| blob | 3f6a824b6d1b666b9b360093fcb183efb27f14dd |
1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
23 * Copyright 2012 Nexenta Systems, Inc. All rights reserved.
24 */
27 /*
28 * Copyright (c) 1983,1984,1985,1986,1987,1988,1989 AT&T.
29 * All Rights Reserved
30 */
32 #include <sys/param.h>
33 #include <sys/types.h>
34 #include <sys/systm.h>
35 #include <sys/cred.h>
36 #include <sys/buf.h>
37 #include <sys/vfs.h>
38 #include <sys/vfs_opreg.h>
39 #include <sys/vnode.h>
40 #include <sys/uio.h>
41 #include <sys/errno.h>
42 #include <sys/sysmacros.h>
43 #include <sys/statvfs.h>
44 #include <sys/kmem.h>
45 #include <sys/dirent.h>
46 #include <sys/cmn_err.h>
47 #include <sys/debug.h>
48 #include <sys/systeminfo.h>
49 #include <sys/flock.h>
50 #include <sys/pathname.h>
51 #include <sys/nbmlock.h>
52 #include <sys/share.h>
53 #include <sys/atomic.h>
54 #include <sys/policy.h>
55 #include <sys/fem.h>
56 #include <sys/sdt.h>
57 #include <sys/ddi.h>
58 #include <sys/zone.h>
60 #include <fs/fs_reparse.h>
62 #include <rpc/types.h>
63 #include <rpc/auth.h>
64 #include <rpc/rpcsec_gss.h>
65 #include <rpc/svc.h>
67 #include <nfs/nfs.h>
68 #include <nfs/export.h>
69 #include <nfs/nfs_cmd.h>
70 #include <nfs/lm.h>
71 #include <nfs/nfs4.h>
73 #include <sys/strsubr.h>
74 #include <sys/strsun.h>
76 #include <inet/common.h>
77 #include <inet/ip.h>
78 #include <inet/ip6.h>
80 #include <sys/tsol/label.h>
81 #include <sys/tsol/tndb.h>
89 /* End of Tunables */
93 /*
94 * Used to bump the stateid4.seqid value and show changes in the stateid
95 */
96 #define next_stateid(sp) (++(sp)->bits.chgseq)
98 /*
99 * RFS4_MINLEN_ENTRY4: XDR-encoded size of smallest possible dirent.
100 * This is used to return NFS4ERR_TOOSMALL when clients specify
101 * maxcount that isn't large enough to hold the smallest possible
102 * XDR encoded dirent.
103 *
104 * sizeof cookie (8 bytes) +
105 * sizeof name_len (4 bytes) +
106 * sizeof smallest (padded) name (4 bytes) +
107 * sizeof bitmap4_len (12 bytes) + NOTE: we always encode len=2 bm4
108 * sizeof attrlist4_len (4 bytes) +
109 * sizeof next boolean (4 bytes)
110 *
111 * RFS4_MINLEN_RDDIR4: XDR-encoded size of READDIR op reply containing
112 * the smallest possible entry4 (assumes no attrs requested).
113 * sizeof nfsstat4 (4 bytes) +
114 * sizeof verifier4 (8 bytes) +
115 * sizeof entry4list bool (4 bytes) +
116 * sizeof entry4 (36 bytes) +
117 * sizeof eof bool (4 bytes)
118 *
119 * RFS4_MINLEN_RDDIR_BUF: minimum length of buffer server will provide to
120 * VOP_READDIR. Its value is the size of the maximum possible dirent
121 * for solaris. The DIRENT64_RECLEN macro returns the size of dirent
122 * required for a given name length. MAXNAMELEN is the maximum
123 * filename length allowed in Solaris. The first two DIRENT64_RECLEN()
124 * macros are to allow for . and .. entries -- just a minor tweak to try
125 * and guarantee that buffer we give to VOP_READDIR will be large enough
126 * to hold ., .., and the largest possible solaris dirent64.
127 */
128 #define RFS4_MINLEN_ENTRY4 36
129 #define RFS4_MINLEN_RDDIR4 (4 + NFS4_VERIFIER_SIZE + 4 + RFS4_MINLEN_ENTRY4 + 4)
130 #define RFS4_MINLEN_RDDIR_BUF \
131 (DIRENT64_RECLEN(1) + DIRENT64_RECLEN(2) + DIRENT64_RECLEN(MAXNAMELEN))
133 /*
134 * It would be better to pad to 4 bytes since that's what XDR would do,
135 * but the dirents UFS gives us are already padded to 8, so just take
136 * what we're given. Dircount is only a hint anyway. Currently the
137 * solaris kernel is ASCII only, so there's no point in calling the
138 * UTF8 functions.
139 *
140 * dirent64: named padded to provide 8 byte struct alignment
141 * d_ino(8) + d_off(8) + d_reclen(2) + d_name(namelen + null(1) + pad)
142 *
143 * cookie: uint64_t + utf8namelen: uint_t + utf8name padded to 8 bytes
144 *
145 */
146 #define DIRENT64_TO_DIRCOUNT(dp) \
147 (3 * BYTES_PER_XDR_UNIT + DIRENT64_NAMELEN((dp)->d_reclen))
153 u_longlong_t nfs4_srv_caller_id;
156 verifier4 Write4verf;
157 verifier4 Readdir4verf;
252 /*
253 * translation table for attrs
254 */
259 bool_t vfsstat;
260 };
277 /*
278 * NFS4 op dispatch table
279 */
285 };
288 /*
289 * NFS VERSION 4
290 */
292 /* RFS_NULL = 0 */
295 /* UNUSED = 1 */
298 /* UNUSED = 2 */
301 /* OP_ACCESS = 3 */
304 /* OP_CLOSE = 4 */
307 /* OP_COMMIT = 5 */
310 /* OP_CREATE = 6 */
313 /* OP_DELEGPURGE = 7 */
316 /* OP_DELEGRETURN = 8 */
319 /* OP_GETATTR = 9 */
322 /* OP_GETFH = 10 */
325 /* OP_LINK = 11 */
328 /* OP_LOCK = 12 */
331 /* OP_LOCKT = 13 */
334 /* OP_LOCKU = 14 */
337 /* OP_LOOKUP = 15 */
340 /* OP_LOOKUPP = 16 */
343 /* OP_NVERIFY = 17 */
346 /* OP_OPEN = 18 */
349 /* OP_OPENATTR = 19 */
352 /* OP_OPEN_CONFIRM = 20 */
355 /* OP_OPEN_DOWNGRADE = 21 */
358 /* OP_OPEN_PUTFH = 22 */
361 /* OP_PUTPUBFH = 23 */
364 /* OP_PUTROOTFH = 24 */
367 /* OP_READ = 25 */
370 /* OP_READDIR = 26 */
373 /* OP_READLINK = 27 */
376 /* OP_REMOVE = 28 */
379 /* OP_RENAME = 29 */
382 /* OP_RENEW = 30 */
385 /* OP_RESTOREFH = 31 */
388 /* OP_SAVEFH = 32 */
391 /* OP_SECINFO = 33 */
394 /* OP_SETATTR = 34 */
397 /* OP_SETCLIENTID = 35 */
400 /* OP_SETCLIENTID_CONFIRM = 36 */
403 /* OP_VERIFY = 37 */
406 /* OP_WRITE = 38 */
409 /* OP_RELEASE_LOCKOWNER = 39 */
411 };
415 #define OP_ILLEGAL_IDX (rfsv4disp_cnt)
417 #ifdef DEBUG
464 "rfs4_op_illegal"
465 };
466 #endif
474 #ifdef nextdp
475 #undef nextdp
476 #endif
477 #define nextdp(dp) ((struct dirent64 *)((char *)(dp) + (dp)->d_reclen))
487 NULL, NULL
488 };
498 NULL, NULL
499 };
501 int
503 {
504 timespec32_t verf;
509 /*
510 * The following algorithm attempts to find a unique verifier
511 * to be used as the write verifier returned from the server
512 * to the client. It is important that this verifier change
513 * whenever the server reboots. Of secondary importance, it
514 * is important for the verifier to be unique between two
515 * different servers.
516 *
517 * Thus, an attempt is made to use the system hostid and the
518 * current time in seconds when the nfssrv kernel module is
519 * loaded. It is assumed that an NFS server will not be able
520 * to boot and then to reboot in less than a second. If the
521 * hostid has not been set, then the current high resolution
522 * time is used. This will ensure different verifiers each
523 * time the server reboots and minimize the chances that two
524 * different servers will have the same verifier.
525 * XXX - this is broken on LP64 kernels.
526 */
531 timespec_t tverf;
536 }
543 /* Used to manage create/destroy of server state */
546 /* Used to manage access to server instance linked list */
549 /* Used to manage access to rfs4_deleg_policy */
561 }
562 }
571 }
573 void
575 {
581 }
589 }
591 void
593 {
600 }
602 void
604 {
609 }
611 /*
612 * returns true if the instance's grace period has never been started
613 */
614 int
616 {
624 }
626 /*
627 * Indicates if server instance is within the
628 * grace period.
629 */
630 int
632 {
640 }
642 int
644 {
648 }
650 /*
651 * reset all currently active grace periods
652 */
653 void
655 {
663 }
665 /*
666 * start any new instances' grace periods
667 */
668 void
670 {
678 }
682 {
688 /*
689 * Take a copy of the string, since the original may be overwritten.
690 * Sadly, no strdup() in the kernel.
691 */
692 /* allow for NUL */
697 /* associate with servinst */
701 /*
702 * Add to list of served paths.
703 * No locking required, as we're only ever called at startup.
704 */
706 /* this is the first dss_path_t */
708 /* needed for insque/remque */
714 }
717 }
719 /*
720 * Create a new server instance, and make it the currently active instance.
721 * Note that starting the grace period too early will reduce the clients'
722 * recovery window.
723 */
724 void
726 {
740 /*
741 * This initial dummy entry is required to setup for insque/remque.
742 * It must be skipped over whenever the list is traversed.
743 */
745 /* insque/remque require initial list entry to be self-terminated */
757 }
761 /* add to linked list */
764 }
767 /* make the new instance "current" */
771 }
773 /*
774 * In future, we might add a rfs4_servinst_destroy(sip) but, for now, destroy
775 * all instances directly.
776 */
777 void
779 {
781 #ifdef DEBUG
783 #endif
798 #ifdef DEBUG
799 n++;
800 #endif
801 }
803 }
805 /*
806 * Assign the current server instance to a client_t.
807 * Should be called with cp->rc_dbe held.
808 */
809 void
811 {
814 /*
815 * The lock ensures that if the current instance is in the process
816 * of changing, we will see the new one.
817 */
821 }
823 rfs4_servinst_t *
825 {
829 }
831 /* ARGSUSED */
832 static void
834 {
835 }
837 /*
838 * This is a fall-through for invalid or not implemented (yet) ops
839 */
840 /* ARGSUSED */
841 static void
844 {
846 }
848 /*
849 * Check if the security flavor, nfsnum, is in the flavor_list.
850 */
851 bool_t
853 {
859 }
861 }
863 /*
864 * Used by rfs4_op_secinfo to get the security information from the
865 * export structure associated with the component.
866 */
867 /* ARGSUSED */
868 static nfsstat4
870 {
874 fid_t fid;
885 /*
886 * If dotdotting, then need to check whether it's above the
887 * root of a filesystem, or above an export point.
888 */
891 /*
892 * If dotdotting at the root of a filesystem, then
893 * need to traverse back to the mounted-on filesystem
894 * and do the dotdot lookup there.
895 */
898 /*
899 * If at the system root, then can
900 * go up no further.
901 */
905 /*
906 * Traverse back to the mounted-on filesystem
907 */
910 /*
911 * Set the different_export flag so we remember
912 * to pick up a new exportinfo entry for
913 * this new filesystem.
914 */
918 /*
919 * If dotdotting above an export point then set
920 * the different_export to get new export info.
921 */
923 }
924 }
926 /*
927 * Get the vnode for the component "nm".
928 */
934 /*
935 * If the vnode is in a pseudo filesystem, or if the security flavor
936 * used in the request is valid but not an explicitly shared flavor,
937 * or the access bit indicates that this is a limited access,
938 * check whether this vnode is visible.
939 */
946 }
947 }
949 /*
950 * If it's a mountpoint, then traverse it.
951 */
957 }
958 /* remember that we had to traverse mountpoint */
963 /*
964 * If vp isn't a mountpoint and the vfs ptrs aren't the same,
965 * then vp is probably an LOFS object. We don't need the
966 * realvp, we just need to know that we might have crossed
967 * a server fs boundary and need to call checkexport4.
968 * (LOFS lookup hides server fs mountpoints, and actually calls
969 * traverse)
970 */
972 }
974 /*
975 * Get the export information for it.
976 */
985 }
989 else
994 /*
995 * If this vnode is a mounted-on vnode,
996 * but the mounted-on file system is not
997 * exported, send back the secinfo for
998 * the exported node that the mounted-on
999 * vnode lives in.
1000 */
1005 }
1006 }
1009 }
1013 /*
1014 * Create the secinfo result based on the security information
1015 * from the exportinfo structure (exi).
1016 *
1017 * Return all flavors for a pseudo node.
1018 * For a real export node, return the flavor that the client
1019 * has access with.
1020 */
1037 /* get oid opaque data */
1046 }
1047 }
1058 /* find out which flavors to return */
1071 ret_cnt++;
1072 }
1073 }
1075 /* Create the returning SECINFO value */
1079 /*
1080 * If the flavor is in the flavor list,
1081 * fill in resok_val.
1082 */
1095 /* get oid opaque data */
1100 KM_SLEEP);
1104 }
1105 k++;
1106 }
1109 }
1113 }
1117 }
1119 /*
1120 * SECINFO (Operation 33): Obtain required security information on
1121 * the component name in the format of (security-mechanism-oid, qop, service)
1122 * triplets.
1123 */
1124 /* ARGSUSED */
1125 static void
1128 {
1132 uint_t len;
1141 /*
1142 * Current file handle (cfh) should have been set before getting
1143 * into this function. If not, return error.
1144 */
1148 }
1153 }
1155 /*
1156 * Verify the component name. If failed, error out, but
1157 * do not error out if the component name is a "..".
1158 * SECINFO will return its parents secinfo data for SECINFO "..".
1159 */
1167 }
1168 }
1174 }
1180 }
1190 }
1199 out:
1202 }
1204 /*
1205 * Free SECINFO result.
1206 */
1207 /* ARGSUSED */
1208 static void
1210 {
1215 /* If this is not an Ok result, nothing to free. */
1218 }
1230 }
1231 }
1235 }
1237 /* ARGSUSED */
1238 static void
1241 {
1251 boolean_t admin_low_client;
1260 }
1261 #endif
1265 }
1271 /*
1272 * If the file system is exported read only, it is not appropriate
1273 * to check write permissions for regular files and directories.
1274 * Special files are interpreted by the client, so the underlying
1275 * permissions are sent back to the client for interpretation.
1276 */
1280 else
1283 /*
1284 * XXX
1285 * We need the mode so that we can correctly determine access
1286 * permissions relative to a mandatory lock file. Access to
1287 * mandatory lock files is denied on the server, so it might
1288 * as well be reflected to the server during the open.
1289 */
1295 }
1309 }
1318 }
1327 }
1334 }
1345 }
1354 }
1362 }
1368 out:
1371 }
1373 /* ARGSUSED */
1374 static void
1377 {
1383 vattr_t va;
1391 }
1395 }
1400 }
1405 /*
1406 * If we can't get the attributes, then we can't do the
1407 * right access checking. So, we'll fail the request.
1408 */
1412 }
1416 }
1421 else
1425 }
1431 }
1438 }
1442 out:
1445 }
1447 /*
1448 * rfs4_op_mknod is called from rfs4_op_create after all initial verification
1449 * was completed. It does the nfsv4 create for special files.
1450 */
1451 /* ARGSUSED */
1455 {
1469 }
1472 else
1487 }
1489 /*
1490 * Must specify the mode.
1491 */
1495 }
1505 }
1507 }
1509 /*
1510 * nfsv4 create is used to create non-regular files. For regular files,
1511 * use nfsv4 open.
1512 */
1513 /* ARGSUSED */
1514 static void
1517 {
1532 nfsstat4 status;
1545 }
1547 /*
1548 * If there is an unshared filesystem mounted on this vnode,
1549 * do not allow to create an object in this directory.
1550 */
1554 }
1556 /* Verify that type is correct */
1568 };
1573 }
1577 }
1582 }
1587 }
1589 /*
1590 * Name of newly created object
1591 */
1596 }
1602 }
1612 }
1634 }
1636 /* Get "before" change value */
1647 }
1652 /*
1653 * Set the default initial values for attributes when the parent
1654 * directory does not have the VSUID/VSGID bit set and they have
1655 * not been specified in createattrs.
1656 */
1660 }
1664 }
1673 }
1678 /*
1679 * Get the initial "after" sequence number, if it fails,
1680 * set to zero
1681 */
1691 }
1693 /*
1694 * symlink names must be treated as data
1695 */
1706 }
1717 }
1731 }
1740 /*
1741 * Get the initial "after" sequence number, if it fails,
1742 * set to zero
1743 */
1753 /*
1754 * va_seq is not safe over VOP calls, check it again
1755 * if it has changed zero out iva to force atomic = FALSE.
1756 */
1763 /*
1764 * probably a special file.
1765 */
1769 }
1771 /*
1772 * We know this will only generate one VOP call
1773 */
1783 }
1785 /*
1786 * Get the initial "after" sequence number, if it fails,
1787 * set to zero
1788 */
1794 }
1801 }
1803 /*
1804 * Force modified data and metadata out to stable storage.
1805 */
1814 }
1816 /*
1817 * Finish setup of cinfo response, "before" value already set.
1818 * Get "after" change value, if it fails, simply return the
1819 * before value.
1820 */
1825 }
1828 /*
1829 * True verification that object was created with correct
1830 * attrs is impossible. The attrs could have been changed
1831 * immediately after object creation. If attributes did
1832 * not verify, the only recourse for the server is to
1833 * destroy the object. Maybe if some attrs (like gid)
1834 * are set incorrectly, the object should be destroyed;
1835 * however, seems bad as a default policy. Do we really
1836 * want to destroy an object over one of the times not
1837 * verifying correctly? For these reasons, the server
1838 * currently sets bits in attrset for createattrs
1839 * that were set; however, no verification is done.
1840 *
1841 * vmask_to_nmask accounts for vattr bits set on create
1842 * [do_rfs4_set_attrs() only sets resp bits for
1843 * non-vattr/vfs bits.]
1844 * Mask off any bits set by default so as not to return
1845 * more attrset bits than were requested in createattrs
1846 */
1854 }
1856 /*
1857 * The cinfo.atomic = TRUE only if we got no errors, we have
1858 * non-zero va_seq's, and it has incremented by exactly one
1859 * during the creation and it didn't change during the VOP_LOOKUP
1860 * or VOP_FSYNC.
1861 */
1865 else
1868 /*
1869 * Force modified metadata out to stable storage.
1870 *
1871 * if a underlying vp exists, pass it to VOP_FSYNC
1872 */
1875 else
1881 }
1887 out:
1890 }
1892 /*ARGSUSED*/
1893 static void
1896 {
1904 }
1906 /*ARGSUSED*/
1907 static void
1910 {
1914 nfsstat4 status;
1924 /* Ensure specified filehandle matches */
1933 out:
1936 }
1938 /*
1939 * Check to see if a given "flavor" is an explicitly shared flavor.
1940 * The assumption of this routine is the "flavor" is already a valid
1941 * flavor in the secinfo list of "exi".
1942 *
1943 * e.g.
1944 * # share -o sec=flavor1 /export
1945 * # share -o sec=flavor2 /export/home
1946 *
1947 * flavor2 is not an explicitly shared flavor for /export,
1948 * however it is in the secinfo list for /export thru the
1949 * server namespace setup.
1950 */
1951 int
1953 {
1962 }
1963 }
1965 /* Should not reach this point based on the assumption */
1967 }
1969 /*
1970 * Check if the security flavor used in the request matches what is
1971 * required at the export point or at the root pseudo node (exi_root).
1972 *
1973 * returns 1 if there's a match or if exported with AUTH_NONE; 0 otherwise.
1974 *
1975 */
1976 static int
1978 {
1982 /*
1983 * Check cs->nfsflavor (from the request) against
1984 * the current export data in cs->exi.
1985 */
1991 }
1994 }
1996 /*
1997 * Check the access authority for the client and return the correct error.
1998 */
1999 nfsstat4
2001 {
2004 /*
2005 * First, check if the security flavor used in the request
2006 * are among the flavors set in the server namespace.
2007 */
2011 }
2025 }
2027 }
2029 /*
2030 * bitmap4_to_attrmask is called by getattr and readdir.
2031 * It sets up the vattr mask and determines whether vfsstat call is needed
2032 * based on the input bitmap.
2033 * Returns nfsv4 status.
2034 */
2035 static nfsstat4
2037 {
2039 uint_t va_mask;
2049 else
2052 /*
2053 * Set rdattr_error_req to true if return error per
2054 * failed entry rather than fail the readdir.
2055 */
2058 else
2061 /*
2062 * generate the va_mask
2063 * Handle the easy cases first
2064 */
2089 }
2091 /*
2092 * Check is vfsstat is needed
2093 */
2099 }
2100 /* NOTREACHED */
2101 }
2103 /*
2104 * bitmap4_get_sysattrs is called by getattr and readdir.
2105 * It calls both VOP_GETATTR and VFS_STATVFS calls to get the attrs.
2106 * Returns nfsv4 status.
2107 */
2108 static nfsstat4
2110 {
2119 }
2120 }
2123 }
2125 static void
2127 {
2129 KM_SLEEP);
2132 }
2134 static void
2137 {
2142 /*
2143 * XXX Should do the same checks for whether the bit is set
2144 */
2149 }
2151 /*
2152 * xdr_free for getattr will be done later
2153 */
2157 }
2158 }
2160 }
2162 /*
2163 * do_rfs4_op_getattr gets the system attrs and converts into fattr4.
2164 */
2165 static nfsstat4
2168 {
2172 XDR xdr;
2173 ulong_t xdr_size;
2184 /* if no bits requested, then return empty fattr4 */
2189 }
2191 /*
2192 * return NFS4ERR_INVAL when client requests write-only attrs
2193 */
2201 /*
2202 * Now loop to get or verify the attrs
2203 */
2212 /*
2213 * Possible error values:
2214 * >0 if sv_getit failed to
2215 * get the attr; 0 if succeeded;
2216 * <0 if rdattr_error and the
2217 * attribute cannot be returned.
2218 */
2221 /*
2222 * If error then just for entry
2223 */
2229 na++;
2234 }
2236 }
2237 }
2238 }
2240 /*
2241 * If rdattr_error was set after the return value for it was assigned,
2242 * update it.
2243 */
2251 }
2258 }
2260 }
2261 }
2268 }
2272 /* freed by rfs4_op_getattr_free() */
2285 }
2286 }
2290 }
2291 done:
2299 }
2301 /* ARGSUSED */
2302 static void
2305 {
2310 nfsstat4 status;
2318 }
2323 }
2335 /* Is this a referral? */
2337 /* Older V4 Solaris client sees a link */
2340 else
2342 }
2346 }
2347 }
2349 out:
2352 }
2354 static void
2356 {
2360 }
2362 /* ARGSUSED */
2363 static void
2366 {
2374 }
2378 }
2380 /* check for reparse point at the share point */
2382 /* it's all bad */
2388 }
2390 /* check for reparse point at vp */
2392 /* it's not all bad */
2397 }
2403 out:
2406 }
2408 static void
2410 {
2418 }
2419 }
2421 /*
2422 * illegal: args: void
2423 * res : status (NFS4ERR_OP_ILLEGAL)
2424 */
2425 /* ARGSUSED */
2426 static void
2429 {
2434 }
2436 /*
2437 * link: args: SAVED_FH: file, CURRENT_FH: target directory
2438 * res: status. If success - CURRENT_FH unchanged, return change_info
2439 */
2440 /* ARGSUSED */
2441 static void
2444 {
2452 uint_t len;
2455 nfsstat4 status;
2460 /* SAVED_FH: source object */
2465 }
2467 /* CURRENT_FH: target directory */
2472 }
2474 /*
2475 * If there is a non-shared filesystem mounted on this vnode,
2476 * do not allow to link any file in this directory.
2477 */
2481 }
2486 }
2488 /* Check source object's type validity */
2492 }
2494 /* Check target directory's type */
2498 }
2503 }
2509 }
2515 }
2521 }
2527 }
2529 /* Get "before" change value */
2536 }
2546 }
2556 /*
2557 * Get the initial "after" sequence number, if it fails, set to zero
2558 */
2563 /*
2564 * Force modified data and metadata out to stable storage.
2565 */
2572 }
2574 /*
2575 * Get "after" change value, if it fails, simply return the
2576 * before value.
2577 */
2582 }
2586 /*
2587 * The cinfo.atomic = TRUE only if we have
2588 * non-zero va_seq's, and it has incremented by exactly one
2589 * during the VOP_LINK and it didn't change during the VOP_FSYNC.
2590 */
2594 else
2598 out:
2601 }
2603 /*
2604 * Used by rfs4_op_lookup and rfs4_op_lookupp to do the actual work.
2605 */
2607 /* ARGSUSED */
2608 static nfsstat4
2610 {
2615 nfsstat4 stat;
2616 fid_t fid;
2626 }
2630 /*
2631 * If dotdotting, then need to check whether it's
2632 * above the root of a filesystem, or above an
2633 * export point.
2634 */
2637 /*
2638 * If dotdotting at the root of a filesystem, then
2639 * need to traverse back to the mounted-on filesystem
2640 * and do the dotdot lookup there.
2641 */
2644 /*
2645 * If at the system root, then can
2646 * go up no further.
2647 */
2651 /*
2652 * Traverse back to the mounted-on filesystem
2653 */
2656 /*
2657 * Set the different_export flag so we remember
2658 * to pick up a new exportinfo entry for
2659 * this new filesystem.
2660 */
2664 /*
2665 * If dotdotting above an export point then set
2666 * the different_export to get new export info.
2667 */
2669 }
2670 }
2677 /*
2678 * If the vnode is in a pseudo filesystem, check whether it is visible.
2679 *
2680 * XXX if the vnode is a symlink and it is not visible in
2681 * a pseudo filesystem, return ENOENT (not following symlink).
2682 * V4 client can not mount such symlink. This is a regression
2683 * from V2/V3.
2684 *
2685 * In the same exported filesystem, if the security flavor used
2686 * is not an explicitly shared flavor, limit the view to the visible
2687 * list entries only. This is not a WRONGSEC case because it's already
2688 * checked via PUTROOTFH/PUTPUBFH or PUTFH.
2689 */
2696 }
2697 }
2699 /*
2700 * If it's a mountpoint, then traverse it.
2701 */
2706 /*
2707 * hold pre_tvp to counteract rele by traverse. We will
2708 * need pre_tvp below if checkexport4 fails
2709 */
2716 }
2720 /*
2721 * The vfsp comparison is to handle the case where
2722 * a LOFS mount is shared. lo_lookup traverses mount points,
2723 * and NFS is unaware of local fs transistions because
2724 * v_vfsmountedhere isn't set. For this special LOFS case,
2725 * the dir and the obj returned by lookup will have different
2726 * vfs ptrs.
2727 */
2729 }
2741 }
2745 else
2750 /*
2751 * If this vnode is a mounted-on vnode,
2752 * but the mounted-on file system is not
2753 * exported, send back the filehandle for
2754 * the mounted-on vnode, not the root of
2755 * the mounted-on file system.
2756 */
2763 }
2765 /* we're done with pre_tvp now. release extra hold */
2767 }
2771 /*
2772 * Now we do a checkauth4. The reason is that
2773 * this client/user may not have access to the new
2774 * exported file system, and if he does,
2775 * the client/user may be mapped to a different uid.
2776 *
2777 * We start with a new cr, because the checkauth4 done
2778 * in the PUT*FH operation over wrote the cred's uid,
2779 * gid, etc, and we want the real thing before calling
2780 * checkauth4()
2781 */
2794 }
2795 }
2797 /*
2798 * After various NFS checks, do a label check on the path
2799 * component. The label on this path should either be the
2800 * global zone's label or a zone's label. We are only
2801 * interested in the zone's label because exported files
2802 * in global zone is accessible (though read-only) to
2803 * clients. The exportability/visibility check is already
2804 * done before reaching this code.
2805 */
2819 }
2821 /*
2822 * We grant access to admin_low label clients
2823 * only if the client is trusted, i.e. also
2824 * running Solaris Trusted Extension.
2825 */
2840 }
2844 SUN_CIPSO) {
2849 }
2851 }
2852 }
2856 err_out:
2864 }
2873 /*
2874 * if did lookup on attrdir and didn't lookup .., set named
2875 * attr fh flag
2876 */
2880 /* Assume false for now, open proc will set this */
2884 }
2886 /* ARGSUSED */
2887 static void
2890 {
2894 uint_t len;
2897 nfsstat4 status;
2905 }
2910 }
2915 }
2921 }
2927 }
2933 }
2943 }
2951 out:
2954 }
2956 /* ARGSUSED */
2957 static void
2960 {
2968 }
2973 }
2977 /*
2978 * From NFSV4 Specification, LOOKUPP should not check for
2979 * NFS4ERR_WRONGSEC. Retrun NFS4_OK instead.
2980 */
2983 }
2985 out:
2988 }
2991 /*ARGSUSED2*/
2992 static void
2995 {
3008 }
3014 }
3016 /*
3017 * If file system supports passing ACE mask to VOP_ACCESS then
3018 * check for ACE_READ_NAMED_ATTRS, otherwise do legacy checks
3019 */
3024 else
3032 }
3034 /*
3035 * The CREATE_XATTR_DIR VOP flag cannot be specified if
3036 * the file system is exported read-only -- regardless of
3037 * createdir flag. Otherwise the attrdir would be created
3038 * (assuming server fs isn't mounted readonly locally). If
3039 * VOP_LOOKUP returns ENOENT in this case, the error will
3040 * be translated into EROFS. ENOSYS is mapped to ENOTSUP
3041 * because specfs has no VOP_LOOKUP op, so the macro would
3042 * return ENOSYS. EINVAL is returned by all (current)
3043 * Solaris file system implementations when any of their
3044 * restrictions are violated (xattr(dir) can't have xattrdir).
3045 * Returning NOTSUPP is more appropriate in this case
3046 * because the object will never be able to have an attrdir.
3047 */
3059 else
3062 }
3072 }
3077 /*
3078 * There is no requirement for an attrdir fh flag
3079 * because the attrdir has a vnode flag to distinguish
3080 * it from regular (non-xattr) directories. The
3081 * FH4_ATTRDIR flag is set for future sanity checks.
3082 */
3086 out:
3089 }
3091 static int
3094 {
3101 /*
3102 * Don't block on mandatory locks. If this routine returns
3103 * EAGAIN, the caller should return NFS4ERR_LOCKED.
3104 */
3118 }
3126 }
3127 }
3130 }
3132 /* ARGSUSED */
3133 static void
3136 {
3145 u_offset_t offset;
3147 nfsstat4 stat;
3153 caller_context_t ct;
3163 }
3167 }
3173 }
3175 /*
3176 * Enter the critical region before calling VOP_RWLOCK
3177 * to avoid a deadlock with write requests.
3178 */
3186 }
3187 }
3193 }
3199 }
3201 }
3203 /* use loaned buffers for TCP */
3209 /*
3210 * If we can't get the attributes, then we can't do the
3211 * right access checking. So, we'll fail the request.
3212 */
3216 }
3222 }
3229 }
3234 }
3243 /* RDMA */
3250 }
3258 /* RDMA */
3264 }
3266 /*
3267 * Do not allocate memory more than maximum allowed
3268 * transfer size
3269 */
3280 /* Jump to do the read if successful */
3282 /*
3283 * Need to hold the vnode until after VOP_RETZCBUF()
3284 * is called.
3285 */
3288 }
3295 /* failure to setup for zero copy */
3298 }
3300 /*
3301 * If returning data via RDMA Write, then grab the chunk list. If we
3302 * aren't returning READ data w/RDMA_WRITE, then grab a mblk.
3303 */
3308 /*
3309 * mp will contain the data to be sent out in the read reply.
3310 * It will be freed after the reply has been sent. Let's
3311 * roundup the data to a BYTES_PER_XDR_UNIT multiple, so that
3312 * the call to xdrmblk_putmblk() never fails. If the first
3313 * alloc of the requested size fails, then decrease the size to
3314 * something more reasonable and wait for the allocation to
3315 * occur.
3316 */
3323 }
3329 }
3339 doio_read:
3350 }
3352 /* make mblk using zc buffers */
3356 }
3367 }
3373 else
3379 }
3382 }
3384 out:
3390 }
3392 static void
3394 {
3402 }
3403 }
3405 static void
3407 {
3414 }
3415 }
3418 /* ARGSUSED */
3419 static void
3422 {
3434 }
3445 }
3451 }
3454 /*
3455 * No filesystem is actually shared public, so we default
3456 * to exi_root. In this case, we must check whether root
3457 * is exported.
3458 */
3461 /*
3462 * if root filesystem is exported, the exportinfo struct that we
3463 * should use is what checkexport4 returns, because root_exi is
3464 * actually a mostly empty struct.
3465 */
3470 /*
3471 * it's a properly shared filesystem
3472 */
3474 }
3488 NFS4ERR_SERVERFAULT;
3490 }
3491 }
3492 }
3502 }
3505 out:
3508 }
3510 /*
3511 * XXX - issue with put*fh operations. Suppose /export/home is exported.
3512 * Suppose an NFS client goes to mount /export/home/joe. If /export, home,
3513 * or joe have restrictive search permissions, then we shouldn't let
3514 * the client get a file handle. This is easy to enforce. However, we
3515 * don't know what security flavor should be used until we resolve the
3516 * path name. Another complication is uid mapping. If root is
3517 * the user, then it will be mapped to the anonymous user by default,
3518 * but we won't know that till we've resolved the path name. And we won't
3519 * know what the anonymous user is.
3520 * Luckily, SECINFO is specified to take a full filename.
3521 * So what we will have to in rfs4_op_lookup is check that flavor of
3522 * the target object matches that of the request, and if root was the
3523 * caller, check for the root= and anon= options, and if necessary,
3524 * repeat the lookup using the right cred_t. But that's not done yet.
3525 */
3526 /* ARGSUSED */
3527 static void
3530 {
3541 }
3546 }
3552 }
3556 NULL);
3561 }
3570 }
3576 }
3582 out:
3585 }
3587 /* ARGSUSED */
3588 static void
3591 {
3594 fid_t fid;
3602 }
3609 /*
3610 * Using rootdir, the system root vnode,
3611 * get its fid.
3612 */
3619 }
3621 /*
3622 * Then use the root fsid & fid it to find out if it's exported
3623 *
3624 * If the server root isn't exported directly, then
3625 * it should at least be a pseudo export based on
3626 * one or more exports further down in the server's
3627 * file tree.
3628 */
3635 }
3637 /*
3638 * Now make a filehandle based on the root
3639 * export and root vnode.
3640 */
3645 }
3658 }
3662 out:
3665 }
3667 /*
3668 * A directory entry is a valid nfsv4 entry if
3669 * - it has a non-zero ino
3670 * - it is not a dot or dotdot name
3671 * - it is visible in a pseudo export or in a real export that can
3672 * only have a limited view.
3673 */
3674 static bool_t
3677 {
3681 }
3686 }
3689 }
3691 /*
3692 * set_rdattr_params sets up the variables used to manage what information
3693 * to get for each directory entry.
3694 */
3695 static nfsstat4
3698 {
3699 uint_t va_mask;
3700 nfsstat4 status;
3701 bitmap4 objbits;
3705 /*
3706 * could not even figure attr mask
3707 */
3709 }
3712 /*
3713 * dirent's d_ino is always correct value for mounted_on_fileid.
3714 * mntdfid_set is set once here, but mounted_on_fileid is
3715 * set in main dirent processing loop for each dirent.
3716 * The mntdfid_set is a simple optimization that lets the
3717 * server attr code avoid work when caller is readdir.
3718 */
3721 /*
3722 * Lookup entry only if client asked for any of the following:
3723 * a) vattr attrs
3724 * b) vfs attrs
3725 * c) attrs w/per-object scope requested (change, filehandle, etc)
3726 * other than mounted_on_fileid (which we can take from dirent)
3727 */
3732 else
3738 /*
3739 * If filesystem attrs are requested, get them now from the
3740 * directory vp, as most entries will have same filesystem. The only
3741 * exception are mounted over entries but we handle
3742 * those as we go (XXX mounted over detection not yet implemented).
3743 */
3749 /*
3750 * Failed to get filesystem attributes.
3751 * Return a rdattr_error for each entry, but don't fail.
3752 * However, don't get any obj-dependent attrs.
3753 */
3756 /*
3757 * At least get fileid for regular readdir output
3758 */
3761 }
3764 }
3766 /*
3767 * readlink: args: CURRENT_FH.
3768 * res: status. If success - CURRENT_FH unchanged, return linktext.
3769 */
3771 /* ARGSUSED */
3772 static void
3775 {
3789 /* CURRENT_FH: directory */
3794 }
3799 }
3801 /* Is it a referral? */
3813 }
3818 }
3820 }
3827 }
3832 }
3840 /* Get an artificial symlink based on a referral */
3851 }
3868 }
3874 }
3881 /*
3882 * Even though the conversion failed, we return
3883 * something. We just don't translate it.
3884 */
3886 }
3888 /*
3889 * treat link name as data
3890 */
3898 out:
3901 }
3903 static void
3905 {
3911 }
3912 }
3914 /*
3915 * release_lockowner:
3916 * Release any state associated with the supplied
3917 * lockowner. Note if any lo_state is holding locks we will not
3918 * rele that lo_state and thus the lockowner will not be destroyed.
3919 * A client using lock after the lock owner stateid has been released
3920 * will suffer the consequence of NFS4ERR_BAD_STATEID and would have
3921 * to reissue the lock with new_lock_owner set to TRUE.
3922 * args: lock_owner
3923 * res: status
3924 */
3925 /* ARGSUSED */
3926 static void
3929 {
3939 sysid_t sysid;
3944 /* Make sure there is a clientid around for this request */
3951 }
3958 }
3961 /*
3962 * Check for EXPIRED client. If so will reap state with in a lease
3963 * period or on next set_clientid_confirm step
3964 */
3969 }
3971 /*
3972 * If no sysid has been assigned, then no locks exist; just return.
3973 */
3979 }
3984 /*
3985 * Mark the lockowner invalid.
3986 */
3989 /*
3990 * sysid-pid pair should now not be used since the lockowner is
3991 * invalid. If the client were to instantiate the lockowner again
3992 * it would be assigned a new pid. Thus we can get the list of
3993 * current locks.
3994 */
3997 /* If we are still holding locks fail */
4003 /*
4004 * We need to unhide the lockowner so the client can
4005 * try it again. The bad thing here is if the client
4006 * has a logic error that took it here in the first place
4007 * he probably has lost accounting of the locks that it
4008 * is holding. So we may have dangling state until the
4009 * open owner state is reaped via close. One scenario
4010 * that could possibly occur is that the client has
4011 * sent the unlock request(s) in separate threads
4012 * and has not waited for the replies before sending the
4013 * RELEASE_LOCKOWNER request. Presumably, it would expect
4014 * and deal appropriately with NFS4ERR_LOCKS_HELD, by
4015 * reissuing the request.
4016 */
4020 }
4022 /*
4023 * For the corresponding client we need to check each open
4024 * owner for any opens that have lockowner state associated
4025 * with this lockowner.
4026 */
4044 }
4045 }
4047 }
4049 }
4056 out:
4059 }
4061 /*
4062 * short utility function to lookup a file and recall the delegation
4063 */
4067 {
4082 else
4084 }
4090 }
4092 /*
4093 * remove: args: CURRENT_FH: directory; name.
4094 * res: status. If success - CURRENT_FH unchanged, return change_info
4095 * for directory.
4096 */
4097 /* ARGSUSED */
4098 static void
4101 {
4108 uint_t len;
4114 nfsstat4 status;
4119 /* CURRENT_FH: directory */
4124 }
4129 }
4131 /*
4132 * If there is an unshared filesystem mounted on this vnode,
4133 * Do not allow to remove anything in this directory.
4134 */
4138 }
4143 }
4149 }
4151 /*
4152 * Lookup the file so that we can check if it's a directory
4153 */
4158 }
4164 }
4170 }
4180 }
4182 /*
4183 * Lookup the file to determine type and while we are see if
4184 * there is a file struct around and check for delegation.
4185 * We don't need to acquire va_seq before this lookup, if
4186 * it causes an update, cinfo.before will not match, which will
4187 * trigger a cache flush even if atomic is TRUE.
4188 */
4191 NULL)) {
4199 }
4200 }
4202 /* Didn't find anything to remove */
4209 }
4224 }
4226 }
4227 }
4229 /* check label before allowing removal */
4249 }
4251 }
4252 }
4253 }
4255 /* Get dir "before" change value */
4269 }
4271 }
4274 /* Actually do the REMOVE operation */
4276 /*
4277 * Can't remove a directory that has a mounted-on filesystem.
4278 */
4282 /*
4283 * System V defines rmdir to return EEXIST,
4284 * not ENOTEMPTY, if the directory is not
4285 * empty. A System V NFS server needs to map
4286 * NFS4ERR_EXIST to NFS4ERR_NOTEMPTY to
4287 * transmit over the wire.
4288 */
4292 }
4306 /*
4307 * This is va_seq safe because we are not
4308 * manipulating dvp.
4309 */
4313 /* Remove state on file remove */
4317 }
4319 }
4321 }
4322 }
4323 }
4332 }
4340 }
4342 /*
4343 * Get the initial "after" sequence number, if it fails, set to zero
4344 */
4349 /*
4350 * Force modified data and metadata out to stable storage.
4351 */
4354 /*
4355 * Get "after" change value, if it fails, simply return the
4356 * before value.
4357 */
4362 }
4366 /*
4367 * The cinfo.atomic = TRUE only if we have
4368 * non-zero va_seq's, and it has incremented by exactly one
4369 * during the VOP_REMOVE/RMDIR and it didn't change during
4370 * the VOP_FSYNC.
4371 */
4375 else
4380 out:
4383 }
4385 /*
4386 * rename: args: SAVED_FH: from directory, CURRENT_FH: target directory,
4387 * oldname and newname.
4388 * res: status. If success - CURRENT_FH unchanged, return change_info
4389 * for both from and target directories.
4390 */
4391 /* ARGSUSED */
4392 static void
4395 {
4413 nfsstat4 status;
4423 /* CURRENT_FH: target directory */
4428 }
4430 /* SAVED_FH: from directory */
4435 }
4440 }
4442 /*
4443 * If there is an unshared filesystem mounted on this vnode,
4444 * do not allow to rename objects in this directory.
4445 */
4449 }
4451 /*
4452 * If there is an unshared filesystem mounted on this vnode,
4453 * do not allow to rename to this directory.
4454 */
4458 }
4463 }
4468 }
4474 }
4480 }
4486 }
4490 nlen);
4496 }
4505 }
4517 }
4525 }
4537 }
4539 /* check label of the target dir */
4551 }
4552 }
4553 }
4555 /*
4556 * Is the source a file and have a delegation?
4557 * We don't need to acquire va_seq before these lookups, if
4558 * it causes an update, cinfo.before will not match, which will
4559 * trigger a cache flush even if atomic is TRUE.
4560 */
4564 NULL)) {
4567 }
4568 }
4579 }
4583 /* Does the destination exist and a file and have a delegation? */
4587 NULL)) {
4590 }
4591 }
4595 /* Check for NBMAND lock on both source and target */
4602 }
4603 }
4611 }
4612 }
4614 /* Get source "before" change value */
4620 }
4624 }
4644 /* The file is gone and so should the state */
4648 }
4650 }
4652 }
4653 }
4669 }
4673 }
4682 /*
4683 * Get the initial "after" sequence number, if it fails, set to zero
4684 */
4693 /*
4694 * Force modified data and metadata out to stable storage.
4695 */
4702 }
4704 /*
4705 * Get "after" change values, if it fails, simply return the
4706 * before value.
4707 */
4712 }
4718 }
4723 /*
4724 * The cinfo.atomic = TRUE only if we have
4725 * non-zero va_seq's, and it has incremented by exactly one
4726 * during the VOP_RENAME and it didn't change during the VOP_FSYNC.
4727 */
4731 else
4737 else
4740 #ifdef VOLATILE_FH_TEST
4741 {
4744 /*
4745 * Add the renamed file handle to the volatile rename list
4746 */
4748 /* file handles may expire on rename */
4752 /*
4753 * Already know that nnm will be a valid string
4754 */
4761 }
4762 }
4763 }
4767 out:
4772 err_out:
4789 }
4793 }
4797 }
4799 /* ARGSUSED */
4800 static void
4803 {
4815 }
4821 }
4831 }
4836 out:
4839 }
4841 /* ARGSUSED */
4842 static void
4845 {
4850 /* No need to check cs->access - we are not accessing any object */
4854 }
4857 }
4865 out:
4868 }
4870 /* ARGSUSED */
4871 static void
4874 {
4879 /* No need to check cs->access - we are not accessing any object */
4883 }
4886 }
4890 /*
4891 * since SAVEFH is fairly rare, don't alloc space for its fh
4892 * unless necessary.
4893 */
4896 }
4900 out:
4903 }
4905 /*
4906 * rfs4_verify_attr is called when nfsv4 Setattr failed, but we wish to
4907 * return the bitmap of attrs that were set successfully. It is also
4908 * called by Verify/Nverify to test the vattr/vfsstat attrs. It should
4909 * always be called only after rfs4_do_set_attrs().
4910 *
4911 * Verify that the attributes are same as the expected ones. sargp->vap
4912 * and sargp->sbp contain the input attributes as translated from fattr4.
4913 *
4914 * This function verifies only the attrs that correspond to a vattr or
4915 * vfsstat struct. That is because of the extra step needed to get the
4916 * corresponding system structs. Other attributes have already been set or
4917 * verified by do_rfs4_set_attrs.
4918 *
4919 * Return 0 if all attrs match, -1 if some don't, error if error processing.
4920 */
4921 static int
4924 {
4928 uint_t vbit;
4934 /*
4935 * Okay to overwrite sargp->vap because we verify based
4936 * on the incoming values.
4937 */
4943 /*
4944 * Must return bitmap of successful attrs
4945 */
4948 /*
4949 * Some file systems clobber va_mask. it is probably
4950 * wrong of them to do so, nonethless we practice
4951 * defensive coding.
4952 * See bug id 4276830.
4953 */
4955 }
4956 }
4959 /*
4960 * Now get the superblock and loop on the bitmap, as there is
4961 * no simple way of translating from superblock to bitmap4.
4962 */
4968 }
4969 }
4971 /*
4972 * Now loop and verify each attribute which getattr returned
4973 * whether it's the same as the input.
4974 */
4986 /*
4987 * If vattr attribute but VOP_GETATTR failed, or it's
4988 * superblock attribute but VFS_STATVFS failed, skip
4989 */
4995 }
5003 }
5007 }
5008 }
5009 errout:
5011 }
5013 /*
5014 * Decode the attribute to be set/verified. If the attr requires a sys op
5015 * (VOP_GETATTR, VFS_VFSSTAT), and the request is to verify, then don't
5016 * call the sv_getit function for it, because the sys op hasn't yet been done.
5017 * Return 0 for success, error code if failed.
5018 *
5019 * Note: the decoded arg is not freed here but in nfs4_ntov_table_free.
5020 */
5021 static int
5024 {
5026 bool_t set_later;
5032 /*
5033 * don't verify yet if a vattr or sb dependent attr,
5034 * because we don't have their sys values yet.
5035 * Will be done later.
5036 */
5038 /*
5039 * ACLs are a special case, since setting the MODE
5040 * conflicts with setting the ACL. We delay setting
5041 * the ACL until all other attributes have been set.
5042 * The ACL gets set in do_rfs4_op_setattr().
5043 */
5050 }
5051 }
5052 }
5054 #ifdef DEBUG
5057 #endif
5059 }
5062 }
5065 }
5067 /*
5068 * Set vattr based on incoming fattr4 attrs - used by setattr.
5069 * Set response mask. Ignore any values that are not writable vattr attrs.
5070 */
5071 static nfsstat4
5074 nfs4_attr_cmd_t cmd)
5075 {
5080 XDR xdr;
5086 #ifndef lint
5087 /*
5088 * Make sure that maximum attribute number can be expressed as an
5089 * 8 bit quantity.
5090 */
5092 #endif
5098 }
5103 }
5111 /* sargp->sbp is set by the caller */
5118 /*
5119 * The following loop iterates on the nfs4_ntov_map checking
5120 * if the fbit is set in the requested bitmap.
5121 * If set then we process the arguments using the
5122 * rfs4_fattr4 conversion functions to populate the setattr
5123 * vattr and va_mask. Any settable attrs that are not using vattr
5124 * will be set in this loop.
5125 */
5129 }
5130 /*
5131 * If setattr, must be a writable attr.
5132 * If verify/nverify, must be a readable attr.
5133 */
5136 /*
5137 * Client tries to set/verify an
5138 * unsupported attribute, tries to set
5139 * a read only attr or verify a write
5140 * only one - error!
5141 */
5143 }
5144 /*
5145 * Decode the attribute to set/verify
5146 */
5152 na++;
5156 }
5163 }
5165 static nfsstat4
5168 {
5171 bool_t trunc;
5182 caller_context_t ct;
5189 NFS4ATTR_SETIT);
5191 /*
5192 * failed set attrs
5193 */
5195 }
5198 /*
5199 * no further work to be done
5200 */
5202 }
5204 /*
5205 * If we got a request to set the ACL and the MODE, only
5206 * allow changing VSUID, VSGID, and VSVTX. Attempting
5207 * to change any other bits, along with setting an ACL,
5208 * gives NFS4ERR_INVAL.
5209 */
5212 vattr_t va;
5219 }
5224 }
5225 }
5227 /* Check stateid only if size has been set */
5239 }
5241 /* XXX start of possible race with delegations */
5243 /*
5244 * We need to specially handle size changes because it is
5245 * possible for the client to create a file with read-only
5246 * modes, but with the file opened for writing. If the client
5247 * then tries to set the file size, e.g. ftruncate(3C),
5248 * fcntl(F_FREESP), the normal access checking done in
5249 * VOP_SETATTR would prevent the client from doing it even though
5250 * it should be allowed to do so. To get around this, we do the
5251 * access checking for ourselves and use VOP_SPACE which doesn't
5252 * do the access checking.
5253 * Also the client should not be allowed to change the file
5254 * size if there is a conflicting non-blocking mandatory lock in
5255 * the region of the change.
5256 */
5258 u_offset_t offset;
5259 ssize_t length;
5261 /*
5262 * ufs_setattr clears AT_SIZE from vap->va_mask, but
5263 * before returning, sarg.vap->va_mask is used to
5264 * generate the setattr reply bitmap. We also clear
5265 * AT_SIZE below before calling VOP_SPACE. For both
5266 * of these cases, the va_mask needs to be saved here
5267 * and restored after calling VOP_SETATTR.
5268 */
5271 /*
5272 * Check any possible conflict due to NBMAND locks.
5273 * Get into critical region before VOP_GETATTR, so the
5274 * size attribute is valid when checking conflicts.
5275 */
5279 }
5285 }
5294 }
5299 }
5300 }
5312 }
5313 }
5318 /* restore va_mask -- ufs_setattr clears AT_SIZE */
5322 /*
5323 * If an ACL was being set, it has been delayed until now,
5324 * in order to set the mode (via the VOP_SETATTR() above) first.
5325 */
5341 }
5347 }
5348 }
5351 /* check if a monitor detected a delegation conflict */
5354 else
5357 /*
5358 * Set the response bitmap when setattr failed.
5359 * If VOP_SETATTR partially succeeded, test by doing a
5360 * VOP_GETATTR on the object and comparing the data
5361 * to the setattr arguments.
5362 */
5365 /*
5366 * Force modified metadata out to stable storage.
5367 */
5369 /*
5370 * Set response bitmap
5371 */
5373 }
5375 /* Return early and already have a NFSv4 error */
5376 done:
5377 /*
5378 * Except for nfs4_vmask_to_nmask_set(), vattr --> fattr
5379 * conversion sets both readable and writeable NFS4 attrs
5380 * for AT_MTIME and AT_ATIME. The line below masks out
5381 * unrequested attrs from the setattr result bitmap. This
5382 * is placed after the done: label to catch the ATTRNOTSUP
5383 * case.
5384 */
5393 }
5395 /* ARGSUSED */
5396 static void
5399 {
5410 }
5412 /*
5413 * If there is an unshared filesystem mounted on this vnode,
5414 * do not allow to setattr on this vnode.
5415 */
5419 }
5426 }
5428 /* check label before setting attributes */
5440 }
5441 }
5442 }
5448 out:
5451 }
5453 /* ARGSUSED */
5454 static void
5457 {
5458 /*
5459 * verify and nverify are exactly the same, except that nverify
5460 * succeeds when some argument changed, and verify succeeds when
5461 * when none changed.
5462 */
5478 }
5486 /*
5487 * do_rfs4_set_attrs will try to verify systemwide attrs,
5488 * so could return -1 for "no match".
5489 */
5493 }
5505 }
5506 done:
5509 out:
5512 }
5514 /* ARGSUSED */
5515 static void
5518 {
5519 /*
5520 * verify and nverify are exactly the same, except that nverify
5521 * succeeds when some argument changed, and verify succeeds when
5522 * when none changed.
5523 */
5541 }
5548 /*
5549 * do_rfs4_set_attrs will try to verify systemwide attrs,
5550 * so could return -1 for "no match".
5551 */
5555 }
5567 }
5568 done:
5574 }
5576 /*
5577 * XXX - This should live in an NFS header file.
5578 */
5579 #define MAX_IOVECS 12
5581 /* ARGSUSED */
5582 static void
5585 {
5591 u_offset_t rlimit;
5599 nfsstat4 stat;
5601 caller_context_t ct;
5610 }
5614 }
5622 }
5624 /*
5625 * We have to enter the critical region before calling VOP_RWLOCK
5626 * to avoid a deadlock with ufs.
5627 */
5635 }
5636 }
5641 /*
5642 * If we can't get the attributes, then we can't do the
5643 * right access checking. So, we'll fail the request.
5644 */
5648 }
5653 }
5659 }
5665 }
5670 }
5678 }
5690 iovcnt++;
5692 }
5693 #ifdef DEBUG
5694 /* should have ended on an mblk boundary */
5701 }
5702 #endif
5707 }
5719 }
5744 }
5746 /*
5747 * We're changing creds because VM may fault and we need
5748 * the cred of the current thread to be used if quota
5749 * checking is enabled.
5750 */
5762 }
5769 else
5774 out:
5780 }
5783 /* XXX put in a header file */
5786 void
5789 {
5790 uint_t i;
5796 /*
5797 * Form a reply tag by copying over the reqeuest tag.
5798 */
5814 /*
5815 * XXX for now, minorversion should be zero
5816 */
5824 }
5829 }
5847 }
5850 KM_SLEEP);
5857 /*
5858 * For now, NFS4 compound processing must be protected by
5859 * exported_lock because it can access more than one exportinfo
5860 * per compound and share/unshare can now change multiple
5861 * exinfo structs. The NFS2/3 code only refs 1 exportinfo
5862 * per proc (excluding public exinfo), and exi_count design
5863 * is sufficient to protect concurrent execution of NFS2/3
5864 * ops along with unexport. This lock will be removed as
5865 * part of the NFSv4 phase 2 namespace redesign work.
5866 */
5869 /*
5870 * If this is the first compound we've seen, we need to start all
5871 * new instances' grace periods.
5872 */
5875 /*
5876 * This must be set after rfs4_grace_start_new(), otherwise
5877 * another thread could proceed past here before the former
5878 * is finished.
5879 */
5881 }
5886 uint_t op;
5894 /*
5895 * Count the individual ops here; NULL and COMPOUND
5896 * are counted in common_dispatch()
5897 */
5908 /*
5909 * This is effectively dead code since XDR code
5910 * will have already returned BADXDR if op doesn't
5911 * decode to legal value. This only done for a
5912 * day when XDR code doesn't verify v4 opcodes.
5913 */
5919 }
5921 /*
5922 * If not at last op, and if we are to stop, then
5923 * compact the results array.
5924 */
5935 }
5936 }
5954 /*
5955 * done with this compound request, free the label
5956 */
5961 }
5962 }
5964 /*
5965 * XXX because of what appears to be duplicate calls to rfs4_compound_free
5966 * XXX zero out the tag and array values. Need to investigate why the
5967 * XXX calls occur, but at least prevent the panic for now.
5968 */
5969 void
5971 {
5972 uint_t i;
5976 }
5980 uint_t op;
5986 }
5987 }
5990 }
5991 }
5993 /*
5994 * Process the value of the compound request rpc flags, as a bit-AND
5995 * of the individual per-op flags (idempotent, allowork, publicfh_ok)
5996 */
5997 void
5999 {
6004 uint_t op;
6010 else
6012 }
6014 }
6016 nfsstat4
6018 {
6019 nfsstat4 e;
6038 }
6040 #if defined(DEBUG) && ! defined(lint)
6042 {
6054 }
6064 }
6070 }
6072 #define LOCK_PRINT(d, s, t, f) if (d) lock_print(s, t, f)
6073 #else
6074 #define LOCK_PRINT(d, s, t, f)
6075 #endif
6077 /*ARGSUSED*/
6078 static bool_t
6080 {
6082 }
6084 /*
6085 * Look up the pathname using the vp in cs as the directory vnode.
6086 * cs->vp will be the vnode for the file on success
6087 */
6089 static nfsstat4
6092 {
6095 nfsstat4 status;
6101 }
6104 }
6113 }
6118 }
6127 }
6137 }
6139 static nfsstat4
6142 {
6143 nfsstat4 status;
6148 /* Get "before" change value */
6154 /* rfs4_lookup may VN_RELE directory */
6161 }
6163 /*
6164 * Get "after" change value, if it fails, simply return the
6165 * before value.
6166 */
6171 }
6174 /*
6175 * Validate the file is a file
6176 */
6188 }
6193 /*
6194 * It is undefined if VOP_LOOKUP will change va_seq, so
6195 * cinfo.atomic = TRUE only if we have
6196 * non-zero va_seq's, and they have not changed.
6197 */
6200 else
6203 /* Check for mandatory locking */
6206 }
6208 static nfsstat4
6211 {
6214 vattr_t va;
6216 tryagain:
6218 /*
6219 * The file open mode used is VWRITE. If the client needs
6220 * some other semantic, then it should do the access checking
6221 * itself. It would have been nice to have the file open mode
6222 * passed as part of the arguments.
6223 */
6231 /*
6232 * If we got something other than file already exists
6233 * then just return this error. Otherwise, we got
6234 * EEXIST. If we were doing a GUARDED create, then
6235 * just return this error. Otherwise, we need to
6236 * make sure that this wasn't a duplicate of an
6237 * exclusive create request.
6238 *
6239 * The assumption is made that a non-exclusive create
6240 * request will never return EEXIST.
6241 */
6246 }
6251 /*
6252 * We couldn't find the file that we thought that
6253 * we just created. So, we'll just try creating
6254 * it again.
6255 */
6261 }
6264 /* existing object must be regular file */
6270 else
6274 }
6277 }
6279 /* Check for duplicate request */
6284 /* We found the file */
6287 /* but its not our creation */
6290 }
6293 }
6296 }
6299 }
6301 static nfsstat4
6304 {
6307 bool_t readonly;
6310 /* For now we don't allow mandatory locking as per V2/V3 */
6313 }
6318 /*
6319 * If the file system is exported read only and we are trying
6320 * to open for write, then return NFS4ERR_ROFS
6321 */
6332 }
6333 }
6339 }
6342 }
6344 static nfsstat4
6347 {
6353 nfsstat4 status;
6359 uint_t buflen;
6360 bool_t created;
6362 len_t reqsize;
6364 bool_t trunc;
6365 caller_context_t ct;
6376 /* Check if the file system is read only */
6380 /* check the label of including directory */
6391 }
6392 }
6393 }
6395 /*
6396 * Get the last component of path name in nm. cs will reference
6397 * the including directory on success.
6398 */
6412 }
6419 }
6424 }
6430 /*FALLTHROUGH*/
6446 else
6448 }
6455 }
6464 }
6468 /* Disallow create with a non-zero size */
6475 }
6477 }
6481 /* prohibit EXCL create of named attributes */
6486 }
6490 /*
6491 * Ensure no time overflows. Assumes underlying
6492 * filesystem supports at least 32 bits.
6493 * Truncate nsec to usec resolution to allow valid
6494 * compares even if the underlying filesystem truncates.
6495 */
6502 /*
6503 * For EXCL create, attrset is set to the server attr
6504 * used to cache the client's verifier.
6505 */
6508 }
6517 }
6530 }
6537 /*
6538 * True verification that object was created with correct
6539 * attrs is impossible. The attrs could have been changed
6540 * immediately after object creation. If attributes did
6541 * not verify, the only recourse for the server is to
6542 * destroy the object. Maybe if some attrs (like gid)
6543 * are set incorrectly, the object should be destroyed;
6544 * however, seems bad as a default policy. Do we really
6545 * want to destroy an object over one of the times not
6546 * verifying correctly? For these reasons, the server
6547 * currently sets bits in attrset for createattrs
6548 * that were set; however, no verification is done.
6549 *
6550 * vmask_to_nmask accounts for vattr bits set on create
6551 * [do_rfs4_set_attrs() only sets resp bits for
6552 * non-vattr/vfs bits.]
6553 * Mask off any bits we set by default so as not to return
6554 * more attrset bits than were requested in createattrs
6555 */
6560 /*
6561 * We did not create the vnode (we tried but it
6562 * already existed). In this case, the only createattr
6563 * that the spec allows the server to set is size,
6564 * and even then, it can only be set if it is 0.
6565 */
6569 }
6570 }
6574 /*
6575 * Get the initial "after" sequence number, if it fails,
6576 * set to zero, time to before.
6577 */
6582 }
6584 /*
6585 * create_vnode attempts to create the file exclusive,
6586 * if it already exists the VOP_CREATE will fail and
6587 * may not increase va_seq. It is atomic if
6588 * we haven't changed the directory, but if it has changed
6589 * we don't know what changed it.
6590 */
6595 else
6599 /*
6600 * The entry was created, we need to sync the
6601 * directory metadata.
6602 */
6605 /*
6606 * Get "after" change value, if it fails, simply return the
6607 * before value.
6608 */
6613 }
6617 /*
6618 * The cinfo->atomic = TRUE only if we have
6619 * non-zero va_seq's, and it has incremented by exactly one
6620 * during the create_vnode and it didn't
6621 * change during the VOP_FSYNC.
6622 */
6626 else
6628 }
6630 /* Check for mandatory locking and that the size gets set. */
6635 /* Assume the worst */
6641 /*
6642 * Truncate the file if necessary; this would be
6643 * the case for create over an existing file.
6644 */
6651 /*
6652 * We are writing over an existing file.
6653 * Check to see if we need to recall a delegation.
6654 */
6664 }
6666 }
6682 }
6683 }
6694 }
6695 }
6699 /*
6700 * Force modified data and metadata out to stable storage.
6701 */
6708 }
6710 /* if parent dir is attrdir, set namedattr fh flag */
6719 /*
6720 * if we did not create the file, we will need to check
6721 * the access bits on the file
6722 */
6730 }
6732 }
6734 /*ARGSUSED*/
6735 static void
6740 {
6741 /* XXX Currently not using req */
6749 sysid_t sysid;
6750 nfsstat4 status;
6751 caller_context_t ct;
6757 /* get the file struct and hold a lock on it during initial open */
6763 }
6769 /* No need to keep any reference */
6773 }
6775 /* try to get the sysid before continuing */
6779 /* Not a fully formed open; "close" it */
6784 }
6786 /* Calculate the fflags for this OPEN. */
6794 /*
6795 * Calculate the new deny and access mode that this open is adding to
6796 * the file for this open owner;
6797 */
6801 /*
6802 * Calculate the new share access and share deny modes that this open
6803 * is adding to the file for this open owner;
6804 */
6810 /*
6811 * Check to see the client has already sent an open for this
6812 * open owner on this file with the same share/deny modes.
6813 * If so, we don't need to check for a conflict and we don't
6814 * need to add another shrlock. If not, then we need to
6815 * check for conflicts in deny and access before checking for
6816 * conflicts in delegation. We don't want to recall a
6817 * delegation based on an open that will eventually fail based
6818 * on shares modes.
6819 */
6827 /* Not a fully formed open; "close" it */
6832 }
6833 }
6837 /*
6838 * Check to see if this file is delegated and if so, if a
6839 * recall needs to be done.
6840 */
6848 /* if state closed while lock was dropped */
6854 /* Not a fully formed open; "close" it */
6860 }
6863 /* Let's see if the delegation was returned */
6872 /* Not a fully formed open; "close" it */
6878 }
6879 }
6880 /*
6881 * the share check passed and any delegation conflict has been
6882 * taken care of, now call vop_open.
6883 * if this is the first open then call vop_open with fflags.
6884 * if not, call vn_open_upgrade with just the upgrade flags.
6885 *
6886 * if the file has been opened already, it will have the current
6887 * access mode in the state struct. if it has no share access, then
6888 * this is a new open.
6889 *
6890 * However, if this is open with CLAIM_DLEGATE_CUR, then don't
6891 * call VOP_OPEN(), just do the open upgrade.
6892 */
6906 /* Not a fully formed open; "close" it */
6910 /* check if a monitor detected a delegation conflict */
6913 else
6916 }
6918 /*
6919 * calculate the fflags for the new mode that is being added
6920 * by this upgrade.
6921 */
6928 }
6944 /*
6945 * Check for delegation here. if the deleg argument is not
6946 * DELEG_ANY, then this is a reclaim from a client and
6947 * we must honor the delegation requested. If necessary we can
6948 * set the recall flag.
6949 */
6965 }
6971 }
6973 /*ARGSUSED*/
6974 static void
6977 {
6985 /* inhibit delegation grants during exclusive create */
6992 }
6996 /* cs->vp cs->fh now reference the desired file */
7002 /*
7003 * If rfs4_createfile set attrset, we must
7004 * clear this attrset before the response is copied.
7005 */
7008 }
7009 }
7010 else
7015 }
7017 /*ARGSUSED*/
7018 static void
7021 {
7023 vattr_t va;
7027 /* Verify that we have a regular file */
7033 else
7036 }
7043 }
7047 /*
7048 * Check if we have access to the file, Note the the file
7049 * could have originally been open UNCHECKED or GUARDED
7050 * with mode bits that will now fail, but there is nothing
7051 * we can really do about that except in the case that the
7052 * owner of the file is the one requesting the open.
7053 */
7058 }
7059 }
7061 /*
7062 * cinfo on a CLAIM_PREVIOUS is undefined, initialize to zero
7063 */
7071 }
7073 static void
7076 {
7078 nfsstat4 status;
7079 stateid4 stateid =
7083 /*
7084 * Find the state info from the stateid and confirm that the
7085 * file is delegated. If the state openowner is the same as
7086 * the supplied openowner we're done. If not, get the file
7087 * info from the found state info. Use that file info to
7088 * create the state for this lock owner. Note solaris doen't
7089 * really need the pathname to find the file. We may want to
7090 * lookup the pathname and make sure that the vp exist and
7091 * matches the vp in the file structure. However it is
7092 * possible that the pathname nolonger exists (local process
7093 * unlinks the file), so this may not be that useful.
7094 */
7100 }
7104 /*
7105 * New lock owner, create state. Since this was probably called
7106 * in response to a CB_RECALL we set deleg to DELEG_NONE
7107 */
7118 }
7120 /* Mark progress for delegation returns */
7125 }
7127 /*ARGSUSED*/
7128 static void
7131 {
7132 /*
7133 * Lookup the pathname, it must already exist since this file
7134 * was delegated.
7135 *
7136 * Find the file and state info for this vp and open owner pair.
7137 * check that they are in fact delegated.
7138 * check that the state access and deny modes are the same.
7139 *
7140 * Return the delgation possibly seting the recall flag.
7141 */
7149 /* Note we ignore oflags */
7155 }
7157 /* get the file struct and hold a lock on it during initial open */
7163 }
7172 }
7187 }
7197 }
7221 }
7223 /* XXX For now */
7233 }
7241 /*
7242 * Generic function for sequence number checks.
7243 */
7244 static rfs4_chkseq_t
7247 {
7248 /* Same sequence ids and matching operations? */
7253 }
7257 }
7259 /* If the incoming sequence is not the next expected then it is bad */
7267 }
7272 }
7274 /* Everything okay -- next expected */
7276 }
7279 static rfs4_chkseq_t
7281 {
7282 rfs4_chkseq_t rc;
7286 TRUE);
7293 }
7295 static rfs4_chkseq_t
7297 {
7298 rfs4_chkseq_t rc;
7306 }
7308 static rfs4_chkseq_t
7310 {
7320 }
7322 static void
7325 {
7332 bool_t create;
7342 }
7344 /*
7345 * Need to check clientid and lease expiration first based on
7346 * error ordering and incrementing sequence id.
7347 */
7353 }
7359 }
7362 /*
7363 * Find the open_owner for use from this point forward. Take
7364 * care in updating the sequence id based on the type of error
7365 * being returned.
7366 */
7367 retry:
7374 }
7376 /* Hold off access to the sequence space while the open is done */
7379 /*
7380 * If the open_owner existed before at the server, then check
7381 * the sequence id.
7382 */
7392 }
7400 }
7402 /*
7403 * Sequence was ok and open owner exists
7404 * check to see if we have yet to see an
7405 * open_confirm.
7406 */
7412 }
7413 }
7414 /* Grace only applies to regular-type OPENs */
7419 }
7421 /*
7422 * If previous state at the server existed then can_reclaim
7423 * will be set. If not reply NFS4ERR_NO_GRACE to the
7424 * client.
7425 */
7429 }
7432 /*
7433 * Reject the open if the client has missed the grace period
7434 */
7438 }
7440 /* Couple of up-front bookkeeping items */
7442 /*
7443 * If this is a reclaim OPEN then we should not ask
7444 * for a confirmation of the open_owner per the
7445 * protocol specification.
7446 */
7449 else
7451 }
7454 /*
7455 * If there is an unshared filesystem mounted on this vnode,
7456 * do not allow to open/create in this directory.
7457 */
7461 }
7463 /*
7464 * access must READ, WRITE, or BOTH. No access is invalid.
7465 * deny can be READ, WRITE, BOTH, or NONE.
7466 * bits not defined for access/deny are invalid.
7467 */
7473 }
7476 /*
7477 * make sure attrset is zero before response is built.
7478 */
7497 }
7499 out:
7502 /* Catch sequence id handling here to make it a little easier */
7511 /*
7512 * The protocol states that if any of these errors are
7513 * being returned, the sequence id should not be
7514 * incremented. Any other return requires an
7515 * increment.
7516 */
7519 /* Always update the lease in this case */
7522 /* Regular response - copy the result */
7526 /*
7527 * REPLAY case: Only if the previous response was OK
7528 * do we copy the filehandle. If not OK, no
7529 * filehandle to copy.
7530 */
7534 /*
7535 * If this is a replay, we must restore the
7536 * current filehandle/vp to that of what was
7537 * returned originally. Try our best to do
7538 * it.
7539 */
7549 }
7560 }
7562 /*
7563 * If this was a replay, no need to update the
7564 * sequence id. If the open_owner was not created on
7565 * this pass, then update. The first use of an
7566 * open_owner will not bump the sequence id.
7567 */
7570 /*
7571 * If the client is receiving an error and the
7572 * open_owner needs to be confirmed, there is no way
7573 * to notify the client of this fact ignoring the fact
7574 * that the server has no method of returning a
7575 * stateid to confirm. Therefore, the server needs to
7576 * mark this open_owner in a way as to avoid the
7577 * sequence id checking the next time the client uses
7578 * this open_owner.
7579 */
7582 /*
7583 * If OK response then clear the postpone flag and
7584 * reset the sequence id to keep in sync with the
7585 * client.
7586 */
7590 }
7592 }
7594 finish:
7600 end:
7603 }
7605 /*ARGSUSED*/
7606 void
7609 {
7613 nfsstat4 status;
7621 }
7627 }
7629 /* Ensure specified filehandle matches */
7634 }
7636 /* hold off other access to open_owner while we tinker */
7645 }
7646 /*
7647 * If it is the appropriate stateid and determined to
7648 * be "OKAY" then this means that the stateid does not
7649 * need to be confirmed and the client is in error for
7650 * sending an OPEN_CONFIRM.
7651 */
7668 resop)) {
7670 /*
7671 * This is replayed stateid; if seqid matches
7672 * next expected, then client is using wrong seqid.
7673 */
7674 /* fall through */
7679 /*
7680 * Note this case is the duplicate case so
7681 * resp->status is already set.
7682 */
7686 }
7693 }
7707 }
7711 out:
7714 }
7716 /*ARGSUSED*/
7717 void
7720 {
7725 nfsstat4 status;
7736 }
7741 }
7747 }
7749 /* Ensure specified filehandle matches */
7754 }
7756 /* hold off other access to open_owner while we tinker */
7765 }
7783 /* Check the sequence id for the open owner */
7785 resop)) {
7787 /*
7788 * This is replayed stateid; if seqid matches
7789 * next expected, then client is using wrong seqid.
7790 */
7791 /* fall through */
7796 /*
7797 * Note this case is the duplicate case so
7798 * resp->status is already set.
7799 */
7803 }
7808 }
7811 /*
7812 * Check that the new access modes and deny modes are valid.
7813 * Check that no invalid bits are set.
7814 */
7821 }
7823 /*
7824 * The new modes must be a subset of the current modes and
7825 * the access must specify at least one mode. To test that
7826 * the new mode is a subset of the current modes we bitwise
7827 * AND them together and check that the result equals the new
7828 * mode. For example:
7829 * New mode, access == R and current mode, sp->rs_open_access == RW
7830 * access & sp->rs_open_access == R == access, so the new access mode
7831 * is valid. Consider access == RW, sp->rs_open_access = R
7832 * access & sp->rs_open_access == R != access, so the new access mode
7833 * is invalid.
7834 */
7843 }
7845 /*
7846 * Release any share locks associated with this stateID.
7847 * Strictly speaking, this violates the spec because the
7848 * spec effectively requires that open downgrade be atomic.
7849 * At present, fs_shrlock does not have this capability.
7850 */
7859 }
7864 /*
7865 * If the current mode has deny read and the new mode
7866 * does not, decrement the number of deny read mode bits
7867 * and if it goes to zero turn off the deny read bit
7868 * on the file.
7869 */
7875 }
7877 /*
7878 * If the current mode has deny write and the new mode
7879 * does not, decrement the number of deny write mode bits
7880 * and if it goes to zero turn off the deny write bit
7881 * on the file.
7882 */
7888 }
7890 /*
7891 * If the current mode has access read and the new mode
7892 * does not, decrement the number of access read mode bits
7893 * and if it goes to zero turn off the access read bit
7894 * on the file. set fflags to FREAD for the call to
7895 * vn_open_downgrade().
7896 */
7903 }
7905 /*
7906 * If the current mode has access write and the new mode
7907 * does not, decrement the number of access write mode bits
7908 * and if it goes to zero turn off the access write bit
7909 * on the file. set fflags to FWRITE for the call to
7910 * vn_open_downgrade().
7911 */
7918 }
7920 /* Check that the file is still accessible */
7925 /* now set the new open access and deny modes */
7929 /*
7930 * we successfully downgraded the share lock, now we need to downgrade
7931 * the open. it is possible that the downgrade was only for a deny
7932 * mode and we have nothing else to do.
7933 */
7937 /* Update the stateid */
7944 /* Update the lease */
7946 /* And the sequence */
7950 end:
7953 out:
7956 }
7958 /*
7959 * The logic behind this function is detailed in the NFSv4 RFC in the
7960 * SETCLIENTID operation description under IMPLEMENTATION. Refer to
7961 * that section for explicit guidance to server behavior for
7962 * SETCLIENTID.
7963 */
7964 void
7967 {
7972 bool_t create;
7978 retry:
7981 /*
7982 * Save the caller's IP address
7983 */
7987 /*
7988 * Record if it is a Solaris client that cannot handle referrals.
7989 */
7992 /* Add a "yes, it's downrev" record */
7998 /* Remove any previous record */
8000 }
8002 /*
8003 * In search of an EXISTING client matching the incoming
8004 * request to establish a new client identifier at the server
8005 */
8009 /* Should never happen */
8015 }
8017 /*
8018 * Easiest case. Client identifier is newly created and is
8019 * unconfirmed. Also note that for this case, no other
8020 * entries exist for the client identifier. Nothing else to
8021 * check. Just setup the response and respond.
8022 */
8028 /* Setup callback information; CB_NULL confirmation later */
8033 }
8035 /*
8036 * An existing, confirmed client may exist but it may not have
8037 * been active for at least one lease period. If so, then
8038 * "close" the client and create a new client identifier
8039 */
8043 }
8047 else
8052 /*
8053 * We have a confirmed client, now check for an
8054 * unconfimred entry
8055 */
8057 /* If creds don't match then client identifier is inuse */
8060 /*
8061 * Some one else has established this client
8062 * id. Try and say * who they are. We will use
8063 * the call back address supplied by * the
8064 * first client.
8065 */
8081 }
8087 }
8089 /*
8090 * Confirmed, creds match, and verifier matches; must
8091 * be an update of the callback info
8092 */
8095 /* Setup callback information */
8099 /* everything okay -- move ahead */
8104 /* update the confirm_verifier and return it */
8111 }
8113 /*
8114 * Creds match but the verifier doesn't. Must search
8115 * for an unconfirmed client that would be replaced by
8116 * this request.
8117 */
8120 cp_confirmed);
8121 }
8123 /*
8124 * At this point, we have taken care of the brand new client
8125 * struct, INUSE case, update of an existing, and confirmed
8126 * client struct.
8127 */
8129 /*
8130 * check to see if things have changed while we originally
8131 * picked up the client struct. If they have, then return and
8132 * retry the processing of this SETCLIENTID request.
8133 */
8142 }
8143 /* do away with the old unconfirmed one */
8148 }
8150 /*
8151 * This search will temporarily hide the confirmed client
8152 * struct while a new client struct is created as the
8153 * unconfirmed one.
8154 */
8164 }
8166 /*
8167 * If one was not created, then a similar request must be in
8168 * process so release and start over with this one
8169 */
8175 }
8181 /* Setup callback information; CB_NULL confirmation later */
8188 out:
8191 }
8193 /*ARGSUSED*/
8194 void
8197 {
8216 }
8222 }
8224 /* If the verifier doesn't match, the record doesn't match */
8229 }
8237 }
8239 /*
8240 * Update the client's associated server instance, if it's changed
8241 * since the client was created.
8242 */
8246 /*
8247 * Record clientid in stable storage.
8248 * Must be done after server instance has been assigned.
8249 */
8255 /* don't need to rele, client_close does it */
8258 /* If needed, initiate CB_NULL call for callback path */
8262 /*
8263 * Check to see if client can perform reclaims
8264 */
8269 out:
8273 }
8276 /*ARGSUSED*/
8277 void
8280 {
8284 nfsstat4 status;
8292 }
8298 }
8300 /* Ensure specified filehandle matches */
8305 }
8307 /* hold off other access to open_owner while we tinker */
8316 }
8334 /* Check the sequence id for the open owner */
8336 resop)) {
8338 /*
8339 * This is replayed stateid; if seqid matches
8340 * next expected, then client is using wrong seqid.
8341 */
8342 /* FALL THROUGH */
8347 /*
8348 * Note this case is the duplicate case so
8349 * resp->status is already set.
8350 */
8354 }
8359 }
8363 /* Update the stateid. */
8377 end:
8380 out:
8383 }
8385 /*
8386 * Manage the counts on the file struct and close all file locks
8387 */
8388 /*ARGSUSED*/
8389 void
8391 bool_t close_of_client)
8392 {
8397 /*
8398 * If this call is part of the larger closing down of client
8399 * state then it is just easier to release all locks
8400 * associated with this client instead of going through each
8401 * individual file and cleaning locks there.
8402 */
8407 /* Is the PxFS kernel module loaded? */
8411 /* Encode the cluster nodeid in new sysid */
8415 /*
8416 * This PxFS routine removes file locks for a
8417 * client over all nodes of a cluster.
8418 */
8421 new_sysid));
8426 /* Release all locks for this client */
8437 }
8440 }
8441 }
8443 /*
8444 * Release all locks on this file by this lock owner or at
8445 * least mark the locks as having been released
8446 */
8451 /* Was this already taken care of above? */
8457 }
8459 /*
8460 * Release any shrlocks associated with this open state ID.
8461 * This must be done before the rfs4_state gets marked closed.
8462 */
8469 /*
8470 * Decrement the count for each access and deny bit that this
8471 * state has contributed to the file.
8472 * If the file counts go to zero
8473 * clear the appropriate bit in the appropriate mask.
8474 */
8480 }
8487 }
8492 }
8497 }
8505 }
8506 }
8508 /*
8509 * lock_denied: Fill in a LOCK4deneid structure given an flock64 structure.
8510 */
8511 static nfsstat4
8513 {
8526 }
8534 }
8536 /*
8537 * Its not a NFS4 lock. We take advantage that the upper 32 bits
8538 * of the client id contain the boot time for a NFS4 lock. So we
8539 * fabricate and identity by setting clientid to the sysid, and
8540 * the lock owner to the pid.
8541 */
8547 finish:
8555 else
8559 }
8561 static int
8563 {
8571 retry:
8585 }
8586 }
8589 /* Get the owner of the lock */
8595 /* No longer locked, retry */
8597 }
8601 }
8602 }
8605 }
8607 /*ARGSUSED*/
8608 static nfsstat4
8611 {
8612 nfsstat4 status;
8619 sysid_t sysid;
8624 }
8629 /* Check for zero length. To lock to end of file use all ones for V4 */
8635 retry:
8640 }
8651 }
8661 }
8664 }
8675 /* Note that length4 is uint64_t but l_len and l_start are off64_t */
8679 }
8681 /*
8682 * N.B. FREAD has the same value as OPEN4_SHARE_ACCESS_READ and
8683 * FWRITE has the same value as OPEN4_SHARE_ACCESS_WRITE.
8684 */
8692 }
8696 /*
8697 * N.B. We map error values to nfsv4 errors. This is differrent
8698 * than puterrno4 routine.
8699 */
8706 /* Can only get here if op is OP_LOCK */
8726 }
8729 }
8731 /*ARGSUSED*/
8732 void
8735 {
8738 nfsstat4 status;
8758 }
8761 /* Create a new lockowner for this instance */
8775 }
8777 /* Ensure specified filehandle matches */
8784 }
8786 /* hold off other access to open_owner while we tinker */
8812 /*
8813 * This is replayed stateid; if seqid
8814 * matches next expected, then client
8815 * is using wrong seqid.
8816 */
8817 /* FALLTHROUGH */
8822 /* This is a duplicate LOCK request */
8825 /*
8826 * For a duplicate we do not want to
8827 * create a new lockowner as it should
8828 * already exist.
8829 * Turn off the lockowner create flag.
8830 */
8832 }
8834 }
8842 }
8847 /*
8848 * Only update theh open_seqid if this is not
8849 * a duplicate request
8850 */
8853 }
8861 }
8863 /*
8864 * This is the new_lock_owner branch and the client is
8865 * supposed to be associating a new lock_owner with
8866 * the open file at this point. If we find that a
8867 * lock_owner/state association already exists and a
8868 * successful LOCK request was returned to the client,
8869 * an error is returned to the client since this is
8870 * not appropriate. The client should be using the
8871 * existing lock_owner branch.
8872 */
8879 }
8880 }
8884 /*
8885 * Only update theh open_seqid if this is not
8886 * a duplicate request
8887 */
8890 }
8892 /*
8893 * If this is a duplicate lock request, just copy the
8894 * previously saved reply and return.
8895 */
8897 /* verify that lock_seqid's match */
8906 /*
8907 * Make sure to copy the just
8908 * retrieved reply status into the
8909 * overall compound status
8910 */
8912 }
8915 }
8919 /* Make sure to update the lock sequence id */
8925 /*
8926 * This is used to signify the newly created lockowner
8927 * stateid and its sequence number. The checks for
8928 * sequence number and increment don't occur on the
8929 * very first lock request for a lockowner.
8930 */
8933 /* hold off other access to lsp while we tinker */
8942 /* get lsp and hold the lock on the underlying file struct */
8949 }
8952 /* Ensure specified filehandle matches */
8959 }
8961 /* hold off other access to lsp while we tinker */
8966 /*
8967 * The stateid looks like it was okay (expected to be
8968 * the next one)
8969 */
8971 /*
8972 * The sequence id is now checked. Determine
8973 * if this is a replay or if it is in the
8974 * expected (next) sequence. In the case of a
8975 * replay, there are two replay conditions
8976 * that may occur. The first is the normal
8977 * condition where a LOCK is done with a
8978 * NFS4_OK response and the stateid is
8979 * updated. That case is handled below when
8980 * the stateid is identified as a REPLAY. The
8981 * second is the case where an error is
8982 * returned, like NFS4ERR_DENIED, and the
8983 * sequence number is updated but the stateid
8984 * is not updated. This second case is dealt
8985 * with here. So it may seem odd that the
8986 * stateid is okay but the sequence id is a
8987 * replay but it is okay.
8988 */
8994 /*
8995 * Here is our replay and need
8996 * to verify that the last
8997 * response was an error.
8998 */
9001 }
9002 /*
9003 * This is done since the sequence id
9004 * looked like a replay but it didn't
9005 * pass our check so a BAD_SEQID is
9006 * returned as a result.
9007 */
9008 /*FALLTHROUGH*/
9013 /* Everything looks okay move ahead */
9015 }
9034 /*
9035 * This is a replayed stateid; if
9036 * seqid matches the next expected,
9037 * then client is using wrong seqid.
9038 */
9046 }
9051 }
9055 }
9057 /*
9058 * NFS4 only allows locking on regular files, so
9059 * verify type of object.
9060 */
9064 else
9067 }
9074 }
9079 }
9084 }
9092 out:
9100 }
9101 /*
9102 * Only update the "OPEN" response here if this was a new
9103 * lock_owner
9104 */
9110 end:
9114 /*
9115 * If an sp obtained, then the lsp does not represent
9116 * a lock on the file struct.
9117 */
9120 else
9122 }
9126 }
9130 }
9132 /* free function for LOCK/LOCKT */
9133 static void
9135 {
9149 }
9153 }
9155 /*ARGSUSED*/
9156 void
9159 {
9162 nfsstat4 status;
9174 }
9181 }
9183 /* Ensure specified filehandle matches */
9190 }
9192 /* hold off other access to lsp while we tinker */
9201 }
9218 /*
9219 * This is a replayed stateid; if
9220 * seqid matches the next expected,
9221 * then client is using wrong seqid.
9222 */
9230 }
9235 }
9240 /*
9241 * NFS4 only allows locking on regular files, so
9242 * verify type of object.
9243 */
9247 else
9250 }
9255 }
9260 out:
9268 end:
9274 }
9276 /*
9277 * LOCKT is a best effort routine, the client can not be guaranteed that
9278 * the status return is still in effect by the time the reply is received.
9279 * They are numerous race conditions in this routine, but we are not required
9280 * and can not be accurate.
9281 */
9282 /*ARGSUSED*/
9283 void
9286 {
9296 length4 posix_length;
9297 sysid_t sysid;
9298 pid_t pid;
9306 }
9308 /*
9309 * NFS4 only allows locking on regular files, so
9310 * verify type of object.
9311 */
9315 else
9318 }
9320 /*
9321 * Check out the clientid to ensure the server knows about it
9322 * so that we correctly inform the client of a server reboot.
9323 */
9329 }
9332 /*
9333 * Protocol doesn't allow returning NFS4ERR_STALE as
9334 * other operations do on this check so STALE_CLIENTID
9335 * is returned instead
9336 */
9339 }
9345 }
9359 }
9362 /* Check for zero length. To lock to end of file use all ones for V4 */
9368 }
9370 /* Find or create a lockowner */
9381 }
9382 retry:
9393 /* Note that length4 is uint64_t but l_len and l_start are off64_t */
9397 }
9401 /*
9402 * N.B. We map error values to nfsv4 errors. This is differrent
9403 * than puterrno4 routine.
9404 */
9413 }
9423 error);
9426 }
9428 err:
9432 out:
9435 }
9437 int
9439 {
9461 }
9465 }
9486 else
9489 }
9495 }
9497 int
9499 {
9521 NULL);
9525 }
9532 }
9534 static int
9536 {
9544 }
9549 }
9551 /* tunable to disable server referrals */
9554 /*
9555 * Find an NFS record in reparse point data.
9556 * Returns 0 for success and <0 or an errno value on failure.
9557 */
9558 int
9560 {
9572 }
9579 }
9582 }
9588 }
9593 }
9595 int
9597 {
9613 }
9615 /*
9616 * There is a user-level copy of this routine in ref_subr.c.
9617 * Changes should be kept in sync.
9618 */
9619 static int
9621 {
9632 /* count number of components in the path */
9638 }
9644 }
9648 }
9651 }
9654 }
9656 /*
9657 * There is a user-level copy of this routine in ref_subr.c.
9658 * Changes should be kept in sync.
9659 */
9660 static int
9662 {
9673 }
9675 /* count number of components to alloc buffer */
9680 }
9683 /* copy components into allocated buffer */
9690 }
9692 #define xdr_fs_locations4 xdr_fattr4_fs_locations
9694 fs_locations4 *
9696 {
9702 XDR xdr;
9705 /*
9706 * Check attrs to ensure it's a reparse point
9707 */
9711 /*
9712 * Look for an NFS record and get the type and data
9713 */
9717 /*
9718 * With the type and data, upcall to get the referral
9719 */
9731 err);
9733 }
9735 /*
9736 * We get an XDR'ed record back from the kderef call
9737 */
9746 }
9748 /*
9749 * Look at path to recover fs_root, ignoring the leading '/'
9750 */
9754 }
9758 {
9764 uint_t len;
9766 /* Get the referral */
9770 /* Deal with only the first location and first server */
9777 }
9779 /* Figure out size for "/net/" + host + /path/path/path + NULL */
9784 /* Allocate the symlink buffer and fill it */
9797 npaths++;
9799 }
9807 }
9809 /*
9810 * Check to see if we have a downrev Solaris client, so that we
9811 * can send it a symlink instead of a referral.
9812 */
9813 int
9815 {
9829 }