
2807c478bdstevel@tonic-gate/*
2817c478bdstevel@tonic-gate * Put a new entry in the cache chain by
2827c478bdstevel@tonic-gate * prepending it to the front.
2837c478bdstevel@tonic-gate * If there isn't enough memory then just give up.
2847c478bdstevel@tonic-gate */
2857c478bdstevel@tonic-gatestatic void
2867c478bdstevel@tonic-gatecache_enter(char *host, char **grl, int grc, int belong)
2877c478bdstevel@tonic-gate{
2887c478bdstevel@tonic-gate	struct cache_entry *entry;
2897c478bdstevel@tonic-gate	int i;
2907c478bdstevel@tonic-gate
2917c478bdstevel@tonic-gate	entry = malloc(sizeof (*entry));
2927c478bdstevel@tonic-gate	if (entry == NULL)
2937c478bdstevel@tonic-gate		return;
2947c478bdstevel@tonic-gate
2957c478bdstevel@tonic-gate	(void) memset((caddr_t)entry, 0, sizeof (*entry));
2967c478bdstevel@tonic-gate	entry->cache_host = strdup(host);
2977c478bdstevel@tonic-gate	if (entry->cache_host == NULL) {
2987c478bdstevel@tonic-gate		cache_free(entry);
2997c478bdstevel@tonic-gate		return;
3007c478bdstevel@tonic-gate	}
3017c478bdstevel@tonic-gate
3027c478bdstevel@tonic-gate	entry->cache_time = time(NULL) + VALID_TIME;
3037c478bdstevel@tonic-gate	entry->cache_belong = belong;
3047c478bdstevel@tonic-gate	entry->cache_grl = malloc(grc * sizeof (char *));
3057c478bdstevel@tonic-gate	if (entry->cache_grl == NULL) {
3067c478bdstevel@tonic-gate		cache_free(entry);
3077c478bdstevel@tonic-gate		return;
3087c478bdstevel@tonic-gate	}
3097c478bdstevel@tonic-gate
3107c478bdstevel@tonic-gate	for (i = 0; i < grc; i++) {
3117c478bdstevel@tonic-gate		entry->cache_grl[i] = strdup(grl[i]);
3127c478bdstevel@tonic-gate		if (entry->cache_grl[i] == NULL) {
3137c478bdstevel@tonic-gate			entry->cache_grc = i;
3147c478bdstevel@tonic-gate			cache_free(entry);
3157c478bdstevel@tonic-gate			return;
3167c478bdstevel@tonic-gate		}
3177c478bdstevel@tonic-gate	}
3187c478bdstevel@tonic-gate
3197c478bdstevel@tonic-gate	entry->cache_grc = grc;
3207c478bdstevel@tonic-gate
3217c478bdstevel@tonic-gate	(void) rw_wrlock(&cache_lock);
3227c478bdstevel@tonic-gate	entry->cache_next = cache_head;
3237c478bdstevel@tonic-gate	cache_head = entry;
3247c478bdstevel@tonic-gate	(void) rw_unlock(&cache_lock);
3257c478bdstevel@tonic-gate}
3267c478bdstevel@tonic-gate
3277c478bdstevel@tonic-gate/*
3287c478bdstevel@tonic-gate * Full cache flush
3297c478bdstevel@tonic-gate */
3307c478bdstevel@tonic-gatevoid
3317c478bdstevel@tonic-gatenetgrp_cache_flush(void)
3327c478bdstevel@tonic-gate{
3337c478bdstevel@tonic-gate	(void) rw_wrlock(&cache_lock);
3347c478bdstevel@tonic-gate	cache_free(cache_head);
3357c478bdstevel@tonic-gate	cache_head = NULL;
3367c478bdstevel@tonic-gate	(void) rw_unlock(&cache_lock);
3377c478bdstevel@tonic-gate}
338