Bug 666340

Summary: autofs handle isspace() char incorrectly
Product: Red Hat Enterprise Linux 6 Reporter: John Lau <jlau>
Component: autofsAssignee: Ian Kent <ikent>
Status: CLOSED ERRATA QA Contact: yanfu,wang <yanwang>
Severity: high Docs Contact:
Priority: low    
Version: 6.0CC: ikent, rwheeler
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: autofs-5.0.5-26.el6 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 668354 (view as bug list) Environment:
Last Closed: 2011-05-19 14:22:54 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 668354    
Attachments:
Description Flags
Escape the isspace() char no matter there is space or not
none
Patch - fix isspace() wild card substition none

Description John Lau 2010-12-30 09:13:26 UTC
Created attachment 471158 [details]
Escape the isspace() char no matter there is space or not

Description of problem:
A customer found a strange behaviour of autofs when using &-expand Sun-style map. For example, if I have the following directory in NFS server:

/export/rhel5

And the /etc/exports file is:

/export		*(rw,no_root_squash,sync)

Then we have a /etc/auto.misc file in client:

*		-ro,intr,noacl		127.0.0.1:/export/&

Then I access the autofs and look for a "/misc/rhel5\n" directory (by write a C code and use chdir()), autofs will create a "rhel5\n" directory and mount the "rhel5" directory. What I expect is that it should fail because there is no "rhel5\n" directory.

After I study the code, I found that problem is related to parse_mount() in parse_sun.c. It will:

1. parse_sun.c:1398 use expandsunent function to append the key (directory name) to the dst (mount path). And it will escape all the isspace() char when there is any *space* in the key.
2. parse_sun.c:1659 dequote function will remove the escape code and the return path will be used to mount the nfs.

So if the key (directory name) don't have a space, it will not escape any other isspace() char (\n, \r, \t, etc). And then the mount path will not be processed correctly by dequote function. In my example, it will be trim to be "127.0.0.1:/export/rhel5".

Also if there is a directory like "rhel5\tx86" in the NFS server, it will not be able to mount by autofs successfully because of this bug, while "rhel 5\tx86" will be processed correctly because it has a space.


Version-Release number of selected component (if applicable):
autofs-5.0.5-23.el6 (The same issue also happens on autofs on Fedora 14)

How reproducible:
100%

Steps to Reproduce:
1. Create a "rhel5" directory in a NFS export directory
2. Config autofs to use &-expand Sun-style map
3. Write a C program to access "rhel5\n" directory by chdir()
  
Actual results:
There will be a "rhel5\n" directory in client and it will mount the "rhel5" directory of the server

Expected results:
It will report fail because there is no "rhel5\n" directory

Comment 4 Ian Kent 2011-01-10 11:06:50 UTC
(In reply to comment #0)
> Created attachment 471158 [details]
> Escape the isspace() char no matter there is space or not
> 
> Description of problem:
> A customer found a strange behaviour of autofs when using &-expand Sun-style
> map. For example, if I have the following directory in NFS server:
> 
> /export/rhel5
> 
> And the /etc/exports file is:
> 
> /export  *(rw,no_root_squash,sync)
> 
> Then we have a /etc/auto.misc file in client:
> 
> *  -ro,intr,noacl  127.0.0.1:/export/&
> 
> Then I access the autofs and look for a "/misc/rhel5\n" directory (by write a C
> code and use chdir()), autofs will create a "rhel5\n" directory and mount the
> "rhel5" directory. What I expect is that it should fail because there is no
> "rhel5\n" directory.
> 
> After I study the code, I found that problem is related to parse_mount() in
> parse_sun.c. It will:
> 
> 1. parse_sun.c:1398 use expandsunent function to append the key (directory
> name) to the dst (mount path). And it will escape all the isspace() char when
> there is any *space* in the key.
> 2. parse_sun.c:1659 dequote function will remove the escape code and the return
> path will be used to mount the nfs.
> 
> So if the key (directory name) don't have a space, it will not escape any other
> isspace() char (\n, \r, \t, etc). And then the mount path will not be processed
> correctly by dequote function. In my example, it will be trim to be
> "127.0.0.1:/export/rhel5".
> 
> Also if there is a directory like "rhel5\tx86" in the NFS server, it will not
> be able to mount by autofs successfully because of this bug, while "rhel
> 5\tx86" will be processed correctly because it has a space.

Handling white space and other characters that are considered
map entry segment terminators is a bit of a nightmare in autofs.

So, while I acknowledge this is a bug, I'm not clear on what we
should do about it. Some testing does show that quoting in the
above cases is not working properly but any change that I make
is probably not going to be what you're expecting.

So what exactly is the behaviour you are hoping to see, given
that white space and other map entry segment terminator characters
can't just be placed in a key string without quoting, even if it
was being handled properly?

You may need to skim over the "map entry segment terminator
characters" statement above to start with, if you don't mind,
while we work out where we want to get to with this.

Ian

Comment 5 Ian Kent 2011-01-10 12:51:48 UTC
Created attachment 472578 [details]
Patch - fix isspace() wild card substition

Maybe I'm making this much more complicated than it needs to be.

After re-reading your comments and looking again at the code I
think this patch is more like what you are trying to get at.

Is this more like it?

Comment 6 Ian Kent 2011-01-10 12:55:01 UTC
(In reply to comment #5)
> Created attachment 472578 [details]
> Patch - fix isspace() wild card substition
> 
> Maybe I'm making this much more complicated than it needs to be.
> 
> After re-reading your comments and looking again at the code I
> think this patch is more like what you are trying to get at.
> 
> Is this more like it?

Mmm ... but I think that's not the whole story either.

That const char *keyp will break if we have more than one &
substitution, ;)

Nevertheless this is hopefully on the right track.

Comment 7 Ian Kent 2011-01-11 03:15:33 UTC
(In reply to comment #6)
> (In reply to comment #5)
> > Created attachment 472578 [details]
> > Patch - fix isspace() wild card substition
> > 
> > Maybe I'm making this much more complicated than it needs to be.
> > 
> > After re-reading your comments and looking again at the code I
> > think this patch is more like what you are trying to get at.
> > 
> > Is this more like it?
> 
> Mmm ... but I think that's not the whole story either.
> 
> That const char *keyp will break if we have more than one &
> substitution, ;)
> 
> Nevertheless this is hopefully on the right track.

Mmm ... looking again today I noticed you provided a patch
which is largely the same as what I have posted, sorry I
didn't notice it yesterday. The formatting in my version
is more to my liking so I'll use it instead of yours.

Now, we just need some acks.

Ian

Comment 10 errata-xmlrpc 2011-05-19 14:22:54 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2011-0753.html