| blob | 3662a97049c296e83008a717b8047215427233c8 |
1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
23 */
24 /*
25 * Copyright 2012 Nexenta Systems, Inc. All rights reserved.
26 */
28 /*
29 * Copyright (c) 1983,1984,1985,1986,1987,1988,1989 AT&T.
30 * All Rights Reserved
31 */
33 #include <sys/param.h>
34 #include <sys/types.h>
35 #include <sys/systm.h>
36 #include <sys/cred.h>
37 #include <sys/buf.h>
38 #include <sys/vfs.h>
39 #include <sys/vfs_opreg.h>
40 #include <sys/vnode.h>
41 #include <sys/uio.h>
42 #include <sys/errno.h>
43 #include <sys/sysmacros.h>
44 #include <sys/statvfs.h>
45 #include <sys/kmem.h>
46 #include <sys/dirent.h>
47 #include <sys/cmn_err.h>
48 #include <sys/debug.h>
49 #include <sys/systeminfo.h>
50 #include <sys/flock.h>
51 #include <sys/pathname.h>
52 #include <sys/nbmlock.h>
53 #include <sys/share.h>
54 #include <sys/atomic.h>
55 #include <sys/policy.h>
56 #include <sys/fem.h>
57 #include <sys/sdt.h>
58 #include <sys/ddi.h>
59 #include <sys/zone.h>
61 #include <fs/fs_reparse.h>
63 #include <rpc/types.h>
64 #include <rpc/auth.h>
65 #include <rpc/rpcsec_gss.h>
66 #include <rpc/svc.h>
68 #include <nfs/nfs.h>
69 #include <nfs/export.h>
70 #include <nfs/nfs_cmd.h>
71 #include <nfs/lm.h>
72 #include <nfs/nfs4.h>
74 #include <sys/strsubr.h>
75 #include <sys/strsun.h>
77 #include <inet/common.h>
78 #include <inet/ip.h>
79 #include <inet/ip6.h>
81 #include <sys/tsol/label.h>
82 #include <sys/tsol/tndb.h>
90 /* End of Tunables */
94 /*
95 * Used to bump the stateid4.seqid value and show changes in the stateid
96 */
97 #define next_stateid(sp) (++(sp)->bits.chgseq)
99 /*
100 * RFS4_MINLEN_ENTRY4: XDR-encoded size of smallest possible dirent.
101 * This is used to return NFS4ERR_TOOSMALL when clients specify
102 * maxcount that isn't large enough to hold the smallest possible
103 * XDR encoded dirent.
104 *
105 * sizeof cookie (8 bytes) +
106 * sizeof name_len (4 bytes) +
107 * sizeof smallest (padded) name (4 bytes) +
108 * sizeof bitmap4_len (12 bytes) + NOTE: we always encode len=2 bm4
109 * sizeof attrlist4_len (4 bytes) +
110 * sizeof next boolean (4 bytes)
111 *
112 * RFS4_MINLEN_RDDIR4: XDR-encoded size of READDIR op reply containing
113 * the smallest possible entry4 (assumes no attrs requested).
114 * sizeof nfsstat4 (4 bytes) +
115 * sizeof verifier4 (8 bytes) +
116 * sizeof entry4list bool (4 bytes) +
117 * sizeof entry4 (36 bytes) +
118 * sizeof eof bool (4 bytes)
119 *
120 * RFS4_MINLEN_RDDIR_BUF: minimum length of buffer server will provide to
121 * VOP_READDIR. Its value is the size of the maximum possible dirent
122 * for solaris. The DIRENT64_RECLEN macro returns the size of dirent
123 * required for a given name length. MAXNAMELEN is the maximum
124 * filename length allowed in Solaris. The first two DIRENT64_RECLEN()
125 * macros are to allow for . and .. entries -- just a minor tweak to try
126 * and guarantee that buffer we give to VOP_READDIR will be large enough
127 * to hold ., .., and the largest possible solaris dirent64.
128 */
129 #define RFS4_MINLEN_ENTRY4 36
130 #define RFS4_MINLEN_RDDIR4 (4 + NFS4_VERIFIER_SIZE + 4 + RFS4_MINLEN_ENTRY4 + 4)
131 #define RFS4_MINLEN_RDDIR_BUF \
132 (DIRENT64_RECLEN(1) + DIRENT64_RECLEN(2) + DIRENT64_RECLEN(MAXNAMELEN))
134 /*
135 * It would be better to pad to 4 bytes since that's what XDR would do,
136 * but the dirents UFS gives us are already padded to 8, so just take
137 * what we're given. Dircount is only a hint anyway. Currently the
138 * solaris kernel is ASCII only, so there's no point in calling the
139 * UTF8 functions.
140 *
141 * dirent64: named padded to provide 8 byte struct alignment
142 * d_ino(8) + d_off(8) + d_reclen(2) + d_name(namelen + null(1) + pad)
143 *
144 * cookie: uint64_t + utf8namelen: uint_t + utf8name padded to 8 bytes
145 *
146 */
147 #define DIRENT64_TO_DIRCOUNT(dp) \
148 (3 * BYTES_PER_XDR_UNIT + DIRENT64_NAMELEN((dp)->d_reclen))
154 u_longlong_t nfs4_srv_caller_id;
157 verifier4 Write4verf;
158 verifier4 Readdir4verf;
253 /*
254 * translation table for attrs
255 */
260 bool_t vfsstat;
261 };
278 /*
279 * NFS4 op dispatch table
280 */
286 };
289 /*
290 * NFS VERSION 4
291 */
293 /* RFS_NULL = 0 */
296 /* UNUSED = 1 */
299 /* UNUSED = 2 */
302 /* OP_ACCESS = 3 */
305 /* OP_CLOSE = 4 */
308 /* OP_COMMIT = 5 */
311 /* OP_CREATE = 6 */
314 /* OP_DELEGPURGE = 7 */
317 /* OP_DELEGRETURN = 8 */
320 /* OP_GETATTR = 9 */
323 /* OP_GETFH = 10 */
326 /* OP_LINK = 11 */
329 /* OP_LOCK = 12 */
332 /* OP_LOCKT = 13 */
335 /* OP_LOCKU = 14 */
338 /* OP_LOOKUP = 15 */
341 /* OP_LOOKUPP = 16 */
344 /* OP_NVERIFY = 17 */
347 /* OP_OPEN = 18 */
350 /* OP_OPENATTR = 19 */
353 /* OP_OPEN_CONFIRM = 20 */
356 /* OP_OPEN_DOWNGRADE = 21 */
359 /* OP_OPEN_PUTFH = 22 */
362 /* OP_PUTPUBFH = 23 */
365 /* OP_PUTROOTFH = 24 */
368 /* OP_READ = 25 */
371 /* OP_READDIR = 26 */
374 /* OP_READLINK = 27 */
377 /* OP_REMOVE = 28 */
380 /* OP_RENAME = 29 */
383 /* OP_RENEW = 30 */
386 /* OP_RESTOREFH = 31 */
389 /* OP_SAVEFH = 32 */
392 /* OP_SECINFO = 33 */
395 /* OP_SETATTR = 34 */
398 /* OP_SETCLIENTID = 35 */
401 /* OP_SETCLIENTID_CONFIRM = 36 */
404 /* OP_VERIFY = 37 */
407 /* OP_WRITE = 38 */
410 /* OP_RELEASE_LOCKOWNER = 39 */
412 };
416 #define OP_ILLEGAL_IDX (rfsv4disp_cnt)
418 #ifdef DEBUG
465 "rfs4_op_illegal"
466 };
467 #endif
475 #ifdef nextdp
476 #undef nextdp
477 #endif
478 #define nextdp(dp) ((struct dirent64 *)((char *)(dp) + (dp)->d_reclen))
488 NULL, NULL
489 };
499 NULL, NULL
500 };
502 int
504 {
505 timespec32_t verf;
510 /*
511 * The following algorithm attempts to find a unique verifier
512 * to be used as the write verifier returned from the server
513 * to the client. It is important that this verifier change
514 * whenever the server reboots. Of secondary importance, it
515 * is important for the verifier to be unique between two
516 * different servers.
517 *
518 * Thus, an attempt is made to use the system hostid and the
519 * current time in seconds when the nfssrv kernel module is
520 * loaded. It is assumed that an NFS server will not be able
521 * to boot and then to reboot in less than a second. If the
522 * hostid has not been set, then the current high resolution
523 * time is used. This will ensure different verifiers each
524 * time the server reboots and minimize the chances that two
525 * different servers will have the same verifier.
526 * XXX - this is broken on LP64 kernels.
527 */
532 timespec_t tverf;
537 }
544 /* Used to manage create/destroy of server state */
547 /* Used to manage access to server instance linked list */
550 /* Used to manage access to rfs4_deleg_policy */
562 }
563 }
572 }
574 void
576 {
582 }
590 }
592 void
594 {
601 }
603 void
605 {
610 }
612 /*
613 * returns true if the instance's grace period has never been started
614 */
615 int
617 {
625 }
627 /*
628 * Indicates if server instance is within the
629 * grace period.
630 */
631 int
633 {
641 }
643 int
645 {
649 }
651 /*
652 * reset all currently active grace periods
653 */
654 void
656 {
664 }
666 /*
667 * start any new instances' grace periods
668 */
669 void
671 {
679 }
683 {
689 /*
690 * Take a copy of the string, since the original may be overwritten.
691 * Sadly, no strdup() in the kernel.
692 */
693 /* allow for NUL */
698 /* associate with servinst */
702 /*
703 * Add to list of served paths.
704 * No locking required, as we're only ever called at startup.
705 */
707 /* this is the first dss_path_t */
709 /* needed for insque/remque */
715 }
718 }
720 /*
721 * Create a new server instance, and make it the currently active instance.
722 * Note that starting the grace period too early will reduce the clients'
723 * recovery window.
724 */
725 void
727 {
741 /*
742 * This initial dummy entry is required to setup for insque/remque.
743 * It must be skipped over whenever the list is traversed.
744 */
746 /* insque/remque require initial list entry to be self-terminated */
758 }
762 /* add to linked list */
765 }
768 /* make the new instance "current" */
772 }
774 /*
775 * In future, we might add a rfs4_servinst_destroy(sip) but, for now, destroy
776 * all instances directly.
777 */
778 void
780 {
782 #ifdef DEBUG
784 #endif
799 #ifdef DEBUG
800 n++;
801 #endif
802 }
804 }
806 /*
807 * Assign the current server instance to a client_t.
808 * Should be called with cp->rc_dbe held.
809 */
810 void
812 {
815 /*
816 * The lock ensures that if the current instance is in the process
817 * of changing, we will see the new one.
818 */
822 }
824 rfs4_servinst_t *
826 {
830 }
832 /* ARGSUSED */
833 static void
835 {
836 }
838 /*
839 * This is a fall-through for invalid or not implemented (yet) ops
840 */
841 /* ARGSUSED */
842 static void
845 {
847 }
849 /*
850 * Check if the security flavor, nfsnum, is in the flavor_list.
851 */
852 bool_t
854 {
860 }
862 }
864 /*
865 * Used by rfs4_op_secinfo to get the security information from the
866 * export structure associated with the component.
867 */
868 /* ARGSUSED */
869 static nfsstat4
871 {
875 fid_t fid;
886 /*
887 * If dotdotting, then need to check whether it's above the
888 * root of a filesystem, or above an export point.
889 */
892 /*
893 * If dotdotting at the root of a filesystem, then
894 * need to traverse back to the mounted-on filesystem
895 * and do the dotdot lookup there.
896 */
899 /*
900 * If at the system root, then can
901 * go up no further.
902 */
906 /*
907 * Traverse back to the mounted-on filesystem
908 */
911 /*
912 * Set the different_export flag so we remember
913 * to pick up a new exportinfo entry for
914 * this new filesystem.
915 */
919 /*
920 * If dotdotting above an export point then set
921 * the different_export to get new export info.
922 */
924 }
925 }
927 /*
928 * Get the vnode for the component "nm".
929 */
935 /*
936 * If the vnode is in a pseudo filesystem, or if the security flavor
937 * used in the request is valid but not an explicitly shared flavor,
938 * or the access bit indicates that this is a limited access,
939 * check whether this vnode is visible.
940 */
947 }
948 }
950 /*
951 * If it's a mountpoint, then traverse it.
952 */
958 }
959 /* remember that we had to traverse mountpoint */
964 /*
965 * If vp isn't a mountpoint and the vfs ptrs aren't the same,
966 * then vp is probably an LOFS object. We don't need the
967 * realvp, we just need to know that we might have crossed
968 * a server fs boundary and need to call checkexport4.
969 * (LOFS lookup hides server fs mountpoints, and actually calls
970 * traverse)
971 */
973 }
975 /*
976 * Get the export information for it.
977 */
986 }
990 else
995 /*
996 * If this vnode is a mounted-on vnode,
997 * but the mounted-on file system is not
998 * exported, send back the secinfo for
999 * the exported node that the mounted-on
1000 * vnode lives in.
1001 */
1006 }
1007 }
1010 }
1014 /*
1015 * Create the secinfo result based on the security information
1016 * from the exportinfo structure (exi).
1017 *
1018 * Return all flavors for a pseudo node.
1019 * For a real export node, return the flavor that the client
1020 * has access with.
1021 */
1038 /* get oid opaque data */
1047 }
1048 }
1059 /* find out which flavors to return */
1072 ret_cnt++;
1073 }
1074 }
1076 /* Create the returning SECINFO value */
1080 /*
1081 * If the flavor is in the flavor list,
1082 * fill in resok_val.
1083 */
1096 /* get oid opaque data */
1101 KM_SLEEP);
1105 }
1106 k++;
1107 }
1110 }
1114 }
1118 }
1120 /*
1121 * SECINFO (Operation 33): Obtain required security information on
1122 * the component name in the format of (security-mechanism-oid, qop, service)
1123 * triplets.
1124 */
1125 /* ARGSUSED */
1126 static void
1129 {
1133 uint_t len;
1142 /*
1143 * Current file handle (cfh) should have been set before getting
1144 * into this function. If not, return error.
1145 */
1149 }
1154 }
1156 /*
1157 * Verify the component name. If failed, error out, but
1158 * do not error out if the component name is a "..".
1159 * SECINFO will return its parents secinfo data for SECINFO "..".
1160 */
1168 }
1169 }
1175 }
1181 }
1191 }
1200 out:
1203 }
1205 /*
1206 * Free SECINFO result.
1207 */
1208 /* ARGSUSED */
1209 static void
1211 {
1216 /* If this is not an Ok result, nothing to free. */
1219 }
1231 }
1232 }
1236 }
1238 /* ARGSUSED */
1239 static void
1242 {
1252 boolean_t admin_low_client;
1261 }
1262 #endif
1266 }
1272 /*
1273 * If the file system is exported read only, it is not appropriate
1274 * to check write permissions for regular files and directories.
1275 * Special files are interpreted by the client, so the underlying
1276 * permissions are sent back to the client for interpretation.
1277 */
1281 else
1284 /*
1285 * XXX
1286 * We need the mode so that we can correctly determine access
1287 * permissions relative to a mandatory lock file. Access to
1288 * mandatory lock files is denied on the server, so it might
1289 * as well be reflected to the server during the open.
1290 */
1296 }
1310 }
1319 }
1328 }
1335 }
1345 }
1354 }
1362 }
1368 out:
1371 }
1373 /* ARGSUSED */
1374 static void
1377 {
1383 vattr_t va;
1391 }
1395 }
1400 }
1405 /*
1406 * If we can't get the attributes, then we can't do the
1407 * right access checking. So, we'll fail the request.
1408 */
1412 }
1416 }
1421 else
1425 }
1431 }
1438 }
1442 out:
1445 }
1447 /*
1448 * rfs4_op_mknod is called from rfs4_op_create after all initial verification
1449 * was completed. It does the nfsv4 create for special files.
1450 */
1451 /* ARGSUSED */
1455 {
1469 }
1472 else
1487 }
1489 /*
1490 * Must specify the mode.
1491 */
1495 }
1505 }
1507 }
1509 /*
1510 * nfsv4 create is used to create non-regular files. For regular files,
1511 * use nfsv4 open.
1512 */
1513 /* ARGSUSED */
1514 static void
1517 {
1532 nfsstat4 status;
1545 }
1547 /*
1548 * If there is an unshared filesystem mounted on this vnode,
1549 * do not allow to create an object in this directory.
1550 */
1554 }
1556 /* Verify that type is correct */
1568 };
1573 }
1577 }
1582 }
1587 }
1589 /*
1590 * Name of newly created object
1591 */
1596 }
1602 }
1612 }
1634 }
1636 /* Get "before" change value */
1647 }
1652 /*
1653 * Set the default initial values for attributes when the parent
1654 * directory does not have the VSUID/VSGID bit set and they have
1655 * not been specified in createattrs.
1656 */
1660 }
1664 }
1673 }
1678 /*
1679 * Get the initial "after" sequence number, if it fails,
1680 * set to zero
1681 */
1691 }
1693 /*
1694 * symlink names must be treated as data
1695 */
1706 }
1717 }
1731 }
1740 /*
1741 * Get the initial "after" sequence number, if it fails,
1742 * set to zero
1743 */
1753 /*
1754 * va_seq is not safe over VOP calls, check it again
1755 * if it has changed zero out iva to force atomic = FALSE.
1756 */
1763 /*
1764 * probably a special file.
1765 */
1769 }
1771 /*
1772 * We know this will only generate one VOP call
1773 */
1783 }
1785 /*
1786 * Get the initial "after" sequence number, if it fails,
1787 * set to zero
1788 */
1794 }
1801 }
1803 /*
1804 * Force modified data and metadata out to stable storage.
1805 */
1814 }
1816 /*
1817 * Finish setup of cinfo response, "before" value already set.
1818 * Get "after" change value, if it fails, simply return the
1819 * before value.
1820 */
1825 }
1828 /*
1829 * True verification that object was created with correct
1830 * attrs is impossible. The attrs could have been changed
1831 * immediately after object creation. If attributes did
1832 * not verify, the only recourse for the server is to
1833 * destroy the object. Maybe if some attrs (like gid)
1834 * are set incorrectly, the object should be destroyed;
1835 * however, seems bad as a default policy. Do we really
1836 * want to destroy an object over one of the times not
1837 * verifying correctly? For these reasons, the server
1838 * currently sets bits in attrset for createattrs
1839 * that were set; however, no verification is done.
1840 *
1841 * vmask_to_nmask accounts for vattr bits set on create
1842 * [do_rfs4_set_attrs() only sets resp bits for
1843 * non-vattr/vfs bits.]
1844 * Mask off any bits set by default so as not to return
1845 * more attrset bits than were requested in createattrs
1846 */
1854 }
1856 /*
1857 * The cinfo.atomic = TRUE only if we got no errors, we have
1858 * non-zero va_seq's, and it has incremented by exactly one
1859 * during the creation and it didn't change during the VOP_LOOKUP
1860 * or VOP_FSYNC.
1861 */
1865 else
1868 /*
1869 * Force modified metadata out to stable storage.
1870 *
1871 * if a underlying vp exists, pass it to VOP_FSYNC
1872 */
1875 else
1881 }
1887 out:
1890 }
1892 /*ARGSUSED*/
1893 static void
1896 {
1904 }
1906 /*ARGSUSED*/
1907 static void
1910 {
1914 nfsstat4 status;
1924 /* Ensure specified filehandle matches */
1933 out:
1936 }
1938 /*
1939 * Check to see if a given "flavor" is an explicitly shared flavor.
1940 * The assumption of this routine is the "flavor" is already a valid
1941 * flavor in the secinfo list of "exi".
1942 *
1943 * e.g.
1944 * # share -o sec=flavor1 /export
1945 * # share -o sec=flavor2 /export/home
1946 *
1947 * flavor2 is not an explicitly shared flavor for /export,
1948 * however it is in the secinfo list for /export thru the
1949 * server namespace setup.
1950 */
1951 int
1953 {
1962 }
1963 }
1965 /* Should not reach this point based on the assumption */
1967 }
1969 /*
1970 * Check if the security flavor used in the request matches what is
1971 * required at the export point or at the root pseudo node (exi_root).
1972 *
1973 * returns 1 if there's a match or if exported with AUTH_NONE; 0 otherwise.
1974 *
1975 */
1976 static int
1978 {
1982 /*
1983 * Check cs->nfsflavor (from the request) against
1984 * the current export data in cs->exi.
1985 */
1991 }
1994 }
1996 /*
1997 * Check the access authority for the client and return the correct error.
1998 */
1999 nfsstat4
2001 {
2004 /*
2005 * First, check if the security flavor used in the request
2006 * are among the flavors set in the server namespace.
2007 */
2011 }
2025 }
2027 }
2029 /*
2030 * bitmap4_to_attrmask is called by getattr and readdir.
2031 * It sets up the vattr mask and determines whether vfsstat call is needed
2032 * based on the input bitmap.
2033 * Returns nfsv4 status.
2034 */
2035 static nfsstat4
2037 {
2039 uint_t va_mask;
2049 else
2052 /*
2053 * Set rdattr_error_req to true if return error per
2054 * failed entry rather than fail the readdir.
2055 */
2058 else
2061 /*
2062 * generate the va_mask
2063 * Handle the easy cases first
2064 */
2089 }
2091 /*
2092 * Check is vfsstat is needed
2093 */
2099 }
2100 /* NOTREACHED */
2101 }
2103 /*
2104 * bitmap4_get_sysattrs is called by getattr and readdir.
2105 * It calls both VOP_GETATTR and VFS_STATVFS calls to get the attrs.
2106 * Returns nfsv4 status.
2107 */
2108 static nfsstat4
2110 {
2119 }
2120 }
2123 }
2125 static void
2127 {
2129 KM_SLEEP);
2132 }
2134 static void
2137 {
2142 /*
2143 * XXX Should do the same checks for whether the bit is set
2144 */
2149 }
2151 /*
2152 * xdr_free for getattr will be done later
2153 */
2157 }
2158 }
2160 }
2162 /*
2163 * do_rfs4_op_getattr gets the system attrs and converts into fattr4.
2164 */
2165 static nfsstat4
2168 {
2172 XDR xdr;
2173 ulong_t xdr_size;
2184 /* if no bits requested, then return empty fattr4 */
2189 }
2191 /*
2192 * return NFS4ERR_INVAL when client requests write-only attrs
2193 */
2201 /*
2202 * Now loop to get or verify the attrs
2203 */
2212 /*
2213 * Possible error values:
2214 * >0 if sv_getit failed to
2215 * get the attr; 0 if succeeded;
2216 * <0 if rdattr_error and the
2217 * attribute cannot be returned.
2218 */
2221 /*
2222 * If error then just for entry
2223 */
2229 na++;
2234 }
2236 }
2237 }
2238 }
2240 /*
2241 * If rdattr_error was set after the return value for it was assigned,
2242 * update it.
2243 */
2251 }
2258 }
2260 }
2261 }
2268 }
2272 /* freed by rfs4_op_getattr_free() */
2285 }
2286 }
2290 }
2291 done:
2299 }
2301 /* ARGSUSED */
2302 static void
2305 {
2310 nfsstat4 status;
2318 }
2323 }
2335 /* Is this a referral? */
2337 /* Older V4 Solaris client sees a link */
2340 else
2342 }
2346 }
2347 }
2349 out:
2352 }
2354 static void
2356 {
2360 }
2362 /* ARGSUSED */
2363 static void
2366 {
2374 }
2378 }
2380 /* check for reparse point at the share point */
2382 /* it's all bad */
2388 }
2390 /* check for reparse point at vp */
2392 /* it's not all bad */
2397 }
2403 out:
2406 }
2408 static void
2410 {
2418 }
2419 }
2421 /*
2422 * illegal: args: void
2423 * res : status (NFS4ERR_OP_ILLEGAL)
2424 */
2425 /* ARGSUSED */
2426 static void
2429 {
2434 }
2436 /*
2437 * link: args: SAVED_FH: file, CURRENT_FH: target directory
2438 * res: status. If success - CURRENT_FH unchanged, return change_info
2439 */
2440 /* ARGSUSED */
2441 static void
2444 {
2452 uint_t len;
2455 nfsstat4 status;
2460 /* SAVED_FH: source object */
2465 }
2467 /* CURRENT_FH: target directory */
2472 }
2474 /*
2475 * If there is a non-shared filesystem mounted on this vnode,
2476 * do not allow to link any file in this directory.
2477 */
2481 }
2486 }
2488 /* Check source object's type validity */
2492 }
2494 /* Check target directory's type */
2498 }
2503 }
2509 }
2515 }
2521 }
2527 }
2529 /* Get "before" change value */
2536 }
2546 }
2556 /*
2557 * Get the initial "after" sequence number, if it fails, set to zero
2558 */
2563 /*
2564 * Force modified data and metadata out to stable storage.
2565 */
2572 }
2574 /*
2575 * Get "after" change value, if it fails, simply return the
2576 * before value.
2577 */
2582 }
2586 /*
2587 * The cinfo.atomic = TRUE only if we have
2588 * non-zero va_seq's, and it has incremented by exactly one
2589 * during the VOP_LINK and it didn't change during the VOP_FSYNC.
2590 */
2594 else
2598 out:
2601 }
2603 /*
2604 * Used by rfs4_op_lookup and rfs4_op_lookupp to do the actual work.
2605 */
2607 /* ARGSUSED */
2608 static nfsstat4
2610 {
2615 nfsstat4 stat;
2616 fid_t fid;
2626 }
2630 /*
2631 * If dotdotting, then need to check whether it's
2632 * above the root of a filesystem, or above an
2633 * export point.
2634 */
2637 /*
2638 * If dotdotting at the root of a filesystem, then
2639 * need to traverse back to the mounted-on filesystem
2640 * and do the dotdot lookup there.
2641 */
2644 /*
2645 * If at the system root, then can
2646 * go up no further.
2647 */
2651 /*
2652 * Traverse back to the mounted-on filesystem
2653 */
2656 /*
2657 * Set the different_export flag so we remember
2658 * to pick up a new exportinfo entry for
2659 * this new filesystem.
2660 */
2664 /*
2665 * If dotdotting above an export point then set
2666 * the different_export to get new export info.
2667 */
2669 }
2670 }
2677 /*
2678 * If the vnode is in a pseudo filesystem, check whether it is visible.
2679 *
2680 * XXX if the vnode is a symlink and it is not visible in
2681 * a pseudo filesystem, return ENOENT (not following symlink).
2682 * V4 client can not mount such symlink. This is a regression
2683 * from V2/V3.
2684 *
2685 * In the same exported filesystem, if the security flavor used
2686 * is not an explicitly shared flavor, limit the view to the visible
2687 * list entries only. This is not a WRONGSEC case because it's already
2688 * checked via PUTROOTFH/PUTPUBFH or PUTFH.
2689 */
2696 }
2697 }
2699 /*
2700 * If it's a mountpoint, then traverse it.
2701 */
2706 /*
2707 * hold pre_tvp to counteract rele by traverse. We will
2708 * need pre_tvp below if checkexport4 fails
2709 */
2716 }
2720 /*
2721 * The vfsp comparison is to handle the case where
2722 * a LOFS mount is shared. lo_lookup traverses mount points,
2723 * and NFS is unaware of local fs transistions because
2724 * v_vfsmountedhere isn't set. For this special LOFS case,
2725 * the dir and the obj returned by lookup will have different
2726 * vfs ptrs.
2727 */
2729 }
2741 }
2745 else
2750 /*
2751 * If this vnode is a mounted-on vnode,
2752 * but the mounted-on file system is not
2753 * exported, send back the filehandle for
2754 * the mounted-on vnode, not the root of
2755 * the mounted-on file system.
2756 */
2763 }
2765 /* we're done with pre_tvp now. release extra hold */
2767 }
2771 /*
2772 * Now we do a checkauth4. The reason is that
2773 * this client/user may not have access to the new
2774 * exported file system, and if he does,
2775 * the client/user may be mapped to a different uid.
2776 *
2777 * We start with a new cr, because the checkauth4 done
2778 * in the PUT*FH operation over wrote the cred's uid,
2779 * gid, etc, and we want the real thing before calling
2780 * checkauth4()
2781 */
2794 }
2795 }
2797 /*
2798 * After various NFS checks, do a label check on the path
2799 * component. The label on this path should either be the
2800 * global zone's label or a zone's label. We are only
2801 * interested in the zone's label because exported files
2802 * in global zone is accessible (though read-only) to
2803 * clients. The exportability/visibility check is already
2804 * done before reaching this code.
2805 */
2819 }
2821 /*
2822 * We grant access to admin_low label clients
2823 * only if the client is trusted, i.e. also
2824 * running Solaris Trusted Extension.
2825 */
2840 }
2844 SUN_CIPSO) {
2849 }
2851 }
2852 }
2856 err_out:
2864 }
2873 /*
2874 * if did lookup on attrdir and didn't lookup .., set named
2875 * attr fh flag
2876 */
2880 /* Assume false for now, open proc will set this */
2884 }
2886 /* ARGSUSED */
2887 static void
2890 {
2894 uint_t len;
2897 nfsstat4 status;
2905 }
2910 }
2915 }
2921 }
2927 }
2933 }
2943 }
2951 out:
2954 }
2956 /* ARGSUSED */
2957 static void
2960 {
2968 }
2973 }
2977 /*
2978 * From NFSV4 Specification, LOOKUPP should not check for
2979 * NFS4ERR_WRONGSEC. Retrun NFS4_OK instead.
2980 */
2983 }
2985 out:
2988 }
2991 /*ARGSUSED2*/
2992 static void
2995 {
3008 }
3014 }
3016 /*
3017 * If file system supports passing ACE mask to VOP_ACCESS then
3018 * check for ACE_READ_NAMED_ATTRS, otherwise do legacy checks
3019 */
3024 else
3032 }
3034 /*
3035 * The CREATE_XATTR_DIR VOP flag cannot be specified if
3036 * the file system is exported read-only -- regardless of
3037 * createdir flag. Otherwise the attrdir would be created
3038 * (assuming server fs isn't mounted readonly locally). If
3039 * VOP_LOOKUP returns ENOENT in this case, the error will
3040 * be translated into EROFS. ENOSYS is mapped to ENOTSUP
3041 * because specfs has no VOP_LOOKUP op, so the macro would
3042 * return ENOSYS. EINVAL is returned by all (current)
3043 * Solaris file system implementations when any of their
3044 * restrictions are violated (xattr(dir) can't have xattrdir).
3045 * Returning NOTSUPP is more appropriate in this case
3046 * because the object will never be able to have an attrdir.
3047 */
3059 else
3062 }
3072 }
3077 /*
3078 * There is no requirement for an attrdir fh flag
3079 * because the attrdir has a vnode flag to distinguish
3080 * it from regular (non-xattr) directories. The
3081 * FH4_ATTRDIR flag is set for future sanity checks.
3082 */
3086 out:
3089 }
3091 static int
3094 {
3101 /*
3102 * Don't block on mandatory locks. If this routine returns
3103 * EAGAIN, the caller should return NFS4ERR_LOCKED.
3104 */
3118 }
3126 }
3127 }
3130 }
3132 /* ARGSUSED */
3133 static void
3136 {
3145 u_offset_t offset;
3147 nfsstat4 stat;
3153 caller_context_t ct;
3163 }
3167 }
3173 }
3175 /*
3176 * Enter the critical region before calling VOP_RWLOCK
3177 * to avoid a deadlock with write requests.
3178 */
3186 }
3187 }
3193 }
3199 }
3201 }
3203 /* use loaned buffers for TCP */
3209 /*
3210 * If we can't get the attributes, then we can't do the
3211 * right access checking. So, we'll fail the request.
3212 */
3216 }
3222 }
3229 }
3234 }
3243 /* RDMA */
3250 }
3258 /* RDMA */
3264 }
3266 /*
3267 * Do not allocate memory more than maximum allowed
3268 * transfer size
3269 */
3280 /* Jump to do the read if successful */
3282 /*
3283 * Need to hold the vnode until after VOP_RETZCBUF()
3284 * is called.
3285 */
3288 }
3295 /* failure to setup for zero copy */
3298 }
3300 /*
3301 * If returning data via RDMA Write, then grab the chunk list. If we
3302 * aren't returning READ data w/RDMA_WRITE, then grab a mblk.
3303 */
3308 /*
3309 * mp will contain the data to be sent out in the read reply.
3310 * It will be freed after the reply has been sent. Let's
3311 * roundup the data to a BYTES_PER_XDR_UNIT multiple, so that
3312 * the call to xdrmblk_putmblk() never fails. If the first
3313 * alloc of the requested size fails, then decrease the size to
3314 * something more reasonable and wait for the allocation to
3315 * occur.
3316 */
3323 }
3329 }
3339 doio_read:
3350 }
3352 /* make mblk using zc buffers */
3356 }
3367 }
3373 else
3379 }
3382 }
3384 out:
3390 }
3392 static void
3394 {
3402 }
3403 }
3405 static void
3407 {
3414 }
3415 }
3418 /* ARGSUSED */
3419 static void
3422 {
3434 }
3445 }
3451 }
3454 /*
3455 * No filesystem is actually shared public, so we default
3456 * to exi_root. In this case, we must check whether root
3457 * is exported.
3458 */
3461 /*
3462 * if root filesystem is exported, the exportinfo struct that we
3463 * should use is what checkexport4 returns, because root_exi is
3464 * actually a mostly empty struct.
3465 */
3470 /*
3471 * it's a properly shared filesystem
3472 */
3474 }
3488 NFS4ERR_SERVERFAULT;
3490 }
3491 }
3492 }
3502 }
3505 out:
3508 }
3510 /*
3511 * XXX - issue with put*fh operations. Suppose /export/home is exported.
3512 * Suppose an NFS client goes to mount /export/home/joe. If /export, home,
3513 * or joe have restrictive search permissions, then we shouldn't let
3514 * the client get a file handle. This is easy to enforce. However, we
3515 * don't know what security flavor should be used until we resolve the
3516 * path name. Another complication is uid mapping. If root is
3517 * the user, then it will be mapped to the anonymous user by default,
3518 * but we won't know that till we've resolved the path name. And we won't
3519 * know what the anonymous user is.
3520 * Luckily, SECINFO is specified to take a full filename.
3521 * So what we will have to in rfs4_op_lookup is check that flavor of
3522 * the target object matches that of the request, and if root was the
3523 * caller, check for the root= and anon= options, and if necessary,
3524 * repeat the lookup using the right cred_t. But that's not done yet.
3525 */
3526 /* ARGSUSED */
3527 static void
3530 {
3541 }
3546 }
3552 }
3556 NULL);
3561 }
3570 }
3576 }
3582 out:
3585 }
3587 /* ARGSUSED */
3588 static void
3591 {
3594 fid_t fid;
3602 }
3609 /*
3610 * Using rootdir, the system root vnode,
3611 * get its fid.
3612 */
3619 }
3621 /*
3622 * Then use the root fsid & fid it to find out if it's exported
3623 *
3624 * If the server root isn't exported directly, then
3625 * it should at least be a pseudo export based on
3626 * one or more exports further down in the server's
3627 * file tree.
3628 */
3635 }
3637 /*
3638 * Now make a filehandle based on the root
3639 * export and root vnode.
3640 */
3645 }
3658 }
3662 out:
3665 }
3667 /*
3668 * A directory entry is a valid nfsv4 entry if
3669 * - it has a non-zero ino
3670 * - it is not a dot or dotdot name
3671 * - it is visible in a pseudo export or in a real export that can
3672 * only have a limited view.
3673 */
3674 static bool_t
3677 {
3681 }
3686 }
3689 }
3691 /*
3692 * set_rdattr_params sets up the variables used to manage what information
3693 * to get for each directory entry.
3694 */
3695 static nfsstat4
3698 {
3699 uint_t va_mask;
3700 nfsstat4 status;
3701 bitmap4 objbits;
3705 /*
3706 * could not even figure attr mask
3707 */
3709 }
3712 /*
3713 * dirent's d_ino is always correct value for mounted_on_fileid.
3714 * mntdfid_set is set once here, but mounted_on_fileid is
3715 * set in main dirent processing loop for each dirent.
3716 * The mntdfid_set is a simple optimization that lets the
3717 * server attr code avoid work when caller is readdir.
3718 */
3721 /*
3722 * Lookup entry only if client asked for any of the following:
3723 * a) vattr attrs
3724 * b) vfs attrs
3725 * c) attrs w/per-object scope requested (change, filehandle, etc)
3726 * other than mounted_on_fileid (which we can take from dirent)
3727 */
3732 else
3738 /*
3739 * If filesystem attrs are requested, get them now from the
3740 * directory vp, as most entries will have same filesystem. The only
3741 * exception are mounted over entries but we handle
3742 * those as we go (XXX mounted over detection not yet implemented).
3743 */
3749 /*
3750 * Failed to get filesystem attributes.
3751 * Return a rdattr_error for each entry, but don't fail.
3752 * However, don't get any obj-dependent attrs.
3753 */
3756 /*
3757 * At least get fileid for regular readdir output
3758 */
3761 }
3764 }
3766 /*
3767 * readlink: args: CURRENT_FH.
3768 * res: status. If success - CURRENT_FH unchanged, return linktext.
3769 */
3771 /* ARGSUSED */
3772 static void
3775 {
3789 /* CURRENT_FH: directory */
3794 }
3799 }
3801 /* Is it a referral? */
3813 }
3818 }
3820 }
3827 }
3832 }
3840 /* Get an artificial symlink based on a referral */
3851 }
3868 }
3874 }
3881 /*
3882 * Even though the conversion failed, we return
3883 * something. We just don't translate it.
3884 */
3886 }
3888 /*
3889 * treat link name as data
3890 */
3898 out:
3901 }
3903 static void
3905 {
3911 }
3912 }
3914 /*
3915 * release_lockowner:
3916 * Release any state associated with the supplied
3917 * lockowner. Note if any lo_state is holding locks we will not
3918 * rele that lo_state and thus the lockowner will not be destroyed.
3919 * A client using lock after the lock owner stateid has been released
3920 * will suffer the consequence of NFS4ERR_BAD_STATEID and would have
3921 * to reissue the lock with new_lock_owner set to TRUE.
3922 * args: lock_owner
3923 * res: status
3924 */
3925 /* ARGSUSED */
3926 static void
3929 {
3939 sysid_t sysid;
3944 /* Make sure there is a clientid around for this request */
3951 }
3958 }
3961 /*
3962 * Check for EXPIRED client. If so will reap state with in a lease
3963 * period or on next set_clientid_confirm step
3964 */
3969 }
3971 /*
3972 * If no sysid has been assigned, then no locks exist; just return.
3973 */
3979 }
3984 /*
3985 * Mark the lockowner invalid.
3986 */
3989 /*
3990 * sysid-pid pair should now not be used since the lockowner is
3991 * invalid. If the client were to instantiate the lockowner again
3992 * it would be assigned a new pid. Thus we can get the list of
3993 * current locks.
3994 */
3997 /* If we are still holding locks fail */
4003 /*
4004 * We need to unhide the lockowner so the client can
4005 * try it again. The bad thing here is if the client
4006 * has a logic error that took it here in the first place
4007 * he probably has lost accounting of the locks that it
4008 * is holding. So we may have dangling state until the
4009 * open owner state is reaped via close. One scenario
4010 * that could possibly occur is that the client has
4011 * sent the unlock request(s) in separate threads
4012 * and has not waited for the replies before sending the
4013 * RELEASE_LOCKOWNER request. Presumably, it would expect
4014 * and deal appropriately with NFS4ERR_LOCKS_HELD, by
4015 * reissuing the request.
4016 */
4020 }
4022 /*
4023 * For the corresponding client we need to check each open
4024 * owner for any opens that have lockowner state associated
4025 * with this lockowner.
4026 */
4044 }
4045 }
4047 }
4049 }
4056 out:
4059 }
4061 /*
4062 * short utility function to lookup a file and recall the delegation
4063 */
4067 {
4082 else
4084 }
4090 }
4092 /*
4093 * remove: args: CURRENT_FH: directory; name.
4094 * res: status. If success - CURRENT_FH unchanged, return change_info
4095 * for directory.
4096 */
4097 /* ARGSUSED */
4098 static void
4101 {
4108 uint_t len;
4114 nfsstat4 status;
4119 /* CURRENT_FH: directory */
4124 }
4129 }
4131 /*
4132 * If there is an unshared filesystem mounted on this vnode,
4133 * Do not allow to remove anything in this directory.
4134 */
4138 }
4143 }
4149 }
4151 /*
4152 * Lookup the file so that we can check if it's a directory
4153 */
4158 }
4164 }
4170 }
4180 }
4182 /*
4183 * Lookup the file to determine type and while we are see if
4184 * there is a file struct around and check for delegation.
4185 * We don't need to acquire va_seq before this lookup, if
4186 * it causes an update, cinfo.before will not match, which will
4187 * trigger a cache flush even if atomic is TRUE.
4188 */
4191 NULL)) {
4199 }
4200 }
4202 /* Didn't find anything to remove */
4209 }
4224 }
4226 }
4227 }
4229 /* check label before allowing removal */
4249 }
4251 }
4252 }
4253 }
4255 /* Get dir "before" change value */
4269 }
4271 }
4274 /* Actually do the REMOVE operation */
4276 /*
4277 * Can't remove a directory that has a mounted-on filesystem.
4278 */
4282 /*
4283 * System V defines rmdir to return EEXIST,
4284 * not ENOTEMPTY, if the directory is not
4285 * empty. A System V NFS server needs to map
4286 * NFS4ERR_EXIST to NFS4ERR_NOTEMPTY to
4287 * transmit over the wire.
4288 */
4292 }
4306 /*
4307 * This is va_seq safe because we are not
4308 * manipulating dvp.
4309 */
4313 /* Remove state on file remove */
4317 }
4319 }
4321 }
4322 }
4323 }
4332 }
4340 }
4342 /*
4343 * Get the initial "after" sequence number, if it fails, set to zero
4344 */
4349 /*
4350 * Force modified data and metadata out to stable storage.
4351 */
4354 /*
4355 * Get "after" change value, if it fails, simply return the
4356 * before value.
4357 */
4362 }
4366 /*
4367 * The cinfo.atomic = TRUE only if we have
4368 * non-zero va_seq's, and it has incremented by exactly one
4369 * during the VOP_REMOVE/RMDIR and it didn't change during
4370 * the VOP_FSYNC.
4371 */
4375 else
4380 out:
4383 }
4385 /*
4386 * rename: args: SAVED_FH: from directory, CURRENT_FH: target directory,
4387 * oldname and newname.
4388 * res: status. If success - CURRENT_FH unchanged, return change_info
4389 * for both from and target directories.
4390 */
4391 /* ARGSUSED */
4392 static void
4395 {
4413 nfsstat4 status;
4423 /* CURRENT_FH: target directory */
4428 }
4430 /* SAVED_FH: from directory */
4435 }
4440 }
4442 /*
4443 * If there is an unshared filesystem mounted on this vnode,
4444 * do not allow to rename objects in this directory.
4445 */
4449 }
4451 /*
4452 * If there is an unshared filesystem mounted on this vnode,
4453 * do not allow to rename to this directory.
4454 */
4458 }
4463 }
4468 }
4474 }
4480 }
4486 }
4490 nlen);
4496 }
4505 }
4517 }
4525 }
4537 }
4539 /* check label of the target dir */
4551 }
4552 }
4553 }
4555 /*
4556 * Is the source a file and have a delegation?
4557 * We don't need to acquire va_seq before these lookups, if
4558 * it causes an update, cinfo.before will not match, which will
4559 * trigger a cache flush even if atomic is TRUE.
4560 */
4564 NULL)) {
4567 }
4568 }
4579 }
4583 /* Does the destination exist and a file and have a delegation? */
4587 NULL)) {
4590 }
4591 }
4595 /* Check for NBMAND lock on both source and target */
4602 }
4603 }
4611 }
4612 }
4614 /* Get source "before" change value */
4620 }
4624 }
4644 /* The file is gone and so should the state */
4648 }
4650 }
4652 }
4653 }
4669 }
4673 }
4682 /*
4683 * Get the initial "after" sequence number, if it fails, set to zero
4684 */
4693 /*
4694 * Force modified data and metadata out to stable storage.
4695 */
4702 }
4704 /*
4705 * Get "after" change values, if it fails, simply return the
4706 * before value.
4707 */
4712 }
4718 }
4723 /*
4724 * The cinfo.atomic = TRUE only if we have
4725 * non-zero va_seq's, and it has incremented by exactly one
4726 * during the VOP_RENAME and it didn't change during the VOP_FSYNC.
4727 */
4731 else
4737 else
4740 #ifdef VOLATILE_FH_TEST
4741 {
4744 /*
4745 * Add the renamed file handle to the volatile rename list
4746 */
4748 /* file handles may expire on rename */
4752 /*
4753 * Already know that nnm will be a valid string
4754 */
4761 }
4762 }
4763 }
4767 out:
4772 err_out:
4789 }
4793 }
4797 }
4799 /* ARGSUSED */
4800 static void
4803 {
4815 }
4821 }
4831 }
4836 out:
4839 }
4841 /* ARGSUSED */
4842 static void
4845 {
4850 /* No need to check cs->access - we are not accessing any object */
4854 }
4857 }
4865 out:
4868 }
4870 /* ARGSUSED */
4871 static void
4874 {
4879 /* No need to check cs->access - we are not accessing any object */
4883 }
4886 }
4890 /*
4891 * since SAVEFH is fairly rare, don't alloc space for its fh
4892 * unless necessary.
4893 */
4896 }
4900 out:
4903 }
4905 /*
4906 * rfs4_verify_attr is called when nfsv4 Setattr failed, but we wish to
4907 * return the bitmap of attrs that were set successfully. It is also
4908 * called by Verify/Nverify to test the vattr/vfsstat attrs. It should
4909 * always be called only after rfs4_do_set_attrs().
4910 *
4911 * Verify that the attributes are same as the expected ones. sargp->vap
4912 * and sargp->sbp contain the input attributes as translated from fattr4.
4913 *
4914 * This function verifies only the attrs that correspond to a vattr or
4915 * vfsstat struct. That is because of the extra step needed to get the
4916 * corresponding system structs. Other attributes have already been set or
4917 * verified by do_rfs4_set_attrs.
4918 *
4919 * Return 0 if all attrs match, -1 if some don't, error if error processing.
4920 */
4921 static int
4924 {
4928 uint_t vbit;
4934 /*
4935 * Okay to overwrite sargp->vap because we verify based
4936 * on the incoming values.
4937 */
4943 /*
4944 * Must return bitmap of successful attrs
4945 */
4948 /*
4949 * Some file systems clobber va_mask. it is probably
4950 * wrong of them to do so, nonethless we practice
4951 * defensive coding.
4952 * See bug id 4276830.
4953 */
4955 }
4956 }
4959 /*
4960 * Now get the superblock and loop on the bitmap, as there is
4961 * no simple way of translating from superblock to bitmap4.
4962 */
4968 }
4969 }
4971 /*
4972 * Now loop and verify each attribute which getattr returned
4973 * whether it's the same as the input.
4974 */
4986 /*
4987 * If vattr attribute but VOP_GETATTR failed, or it's
4988 * superblock attribute but VFS_STATVFS failed, skip
4989 */
4995 }
5003 }
5007 }
5008 }
5009 errout:
5011 }
5013 /*
5014 * Decode the attribute to be set/verified. If the attr requires a sys op
5015 * (VOP_GETATTR, VFS_VFSSTAT), and the request is to verify, then don't
5016 * call the sv_getit function for it, because the sys op hasn't yet been done.
5017 * Return 0 for success, error code if failed.
5018 *
5019 * Note: the decoded arg is not freed here but in nfs4_ntov_table_free.
5020 */
5021 static int
5024 {
5026 bool_t set_later;
5032 /*
5033 * don't verify yet if a vattr or sb dependent attr,
5034 * because we don't have their sys values yet.
5035 * Will be done later.
5036 */
5038 /*
5039 * ACLs are a special case, since setting the MODE
5040 * conflicts with setting the ACL. We delay setting
5041 * the ACL until all other attributes have been set.
5042 * The ACL gets set in do_rfs4_op_setattr().
5043 */
5050 }
5051 }
5052 }
5054 #ifdef DEBUG
5057 #endif
5059 }
5062 }
5065 }
5067 /*
5068 * Set vattr based on incoming fattr4 attrs - used by setattr.
5069 * Set response mask. Ignore any values that are not writable vattr attrs.
5070 */
5071 static nfsstat4
5074 nfs4_attr_cmd_t cmd)
5075 {
5080 XDR xdr;
5086 #ifndef lint
5087 /*
5088 * Make sure that maximum attribute number can be expressed as an
5089 * 8 bit quantity.
5090 */
5092 #endif
5098 }
5103 }
5111 /* sargp->sbp is set by the caller */
5118 /*
5119 * The following loop iterates on the nfs4_ntov_map checking
5120 * if the fbit is set in the requested bitmap.
5121 * If set then we process the arguments using the
5122 * rfs4_fattr4 conversion functions to populate the setattr
5123 * vattr and va_mask. Any settable attrs that are not using vattr
5124 * will be set in this loop.
5125 */
5129 }
5130 /*
5131 * If setattr, must be a writable attr.
5132 * If verify/nverify, must be a readable attr.
5133 */
5136 /*
5137 * Client tries to set/verify an
5138 * unsupported attribute, tries to set
5139 * a read only attr or verify a write
5140 * only one - error!
5141 */
5143 }
5144 /*
5145 * Decode the attribute to set/verify
5146 */
5152 na++;
5156 }
5163 }
5165 static nfsstat4
5168 {
5171 bool_t trunc;
5182 caller_context_t ct;
5189 NFS4ATTR_SETIT);
5191 /*
5192 * failed set attrs
5193 */
5195 }
5198 /*
5199 * no further work to be done
5200 */
5202 }
5204 /*
5205 * If we got a request to set the ACL and the MODE, only
5206 * allow changing VSUID, VSGID, and VSVTX. Attempting
5207 * to change any other bits, along with setting an ACL,
5208 * gives NFS4ERR_INVAL.
5209 */
5212 vattr_t va;
5219 }
5224 }
5225 }
5227 /* Check stateid only if size has been set */
5239 }
5241 /* XXX start of possible race with delegations */
5243 /*
5244 * We need to specially handle size changes because it is
5245 * possible for the client to create a file with read-only
5246 * modes, but with the file opened for writing. If the client
5247 * then tries to set the file size, e.g. ftruncate(3C),
5248 * fcntl(F_FREESP), the normal access checking done in
5249 * VOP_SETATTR would prevent the client from doing it even though
5250 * it should be allowed to do so. To get around this, we do the
5251 * access checking for ourselves and use VOP_SPACE which doesn't
5252 * do the access checking.
5253 * Also the client should not be allowed to change the file
5254 * size if there is a conflicting non-blocking mandatory lock in
5255 * the region of the change.
5256 */
5258 u_offset_t offset;
5259 ssize_t length;
5261 /*
5262 * ufs_setattr clears AT_SIZE from vap->va_mask, but
5263 * before returning, sarg.vap->va_mask is used to
5264 * generate the setattr reply bitmap. We also clear
5265 * AT_SIZE below before calling VOP_SPACE. For both
5266 * of these cases, the va_mask needs to be saved here
5267 * and restored after calling VOP_SETATTR.
5268 */
5271 /*
5272 * Check any possible conflict due to NBMAND locks.
5273 * Get into critical region before VOP_GETATTR, so the
5274 * size attribute is valid when checking conflicts.
5275 */
5279 }
5285 }
5294 }
5299 }
5300 }
5312 }
5313 }
5318 /* restore va_mask -- ufs_setattr clears AT_SIZE */
5322 /*
5323 * If an ACL was being set, it has been delayed until now,
5324 * in order to set the mode (via the VOP_SETATTR() above) first.
5325 */
5341 }
5347 }
5348 }
5351 /* check if a monitor detected a delegation conflict */
5354 else
5357 /*
5358 * Set the response bitmap when setattr failed.
5359 * If VOP_SETATTR partially succeeded, test by doing a
5360 * VOP_GETATTR on the object and comparing the data
5361 * to the setattr arguments.
5362 */
5365 /*
5366 * Force modified metadata out to stable storage.
5367 */
5369 /*
5370 * Set response bitmap
5371 */
5373 }
5375 /* Return early and already have a NFSv4 error */
5376 done:
5377 /*
5378 * Except for nfs4_vmask_to_nmask_set(), vattr --> fattr
5379 * conversion sets both readable and writeable NFS4 attrs
5380 * for AT_MTIME and AT_ATIME. The line below masks out
5381 * unrequested attrs from the setattr result bitmap. This
5382 * is placed after the done: label to catch the ATTRNOTSUP
5383 * case.
5384 */
5393 }
5395 /* ARGSUSED */
5396 static void
5399 {
5410 }
5412 /*
5413 * If there is an unshared filesystem mounted on this vnode,
5414 * do not allow to setattr on this vnode.
5415 */
5419 }
5426 }
5428 /* check label before setting attributes */
5440 }
5441 }
5442 }
5448 out:
5451 }
5453 /* ARGSUSED */
5454 static void
5457 {
5458 /*
5459 * verify and nverify are exactly the same, except that nverify
5460 * succeeds when some argument changed, and verify succeeds when
5461 * when none changed.
5462 */
5478 }
5486 /*
5487 * do_rfs4_set_attrs will try to verify systemwide attrs,
5488 * so could return -1 for "no match".
5489 */
5493 }
5505 }
5506 done:
5509 out:
5512 }
5514 /* ARGSUSED */
5515 static void
5518 {
5519 /*
5520 * verify and nverify are exactly the same, except that nverify
5521 * succeeds when some argument changed, and verify succeeds when
5522 * when none changed.
5523 */
5541 }
5548 /*
5549 * do_rfs4_set_attrs will try to verify systemwide attrs,
5550 * so could return -1 for "no match".
5551 */
5555 }
5567 }
5568 done:
5574 }
5576 /*
5577 * XXX - This should live in an NFS header file.
5578 */
5579 #define MAX_IOVECS 12
5581 /* ARGSUSED */
5582 static void
5585 {
5591 u_offset_t rlimit;
5599 nfsstat4 stat;
5601 caller_context_t ct;
5610 }
5614 }
5622 }
5624 /*
5625 * We have to enter the critical region before calling VOP_RWLOCK
5626 * to avoid a deadlock with ufs.
5627 */
5635 }
5636 }
5641 /*
5642 * If we can't get the attributes, then we can't do the
5643 * right access checking. So, we'll fail the request.
5644 */
5648 }
5653 }
5659 }
5665 }
5670 }
5678 }
5690 iovcnt++;
5692 }
5693 #ifdef DEBUG
5694 /* should have ended on an mblk boundary */
5701 }
5702 #endif
5707 }
5719 }
5744 }
5746 /*
5747 * We're changing creds because VM may fault and we need
5748 * the cred of the current thread to be used if quota
5749 * checking is enabled.
5750 */
5762 }
5769 else
5774 out:
5780 }
5783 /* XXX put in a header file */
5786 void
5789 {
5790 uint_t i;
5796 /*
5797 * Form a reply tag by copying over the reqeuest tag.
5798 */
5808 /*
5809 * XXX for now, minorversion should be zero
5810 */
5820 }
5838 }
5841 KM_SLEEP);
5848 /*
5849 * For now, NFS4 compound processing must be protected by
5850 * exported_lock because it can access more than one exportinfo
5851 * per compound and share/unshare can now change multiple
5852 * exinfo structs. The NFS2/3 code only refs 1 exportinfo
5853 * per proc (excluding public exinfo), and exi_count design
5854 * is sufficient to protect concurrent execution of NFS2/3
5855 * ops along with unexport. This lock will be removed as
5856 * part of the NFSv4 phase 2 namespace redesign work.
5857 */
5860 /*
5861 * If this is the first compound we've seen, we need to start all
5862 * new instances' grace periods.
5863 */
5866 /*
5867 * This must be set after rfs4_grace_start_new(), otherwise
5868 * another thread could proceed past here before the former
5869 * is finished.
5870 */
5872 }
5877 uint_t op;
5885 /*
5886 * Count the individual ops here; NULL and COMPOUND
5887 * are counted in common_dispatch()
5888 */
5899 /*
5900 * This is effectively dead code since XDR code
5901 * will have already returned BADXDR if op doesn't
5902 * decode to legal value. This only done for a
5903 * day when XDR code doesn't verify v4 opcodes.
5904 */
5910 }
5912 /*
5913 * If not at last op, and if we are to stop, then
5914 * compact the results array.
5915 */
5926 }
5927 }
5945 /*
5946 * done with this compound request, free the label
5947 */
5952 }
5953 }
5955 /*
5956 * XXX because of what appears to be duplicate calls to rfs4_compound_free
5957 * XXX zero out the tag and array values. Need to investigate why the
5958 * XXX calls occur, but at least prevent the panic for now.
5959 */
5960 void
5962 {
5963 uint_t i;
5967 }
5971 uint_t op;
5977 }
5978 }
5981 }
5982 }
5984 /*
5985 * Process the value of the compound request rpc flags, as a bit-AND
5986 * of the individual per-op flags (idempotent, allowork, publicfh_ok)
5987 */
5988 void
5990 {
5995 uint_t op;
6001 else
6003 }
6005 }
6007 nfsstat4
6009 {
6010 nfsstat4 e;
6029 }
6031 #if defined(DEBUG) && ! defined(lint)
6033 {
6045 }
6055 }
6061 }
6063 #define LOCK_PRINT(d, s, t, f) if (d) lock_print(s, t, f)
6064 #else
6065 #define LOCK_PRINT(d, s, t, f)
6066 #endif
6068 /*ARGSUSED*/
6069 static bool_t
6071 {
6073 }
6075 /*
6076 * Look up the pathname using the vp in cs as the directory vnode.
6077 * cs->vp will be the vnode for the file on success
6078 */
6080 static nfsstat4
6083 {
6086 nfsstat4 status;
6092 }
6095 }
6104 }
6109 }
6118 }
6128 }
6130 static nfsstat4
6133 {
6134 nfsstat4 status;
6139 /* Get "before" change value */
6145 /* rfs4_lookup may VN_RELE directory */
6152 }
6154 /*
6155 * Get "after" change value, if it fails, simply return the
6156 * before value.
6157 */
6162 }
6165 /*
6166 * Validate the file is a file
6167 */
6179 }
6184 /*
6185 * It is undefined if VOP_LOOKUP will change va_seq, so
6186 * cinfo.atomic = TRUE only if we have
6187 * non-zero va_seq's, and they have not changed.
6188 */
6191 else
6194 /* Check for mandatory locking */
6197 }
6199 static nfsstat4
6202 {
6205 vattr_t va;
6207 tryagain:
6209 /*
6210 * The file open mode used is VWRITE. If the client needs
6211 * some other semantic, then it should do the access checking
6212 * itself. It would have been nice to have the file open mode
6213 * passed as part of the arguments.
6214 */
6222 /*
6223 * If we got something other than file already exists
6224 * then just return this error. Otherwise, we got
6225 * EEXIST. If we were doing a GUARDED create, then
6226 * just return this error. Otherwise, we need to
6227 * make sure that this wasn't a duplicate of an
6228 * exclusive create request.
6229 *
6230 * The assumption is made that a non-exclusive create
6231 * request will never return EEXIST.
6232 */
6237 }
6242 /*
6243 * We couldn't find the file that we thought that
6244 * we just created. So, we'll just try creating
6245 * it again.
6246 */
6252 }
6255 /* existing object must be regular file */
6261 else
6265 }
6268 }
6270 /* Check for duplicate request */
6275 /* We found the file */
6278 /* but its not our creation */
6281 }
6284 }
6287 }
6290 }
6292 static nfsstat4
6295 {
6298 bool_t readonly;
6301 /* For now we don't allow mandatory locking as per V2/V3 */
6304 }
6309 /*
6310 * If the file system is exported read only and we are trying
6311 * to open for write, then return NFS4ERR_ROFS
6312 */
6323 }
6324 }
6330 }
6333 }
6335 static nfsstat4
6338 {
6344 nfsstat4 status;
6350 uint_t buflen;
6351 bool_t created;
6353 len_t reqsize;
6355 bool_t trunc;
6356 caller_context_t ct;
6367 /* Check if the file system is read only */
6371 /* check the label of including directory */
6382 }
6383 }
6384 }
6386 /*
6387 * Get the last component of path name in nm. cs will reference
6388 * the including directory on success.
6389 */
6403 }
6410 }
6415 }
6421 /*FALLTHROUGH*/
6437 else
6439 }
6446 }
6455 }
6459 /* Disallow create with a non-zero size */
6466 }
6468 }
6472 /* prohibit EXCL create of named attributes */
6477 }
6481 /*
6482 * Ensure no time overflows. Assumes underlying
6483 * filesystem supports at least 32 bits.
6484 * Truncate nsec to usec resolution to allow valid
6485 * compares even if the underlying filesystem truncates.
6486 */
6493 /*
6494 * For EXCL create, attrset is set to the server attr
6495 * used to cache the client's verifier.
6496 */
6499 }
6508 }
6521 }
6528 /*
6529 * True verification that object was created with correct
6530 * attrs is impossible. The attrs could have been changed
6531 * immediately after object creation. If attributes did
6532 * not verify, the only recourse for the server is to
6533 * destroy the object. Maybe if some attrs (like gid)
6534 * are set incorrectly, the object should be destroyed;
6535 * however, seems bad as a default policy. Do we really
6536 * want to destroy an object over one of the times not
6537 * verifying correctly? For these reasons, the server
6538 * currently sets bits in attrset for createattrs
6539 * that were set; however, no verification is done.
6540 *
6541 * vmask_to_nmask accounts for vattr bits set on create
6542 * [do_rfs4_set_attrs() only sets resp bits for
6543 * non-vattr/vfs bits.]
6544 * Mask off any bits we set by default so as not to return
6545 * more attrset bits than were requested in createattrs
6546 */
6551 /*
6552 * We did not create the vnode (we tried but it
6553 * already existed). In this case, the only createattr
6554 * that the spec allows the server to set is size,
6555 * and even then, it can only be set if it is 0.
6556 */
6560 }
6561 }
6565 /*
6566 * Get the initial "after" sequence number, if it fails,
6567 * set to zero, time to before.
6568 */
6573 }
6575 /*
6576 * create_vnode attempts to create the file exclusive,
6577 * if it already exists the VOP_CREATE will fail and
6578 * may not increase va_seq. It is atomic if
6579 * we haven't changed the directory, but if it has changed
6580 * we don't know what changed it.
6581 */
6586 else
6590 /*
6591 * The entry was created, we need to sync the
6592 * directory metadata.
6593 */
6596 /*
6597 * Get "after" change value, if it fails, simply return the
6598 * before value.
6599 */
6604 }
6608 /*
6609 * The cinfo->atomic = TRUE only if we have
6610 * non-zero va_seq's, and it has incremented by exactly one
6611 * during the create_vnode and it didn't
6612 * change during the VOP_FSYNC.
6613 */
6617 else
6619 }
6621 /* Check for mandatory locking and that the size gets set. */
6626 /* Assume the worst */
6632 /*
6633 * Truncate the file if necessary; this would be
6634 * the case for create over an existing file.
6635 */
6642 /*
6643 * We are writing over an existing file.
6644 * Check to see if we need to recall a delegation.
6645 */
6655 }
6657 }
6673 }
6674 }
6685 }
6686 }
6690 /*
6691 * Force modified data and metadata out to stable storage.
6692 */
6699 }
6701 /* if parent dir is attrdir, set namedattr fh flag */
6710 /*
6711 * if we did not create the file, we will need to check
6712 * the access bits on the file
6713 */
6721 }
6723 }
6725 /*ARGSUSED*/
6726 static void
6731 {
6732 /* XXX Currently not using req */
6740 sysid_t sysid;
6741 nfsstat4 status;
6742 caller_context_t ct;
6748 /* get the file struct and hold a lock on it during initial open */
6754 }
6760 /* No need to keep any reference */
6764 }
6766 /* try to get the sysid before continuing */
6770 /* Not a fully formed open; "close" it */
6775 }
6777 /* Calculate the fflags for this OPEN. */
6785 /*
6786 * Calculate the new deny and access mode that this open is adding to
6787 * the file for this open owner;
6788 */
6792 /*
6793 * Calculate the new share access and share deny modes that this open
6794 * is adding to the file for this open owner;
6795 */
6801 /*
6802 * Check to see the client has already sent an open for this
6803 * open owner on this file with the same share/deny modes.
6804 * If so, we don't need to check for a conflict and we don't
6805 * need to add another shrlock. If not, then we need to
6806 * check for conflicts in deny and access before checking for
6807 * conflicts in delegation. We don't want to recall a
6808 * delegation based on an open that will eventually fail based
6809 * on shares modes.
6810 */
6818 /* Not a fully formed open; "close" it */
6823 }
6824 }
6828 /*
6829 * Check to see if this file is delegated and if so, if a
6830 * recall needs to be done.
6831 */
6839 /* if state closed while lock was dropped */
6845 /* Not a fully formed open; "close" it */
6851 }
6854 /* Let's see if the delegation was returned */
6863 /* Not a fully formed open; "close" it */
6869 }
6870 }
6871 /*
6872 * the share check passed and any delegation conflict has been
6873 * taken care of, now call vop_open.
6874 * if this is the first open then call vop_open with fflags.
6875 * if not, call vn_open_upgrade with just the upgrade flags.
6876 *
6877 * if the file has been opened already, it will have the current
6878 * access mode in the state struct. if it has no share access, then
6879 * this is a new open.
6880 *
6881 * However, if this is open with CLAIM_DLEGATE_CUR, then don't
6882 * call VOP_OPEN(), just do the open upgrade.
6883 */
6897 /* Not a fully formed open; "close" it */
6901 /* check if a monitor detected a delegation conflict */
6904 else
6907 }
6909 /*
6910 * calculate the fflags for the new mode that is being added
6911 * by this upgrade.
6912 */
6919 }
6935 /*
6936 * Check for delegation here. if the deleg argument is not
6937 * DELEG_ANY, then this is a reclaim from a client and
6938 * we must honor the delegation requested. If necessary we can
6939 * set the recall flag.
6940 */
6956 }
6962 }
6964 /*ARGSUSED*/
6965 static void
6968 {
6976 /* inhibit delegation grants during exclusive create */
6983 }
6987 /* cs->vp cs->fh now reference the desired file */
6993 /*
6994 * If rfs4_createfile set attrset, we must
6995 * clear this attrset before the response is copied.
6996 */
6999 }
7000 }
7001 else
7006 }
7008 /*ARGSUSED*/
7009 static void
7012 {
7014 vattr_t va;
7018 /* Verify that we have a regular file */
7024 else
7027 }
7034 }
7038 /*
7039 * Check if we have access to the file, Note the the file
7040 * could have originally been open UNCHECKED or GUARDED
7041 * with mode bits that will now fail, but there is nothing
7042 * we can really do about that except in the case that the
7043 * owner of the file is the one requesting the open.
7044 */
7049 }
7050 }
7052 /*
7053 * cinfo on a CLAIM_PREVIOUS is undefined, initialize to zero
7054 */
7062 }
7064 static void
7067 {
7069 nfsstat4 status;
7070 stateid4 stateid =
7074 /*
7075 * Find the state info from the stateid and confirm that the
7076 * file is delegated. If the state openowner is the same as
7077 * the supplied openowner we're done. If not, get the file
7078 * info from the found state info. Use that file info to
7079 * create the state for this lock owner. Note solaris doen't
7080 * really need the pathname to find the file. We may want to
7081 * lookup the pathname and make sure that the vp exist and
7082 * matches the vp in the file structure. However it is
7083 * possible that the pathname nolonger exists (local process
7084 * unlinks the file), so this may not be that useful.
7085 */
7091 }
7095 /*
7096 * New lock owner, create state. Since this was probably called
7097 * in response to a CB_RECALL we set deleg to DELEG_NONE
7098 */
7109 }
7111 /* Mark progress for delegation returns */
7116 }
7118 /*ARGSUSED*/
7119 static void
7122 {
7123 /*
7124 * Lookup the pathname, it must already exist since this file
7125 * was delegated.
7126 *
7127 * Find the file and state info for this vp and open owner pair.
7128 * check that they are in fact delegated.
7129 * check that the state access and deny modes are the same.
7130 *
7131 * Return the delgation possibly seting the recall flag.
7132 */
7140 /* Note we ignore oflags */
7146 }
7148 /* get the file struct and hold a lock on it during initial open */
7154 }
7163 }
7178 }
7188 }
7212 }
7214 /* XXX For now */
7224 }
7232 /*
7233 * Generic function for sequence number checks.
7234 */
7235 static rfs4_chkseq_t
7238 {
7239 /* Same sequence ids and matching operations? */
7244 }
7248 }
7250 /* If the incoming sequence is not the next expected then it is bad */
7258 }
7263 }
7265 /* Everything okay -- next expected */
7267 }
7270 static rfs4_chkseq_t
7272 {
7273 rfs4_chkseq_t rc;
7277 TRUE);
7284 }
7286 static rfs4_chkseq_t
7288 {
7289 rfs4_chkseq_t rc;
7297 }
7299 static rfs4_chkseq_t
7301 {
7311 }
7313 static void
7316 {
7323 bool_t create;
7333 }
7335 /*
7336 * Need to check clientid and lease expiration first based on
7337 * error ordering and incrementing sequence id.
7338 */
7344 }
7350 }
7353 /*
7354 * Find the open_owner for use from this point forward. Take
7355 * care in updating the sequence id based on the type of error
7356 * being returned.
7357 */
7358 retry:
7365 }
7367 /* Hold off access to the sequence space while the open is done */
7370 /*
7371 * If the open_owner existed before at the server, then check
7372 * the sequence id.
7373 */
7383 }
7391 }
7393 /*
7394 * Sequence was ok and open owner exists
7395 * check to see if we have yet to see an
7396 * open_confirm.
7397 */
7403 }
7404 }
7405 /* Grace only applies to regular-type OPENs */
7410 }
7412 /*
7413 * If previous state at the server existed then can_reclaim
7414 * will be set. If not reply NFS4ERR_NO_GRACE to the
7415 * client.
7416 */
7420 }
7423 /*
7424 * Reject the open if the client has missed the grace period
7425 */
7429 }
7431 /* Couple of up-front bookkeeping items */
7433 /*
7434 * If this is a reclaim OPEN then we should not ask
7435 * for a confirmation of the open_owner per the
7436 * protocol specification.
7437 */
7440 else
7442 }
7445 /*
7446 * If there is an unshared filesystem mounted on this vnode,
7447 * do not allow to open/create in this directory.
7448 */
7452 }
7454 /*
7455 * access must READ, WRITE, or BOTH. No access is invalid.
7456 * deny can be READ, WRITE, BOTH, or NONE.
7457 * bits not defined for access/deny are invalid.
7458 */
7464 }
7467 /*
7468 * make sure attrset is zero before response is built.
7469 */
7488 }
7490 out:
7493 /* Catch sequence id handling here to make it a little easier */
7502 /*
7503 * The protocol states that if any of these errors are
7504 * being returned, the sequence id should not be
7505 * incremented. Any other return requires an
7506 * increment.
7507 */
7510 /* Always update the lease in this case */
7513 /* Regular response - copy the result */
7517 /*
7518 * REPLAY case: Only if the previous response was OK
7519 * do we copy the filehandle. If not OK, no
7520 * filehandle to copy.
7521 */
7525 /*
7526 * If this is a replay, we must restore the
7527 * current filehandle/vp to that of what was
7528 * returned originally. Try our best to do
7529 * it.
7530 */
7540 }
7551 }
7553 /*
7554 * If this was a replay, no need to update the
7555 * sequence id. If the open_owner was not created on
7556 * this pass, then update. The first use of an
7557 * open_owner will not bump the sequence id.
7558 */
7561 /*
7562 * If the client is receiving an error and the
7563 * open_owner needs to be confirmed, there is no way
7564 * to notify the client of this fact ignoring the fact
7565 * that the server has no method of returning a
7566 * stateid to confirm. Therefore, the server needs to
7567 * mark this open_owner in a way as to avoid the
7568 * sequence id checking the next time the client uses
7569 * this open_owner.
7570 */
7573 /*
7574 * If OK response then clear the postpone flag and
7575 * reset the sequence id to keep in sync with the
7576 * client.
7577 */
7581 }
7583 }
7585 finish:
7591 end:
7594 }
7596 /*ARGSUSED*/
7597 void
7600 {
7604 nfsstat4 status;
7612 }
7618 }
7620 /* Ensure specified filehandle matches */
7625 }
7627 /* hold off other access to open_owner while we tinker */
7636 }
7637 /*
7638 * If it is the appropriate stateid and determined to
7639 * be "OKAY" then this means that the stateid does not
7640 * need to be confirmed and the client is in error for
7641 * sending an OPEN_CONFIRM.
7642 */
7659 resop)) {
7661 /*
7662 * This is replayed stateid; if seqid matches
7663 * next expected, then client is using wrong seqid.
7664 */
7665 /* fall through */
7670 /*
7671 * Note this case is the duplicate case so
7672 * resp->status is already set.
7673 */
7677 }
7684 }
7698 }
7702 out:
7705 }
7707 /*ARGSUSED*/
7708 void
7711 {
7716 nfsstat4 status;
7727 }
7733 }
7735 /* Ensure specified filehandle matches */
7740 }
7742 /* hold off other access to open_owner while we tinker */
7751 }
7769 /* Check the sequence id for the open owner */
7771 resop)) {
7773 /*
7774 * This is replayed stateid; if seqid matches
7775 * next expected, then client is using wrong seqid.
7776 */
7777 /* fall through */
7782 /*
7783 * Note this case is the duplicate case so
7784 * resp->status is already set.
7785 */
7789 }
7794 }
7797 /*
7798 * Check that the new access modes and deny modes are valid.
7799 * Check that no invalid bits are set.
7800 */
7807 }
7809 /*
7810 * The new modes must be a subset of the current modes and
7811 * the access must specify at least one mode. To test that
7812 * the new mode is a subset of the current modes we bitwise
7813 * AND them together and check that the result equals the new
7814 * mode. For example:
7815 * New mode, access == R and current mode, sp->rs_open_access == RW
7816 * access & sp->rs_open_access == R == access, so the new access mode
7817 * is valid. Consider access == RW, sp->rs_open_access = R
7818 * access & sp->rs_open_access == R != access, so the new access mode
7819 * is invalid.
7820 */
7829 }
7831 /*
7832 * Release any share locks associated with this stateID.
7833 * Strictly speaking, this violates the spec because the
7834 * spec effectively requires that open downgrade be atomic.
7835 * At present, fs_shrlock does not have this capability.
7836 */
7845 }
7850 /*
7851 * If the current mode has deny read and the new mode
7852 * does not, decrement the number of deny read mode bits
7853 * and if it goes to zero turn off the deny read bit
7854 * on the file.
7855 */
7861 }
7863 /*
7864 * If the current mode has deny write and the new mode
7865 * does not, decrement the number of deny write mode bits
7866 * and if it goes to zero turn off the deny write bit
7867 * on the file.
7868 */
7874 }
7876 /*
7877 * If the current mode has access read and the new mode
7878 * does not, decrement the number of access read mode bits
7879 * and if it goes to zero turn off the access read bit
7880 * on the file. set fflags to FREAD for the call to
7881 * vn_open_downgrade().
7882 */
7889 }
7891 /*
7892 * If the current mode has access write and the new mode
7893 * does not, decrement the number of access write mode bits
7894 * and if it goes to zero turn off the access write bit
7895 * on the file. set fflags to FWRITE for the call to
7896 * vn_open_downgrade().
7897 */
7904 }
7906 /* Check that the file is still accessible */
7911 /* now set the new open access and deny modes */
7915 /*
7916 * we successfully downgraded the share lock, now we need to downgrade
7917 * the open. it is possible that the downgrade was only for a deny
7918 * mode and we have nothing else to do.
7919 */
7923 /* Update the stateid */
7930 /* Update the lease */
7932 /* And the sequence */
7936 end:
7939 out:
7942 }
7944 /*
7945 * The logic behind this function is detailed in the NFSv4 RFC in the
7946 * SETCLIENTID operation description under IMPLEMENTATION. Refer to
7947 * that section for explicit guidance to server behavior for
7948 * SETCLIENTID.
7949 */
7950 void
7953 {
7958 bool_t create;
7964 retry:
7967 /*
7968 * Save the caller's IP address
7969 */
7973 /*
7974 * Record if it is a Solaris client that cannot handle referrals.
7975 */
7978 /* Add a "yes, it's downrev" record */
7984 /* Remove any previous record */
7986 }
7988 /*
7989 * In search of an EXISTING client matching the incoming
7990 * request to establish a new client identifier at the server
7991 */
7995 /* Should never happen */
8001 }
8003 /*
8004 * Easiest case. Client identifier is newly created and is
8005 * unconfirmed. Also note that for this case, no other
8006 * entries exist for the client identifier. Nothing else to
8007 * check. Just setup the response and respond.
8008 */
8014 /* Setup callback information; CB_NULL confirmation later */
8019 }
8021 /*
8022 * An existing, confirmed client may exist but it may not have
8023 * been active for at least one lease period. If so, then
8024 * "close" the client and create a new client identifier
8025 */
8029 }
8033 else
8038 /*
8039 * We have a confirmed client, now check for an
8040 * unconfimred entry
8041 */
8043 /* If creds don't match then client identifier is inuse */
8046 /*
8047 * Some one else has established this client
8048 * id. Try and say * who they are. We will use
8049 * the call back address supplied by * the
8050 * first client.
8051 */
8067 }
8073 }
8075 /*
8076 * Confirmed, creds match, and verifier matches; must
8077 * be an update of the callback info
8078 */
8081 /* Setup callback information */
8085 /* everything okay -- move ahead */
8090 /* update the confirm_verifier and return it */
8097 }
8099 /*
8100 * Creds match but the verifier doesn't. Must search
8101 * for an unconfirmed client that would be replaced by
8102 * this request.
8103 */
8106 cp_confirmed);
8107 }
8109 /*
8110 * At this point, we have taken care of the brand new client
8111 * struct, INUSE case, update of an existing, and confirmed
8112 * client struct.
8113 */
8115 /*
8116 * check to see if things have changed while we originally
8117 * picked up the client struct. If they have, then return and
8118 * retry the processing of this SETCLIENTID request.
8119 */
8128 }
8129 /* do away with the old unconfirmed one */
8134 }
8136 /*
8137 * This search will temporarily hide the confirmed client
8138 * struct while a new client struct is created as the
8139 * unconfirmed one.
8140 */
8150 }
8152 /*
8153 * If one was not created, then a similar request must be in
8154 * process so release and start over with this one
8155 */
8161 }
8167 /* Setup callback information; CB_NULL confirmation later */
8174 out:
8177 }
8179 /*ARGSUSED*/
8180 void
8183 {
8202 }
8208 }
8210 /* If the verifier doesn't match, the record doesn't match */
8215 }
8223 }
8225 /*
8226 * Update the client's associated server instance, if it's changed
8227 * since the client was created.
8228 */
8232 /*
8233 * Record clientid in stable storage.
8234 * Must be done after server instance has been assigned.
8235 */
8241 /* don't need to rele, client_close does it */
8244 /* If needed, initiate CB_NULL call for callback path */
8248 /*
8249 * Check to see if client can perform reclaims
8250 */
8255 out:
8259 }
8262 /*ARGSUSED*/
8263 void
8266 {
8270 nfsstat4 status;
8278 }
8284 }
8286 /* Ensure specified filehandle matches */
8291 }
8293 /* hold off other access to open_owner while we tinker */
8302 }
8320 /* Check the sequence id for the open owner */
8322 resop)) {
8324 /*
8325 * This is replayed stateid; if seqid matches
8326 * next expected, then client is using wrong seqid.
8327 */
8328 /* FALL THROUGH */
8333 /*
8334 * Note this case is the duplicate case so
8335 * resp->status is already set.
8336 */
8340 }
8345 }
8349 /* Update the stateid. */
8363 end:
8366 out:
8369 }
8371 /*
8372 * Manage the counts on the file struct and close all file locks
8373 */
8374 /*ARGSUSED*/
8375 void
8377 bool_t close_of_client)
8378 {
8383 /*
8384 * If this call is part of the larger closing down of client
8385 * state then it is just easier to release all locks
8386 * associated with this client instead of going through each
8387 * individual file and cleaning locks there.
8388 */
8393 /* Is the PxFS kernel module loaded? */
8397 /* Encode the cluster nodeid in new sysid */
8401 /*
8402 * This PxFS routine removes file locks for a
8403 * client over all nodes of a cluster.
8404 */
8407 new_sysid));
8412 /* Release all locks for this client */
8423 }
8426 }
8427 }
8429 /*
8430 * Release all locks on this file by this lock owner or at
8431 * least mark the locks as having been released
8432 */
8437 /* Was this already taken care of above? */
8443 }
8445 /*
8446 * Release any shrlocks associated with this open state ID.
8447 * This must be done before the rfs4_state gets marked closed.
8448 */
8455 /*
8456 * Decrement the count for each access and deny bit that this
8457 * state has contributed to the file.
8458 * If the file counts go to zero
8459 * clear the appropriate bit in the appropriate mask.
8460 */
8466 }
8473 }
8478 }
8483 }
8491 }
8492 }
8494 /*
8495 * lock_denied: Fill in a LOCK4deneid structure given an flock64 structure.
8496 */
8497 static nfsstat4
8499 {
8512 }
8520 }
8522 /*
8523 * Its not a NFS4 lock. We take advantage that the upper 32 bits
8524 * of the client id contain the boot time for a NFS4 lock. So we
8525 * fabricate and identity by setting clientid to the sysid, and
8526 * the lock owner to the pid.
8527 */
8533 finish:
8541 else
8545 }
8547 static int
8549 {
8557 retry:
8571 }
8572 }
8575 /* Get the owner of the lock */
8581 /* No longer locked, retry */
8583 }
8587 }
8588 }
8591 }
8593 /*ARGSUSED*/
8594 static nfsstat4
8597 {
8598 nfsstat4 status;
8605 sysid_t sysid;
8610 }
8615 /* Check for zero length. To lock to end of file use all ones for V4 */
8621 retry:
8626 }
8637 }
8647 }
8650 }
8661 /* Note that length4 is uint64_t but l_len and l_start are off64_t */
8665 }
8667 /*
8668 * N.B. FREAD has the same value as OPEN4_SHARE_ACCESS_READ and
8669 * FWRITE has the same value as OPEN4_SHARE_ACCESS_WRITE.
8670 */
8678 }
8682 /*
8683 * N.B. We map error values to nfsv4 errors. This is differrent
8684 * than puterrno4 routine.
8685 */
8692 /* Can only get here if op is OP_LOCK */
8712 }
8715 }
8717 /*ARGSUSED*/
8718 void
8721 {
8724 nfsstat4 status;
8744 }
8747 /* Create a new lockowner for this instance */
8761 }
8763 /* Ensure specified filehandle matches */
8770 }
8772 /* hold off other access to open_owner while we tinker */
8798 /*
8799 * This is replayed stateid; if seqid
8800 * matches next expected, then client
8801 * is using wrong seqid.
8802 */
8803 /* FALLTHROUGH */
8808 /* This is a duplicate LOCK request */
8811 /*
8812 * For a duplicate we do not want to
8813 * create a new lockowner as it should
8814 * already exist.
8815 * Turn off the lockowner create flag.
8816 */
8818 }
8820 }
8828 }
8833 /*
8834 * Only update theh open_seqid if this is not
8835 * a duplicate request
8836 */
8839 }
8847 }
8849 /*
8850 * This is the new_lock_owner branch and the client is
8851 * supposed to be associating a new lock_owner with
8852 * the open file at this point. If we find that a
8853 * lock_owner/state association already exists and a
8854 * successful LOCK request was returned to the client,
8855 * an error is returned to the client since this is
8856 * not appropriate. The client should be using the
8857 * existing lock_owner branch.
8858 */
8865 }
8866 }
8870 /*
8871 * Only update theh open_seqid if this is not
8872 * a duplicate request
8873 */
8876 }
8878 /*
8879 * If this is a duplicate lock request, just copy the
8880 * previously saved reply and return.
8881 */
8883 /* verify that lock_seqid's match */
8892 /*
8893 * Make sure to copy the just
8894 * retrieved reply status into the
8895 * overall compound status
8896 */
8898 }
8901 }
8905 /* Make sure to update the lock sequence id */
8911 /*
8912 * This is used to signify the newly created lockowner
8913 * stateid and its sequence number. The checks for
8914 * sequence number and increment don't occur on the
8915 * very first lock request for a lockowner.
8916 */
8919 /* hold off other access to lsp while we tinker */
8928 /* get lsp and hold the lock on the underlying file struct */
8935 }
8938 /* Ensure specified filehandle matches */
8945 }
8947 /* hold off other access to lsp while we tinker */
8952 /*
8953 * The stateid looks like it was okay (expected to be
8954 * the next one)
8955 */
8957 /*
8958 * The sequence id is now checked. Determine
8959 * if this is a replay or if it is in the
8960 * expected (next) sequence. In the case of a
8961 * replay, there are two replay conditions
8962 * that may occur. The first is the normal
8963 * condition where a LOCK is done with a
8964 * NFS4_OK response and the stateid is
8965 * updated. That case is handled below when
8966 * the stateid is identified as a REPLAY. The
8967 * second is the case where an error is
8968 * returned, like NFS4ERR_DENIED, and the
8969 * sequence number is updated but the stateid
8970 * is not updated. This second case is dealt
8971 * with here. So it may seem odd that the
8972 * stateid is okay but the sequence id is a
8973 * replay but it is okay.
8974 */
8980 /*
8981 * Here is our replay and need
8982 * to verify that the last
8983 * response was an error.
8984 */
8987 }
8988 /*
8989 * This is done since the sequence id
8990 * looked like a replay but it didn't
8991 * pass our check so a BAD_SEQID is
8992 * returned as a result.
8993 */
8994 /*FALLTHROUGH*/
8999 /* Everything looks okay move ahead */
9001 }
9020 /*
9021 * This is a replayed stateid; if
9022 * seqid matches the next expected,
9023 * then client is using wrong seqid.
9024 */
9032 }
9037 }
9041 }
9043 /*
9044 * NFS4 only allows locking on regular files, so
9045 * verify type of object.
9046 */
9050 else
9053 }
9060 }
9065 }
9070 }
9078 out:
9086 }
9087 /*
9088 * Only update the "OPEN" response here if this was a new
9089 * lock_owner
9090 */
9096 end:
9100 /*
9101 * If an sp obtained, then the lsp does not represent
9102 * a lock on the file struct.
9103 */
9106 else
9108 }
9112 }
9116 }
9118 /* free function for LOCK/LOCKT */
9119 static void
9121 {
9135 }
9139 }
9141 /*ARGSUSED*/
9142 void
9145 {
9148 nfsstat4 status;
9160 }
9167 }
9169 /* Ensure specified filehandle matches */
9176 }
9178 /* hold off other access to lsp while we tinker */
9187 }
9204 /*
9205 * This is a replayed stateid; if
9206 * seqid matches the next expected,
9207 * then client is using wrong seqid.
9208 */
9216 }
9221 }
9226 /*
9227 * NFS4 only allows locking on regular files, so
9228 * verify type of object.
9229 */
9233 else
9236 }
9241 }
9246 out:
9254 end:
9260 }
9262 /*
9263 * LOCKT is a best effort routine, the client can not be guaranteed that
9264 * the status return is still in effect by the time the reply is received.
9265 * They are numerous race conditions in this routine, but we are not required
9266 * and can not be accurate.
9267 */
9268 /*ARGSUSED*/
9269 void
9272 {
9282 length4 posix_length;
9283 sysid_t sysid;
9284 pid_t pid;
9292 }
9294 /*
9295 * NFS4 only allows locking on regular files, so
9296 * verify type of object.
9297 */
9301 else
9304 }
9306 /*
9307 * Check out the clientid to ensure the server knows about it
9308 * so that we correctly inform the client of a server reboot.
9309 */
9315 }
9318 /*
9319 * Protocol doesn't allow returning NFS4ERR_STALE as
9320 * other operations do on this check so STALE_CLIENTID
9321 * is returned instead
9322 */
9325 }
9331 }
9345 }
9348 /* Check for zero length. To lock to end of file use all ones for V4 */
9354 }
9356 /* Find or create a lockowner */
9367 }
9368 retry:
9379 /* Note that length4 is uint64_t but l_len and l_start are off64_t */
9383 }
9387 /*
9388 * N.B. We map error values to nfsv4 errors. This is differrent
9389 * than puterrno4 routine.
9390 */
9399 }
9409 error);
9412 }
9414 err:
9418 out:
9421 }
9423 int
9425 {
9447 }
9451 }
9472 else
9475 }
9481 }
9483 int
9485 {
9507 NULL);
9511 }
9518 }
9520 static int
9522 {
9530 }
9535 }
9537 /* tunable to disable server referrals */
9540 /*
9541 * Find an NFS record in reparse point data.
9542 * Returns 0 for success and <0 or an errno value on failure.
9543 */
9544 int
9546 {
9558 }
9565 }
9568 }
9574 }
9579 }
9581 int
9583 {
9599 }
9601 /*
9602 * There is a user-level copy of this routine in ref_subr.c.
9603 * Changes should be kept in sync.
9604 */
9605 static int
9607 {
9618 /* count number of components in the path */
9624 }
9630 }
9634 }
9637 }
9640 }
9642 /*
9643 * There is a user-level copy of this routine in ref_subr.c.
9644 * Changes should be kept in sync.
9645 */
9646 static int
9648 {
9659 }
9661 /* count number of components to alloc buffer */
9666 }
9669 /* copy components into allocated buffer */
9676 }
9678 #define xdr_fs_locations4 xdr_fattr4_fs_locations
9680 fs_locations4 *
9682 {
9688 XDR xdr;
9691 /*
9692 * Check attrs to ensure it's a reparse point
9693 */
9697 /*
9698 * Look for an NFS record and get the type and data
9699 */
9703 /*
9704 * With the type and data, upcall to get the referral
9705 */
9717 err);
9719 }
9721 /*
9722 * We get an XDR'ed record back from the kderef call
9723 */
9732 }
9734 /*
9735 * Look at path to recover fs_root, ignoring the leading '/'
9736 */
9740 }
9744 {
9750 uint_t len;
9752 /* Get the referral */
9756 /* Deal with only the first location and first server */
9763 }
9765 /* Figure out size for "/net/" + host + /path/path/path + NULL */
9770 /* Allocate the symlink buffer and fill it */
9783 npaths++;
9785 }
9793 }
9795 /*
9796 * Check to see if we have a downrev Solaris client, so that we
9797 * can send it a symlink instead of a referral.
9798 */
9799 int
9801 {
9815 }