From patchwork Thu Feb 25 02:42:47 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: NeilBrown X-Patchwork-Id: 12103133 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E8ED0C433E6 for ; Thu, 25 Feb 2021 02:44:19 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id AA7AD6146B for ; Thu, 25 Feb 2021 02:44:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236802AbhBYCn5 (ORCPT ); Wed, 24 Feb 2021 21:43:57 -0500 Received: from mx2.suse.de ([195.135.220.15]:41946 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234384AbhBYCn4 (ORCPT ); Wed, 24 Feb 2021 21:43:56 -0500 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.221.27]) by mx2.suse.de (Postfix) with ESMTP id 227B2AE05; Thu, 25 Feb 2021 02:43:15 +0000 (UTC) From: NeilBrown To: Steve Dickson Date: Thu, 25 Feb 2021 13:42:47 +1100 Subject: [PATCH 1/5] mountd: reject unknown client IP when !use_ipaddr. Cc: Linux NFS Mailing list Message-ID: <161422096786.28256.16255172827545591674.stgit@noble> In-Reply-To: <161422077024.28256.15543036625096419495.stgit@noble> References: <161422077024.28256.15543036625096419495.stgit@noble> User-Agent: StGit/0.23 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org From: NeilBrown When use_ipaddr is not in effect, an auth_unix_ip lookup request from the kernel for an unknown client will be rejected. When it IS in effect, these requests are always granted with the IP address being mapped to a string form of the address, preceded by a '$'. This is inconsistent behaviour and could present a small information leak. It means that, for example, a SETCLIENT NFSv4 request may or may not succeed depending on an internal setting in rpc.mountd. This is easily rectified by always checking if the client is known. Signed-off-by: NeilBrown --- support/export/cache.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) diff --git a/support/export/cache.c b/support/export/cache.c index f1569afb558c..156ebfd4087c 100644 --- a/support/export/cache.c +++ b/support/export/cache.c @@ -114,6 +114,7 @@ static void auth_unix_ip(int f) char class[20]; char ipaddr[INET6_ADDRSTRLEN + 1]; char *client = NULL; + struct addrinfo *ai = NULL; struct addrinfo *tmp = NULL; char buf[RPC_CHAN_BUF_SIZE], *bp; int blen; @@ -139,21 +140,17 @@ static void auth_unix_ip(int f) auth_reload(); - /* addr is a valid, interesting address, find the domain name... */ - if (!use_ipaddr) { - struct addrinfo *ai = NULL; - - ai = client_resolve(tmp->ai_addr); - if (ai) { - client = client_compose(ai); - nfs_freeaddrinfo(ai); - } + /* addr is a valid address, find the domain name... */ + ai = client_resolve(tmp->ai_addr); + if (ai) { + client = client_compose(ai); + nfs_freeaddrinfo(ai); } bp = buf; blen = sizeof(buf); qword_add(&bp, &blen, "nfsd"); qword_add(&bp, &blen, ipaddr); qword_adduint(&bp, &blen, time(0) + DEFAULT_TTL); - if (use_ipaddr) { + if (use_ipaddr && client) { memmove(ipaddr + 1, ipaddr, strlen(ipaddr) + 1); ipaddr[0] = '$'; qword_add(&bp, &blen, ipaddr); From patchwork Thu Feb 25 02:42:47 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: NeilBrown X-Patchwork-Id: 12103137 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 10C70C433E0 for ; Thu, 25 Feb 2021 02:44:20 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id DBCD264ED3 for ; Thu, 25 Feb 2021 02:44:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236805AbhBYCoB (ORCPT ); Wed, 24 Feb 2021 21:44:01 -0500 Received: from mx2.suse.de ([195.135.220.15]:41984 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234384AbhBYCoB (ORCPT ); Wed, 24 Feb 2021 21:44:01 -0500 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.221.27]) by mx2.suse.de (Postfix) with ESMTP id 55655AE7A; Thu, 25 Feb 2021 02:43:19 +0000 (UTC) From: NeilBrown To: Steve Dickson Date: Thu, 25 Feb 2021 13:42:47 +1100 Subject: [PATCH 2/5] mountd: Don't proactively add export info when fh info is requested. Cc: Linux NFS Mailing list Message-ID: <161422096787.28256.6764678456311890448.stgit@noble> In-Reply-To: <161422077024.28256.15543036625096419495.stgit@noble> References: <161422077024.28256.15543036625096419495.stgit@noble> User-Agent: StGit/0.23 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org From: NeilBrown When an "nfsd.fh" request is received from the kernel, we map the file-handle prefix to a path name and report that (as required) and then also add "nfsd.export" information with export flags applicable to that path. This is not necessary and was added as a perceived optimisation. When updating data already in the kernel, it is unlikely to help as the kernel can be expected to ask for both details at much the same time. With NFSv3, new information is normally added by a MOUNT rpc request, so this is irrelevant. With NFSv4, the kernel requests the "nfsd.export" information when walking down from ROOT, *before* requesting the nfsd.fh information, so this "optimisation" causes unnecessary work. A future patch will add logging of authentication requests, and this double-handling would result in extra unnecessary log messages. As this "optimisation" appears to have no practical value and some (small) cost, let's remove it. Signed-off-by: NeilBrown --- support/export/cache.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/support/export/cache.c b/support/export/cache.c index 156ebfd4087c..49a761749ec6 100644 --- a/support/export/cache.c +++ b/support/export/cache.c @@ -96,7 +96,6 @@ static bool path_lookup_error(int err) * Record is terminated with newline. * */ -static int cache_export_ent(char *buf, int buflen, char *domain, struct exportent *exp, char *path); #define INITIAL_MANAGED_GROUPS 100 @@ -870,18 +869,13 @@ static void nfsd_fh(int f) !is_mountpoint(found->e_mountpoint[0]? found->e_mountpoint: found->e_path)) { - /* Cannot export this yet + /* Cannot export this yet * should log a warning, but need to rate limit xlog(L_WARNING, "%s not exported as %d not a mountpoint", found->e_path, found->e_mountpoint); */ /* FIXME we need to make sure we re-visit this later */ goto out; - } else if (cache_export_ent(buf, sizeof(buf), dom, found, found_path) < 0) { - if (!path_lookup_error(errno)) - goto out; - /* The kernel is saying the path is unexportable */ - found = NULL; } bp = buf; blen = sizeof(buf); From patchwork Thu Feb 25 02:42:47 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: NeilBrown X-Patchwork-Id: 12103141 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 254B5C433E9 for ; Thu, 25 Feb 2021 02:44:20 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id F3A046146B for ; Thu, 25 Feb 2021 02:44:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234205AbhBYCoH (ORCPT ); Wed, 24 Feb 2021 21:44:07 -0500 Received: from mx2.suse.de ([195.135.220.15]:41996 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229722AbhBYCoF (ORCPT ); Wed, 24 Feb 2021 21:44:05 -0500 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.221.27]) by mx2.suse.de (Postfix) with ESMTP id 80056AE7F; Thu, 25 Feb 2021 02:43:23 +0000 (UTC) From: NeilBrown To: Steve Dickson Date: Thu, 25 Feb 2021 13:42:47 +1100 Subject: [PATCH 3/5] mountd: add logging for authentication results for accesses. Cc: Linux NFS Mailing list Message-ID: <161422096788.28256.6306810361070404010.stgit@noble> In-Reply-To: <161422077024.28256.15543036625096419495.stgit@noble> References: <161422077024.28256.15543036625096419495.stgit@noble> User-Agent: StGit/0.23 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org From: NeilBrown When NFSv3 is used to mount a filesystem, success/failure messages are logged by mountd and can be used for auditing. When NFSv4 is used, there is no distinct "MOUNT" request, and nothing is logged. We can instead log authentication requests from the kernel. These will happen regularly - typically every 15 minutes of ongoing access - so they may be too noisy, or might be more useful. As they might not be wanted, make them selectable with the "AUTH" facility in xlog(). Add a "-l" to enable these logs. Alternately "debug = auth" will have the same effect. Signed-off-by: NeilBrown --- support/export/cache.c | 18 +++++++++++++++++- utils/mountd/mountd.c | 7 ++++++- utils/mountd/mountd.man | 39 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 62 insertions(+), 2 deletions(-) diff --git a/support/export/cache.c b/support/export/cache.c index 49a761749ec6..50f7c7a15ceb 100644 --- a/support/export/cache.c +++ b/support/export/cache.c @@ -145,6 +145,15 @@ static void auth_unix_ip(int f) client = client_compose(ai); nfs_freeaddrinfo(ai); } + if (!client) + xlog(D_AUTH, "failed authentication for IP %s", ipaddr); + else if (!use_ipaddr) + xlog(D_AUTH, "successful authentication for IP %s as %s", + ipaddr, *client ? client : "DEFAULT"); + else + xlog(D_AUTH, "successful authentication for IP %s", + ipaddr); + bp = buf; blen = sizeof(buf); qword_add(&bp, &blen, "nfsd"); qword_add(&bp, &blen, ipaddr); @@ -896,6 +905,8 @@ static void nfsd_fh(int f) qword_addeol(&bp, &blen); if (blen <= 0 || cache_write(f, buf, bp - buf) != bp - buf) xlog(L_ERROR, "nfsd_fh: error writing reply"); + if (!found) + xlog(D_AUTH, "denied access to %s", *dom == '$' ? dom+1 : dom); out: if (found_path) free(found_path); @@ -987,8 +998,13 @@ static int dump_to_cache(int f, char *buf, int blen, char *domain, qword_add(&bp, &blen, "uuid"); qword_addhex(&bp, &blen, u, 16); } - } else + xlog(D_AUTH, "granted access to %s for %s", + path, *domain == '$' ? domain+1 : domain); + } else { qword_adduint(&bp, &blen, now + ttl); + xlog(D_AUTH, "denied access to %s for %s", + path, *domain == '$' ? domain+1 : domain); + } qword_addeol(&bp, &blen); if (blen <= 0) { errno = ENOBUFS; diff --git a/utils/mountd/mountd.c b/utils/mountd/mountd.c index 612063ba2340..59eddf79fd2e 100644 --- a/utils/mountd/mountd.c +++ b/utils/mountd/mountd.c @@ -74,8 +74,10 @@ static struct option longopts[] = { "reverse-lookup", 0, 0, 'r' }, { "manage-gids", 0, 0, 'g' }, { "no-udp", 0, 0, 'u' }, + { "log-auth", 0, 0, 'l'}, { NULL, 0, 0, 0 } }; +static char shortopts[] = "o:nFd:p:P:hH:N:V:vurs:t:gl"; #define NFSVERSBIT(vers) (0x1 << (vers - 1)) #define NFSVERSBIT_ALL (NFSVERSBIT(2) | NFSVERSBIT(3) | NFSVERSBIT(4)) @@ -727,7 +729,7 @@ main(int argc, char **argv) /* Parse the command line options and arguments. */ opterr = 0; - while ((c = getopt_long(argc, argv, "o:nFd:p:P:hH:N:V:vurs:t:g", longopts, NULL)) != EOF) + while ((c = getopt_long(argc, argv, shortopts, longopts, NULL)) != EOF) switch (c) { case 'g': manage_gids = 1; @@ -798,6 +800,9 @@ main(int argc, char **argv) case 'u': NFSCTL_UDPUNSET(_rpcprotobits); break; + case 'l': + xlog_sconfig("auth", 1); + break; case 0: break; case '?': diff --git a/utils/mountd/mountd.man b/utils/mountd/mountd.man index 9978afcdb4cc..df4e5356cb05 100644 --- a/utils/mountd/mountd.man +++ b/utils/mountd/mountd.man @@ -13,6 +13,8 @@ The .B rpc.mountd daemon implements the server side of the NFS MOUNT protocol, an NFS side protocol used by NFS version 2 [RFC1094] and NFS version 3 [RFC1813]. +It also responds to requests from the Linux kernel to authenticate +clients and provides details of access permissions. .PP An NFS server maintains a table of local physical file systems that are accessible to NFS clients. @@ -78,11 +80,44 @@ A client may continue accessing an export even after invoking UMNT. If the client reboots without sending a UMNT request, stale entries remain for that client in .IR /var/lib/nfs/rmtab . +.SS Mounting File Systems with NFSv4 +Version 4 (and later) of NFS does not use a separate NFS MOUNT +protocol. Instead mounting is performed using regular NFS requests +handled by the NFS server in the Linux kernel +.RI ( nfsd ). +When +.I nfsd +needs to confirm if a client has access to a particular filesystem, it +communicates with +.B rpc.mountd +to authenticate the client and to then determine what access that client +has to a given filesystem. .SH OPTIONS .TP .B \-d kind " or " \-\-debug kind Turn on debugging. Valid kinds are: all, auth, call, general and parse. .TP +.BR \-l " or " \-\-log\-auth +Enable logging of responses to authentication and access requests from +nfsd. Each response is then cached by the kernel for 30 minutes, and +will be refreshed after 15 minutes if the relevant client remains +active. +Note that +.B -l +is equivalent to +.B "-d auth" +and so can be enabled in +.B /etc/nfs.conf +with +.B "\[dq]debug = auth\[dq]" +in the +.B "[mountd]" +section. +.IP +.B rpc.mountd +will always log authentication responses to MOUNT requests when NFSv3 is +used, but to get similar logs for NFSv4, this option is required. +.TP .B \-F " or " \-\-foreground Run in foreground (do not daemonize) .TP @@ -295,5 +330,9 @@ table of clients accessing server's exports RFC 1094 - "NFS: Network File System Protocol Specification" .br RFC 1813 - "NFS Version 3 Protocol Specification" +.br +RFC 7530 - "Network File System (NFS) Version 4 Protocol" +.br +RFC 8881 - "Network File System (NFS) Version 4 Minor Version 1 Protocol" .SH AUTHOR Olaf Kirch, H. J. Lu, G. Allan Morris III, and a host of others. From patchwork Thu Feb 25 02:42:47 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: NeilBrown X-Patchwork-Id: 12103139 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.7 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2DE67C43381 for ; Thu, 25 Feb 2021 02:44:20 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 17CBD64ED1 for ; Thu, 25 Feb 2021 02:44:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234339AbhBYCoM (ORCPT ); Wed, 24 Feb 2021 21:44:12 -0500 Received: from mx2.suse.de ([195.135.220.15]:42012 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229722AbhBYCoJ (ORCPT ); Wed, 24 Feb 2021 21:44:09 -0500 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.221.27]) by mx2.suse.de (Postfix) with ESMTP id B1F41AE71; Thu, 25 Feb 2021 02:43:27 +0000 (UTC) From: NeilBrown To: Steve Dickson Date: Thu, 25 Feb 2021 13:42:47 +1100 Subject: [PATCH 4/5] mountd: add --cache-use-ipaddr option to force use_ipaddr Cc: Linux NFS Mailing list Message-ID: <161422096789.28256.15609412723964905025.stgit@noble> In-Reply-To: <161422077024.28256.15543036625096419495.stgit@noble> References: <161422077024.28256.15543036625096419495.stgit@noble> User-Agent: StGit/0.23 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org From: NeilBrown When logging authentication requests, it can be easier to read the logs if clients are always identified by IP address, not intermediate names like netgroups or subnets. To allow this, add --cache-use-ipaddr or -i which tell mountd to always enable use_ipaddr. Signed-off-by: NeilBrown --- support/export/auth.c | 4 ++++ utils/mountd/mountd.c | 8 +++++++- utils/mountd/mountd.man | 18 ++++++++++++++++++ 3 files changed, 29 insertions(+), 1 deletion(-) diff --git a/support/export/auth.c b/support/export/auth.c index 0bfa77d18469..cea376300d01 100644 --- a/support/export/auth.c +++ b/support/export/auth.c @@ -66,6 +66,10 @@ check_useipaddr(void) int old_use_ipaddr = use_ipaddr; unsigned int len = 0; + if (use_ipaddr > 1) + /* fixed - don't check */ + return; + /* add length of m_hostname + 1 for the comma */ for (clp = clientlist[MCL_NETGROUP]; clp; clp = clp->m_next) len += (strlen(clp->m_hostname) + 1); diff --git a/utils/mountd/mountd.c b/utils/mountd/mountd.c index 59eddf79fd2e..dafcc35ca9c2 100644 --- a/utils/mountd/mountd.c +++ b/utils/mountd/mountd.c @@ -75,9 +75,10 @@ static struct option longopts[] = { "manage-gids", 0, 0, 'g' }, { "no-udp", 0, 0, 'u' }, { "log-auth", 0, 0, 'l'}, + { "cache-use-ipaddr", 0, 0, 'i'}, { NULL, 0, 0, 0 } }; -static char shortopts[] = "o:nFd:p:P:hH:N:V:vurs:t:gl"; +static char shortopts[] = "o:nFd:p:P:hH:N:V:vurs:t:gli"; #define NFSVERSBIT(vers) (0x1 << (vers - 1)) #define NFSVERSBIT_ALL (NFSVERSBIT(2) | NFSVERSBIT(3) | NFSVERSBIT(4)) @@ -681,6 +682,8 @@ read_mountd_conf(char **argv) num_threads = conf_get_num("mountd", "threads", num_threads); reverse_resolve = conf_get_bool("mountd", "reverse-lookup", reverse_resolve); ha_callout_prog = conf_get_str("mountd", "ha-callout"); + if (conf_get_bool("mountd", "cache-use-ipaddr", 0)) + use_ipaddr = 2; s = conf_get_str("mountd", "state-directory-path"); if (s && !state_setup_basedir(argv[0], s)) @@ -803,6 +806,9 @@ main(int argc, char **argv) case 'l': xlog_sconfig("auth", 1); break; + case 'i': + use_ipaddr = 2; + break; case 0: break; case '?': diff --git a/utils/mountd/mountd.man b/utils/mountd/mountd.man index df4e5356cb05..44d237e56110 100644 --- a/utils/mountd/mountd.man +++ b/utils/mountd/mountd.man @@ -118,6 +118,23 @@ section. will always log authentication responses to MOUNT requests when NFSv3 is used, but to get similar logs for NFSv4, this option is required. .TP +.BR \-i " or " \-\-cache\-use\-ipaddr +Normally each client IP address is matched against each host identifier +(name, wildcard, netgroup etc) found in +.B /etc/exports +and a combined identity is formed from all matching identifiers. +Often many clients will map to the same combined identity so performing +this mapping reduces the number of distinct access details that the +kernel needs to store. +Specifying the +.B \-i +option suppresses this mapping so that access to each filesystem is +requested and cached separately for each client IP address. Doing this +can increase the burden of updating the cache slightly, but can make the +log messages produced by the +.B -l +option easier to read. +.TP .B \-F " or " \-\-foreground Run in foreground (do not daemonize) .TP @@ -248,6 +265,7 @@ Values recognized in the .B [mountd] section include .BR manage-gids , +.BR cache\-use\-ipaddr , .BR descriptors , .BR port , .BR threads , From patchwork Thu Feb 25 02:42:47 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: NeilBrown X-Patchwork-Id: 12103143 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 65E7EC433DB for ; Thu, 25 Feb 2021 02:44:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 339D764ECF for ; Thu, 25 Feb 2021 02:44:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234384AbhBYCoW (ORCPT ); Wed, 24 Feb 2021 21:44:22 -0500 Received: from mx2.suse.de ([195.135.220.15]:42032 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229722AbhBYCoU (ORCPT ); Wed, 24 Feb 2021 21:44:20 -0500 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.221.27]) by mx2.suse.de (Postfix) with ESMTP id CD181AE84; Thu, 25 Feb 2021 02:43:31 +0000 (UTC) From: NeilBrown To: Steve Dickson Date: Thu, 25 Feb 2021 13:42:47 +1100 Subject: [PATCH 5/5] mountd: make default ttl settable by option Cc: Linux NFS Mailing list Message-ID: <161422096790.28256.1355829309363969536.stgit@noble> In-Reply-To: <161422077024.28256.15543036625096419495.stgit@noble> References: <161422077024.28256.15543036625096419495.stgit@noble> User-Agent: StGit/0.23 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org From: NeilBrown The DEFAULT_TTL affects the rate at which authentication messages are logged. So it is useful to make it settable. Add "-ttl" and "-T", and add clear statement in the documentation of both the benefits and the possible negative effects of choosing a larger value Signed-off-by: NeilBrown --- support/export/cache.c | 6 +++--- support/export/v4root.c | 3 ++- support/include/exportfs.h | 3 ++- support/nfs/exports.c | 4 +++- utils/mountd/mountd.c | 18 +++++++++++++++++- utils/mountd/mountd.man | 19 ++++++++++++++++--- 6 files changed, 43 insertions(+), 10 deletions(-) diff --git a/support/export/cache.c b/support/export/cache.c index 50f7c7a15ceb..c0848c3e437b 100644 --- a/support/export/cache.c +++ b/support/export/cache.c @@ -157,7 +157,7 @@ static void auth_unix_ip(int f) bp = buf; blen = sizeof(buf); qword_add(&bp, &blen, "nfsd"); qword_add(&bp, &blen, ipaddr); - qword_adduint(&bp, &blen, time(0) + DEFAULT_TTL); + qword_adduint(&bp, &blen, time(0) + default_ttl); if (use_ipaddr && client) { memmove(ipaddr + 1, ipaddr, strlen(ipaddr) + 1); ipaddr[0] = '$'; @@ -230,7 +230,7 @@ static void auth_unix_gid(int f) bp = buf; blen = sizeof(buf); qword_adduint(&bp, &blen, uid); - qword_adduint(&bp, &blen, time(0) + DEFAULT_TTL); + qword_adduint(&bp, &blen, time(0) + default_ttl); if (rv >= 0) { qword_adduint(&bp, &blen, ngroups); for (i=0; im_export; dupexportent(&eep, &pseudo_root.m_export); + eep.e_ttl = default_ttl; eep.e_hostname = curexp->e_hostname; strncpy(eep.e_path, path, sizeof(eep.e_path)-1); if (strcmp(path, "/") != 0) diff --git a/support/include/exportfs.h b/support/include/exportfs.h index daa7e2a06d82..81d137210862 100644 --- a/support/include/exportfs.h +++ b/support/include/exportfs.h @@ -105,7 +105,8 @@ typedef struct mexport { } nfs_export; #define HASH_TABLE_SIZE 1021 -#define DEFAULT_TTL (30 * 60) + +extern int default_ttl; typedef struct _exp_hash_entry { nfs_export * p_first; diff --git a/support/nfs/exports.c b/support/nfs/exports.c index 037febd08d9b..2c8f0752ad9d 100644 --- a/support/nfs/exports.c +++ b/support/nfs/exports.c @@ -47,6 +47,8 @@ struct flav_info flav_map[] = { const int flav_map_size = sizeof(flav_map)/sizeof(flav_map[0]); +int default_ttl = 30 * 60; + static char *efname = NULL; static XFILE *efp = NULL; static int first; @@ -100,7 +102,7 @@ static void init_exportent (struct exportent *ee, int fromkernel) ee->e_nsquids = 0; ee->e_nsqgids = 0; ee->e_uuid = NULL; - ee->e_ttl = DEFAULT_TTL; + ee->e_ttl = default_ttl; } struct exportent * diff --git a/utils/mountd/mountd.c b/utils/mountd/mountd.c index dafcc35ca9c2..22279e9afe48 100644 --- a/utils/mountd/mountd.c +++ b/utils/mountd/mountd.c @@ -76,9 +76,10 @@ static struct option longopts[] = { "no-udp", 0, 0, 'u' }, { "log-auth", 0, 0, 'l'}, { "cache-use-ipaddr", 0, 0, 'i'}, + { "ttl", 1, 0, 'T'}, { NULL, 0, 0, 0 } }; -static char shortopts[] = "o:nFd:p:P:hH:N:V:vurs:t:gli"; +static char shortopts[] = "o:nFd:p:P:hH:N:V:vurs:t:gliT"; #define NFSVERSBIT(vers) (0x1 << (vers - 1)) #define NFSVERSBIT_ALL (NFSVERSBIT(2) | NFSVERSBIT(3) | NFSVERSBIT(4)) @@ -672,6 +673,7 @@ inline static void read_mountd_conf(char **argv) { char *s; + int ttl; conf_init_file(NFS_CONFFILE); @@ -706,6 +708,10 @@ read_mountd_conf(char **argv) else NFSCTL_VERUNSET(nfs_version, vers); } + + ttl = conf_get_num("mountd", "ttl", default_ttl); + if (ttl > 0) + default_ttl = ttl; } int @@ -715,6 +721,7 @@ main(int argc, char **argv) unsigned int listeners = 0; int foreground = 0; int c; + int ttl; struct sigaction sa; struct rlimit rlim; @@ -809,6 +816,15 @@ main(int argc, char **argv) case 'i': use_ipaddr = 2; break; + case 'T': + ttl = atoi(optarg); + if (ttl <= 0) { + fprintf(stderr, "%s: bad ttl number of seconds: %s\n", + argv[0], optarg); + usage(argv[0], 1); + } + default_ttl = ttl; + break; case 0: break; case '?': diff --git a/utils/mountd/mountd.man b/utils/mountd/mountd.man index 44d237e56110..82e07cf221fa 100644 --- a/utils/mountd/mountd.man +++ b/utils/mountd/mountd.man @@ -99,9 +99,10 @@ Turn on debugging. Valid kinds are: all, auth, call, general and parse. .TP .BR \-l " or " \-\-log\-auth Enable logging of responses to authentication and access requests from -nfsd. Each response is then cached by the kernel for 30 minutes, and -will be refreshed after 15 minutes if the relevant client remains -active. +nfsd. Each response is then cached by the kernel for 30 minutes (or as set by +.B \-\-ttl +below), and will be refreshed after 15 minutes (half the ttl time) if +the relevant client remains active. Note that .B -l is equivalent to @@ -135,6 +136,17 @@ log messages produced by the .B -l option easier to read. .TP +.B \-T " or " \-\-ttl +Provide a time-to-live (TTL) for cached information given to the kernel. +The kernel will normally request an update if the information is needed +after half of this time has expired. Increasing the provided number, +which is in seconds, reduces the rate of cache update requests, and this +is particularly noticeable when these requests are logged with +.BR \-l . +However increasing also means that changes to hostname to address +mappings can take longer to be noticed. +The default TTL is 1800 (30 minutes). +.TP .B \-F " or " \-\-foreground Run in foreground (do not daemonize) .TP @@ -269,6 +281,7 @@ section include .BR descriptors , .BR port , .BR threads , +.BR ttl , .BR reverse-lookup ", and" .BR state-directory-path , .B ha-callout