diff options
| author | Frank Sorenson <sorenson@redhat.com> | 2015-11-02 08:31:29 -0500 |
|---|---|---|
| committer | Steve Dickson <steved@redhat.com> | 2015-11-02 08:55:04 -0500 |
| commit | 9a92ef6f194926904b1289e0ce1daecb42bd5e8b (patch) | |
| tree | b06e6c3272a4722b3ee21cb8475c6d0e03d33ac3 | |
| parent | bbcb9b79fbe77e133fddf921c09dc757947c031b (diff) | |
| download | nfs-utils-9a92ef6f194926904b1289e0ce1daecb42bd5e8b.tar.gz nfs-utils-9a92ef6f194926904b1289e0ce1daecb42bd5e8b.tar.xz nfs-utils-9a92ef6f194926904b1289e0ce1daecb42bd5e8b.zip | |
mountd: fix netgroup lookup for resolvable IP addresses
If a netgroup entry specifies an IP address, and that
IP address can be resolved to a name, mountd will
currently only test whether the canonical name and
any aliases are in the netgroup, and does not test
whether the IP address is in the netgroup (IP
addresses which do not resolve to a name are
already checked against the netgroup).
This patch adds the check to see whether the IP
addresses are in the netgroup.
Signed-off-by: Frank Sorenson <sorenson@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
| -rw-r--r-- | support/export/client.c | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/support/export/client.c b/support/export/client.c index 95156f0..af9e6bb 100644 --- a/support/export/client.c +++ b/support/export/client.c @@ -686,6 +686,21 @@ check_netgroup(const nfs_client *clp, const struct addrinfo *ai) } } + /* check whether the IP itself is in the netgroup */ + for (tmp = (struct addrinfo *)ai ; tmp != NULL ; tmp = tmp->ai_next) { + free(hname); + hname = calloc(INET6_ADDRSTRLEN, 1); + + if (inet_ntop(tmp->ai_family, &(((struct sockaddr_in *)tmp->ai_addr)->sin_addr), hname, INET6_ADDRSTRLEN) != hname) { + xlog(D_GENERAL, " %s: unable to inet_ntop addrinfo %p: %m", __func__, tmp, errno); + goto out; + } + if (innetgr(netgroup, hname, NULL, NULL)) { + match = 1; + goto out; + } + } + /* Okay, strip off the domain (if we have one) */ dot = strchr(hname, '.'); if (dot == NULL) |