From patchwork Mon Mar 1 02:17:15 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: NeilBrown X-Patchwork-Id: 12108651 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9125BC433E0 for ; Mon, 1 Mar 2021 02:18:38 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 5D88964E20 for ; Mon, 1 Mar 2021 02:18:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231804AbhCACSZ (ORCPT ); Sun, 28 Feb 2021 21:18:25 -0500 Received: from mx2.suse.de ([195.135.220.15]:58470 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231802AbhCACSY (ORCPT ); Sun, 28 Feb 2021 21:18:24 -0500 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.221.27]) by mx2.suse.de (Postfix) with ESMTP id BC4D1AE65; Mon, 1 Mar 2021 02:17:43 +0000 (UTC) From: NeilBrown To: Steve Dickson Date: Mon, 01 Mar 2021 13:17:15 +1100 Subject: [PATCH 1/5] mountd: reject unknown client IP when !use_ipaddr. Cc: Linux NFS Mailing list Message-ID: <161456503507.22801.16112597025827774254.stgit@noble> In-Reply-To: <161456493684.22801.323431390819102360.stgit@noble> References: <161456493684.22801.323431390819102360.stgit@noble> User-Agent: StGit/0.23 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org From: NeilBrown When use_ipaddr is not in effect, an auth_unix_ip lookup request from the kernel for an unknown client will be rejected. When it IS in effect, these requests are always granted with the IP address being mapped to a string form of the address, preceded by a '$'. This is inconsistent behaviour and could present a small information leak. It means that, for example, a SETCLIENT NFSv4 request may or may not succeed depending on an internal setting in rpc.mountd. This is easily rectified by always checking if the client is known. Signed-off-by: NeilBrown --- support/export/cache.c | 17 +++++++---------- 1 file changed, 7 insertions(+), 10 deletions(-) diff --git a/support/export/cache.c b/support/export/cache.c index f1569afb558c..156ebfd4087c 100644 --- a/support/export/cache.c +++ b/support/export/cache.c @@ -114,6 +114,7 @@ static void auth_unix_ip(int f) char class[20]; char ipaddr[INET6_ADDRSTRLEN + 1]; char *client = NULL; + struct addrinfo *ai = NULL; struct addrinfo *tmp = NULL; char buf[RPC_CHAN_BUF_SIZE], *bp; int blen; @@ -139,21 +140,17 @@ static void auth_unix_ip(int f) auth_reload(); - /* addr is a valid, interesting address, find the domain name... */ - if (!use_ipaddr) { - struct addrinfo *ai = NULL; - - ai = client_resolve(tmp->ai_addr); - if (ai) { - client = client_compose(ai); - nfs_freeaddrinfo(ai); - } + /* addr is a valid address, find the domain name... */ + ai = client_resolve(tmp->ai_addr); + if (ai) { + client = client_compose(ai); + nfs_freeaddrinfo(ai); } bp = buf; blen = sizeof(buf); qword_add(&bp, &blen, "nfsd"); qword_add(&bp, &blen, ipaddr); qword_adduint(&bp, &blen, time(0) + DEFAULT_TTL); - if (use_ipaddr) { + if (use_ipaddr && client) { memmove(ipaddr + 1, ipaddr, strlen(ipaddr) + 1); ipaddr[0] = '$'; qword_add(&bp, &blen, ipaddr); From patchwork Mon Mar 1 02:17:15 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: NeilBrown X-Patchwork-Id: 12108653 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C2987C433E6 for ; Mon, 1 Mar 2021 02:18:38 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 7EA2164DF5 for ; Mon, 1 Mar 2021 02:18:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231806AbhCACSa (ORCPT ); Sun, 28 Feb 2021 21:18:30 -0500 Received: from mx2.suse.de ([195.135.220.15]:58482 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231802AbhCACS3 (ORCPT ); Sun, 28 Feb 2021 21:18:29 -0500 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.221.27]) by mx2.suse.de (Postfix) with ESMTP id E73D5AF77; Mon, 1 Mar 2021 02:17:47 +0000 (UTC) From: NeilBrown To: Steve Dickson Date: Mon, 01 Mar 2021 13:17:15 +1100 Subject: [PATCH 2/5] mountd: Don't proactively add export info when fh info is requested. Cc: Linux NFS Mailing list Message-ID: <161456503508.22801.10952444290383474947.stgit@noble> In-Reply-To: <161456493684.22801.323431390819102360.stgit@noble> References: <161456493684.22801.323431390819102360.stgit@noble> User-Agent: StGit/0.23 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org From: NeilBrown When an "nfsd.fh" request is received from the kernel, we map the file-handle prefix to a path name and report that (as required) and then also add "nfsd.export" information with export flags applicable to that path. This is not necessary and was added as a perceived optimisation. When updating data already in the kernel, it is unlikely to help as the kernel can be expected to ask for both details at much the same time. With NFSv3, new information is normally added by a MOUNT rpc request, so this is irrelevant. With NFSv4, the kernel requests the "nfsd.export" information when walking down from ROOT, *before* requesting the nfsd.fh information, so this "optimisation" causes unnecessary work. A future patch will add logging of authentication requests, and this double-handling would result in extra unnecessary log messages. As this "optimisation" appears to have no practical value and some (small) cost, let's remove it. Signed-off-by: NeilBrown --- support/export/cache.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/support/export/cache.c b/support/export/cache.c index 156ebfd4087c..49a761749ec6 100644 --- a/support/export/cache.c +++ b/support/export/cache.c @@ -96,7 +96,6 @@ static bool path_lookup_error(int err) * Record is terminated with newline. * */ -static int cache_export_ent(char *buf, int buflen, char *domain, struct exportent *exp, char *path); #define INITIAL_MANAGED_GROUPS 100 @@ -870,18 +869,13 @@ static void nfsd_fh(int f) !is_mountpoint(found->e_mountpoint[0]? found->e_mountpoint: found->e_path)) { - /* Cannot export this yet + /* Cannot export this yet * should log a warning, but need to rate limit xlog(L_WARNING, "%s not exported as %d not a mountpoint", found->e_path, found->e_mountpoint); */ /* FIXME we need to make sure we re-visit this later */ goto out; - } else if (cache_export_ent(buf, sizeof(buf), dom, found, found_path) < 0) { - if (!path_lookup_error(errno)) - goto out; - /* The kernel is saying the path is unexportable */ - found = NULL; } bp = buf; blen = sizeof(buf); From patchwork Mon Mar 1 02:17:15 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: NeilBrown X-Patchwork-Id: 12108657 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id CEF7CC433E9 for ; Mon, 1 Mar 2021 02:18:38 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9F12D64E10 for ; Mon, 1 Mar 2021 02:18:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231815AbhCACSg (ORCPT ); Sun, 28 Feb 2021 21:18:36 -0500 Received: from mx2.suse.de ([195.135.220.15]:58494 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231802AbhCACSe (ORCPT ); Sun, 28 Feb 2021 21:18:34 -0500 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.221.27]) by mx2.suse.de (Postfix) with ESMTP id 1DF1FAF7E; Mon, 1 Mar 2021 02:17:52 +0000 (UTC) From: NeilBrown To: Steve Dickson Date: Mon, 01 Mar 2021 13:17:15 +1100 Subject: [PATCH 3/5] mountd: add logging for authentication results for accesses. Cc: Linux NFS Mailing list Message-ID: <161456503509.22801.10248959706273331431.stgit@noble> In-Reply-To: <161456493684.22801.323431390819102360.stgit@noble> References: <161456493684.22801.323431390819102360.stgit@noble> User-Agent: StGit/0.23 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org From: NeilBrown When NFSv3 is used to mount a filesystem, success/failure messages are logged by mountd and can be used for auditing. When NFSv4 is used, there is no distinct "MOUNT" request, and nothing is logged. We can instead log authentication requests from the kernel. These will happen regularly - typically every 15 minutes of ongoing access - so they may be too noisy, or might be more useful. As they might not be wanted, make them selectable with the "AUTH" facility in xlog(). Add a "-l" to enable these logs. Alternately "debug = auth" will have the same effect. Signed-off-by: NeilBrown --- support/export/cache.c | 18 +++++++++++++++++- utils/mountd/mountd.c | 8 +++++++- utils/mountd/mountd.man | 39 +++++++++++++++++++++++++++++++++++++++ 3 files changed, 63 insertions(+), 2 deletions(-) diff --git a/support/export/cache.c b/support/export/cache.c index 49a761749ec6..50f7c7a15ceb 100644 --- a/support/export/cache.c +++ b/support/export/cache.c @@ -145,6 +145,15 @@ static void auth_unix_ip(int f) client = client_compose(ai); nfs_freeaddrinfo(ai); } + if (!client) + xlog(D_AUTH, "failed authentication for IP %s", ipaddr); + else if (!use_ipaddr) + xlog(D_AUTH, "successful authentication for IP %s as %s", + ipaddr, *client ? client : "DEFAULT"); + else + xlog(D_AUTH, "successful authentication for IP %s", + ipaddr); + bp = buf; blen = sizeof(buf); qword_add(&bp, &blen, "nfsd"); qword_add(&bp, &blen, ipaddr); @@ -896,6 +905,8 @@ static void nfsd_fh(int f) qword_addeol(&bp, &blen); if (blen <= 0 || cache_write(f, buf, bp - buf) != bp - buf) xlog(L_ERROR, "nfsd_fh: error writing reply"); + if (!found) + xlog(D_AUTH, "denied access to %s", *dom == '$' ? dom+1 : dom); out: if (found_path) free(found_path); @@ -987,8 +998,13 @@ static int dump_to_cache(int f, char *buf, int blen, char *domain, qword_add(&bp, &blen, "uuid"); qword_addhex(&bp, &blen, u, 16); } - } else + xlog(D_AUTH, "granted access to %s for %s", + path, *domain == '$' ? domain+1 : domain); + } else { qword_adduint(&bp, &blen, now + ttl); + xlog(D_AUTH, "denied access to %s for %s", + path, *domain == '$' ? domain+1 : domain); + } qword_addeol(&bp, &blen); if (blen <= 0) { errno = ENOBUFS; diff --git a/utils/mountd/mountd.c b/utils/mountd/mountd.c index 612063ba2340..9fecf2f04c3b 100644 --- a/utils/mountd/mountd.c +++ b/utils/mountd/mountd.c @@ -74,8 +74,10 @@ static struct option longopts[] = { "reverse-lookup", 0, 0, 'r' }, { "manage-gids", 0, 0, 'g' }, { "no-udp", 0, 0, 'u' }, + { "log-auth", 0, 0, 'l'}, { NULL, 0, 0, 0 } }; +static char shortopts[] = "o:nFd:p:P:hH:N:V:vurs:t:gl"; #define NFSVERSBIT(vers) (0x1 << (vers - 1)) #define NFSVERSBIT_ALL (NFSVERSBIT(2) | NFSVERSBIT(3) | NFSVERSBIT(4)) @@ -727,7 +729,7 @@ main(int argc, char **argv) /* Parse the command line options and arguments. */ opterr = 0; - while ((c = getopt_long(argc, argv, "o:nFd:p:P:hH:N:V:vurs:t:g", longopts, NULL)) != EOF) + while ((c = getopt_long(argc, argv, shortopts, longopts, NULL)) != EOF) switch (c) { case 'g': manage_gids = 1; @@ -798,6 +800,9 @@ main(int argc, char **argv) case 'u': NFSCTL_UDPUNSET(_rpcprotobits); break; + case 'l': + xlog_sconfig("auth", 1); + break; case 0: break; case '?': @@ -913,6 +918,7 @@ usage(const char *prog, int n) { fprintf(stderr, "Usage: %s [-F|--foreground] [-h|--help] [-v|--version] [-d kind|--debug kind]\n" +" [-l|--log-auth]\n" " [-o num|--descriptors num]\n" " [-p|--port port] [-V version|--nfs-version version]\n" " [-N version|--no-nfs-version version] [-n|--no-tcp]\n" diff --git a/utils/mountd/mountd.man b/utils/mountd/mountd.man index 9978afcdb4cc..df4e5356cb05 100644 --- a/utils/mountd/mountd.man +++ b/utils/mountd/mountd.man @@ -13,6 +13,8 @@ The .B rpc.mountd daemon implements the server side of the NFS MOUNT protocol, an NFS side protocol used by NFS version 2 [RFC1094] and NFS version 3 [RFC1813]. +It also responds to requests from the Linux kernel to authenticate +clients and provides details of access permissions. .PP An NFS server maintains a table of local physical file systems that are accessible to NFS clients. @@ -78,11 +80,44 @@ A client may continue accessing an export even after invoking UMNT. If the client reboots without sending a UMNT request, stale entries remain for that client in .IR /var/lib/nfs/rmtab . +.SS Mounting File Systems with NFSv4 +Version 4 (and later) of NFS does not use a separate NFS MOUNT +protocol. Instead mounting is performed using regular NFS requests +handled by the NFS server in the Linux kernel +.RI ( nfsd ). +When +.I nfsd +needs to confirm if a client has access to a particular filesystem, it +communicates with +.B rpc.mountd +to authenticate the client and to then determine what access that client +has to a given filesystem. .SH OPTIONS .TP .B \-d kind " or " \-\-debug kind Turn on debugging. Valid kinds are: all, auth, call, general and parse. .TP +.BR \-l " or " \-\-log\-auth +Enable logging of responses to authentication and access requests from +nfsd. Each response is then cached by the kernel for 30 minutes, and +will be refreshed after 15 minutes if the relevant client remains +active. +Note that +.B -l +is equivalent to +.B "-d auth" +and so can be enabled in +.B /etc/nfs.conf +with +.B "\[dq]debug = auth\[dq]" +in the +.B "[mountd]" +section. +.IP +.B rpc.mountd +will always log authentication responses to MOUNT requests when NFSv3 is +used, but to get similar logs for NFSv4, this option is required. +.TP .B \-F " or " \-\-foreground Run in foreground (do not daemonize) .TP @@ -295,5 +330,9 @@ table of clients accessing server's exports RFC 1094 - "NFS: Network File System Protocol Specification" .br RFC 1813 - "NFS Version 3 Protocol Specification" +.br +RFC 7530 - "Network File System (NFS) Version 4 Protocol" +.br +RFC 8881 - "Network File System (NFS) Version 4 Minor Version 1 Protocol" .SH AUTHOR Olaf Kirch, H. J. Lu, G. Allan Morris III, and a host of others. From patchwork Mon Mar 1 02:17:15 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: NeilBrown X-Patchwork-Id: 12108655 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C6320C43381 for ; Mon, 1 Mar 2021 02:18:39 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9844B64DF5 for ; Mon, 1 Mar 2021 02:18:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231808AbhCACSi (ORCPT ); Sun, 28 Feb 2021 21:18:38 -0500 Received: from mx2.suse.de ([195.135.220.15]:58506 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231802AbhCACSh (ORCPT ); Sun, 28 Feb 2021 21:18:37 -0500 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.221.27]) by mx2.suse.de (Postfix) with ESMTP id 45C0AAF7F; Mon, 1 Mar 2021 02:17:56 +0000 (UTC) From: NeilBrown To: Steve Dickson Date: Mon, 01 Mar 2021 13:17:15 +1100 Subject: [PATCH 4/5] mountd: add --cache-use-ipaddr option to force use_ipaddr Cc: Linux NFS Mailing list Message-ID: <161456503509.22801.5697064120235155947.stgit@noble> In-Reply-To: <161456493684.22801.323431390819102360.stgit@noble> References: <161456493684.22801.323431390819102360.stgit@noble> User-Agent: StGit/0.23 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org From: NeilBrown When logging authentication requests, it can be easier to read the logs if clients are always identified by IP address, not intermediate names like netgroups or subnets. To allow this, add --cache-use-ipaddr or -i which tell mountd to always enable use_ipaddr. Signed-off-by: NeilBrown --- support/export/auth.c | 4 ++++ utils/mountd/mountd.c | 10 ++++++++-- utils/mountd/mountd.man | 18 ++++++++++++++++++ 3 files changed, 30 insertions(+), 2 deletions(-) diff --git a/support/export/auth.c b/support/export/auth.c index 0bfa77d18469..cea376300d01 100644 --- a/support/export/auth.c +++ b/support/export/auth.c @@ -66,6 +66,10 @@ check_useipaddr(void) int old_use_ipaddr = use_ipaddr; unsigned int len = 0; + if (use_ipaddr > 1) + /* fixed - don't check */ + return; + /* add length of m_hostname + 1 for the comma */ for (clp = clientlist[MCL_NETGROUP]; clp; clp = clp->m_next) len += (strlen(clp->m_hostname) + 1); diff --git a/utils/mountd/mountd.c b/utils/mountd/mountd.c index 9fecf2f04c3b..b9260aeb86a3 100644 --- a/utils/mountd/mountd.c +++ b/utils/mountd/mountd.c @@ -75,9 +75,10 @@ static struct option longopts[] = { "manage-gids", 0, 0, 'g' }, { "no-udp", 0, 0, 'u' }, { "log-auth", 0, 0, 'l'}, + { "cache-use-ipaddr", 0, 0, 'i'}, { NULL, 0, 0, 0 } }; -static char shortopts[] = "o:nFd:p:P:hH:N:V:vurs:t:gl"; +static char shortopts[] = "o:nFd:p:P:hH:N:V:vurs:t:gli"; #define NFSVERSBIT(vers) (0x1 << (vers - 1)) #define NFSVERSBIT_ALL (NFSVERSBIT(2) | NFSVERSBIT(3) | NFSVERSBIT(4)) @@ -681,6 +682,8 @@ read_mountd_conf(char **argv) num_threads = conf_get_num("mountd", "threads", num_threads); reverse_resolve = conf_get_bool("mountd", "reverse-lookup", reverse_resolve); ha_callout_prog = conf_get_str("mountd", "ha-callout"); + if (conf_get_bool("mountd", "cache-use-ipaddr", 0)) + use_ipaddr = 2; s = conf_get_str("mountd", "state-directory-path"); if (s && !state_setup_basedir(argv[0], s)) @@ -803,6 +806,9 @@ main(int argc, char **argv) case 'l': xlog_sconfig("auth", 1); break; + case 'i': + use_ipaddr = 2; + break; case 0: break; case '?': @@ -918,7 +924,7 @@ usage(const char *prog, int n) { fprintf(stderr, "Usage: %s [-F|--foreground] [-h|--help] [-v|--version] [-d kind|--debug kind]\n" -" [-l|--log-auth]\n" +" [-l|--log-auth] [-i|--cache-use-ipaddr]\n" " [-o num|--descriptors num]\n" " [-p|--port port] [-V version|--nfs-version version]\n" " [-N version|--no-nfs-version version] [-n|--no-tcp]\n" diff --git a/utils/mountd/mountd.man b/utils/mountd/mountd.man index df4e5356cb05..44d237e56110 100644 --- a/utils/mountd/mountd.man +++ b/utils/mountd/mountd.man @@ -118,6 +118,23 @@ section. will always log authentication responses to MOUNT requests when NFSv3 is used, but to get similar logs for NFSv4, this option is required. .TP +.BR \-i " or " \-\-cache\-use\-ipaddr +Normally each client IP address is matched against each host identifier +(name, wildcard, netgroup etc) found in +.B /etc/exports +and a combined identity is formed from all matching identifiers. +Often many clients will map to the same combined identity so performing +this mapping reduces the number of distinct access details that the +kernel needs to store. +Specifying the +.B \-i +option suppresses this mapping so that access to each filesystem is +requested and cached separately for each client IP address. Doing this +can increase the burden of updating the cache slightly, but can make the +log messages produced by the +.B -l +option easier to read. +.TP .B \-F " or " \-\-foreground Run in foreground (do not daemonize) .TP @@ -248,6 +265,7 @@ Values recognized in the .B [mountd] section include .BR manage-gids , +.BR cache\-use\-ipaddr , .BR descriptors , .BR port , .BR threads , From patchwork Mon Mar 1 02:17:15 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: NeilBrown X-Patchwork-Id: 12108659 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.8 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2DD6FC433E0 for ; Mon, 1 Mar 2021 02:19:08 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id E8A8C64E10 for ; Mon, 1 Mar 2021 02:19:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231811AbhCACTG (ORCPT ); Sun, 28 Feb 2021 21:19:06 -0500 Received: from mx2.suse.de ([195.135.220.15]:58540 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231802AbhCACTE (ORCPT ); Sun, 28 Feb 2021 21:19:04 -0500 X-Virus-Scanned: by amavisd-new at test-mx.suse.de Received: from relay2.suse.de (unknown [195.135.221.27]) by mx2.suse.de (Postfix) with ESMTP id 6C0FEAF84; Mon, 1 Mar 2021 02:18:00 +0000 (UTC) From: NeilBrown To: Steve Dickson Date: Mon, 01 Mar 2021 13:17:15 +1100 Subject: [PATCH 5/5] mountd: make default ttl settable by option Cc: Linux NFS Mailing list Message-ID: <161456503510.22801.14509641806602250672.stgit@noble> In-Reply-To: <161456493684.22801.323431390819102360.stgit@noble> References: <161456493684.22801.323431390819102360.stgit@noble> User-Agent: StGit/0.23 MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org From: NeilBrown The DEFAULT_TTL affects the rate at which authentication messages are logged. So it is useful to make it settable. Add "-ttl" and "-T", and add clear statement in the documentation of both the benefits and the possible negative effects of choosing a larger value Signed-off-by: NeilBrown --- support/export/cache.c | 6 +++--- support/export/v4root.c | 3 ++- support/include/exportfs.h | 3 ++- support/nfs/exports.c | 4 +++- utils/mountd/mountd.c | 20 ++++++++++++++++++-- utils/mountd/mountd.man | 19 ++++++++++++++++--- 6 files changed, 44 insertions(+), 11 deletions(-) diff --git a/support/export/cache.c b/support/export/cache.c index 50f7c7a15ceb..c0848c3e437b 100644 --- a/support/export/cache.c +++ b/support/export/cache.c @@ -157,7 +157,7 @@ static void auth_unix_ip(int f) bp = buf; blen = sizeof(buf); qword_add(&bp, &blen, "nfsd"); qword_add(&bp, &blen, ipaddr); - qword_adduint(&bp, &blen, time(0) + DEFAULT_TTL); + qword_adduint(&bp, &blen, time(0) + default_ttl); if (use_ipaddr && client) { memmove(ipaddr + 1, ipaddr, strlen(ipaddr) + 1); ipaddr[0] = '$'; @@ -230,7 +230,7 @@ static void auth_unix_gid(int f) bp = buf; blen = sizeof(buf); qword_adduint(&bp, &blen, uid); - qword_adduint(&bp, &blen, time(0) + DEFAULT_TTL); + qword_adduint(&bp, &blen, time(0) + default_ttl); if (rv >= 0) { qword_adduint(&bp, &blen, ngroups); for (i=0; im_export; dupexportent(&eep, &pseudo_root.m_export); + eep.e_ttl = default_ttl; eep.e_hostname = curexp->e_hostname; strncpy(eep.e_path, path, sizeof(eep.e_path)-1); if (strcmp(path, "/") != 0) diff --git a/support/include/exportfs.h b/support/include/exportfs.h index daa7e2a06d82..81d137210862 100644 --- a/support/include/exportfs.h +++ b/support/include/exportfs.h @@ -105,7 +105,8 @@ typedef struct mexport { } nfs_export; #define HASH_TABLE_SIZE 1021 -#define DEFAULT_TTL (30 * 60) + +extern int default_ttl; typedef struct _exp_hash_entry { nfs_export * p_first; diff --git a/support/nfs/exports.c b/support/nfs/exports.c index 037febd08d9b..2c8f0752ad9d 100644 --- a/support/nfs/exports.c +++ b/support/nfs/exports.c @@ -47,6 +47,8 @@ struct flav_info flav_map[] = { const int flav_map_size = sizeof(flav_map)/sizeof(flav_map[0]); +int default_ttl = 30 * 60; + static char *efname = NULL; static XFILE *efp = NULL; static int first; @@ -100,7 +102,7 @@ static void init_exportent (struct exportent *ee, int fromkernel) ee->e_nsquids = 0; ee->e_nsqgids = 0; ee->e_uuid = NULL; - ee->e_ttl = DEFAULT_TTL; + ee->e_ttl = default_ttl; } struct exportent * diff --git a/utils/mountd/mountd.c b/utils/mountd/mountd.c index b9260aeb86a3..fce389661e7a 100644 --- a/utils/mountd/mountd.c +++ b/utils/mountd/mountd.c @@ -76,9 +76,10 @@ static struct option longopts[] = { "no-udp", 0, 0, 'u' }, { "log-auth", 0, 0, 'l'}, { "cache-use-ipaddr", 0, 0, 'i'}, + { "ttl", 1, 0, 'T'}, { NULL, 0, 0, 0 } }; -static char shortopts[] = "o:nFd:p:P:hH:N:V:vurs:t:gli"; +static char shortopts[] = "o:nFd:p:P:hH:N:V:vurs:t:gliT:"; #define NFSVERSBIT(vers) (0x1 << (vers - 1)) #define NFSVERSBIT_ALL (NFSVERSBIT(2) | NFSVERSBIT(3) | NFSVERSBIT(4)) @@ -672,6 +673,7 @@ inline static void read_mountd_conf(char **argv) { char *s; + int ttl; conf_init_file(NFS_CONFFILE); @@ -706,6 +708,10 @@ read_mountd_conf(char **argv) else NFSCTL_VERUNSET(nfs_version, vers); } + + ttl = conf_get_num("mountd", "ttl", default_ttl); + if (ttl > 0) + default_ttl = ttl; } int @@ -715,6 +721,7 @@ main(int argc, char **argv) unsigned int listeners = 0; int foreground = 0; int c; + int ttl; struct sigaction sa; struct rlimit rlim; @@ -809,6 +816,15 @@ main(int argc, char **argv) case 'i': use_ipaddr = 2; break; + case 'T': + ttl = atoi(optarg); + if (ttl <= 0) { + fprintf(stderr, "%s: bad ttl number of seconds: %s\n", + argv[0], optarg); + usage(argv[0], 1); + } + default_ttl = ttl; + break; case 0: break; case '?': @@ -924,7 +940,7 @@ usage(const char *prog, int n) { fprintf(stderr, "Usage: %s [-F|--foreground] [-h|--help] [-v|--version] [-d kind|--debug kind]\n" -" [-l|--log-auth] [-i|--cache-use-ipaddr]\n" +" [-l|--log-auth] [-i|--cache-use-ipaddr] [-T|--ttl ttl]\n" " [-o num|--descriptors num]\n" " [-p|--port port] [-V version|--nfs-version version]\n" " [-N version|--no-nfs-version version] [-n|--no-tcp]\n" diff --git a/utils/mountd/mountd.man b/utils/mountd/mountd.man index 44d237e56110..82e07cf221fa 100644 --- a/utils/mountd/mountd.man +++ b/utils/mountd/mountd.man @@ -99,9 +99,10 @@ Turn on debugging. Valid kinds are: all, auth, call, general and parse. .TP .BR \-l " or " \-\-log\-auth Enable logging of responses to authentication and access requests from -nfsd. Each response is then cached by the kernel for 30 minutes, and -will be refreshed after 15 minutes if the relevant client remains -active. +nfsd. Each response is then cached by the kernel for 30 minutes (or as set by +.B \-\-ttl +below), and will be refreshed after 15 minutes (half the ttl time) if +the relevant client remains active. Note that .B -l is equivalent to @@ -135,6 +136,17 @@ log messages produced by the .B -l option easier to read. .TP +.B \-T " or " \-\-ttl +Provide a time-to-live (TTL) for cached information given to the kernel. +The kernel will normally request an update if the information is needed +after half of this time has expired. Increasing the provided number, +which is in seconds, reduces the rate of cache update requests, and this +is particularly noticeable when these requests are logged with +.BR \-l . +However increasing also means that changes to hostname to address +mappings can take longer to be noticed. +The default TTL is 1800 (30 minutes). +.TP .B \-F " or " \-\-foreground Run in foreground (do not daemonize) .TP @@ -269,6 +281,7 @@ section include .BR descriptors , .BR port , .BR threads , +.BR ttl , .BR reverse-lookup ", and" .BR state-directory-path , .B ha-callout