nfs: fix host_reliable_addrinfo

According to Neil Brown:

    The point of the word 'reliable' is to check that the name we get
    really does belong to the host in question - ie that both the
    forward and reverse maps agree.

    But the new code doesn't do that check at all.  Rather it simply
    maps the address to a name, then discards the address and maps the
    name back to a list of addresses and uses that list of addresses as
    "where the request came from" for permission checking.

This bug is exploitable via the following scenario and could allow an
attacker access to data that they shouldn't be able to access.

    Suppose you export a filesystem to some subnet or FQDN and also to a
    wildcard or netgroup, and I know the details of this (maybe
    showmount -e tells me) Suppose further that I can get IP packets to
    your server..

    Then I create a reverse mapping for my ipaddress to a domain that I
    own, say "black.hat.org", and a forward mapping from that domain to
    my IP address, and one of your IP addresses.

    Then I try to mount your filesystem.  The IP address gets correctly
    mapped to "black.hat.org" and then mapped to both my IP address and
    your IP address.

    Then you search through all of your exports and find that one of the
    addresses: yours - is allowed to access the filesystem.

    So you create an export based on the addrinfo you have which allows
    my IP address the same access as your IP address.

Fix this by instead using the forward lookup of the hostname just to
verify that the original address is in the list. Then do a numeric
lookup using the address and stick the hostname in the ai_canonname.

Reviewed-by: NeilBrown <neilb@suse.de>
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
libexport.a: fix using bad index for loop at cltsetup()

In cltsetup(), when checking the address, use clp's naddr for index,
instead of  cltarg's naddr, which it's always zero there.

Signed-off-by: Mi Jinlong <mijinlong@cn.fujitsu.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
nfsstat: reorder nfs4 stats for 2.6.39

Signed-off-by: Benny Halevy <benny@tonian.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
manpage: add info about IPv6 configuration to exports(5)

The parts of the exports(5) manpage that discuss IP addressing neglect
IPv6 configuration. Update to include info on how to export to IPv6
subnets and addresses, and add a line demonstrating that to the EXAMPLE
section.

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
nfs-utils: remove possibly false statement from exports.man

A very minor change suggested by J. Bruce Fields <bfields@fieldses.org>
to remove the statement that exporting to a single host or IP address is
the "most common format" - as it probably isn't.

Signed-off-by: James Pearson <james-p@moving-picture.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
manpage: add section on character class matches to exports(5)

Signed-off-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
mountd: prefer explicit subexports over crossmnt parents

If a parent is exported with crossmnt, and if a child is also explicitly
exported, then both exports could potentially produce matches in this
loop; that isn't a bug.

Instead of warning and ignoring the second match we find, we should
instead prefer whichever export is deeper in the tree, so that
children's options can override those of their parents.

Reported-by: Olga Kornievskaia <aglo@citi.umich.edu>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
mountd: gather fsid information into one struct

A large part of nfsd_fh() is concerned with extracting
fsid-type-specific information from the fsid, then matching that
information with information from the export list and the filesystem.

Moving all that information into one struct will allow some further
simplifications.

Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
mountd: move fsidtype-specific code to helpers

Now we can move these big switch statements into helper functions.

Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
mount: improve signal management when locking mtab

As mount.nfs can run setuid it must be careful about how the user can
interact with in.  In particular it needs to ensure it does not
respond badly to any signals that the user might be able to generate.

This is particularly an issue while updating /etc/mtab (when that is
not linked to /proc/mounts).  If the user can generate a signal which
kills mount.nfs while /etc/mtab is locked, then it will leave the file
locked, and could possibly corrupt mtab (particularly if 'ulimit 1'
was previously issued).

Currently lock_mtab does set some handlers for signals, but not
enough.  It arranges for every signal up to (but not including)
SIGCHLD to cause mount.nfs to unlock mdadm promptly exit ... even if
the default behaviour would be to ignore the signal.  SIGALRM is
handled specially, and signals after SIGCHLD are left with their
default behaviour.  This includes for example SIGXFSZ which can be
generated by the user running "ulimit 1".

So: change this so that some signals are left unchanged, SIGALRM is
handled as required, and all signals that the user can generate are
explicitly ignored.

The remainder still cause mount.nfs to print a message, unlock mtab, and
exit.

Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Steve Dickson <steved@redhat.com>
mount.nfs: Don't hard code source and destination

Currently souce and destination parameters should be passed as first and
second paramter while using mount.nfs. This patch allows them to be passed
anywhere while mounting.

Current functionality is
	mount.nfs source destn -o <options>
This patch will allow to do this
	mount.nfs -o <options> source destn
		or
	mount.nfs -o <options> source -o <options> destn

Signed-off-by: Prem Karat <prem.karat@linux.vnet.ibm.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
Do not compile unnecessary files when the libmount code is enable

Signed-off-by: Steve Dickson <steved@redhat.com>
Updated ChangeLog with all the commits of the current release.

Signed-off-by: Steve Dickson <steved@redhat.com>
Release 1.2.4

Signed-off-by: Steve Dickson <steved@redhat.com>
Revert "Release 1.2.4"

This reverts commit 5b1ffc69dc68b355cdc7d02153068f6efef1c9b7.
mount.nfs: Fix for the bug in v1.2.4 that breaks mount.nfs

commit 30ebf047 failed to include these changes that breaks mount.nfs.
mount.nfs will continue to work fine with these changes

Signed-off-by: Steve Dickson <steved@redhat.com>
Re-Release of 1.2.4

Signed-off-by: Steve Dickson <steved@redhat.com>
Add requirement for newer libgssglue for svcgssd -n option

SNAFU.  This came to my attention minutes after 1.2.4 was
released...

Changes in commit d6c1b35c require that gss_acquire_cred()
is now called when the "-n" option is used.  This requires an
updated libgssglue which properly handles name GSS_C_NO_NAME
as input to gss_import_name()/gss_acquire_cred().

Add a requirement for the newer version.

Without the newer libgssglue, when svcgssd is started with "-n"
you will see the error message, "ERROR: GSS-API: error in
gss_acquire_cred(): GSS_S_BAD_NAME (An invalid name was supplied)
- Unknown error"

Signed-off-by: Steve Dickson <steved@redhat.com>
exportfs: closing fd associated with /proc/fs/nfsd/export_features

The fd associated with /proc/fs/nfsd/export_features opened in
get_export_features is not closed.

Acked-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Masatake YAMATO <yamato@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
mount.nfs: Do not segfault because of kernel version

mount.nfs segfaults if kernel version number does not contain
at least 3 components delimited with a dot.

Avoid this by matching up to three unsigned integers inialised
to zero, separated by dots.

A version that does not start with an integer is probably a future
version where the versioning evolved to another scheme.
Return UINT_MAX which is guaranteed to be higher than existing
versions. This would also make it possible to easily identify
versions that do not start with an integer.

Signed-off-by: Luk Claes <luk@debian.org>
Signed-off-by: Steve Dickson <steved@redhat.com>