| blob | 288faadf85275bb7a965da793411a14f636fc3e6 |
1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
23 */
25 /*
26 * Copyright (c) 1983,1984,1985,1986,1987,1988,1989 AT&T.
27 * All Rights Reserved
28 */
30 #include <sys/param.h>
31 #include <sys/types.h>
32 #include <sys/systm.h>
33 #include <sys/cred.h>
34 #include <sys/buf.h>
35 #include <sys/vfs.h>
36 #include <sys/vfs_opreg.h>
37 #include <sys/vnode.h>
38 #include <sys/uio.h>
39 #include <sys/errno.h>
40 #include <sys/sysmacros.h>
41 #include <sys/statvfs.h>
42 #include <sys/kmem.h>
43 #include <sys/dirent.h>
44 #include <sys/cmn_err.h>
45 #include <sys/debug.h>
46 #include <sys/systeminfo.h>
47 #include <sys/flock.h>
48 #include <sys/pathname.h>
49 #include <sys/nbmlock.h>
50 #include <sys/share.h>
51 #include <sys/atomic.h>
52 #include <sys/policy.h>
53 #include <sys/fem.h>
54 #include <sys/sdt.h>
55 #include <sys/ddi.h>
56 #include <sys/zone.h>
58 #include <fs/fs_reparse.h>
60 #include <rpc/types.h>
61 #include <rpc/auth.h>
62 #include <rpc/rpcsec_gss.h>
63 #include <rpc/svc.h>
65 #include <nfs/nfs.h>
66 #include <nfs/export.h>
67 #include <nfs/nfs_cmd.h>
68 #include <nfs/lm.h>
69 #include <nfs/nfs4.h>
71 #include <sys/strsubr.h>
72 #include <sys/strsun.h>
74 #include <inet/common.h>
75 #include <inet/ip.h>
76 #include <inet/ip6.h>
78 #include <sys/tsol/label.h>
79 #include <sys/tsol/tndb.h>
87 /* End of Tunables */
91 /*
92 * Used to bump the stateid4.seqid value and show changes in the stateid
93 */
94 #define next_stateid(sp) (++(sp)->bits.chgseq)
96 /*
97 * RFS4_MINLEN_ENTRY4: XDR-encoded size of smallest possible dirent.
98 * This is used to return NFS4ERR_TOOSMALL when clients specify
99 * maxcount that isn't large enough to hold the smallest possible
100 * XDR encoded dirent.
101 *
102 * sizeof cookie (8 bytes) +
103 * sizeof name_len (4 bytes) +
104 * sizeof smallest (padded) name (4 bytes) +
105 * sizeof bitmap4_len (12 bytes) + NOTE: we always encode len=2 bm4
106 * sizeof attrlist4_len (4 bytes) +
107 * sizeof next boolean (4 bytes)
108 *
109 * RFS4_MINLEN_RDDIR4: XDR-encoded size of READDIR op reply containing
110 * the smallest possible entry4 (assumes no attrs requested).
111 * sizeof nfsstat4 (4 bytes) +
112 * sizeof verifier4 (8 bytes) +
113 * sizeof entry4list bool (4 bytes) +
114 * sizeof entry4 (36 bytes) +
115 * sizeof eof bool (4 bytes)
116 *
117 * RFS4_MINLEN_RDDIR_BUF: minimum length of buffer server will provide to
118 * VOP_READDIR. Its value is the size of the maximum possible dirent
119 * for solaris. The DIRENT64_RECLEN macro returns the size of dirent
120 * required for a given name length. MAXNAMELEN is the maximum
121 * filename length allowed in Solaris. The first two DIRENT64_RECLEN()
122 * macros are to allow for . and .. entries -- just a minor tweak to try
123 * and guarantee that buffer we give to VOP_READDIR will be large enough
124 * to hold ., .., and the largest possible solaris dirent64.
125 */
126 #define RFS4_MINLEN_ENTRY4 36
127 #define RFS4_MINLEN_RDDIR4 (4 + NFS4_VERIFIER_SIZE + 4 + RFS4_MINLEN_ENTRY4 + 4)
128 #define RFS4_MINLEN_RDDIR_BUF \
129 (DIRENT64_RECLEN(1) + DIRENT64_RECLEN(2) + DIRENT64_RECLEN(MAXNAMELEN))
131 /*
132 * It would be better to pad to 4 bytes since that's what XDR would do,
133 * but the dirents UFS gives us are already padded to 8, so just take
134 * what we're given. Dircount is only a hint anyway. Currently the
135 * solaris kernel is ASCII only, so there's no point in calling the
136 * UTF8 functions.
137 *
138 * dirent64: named padded to provide 8 byte struct alignment
139 * d_ino(8) + d_off(8) + d_reclen(2) + d_name(namelen + null(1) + pad)
140 *
141 * cookie: uint64_t + utf8namelen: uint_t + utf8name padded to 8 bytes
142 *
143 */
144 #define DIRENT64_TO_DIRCOUNT(dp) \
145 (3 * BYTES_PER_XDR_UNIT + DIRENT64_NAMELEN((dp)->d_reclen))
151 u_longlong_t nfs4_srv_caller_id;
154 verifier4 Write4verf;
155 verifier4 Readdir4verf;
250 /*
251 * translation table for attrs
252 */
257 bool_t vfsstat;
258 };
275 /*
276 * NFS4 op dispatch table
277 */
283 };
286 /*
287 * NFS VERSION 4
288 */
290 /* RFS_NULL = 0 */
293 /* UNUSED = 1 */
296 /* UNUSED = 2 */
299 /* OP_ACCESS = 3 */
302 /* OP_CLOSE = 4 */
305 /* OP_COMMIT = 5 */
308 /* OP_CREATE = 6 */
311 /* OP_DELEGPURGE = 7 */
314 /* OP_DELEGRETURN = 8 */
317 /* OP_GETATTR = 9 */
320 /* OP_GETFH = 10 */
323 /* OP_LINK = 11 */
326 /* OP_LOCK = 12 */
329 /* OP_LOCKT = 13 */
332 /* OP_LOCKU = 14 */
335 /* OP_LOOKUP = 15 */
338 /* OP_LOOKUPP = 16 */
341 /* OP_NVERIFY = 17 */
344 /* OP_OPEN = 18 */
347 /* OP_OPENATTR = 19 */
350 /* OP_OPEN_CONFIRM = 20 */
353 /* OP_OPEN_DOWNGRADE = 21 */
356 /* OP_OPEN_PUTFH = 22 */
359 /* OP_PUTPUBFH = 23 */
362 /* OP_PUTROOTFH = 24 */
365 /* OP_READ = 25 */
368 /* OP_READDIR = 26 */
371 /* OP_READLINK = 27 */
374 /* OP_REMOVE = 28 */
377 /* OP_RENAME = 29 */
380 /* OP_RENEW = 30 */
383 /* OP_RESTOREFH = 31 */
386 /* OP_SAVEFH = 32 */
389 /* OP_SECINFO = 33 */
392 /* OP_SETATTR = 34 */
395 /* OP_SETCLIENTID = 35 */
398 /* OP_SETCLIENTID_CONFIRM = 36 */
401 /* OP_VERIFY = 37 */
404 /* OP_WRITE = 38 */
407 /* OP_RELEASE_LOCKOWNER = 39 */
409 };
413 #define OP_ILLEGAL_IDX (rfsv4disp_cnt)
415 #ifdef DEBUG
462 "rfs4_op_illegal"
463 };
464 #endif
472 #ifdef nextdp
473 #undef nextdp
474 #endif
475 #define nextdp(dp) ((struct dirent64 *)((char *)(dp) + (dp)->d_reclen))
485 NULL, NULL
486 };
496 NULL, NULL
497 };
499 int
501 {
502 timespec32_t verf;
507 /*
508 * The following algorithm attempts to find a unique verifier
509 * to be used as the write verifier returned from the server
510 * to the client. It is important that this verifier change
511 * whenever the server reboots. Of secondary importance, it
512 * is important for the verifier to be unique between two
513 * different servers.
514 *
515 * Thus, an attempt is made to use the system hostid and the
516 * current time in seconds when the nfssrv kernel module is
517 * loaded. It is assumed that an NFS server will not be able
518 * to boot and then to reboot in less than a second. If the
519 * hostid has not been set, then the current high resolution
520 * time is used. This will ensure different verifiers each
521 * time the server reboots and minimize the chances that two
522 * different servers will have the same verifier.
523 * XXX - this is broken on LP64 kernels.
524 */
529 timespec_t tverf;
534 }
541 /* Used to manage create/destroy of server state */
544 /* Used to manage access to server instance linked list */
547 /* Used to manage access to rfs4_deleg_policy */
559 }
560 }
569 }
571 void
573 {
579 }
587 }
589 void
591 {
598 }
600 void
602 {
607 }
609 /*
610 * returns true if the instance's grace period has never been started
611 */
612 int
614 {
622 }
624 /*
625 * Indicates if server instance is within the
626 * grace period.
627 */
628 int
630 {
638 }
640 int
642 {
646 }
648 /*
649 * reset all currently active grace periods
650 */
651 void
653 {
661 }
663 /*
664 * start any new instances' grace periods
665 */
666 void
668 {
676 }
680 {
686 /*
687 * Take a copy of the string, since the original may be overwritten.
688 * Sadly, no strdup() in the kernel.
689 */
690 /* allow for NUL */
695 /* associate with servinst */
699 /*
700 * Add to list of served paths.
701 * No locking required, as we're only ever called at startup.
702 */
704 /* this is the first dss_path_t */
706 /* needed for insque/remque */
712 }
715 }
717 /*
718 * Create a new server instance, and make it the currently active instance.
719 * Note that starting the grace period too early will reduce the clients'
720 * recovery window.
721 */
722 void
724 {
738 /*
739 * This initial dummy entry is required to setup for insque/remque.
740 * It must be skipped over whenever the list is traversed.
741 */
743 /* insque/remque require initial list entry to be self-terminated */
755 }
759 /* add to linked list */
762 }
765 /* make the new instance "current" */
769 }
771 /*
772 * In future, we might add a rfs4_servinst_destroy(sip) but, for now, destroy
773 * all instances directly.
774 */
775 void
777 {
779 #ifdef DEBUG
781 #endif
796 #ifdef DEBUG
797 n++;
798 #endif
799 }
801 }
803 /*
804 * Assign the current server instance to a client_t.
805 * Should be called with cp->rc_dbe held.
806 */
807 void
809 {
812 /*
813 * The lock ensures that if the current instance is in the process
814 * of changing, we will see the new one.
815 */
819 }
821 rfs4_servinst_t *
823 {
827 }
829 /* ARGSUSED */
830 static void
832 {
833 }
835 /*
836 * This is a fall-through for invalid or not implemented (yet) ops
837 */
838 /* ARGSUSED */
839 static void
842 {
844 }
846 /*
847 * Check if the security flavor, nfsnum, is in the flavor_list.
848 */
849 bool_t
851 {
857 }
859 }
861 /*
862 * Used by rfs4_op_secinfo to get the security information from the
863 * export structure associated with the component.
864 */
865 /* ARGSUSED */
866 static nfsstat4
868 {
872 fid_t fid;
883 /*
884 * If dotdotting, then need to check whether it's above the
885 * root of a filesystem, or above an export point.
886 */
889 /*
890 * If dotdotting at the root of a filesystem, then
891 * need to traverse back to the mounted-on filesystem
892 * and do the dotdot lookup there.
893 */
896 /*
897 * If at the system root, then can
898 * go up no further.
899 */
903 /*
904 * Traverse back to the mounted-on filesystem
905 */
908 /*
909 * Set the different_export flag so we remember
910 * to pick up a new exportinfo entry for
911 * this new filesystem.
912 */
916 /*
917 * If dotdotting above an export point then set
918 * the different_export to get new export info.
919 */
921 }
922 }
924 /*
925 * Get the vnode for the component "nm".
926 */
932 /*
933 * If the vnode is in a pseudo filesystem, or if the security flavor
934 * used in the request is valid but not an explicitly shared flavor,
935 * or the access bit indicates that this is a limited access,
936 * check whether this vnode is visible.
937 */
944 }
945 }
947 /*
948 * If it's a mountpoint, then traverse it.
949 */
955 }
956 /* remember that we had to traverse mountpoint */
961 /*
962 * If vp isn't a mountpoint and the vfs ptrs aren't the same,
963 * then vp is probably an LOFS object. We don't need the
964 * realvp, we just need to know that we might have crossed
965 * a server fs boundary and need to call checkexport4.
966 * (LOFS lookup hides server fs mountpoints, and actually calls
967 * traverse)
968 */
970 }
972 /*
973 * Get the export information for it.
974 */
983 }
987 else
992 /*
993 * If this vnode is a mounted-on vnode,
994 * but the mounted-on file system is not
995 * exported, send back the secinfo for
996 * the exported node that the mounted-on
997 * vnode lives in.
998 */
1003 }
1004 }
1007 }
1011 /*
1012 * Create the secinfo result based on the security information
1013 * from the exportinfo structure (exi).
1014 *
1015 * Return all flavors for a pseudo node.
1016 * For a real export node, return the flavor that the client
1017 * has access with.
1018 */
1035 /* get oid opaque data */
1044 }
1045 }
1056 /* find out which flavors to return */
1069 ret_cnt++;
1070 }
1071 }
1073 /* Create the returning SECINFO value */
1077 /*
1078 * If the flavor is in the flavor list,
1079 * fill in resok_val.
1080 */
1093 /* get oid opaque data */
1098 KM_SLEEP);
1102 }
1103 k++;
1104 }
1107 }
1111 }
1115 }
1117 /*
1118 * SECINFO (Operation 33): Obtain required security information on
1119 * the component name in the format of (security-mechanism-oid, qop, service)
1120 * triplets.
1121 */
1122 /* ARGSUSED */
1123 static void
1126 {
1130 uint_t len;
1138 /*
1139 * Current file handle (cfh) should have been set before getting
1140 * into this function. If not, return error.
1141 */
1145 }
1150 }
1152 /*
1153 * Verify the component name. If failed, error out, but
1154 * do not error out if the component name is a "..".
1155 * SECINFO will return its parents secinfo data for SECINFO "..".
1156 */
1163 }
1164 }
1170 }
1176 }
1186 }
1195 out:
1198 }
1200 /*
1201 * Free SECINFO result.
1202 */
1203 /* ARGSUSED */
1204 static void
1206 {
1211 /* If this is not an Ok result, nothing to free. */
1214 }
1226 }
1227 }
1231 }
1233 /* ARGSUSED */
1234 static void
1237 {
1247 boolean_t admin_low_client;
1256 }
1257 #endif
1261 }
1267 /*
1268 * If the file system is exported read only, it is not appropriate
1269 * to check write permissions for regular files and directories.
1270 * Special files are interpreted by the client, so the underlying
1271 * permissions are sent back to the client for interpretation.
1272 */
1276 else
1279 /*
1280 * XXX
1281 * We need the mode so that we can correctly determine access
1282 * permissions relative to a mandatory lock file. Access to
1283 * mandatory lock files is denied on the server, so it might
1284 * as well be reflected to the server during the open.
1285 */
1291 }
1305 }
1314 }
1323 }
1330 }
1340 }
1349 }
1357 }
1363 out:
1366 }
1368 /* ARGSUSED */
1369 static void
1372 {
1378 vattr_t va;
1386 }
1390 }
1395 }
1400 /*
1401 * If we can't get the attributes, then we can't do the
1402 * right access checking. So, we'll fail the request.
1403 */
1407 }
1411 }
1416 else
1420 }
1426 }
1433 }
1437 out:
1440 }
1442 /*
1443 * rfs4_op_mknod is called from rfs4_op_create after all initial verification
1444 * was completed. It does the nfsv4 create for special files.
1445 */
1446 /* ARGSUSED */
1450 {
1464 }
1467 else
1482 }
1484 /*
1485 * Must specify the mode.
1486 */
1490 }
1500 }
1502 }
1504 /*
1505 * nfsv4 create is used to create non-regular files. For regular files,
1506 * use nfsv4 open.
1507 */
1508 /* ARGSUSED */
1509 static void
1512 {
1527 nfsstat4 status;
1540 }
1542 /*
1543 * If there is an unshared filesystem mounted on this vnode,
1544 * do not allow to create an object in this directory.
1545 */
1549 }
1551 /* Verify that type is correct */
1563 };
1568 }
1572 }
1576 }
1581 }
1583 /*
1584 * Name of newly created object
1585 */
1590 }
1596 }
1606 }
1628 }
1630 /* Get "before" change value */
1641 }
1646 /*
1647 * Set the default initial values for attributes when the parent
1648 * directory does not have the VSUID/VSGID bit set and they have
1649 * not been specified in createattrs.
1650 */
1654 }
1658 }
1667 }
1672 /*
1673 * Get the initial "after" sequence number, if it fails,
1674 * set to zero
1675 */
1685 }
1687 /*
1688 * symlink names must be treated as data
1689 */
1700 }
1711 }
1725 }
1734 /*
1735 * Get the initial "after" sequence number, if it fails,
1736 * set to zero
1737 */
1747 /*
1748 * va_seq is not safe over VOP calls, check it again
1749 * if it has changed zero out iva to force atomic = FALSE.
1750 */
1757 /*
1758 * probably a special file.
1759 */
1763 }
1765 /*
1766 * We know this will only generate one VOP call
1767 */
1777 }
1779 /*
1780 * Get the initial "after" sequence number, if it fails,
1781 * set to zero
1782 */
1788 }
1795 }
1797 /*
1798 * Force modified data and metadata out to stable storage.
1799 */
1808 }
1810 /*
1811 * Finish setup of cinfo response, "before" value already set.
1812 * Get "after" change value, if it fails, simply return the
1813 * before value.
1814 */
1819 }
1822 /*
1823 * True verification that object was created with correct
1824 * attrs is impossible. The attrs could have been changed
1825 * immediately after object creation. If attributes did
1826 * not verify, the only recourse for the server is to
1827 * destroy the object. Maybe if some attrs (like gid)
1828 * are set incorrectly, the object should be destroyed;
1829 * however, seems bad as a default policy. Do we really
1830 * want to destroy an object over one of the times not
1831 * verifying correctly? For these reasons, the server
1832 * currently sets bits in attrset for createattrs
1833 * that were set; however, no verification is done.
1834 *
1835 * vmask_to_nmask accounts for vattr bits set on create
1836 * [do_rfs4_set_attrs() only sets resp bits for
1837 * non-vattr/vfs bits.]
1838 * Mask off any bits set by default so as not to return
1839 * more attrset bits than were requested in createattrs
1840 */
1848 }
1850 /*
1851 * The cinfo.atomic = TRUE only if we got no errors, we have
1852 * non-zero va_seq's, and it has incremented by exactly one
1853 * during the creation and it didn't change during the VOP_LOOKUP
1854 * or VOP_FSYNC.
1855 */
1859 else
1862 /*
1863 * Force modified metadata out to stable storage.
1864 *
1865 * if a underlying vp exists, pass it to VOP_FSYNC
1866 */
1869 else
1875 }
1881 out:
1884 }
1886 /*ARGSUSED*/
1887 static void
1890 {
1898 }
1900 /*ARGSUSED*/
1901 static void
1904 {
1908 nfsstat4 status;
1918 /* Ensure specified filehandle matches */
1927 out:
1930 }
1932 /*
1933 * Check to see if a given "flavor" is an explicitly shared flavor.
1934 * The assumption of this routine is the "flavor" is already a valid
1935 * flavor in the secinfo list of "exi".
1936 *
1937 * e.g.
1938 * # share -o sec=flavor1 /export
1939 * # share -o sec=flavor2 /export/home
1940 *
1941 * flavor2 is not an explicitly shared flavor for /export,
1942 * however it is in the secinfo list for /export thru the
1943 * server namespace setup.
1944 */
1945 int
1947 {
1956 }
1957 }
1959 /* Should not reach this point based on the assumption */
1961 }
1963 /*
1964 * Check if the security flavor used in the request matches what is
1965 * required at the export point or at the root pseudo node (exi_root).
1966 *
1967 * returns 1 if there's a match or if exported with AUTH_NONE; 0 otherwise.
1968 *
1969 */
1970 static int
1972 {
1976 /*
1977 * Check cs->nfsflavor (from the request) against
1978 * the current export data in cs->exi.
1979 */
1985 }
1988 }
1990 /*
1991 * Check the access authority for the client and return the correct error.
1992 */
1993 nfsstat4
1995 {
1998 /*
1999 * First, check if the security flavor used in the request
2000 * are among the flavors set in the server namespace.
2001 */
2005 }
2019 }
2021 }
2023 /*
2024 * bitmap4_to_attrmask is called by getattr and readdir.
2025 * It sets up the vattr mask and determines whether vfsstat call is needed
2026 * based on the input bitmap.
2027 * Returns nfsv4 status.
2028 */
2029 static nfsstat4
2031 {
2033 uint_t va_mask;
2043 else
2046 /*
2047 * Set rdattr_error_req to true if return error per
2048 * failed entry rather than fail the readdir.
2049 */
2052 else
2055 /*
2056 * generate the va_mask
2057 * Handle the easy cases first
2058 */
2083 }
2085 /*
2086 * Check is vfsstat is needed
2087 */
2093 }
2094 /* NOTREACHED */
2095 }
2097 /*
2098 * bitmap4_get_sysattrs is called by getattr and readdir.
2099 * It calls both VOP_GETATTR and VFS_STATVFS calls to get the attrs.
2100 * Returns nfsv4 status.
2101 */
2102 static nfsstat4
2104 {
2113 }
2114 }
2117 }
2119 static void
2121 {
2123 KM_SLEEP);
2126 }
2128 static void
2131 {
2136 /*
2137 * XXX Should do the same checks for whether the bit is set
2138 */
2143 }
2145 /*
2146 * xdr_free for getattr will be done later
2147 */
2151 }
2152 }
2154 }
2156 /*
2157 * do_rfs4_op_getattr gets the system attrs and converts into fattr4.
2158 */
2159 static nfsstat4
2162 {
2166 XDR xdr;
2167 ulong_t xdr_size;
2178 /* if no bits requested, then return empty fattr4 */
2183 }
2185 /*
2186 * return NFS4ERR_INVAL when client requests write-only attrs
2187 */
2195 /*
2196 * Now loop to get or verify the attrs
2197 */
2206 /*
2207 * Possible error values:
2208 * >0 if sv_getit failed to
2209 * get the attr; 0 if succeeded;
2210 * <0 if rdattr_error and the
2211 * attribute cannot be returned.
2212 */
2215 /*
2216 * If error then just for entry
2217 */
2223 na++;
2228 }
2230 }
2231 }
2232 }
2234 /*
2235 * If rdattr_error was set after the return value for it was assigned,
2236 * update it.
2237 */
2245 }
2252 }
2254 }
2255 }
2262 }
2266 /* freed by rfs4_op_getattr_free() */
2279 }
2280 }
2284 }
2285 done:
2293 }
2295 /* ARGSUSED */
2296 static void
2299 {
2304 nfsstat4 status;
2312 }
2317 }
2329 /* Is this a referral? */
2331 /* Older V4 Solaris client sees a link */
2334 else
2336 }
2340 }
2341 }
2343 out:
2346 }
2348 static void
2350 {
2354 }
2356 /* ARGSUSED */
2357 static void
2360 {
2368 }
2372 }
2374 /* check for reparse point at the share point */
2376 /* it's all bad */
2382 }
2384 /* check for reparse point at vp */
2386 /* it's not all bad */
2391 }
2397 out:
2400 }
2402 static void
2404 {
2412 }
2413 }
2415 /*
2416 * illegal: args: void
2417 * res : status (NFS4ERR_OP_ILLEGAL)
2418 */
2419 /* ARGSUSED */
2420 static void
2423 {
2428 }
2430 /*
2431 * link: args: SAVED_FH: file, CURRENT_FH: target directory
2432 * res: status. If success - CURRENT_FH unchanged, return change_info
2433 */
2434 /* ARGSUSED */
2435 static void
2438 {
2446 uint_t len;
2453 /* SAVED_FH: source object */
2458 }
2460 /* CURRENT_FH: target directory */
2465 }
2467 /*
2468 * If there is a non-shared filesystem mounted on this vnode,
2469 * do not allow to link any file in this directory.
2470 */
2474 }
2479 }
2481 /* Check source object's type validity */
2485 }
2487 /* Check target directory's type */
2491 }
2496 }
2501 }
2507 }
2513 }
2519 }
2521 /* Get "before" change value */
2528 }
2538 }
2548 /*
2549 * Get the initial "after" sequence number, if it fails, set to zero
2550 */
2555 /*
2556 * Force modified data and metadata out to stable storage.
2557 */
2564 }
2566 /*
2567 * Get "after" change value, if it fails, simply return the
2568 * before value.
2569 */
2574 }
2578 /*
2579 * The cinfo.atomic = TRUE only if we have
2580 * non-zero va_seq's, and it has incremented by exactly one
2581 * during the VOP_LINK and it didn't change during the VOP_FSYNC.
2582 */
2586 else
2590 out:
2593 }
2595 /*
2596 * Used by rfs4_op_lookup and rfs4_op_lookupp to do the actual work.
2597 */
2599 /* ARGSUSED */
2600 static nfsstat4
2602 {
2607 nfsstat4 stat;
2608 fid_t fid;
2618 }
2622 /*
2623 * If dotdotting, then need to check whether it's
2624 * above the root of a filesystem, or above an
2625 * export point.
2626 */
2629 /*
2630 * If dotdotting at the root of a filesystem, then
2631 * need to traverse back to the mounted-on filesystem
2632 * and do the dotdot lookup there.
2633 */
2636 /*
2637 * If at the system root, then can
2638 * go up no further.
2639 */
2643 /*
2644 * Traverse back to the mounted-on filesystem
2645 */
2648 /*
2649 * Set the different_export flag so we remember
2650 * to pick up a new exportinfo entry for
2651 * this new filesystem.
2652 */
2656 /*
2657 * If dotdotting above an export point then set
2658 * the different_export to get new export info.
2659 */
2661 }
2662 }
2669 /*
2670 * If the vnode is in a pseudo filesystem, check whether it is visible.
2671 *
2672 * XXX if the vnode is a symlink and it is not visible in
2673 * a pseudo filesystem, return ENOENT (not following symlink).
2674 * V4 client can not mount such symlink. This is a regression
2675 * from V2/V3.
2676 *
2677 * In the same exported filesystem, if the security flavor used
2678 * is not an explicitly shared flavor, limit the view to the visible
2679 * list entries only. This is not a WRONGSEC case because it's already
2680 * checked via PUTROOTFH/PUTPUBFH or PUTFH.
2681 */
2688 }
2689 }
2691 /*
2692 * If it's a mountpoint, then traverse it.
2693 */
2698 /*
2699 * hold pre_tvp to counteract rele by traverse. We will
2700 * need pre_tvp below if checkexport4 fails
2701 */
2708 }
2712 /*
2713 * The vfsp comparison is to handle the case where
2714 * a LOFS mount is shared. lo_lookup traverses mount points,
2715 * and NFS is unaware of local fs transistions because
2716 * v_vfsmountedhere isn't set. For this special LOFS case,
2717 * the dir and the obj returned by lookup will have different
2718 * vfs ptrs.
2719 */
2721 }
2733 }
2737 else
2742 /*
2743 * If this vnode is a mounted-on vnode,
2744 * but the mounted-on file system is not
2745 * exported, send back the filehandle for
2746 * the mounted-on vnode, not the root of
2747 * the mounted-on file system.
2748 */
2755 }
2757 /* we're done with pre_tvp now. release extra hold */
2759 }
2763 /*
2764 * Now we do a checkauth4. The reason is that
2765 * this client/user may not have access to the new
2766 * exported file system, and if he does,
2767 * the client/user may be mapped to a different uid.
2768 *
2769 * We start with a new cr, because the checkauth4 done
2770 * in the PUT*FH operation over wrote the cred's uid,
2771 * gid, etc, and we want the real thing before calling
2772 * checkauth4()
2773 */
2786 }
2787 }
2789 /*
2790 * After various NFS checks, do a label check on the path
2791 * component. The label on this path should either be the
2792 * global zone's label or a zone's label. We are only
2793 * interested in the zone's label because exported files
2794 * in global zone is accessible (though read-only) to
2795 * clients. The exportability/visibility check is already
2796 * done before reaching this code.
2797 */
2811 }
2813 /*
2814 * We grant access to admin_low label clients
2815 * only if the client is trusted, i.e. also
2816 * running Solaris Trusted Extension.
2817 */
2832 }
2836 SUN_CIPSO) {
2841 }
2843 }
2844 }
2848 err_out:
2856 }
2865 /*
2866 * if did lookup on attrdir and didn't lookup .., set named
2867 * attr fh flag
2868 */
2872 /* Assume false for now, open proc will set this */
2876 }
2878 /* ARGSUSED */
2879 static void
2882 {
2886 uint_t len;
2896 }
2901 }
2906 }
2911 }
2917 }
2923 }
2933 }
2941 out:
2944 }
2946 /* ARGSUSED */
2947 static void
2950 {
2958 }
2963 }
2967 /*
2968 * From NFSV4 Specification, LOOKUPP should not check for
2969 * NFS4ERR_WRONGSEC. Retrun NFS4_OK instead.
2970 */
2973 }
2975 out:
2978 }
2981 /*ARGSUSED2*/
2982 static void
2985 {
2998 }
3004 }
3006 /*
3007 * If file system supports passing ACE mask to VOP_ACCESS then
3008 * check for ACE_READ_NAMED_ATTRS, otherwise do legacy checks
3009 */
3014 else
3022 }
3024 /*
3025 * The CREATE_XATTR_DIR VOP flag cannot be specified if
3026 * the file system is exported read-only -- regardless of
3027 * createdir flag. Otherwise the attrdir would be created
3028 * (assuming server fs isn't mounted readonly locally). If
3029 * VOP_LOOKUP returns ENOENT in this case, the error will
3030 * be translated into EROFS. ENOSYS is mapped to ENOTSUP
3031 * because specfs has no VOP_LOOKUP op, so the macro would
3032 * return ENOSYS. EINVAL is returned by all (current)
3033 * Solaris file system implementations when any of their
3034 * restrictions are violated (xattr(dir) can't have xattrdir).
3035 * Returning NOTSUPP is more appropriate in this case
3036 * because the object will never be able to have an attrdir.
3037 */
3049 else
3052 }
3062 }
3067 /*
3068 * There is no requirement for an attrdir fh flag
3069 * because the attrdir has a vnode flag to distinguish
3070 * it from regular (non-xattr) directories. The
3071 * FH4_ATTRDIR flag is set for future sanity checks.
3072 */
3076 out:
3079 }
3081 static int
3084 {
3091 /*
3092 * Don't block on mandatory locks. If this routine returns
3093 * EAGAIN, the caller should return NFS4ERR_LOCKED.
3094 */
3108 }
3116 }
3117 }
3120 }
3122 /* ARGSUSED */
3123 static void
3126 {
3135 u_offset_t offset;
3137 nfsstat4 stat;
3143 caller_context_t ct;
3153 }
3157 }
3163 }
3165 /*
3166 * Enter the critical region before calling VOP_RWLOCK
3167 * to avoid a deadlock with write requests.
3168 */
3176 }
3177 }
3183 }
3188 /* use loaned buffers for TCP */
3194 /*
3195 * If we can't get the attributes, then we can't do the
3196 * right access checking. So, we'll fail the request.
3197 */
3201 }
3207 }
3214 }
3219 }
3228 /* RDMA */
3235 }
3243 /* RDMA */
3249 }
3251 /*
3252 * Do not allocate memory more than maximum allowed
3253 * transfer size
3254 */
3265 /* Jump to do the read if successful */
3267 /*
3268 * Need to hold the vnode until after VOP_RETZCBUF()
3269 * is called.
3270 */
3273 }
3280 /* failure to setup for zero copy */
3283 }
3285 /*
3286 * If returning data via RDMA Write, then grab the chunk list. If we
3287 * aren't returning READ data w/RDMA_WRITE, then grab a mblk.
3288 */
3293 /*
3294 * mp will contain the data to be sent out in the read reply.
3295 * It will be freed after the reply has been sent. Let's
3296 * roundup the data to a BYTES_PER_XDR_UNIT multiple, so that
3297 * the call to xdrmblk_putmblk() never fails. If the first
3298 * alloc of the requested size fails, then decrease the size to
3299 * something more reasonable and wait for the allocation to
3300 * occur.
3301 */
3308 }
3314 }
3324 doio_read:
3335 }
3337 /* make mblk using zc buffers */
3341 }
3352 }
3358 else
3364 }
3367 }
3369 out:
3375 }
3377 static void
3379 {
3387 }
3388 }
3390 static void
3392 {
3399 }
3400 }
3403 /* ARGSUSED */
3404 static void
3407 {
3419 }
3430 }
3436 }
3439 /*
3440 * No filesystem is actually shared public, so we default
3441 * to exi_root. In this case, we must check whether root
3442 * is exported.
3443 */
3446 /*
3447 * if root filesystem is exported, the exportinfo struct that we
3448 * should use is what checkexport4 returns, because root_exi is
3449 * actually a mostly empty struct.
3450 */
3455 /*
3456 * it's a properly shared filesystem
3457 */
3459 }
3473 NFS4ERR_SERVERFAULT;
3475 }
3476 }
3477 }
3487 }
3490 out:
3493 }
3495 /*
3496 * XXX - issue with put*fh operations. Suppose /export/home is exported.
3497 * Suppose an NFS client goes to mount /export/home/joe. If /export, home,
3498 * or joe have restrictive search permissions, then we shouldn't let
3499 * the client get a file handle. This is easy to enforce. However, we
3500 * don't know what security flavor should be used until we resolve the
3501 * path name. Another complication is uid mapping. If root is
3502 * the user, then it will be mapped to the anonymous user by default,
3503 * but we won't know that till we've resolved the path name. And we won't
3504 * know what the anonymous user is.
3505 * Luckily, SECINFO is specified to take a full filename.
3506 * So what we will have to in rfs4_op_lookup is check that flavor of
3507 * the target object matches that of the request, and if root was the
3508 * caller, check for the root= and anon= options, and if necessary,
3509 * repeat the lookup using the right cred_t. But that's not done yet.
3510 */
3511 /* ARGSUSED */
3512 static void
3515 {
3526 }
3531 }
3537 }
3541 NULL);
3546 }
3555 }
3561 }
3567 out:
3570 }
3572 /* ARGSUSED */
3573 static void
3576 {
3579 fid_t fid;
3587 }
3594 /*
3595 * Using rootdir, the system root vnode,
3596 * get its fid.
3597 */
3604 }
3606 /*
3607 * Then use the root fsid & fid it to find out if it's exported
3608 *
3609 * If the server root isn't exported directly, then
3610 * it should at least be a pseudo export based on
3611 * one or more exports further down in the server's
3612 * file tree.
3613 */
3620 }
3622 /*
3623 * Now make a filehandle based on the root
3624 * export and root vnode.
3625 */
3630 }
3643 }
3647 out:
3650 }
3652 /*
3653 * A directory entry is a valid nfsv4 entry if
3654 * - it has a non-zero ino
3655 * - it is not a dot or dotdot name
3656 * - it is visible in a pseudo export or in a real export that can
3657 * only have a limited view.
3658 */
3659 static bool_t
3662 {
3666 }
3671 }
3674 }
3676 /*
3677 * set_rdattr_params sets up the variables used to manage what information
3678 * to get for each directory entry.
3679 */
3680 static nfsstat4
3683 {
3684 uint_t va_mask;
3685 nfsstat4 status;
3686 bitmap4 objbits;
3690 /*
3691 * could not even figure attr mask
3692 */
3694 }
3697 /*
3698 * dirent's d_ino is always correct value for mounted_on_fileid.
3699 * mntdfid_set is set once here, but mounted_on_fileid is
3700 * set in main dirent processing loop for each dirent.
3701 * The mntdfid_set is a simple optimization that lets the
3702 * server attr code avoid work when caller is readdir.
3703 */
3706 /*
3707 * Lookup entry only if client asked for any of the following:
3708 * a) vattr attrs
3709 * b) vfs attrs
3710 * c) attrs w/per-object scope requested (change, filehandle, etc)
3711 * other than mounted_on_fileid (which we can take from dirent)
3712 */
3717 else
3723 /*
3724 * If filesystem attrs are requested, get them now from the
3725 * directory vp, as most entries will have same filesystem. The only
3726 * exception are mounted over entries but we handle
3727 * those as we go (XXX mounted over detection not yet implemented).
3728 */
3734 /*
3735 * Failed to get filesystem attributes.
3736 * Return a rdattr_error for each entry, but don't fail.
3737 * However, don't get any obj-dependent attrs.
3738 */
3741 /*
3742 * At least get fileid for regular readdir output
3743 */
3746 }
3749 }
3751 /*
3752 * readlink: args: CURRENT_FH.
3753 * res: status. If success - CURRENT_FH unchanged, return linktext.
3754 */
3756 /* ARGSUSED */
3757 static void
3760 {
3774 /* CURRENT_FH: directory */
3779 }
3784 }
3786 /* Is it a referral? */
3798 }
3803 }
3805 }
3812 }
3817 }
3825 /* Get an artificial symlink based on a referral */
3836 }
3853 }
3859 }
3866 /*
3867 * Even though the conversion failed, we return
3868 * something. We just don't translate it.
3869 */
3871 }
3873 /*
3874 * treat link name as data
3875 */
3883 out:
3886 }
3888 static void
3890 {
3896 }
3897 }
3899 /*
3900 * release_lockowner:
3901 * Release any state associated with the supplied
3902 * lockowner. Note if any lo_state is holding locks we will not
3903 * rele that lo_state and thus the lockowner will not be destroyed.
3904 * A client using lock after the lock owner stateid has been released
3905 * will suffer the consequence of NFS4ERR_BAD_STATEID and would have
3906 * to reissue the lock with new_lock_owner set to TRUE.
3907 * args: lock_owner
3908 * res: status
3909 */
3910 /* ARGSUSED */
3911 static void
3914 {
3924 sysid_t sysid;
3929 /* Make sure there is a clientid around for this request */
3936 }
3943 }
3946 /*
3947 * Check for EXPIRED client. If so will reap state with in a lease
3948 * period or on next set_clientid_confirm step
3949 */
3954 }
3956 /*
3957 * If no sysid has been assigned, then no locks exist; just return.
3958 */
3964 }
3969 /*
3970 * Mark the lockowner invalid.
3971 */
3974 /*
3975 * sysid-pid pair should now not be used since the lockowner is
3976 * invalid. If the client were to instantiate the lockowner again
3977 * it would be assigned a new pid. Thus we can get the list of
3978 * current locks.
3979 */
3982 /* If we are still holding locks fail */
3988 /*
3989 * We need to unhide the lockowner so the client can
3990 * try it again. The bad thing here is if the client
3991 * has a logic error that took it here in the first place
3992 * he probably has lost accounting of the locks that it
3993 * is holding. So we may have dangling state until the
3994 * open owner state is reaped via close. One scenario
3995 * that could possibly occur is that the client has
3996 * sent the unlock request(s) in separate threads
3997 * and has not waited for the replies before sending the
3998 * RELEASE_LOCKOWNER request. Presumably, it would expect
3999 * and deal appropriately with NFS4ERR_LOCKS_HELD, by
4000 * reissuing the request.
4001 */
4005 }
4007 /*
4008 * For the corresponding client we need to check each open
4009 * owner for any opens that have lockowner state associated
4010 * with this lockowner.
4011 */
4029 }
4030 }
4032 }
4034 }
4041 out:
4044 }
4046 /*
4047 * short utility function to lookup a file and recall the delegation
4048 */
4052 {
4067 else
4069 }
4075 }
4077 /*
4078 * remove: args: CURRENT_FH: directory; name.
4079 * res: status. If success - CURRENT_FH unchanged, return change_info
4080 * for directory.
4081 */
4082 /* ARGSUSED */
4083 static void
4086 {
4093 uint_t len;
4103 /* CURRENT_FH: directory */
4108 }
4113 }
4115 /*
4116 * If there is an unshared filesystem mounted on this vnode,
4117 * Do not allow to remove anything in this directory.
4118 */
4122 }
4127 }
4132 }
4134 /*
4135 * Lookup the file so that we can check if it's a directory
4136 */
4141 }
4147 }
4153 }
4163 }
4165 /*
4166 * Lookup the file to determine type and while we are see if
4167 * there is a file struct around and check for delegation.
4168 * We don't need to acquire va_seq before this lookup, if
4169 * it causes an update, cinfo.before will not match, which will
4170 * trigger a cache flush even if atomic is TRUE.
4171 */
4174 NULL)) {
4182 }
4183 }
4185 /* Didn't find anything to remove */
4192 }
4207 }
4209 }
4210 }
4212 /* check label before allowing removal */
4232 }
4234 }
4235 }
4236 }
4238 /* Get dir "before" change value */
4252 }
4254 }
4257 /* Actually do the REMOVE operation */
4259 /*
4260 * Can't remove a directory that has a mounted-on filesystem.
4261 */
4265 /*
4266 * System V defines rmdir to return EEXIST,
4267 * not ENOTEMPTY, if the directory is not
4268 * empty. A System V NFS server needs to map
4269 * NFS4ERR_EXIST to NFS4ERR_NOTEMPTY to
4270 * transmit over the wire.
4271 */
4275 }
4289 /*
4290 * This is va_seq safe because we are not
4291 * manipulating dvp.
4292 */
4296 /* Remove state on file remove */
4300 }
4302 }
4304 }
4305 }
4306 }
4315 }
4323 }
4325 /*
4326 * Get the initial "after" sequence number, if it fails, set to zero
4327 */
4332 /*
4333 * Force modified data and metadata out to stable storage.
4334 */
4337 /*
4338 * Get "after" change value, if it fails, simply return the
4339 * before value.
4340 */
4345 }
4349 /*
4350 * The cinfo.atomic = TRUE only if we have
4351 * non-zero va_seq's, and it has incremented by exactly one
4352 * during the VOP_REMOVE/RMDIR and it didn't change during
4353 * the VOP_FSYNC.
4354 */
4358 else
4363 out:
4366 }
4368 /*
4369 * rename: args: SAVED_FH: from directory, CURRENT_FH: target directory,
4370 * oldname and newname.
4371 * res: status. If success - CURRENT_FH unchanged, return change_info
4372 * for both from and target directories.
4373 */
4374 /* ARGSUSED */
4375 static void
4378 {
4405 /* CURRENT_FH: target directory */
4410 }
4412 /* SAVED_FH: from directory */
4417 }
4422 }
4424 /*
4425 * If there is an unshared filesystem mounted on this vnode,
4426 * do not allow to rename objects in this directory.
4427 */
4431 }
4433 /*
4434 * If there is an unshared filesystem mounted on this vnode,
4435 * do not allow to rename to this directory.
4436 */
4440 }
4445 }
4450 }
4455 }
4460 }
4466 }
4470 nlen);
4476 }
4485 }
4497 }
4505 }
4517 }
4519 /* check label of the target dir */
4531 }
4532 }
4533 }
4535 /*
4536 * Is the source a file and have a delegation?
4537 * We don't need to acquire va_seq before these lookups, if
4538 * it causes an update, cinfo.before will not match, which will
4539 * trigger a cache flush even if atomic is TRUE.
4540 */
4544 NULL)) {
4547 }
4548 }
4559 }
4563 /* Does the destination exist and a file and have a delegation? */
4567 NULL)) {
4570 }
4571 }
4575 /* Check for NBMAND lock on both source and target */
4582 }
4583 }
4591 }
4592 }
4594 /* Get source "before" change value */
4600 }
4604 }
4624 /* The file is gone and so should the state */
4628 }
4630 }
4632 }
4633 }
4649 }
4653 }
4662 /*
4663 * Get the initial "after" sequence number, if it fails, set to zero
4664 */
4673 /*
4674 * Force modified data and metadata out to stable storage.
4675 */
4682 }
4684 /*
4685 * Get "after" change values, if it fails, simply return the
4686 * before value.
4687 */
4692 }
4698 }
4703 /*
4704 * The cinfo.atomic = TRUE only if we have
4705 * non-zero va_seq's, and it has incremented by exactly one
4706 * during the VOP_RENAME and it didn't change during the VOP_FSYNC.
4707 */
4711 else
4717 else
4720 #ifdef VOLATILE_FH_TEST
4721 {
4724 /*
4725 * Add the renamed file handle to the volatile rename list
4726 */
4728 /* file handles may expire on rename */
4732 /*
4733 * Already know that nnm will be a valid string
4734 */
4741 }
4742 }
4743 }
4747 out:
4752 err_out:
4769 }
4773 }
4777 }
4779 /* ARGSUSED */
4780 static void
4783 {
4795 }
4801 }
4811 }
4816 out:
4819 }
4821 /* ARGSUSED */
4822 static void
4825 {
4830 /* No need to check cs->access - we are not accessing any object */
4834 }
4837 }
4845 out:
4848 }
4850 /* ARGSUSED */
4851 static void
4854 {
4859 /* No need to check cs->access - we are not accessing any object */
4863 }
4866 }
4870 /*
4871 * since SAVEFH is fairly rare, don't alloc space for its fh
4872 * unless necessary.
4873 */
4876 }
4880 out:
4883 }
4885 /*
4886 * rfs4_verify_attr is called when nfsv4 Setattr failed, but we wish to
4887 * return the bitmap of attrs that were set successfully. It is also
4888 * called by Verify/Nverify to test the vattr/vfsstat attrs. It should
4889 * always be called only after rfs4_do_set_attrs().
4890 *
4891 * Verify that the attributes are same as the expected ones. sargp->vap
4892 * and sargp->sbp contain the input attributes as translated from fattr4.
4893 *
4894 * This function verifies only the attrs that correspond to a vattr or
4895 * vfsstat struct. That is because of the extra step needed to get the
4896 * corresponding system structs. Other attributes have already been set or
4897 * verified by do_rfs4_set_attrs.
4898 *
4899 * Return 0 if all attrs match, -1 if some don't, error if error processing.
4900 */
4901 static int
4904 {
4908 uint_t vbit;
4914 /*
4915 * Okay to overwrite sargp->vap because we verify based
4916 * on the incoming values.
4917 */
4923 /*
4924 * Must return bitmap of successful attrs
4925 */
4928 /*
4929 * Some file systems clobber va_mask. it is probably
4930 * wrong of them to do so, nonethless we practice
4931 * defensive coding.
4932 * See bug id 4276830.
4933 */
4935 }
4936 }
4939 /*
4940 * Now get the superblock and loop on the bitmap, as there is
4941 * no simple way of translating from superblock to bitmap4.
4942 */
4948 }
4949 }
4951 /*
4952 * Now loop and verify each attribute which getattr returned
4953 * whether it's the same as the input.
4954 */
4966 /*
4967 * If vattr attribute but VOP_GETATTR failed, or it's
4968 * superblock attribute but VFS_STATVFS failed, skip
4969 */
4975 }
4983 }
4987 }
4988 }
4989 errout:
4991 }
4993 /*
4994 * Decode the attribute to be set/verified. If the attr requires a sys op
4995 * (VOP_GETATTR, VFS_VFSSTAT), and the request is to verify, then don't
4996 * call the sv_getit function for it, because the sys op hasn't yet been done.
4997 * Return 0 for success, error code if failed.
4998 *
4999 * Note: the decoded arg is not freed here but in nfs4_ntov_table_free.
5000 */
5001 static int
5004 {
5006 bool_t set_later;
5012 /*
5013 * don't verify yet if a vattr or sb dependent attr,
5014 * because we don't have their sys values yet.
5015 * Will be done later.
5016 */
5018 /*
5019 * ACLs are a special case, since setting the MODE
5020 * conflicts with setting the ACL. We delay setting
5021 * the ACL until all other attributes have been set.
5022 * The ACL gets set in do_rfs4_op_setattr().
5023 */
5030 }
5031 }
5032 }
5034 #ifdef DEBUG
5037 #endif
5039 }
5042 }
5045 }
5047 /*
5048 * Set vattr based on incoming fattr4 attrs - used by setattr.
5049 * Set response mask. Ignore any values that are not writable vattr attrs.
5050 */
5051 static nfsstat4
5054 nfs4_attr_cmd_t cmd)
5055 {
5060 XDR xdr;
5066 #ifndef lint
5067 /*
5068 * Make sure that maximum attribute number can be expressed as an
5069 * 8 bit quantity.
5070 */
5072 #endif
5078 }
5083 }
5091 /* sargp->sbp is set by the caller */
5098 /*
5099 * The following loop iterates on the nfs4_ntov_map checking
5100 * if the fbit is set in the requested bitmap.
5101 * If set then we process the arguments using the
5102 * rfs4_fattr4 conversion functions to populate the setattr
5103 * vattr and va_mask. Any settable attrs that are not using vattr
5104 * will be set in this loop.
5105 */
5109 }
5110 /*
5111 * If setattr, must be a writable attr.
5112 * If verify/nverify, must be a readable attr.
5113 */
5116 /*
5117 * Client tries to set/verify an
5118 * unsupported attribute, tries to set
5119 * a read only attr or verify a write
5120 * only one - error!
5121 */
5123 }
5124 /*
5125 * Decode the attribute to set/verify
5126 */
5132 na++;
5136 }
5143 }
5145 static nfsstat4
5148 {
5151 bool_t trunc;
5162 caller_context_t ct;
5169 NFS4ATTR_SETIT);
5171 /*
5172 * failed set attrs
5173 */
5175 }
5178 /*
5179 * no further work to be done
5180 */
5182 }
5184 /*
5185 * If we got a request to set the ACL and the MODE, only
5186 * allow changing VSUID, VSGID, and VSVTX. Attempting
5187 * to change any other bits, along with setting an ACL,
5188 * gives NFS4ERR_INVAL.
5189 */
5192 vattr_t va;
5199 }
5204 }
5205 }
5207 /* Check stateid only if size has been set */
5219 }
5221 /* XXX start of possible race with delegations */
5223 /*
5224 * We need to specially handle size changes because it is
5225 * possible for the client to create a file with read-only
5226 * modes, but with the file opened for writing. If the client
5227 * then tries to set the file size, e.g. ftruncate(3C),
5228 * fcntl(F_FREESP), the normal access checking done in
5229 * VOP_SETATTR would prevent the client from doing it even though
5230 * it should be allowed to do so. To get around this, we do the
5231 * access checking for ourselves and use VOP_SPACE which doesn't
5232 * do the access checking.
5233 * Also the client should not be allowed to change the file
5234 * size if there is a conflicting non-blocking mandatory lock in
5235 * the region of the change.
5236 */
5238 u_offset_t offset;
5239 ssize_t length;
5241 /*
5242 * ufs_setattr clears AT_SIZE from vap->va_mask, but
5243 * before returning, sarg.vap->va_mask is used to
5244 * generate the setattr reply bitmap. We also clear
5245 * AT_SIZE below before calling VOP_SPACE. For both
5246 * of these cases, the va_mask needs to be saved here
5247 * and restored after calling VOP_SETATTR.
5248 */
5251 /*
5252 * Check any possible conflict due to NBMAND locks.
5253 * Get into critical region before VOP_GETATTR, so the
5254 * size attribute is valid when checking conflicts.
5255 */
5259 }
5265 }
5274 }
5279 }
5280 }
5292 }
5293 }
5298 /* restore va_mask -- ufs_setattr clears AT_SIZE */
5302 /*
5303 * If an ACL was being set, it has been delayed until now,
5304 * in order to set the mode (via the VOP_SETATTR() above) first.
5305 */
5321 }
5327 }
5328 }
5331 /* check if a monitor detected a delegation conflict */
5334 else
5337 /*
5338 * Set the response bitmap when setattr failed.
5339 * If VOP_SETATTR partially succeeded, test by doing a
5340 * VOP_GETATTR on the object and comparing the data
5341 * to the setattr arguments.
5342 */
5345 /*
5346 * Force modified metadata out to stable storage.
5347 */
5349 /*
5350 * Set response bitmap
5351 */
5353 }
5355 /* Return early and already have a NFSv4 error */
5356 done:
5357 /*
5358 * Except for nfs4_vmask_to_nmask_set(), vattr --> fattr
5359 * conversion sets both readable and writeable NFS4 attrs
5360 * for AT_MTIME and AT_ATIME. The line below masks out
5361 * unrequested attrs from the setattr result bitmap. This
5362 * is placed after the done: label to catch the ATTRNOTSUP
5363 * case.
5364 */
5373 }
5375 /* ARGSUSED */
5376 static void
5379 {
5390 }
5392 /*
5393 * If there is an unshared filesystem mounted on this vnode,
5394 * do not allow to setattr on this vnode.
5395 */
5399 }
5406 }
5408 /* check label before setting attributes */
5420 }
5421 }
5422 }
5428 out:
5431 }
5433 /* ARGSUSED */
5434 static void
5437 {
5438 /*
5439 * verify and nverify are exactly the same, except that nverify
5440 * succeeds when some argument changed, and verify succeeds when
5441 * when none changed.
5442 */
5458 }
5466 /*
5467 * do_rfs4_set_attrs will try to verify systemwide attrs,
5468 * so could return -1 for "no match".
5469 */
5473 }
5485 }
5486 done:
5489 out:
5492 }
5494 /* ARGSUSED */
5495 static void
5498 {
5499 /*
5500 * verify and nverify are exactly the same, except that nverify
5501 * succeeds when some argument changed, and verify succeeds when
5502 * when none changed.
5503 */
5521 }
5528 /*
5529 * do_rfs4_set_attrs will try to verify systemwide attrs,
5530 * so could return -1 for "no match".
5531 */
5535 }
5547 }
5548 done:
5554 }
5556 /*
5557 * XXX - This should live in an NFS header file.
5558 */
5559 #define MAX_IOVECS 12
5561 /* ARGSUSED */
5562 static void
5565 {
5571 u_offset_t rlimit;
5579 nfsstat4 stat;
5581 caller_context_t ct;
5590 }
5594 }
5602 }
5604 /*
5605 * We have to enter the critical region before calling VOP_RWLOCK
5606 * to avoid a deadlock with ufs.
5607 */
5615 }
5616 }
5621 /*
5622 * If we can't get the attributes, then we can't do the
5623 * right access checking. So, we'll fail the request.
5624 */
5628 }
5633 }
5639 }
5645 }
5650 }
5658 }
5670 iovcnt++;
5672 }
5673 #ifdef DEBUG
5674 /* should have ended on an mblk boundary */
5681 }
5682 #endif
5687 }
5699 }
5724 }
5726 /*
5727 * We're changing creds because VM may fault and we need
5728 * the cred of the current thread to be used if quota
5729 * checking is enabled.
5730 */
5742 }
5749 else
5754 out:
5760 }
5763 /* XXX put in a header file */
5766 void
5769 {
5770 uint_t i;
5776 /*
5777 * Form a reply tag by copying over the reqeuest tag.
5778 */
5788 /*
5789 * XXX for now, minorversion should be zero
5790 */
5800 }
5818 }
5821 KM_SLEEP);
5828 /*
5829 * For now, NFS4 compound processing must be protected by
5830 * exported_lock because it can access more than one exportinfo
5831 * per compound and share/unshare can now change multiple
5832 * exinfo structs. The NFS2/3 code only refs 1 exportinfo
5833 * per proc (excluding public exinfo), and exi_count design
5834 * is sufficient to protect concurrent execution of NFS2/3
5835 * ops along with unexport. This lock will be removed as
5836 * part of the NFSv4 phase 2 namespace redesign work.
5837 */
5840 /*
5841 * If this is the first compound we've seen, we need to start all
5842 * new instances' grace periods.
5843 */
5846 /*
5847 * This must be set after rfs4_grace_start_new(), otherwise
5848 * another thread could proceed past here before the former
5849 * is finished.
5850 */
5852 }
5857 uint_t op;
5865 /*
5866 * Count the individual ops here; NULL and COMPOUND
5867 * are counted in common_dispatch()
5868 */
5879 /*
5880 * This is effectively dead code since XDR code
5881 * will have already returned BADXDR if op doesn't
5882 * decode to legal value. This only done for a
5883 * day when XDR code doesn't verify v4 opcodes.
5884 */
5890 }
5892 /*
5893 * If not at last op, and if we are to stop, then
5894 * compact the results array.
5895 */
5906 }
5907 }
5925 /*
5926 * done with this compound request, free the label
5927 */
5932 }
5933 }
5935 /*
5936 * XXX because of what appears to be duplicate calls to rfs4_compound_free
5937 * XXX zero out the tag and array values. Need to investigate why the
5938 * XXX calls occur, but at least prevent the panic for now.
5939 */
5940 void
5942 {
5943 uint_t i;
5947 }
5951 uint_t op;
5957 }
5958 }
5961 }
5962 }
5964 /*
5965 * Process the value of the compound request rpc flags, as a bit-AND
5966 * of the individual per-op flags (idempotent, allowork, publicfh_ok)
5967 */
5968 void
5970 {
5975 uint_t op;
5981 else
5983 }
5985 }
5987 nfsstat4
5989 {
5990 nfsstat4 e;
6009 }
6011 #if defined(DEBUG) && ! defined(lint)
6013 {
6025 }
6035 }
6041 }
6043 #define LOCK_PRINT(d, s, t, f) if (d) lock_print(s, t, f)
6044 #else
6045 #define LOCK_PRINT(d, s, t, f)
6046 #endif
6048 /*ARGSUSED*/
6049 static bool_t
6051 {
6053 }
6055 /*
6056 * Look up the pathname using the vp in cs as the directory vnode.
6057 * cs->vp will be the vnode for the file on success
6058 */
6060 static nfsstat4
6063 {
6066 nfsstat4 status;
6072 }
6075 }
6083 }
6088 }
6097 }
6107 }
6109 static nfsstat4
6112 {
6113 nfsstat4 status;
6118 /* Get "before" change value */
6124 /* rfs4_lookup may VN_RELE directory */
6131 }
6133 /*
6134 * Get "after" change value, if it fails, simply return the
6135 * before value.
6136 */
6141 }
6144 /*
6145 * Validate the file is a file
6146 */
6158 }
6163 /*
6164 * It is undefined if VOP_LOOKUP will change va_seq, so
6165 * cinfo.atomic = TRUE only if we have
6166 * non-zero va_seq's, and they have not changed.
6167 */
6170 else
6173 /* Check for mandatory locking */
6176 }
6178 static nfsstat4
6181 {
6184 vattr_t va;
6186 tryagain:
6188 /*
6189 * The file open mode used is VWRITE. If the client needs
6190 * some other semantic, then it should do the access checking
6191 * itself. It would have been nice to have the file open mode
6192 * passed as part of the arguments.
6193 */
6201 /*
6202 * If we got something other than file already exists
6203 * then just return this error. Otherwise, we got
6204 * EEXIST. If we were doing a GUARDED create, then
6205 * just return this error. Otherwise, we need to
6206 * make sure that this wasn't a duplicate of an
6207 * exclusive create request.
6208 *
6209 * The assumption is made that a non-exclusive create
6210 * request will never return EEXIST.
6211 */
6216 }
6221 /*
6222 * We couldn't find the file that we thought that
6223 * we just created. So, we'll just try creating
6224 * it again.
6225 */
6231 }
6234 /* existing object must be regular file */
6240 else
6244 }
6247 }
6249 /* Check for duplicate request */
6254 /* We found the file */
6257 /* but its not our creation */
6260 }
6263 }
6266 }
6269 }
6271 static nfsstat4
6274 {
6277 bool_t readonly;
6280 /* For now we don't allow mandatory locking as per V2/V3 */
6283 }
6288 /*
6289 * If the file system is exported read only and we are trying
6290 * to open for write, then return NFS4ERR_ROFS
6291 */
6302 }
6303 }
6309 }
6312 }
6314 static nfsstat4
6317 {
6323 nfsstat4 status;
6329 uint_t buflen;
6330 bool_t created;
6332 len_t reqsize;
6334 bool_t trunc;
6335 caller_context_t ct;
6346 /* Check if the file system is read only */
6350 /* check the label of including directory */
6361 }
6362 }
6363 }
6365 /*
6366 * Get the last component of path name in nm. cs will reference
6367 * the including directory on success.
6368 */
6381 }
6388 }
6393 }
6399 /*FALLTHROUGH*/
6415 else
6417 }
6424 }
6433 }
6437 /* Disallow create with a non-zero size */
6444 }
6446 }
6450 /* prohibit EXCL create of named attributes */
6455 }
6459 /*
6460 * Ensure no time overflows. Assumes underlying
6461 * filesystem supports at least 32 bits.
6462 * Truncate nsec to usec resolution to allow valid
6463 * compares even if the underlying filesystem truncates.
6464 */
6471 /*
6472 * For EXCL create, attrset is set to the server attr
6473 * used to cache the client's verifier.
6474 */
6477 }
6486 }
6499 }
6506 /*
6507 * True verification that object was created with correct
6508 * attrs is impossible. The attrs could have been changed
6509 * immediately after object creation. If attributes did
6510 * not verify, the only recourse for the server is to
6511 * destroy the object. Maybe if some attrs (like gid)
6512 * are set incorrectly, the object should be destroyed;
6513 * however, seems bad as a default policy. Do we really
6514 * want to destroy an object over one of the times not
6515 * verifying correctly? For these reasons, the server
6516 * currently sets bits in attrset for createattrs
6517 * that were set; however, no verification is done.
6518 *
6519 * vmask_to_nmask accounts for vattr bits set on create
6520 * [do_rfs4_set_attrs() only sets resp bits for
6521 * non-vattr/vfs bits.]
6522 * Mask off any bits we set by default so as not to return
6523 * more attrset bits than were requested in createattrs
6524 */
6529 /*
6530 * We did not create the vnode (we tried but it
6531 * already existed). In this case, the only createattr
6532 * that the spec allows the server to set is size,
6533 * and even then, it can only be set if it is 0.
6534 */
6538 }
6539 }
6543 /*
6544 * Get the initial "after" sequence number, if it fails,
6545 * set to zero, time to before.
6546 */
6551 }
6553 /*
6554 * create_vnode attempts to create the file exclusive,
6555 * if it already exists the VOP_CREATE will fail and
6556 * may not increase va_seq. It is atomic if
6557 * we haven't changed the directory, but if it has changed
6558 * we don't know what changed it.
6559 */
6564 else
6568 /*
6569 * The entry was created, we need to sync the
6570 * directory metadata.
6571 */
6574 /*
6575 * Get "after" change value, if it fails, simply return the
6576 * before value.
6577 */
6582 }
6586 /*
6587 * The cinfo->atomic = TRUE only if we have
6588 * non-zero va_seq's, and it has incremented by exactly one
6589 * during the create_vnode and it didn't
6590 * change during the VOP_FSYNC.
6591 */
6595 else
6597 }
6599 /* Check for mandatory locking and that the size gets set. */
6604 /* Assume the worst */
6610 /*
6611 * Truncate the file if necessary; this would be
6612 * the case for create over an existing file.
6613 */
6620 /*
6621 * We are writing over an existing file.
6622 * Check to see if we need to recall a delegation.
6623 */
6633 }
6635 }
6651 }
6652 }
6663 }
6664 }
6668 /*
6669 * Force modified data and metadata out to stable storage.
6670 */
6677 }
6679 /* if parent dir is attrdir, set namedattr fh flag */
6688 /*
6689 * if we did not create the file, we will need to check
6690 * the access bits on the file
6691 */
6699 }
6701 }
6703 /*ARGSUSED*/
6704 static void
6709 {
6710 /* XXX Currently not using req */
6718 sysid_t sysid;
6719 nfsstat4 status;
6720 caller_context_t ct;
6726 /* get the file struct and hold a lock on it during initial open */
6732 }
6738 /* No need to keep any reference */
6742 }
6744 /* try to get the sysid before continuing */
6748 /* Not a fully formed open; "close" it */
6753 }
6755 /* Calculate the fflags for this OPEN. */
6763 /*
6764 * Calculate the new deny and access mode that this open is adding to
6765 * the file for this open owner;
6766 */
6770 /*
6771 * Calculate the new share access and share deny modes that this open
6772 * is adding to the file for this open owner;
6773 */
6779 /*
6780 * Check to see the client has already sent an open for this
6781 * open owner on this file with the same share/deny modes.
6782 * If so, we don't need to check for a conflict and we don't
6783 * need to add another shrlock. If not, then we need to
6784 * check for conflicts in deny and access before checking for
6785 * conflicts in delegation. We don't want to recall a
6786 * delegation based on an open that will eventually fail based
6787 * on shares modes.
6788 */
6796 /* Not a fully formed open; "close" it */
6801 }
6802 }
6806 /*
6807 * Check to see if this file is delegated and if so, if a
6808 * recall needs to be done.
6809 */
6817 /* if state closed while lock was dropped */
6823 /* Not a fully formed open; "close" it */
6829 }
6832 /* Let's see if the delegation was returned */
6841 /* Not a fully formed open; "close" it */
6847 }
6848 }
6849 /*
6850 * the share check passed and any delegation conflict has been
6851 * taken care of, now call vop_open.
6852 * if this is the first open then call vop_open with fflags.
6853 * if not, call vn_open_upgrade with just the upgrade flags.
6854 *
6855 * if the file has been opened already, it will have the current
6856 * access mode in the state struct. if it has no share access, then
6857 * this is a new open.
6858 *
6859 * However, if this is open with CLAIM_DLEGATE_CUR, then don't
6860 * call VOP_OPEN(), just do the open upgrade.
6861 */
6875 /* Not a fully formed open; "close" it */
6879 /* check if a monitor detected a delegation conflict */
6882 else
6885 }
6887 /*
6888 * calculate the fflags for the new mode that is being added
6889 * by this upgrade.
6890 */
6897 }
6913 /*
6914 * Check for delegation here. if the deleg argument is not
6915 * DELEG_ANY, then this is a reclaim from a client and
6916 * we must honor the delegation requested. If necessary we can
6917 * set the recall flag.
6918 */
6934 }
6940 }
6942 /*ARGSUSED*/
6943 static void
6946 {
6954 /* inhibit delegation grants during exclusive create */
6961 }
6965 /* cs->vp cs->fh now reference the desired file */
6971 /*
6972 * If rfs4_createfile set attrset, we must
6973 * clear this attrset before the response is copied.
6974 */
6977 }
6978 }
6979 else
6984 }
6986 /*ARGSUSED*/
6987 static void
6990 {
6992 vattr_t va;
6996 /* Verify that we have a regular file */
7002 else
7005 }
7012 }
7016 /*
7017 * Check if we have access to the file, Note the the file
7018 * could have originally been open UNCHECKED or GUARDED
7019 * with mode bits that will now fail, but there is nothing
7020 * we can really do about that except in the case that the
7021 * owner of the file is the one requesting the open.
7022 */
7027 }
7028 }
7030 /*
7031 * cinfo on a CLAIM_PREVIOUS is undefined, initialize to zero
7032 */
7040 }
7042 static void
7045 {
7047 nfsstat4 status;
7048 stateid4 stateid =
7052 /*
7053 * Find the state info from the stateid and confirm that the
7054 * file is delegated. If the state openowner is the same as
7055 * the supplied openowner we're done. If not, get the file
7056 * info from the found state info. Use that file info to
7057 * create the state for this lock owner. Note solaris doen't
7058 * really need the pathname to find the file. We may want to
7059 * lookup the pathname and make sure that the vp exist and
7060 * matches the vp in the file structure. However it is
7061 * possible that the pathname nolonger exists (local process
7062 * unlinks the file), so this may not be that useful.
7063 */
7069 }
7073 /*
7074 * New lock owner, create state. Since this was probably called
7075 * in response to a CB_RECALL we set deleg to DELEG_NONE
7076 */
7087 }
7089 /* Mark progress for delegation returns */
7094 }
7096 /*ARGSUSED*/
7097 static void
7100 {
7101 /*
7102 * Lookup the pathname, it must already exist since this file
7103 * was delegated.
7104 *
7105 * Find the file and state info for this vp and open owner pair.
7106 * check that they are in fact delegated.
7107 * check that the state access and deny modes are the same.
7108 *
7109 * Return the delgation possibly seting the recall flag.
7110 */
7118 /* Note we ignore oflags */
7124 }
7126 /* get the file struct and hold a lock on it during initial open */
7132 }
7141 }
7156 }
7166 }
7190 }
7192 /* XXX For now */
7202 }
7210 /*
7211 * Generic function for sequence number checks.
7212 */
7213 static rfs4_chkseq_t
7216 {
7217 /* Same sequence ids and matching operations? */
7222 }
7226 }
7228 /* If the incoming sequence is not the next expected then it is bad */
7236 }
7241 }
7243 /* Everything okay -- next expected */
7245 }
7248 static rfs4_chkseq_t
7250 {
7251 rfs4_chkseq_t rc;
7255 TRUE);
7262 }
7264 static rfs4_chkseq_t
7266 {
7267 rfs4_chkseq_t rc;
7275 }
7277 static rfs4_chkseq_t
7279 {
7289 }
7291 static void
7294 {
7301 bool_t create;
7311 }
7313 /*
7314 * Need to check clientid and lease expiration first based on
7315 * error ordering and incrementing sequence id.
7316 */
7322 }
7328 }
7331 /*
7332 * Find the open_owner for use from this point forward. Take
7333 * care in updating the sequence id based on the type of error
7334 * being returned.
7335 */
7336 retry:
7343 }
7345 /* Hold off access to the sequence space while the open is done */
7348 /*
7349 * If the open_owner existed before at the server, then check
7350 * the sequence id.
7351 */
7361 }
7369 }
7371 /*
7372 * Sequence was ok and open owner exists
7373 * check to see if we have yet to see an
7374 * open_confirm.
7375 */
7381 }
7382 }
7383 /* Grace only applies to regular-type OPENs */
7388 }
7390 /*
7391 * If previous state at the server existed then can_reclaim
7392 * will be set. If not reply NFS4ERR_NO_GRACE to the
7393 * client.
7394 */
7398 }
7401 /*
7402 * Reject the open if the client has missed the grace period
7403 */
7407 }
7409 /* Couple of up-front bookkeeping items */
7411 /*
7412 * If this is a reclaim OPEN then we should not ask
7413 * for a confirmation of the open_owner per the
7414 * protocol specification.
7415 */
7418 else
7420 }
7423 /*
7424 * If there is an unshared filesystem mounted on this vnode,
7425 * do not allow to open/create in this directory.
7426 */
7430 }
7432 /*
7433 * access must READ, WRITE, or BOTH. No access is invalid.
7434 * deny can be READ, WRITE, BOTH, or NONE.
7435 * bits not defined for access/deny are invalid.
7436 */
7442 }
7445 /*
7446 * make sure attrset is zero before response is built.
7447 */
7466 }
7468 out:
7471 /* Catch sequence id handling here to make it a little easier */
7480 /*
7481 * The protocol states that if any of these errors are
7482 * being returned, the sequence id should not be
7483 * incremented. Any other return requires an
7484 * increment.
7485 */
7488 /* Always update the lease in this case */
7491 /* Regular response - copy the result */
7495 /*
7496 * REPLAY case: Only if the previous response was OK
7497 * do we copy the filehandle. If not OK, no
7498 * filehandle to copy.
7499 */
7503 /*
7504 * If this is a replay, we must restore the
7505 * current filehandle/vp to that of what was
7506 * returned originally. Try our best to do
7507 * it.
7508 */
7518 }
7529 }
7531 /*
7532 * If this was a replay, no need to update the
7533 * sequence id. If the open_owner was not created on
7534 * this pass, then update. The first use of an
7535 * open_owner will not bump the sequence id.
7536 */
7539 /*
7540 * If the client is receiving an error and the
7541 * open_owner needs to be confirmed, there is no way
7542 * to notify the client of this fact ignoring the fact
7543 * that the server has no method of returning a
7544 * stateid to confirm. Therefore, the server needs to
7545 * mark this open_owner in a way as to avoid the
7546 * sequence id checking the next time the client uses
7547 * this open_owner.
7548 */
7551 /*
7552 * If OK response then clear the postpone flag and
7553 * reset the sequence id to keep in sync with the
7554 * client.
7555 */
7559 }
7561 }
7563 finish:
7569 end:
7572 }
7574 /*ARGSUSED*/
7575 void
7578 {
7582 nfsstat4 status;
7590 }
7596 }
7598 /* Ensure specified filehandle matches */
7603 }
7605 /* hold off other access to open_owner while we tinker */
7614 }
7615 /*
7616 * If it is the appropriate stateid and determined to
7617 * be "OKAY" then this means that the stateid does not
7618 * need to be confirmed and the client is in error for
7619 * sending an OPEN_CONFIRM.
7620 */
7637 resop)) {
7639 /*
7640 * This is replayed stateid; if seqid matches
7641 * next expected, then client is using wrong seqid.
7642 */
7643 /* fall through */
7648 /*
7649 * Note this case is the duplicate case so
7650 * resp->status is already set.
7651 */
7655 }
7662 }
7676 }
7680 out:
7683 }
7685 /*ARGSUSED*/
7686 void
7689 {
7694 nfsstat4 status;
7705 }
7711 }
7713 /* Ensure specified filehandle matches */
7718 }
7720 /* hold off other access to open_owner while we tinker */
7729 }
7747 /* Check the sequence id for the open owner */
7749 resop)) {
7751 /*
7752 * This is replayed stateid; if seqid matches
7753 * next expected, then client is using wrong seqid.
7754 */
7755 /* fall through */
7760 /*
7761 * Note this case is the duplicate case so
7762 * resp->status is already set.
7763 */
7767 }
7772 }
7775 /*
7776 * Check that the new access modes and deny modes are valid.
7777 * Check that no invalid bits are set.
7778 */
7785 }
7787 /*
7788 * The new modes must be a subset of the current modes and
7789 * the access must specify at least one mode. To test that
7790 * the new mode is a subset of the current modes we bitwise
7791 * AND them together and check that the result equals the new
7792 * mode. For example:
7793 * New mode, access == R and current mode, sp->rs_open_access == RW
7794 * access & sp->rs_open_access == R == access, so the new access mode
7795 * is valid. Consider access == RW, sp->rs_open_access = R
7796 * access & sp->rs_open_access == R != access, so the new access mode
7797 * is invalid.
7798 */
7807 }
7809 /*
7810 * Release any share locks associated with this stateID.
7811 * Strictly speaking, this violates the spec because the
7812 * spec effectively requires that open downgrade be atomic.
7813 * At present, fs_shrlock does not have this capability.
7814 */
7823 }
7828 /*
7829 * If the current mode has deny read and the new mode
7830 * does not, decrement the number of deny read mode bits
7831 * and if it goes to zero turn off the deny read bit
7832 * on the file.
7833 */
7839 }
7841 /*
7842 * If the current mode has deny write and the new mode
7843 * does not, decrement the number of deny write mode bits
7844 * and if it goes to zero turn off the deny write bit
7845 * on the file.
7846 */
7852 }
7854 /*
7855 * If the current mode has access read and the new mode
7856 * does not, decrement the number of access read mode bits
7857 * and if it goes to zero turn off the access read bit
7858 * on the file. set fflags to FREAD for the call to
7859 * vn_open_downgrade().
7860 */
7867 }
7869 /*
7870 * If the current mode has access write and the new mode
7871 * does not, decrement the number of access write mode bits
7872 * and if it goes to zero turn off the access write bit
7873 * on the file. set fflags to FWRITE for the call to
7874 * vn_open_downgrade().
7875 */
7882 }
7884 /* Check that the file is still accessible */
7889 /* now set the new open access and deny modes */
7893 /*
7894 * we successfully downgraded the share lock, now we need to downgrade
7895 * the open. it is possible that the downgrade was only for a deny
7896 * mode and we have nothing else to do.
7897 */
7901 /* Update the stateid */
7908 /* Update the lease */
7910 /* And the sequence */
7914 end:
7917 out:
7920 }
7922 /*
7923 * The logic behind this function is detailed in the NFSv4 RFC in the
7924 * SETCLIENTID operation description under IMPLEMENTATION. Refer to
7925 * that section for explicit guidance to server behavior for
7926 * SETCLIENTID.
7927 */
7928 void
7931 {
7936 bool_t create;
7942 retry:
7945 /*
7946 * Save the caller's IP address
7947 */
7951 /*
7952 * Record if it is a Solaris client that cannot handle referrals.
7953 */
7956 /* Add a "yes, it's downrev" record */
7962 /* Remove any previous record */
7964 }
7966 /*
7967 * In search of an EXISTING client matching the incoming
7968 * request to establish a new client identifier at the server
7969 */
7973 /* Should never happen */
7979 }
7981 /*
7982 * Easiest case. Client identifier is newly created and is
7983 * unconfirmed. Also note that for this case, no other
7984 * entries exist for the client identifier. Nothing else to
7985 * check. Just setup the response and respond.
7986 */
7992 /* Setup callback information; CB_NULL confirmation later */
7997 }
7999 /*
8000 * An existing, confirmed client may exist but it may not have
8001 * been active for at least one lease period. If so, then
8002 * "close" the client and create a new client identifier
8003 */
8007 }
8011 else
8016 /*
8017 * We have a confirmed client, now check for an
8018 * unconfimred entry
8019 */
8021 /* If creds don't match then client identifier is inuse */
8024 /*
8025 * Some one else has established this client
8026 * id. Try and say * who they are. We will use
8027 * the call back address supplied by * the
8028 * first client.
8029 */
8045 }
8051 }
8053 /*
8054 * Confirmed, creds match, and verifier matches; must
8055 * be an update of the callback info
8056 */
8059 /* Setup callback information */
8063 /* everything okay -- move ahead */
8068 /* update the confirm_verifier and return it */
8075 }
8077 /*
8078 * Creds match but the verifier doesn't. Must search
8079 * for an unconfirmed client that would be replaced by
8080 * this request.
8081 */
8084 cp_confirmed);
8085 }
8087 /*
8088 * At this point, we have taken care of the brand new client
8089 * struct, INUSE case, update of an existing, and confirmed
8090 * client struct.
8091 */
8093 /*
8094 * check to see if things have changed while we originally
8095 * picked up the client struct. If they have, then return and
8096 * retry the processing of this SETCLIENTID request.
8097 */
8106 }
8107 /* do away with the old unconfirmed one */
8112 }
8114 /*
8115 * This search will temporarily hide the confirmed client
8116 * struct while a new client struct is created as the
8117 * unconfirmed one.
8118 */
8128 }
8130 /*
8131 * If one was not created, then a similar request must be in
8132 * process so release and start over with this one
8133 */
8139 }
8145 /* Setup callback information; CB_NULL confirmation later */
8152 out:
8155 }
8157 /*ARGSUSED*/
8158 void
8161 {
8180 }
8186 }
8188 /* If the verifier doesn't match, the record doesn't match */
8193 }
8201 }
8203 /*
8204 * Update the client's associated server instance, if it's changed
8205 * since the client was created.
8206 */
8210 /*
8211 * Record clientid in stable storage.
8212 * Must be done after server instance has been assigned.
8213 */
8219 /* don't need to rele, client_close does it */
8222 /* If needed, initiate CB_NULL call for callback path */
8226 /*
8227 * Check to see if client can perform reclaims
8228 */
8233 out:
8237 }
8240 /*ARGSUSED*/
8241 void
8244 {
8248 nfsstat4 status;
8256 }
8262 }
8264 /* Ensure specified filehandle matches */
8269 }
8271 /* hold off other access to open_owner while we tinker */
8280 }
8298 /* Check the sequence id for the open owner */
8300 resop)) {
8302 /*
8303 * This is replayed stateid; if seqid matches
8304 * next expected, then client is using wrong seqid.
8305 */
8306 /* FALL THROUGH */
8311 /*
8312 * Note this case is the duplicate case so
8313 * resp->status is already set.
8314 */
8318 }
8323 }
8327 /* Update the stateid. */
8341 end:
8344 out:
8347 }
8349 /*
8350 * Manage the counts on the file struct and close all file locks
8351 */
8352 /*ARGSUSED*/
8353 void
8355 bool_t close_of_client)
8356 {
8361 /*
8362 * If this call is part of the larger closing down of client
8363 * state then it is just easier to release all locks
8364 * associated with this client instead of going through each
8365 * individual file and cleaning locks there.
8366 */
8371 /* Is the PxFS kernel module loaded? */
8375 /* Encode the cluster nodeid in new sysid */
8379 /*
8380 * This PxFS routine removes file locks for a
8381 * client over all nodes of a cluster.
8382 */
8385 new_sysid));
8390 /* Release all locks for this client */
8401 }
8404 }
8405 }
8407 /*
8408 * Release all locks on this file by this lock owner or at
8409 * least mark the locks as having been released
8410 */
8415 /* Was this already taken care of above? */
8421 }
8423 /*
8424 * Release any shrlocks associated with this open state ID.
8425 * This must be done before the rfs4_state gets marked closed.
8426 */
8433 /*
8434 * Decrement the count for each access and deny bit that this
8435 * state has contributed to the file.
8436 * If the file counts go to zero
8437 * clear the appropriate bit in the appropriate mask.
8438 */
8444 }
8451 }
8456 }
8461 }
8469 }
8470 }
8472 /*
8473 * lock_denied: Fill in a LOCK4deneid structure given an flock64 structure.
8474 */
8475 static nfsstat4
8477 {
8490 }
8498 }
8500 /*
8501 * Its not a NFS4 lock. We take advantage that the upper 32 bits
8502 * of the client id contain the boot time for a NFS4 lock. So we
8503 * fabricate and identity by setting clientid to the sysid, and
8504 * the lock owner to the pid.
8505 */
8511 finish:
8519 else
8523 }
8525 static int
8527 {
8535 retry:
8549 }
8550 }
8553 /* Get the owner of the lock */
8559 /* No longer locked, retry */
8561 }
8565 }
8566 }
8569 }
8571 /*ARGSUSED*/
8572 static nfsstat4
8575 {
8576 nfsstat4 status;
8583 sysid_t sysid;
8588 }
8593 /* Check for zero length. To lock to end of file use all ones for V4 */
8599 retry:
8604 }
8615 }
8625 }
8628 }
8639 /* Note that length4 is uint64_t but l_len and l_start are off64_t */
8643 }
8645 /*
8646 * N.B. FREAD has the same value as OPEN4_SHARE_ACCESS_READ and
8647 * FWRITE has the same value as OPEN4_SHARE_ACCESS_WRITE.
8648 */
8656 }
8660 /*
8661 * N.B. We map error values to nfsv4 errors. This is differrent
8662 * than puterrno4 routine.
8663 */
8670 /* Can only get here if op is OP_LOCK */
8690 }
8693 }
8695 /*ARGSUSED*/
8696 void
8699 {
8702 nfsstat4 status;
8722 }
8725 /* Create a new lockowner for this instance */
8739 }
8741 /* Ensure specified filehandle matches */
8748 }
8750 /* hold off other access to open_owner while we tinker */
8776 /*
8777 * This is replayed stateid; if seqid
8778 * matches next expected, then client
8779 * is using wrong seqid.
8780 */
8781 /* FALLTHROUGH */
8786 /* This is a duplicate LOCK request */
8789 /*
8790 * For a duplicate we do not want to
8791 * create a new lockowner as it should
8792 * already exist.
8793 * Turn off the lockowner create flag.
8794 */
8796 }
8798 }
8806 }
8811 /*
8812 * Only update theh open_seqid if this is not
8813 * a duplicate request
8814 */
8817 }
8825 }
8827 /*
8828 * This is the new_lock_owner branch and the client is
8829 * supposed to be associating a new lock_owner with
8830 * the open file at this point. If we find that a
8831 * lock_owner/state association already exists and a
8832 * successful LOCK request was returned to the client,
8833 * an error is returned to the client since this is
8834 * not appropriate. The client should be using the
8835 * existing lock_owner branch.
8836 */
8843 }
8844 }
8848 /*
8849 * Only update theh open_seqid if this is not
8850 * a duplicate request
8851 */
8854 }
8856 /*
8857 * If this is a duplicate lock request, just copy the
8858 * previously saved reply and return.
8859 */
8861 /* verify that lock_seqid's match */
8870 /*
8871 * Make sure to copy the just
8872 * retrieved reply status into the
8873 * overall compound status
8874 */
8876 }
8879 }
8883 /* Make sure to update the lock sequence id */
8889 /*
8890 * This is used to signify the newly created lockowner
8891 * stateid and its sequence number. The checks for
8892 * sequence number and increment don't occur on the
8893 * very first lock request for a lockowner.
8894 */
8897 /* hold off other access to lsp while we tinker */
8906 /* get lsp and hold the lock on the underlying file struct */
8913 }
8916 /* Ensure specified filehandle matches */
8923 }
8925 /* hold off other access to lsp while we tinker */
8930 /*
8931 * The stateid looks like it was okay (expected to be
8932 * the next one)
8933 */
8935 /*
8936 * The sequence id is now checked. Determine
8937 * if this is a replay or if it is in the
8938 * expected (next) sequence. In the case of a
8939 * replay, there are two replay conditions
8940 * that may occur. The first is the normal
8941 * condition where a LOCK is done with a
8942 * NFS4_OK response and the stateid is
8943 * updated. That case is handled below when
8944 * the stateid is identified as a REPLAY. The
8945 * second is the case where an error is
8946 * returned, like NFS4ERR_DENIED, and the
8947 * sequence number is updated but the stateid
8948 * is not updated. This second case is dealt
8949 * with here. So it may seem odd that the
8950 * stateid is okay but the sequence id is a
8951 * replay but it is okay.
8952 */
8958 /*
8959 * Here is our replay and need
8960 * to verify that the last
8961 * response was an error.
8962 */
8965 }
8966 /*
8967 * This is done since the sequence id
8968 * looked like a replay but it didn't
8969 * pass our check so a BAD_SEQID is
8970 * returned as a result.
8971 */
8972 /*FALLTHROUGH*/
8977 /* Everything looks okay move ahead */
8979 }
8998 /*
8999 * This is a replayed stateid; if
9000 * seqid matches the next expected,
9001 * then client is using wrong seqid.
9002 */
9010 }
9015 }
9019 }
9021 /*
9022 * NFS4 only allows locking on regular files, so
9023 * verify type of object.
9024 */
9028 else
9031 }
9038 }
9043 }
9048 }
9056 out:
9064 }
9065 /*
9066 * Only update the "OPEN" response here if this was a new
9067 * lock_owner
9068 */
9074 end:
9078 /*
9079 * If an sp obtained, then the lsp does not represent
9080 * a lock on the file struct.
9081 */
9084 else
9086 }
9090 }
9094 }
9096 /* free function for LOCK/LOCKT */
9097 static void
9099 {
9113 }
9117 }
9119 /*ARGSUSED*/
9120 void
9123 {
9126 nfsstat4 status;
9138 }
9145 }
9147 /* Ensure specified filehandle matches */
9154 }
9156 /* hold off other access to lsp while we tinker */
9165 }
9182 /*
9183 * This is a replayed stateid; if
9184 * seqid matches the next expected,
9185 * then client is using wrong seqid.
9186 */
9194 }
9199 }
9204 /*
9205 * NFS4 only allows locking on regular files, so
9206 * verify type of object.
9207 */
9211 else
9214 }
9219 }
9224 out:
9232 end:
9238 }
9240 /*
9241 * LOCKT is a best effort routine, the client can not be guaranteed that
9242 * the status return is still in effect by the time the reply is received.
9243 * They are numerous race conditions in this routine, but we are not required
9244 * and can not be accurate.
9245 */
9246 /*ARGSUSED*/
9247 void
9250 {
9260 length4 posix_length;
9261 sysid_t sysid;
9262 pid_t pid;
9270 }
9272 /*
9273 * NFS4 only allows locking on regular files, so
9274 * verify type of object.
9275 */
9279 else
9282 }
9284 /*
9285 * Check out the clientid to ensure the server knows about it
9286 * so that we correctly inform the client of a server reboot.
9287 */
9293 }
9296 /*
9297 * Protocol doesn't allow returning NFS4ERR_STALE as
9298 * other operations do on this check so STALE_CLIENTID
9299 * is returned instead
9300 */
9303 }
9309 }
9323 }
9326 /* Check for zero length. To lock to end of file use all ones for V4 */
9332 }
9334 /* Find or create a lockowner */
9345 }
9346 retry:
9357 /* Note that length4 is uint64_t but l_len and l_start are off64_t */
9361 }
9365 /*
9366 * N.B. We map error values to nfsv4 errors. This is differrent
9367 * than puterrno4 routine.
9368 */
9377 }
9387 error);
9390 }
9392 err:
9396 out:
9399 }
9401 int
9403 {
9425 }
9429 }
9450 else
9453 }
9459 }
9461 int
9463 {
9485 NULL);
9489 }
9496 }
9498 static int
9500 {
9508 }
9513 }
9515 /* tunable to disable server referrals */
9518 /*
9519 * Find an NFS record in reparse point data.
9520 * Returns 0 for success and <0 or an errno value on failure.
9521 */
9522 int
9524 {
9536 }
9543 }
9546 }
9552 }
9557 }
9559 int
9561 {
9577 }
9579 /*
9580 * There is a user-level copy of this routine in ref_subr.c.
9581 * Changes should be kept in sync.
9582 */
9583 static int
9585 {
9596 /* count number of components in the path */
9602 }
9608 }
9612 }
9615 }
9618 }
9620 /*
9621 * There is a user-level copy of this routine in ref_subr.c.
9622 * Changes should be kept in sync.
9623 */
9624 static int
9626 {
9637 }
9639 /* count number of components to alloc buffer */
9644 }
9647 /* copy components into allocated buffer */
9654 }
9656 #define xdr_fs_locations4 xdr_fattr4_fs_locations
9658 fs_locations4 *
9660 {
9666 XDR xdr;
9669 /*
9670 * Check attrs to ensure it's a reparse point
9671 */
9675 /*
9676 * Look for an NFS record and get the type and data
9677 */
9681 /*
9682 * With the type and data, upcall to get the referral
9683 */
9695 err);
9697 }
9699 /*
9700 * We get an XDR'ed record back from the kderef call
9701 */
9710 }
9712 /*
9713 * Look at path to recover fs_root, ignoring the leading '/'
9714 */
9718 }
9722 {
9728 uint_t len;
9730 /* Get the referral */
9734 /* Deal with only the first location and first server */
9741 }
9743 /* Figure out size for "/net/" + host + /path/path/path + NULL */
9748 /* Allocate the symlink buffer and fill it */
9761 npaths++;
9763 }
9771 }
9773 /*
9774 * Check to see if we have a downrev Solaris client, so that we
9775 * can send it a symlink instead of a referral.
9776 */
9777 int
9779 {
9793 }