Commit f15364bd authored by Aurélien Charbon's avatar Aurélien Charbon Committed by J. Bruce Fields

IPv6 support for NFS server export caches

This adds IPv6 support to the interfaces that are used to express nfsd
exports.  All addressed are stored internally as IPv6; backwards
compatibility is maintained using mapped addresses.

Thanks to Bruce Fields, Brian Haley, Neil Brown and Hideaki Joshifuji
for comments
Signed-off-by: default avatarAurelien Charbon <aurelien.charbon@bull.net>
Cc: Neil Brown <neilb@suse.de>
Cc: Brian Haley <brian.haley@hp.com>
Cc:  YOSHIFUJI Hideaki / 吉藤英明 <yoshfuji@linux-ipv6.org>
Signed-off-by: default avatarJ. Bruce Fields <bfields@citi.umich.edu>
parent d751a7cd
...@@ -35,6 +35,7 @@ ...@@ -35,6 +35,7 @@
#include <linux/lockd/bind.h> #include <linux/lockd/bind.h>
#include <linux/sunrpc/msg_prot.h> #include <linux/sunrpc/msg_prot.h>
#include <linux/sunrpc/gss_api.h> #include <linux/sunrpc/gss_api.h>
#include <net/ipv6.h>
#define NFSDDBG_FACILITY NFSDDBG_EXPORT #define NFSDDBG_FACILITY NFSDDBG_EXPORT
...@@ -1548,6 +1549,7 @@ exp_addclient(struct nfsctl_client *ncp) ...@@ -1548,6 +1549,7 @@ exp_addclient(struct nfsctl_client *ncp)
{ {
struct auth_domain *dom; struct auth_domain *dom;
int i, err; int i, err;
struct in6_addr addr6;
/* First, consistency check. */ /* First, consistency check. */
err = -EINVAL; err = -EINVAL;
...@@ -1566,9 +1568,10 @@ exp_addclient(struct nfsctl_client *ncp) ...@@ -1566,9 +1568,10 @@ exp_addclient(struct nfsctl_client *ncp)
goto out_unlock; goto out_unlock;
/* Insert client into hashtable. */ /* Insert client into hashtable. */
for (i = 0; i < ncp->cl_naddr; i++) for (i = 0; i < ncp->cl_naddr; i++) {
auth_unix_add_addr(ncp->cl_addrlist[i], dom); ipv6_addr_set_v4mapped(ncp->cl_addrlist[i].s_addr, &addr6);
auth_unix_add_addr(&addr6, dom);
}
auth_unix_forget_old(dom); auth_unix_forget_old(dom);
auth_domain_put(dom); auth_domain_put(dom);
......
...@@ -37,6 +37,7 @@ ...@@ -37,6 +37,7 @@
#include <linux/nfsd/syscall.h> #include <linux/nfsd/syscall.h>
#include <asm/uaccess.h> #include <asm/uaccess.h>
#include <net/ipv6.h>
/* /*
* We have a single directory with 9 nodes in it. * We have a single directory with 9 nodes in it.
...@@ -222,6 +223,7 @@ static ssize_t write_getfs(struct file *file, char *buf, size_t size) ...@@ -222,6 +223,7 @@ static ssize_t write_getfs(struct file *file, char *buf, size_t size)
struct auth_domain *clp; struct auth_domain *clp;
int err = 0; int err = 0;
struct knfsd_fh *res; struct knfsd_fh *res;
struct in6_addr in6;
if (size < sizeof(*data)) if (size < sizeof(*data))
return -EINVAL; return -EINVAL;
...@@ -236,7 +238,11 @@ static ssize_t write_getfs(struct file *file, char *buf, size_t size) ...@@ -236,7 +238,11 @@ static ssize_t write_getfs(struct file *file, char *buf, size_t size)
res = (struct knfsd_fh*)buf; res = (struct knfsd_fh*)buf;
exp_readlock(); exp_readlock();
if (!(clp = auth_unix_lookup(sin->sin_addr)))
ipv6_addr_set_v4mapped(sin->sin_addr.s_addr, &in6);
clp = auth_unix_lookup(&in6);
if (!clp)
err = -EPERM; err = -EPERM;
else { else {
err = exp_rootfh(clp, data->gd_path, res, data->gd_maxlen); err = exp_rootfh(clp, data->gd_path, res, data->gd_maxlen);
...@@ -257,6 +263,7 @@ static ssize_t write_getfd(struct file *file, char *buf, size_t size) ...@@ -257,6 +263,7 @@ static ssize_t write_getfd(struct file *file, char *buf, size_t size)
int err = 0; int err = 0;
struct knfsd_fh fh; struct knfsd_fh fh;
char *res; char *res;
struct in6_addr in6;
if (size < sizeof(*data)) if (size < sizeof(*data))
return -EINVAL; return -EINVAL;
...@@ -271,7 +278,11 @@ static ssize_t write_getfd(struct file *file, char *buf, size_t size) ...@@ -271,7 +278,11 @@ static ssize_t write_getfd(struct file *file, char *buf, size_t size)
res = buf; res = buf;
sin = (struct sockaddr_in *)&data->gd_addr; sin = (struct sockaddr_in *)&data->gd_addr;
exp_readlock(); exp_readlock();
if (!(clp = auth_unix_lookup(sin->sin_addr)))
ipv6_addr_set_v4mapped(sin->sin_addr.s_addr, &in6);
clp = auth_unix_lookup(&in6);
if (!clp)
err = -EPERM; err = -EPERM;
else { else {
err = exp_rootfh(clp, data->gd_path, &fh, NFS_FHSIZE); err = exp_rootfh(clp, data->gd_path, &fh, NFS_FHSIZE);
......
...@@ -24,6 +24,7 @@ struct svc_cred { ...@@ -24,6 +24,7 @@ struct svc_cred {
}; };
struct svc_rqst; /* forward decl */ struct svc_rqst; /* forward decl */
struct in6_addr;
/* Authentication is done in the context of a domain. /* Authentication is done in the context of a domain.
* *
...@@ -120,10 +121,10 @@ extern void svc_auth_unregister(rpc_authflavor_t flavor); ...@@ -120,10 +121,10 @@ extern void svc_auth_unregister(rpc_authflavor_t flavor);
extern struct auth_domain *unix_domain_find(char *name); extern struct auth_domain *unix_domain_find(char *name);
extern void auth_domain_put(struct auth_domain *item); extern void auth_domain_put(struct auth_domain *item);
extern int auth_unix_add_addr(struct in_addr addr, struct auth_domain *dom); extern int auth_unix_add_addr(struct in6_addr *addr, struct auth_domain *dom);
extern struct auth_domain *auth_domain_lookup(char *name, struct auth_domain *new); extern struct auth_domain *auth_domain_lookup(char *name, struct auth_domain *new);
extern struct auth_domain *auth_domain_find(char *name); extern struct auth_domain *auth_domain_find(char *name);
extern struct auth_domain *auth_unix_lookup(struct in_addr addr); extern struct auth_domain *auth_unix_lookup(struct in6_addr *addr);
extern int auth_unix_forget_old(struct auth_domain *dom); extern int auth_unix_forget_old(struct auth_domain *dom);
extern void svcauth_unix_purge(void); extern void svcauth_unix_purge(void);
extern void svcauth_unix_info_release(void *); extern void svcauth_unix_info_release(void *);
......
...@@ -383,6 +383,15 @@ static inline int ipv6_addr_orchid(const struct in6_addr *a) ...@@ -383,6 +383,15 @@ static inline int ipv6_addr_orchid(const struct in6_addr *a)
== htonl(0x20010010)); == htonl(0x20010010));
} }
static inline void ipv6_addr_set_v4mapped(const __be32 addr,
struct in6_addr *v4mapped)
{
ipv6_addr_set(v4mapped,
0, 0,
htonl(0x0000FFFF),
addr);
}
/* /*
* find the first different bit between two addresses * find the first different bit between two addresses
* length of address must be a multiple of 32bits * length of address must be a multiple of 32bits
......
...@@ -11,7 +11,8 @@ ...@@ -11,7 +11,8 @@
#include <linux/hash.h> #include <linux/hash.h>
#include <linux/string.h> #include <linux/string.h>
#include <net/sock.h> #include <net/sock.h>
#include <net/ipv6.h>
#include <linux/kernel.h>
#define RPCDBG_FACILITY RPCDBG_AUTH #define RPCDBG_FACILITY RPCDBG_AUTH
...@@ -85,7 +86,7 @@ static void svcauth_unix_domain_release(struct auth_domain *dom) ...@@ -85,7 +86,7 @@ static void svcauth_unix_domain_release(struct auth_domain *dom)
struct ip_map { struct ip_map {
struct cache_head h; struct cache_head h;
char m_class[8]; /* e.g. "nfsd" */ char m_class[8]; /* e.g. "nfsd" */
struct in_addr m_addr; struct in6_addr m_addr;
struct unix_domain *m_client; struct unix_domain *m_client;
int m_add_change; int m_add_change;
}; };
...@@ -113,12 +114,19 @@ static inline int hash_ip(__be32 ip) ...@@ -113,12 +114,19 @@ static inline int hash_ip(__be32 ip)
return (hash ^ (hash>>8)) & 0xff; return (hash ^ (hash>>8)) & 0xff;
} }
#endif #endif
static inline int hash_ip6(struct in6_addr ip)
{
return (hash_ip(ip.s6_addr32[0]) ^
hash_ip(ip.s6_addr32[1]) ^
hash_ip(ip.s6_addr32[2]) ^
hash_ip(ip.s6_addr32[3]));
}
static int ip_map_match(struct cache_head *corig, struct cache_head *cnew) static int ip_map_match(struct cache_head *corig, struct cache_head *cnew)
{ {
struct ip_map *orig = container_of(corig, struct ip_map, h); struct ip_map *orig = container_of(corig, struct ip_map, h);
struct ip_map *new = container_of(cnew, struct ip_map, h); struct ip_map *new = container_of(cnew, struct ip_map, h);
return strcmp(orig->m_class, new->m_class) == 0 return strcmp(orig->m_class, new->m_class) == 0
&& orig->m_addr.s_addr == new->m_addr.s_addr; && ipv6_addr_equal(&orig->m_addr, &new->m_addr);
} }
static void ip_map_init(struct cache_head *cnew, struct cache_head *citem) static void ip_map_init(struct cache_head *cnew, struct cache_head *citem)
{ {
...@@ -126,7 +134,7 @@ static void ip_map_init(struct cache_head *cnew, struct cache_head *citem) ...@@ -126,7 +134,7 @@ static void ip_map_init(struct cache_head *cnew, struct cache_head *citem)
struct ip_map *item = container_of(citem, struct ip_map, h); struct ip_map *item = container_of(citem, struct ip_map, h);
strcpy(new->m_class, item->m_class); strcpy(new->m_class, item->m_class);
new->m_addr.s_addr = item->m_addr.s_addr; ipv6_addr_copy(&new->m_addr, &item->m_addr);
} }
static void update(struct cache_head *cnew, struct cache_head *citem) static void update(struct cache_head *cnew, struct cache_head *citem)
{ {
...@@ -150,22 +158,24 @@ static void ip_map_request(struct cache_detail *cd, ...@@ -150,22 +158,24 @@ static void ip_map_request(struct cache_detail *cd,
struct cache_head *h, struct cache_head *h,
char **bpp, int *blen) char **bpp, int *blen)
{ {
char text_addr[20]; char text_addr[40];
struct ip_map *im = container_of(h, struct ip_map, h); struct ip_map *im = container_of(h, struct ip_map, h);
__be32 addr = im->m_addr.s_addr;
snprintf(text_addr, 20, "%u.%u.%u.%u",
ntohl(addr) >> 24 & 0xff,
ntohl(addr) >> 16 & 0xff,
ntohl(addr) >> 8 & 0xff,
ntohl(addr) >> 0 & 0xff);
if (ipv6_addr_v4mapped(&(im->m_addr))) {
snprintf(text_addr, 20, NIPQUAD_FMT,
ntohl(im->m_addr.s6_addr32[3]) >> 24 & 0xff,
ntohl(im->m_addr.s6_addr32[3]) >> 16 & 0xff,
ntohl(im->m_addr.s6_addr32[3]) >> 8 & 0xff,
ntohl(im->m_addr.s6_addr32[3]) >> 0 & 0xff);
} else {
snprintf(text_addr, 40, NIP6_FMT, NIP6(im->m_addr));
}
qword_add(bpp, blen, im->m_class); qword_add(bpp, blen, im->m_class);
qword_add(bpp, blen, text_addr); qword_add(bpp, blen, text_addr);
(*bpp)[-1] = '\n'; (*bpp)[-1] = '\n';
} }
static struct ip_map *ip_map_lookup(char *class, struct in_addr addr); static struct ip_map *ip_map_lookup(char *class, struct in6_addr *addr);
static int ip_map_update(struct ip_map *ipm, struct unix_domain *udom, time_t expiry); static int ip_map_update(struct ip_map *ipm, struct unix_domain *udom, time_t expiry);
static int ip_map_parse(struct cache_detail *cd, static int ip_map_parse(struct cache_detail *cd,
...@@ -176,10 +186,10 @@ static int ip_map_parse(struct cache_detail *cd, ...@@ -176,10 +186,10 @@ static int ip_map_parse(struct cache_detail *cd,
* for scratch: */ * for scratch: */
char *buf = mesg; char *buf = mesg;
int len; int len;
int b1,b2,b3,b4; int b1, b2, b3, b4, b5, b6, b7, b8;
char c; char c;
char class[8]; char class[8];
struct in_addr addr; struct in6_addr addr;
int err; int err;
struct ip_map *ipmp; struct ip_map *ipmp;
...@@ -198,7 +208,23 @@ static int ip_map_parse(struct cache_detail *cd, ...@@ -198,7 +208,23 @@ static int ip_map_parse(struct cache_detail *cd,
len = qword_get(&mesg, buf, mlen); len = qword_get(&mesg, buf, mlen);
if (len <= 0) return -EINVAL; if (len <= 0) return -EINVAL;
if (sscanf(buf, "%u.%u.%u.%u%c", &b1, &b2, &b3, &b4, &c) != 4) if (sscanf(buf, NIPQUAD_FMT "%c", &b1, &b2, &b3, &b4, &c) == 4) {
addr.s6_addr32[0] = 0;
addr.s6_addr32[1] = 0;
addr.s6_addr32[2] = htonl(0xffff);
addr.s6_addr32[3] =
htonl((((((b1<<8)|b2)<<8)|b3)<<8)|b4);
} else if (sscanf(buf, NIP6_FMT "%c",
&b1, &b2, &b3, &b4, &b5, &b6, &b7, &b8, &c) == 8) {
addr.s6_addr16[0] = htons(b1);
addr.s6_addr16[1] = htons(b2);
addr.s6_addr16[2] = htons(b3);
addr.s6_addr16[3] = htons(b4);
addr.s6_addr16[4] = htons(b5);
addr.s6_addr16[5] = htons(b6);
addr.s6_addr16[6] = htons(b7);
addr.s6_addr16[7] = htons(b8);
} else
return -EINVAL; return -EINVAL;
expiry = get_expiry(&mesg); expiry = get_expiry(&mesg);
...@@ -216,10 +242,7 @@ static int ip_map_parse(struct cache_detail *cd, ...@@ -216,10 +242,7 @@ static int ip_map_parse(struct cache_detail *cd,
} else } else
dom = NULL; dom = NULL;
addr.s_addr = ipmp = ip_map_lookup(class, &addr);
htonl((((((b1<<8)|b2)<<8)|b3)<<8)|b4);
ipmp = ip_map_lookup(class,addr);
if (ipmp) { if (ipmp) {
err = ip_map_update(ipmp, err = ip_map_update(ipmp,
container_of(dom, struct unix_domain, h), container_of(dom, struct unix_domain, h),
...@@ -239,7 +262,7 @@ static int ip_map_show(struct seq_file *m, ...@@ -239,7 +262,7 @@ static int ip_map_show(struct seq_file *m,
struct cache_head *h) struct cache_head *h)
{ {
struct ip_map *im; struct ip_map *im;
struct in_addr addr; struct in6_addr addr;
char *dom = "-no-domain-"; char *dom = "-no-domain-";
if (h == NULL) { if (h == NULL) {
...@@ -248,20 +271,24 @@ static int ip_map_show(struct seq_file *m, ...@@ -248,20 +271,24 @@ static int ip_map_show(struct seq_file *m,
} }
im = container_of(h, struct ip_map, h); im = container_of(h, struct ip_map, h);
/* class addr domain */ /* class addr domain */
addr = im->m_addr; ipv6_addr_copy(&addr, &im->m_addr);
if (test_bit(CACHE_VALID, &h->flags) && if (test_bit(CACHE_VALID, &h->flags) &&
!test_bit(CACHE_NEGATIVE, &h->flags)) !test_bit(CACHE_NEGATIVE, &h->flags))
dom = im->m_client->h.name; dom = im->m_client->h.name;
seq_printf(m, "%s %d.%d.%d.%d %s\n", if (ipv6_addr_v4mapped(&addr)) {
seq_printf(m, "%s" NIPQUAD_FMT "%s\n",
im->m_class, im->m_class,
ntohl(addr.s_addr) >> 24 & 0xff, ntohl(addr.s6_addr32[3]) >> 24 & 0xff,
ntohl(addr.s_addr) >> 16 & 0xff, ntohl(addr.s6_addr32[3]) >> 16 & 0xff,
ntohl(addr.s_addr) >> 8 & 0xff, ntohl(addr.s6_addr32[3]) >> 8 & 0xff,
ntohl(addr.s_addr) >> 0 & 0xff, ntohl(addr.s6_addr32[3]) >> 0 & 0xff,
dom dom);
); } else {
seq_printf(m, "%s" NIP6_FMT "%s\n",
im->m_class, NIP6(addr), dom);
}
return 0; return 0;
} }
...@@ -281,16 +308,16 @@ struct cache_detail ip_map_cache = { ...@@ -281,16 +308,16 @@ struct cache_detail ip_map_cache = {
.alloc = ip_map_alloc, .alloc = ip_map_alloc,
}; };
static struct ip_map *ip_map_lookup(char *class, struct in_addr addr) static struct ip_map *ip_map_lookup(char *class, struct in6_addr *addr)
{ {
struct ip_map ip; struct ip_map ip;
struct cache_head *ch; struct cache_head *ch;
strcpy(ip.m_class, class); strcpy(ip.m_class, class);
ip.m_addr = addr; ipv6_addr_copy(&ip.m_addr, addr);
ch = sunrpc_cache_lookup(&ip_map_cache, &ip.h, ch = sunrpc_cache_lookup(&ip_map_cache, &ip.h,
hash_str(class, IP_HASHBITS) ^ hash_str(class, IP_HASHBITS) ^
hash_ip(addr.s_addr)); hash_ip6(*addr));
if (ch) if (ch)
return container_of(ch, struct ip_map, h); return container_of(ch, struct ip_map, h);
...@@ -319,14 +346,14 @@ static int ip_map_update(struct ip_map *ipm, struct unix_domain *udom, time_t ex ...@@ -319,14 +346,14 @@ static int ip_map_update(struct ip_map *ipm, struct unix_domain *udom, time_t ex
ch = sunrpc_cache_update(&ip_map_cache, ch = sunrpc_cache_update(&ip_map_cache,
&ip.h, &ipm->h, &ip.h, &ipm->h,
hash_str(ipm->m_class, IP_HASHBITS) ^ hash_str(ipm->m_class, IP_HASHBITS) ^
hash_ip(ipm->m_addr.s_addr)); hash_ip6(ipm->m_addr));
if (!ch) if (!ch)
return -ENOMEM; return -ENOMEM;
cache_put(ch, &ip_map_cache); cache_put(ch, &ip_map_cache);
return 0; return 0;
} }
int auth_unix_add_addr(struct in_addr addr, struct auth_domain *dom) int auth_unix_add_addr(struct in6_addr *addr, struct auth_domain *dom)
{ {
struct unix_domain *udom; struct unix_domain *udom;
struct ip_map *ipmp; struct ip_map *ipmp;
...@@ -355,7 +382,7 @@ int auth_unix_forget_old(struct auth_domain *dom) ...@@ -355,7 +382,7 @@ int auth_unix_forget_old(struct auth_domain *dom)
} }
EXPORT_SYMBOL(auth_unix_forget_old); EXPORT_SYMBOL(auth_unix_forget_old);
struct auth_domain *auth_unix_lookup(struct in_addr addr) struct auth_domain *auth_unix_lookup(struct in6_addr *addr)
{ {
struct ip_map *ipm; struct ip_map *ipm;
struct auth_domain *rv; struct auth_domain *rv;
...@@ -650,9 +677,24 @@ static int unix_gid_find(uid_t uid, struct group_info **gip, ...@@ -650,9 +677,24 @@ static int unix_gid_find(uid_t uid, struct group_info **gip,
int int
svcauth_unix_set_client(struct svc_rqst *rqstp) svcauth_unix_set_client(struct svc_rqst *rqstp)
{ {
struct sockaddr_in *sin = svc_addr_in(rqstp); struct sockaddr_in *sin;
struct sockaddr_in6 *sin6, sin6_storage;
struct ip_map *ipm; struct ip_map *ipm;
switch (rqstp->rq_addr.ss_family) {
case AF_INET:
sin = svc_addr_in(rqstp);
sin6 = &sin6_storage;
ipv6_addr_set(&sin6->sin6_addr, 0, 0,
htonl(0x0000FFFF), sin->sin_addr.s_addr);
break;
case AF_INET6:
sin6 = svc_addr_in6(rqstp);
break;
default:
BUG();
}
rqstp->rq_client = NULL; rqstp->rq_client = NULL;
if (rqstp->rq_proc == 0) if (rqstp->rq_proc == 0)
return SVC_OK; return SVC_OK;
...@@ -660,7 +702,7 @@ svcauth_unix_set_client(struct svc_rqst *rqstp) ...@@ -660,7 +702,7 @@ svcauth_unix_set_client(struct svc_rqst *rqstp)
ipm = ip_map_cached_get(rqstp); ipm = ip_map_cached_get(rqstp);
if (ipm == NULL) if (ipm == NULL)
ipm = ip_map_lookup(rqstp->rq_server->sv_program->pg_class, ipm = ip_map_lookup(rqstp->rq_server->sv_program->pg_class,
sin->sin_addr); &sin6->sin6_addr);
if (ipm == NULL) if (ipm == NULL)
return SVC_DENIED; return SVC_DENIED;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment