| blob | 5b02a9abcf9eda71459de75999a6362f19bc6e0c |
1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
22 /*
23 * Copyright 2016 Nexenta Systems, Inc. All rights reserved.
24 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
25 * Copyright (c) 2012, 2016 by Delphix. All rights reserved.
26 */
28 /*
29 * Copyright (c) 1983,1984,1985,1986,1987,1988,1989 AT&T.
30 * All Rights Reserved
31 */
33 #include <sys/param.h>
34 #include <sys/types.h>
35 #include <sys/systm.h>
36 #include <sys/cred.h>
37 #include <sys/buf.h>
38 #include <sys/vfs.h>
39 #include <sys/vnode.h>
40 #include <sys/uio.h>
41 #include <sys/errno.h>
42 #include <sys/sysmacros.h>
43 #include <sys/statvfs.h>
44 #include <sys/kmem.h>
45 #include <sys/dirent.h>
46 #include <sys/cmn_err.h>
47 #include <sys/debug.h>
48 #include <sys/systeminfo.h>
49 #include <sys/flock.h>
50 #include <sys/pathname.h>
51 #include <sys/nbmlock.h>
52 #include <sys/share.h>
53 #include <sys/atomic.h>
54 #include <sys/policy.h>
55 #include <sys/fem.h>
56 #include <sys/sdt.h>
57 #include <sys/ddi.h>
58 #include <sys/zone.h>
60 #include <sys/fs_reparse.h>
62 #include <rpc/types.h>
63 #include <rpc/auth.h>
64 #include <rpc/rpcsec_gss.h>
65 #include <rpc/svc.h>
67 #include <nfs/nfs.h>
68 #include <nfs/export.h>
69 #include <nfs/nfs_cmd.h>
70 #include <nfs/lm.h>
71 #include <nfs/nfs4.h>
73 #include <sys/strsubr.h>
74 #include <sys/strsun.h>
76 #include <inet/common.h>
77 #include <inet/ip.h>
78 #include <inet/ip6.h>
86 /* End of Tunables */
90 /*
91 * Used to bump the stateid4.seqid value and show changes in the stateid
92 */
93 #define next_stateid(sp) (++(sp)->bits.chgseq)
95 /*
96 * RFS4_MINLEN_ENTRY4: XDR-encoded size of smallest possible dirent.
97 * This is used to return NFS4ERR_TOOSMALL when clients specify
98 * maxcount that isn't large enough to hold the smallest possible
99 * XDR encoded dirent.
100 *
101 * sizeof cookie (8 bytes) +
102 * sizeof name_len (4 bytes) +
103 * sizeof smallest (padded) name (4 bytes) +
104 * sizeof bitmap4_len (12 bytes) + NOTE: we always encode len=2 bm4
105 * sizeof attrlist4_len (4 bytes) +
106 * sizeof next boolean (4 bytes)
107 *
108 * RFS4_MINLEN_RDDIR4: XDR-encoded size of READDIR op reply containing
109 * the smallest possible entry4 (assumes no attrs requested).
110 * sizeof nfsstat4 (4 bytes) +
111 * sizeof verifier4 (8 bytes) +
112 * sizeof entry4list bool (4 bytes) +
113 * sizeof entry4 (36 bytes) +
114 * sizeof eof bool (4 bytes)
115 *
116 * RFS4_MINLEN_RDDIR_BUF: minimum length of buffer server will provide to
117 * fop_readdir. Its value is the size of the maximum possible dirent
118 * for solaris. The DIRENT_RECLEN macro returns the size of dirent
119 * required for a given name length. MAXNAMELEN is the maximum
120 * filename length allowed in Solaris. The first two DIRENT_RECLEN()
121 * macros are to allow for . and .. entries -- just a minor tweak to try
122 * and guarantee that buffer we give to fop_readdir will be large enough
123 * to hold ., .., and the largest possible solaris dirent64.
124 */
125 #define RFS4_MINLEN_ENTRY4 36
126 #define RFS4_MINLEN_RDDIR4 (4 + NFS4_VERIFIER_SIZE + 4 + RFS4_MINLEN_ENTRY4 + 4)
127 #define RFS4_MINLEN_RDDIR_BUF \
128 (DIRENT_RECLEN(1) + DIRENT_RECLEN(2) + DIRENT_RECLEN(MAXNAMELEN))
130 /*
131 * It would be better to pad to 4 bytes since that's what XDR would do,
132 * but the dirents UFS gives us are already padded to 8, so just take
133 * what we're given. Dircount is only a hint anyway. Currently the
134 * solaris kernel is ASCII only, so there's no point in calling the
135 * UTF8 functions.
136 *
137 * dirent64: named padded to provide 8 byte struct alignment
138 * d_ino(8) + d_off(8) + d_reclen(2) + d_name(namelen + null(1) + pad)
139 *
140 * cookie: uint64_t + utf8namelen: uint_t + utf8name padded to 8 bytes
141 *
142 */
143 #define DIRENT64_TO_DIRCOUNT(dp) \
144 (3 * BYTES_PER_XDR_UNIT + DIRENT_NAMELEN((dp)->d_reclen))
150 u_longlong_t nfs4_srv_caller_id;
153 verifier4 Write4verf;
154 verifier4 Readdir4verf;
249 /*
250 * translation table for attrs
251 */
256 bool_t vfsstat;
257 };
271 /*
272 * NFS4 op dispatch table
273 */
279 };
282 /*
283 * NFS VERSION 4
284 */
286 /* RFS_NULL = 0 */
289 /* UNUSED = 1 */
292 /* UNUSED = 2 */
295 /* OP_ACCESS = 3 */
298 /* OP_CLOSE = 4 */
301 /* OP_COMMIT = 5 */
304 /* OP_CREATE = 6 */
307 /* OP_DELEGPURGE = 7 */
310 /* OP_DELEGRETURN = 8 */
313 /* OP_GETATTR = 9 */
316 /* OP_GETFH = 10 */
319 /* OP_LINK = 11 */
322 /* OP_LOCK = 12 */
325 /* OP_LOCKT = 13 */
328 /* OP_LOCKU = 14 */
331 /* OP_LOOKUP = 15 */
334 /* OP_LOOKUPP = 16 */
337 /* OP_NVERIFY = 17 */
340 /* OP_OPEN = 18 */
343 /* OP_OPENATTR = 19 */
346 /* OP_OPEN_CONFIRM = 20 */
349 /* OP_OPEN_DOWNGRADE = 21 */
352 /* OP_OPEN_PUTFH = 22 */
355 /* OP_PUTPUBFH = 23 */
358 /* OP_PUTROOTFH = 24 */
361 /* OP_READ = 25 */
364 /* OP_READDIR = 26 */
367 /* OP_READLINK = 27 */
370 /* OP_REMOVE = 28 */
373 /* OP_RENAME = 29 */
376 /* OP_RENEW = 30 */
379 /* OP_RESTOREFH = 31 */
382 /* OP_SAVEFH = 32 */
385 /* OP_SECINFO = 33 */
388 /* OP_SETATTR = 34 */
391 /* OP_SETCLIENTID = 35 */
394 /* OP_SETCLIENTID_CONFIRM = 36 */
397 /* OP_VERIFY = 37 */
400 /* OP_WRITE = 38 */
403 /* OP_RELEASE_LOCKOWNER = 39 */
405 };
409 #define OP_ILLEGAL_IDX (rfsv4disp_cnt)
411 #ifdef DEBUG
458 "rfs4_op_illegal"
459 };
460 #endif
468 #ifdef nextdp
469 #undef nextdp
470 #endif
471 #define nextdp(dp) ((struct dirent *)((char *)(dp) + (dp)->d_reclen))
473 fem_t deleg_rdops = {
482 };
484 fem_t deleg_wrops = {
494 };
496 int
498 {
499 timespec32_t verf;
504 /*
505 * The following algorithm attempts to find a unique verifier
506 * to be used as the write verifier returned from the server
507 * to the client. It is important that this verifier change
508 * whenever the server reboots. Of secondary importance, it
509 * is important for the verifier to be unique between two
510 * different servers.
511 *
512 * Thus, an attempt is made to use the system hostid and the
513 * current time in seconds when the nfssrv kernel module is
514 * loaded. It is assumed that an NFS server will not be able
515 * to boot and then to reboot in less than a second. If the
516 * hostid has not been set, then the current high resolution
517 * time is used. This will ensure different verifiers each
518 * time the server reboots and minimize the chances that two
519 * different servers will have the same verifier.
520 * XXX - this is broken on LP64 kernels.
521 */
526 timespec_t tverf;
531 }
538 /* Used to manage create/destroy of server state */
541 /* Used to manage access to server instance linked list */
544 /* Used to manage access to rfs4_deleg_policy */
554 }
556 void
558 {
564 }
569 }
571 void
573 {
580 }
582 void
584 {
589 }
591 /*
592 * returns true if the instance's grace period has never been started
593 */
594 int
596 {
604 }
606 /*
607 * Indicates if server instance is within the
608 * grace period.
609 */
610 int
612 {
620 }
622 int
624 {
628 }
630 /*
631 * reset all currently active grace periods
632 */
633 void
635 {
643 }
645 /*
646 * start any new instances' grace periods
647 */
648 void
650 {
658 }
662 {
668 /*
669 * Take a copy of the string, since the original may be overwritten.
670 * Sadly, no strdup() in the kernel.
671 */
672 /* allow for NUL */
677 /* associate with servinst */
681 /*
682 * Add to list of served paths.
683 * No locking required, as we're only ever called at startup.
684 */
686 /* this is the first dss_path_t */
688 /* needed for insque/remque */
694 }
697 }
699 /*
700 * Create a new server instance, and make it the currently active instance.
701 * Note that starting the grace period too early will reduce the clients'
702 * recovery window.
703 */
704 void
706 {
720 /*
721 * This initial dummy entry is required to setup for insque/remque.
722 * It must be skipped over whenever the list is traversed.
723 */
725 /* insque/remque require initial list entry to be self-terminated */
737 }
741 /* add to linked list */
744 }
747 /* make the new instance "current" */
751 }
753 /*
754 * In future, we might add a rfs4_servinst_destroy(sip) but, for now, destroy
755 * all instances directly.
756 */
757 void
759 {
761 #ifdef DEBUG
763 #endif
778 #ifdef DEBUG
779 n++;
780 #endif
781 }
783 }
785 /*
786 * Assign the current server instance to a client_t.
787 * Should be called with cp->rc_dbe held.
788 */
789 void
791 {
794 /*
795 * The lock ensures that if the current instance is in the process
796 * of changing, we will see the new one.
797 */
801 }
803 rfs4_servinst_t *
805 {
809 }
811 /* ARGSUSED */
812 static void
814 {
815 }
817 /*
818 * This is a fall-through for invalid or not implemented (yet) ops
819 */
820 /* ARGSUSED */
821 static void
824 {
826 }
828 /*
829 * Check if the security flavor, nfsnum, is in the flavor_list.
830 */
831 bool_t
833 {
839 }
841 }
843 /*
844 * Used by rfs4_op_secinfo to get the security information from the
845 * export structure associated with the component.
846 */
847 /* ARGSUSED */
848 static nfsstat4
850 {
854 fid_t fid;
865 /*
866 * If dotdotting, then need to check whether it's above the
867 * root of a filesystem, or above an export point.
868 */
871 /*
872 * If dotdotting at the root of a filesystem, then
873 * need to traverse back to the mounted-on filesystem
874 * and do the dotdot lookup there.
875 */
878 /*
879 * If at the system root, then can
880 * go up no further.
881 */
885 /*
886 * Traverse back to the mounted-on filesystem
887 */
890 /*
891 * Set the different_export flag so we remember
892 * to pick up a new exportinfo entry for
893 * this new filesystem.
894 */
898 /*
899 * If dotdotting above an export point then set
900 * the different_export to get new export info.
901 */
903 }
904 }
906 /*
907 * Get the vnode for the component "nm".
908 */
914 /*
915 * If the vnode is in a pseudo filesystem, or if the security flavor
916 * used in the request is valid but not an explicitly shared flavor,
917 * or the access bit indicates that this is a limited access,
918 * check whether this vnode is visible.
919 */
926 }
927 }
929 /*
930 * If it's a mountpoint, then traverse it.
931 */
936 }
937 /* remember that we had to traverse mountpoint */
941 /*
942 * If vp isn't a mountpoint and the vfs ptrs aren't the same,
943 * then vp is probably an LOFS object. We don't need the
944 * realvp, we just need to know that we might have crossed
945 * a server fs boundary and need to call checkexport4.
946 * (LOFS lookup hides server fs mountpoints, and actually calls
947 * traverse)
948 */
950 }
952 /*
953 * Get the export information for it.
954 */
963 }
967 else
972 /*
973 * If this vnode is a mounted-on vnode,
974 * but the mounted-on file system is not
975 * exported, send back the secinfo for
976 * the exported node that the mounted-on
977 * vnode lives in.
978 */
983 }
984 }
987 }
991 /*
992 * Create the secinfo result based on the security information
993 * from the exportinfo structure (exi).
994 *
995 * Return all flavors for a pseudo node.
996 * For a real export node, return the flavor that the client
997 * has access with.
998 */
1015 /* get oid opaque data */
1024 }
1025 }
1036 /* find out which flavors to return */
1049 ret_cnt++;
1050 }
1051 }
1053 /* Create the returning SECINFO value */
1057 /*
1058 * If the flavor is in the flavor list,
1059 * fill in resok_val.
1060 */
1073 /* get oid opaque data */
1078 KM_SLEEP);
1082 }
1083 k++;
1084 }
1087 }
1091 }
1095 }
1097 /*
1098 * SECINFO (Operation 33): Obtain required security information on
1099 * the component name in the format of (security-mechanism-oid, qop, service)
1100 * triplets.
1101 */
1102 /* ARGSUSED */
1103 static void
1106 {
1110 uint_t len;
1119 /*
1120 * Current file handle (cfh) should have been set before getting
1121 * into this function. If not, return error.
1122 */
1126 }
1131 }
1133 /*
1134 * Verify the component name. If failed, error out, but
1135 * do not error out if the component name is a "..".
1136 * SECINFO will return its parents secinfo data for SECINFO "..".
1137 */
1145 }
1146 }
1152 }
1158 }
1168 }
1177 out:
1180 }
1182 /*
1183 * Free SECINFO result.
1184 */
1185 /* ARGSUSED */
1186 static void
1188 {
1193 /* If this is not an Ok result, nothing to free. */
1196 }
1208 }
1209 }
1213 }
1215 /* ARGSUSED */
1216 static void
1219 {
1235 }
1236 #endif
1240 }
1246 /*
1247 * If the file system is exported read only, it is not appropriate
1248 * to check write permissions for regular files and directories.
1249 * Special files are interpreted by the client, so the underlying
1250 * permissions are sent back to the client for interpretation.
1251 */
1255 else
1258 /*
1259 * XXX
1260 * We need the mode so that we can correctly determine access
1261 * permissions relative to a mandatory lock file. Access to
1262 * mandatory lock files is denied on the server, so it might
1263 * as well be reflected to the server during the open.
1264 */
1270 }
1279 }
1285 }
1294 }
1302 }
1308 }
1311 out:
1314 }
1316 /* ARGSUSED */
1317 static void
1320 {
1326 vattr_t va;
1334 }
1338 }
1343 }
1348 /*
1349 * If we can't get the attributes, then we can't do the
1350 * right access checking. So, we'll fail the request.
1351 */
1355 }
1359 }
1364 else
1368 }
1374 }
1381 }
1385 out:
1388 }
1390 /*
1391 * rfs4_op_mknod is called from rfs4_op_create after all initial verification
1392 * was completed. It does the nfsv4 create for special files.
1393 */
1394 /* ARGSUSED */
1398 {
1412 }
1415 else
1430 }
1432 /*
1433 * Must specify the mode.
1434 */
1438 }
1448 }
1450 }
1452 /*
1453 * nfsv4 create is used to create non-regular files. For regular files,
1454 * use nfsv4 open.
1455 */
1456 /* ARGSUSED */
1457 static void
1460 {
1475 nfsstat4 status;
1488 }
1490 /*
1491 * If there is an unshared filesystem mounted on this vnode,
1492 * do not allow to create an object in this directory.
1493 */
1497 }
1499 /* Verify that type is correct */
1511 };
1516 }
1520 }
1525 }
1530 }
1532 /*
1533 * Name of newly created object
1534 */
1539 }
1545 }
1555 }
1577 }
1579 /* Get "before" change value */
1590 }
1595 /*
1596 * Set the default initial values for attributes when the parent
1597 * directory does not have the VSUID/VSGID bit set and they have
1598 * not been specified in createattrs.
1599 */
1603 }
1607 }
1616 }
1621 /*
1622 * Get the initial "after" sequence number, if it fails,
1623 * set to zero
1624 */
1634 }
1636 /*
1637 * symlink names must be treated as data
1638 */
1650 }
1661 }
1675 }
1684 /*
1685 * Get the initial "after" sequence number, if it fails,
1686 * set to zero
1687 */
1697 /*
1698 * va_seq is not safe over VOP calls, check it again
1699 * if it has changed zero out iva to force atomic = FALSE.
1700 */
1707 /*
1708 * probably a special file.
1709 */
1713 }
1715 /*
1716 * We know this will only generate one VOP call
1717 */
1727 }
1729 /*
1730 * Get the initial "after" sequence number, if it fails,
1731 * set to zero
1732 */
1738 }
1745 }
1747 /*
1748 * Force modified data and metadata out to stable storage.
1749 */
1758 }
1760 /*
1761 * Finish setup of cinfo response, "before" value already set.
1762 * Get "after" change value, if it fails, simply return the
1763 * before value.
1764 */
1769 }
1772 /*
1773 * True verification that object was created with correct
1774 * attrs is impossible. The attrs could have been changed
1775 * immediately after object creation. If attributes did
1776 * not verify, the only recourse for the server is to
1777 * destroy the object. Maybe if some attrs (like gid)
1778 * are set incorrectly, the object should be destroyed;
1779 * however, seems bad as a default policy. Do we really
1780 * want to destroy an object over one of the times not
1781 * verifying correctly? For these reasons, the server
1782 * currently sets bits in attrset for createattrs
1783 * that were set; however, no verification is done.
1784 *
1785 * vmask_to_nmask accounts for vattr bits set on create
1786 * [do_rfs4_set_attrs() only sets resp bits for
1787 * non-vattr/vfs bits.]
1788 * Mask off any bits set by default so as not to return
1789 * more attrset bits than were requested in createattrs
1790 */
1798 }
1800 /*
1801 * The cinfo.atomic = TRUE only if we got no errors, we have
1802 * non-zero va_seq's, and it has incremented by exactly one
1803 * during the creation and it didn't change during the fop_lookup
1804 * or fop_fsync.
1805 */
1809 else
1812 /*
1813 * Force modified metadata out to stable storage.
1814 *
1815 * if a underlying vp exists, pass it to fop_fsync
1816 */
1819 else
1825 }
1831 out:
1834 }
1836 /*ARGSUSED*/
1837 static void
1840 {
1848 }
1850 /*ARGSUSED*/
1851 static void
1854 {
1858 nfsstat4 status;
1868 /* Ensure specified filehandle matches */
1877 out:
1880 }
1882 /*
1883 * Check to see if a given "flavor" is an explicitly shared flavor.
1884 * The assumption of this routine is the "flavor" is already a valid
1885 * flavor in the secinfo list of "exi".
1886 *
1887 * e.g.
1888 * # share -o sec=flavor1 /export
1889 * # share -o sec=flavor2 /export/home
1890 *
1891 * flavor2 is not an explicitly shared flavor for /export,
1892 * however it is in the secinfo list for /export thru the
1893 * server namespace setup.
1894 */
1895 int
1897 {
1906 }
1907 }
1909 /* Should not reach this point based on the assumption */
1911 }
1913 /*
1914 * Check if the security flavor used in the request matches what is
1915 * required at the export point or at the root pseudo node (exi_root).
1916 *
1917 * returns 1 if there's a match or if exported with AUTH_NONE; 0 otherwise.
1918 *
1919 */
1920 static int
1922 {
1926 /*
1927 * Check cs->nfsflavor (from the request) against
1928 * the current export data in cs->exi.
1929 */
1935 }
1938 }
1940 /*
1941 * Check the access authority for the client and return the correct error.
1942 */
1943 nfsstat4
1945 {
1948 /*
1949 * First, check if the security flavor used in the request
1950 * are among the flavors set in the server namespace.
1951 */
1955 }
1969 }
1971 }
1973 /*
1974 * bitmap4_to_attrmask is called by getattr and readdir.
1975 * It sets up the vattr mask and determines whether vfsstat call is needed
1976 * based on the input bitmap.
1977 * Returns nfsv4 status.
1978 */
1979 static nfsstat4
1981 {
1983 uint_t va_mask;
1993 else
1996 /*
1997 * Set rdattr_error_req to true if return error per
1998 * failed entry rather than fail the readdir.
1999 */
2002 else
2005 /*
2006 * generate the va_mask
2007 * Handle the easy cases first
2008 */
2033 }
2035 /*
2036 * Check is vfsstat is needed
2037 */
2043 }
2044 /* NOTREACHED */
2045 }
2047 /*
2048 * bitmap4_get_sysattrs is called by getattr and readdir.
2049 * It calls both fop_getattr and VFS_STATVFS calls to get the attrs.
2050 * Returns nfsv4 status.
2051 */
2052 static nfsstat4
2054 {
2063 }
2064 }
2067 }
2069 static void
2071 {
2073 KM_SLEEP);
2076 }
2078 static void
2081 {
2086 /*
2087 * XXX Should do the same checks for whether the bit is set
2088 */
2093 }
2095 /*
2096 * xdr_free for getattr will be done later
2097 */
2101 }
2102 }
2104 }
2106 /*
2107 * do_rfs4_op_getattr gets the system attrs and converts into fattr4.
2108 */
2109 static nfsstat4
2112 {
2116 XDR xdr;
2117 ulong_t xdr_size;
2128 /* if no bits requested, then return empty fattr4 */
2133 }
2135 /*
2136 * return NFS4ERR_INVAL when client requests write-only attrs
2137 */
2145 /*
2146 * Now loop to get or verify the attrs
2147 */
2156 /*
2157 * Possible error values:
2158 * >0 if sv_getit failed to
2159 * get the attr; 0 if succeeded;
2160 * <0 if rdattr_error and the
2161 * attribute cannot be returned.
2162 */
2165 /*
2166 * If error then just for entry
2167 */
2173 na++;
2178 }
2180 }
2181 }
2182 }
2184 /*
2185 * If rdattr_error was set after the return value for it was assigned,
2186 * update it.
2187 */
2195 }
2202 }
2204 }
2205 }
2212 }
2216 /* freed by rfs4_op_getattr_free() */
2229 }
2230 }
2234 }
2235 done:
2243 }
2245 /* ARGSUSED */
2246 static void
2249 {
2254 nfsstat4 status;
2262 }
2267 }
2279 /* Is this a referral? */
2281 /* Older V4 Solaris client sees a link */
2284 else
2286 }
2290 }
2291 }
2293 out:
2296 }
2298 static void
2300 {
2304 }
2306 /* ARGSUSED */
2307 static void
2310 {
2318 }
2322 }
2324 /* check for reparse point at the share point */
2326 /* it's all bad */
2332 }
2334 /* check for reparse point at vp */
2336 /* it's not all bad */
2341 }
2347 out:
2350 }
2352 static void
2354 {
2362 }
2363 }
2365 /*
2366 * illegal: args: void
2367 * res : status (NFS4ERR_OP_ILLEGAL)
2368 */
2369 /* ARGSUSED */
2370 static void
2373 {
2378 }
2380 /*
2381 * link: args: SAVED_FH: file, CURRENT_FH: target directory
2382 * res: status. If success - CURRENT_FH unchanged, return change_info
2383 */
2384 /* ARGSUSED */
2385 static void
2388 {
2396 uint_t len;
2399 nfsstat4 status;
2404 /* SAVED_FH: source object */
2409 }
2411 /* CURRENT_FH: target directory */
2416 }
2418 /*
2419 * If there is a non-shared filesystem mounted on this vnode,
2420 * do not allow to link any file in this directory.
2421 */
2425 }
2430 }
2432 /* Check source object's type validity */
2436 }
2438 /* Check target directory's type */
2442 }
2447 }
2453 }
2459 }
2465 }
2471 }
2473 /* Get "before" change value */
2480 }
2490 }
2500 /*
2501 * Get the initial "after" sequence number, if it fails, set to zero
2502 */
2507 /*
2508 * Force modified data and metadata out to stable storage.
2509 */
2516 }
2518 /*
2519 * Get "after" change value, if it fails, simply return the
2520 * before value.
2521 */
2526 }
2530 /*
2531 * The cinfo.atomic = TRUE only if we have
2532 * non-zero va_seq's, and it has incremented by exactly one
2533 * during the fop_link and it didn't change during the fop_fsync.
2534 */
2538 else
2542 out:
2545 }
2547 /*
2548 * Used by rfs4_op_lookup and rfs4_op_lookupp to do the actual work.
2549 */
2551 /* ARGSUSED */
2552 static nfsstat4
2554 {
2559 nfsstat4 stat;
2560 fid_t fid;
2570 }
2574 /*
2575 * If dotdotting, then need to check whether it's
2576 * above the root of a filesystem, or above an
2577 * export point.
2578 */
2581 /*
2582 * If dotdotting at the root of a filesystem, then
2583 * need to traverse back to the mounted-on filesystem
2584 * and do the dotdot lookup there.
2585 */
2588 /*
2589 * If at the system root, then can
2590 * go up no further.
2591 */
2595 /*
2596 * Traverse back to the mounted-on filesystem
2597 */
2600 /*
2601 * Set the different_export flag so we remember
2602 * to pick up a new exportinfo entry for
2603 * this new filesystem.
2604 */
2608 /*
2609 * If dotdotting above an export point then set
2610 * the different_export to get new export info.
2611 */
2613 }
2614 }
2621 /*
2622 * If the vnode is in a pseudo filesystem, check whether it is visible.
2623 *
2624 * XXX if the vnode is a symlink and it is not visible in
2625 * a pseudo filesystem, return ENOENT (not following symlink).
2626 * V4 client can not mount such symlink. This is a regression
2627 * from V2/V3.
2628 *
2629 * In the same exported filesystem, if the security flavor used
2630 * is not an explicitly shared flavor, limit the view to the visible
2631 * list entries only. This is not a WRONGSEC case because it's already
2632 * checked via PUTROOTFH/PUTPUBFH or PUTFH.
2633 */
2640 }
2641 }
2643 /*
2644 * If it's a mountpoint, then traverse it.
2645 */
2650 /*
2651 * hold pre_tvp to counteract rele by traverse. We will
2652 * need pre_tvp below if checkexport4 fails
2653 */
2659 }
2662 /*
2663 * The vfsp comparison is to handle the case where
2664 * a LOFS mount is shared. lo_lookup traverses mount points,
2665 * and NFS is unaware of local fs transistions because
2666 * v_vfsmountedhere isn't set. For this special LOFS case,
2667 * the dir and the obj returned by lookup will have different
2668 * vfs ptrs.
2669 */
2671 }
2683 }
2687 else
2692 /*
2693 * If this vnode is a mounted-on vnode,
2694 * but the mounted-on file system is not
2695 * exported, send back the filehandle for
2696 * the mounted-on vnode, not the root of
2697 * the mounted-on file system.
2698 */
2705 }
2707 /* we're done with pre_tvp now. release extra hold */
2709 }
2713 /*
2714 * Now we do a checkauth4. The reason is that
2715 * this client/user may not have access to the new
2716 * exported file system, and if they do,
2717 * the client/user may be mapped to a different uid.
2718 *
2719 * We start with a new cr, because the checkauth4 done
2720 * in the PUT*FH operation over wrote the cred's uid,
2721 * gid, etc, and we want the real thing before calling
2722 * checkauth4()
2723 */
2736 }
2737 }
2741 err_out:
2749 }
2758 /*
2759 * if did lookup on attrdir and didn't lookup .., set named
2760 * attr fh flag
2761 */
2765 /* Assume false for now, open proc will set this */
2769 }
2771 /* ARGSUSED */
2772 static void
2775 {
2779 uint_t len;
2782 nfsstat4 status;
2790 }
2795 }
2800 }
2806 }
2812 }
2818 }
2828 }
2836 out:
2839 }
2841 /* ARGSUSED */
2842 static void
2845 {
2853 }
2858 }
2862 /*
2863 * From NFSV4 Specification, LOOKUPP should not check for
2864 * NFS4ERR_WRONGSEC. Retrun NFS4_OK instead.
2865 */
2868 }
2870 out:
2873 }
2876 /*ARGSUSED2*/
2877 static void
2880 {
2893 }
2899 }
2901 /*
2902 * If file system supports passing ACE mask to fop_access then
2903 * check for ACE_READ_NAMED_ATTRS, otherwise do legacy checks
2904 */
2909 else
2917 }
2919 /*
2920 * The CREATE_XATTR_DIR VOP flag cannot be specified if
2921 * the file system is exported read-only -- regardless of
2922 * createdir flag. Otherwise the attrdir would be created
2923 * (assuming server fs isn't mounted readonly locally). If
2924 * fop_lookup returns ENOENT in this case, the error will
2925 * be translated into EROFS. ENOSYS is mapped to ENOTSUP
2926 * because specfs has no fop_lookup op, so the macro would
2927 * return ENOSYS. EINVAL is returned by all (current)
2928 * Solaris file system implementations when any of their
2929 * restrictions are violated (xattr(dir) can't have xattrdir).
2930 * Returning NOTSUPP is more appropriate in this case
2931 * because the object will never be able to have an attrdir.
2932 */
2944 else
2947 }
2957 }
2962 /*
2963 * There is no requirement for an attrdir fh flag
2964 * because the attrdir has a vnode flag to distinguish
2965 * it from regular (non-xattr) directories. The
2966 * FH4_ATTRDIR flag is set for future sanity checks.
2967 */
2971 out:
2974 }
2976 static int
2979 {
2986 /*
2987 * Don't block on mandatory locks. If this routine returns
2988 * EAGAIN, the caller should return NFS4ERR_LOCKED.
2989 */
3003 }
3011 }
3012 }
3015 }
3017 /* ARGSUSED */
3018 static void
3021 {
3031 uoff_t offset;
3033 nfsstat4 stat;
3039 caller_context_t ct;
3049 }
3053 }
3059 }
3061 /*
3062 * Enter the critical region before calling fop_rwlock
3063 * to avoid a deadlock with write requests.
3064 */
3072 }
3073 }
3079 }
3081 }
3083 /* use loaned buffers for TCP */
3089 /*
3090 * If we can't get the attributes, then we can't do the
3091 * right access checking. So, we'll fail the request.
3092 */
3096 }
3102 }
3109 }
3114 }
3123 /* RDMA */
3130 }
3138 /* RDMA */
3144 }
3146 /*
3147 * Do not allocate memory more than maximum allowed
3148 * transfer size
3149 */
3160 /* Jump to do the read if successful */
3162 /*
3163 * Need to hold the vnode until after fop_retzcbuf()
3164 * is called.
3165 */
3168 }
3175 /* failure to setup for zero copy */
3178 }
3180 /*
3181 * If returning data via RDMA Write, then grab the chunk list. If we
3182 * aren't returning READ data w/RDMA_WRITE, then grab a mblk.
3183 */
3190 /*
3191 * mp will contain the data to be sent out in the read reply.
3192 * It will be freed after the reply has been sent.
3193 */
3199 }
3207 doio_read:
3218 }
3220 /* make mblk using zc buffers */
3224 }
3235 }
3241 else
3247 }
3250 }
3252 out:
3261 }
3263 static void
3265 {
3273 }
3274 }
3276 static void
3278 {
3285 }
3286 }
3289 /* ARGSUSED */
3290 static void
3293 {
3305 }
3316 }
3322 }
3325 /*
3326 * No filesystem is actually shared public, so we default
3327 * to exi_root. In this case, we must check whether root
3328 * is exported.
3329 */
3332 /*
3333 * if root filesystem is exported, the exportinfo struct that we
3334 * should use is what checkexport4 returns, because root_exi is
3335 * actually a mostly empty struct.
3336 */
3341 /*
3342 * it's a properly shared filesystem
3343 */
3345 }
3355 }
3358 out:
3361 }
3363 /*
3364 * XXX - issue with put*fh operations. Suppose /export/home is exported.
3365 * Suppose an NFS client goes to mount /export/home/joe. If /export, home,
3366 * or joe have restrictive search permissions, then we shouldn't let
3367 * the client get a file handle. This is easy to enforce. However, we
3368 * don't know what security flavor should be used until we resolve the
3369 * path name. Another complication is uid mapping. If root is
3370 * the user, then it will be mapped to the anonymous user by default,
3371 * but we won't know that till we've resolved the path name. And we won't
3372 * know what the anonymous user is.
3373 * Luckily, SECINFO is specified to take a full filename.
3374 * So what we will have to in rfs4_op_lookup is check that flavor of
3375 * the target object matches that of the request, and if root was the
3376 * caller, check for the root= and anon= options, and if necessary,
3377 * repeat the lookup using the right cred_t. But that's not done yet.
3378 */
3379 /* ARGSUSED */
3380 static void
3383 {
3394 }
3399 }
3405 }
3409 NULL);
3414 }
3423 }
3429 }
3435 out:
3438 }
3440 /* ARGSUSED */
3441 static void
3444 {
3447 fid_t fid;
3455 }
3462 /*
3463 * Using rootdir, the system root vnode,
3464 * get its fid.
3465 */
3472 }
3474 /*
3475 * Then use the root fsid & fid it to find out if it's exported
3476 *
3477 * If the server root isn't exported directly, then
3478 * it should at least be a pseudo export based on
3479 * one or more exports further down in the server's
3480 * file tree.
3481 */
3488 }
3490 /*
3491 * Now make a filehandle based on the root
3492 * export and root vnode.
3493 */
3498 }
3511 }
3515 out:
3518 }
3520 /*
3521 * readlink: args: CURRENT_FH.
3522 * res: status. If success - CURRENT_FH unchanged, return linktext.
3523 */
3525 /* ARGSUSED */
3526 static void
3529 {
3543 /* CURRENT_FH: directory */
3548 }
3553 }
3555 /* Is it a referral? */
3567 }
3572 }
3574 }
3581 }
3586 }
3594 /* Get an artificial symlink based on a referral */
3605 }
3622 }
3628 }
3635 /*
3636 * Even though the conversion failed, we return
3637 * something. We just don't translate it.
3638 */
3640 }
3642 /*
3643 * treat link name as data
3644 */
3652 out:
3655 }
3657 static void
3659 {
3665 }
3666 }
3668 /*
3669 * release_lockowner:
3670 * Release any state associated with the supplied
3671 * lockowner. Note if any lo_state is holding locks we will not
3672 * rele that lo_state and thus the lockowner will not be destroyed.
3673 * A client using lock after the lock owner stateid has been released
3674 * will suffer the consequence of NFS4ERR_BAD_STATEID and would have
3675 * to reissue the lock with new_lock_owner set to TRUE.
3676 * args: lock_owner
3677 * res: status
3678 */
3679 /* ARGSUSED */
3680 static void
3683 {
3693 sysid_t sysid;
3698 /* Make sure there is a clientid around for this request */
3705 }
3712 }
3715 /*
3716 * Check for EXPIRED client. If so will reap state with in a lease
3717 * period or on next set_clientid_confirm step
3718 */
3723 }
3725 /*
3726 * If no sysid has been assigned, then no locks exist; just return.
3727 */
3733 }
3738 /*
3739 * Mark the lockowner invalid.
3740 */
3743 /*
3744 * sysid-pid pair should now not be used since the lockowner is
3745 * invalid. If the client were to instantiate the lockowner again
3746 * it would be assigned a new pid. Thus we can get the list of
3747 * current locks.
3748 */
3751 /* If we are still holding locks fail */
3757 /*
3758 * We need to unhide the lockowner so the client can
3759 * try it again. The bad thing here is if the client
3760 * has a logic error that took it here in the first place
3761 * they probably have lost accounting of the locks that it
3762 * is holding. So we may have dangling state until the
3763 * open owner state is reaped via close. One scenario
3764 * that could possibly occur is that the client has
3765 * sent the unlock request(s) in separate threads
3766 * and has not waited for the replies before sending the
3767 * RELEASE_LOCKOWNER request. Presumably, it would expect
3768 * and deal appropriately with NFS4ERR_LOCKS_HELD, by
3769 * reissuing the request.
3770 */
3774 }
3776 /*
3777 * For the corresponding client we need to check each open
3778 * owner for any opens that have lockowner state associated
3779 * with this lockowner.
3780 */
3798 }
3799 }
3801 }
3803 }
3810 out:
3813 }
3815 /*
3816 * short utility function to lookup a file and recall the delegation
3817 */
3821 {
3836 else
3838 }
3844 }
3846 /*
3847 * remove: args: CURRENT_FH: directory; name.
3848 * res: status. If success - CURRENT_FH unchanged, return change_info
3849 * for directory.
3850 */
3851 /* ARGSUSED */
3852 static void
3855 {
3862 uint_t len;
3867 nfsstat4 status;
3872 /* CURRENT_FH: directory */
3877 }
3882 }
3884 /*
3885 * If there is an unshared filesystem mounted on this vnode,
3886 * Do not allow to remove anything in this directory.
3887 */
3891 }
3896 }
3902 }
3904 /*
3905 * Lookup the file so that we can check if it's a directory
3906 */
3911 }
3917 }
3923 }
3933 }
3935 /*
3936 * Lookup the file to determine type and while we are see if
3937 * there is a file struct around and check for delegation.
3938 * We don't need to acquire va_seq before this lookup, if
3939 * it causes an update, cinfo.before will not match, which will
3940 * trigger a cache flush even if atomic is TRUE.
3941 */
3944 NULL)) {
3952 }
3953 }
3955 /* Didn't find anything to remove */
3962 }
3977 }
3979 }
3980 }
3982 /* Get dir "before" change value */
3996 }
3998 }
4001 /* Actually do the REMOVE operation */
4003 /*
4004 * Can't remove a directory that has a mounted-on filesystem.
4005 */
4009 /*
4010 * System V defines rmdir to return EEXIST,
4011 * not ENOTEMPTY, if the directory is not
4012 * empty. A System V NFS server needs to map
4013 * NFS4ERR_EXIST to NFS4ERR_NOTEMPTY to
4014 * transmit over the wire.
4015 */
4019 }
4033 /*
4034 * This is va_seq safe because we are not
4035 * manipulating dvp.
4036 */
4040 /* Remove state on file remove */
4044 }
4046 }
4048 }
4049 }
4050 }
4059 }
4067 }
4069 /*
4070 * Get the initial "after" sequence number, if it fails, set to zero
4071 */
4076 /*
4077 * Force modified data and metadata out to stable storage.
4078 */
4081 /*
4082 * Get "after" change value, if it fails, simply return the
4083 * before value.
4084 */
4089 }
4093 /*
4094 * The cinfo.atomic = TRUE only if we have
4095 * non-zero va_seq's, and it has incremented by exactly one
4096 * during the fop_remove/RMDIR and it didn't change during
4097 * the fop_fsync.
4098 */
4102 else
4107 out:
4110 }
4112 /*
4113 * rename: args: SAVED_FH: from directory, CURRENT_FH: target directory,
4114 * oldname and newname.
4115 * res: status. If success - CURRENT_FH unchanged, return change_info
4116 * for both from and target directories.
4117 */
4118 /* ARGSUSED */
4119 static void
4122 {
4139 nfsstat4 status;
4149 /* CURRENT_FH: target directory */
4154 }
4156 /* SAVED_FH: from directory */
4161 }
4166 }
4168 /*
4169 * If there is an unshared filesystem mounted on this vnode,
4170 * do not allow to rename objects in this directory.
4171 */
4175 }
4177 /*
4178 * If there is an unshared filesystem mounted on this vnode,
4179 * do not allow to rename to this directory.
4180 */
4184 }
4189 }
4194 }
4200 }
4206 }
4212 }
4216 nlen);
4222 }
4231 }
4243 }
4251 }
4263 }
4265 /*
4266 * Is the source a file and have a delegation?
4267 * We don't need to acquire va_seq before these lookups, if
4268 * it causes an update, cinfo.before will not match, which will
4269 * trigger a cache flush even if atomic is TRUE.
4270 */
4274 NULL)) {
4277 }
4278 }
4289 }
4293 /* Does the destination exist and a file and have a delegation? */
4297 NULL)) {
4300 }
4301 }
4305 /* Check for NBMAND lock on both source and target */
4312 }
4313 }
4321 }
4322 }
4324 /* Get source "before" change value */
4330 }
4334 }
4354 /* The file is gone and so should the state */
4358 }
4360 }
4362 }
4363 }
4379 }
4383 }
4392 /*
4393 * Get the initial "after" sequence number, if it fails, set to zero
4394 */
4403 /*
4404 * Force modified data and metadata out to stable storage.
4405 */
4412 }
4414 /*
4415 * Get "after" change values, if it fails, simply return the
4416 * before value.
4417 */
4422 }
4428 }
4433 /*
4434 * The cinfo.atomic = TRUE only if we have
4435 * non-zero va_seq's, and it has incremented by exactly one
4436 * during the fop_rename and it didn't change during the fop_fsync.
4437 */
4441 else
4447 else
4450 #ifdef VOLATILE_FH_TEST
4451 {
4454 /*
4455 * Add the renamed file handle to the volatile rename list
4456 */
4458 /* file handles may expire on rename */
4462 /*
4463 * Already know that nnm will be a valid string
4464 */
4471 }
4472 }
4473 }
4477 out:
4482 err_out:
4499 }
4503 }
4507 }
4509 /* ARGSUSED */
4510 static void
4513 {
4525 }
4531 }
4541 }
4546 out:
4549 }
4551 /* ARGSUSED */
4552 static void
4555 {
4560 /* No need to check cs->access - we are not accessing any object */
4564 }
4567 }
4575 out:
4578 }
4580 /* ARGSUSED */
4581 static void
4584 {
4589 /* No need to check cs->access - we are not accessing any object */
4593 }
4596 }
4600 /*
4601 * since SAVEFH is fairly rare, don't alloc space for its fh
4602 * unless necessary.
4603 */
4606 }
4610 out:
4613 }
4615 /*
4616 * rfs4_verify_attr is called when nfsv4 Setattr failed, but we wish to
4617 * return the bitmap of attrs that were set successfully. It is also
4618 * called by Verify/Nverify to test the vattr/vfsstat attrs. It should
4619 * always be called only after rfs4_do_set_attrs().
4620 *
4621 * Verify that the attributes are same as the expected ones. sargp->vap
4622 * and sargp->sbp contain the input attributes as translated from fattr4.
4623 *
4624 * This function verifies only the attrs that correspond to a vattr or
4625 * vfsstat struct. That is because of the extra step needed to get the
4626 * corresponding system structs. Other attributes have already been set or
4627 * verified by do_rfs4_set_attrs.
4628 *
4629 * Return 0 if all attrs match, -1 if some don't, error if error processing.
4630 */
4631 static int
4634 {
4638 uint_t vbit;
4644 /*
4645 * Okay to overwrite sargp->vap because we verify based
4646 * on the incoming values.
4647 */
4653 /*
4654 * Must return bitmap of successful attrs
4655 */
4658 /*
4659 * Some file systems clobber va_mask. it is probably
4660 * wrong of them to do so, nonethless we practice
4661 * defensive coding.
4662 * See bug id 4276830.
4663 */
4665 }
4666 }
4669 /*
4670 * Now get the superblock and loop on the bitmap, as there is
4671 * no simple way of translating from superblock to bitmap4.
4672 */
4678 }
4679 }
4681 /*
4682 * Now loop and verify each attribute which getattr returned
4683 * whether it's the same as the input.
4684 */
4696 /*
4697 * If vattr attribute but fop_getattr failed, or it's
4698 * superblock attribute but VFS_STATVFS failed, skip
4699 */
4705 }
4713 }
4717 }
4718 }
4719 errout:
4721 }
4723 /*
4724 * Decode the attribute to be set/verified. If the attr requires a sys op
4725 * (fop_getattr, VFS_VFSSTAT), and the request is to verify, then don't
4726 * call the sv_getit function for it, because the sys op hasn't yet been done.
4727 * Return 0 for success, error code if failed.
4728 *
4729 * Note: the decoded arg is not freed here but in nfs4_ntov_table_free.
4730 */
4731 static int
4734 {
4736 bool_t set_later;
4742 /*
4743 * don't verify yet if a vattr or sb dependent attr,
4744 * because we don't have their sys values yet.
4745 * Will be done later.
4746 */
4748 /*
4749 * ACLs are a special case, since setting the MODE
4750 * conflicts with setting the ACL. We delay setting
4751 * the ACL until all other attributes have been set.
4752 * The ACL gets set in do_rfs4_op_setattr().
4753 */
4760 }
4761 }
4762 }
4764 #ifdef DEBUG
4767 #endif
4769 }
4772 }
4775 }
4777 /*
4778 * Set vattr based on incoming fattr4 attrs - used by setattr.
4779 * Set response mask. Ignore any values that are not writable vattr attrs.
4780 */
4781 static nfsstat4
4784 nfs4_attr_cmd_t cmd)
4785 {
4790 XDR xdr;
4796 /*
4797 * Make sure that maximum attribute number can be expressed as an
4798 * 8 bit quantity.
4799 */
4806 }
4811 }
4819 /* sargp->sbp is set by the caller */
4826 /*
4827 * The following loop iterates on the nfs4_ntov_map checking
4828 * if the fbit is set in the requested bitmap.
4829 * If set then we process the arguments using the
4830 * rfs4_fattr4 conversion functions to populate the setattr
4831 * vattr and va_mask. Any settable attrs that are not using vattr
4832 * will be set in this loop.
4833 */
4837 }
4838 /*
4839 * If setattr, must be a writable attr.
4840 * If verify/nverify, must be a readable attr.
4841 */
4844 /*
4845 * Client tries to set/verify an
4846 * unsupported attribute, tries to set
4847 * a read only attr or verify a write
4848 * only one - error!
4849 */
4851 }
4852 /*
4853 * Decode the attribute to set/verify
4854 */
4860 na++;
4864 }
4871 }
4873 static nfsstat4
4876 {
4879 bool_t trunc;
4890 caller_context_t ct;
4897 NFS4ATTR_SETIT);
4899 /*
4900 * failed set attrs
4901 */
4903 }
4906 /*
4907 * no further work to be done
4908 */
4910 }
4912 /*
4913 * If we got a request to set the ACL and the MODE, only
4914 * allow changing VSUID, VSGID, and VSVTX. Attempting
4915 * to change any other bits, along with setting an ACL,
4916 * gives NFS4ERR_INVAL.
4917 */
4920 vattr_t va;
4927 }
4932 }
4933 }
4935 /* Check stateid only if size has been set */
4947 }
4949 /* XXX start of possible race with delegations */
4951 /*
4952 * We need to specially handle size changes because it is
4953 * possible for the client to create a file with read-only
4954 * modes, but with the file opened for writing. If the client
4955 * then tries to set the file size, e.g. ftruncate(3C),
4956 * fcntl(F_FREESP), the normal access checking done in
4957 * fop_setattr would prevent the client from doing it even though
4958 * it should be allowed to do so. To get around this, we do the
4959 * access checking for ourselves and use fop_space which doesn't
4960 * do the access checking.
4961 * Also the client should not be allowed to change the file
4962 * size if there is a conflicting non-blocking mandatory lock in
4963 * the region of the change.
4964 */
4966 uoff_t offset;
4967 ssize_t length;
4969 /*
4970 * ufs_setattr clears VATTR_SIZE from vap->va_mask, but
4971 * before returning, sarg.vap->va_mask is used to
4972 * generate the setattr reply bitmap. We also clear
4973 * VATTR_SIZE below before calling fop_space. For both
4974 * of these cases, the va_mask needs to be saved here
4975 * and restored after calling fop_setattr.
4976 */
4979 /*
4980 * Check any possible conflict due to NBMAND locks.
4981 * Get into critical region before fop_getattr, so the
4982 * size attribute is valid when checking conflicts.
4983 */
4987 }
4993 }
5002 }
5007 }
5008 }
5020 }
5021 }
5026 /* restore va_mask -- ufs_setattr clears VATTR_SIZE */
5030 /*
5031 * If an ACL was being set, it has been delayed until now,
5032 * in order to set the mode (via the fop_setattr() above) first.
5033 */
5049 }
5055 }
5056 }
5059 /* check if a monitor detected a delegation conflict */
5062 else
5065 /*
5066 * Set the response bitmap when setattr failed.
5067 * If fop_setattr partially succeeded, test by doing a
5068 * fop_getattr on the object and comparing the data
5069 * to the setattr arguments.
5070 */
5073 /*
5074 * Force modified metadata out to stable storage.
5075 */
5077 /*
5078 * Set response bitmap
5079 */
5081 }
5083 /* Return early and already have a NFSv4 error */
5084 done:
5085 /*
5086 * Except for nfs4_vmask_to_nmask_set(), vattr --> fattr
5087 * conversion sets both readable and writeable NFS4 attrs
5088 * for VATTR_MTIME and VATTR_ATIME. The line below masks out
5089 * unrequested attrs from the setattr result bitmap. This
5090 * is placed after the done: label to catch the ATTRNOTSUP
5091 * case.
5092 */
5101 }
5103 /* ARGSUSED */
5104 static void
5107 {
5117 }
5119 /*
5120 * If there is an unshared filesystem mounted on this vnode,
5121 * do not allow to setattr on this vnode.
5122 */
5126 }
5133 }
5139 out:
5142 }
5144 /* ARGSUSED */
5145 static void
5148 {
5149 /*
5150 * verify and nverify are exactly the same, except that nverify
5151 * succeeds when some argument changed, and verify succeeds when
5152 * when none changed.
5153 */
5169 }
5177 /*
5178 * do_rfs4_set_attrs will try to verify systemwide attrs,
5179 * so could return -1 for "no match".
5180 */
5184 }
5196 }
5197 done:
5200 out:
5203 }
5205 /* ARGSUSED */
5206 static void
5209 {
5210 /*
5211 * verify and nverify are exactly the same, except that nverify
5212 * succeeds when some argument changed, and verify succeeds when
5213 * when none changed.
5214 */
5232 }
5239 /*
5240 * do_rfs4_set_attrs will try to verify systemwide attrs,
5241 * so could return -1 for "no match".
5242 */
5246 }
5258 }
5259 done:
5265 }
5267 /*
5268 * XXX - This should live in an NFS header file.
5269 */
5270 #define MAX_IOVECS 12
5272 /* ARGSUSED */
5273 static void
5276 {
5282 uoff_t rlimit;
5290 nfsstat4 stat;
5292 caller_context_t ct;
5301 }
5305 }
5313 }
5315 /*
5316 * We have to enter the critical region before calling fop_rwlock
5317 * to avoid a deadlock with ufs.
5318 */
5326 }
5327 }
5332 /*
5333 * If we can't get the attributes, then we can't do the
5334 * right access checking. So, we'll fail the request.
5335 */
5339 }
5344 }
5350 }
5356 }
5361 }
5369 }
5381 iovcnt++;
5383 }
5384 #ifdef DEBUG
5385 /* should have ended on an mblk boundary */
5392 }
5393 #endif
5398 }
5410 }
5435 }
5437 /*
5438 * We're changing creds because VM may fault and we need
5439 * the cred of the current thread to be used if quota
5440 * checking is enabled.
5441 */
5453 }
5460 else
5465 out:
5471 }
5474 /* XXX put in a header file */
5477 void
5480 {
5481 uint_t i;
5487 /*
5488 * Form a reply tag by copying over the reqeuest tag.
5489 */
5501 /*
5502 * XXX for now, minorversion should be zero
5503 */
5511 }
5516 }
5534 }
5537 KM_SLEEP);
5544 /*
5545 * For now, NFS4 compound processing must be protected by
5546 * exported_lock because it can access more than one exportinfo
5547 * per compound and share/unshare can now change multiple
5548 * exinfo structs. The NFS2/3 code only refs 1 exportinfo
5549 * per proc (excluding public exinfo), and exi_count design
5550 * is sufficient to protect concurrent execution of NFS2/3
5551 * ops along with unexport. This lock will be removed as
5552 * part of the NFSv4 phase 2 namespace redesign work.
5553 */
5556 /*
5557 * If this is the first compound we've seen, we need to start all
5558 * new instances' grace periods.
5559 */
5562 /*
5563 * This must be set after rfs4_grace_start_new(), otherwise
5564 * another thread could proceed past here before the former
5565 * is finished.
5566 */
5568 }
5573 uint_t op;
5581 /*
5582 * Count the individual ops here; NULL and COMPOUND
5583 * are counted in common_dispatch()
5584 */
5595 /*
5596 * This is effectively dead code since XDR code
5597 * will have already returned BADXDR if op doesn't
5598 * decode to legal value. This only done for a
5599 * day when XDR code doesn't verify v4 opcodes.
5600 */
5606 }
5608 /*
5609 * If not at last op, and if we are to stop, then
5610 * compact the results array.
5611 */
5622 }
5623 }
5641 }
5643 /*
5644 * XXX because of what appears to be duplicate calls to rfs4_compound_free
5645 * XXX zero out the tag and array values. Need to investigate why the
5646 * XXX calls occur, but at least prevent the panic for now.
5647 */
5648 void
5650 {
5651 uint_t i;
5655 }
5659 uint_t op;
5665 }
5666 }
5669 }
5670 }
5672 /*
5673 * Process the value of the compound request rpc flags, as a bit-AND
5674 * of the individual per-op flags (idempotent, allowork, publicfh_ok)
5675 */
5676 void
5678 {
5683 uint_t op;
5689 else
5691 }
5693 }
5695 nfsstat4
5697 {
5698 nfsstat4 e;
5717 }
5719 #if defined(DEBUG) && ! defined(lint)
5721 {
5733 }
5743 }
5749 }
5751 #define LOCK_PRINT(d, s, t, f) if (d) lock_print(s, t, f)
5752 #else
5753 #define LOCK_PRINT(d, s, t, f)
5754 #endif
5756 /*ARGSUSED*/
5757 static bool_t
5759 {
5761 }
5763 /*
5764 * Look up the pathname using the vp in cs as the directory vnode.
5765 * cs->vp will be the vnode for the file on success
5766 */
5768 static nfsstat4
5771 {
5774 nfsstat4 status;
5780 }
5783 }
5792 }
5797 }
5806 }
5816 }
5818 static nfsstat4
5821 {
5822 nfsstat4 status;
5827 /* Get "before" change value */
5833 /* rfs4_lookup may VN_RELE directory */
5840 }
5842 /*
5843 * Get "after" change value, if it fails, simply return the
5844 * before value.
5845 */
5850 }
5853 /*
5854 * Validate the file is a file
5855 */
5867 }
5872 /*
5873 * It is undefined if fop_lookup will change va_seq, so
5874 * cinfo.atomic = TRUE only if we have
5875 * non-zero va_seq's, and they have not changed.
5876 */
5879 else
5882 /* Check for mandatory locking */
5885 }
5887 static nfsstat4
5890 {
5893 vattr_t va;
5895 tryagain:
5897 /*
5898 * The file open mode used is VWRITE. If the client needs
5899 * some other semantic, then it should do the access checking
5900 * itself. It would have been nice to have the file open mode
5901 * passed as part of the arguments.
5902 */
5910 /*
5911 * If we got something other than file already exists
5912 * then just return this error. Otherwise, we got
5913 * EEXIST. If we were doing a GUARDED create, then
5914 * just return this error. Otherwise, we need to
5915 * make sure that this wasn't a duplicate of an
5916 * exclusive create request.
5917 *
5918 * The assumption is made that a non-exclusive create
5919 * request will never return EEXIST.
5920 */
5925 }
5930 /*
5931 * We couldn't find the file that we thought that
5932 * we just created. So, we'll just try creating
5933 * it again.
5934 */
5940 }
5943 /* existing object must be regular file */
5949 else
5953 }
5956 }
5958 /* Check for duplicate request */
5962 /* We found the file */
5967 /* but its not our creation */
5970 }
5973 }
5976 }
5979 }
5981 static nfsstat4
5984 {
5987 bool_t readonly;
5990 /* For now we don't allow mandatory locking as per V2/V3 */
5993 }
5998 /*
5999 * If the file system is exported read only and we are trying
6000 * to open for write, then return NFS4ERR_ROFS
6001 */
6012 }
6013 }
6019 }
6022 }
6024 static nfsstat4
6027 {
6033 nfsstat4 status;
6039 uint_t buflen;
6040 bool_t created;
6042 len_t reqsize;
6044 bool_t trunc;
6045 caller_context_t ct;
6055 /* Check if the file system is read only */
6059 /*
6060 * Get the last component of path name in nm. cs will reference
6061 * the including directory on success.
6062 */
6076 }
6083 }
6088 }
6094 /*FALLTHROUGH*/
6110 else
6112 }
6119 }
6128 }
6132 /* Disallow create with a non-zero size */
6139 }
6141 }
6145 /* prohibit EXCL create of named attributes */
6150 }
6154 /*
6155 * Ensure no time overflows. Assumes underlying
6156 * filesystem supports at least 32 bits.
6157 * Truncate nsec to usec resolution to allow valid
6158 * compares even if the underlying filesystem truncates.
6159 */
6166 /*
6167 * For EXCL create, attrset is set to the server attr
6168 * used to cache the client's verifier.
6169 */
6172 }
6181 }
6194 }
6201 /*
6202 * True verification that object was created with correct
6203 * attrs is impossible. The attrs could have been changed
6204 * immediately after object creation. If attributes did
6205 * not verify, the only recourse for the server is to
6206 * destroy the object. Maybe if some attrs (like gid)
6207 * are set incorrectly, the object should be destroyed;
6208 * however, seems bad as a default policy. Do we really
6209 * want to destroy an object over one of the times not
6210 * verifying correctly? For these reasons, the server
6211 * currently sets bits in attrset for createattrs
6212 * that were set; however, no verification is done.
6213 *
6214 * vmask_to_nmask accounts for vattr bits set on create
6215 * [do_rfs4_set_attrs() only sets resp bits for
6216 * non-vattr/vfs bits.]
6217 * Mask off any bits we set by default so as not to return
6218 * more attrset bits than were requested in createattrs
6219 */
6224 /*
6225 * We did not create the vnode (we tried but it
6226 * already existed). In this case, the only createattr
6227 * that the spec allows the server to set is size,
6228 * and even then, it can only be set if it is 0.
6229 */
6233 }
6234 }
6238 /*
6239 * Get the initial "after" sequence number, if it fails,
6240 * set to zero, time to before.
6241 */
6246 }
6248 /*
6249 * create_vnode attempts to create the file exclusive,
6250 * if it already exists the fop_create will fail and
6251 * may not increase va_seq. It is atomic if
6252 * we haven't changed the directory, but if it has changed
6253 * we don't know what changed it.
6254 */
6259 else
6263 /*
6264 * The entry was created, we need to sync the
6265 * directory metadata.
6266 */
6269 /*
6270 * Get "after" change value, if it fails, simply return the
6271 * before value.
6272 */
6277 }
6281 /*
6282 * The cinfo->atomic = TRUE only if we have
6283 * non-zero va_seq's, and it has incremented by exactly one
6284 * during the create_vnode and it didn't
6285 * change during the fop_fsync.
6286 */
6290 else
6292 }
6294 /* Check for mandatory locking and that the size gets set. */
6299 /* Assume the worst */
6305 /*
6306 * Truncate the file if necessary; this would be
6307 * the case for create over an existing file.
6308 */
6315 /*
6316 * We are writing over an existing file.
6317 * Check to see if we need to recall a delegation.
6318 */
6328 }
6330 }
6346 }
6347 }
6358 }
6359 }
6363 /*
6364 * Force modified data and metadata out to stable storage.
6365 */
6372 }
6374 /* if parent dir is attrdir, set namedattr fh flag */
6383 /*
6384 * if we did not create the file, we will need to check
6385 * the access bits on the file
6386 */
6394 }
6396 }
6398 /*ARGSUSED*/
6399 static void
6404 {
6405 /* XXX Currently not using req */
6413 sysid_t sysid;
6414 nfsstat4 status;
6415 caller_context_t ct;
6421 /* get the file struct and hold a lock on it during initial open */
6427 }
6433 /* No need to keep any reference */
6437 }
6439 /* try to get the sysid before continuing */
6443 /* Not a fully formed open; "close" it */
6448 }
6450 /* Calculate the fflags for this OPEN. */
6458 /*
6459 * Calculate the new deny and access mode that this open is adding to
6460 * the file for this open owner;
6461 */
6465 /*
6466 * Calculate the new share access and share deny modes that this open
6467 * is adding to the file for this open owner;
6468 */
6474 /*
6475 * Check to see the client has already sent an open for this
6476 * open owner on this file with the same share/deny modes.
6477 * If so, we don't need to check for a conflict and we don't
6478 * need to add another shrlock. If not, then we need to
6479 * check for conflicts in deny and access before checking for
6480 * conflicts in delegation. We don't want to recall a
6481 * delegation based on an open that will eventually fail based
6482 * on shares modes.
6483 */
6491 /* Not a fully formed open; "close" it */
6496 }
6497 }
6501 /*
6502 * Check to see if this file is delegated and if so, if a
6503 * recall needs to be done.
6504 */
6512 /* if state closed while lock was dropped */
6518 /* Not a fully formed open; "close" it */
6524 }
6527 /* Let's see if the delegation was returned */
6536 /* Not a fully formed open; "close" it */
6542 }
6543 }
6544 /*
6545 * the share check passed and any delegation conflict has been
6546 * taken care of, now call vop_open.
6547 * if this is the first open then call vop_open with fflags.
6548 * if not, call vn_open_upgrade with just the upgrade flags.
6549 *
6550 * if the file has been opened already, it will have the current
6551 * access mode in the state struct. if it has no share access, then
6552 * this is a new open.
6553 *
6554 * However, if this is open with CLAIM_DLEGATE_CUR, then don't
6555 * call fop_open(), just do the open upgrade.
6556 */
6570 /* Not a fully formed open; "close" it */
6574 /* check if a monitor detected a delegation conflict */
6577 else
6580 }
6582 /*
6583 * calculate the fflags for the new mode that is being added
6584 * by this upgrade.
6585 */
6592 }
6608 /*
6609 * Check for delegation here. if the deleg argument is not
6610 * DELEG_ANY, then this is a reclaim from a client and
6611 * we must honor the delegation requested. If necessary we can
6612 * set the recall flag.
6613 */
6629 }
6635 }
6637 /*ARGSUSED*/
6638 static void
6641 {
6649 /* inhibit delegation grants during exclusive create */
6656 }
6660 /* cs->vp cs->fh now reference the desired file */
6666 /*
6667 * If rfs4_createfile set attrset, we must
6668 * clear this attrset before the response is copied.
6669 */
6672 }
6673 }
6674 else
6679 }
6681 /*ARGSUSED*/
6682 static void
6685 {
6687 vattr_t va;
6691 /* Verify that we have a regular file */
6697 else
6700 }
6707 }
6711 /*
6712 * Check if we have access to the file, Note the the file
6713 * could have originally been open UNCHECKED or GUARDED
6714 * with mode bits that will now fail, but there is nothing
6715 * we can really do about that except in the case that the
6716 * owner of the file is the one requesting the open.
6717 */
6722 }
6723 }
6725 /*
6726 * cinfo on a CLAIM_PREVIOUS is undefined, initialize to zero
6727 */
6735 }
6737 static void
6740 {
6742 nfsstat4 status;
6743 stateid4 stateid =
6747 /*
6748 * Find the state info from the stateid and confirm that the
6749 * file is delegated. If the state openowner is the same as
6750 * the supplied openowner we're done. If not, get the file
6751 * info from the found state info. Use that file info to
6752 * create the state for this lock owner. Note solaris doen't
6753 * really need the pathname to find the file. We may want to
6754 * lookup the pathname and make sure that the vp exist and
6755 * matches the vp in the file structure. However it is
6756 * possible that the pathname nolonger exists (local process
6757 * unlinks the file), so this may not be that useful.
6758 */
6764 }
6768 /*
6769 * New lock owner, create state. Since this was probably called
6770 * in response to a CB_RECALL we set deleg to DELEG_NONE
6771 */
6782 }
6784 /* Mark progress for delegation returns */
6789 }
6791 /*ARGSUSED*/
6792 static void
6795 {
6796 /*
6797 * Lookup the pathname, it must already exist since this file
6798 * was delegated.
6799 *
6800 * Find the file and state info for this vp and open owner pair.
6801 * check that they are in fact delegated.
6802 * check that the state access and deny modes are the same.
6803 *
6804 * Return the delgation possibly seting the recall flag.
6805 */
6813 /* Note we ignore oflags */
6819 }
6821 /* get the file struct and hold a lock on it during initial open */
6827 }
6836 }
6851 }
6861 }
6885 }
6887 /* XXX For now */
6897 }
6905 /*
6906 * Generic function for sequence number checks.
6907 */
6908 static rfs4_chkseq_t
6911 {
6912 /* Same sequence ids and matching operations? */
6917 }
6921 }
6923 /* If the incoming sequence is not the next expected then it is bad */
6931 }
6936 }
6938 /* Everything okay -- next expected */
6940 }
6943 static rfs4_chkseq_t
6945 {
6946 rfs4_chkseq_t rc;
6950 TRUE);
6957 }
6959 static rfs4_chkseq_t
6961 {
6962 rfs4_chkseq_t rc;
6970 }
6972 static rfs4_chkseq_t
6974 {
6984 }
6986 static void
6989 {
6996 bool_t create;
7006 }
7008 /*
7009 * Need to check clientid and lease expiration first based on
7010 * error ordering and incrementing sequence id.
7011 */
7017 }
7023 }
7026 /*
7027 * Find the open_owner for use from this point forward. Take
7028 * care in updating the sequence id based on the type of error
7029 * being returned.
7030 */
7031 retry:
7038 }
7040 /* Hold off access to the sequence space while the open is done */
7043 /*
7044 * If the open_owner existed before at the server, then check
7045 * the sequence id.
7046 */
7056 }
7064 }
7066 /*
7067 * Sequence was ok and open owner exists
7068 * check to see if we have yet to see an
7069 * open_confirm.
7070 */
7076 }
7077 }
7078 /* Grace only applies to regular-type OPENs */
7083 }
7085 /*
7086 * If previous state at the server existed then can_reclaim
7087 * will be set. If not reply NFS4ERR_NO_GRACE to the
7088 * client.
7089 */
7093 }
7096 /*
7097 * Reject the open if the client has missed the grace period
7098 */
7102 }
7104 /* Couple of up-front bookkeeping items */
7106 /*
7107 * If this is a reclaim OPEN then we should not ask
7108 * for a confirmation of the open_owner per the
7109 * protocol specification.
7110 */
7113 else
7115 }
7118 /*
7119 * If there is an unshared filesystem mounted on this vnode,
7120 * do not allow to open/create in this directory.
7121 */
7125 }
7127 /*
7128 * access must READ, WRITE, or BOTH. No access is invalid.
7129 * deny can be READ, WRITE, BOTH, or NONE.
7130 * bits not defined for access/deny are invalid.
7131 */
7137 }
7140 /*
7141 * make sure attrset is zero before response is built.
7142 */
7161 }
7163 out:
7166 /* Catch sequence id handling here to make it a little easier */
7175 /*
7176 * The protocol states that if any of these errors are
7177 * being returned, the sequence id should not be
7178 * incremented. Any other return requires an
7179 * increment.
7180 */
7183 /* Always update the lease in this case */
7186 /* Regular response - copy the result */
7190 /*
7191 * REPLAY case: Only if the previous response was OK
7192 * do we copy the filehandle. If not OK, no
7193 * filehandle to copy.
7194 */
7198 /*
7199 * If this is a replay, we must restore the
7200 * current filehandle/vp to that of what was
7201 * returned originally. Try our best to do
7202 * it.
7203 */
7213 }
7224 }
7226 /*
7227 * If this was a replay, no need to update the
7228 * sequence id. If the open_owner was not created on
7229 * this pass, then update. The first use of an
7230 * open_owner will not bump the sequence id.
7231 */
7234 /*
7235 * If the client is receiving an error and the
7236 * open_owner needs to be confirmed, there is no way
7237 * to notify the client of this fact ignoring the fact
7238 * that the server has no method of returning a
7239 * stateid to confirm. Therefore, the server needs to
7240 * mark this open_owner in a way as to avoid the
7241 * sequence id checking the next time the client uses
7242 * this open_owner.
7243 */
7246 /*
7247 * If OK response then clear the postpone flag and
7248 * reset the sequence id to keep in sync with the
7249 * client.
7250 */
7254 }
7256 }
7258 finish:
7264 end:
7267 }
7269 /*ARGSUSED*/
7270 void
7273 {
7277 nfsstat4 status;
7285 }
7291 }
7297 }
7299 /* Ensure specified filehandle matches */
7304 }
7306 /* hold off other access to open_owner while we tinker */
7315 }
7316 /*
7317 * If it is the appropriate stateid and determined to
7318 * be "OKAY" then this means that the stateid does not
7319 * need to be confirmed and the client is in error for
7320 * sending an OPEN_CONFIRM.
7321 */
7338 resop)) {
7340 /*
7341 * This is replayed stateid; if seqid matches
7342 * next expected, then client is using wrong seqid.
7343 */
7344 /* fall through */
7349 /*
7350 * Note this case is the duplicate case so
7351 * resp->status is already set.
7352 */
7356 }
7363 }
7377 }
7381 out:
7384 }
7386 /*ARGSUSED*/
7387 void
7390 {
7395 nfsstat4 status;
7406 }
7411 }
7417 }
7419 /* Ensure specified filehandle matches */
7424 }
7426 /* hold off other access to open_owner while we tinker */
7435 }
7453 /* Check the sequence id for the open owner */
7455 resop)) {
7457 /*
7458 * This is replayed stateid; if seqid matches
7459 * next expected, then client is using wrong seqid.
7460 */
7461 /* fall through */
7466 /*
7467 * Note this case is the duplicate case so
7468 * resp->status is already set.
7469 */
7473 }
7478 }
7481 /*
7482 * Check that the new access modes and deny modes are valid.
7483 * Check that no invalid bits are set.
7484 */
7491 }
7493 /*
7494 * The new modes must be a subset of the current modes and
7495 * the access must specify at least one mode. To test that
7496 * the new mode is a subset of the current modes we bitwise
7497 * AND them together and check that the result equals the new
7498 * mode. For example:
7499 * New mode, access == R and current mode, sp->rs_open_access == RW
7500 * access & sp->rs_open_access == R == access, so the new access mode
7501 * is valid. Consider access == RW, sp->rs_open_access = R
7502 * access & sp->rs_open_access == R != access, so the new access mode
7503 * is invalid.
7504 */
7513 }
7515 /*
7516 * Release any share locks associated with this stateID.
7517 * Strictly speaking, this violates the spec because the
7518 * spec effectively requires that open downgrade be atomic.
7519 * At present, fs_shrlock does not have this capability.
7520 */
7529 }
7534 /*
7535 * If the current mode has deny read and the new mode
7536 * does not, decrement the number of deny read mode bits
7537 * and if it goes to zero turn off the deny read bit
7538 * on the file.
7539 */
7545 }
7547 /*
7548 * If the current mode has deny write and the new mode
7549 * does not, decrement the number of deny write mode bits
7550 * and if it goes to zero turn off the deny write bit
7551 * on the file.
7552 */
7558 }
7560 /*
7561 * If the current mode has access read and the new mode
7562 * does not, decrement the number of access read mode bits
7563 * and if it goes to zero turn off the access read bit
7564 * on the file. set fflags to FREAD for the call to
7565 * vn_open_downgrade().
7566 */
7573 }
7575 /*
7576 * If the current mode has access write and the new mode
7577 * does not, decrement the number of access write mode bits
7578 * and if it goes to zero turn off the access write bit
7579 * on the file. set fflags to FWRITE for the call to
7580 * vn_open_downgrade().
7581 */
7588 }
7590 /* Check that the file is still accessible */
7595 /* now set the new open access and deny modes */
7599 /*
7600 * we successfully downgraded the share lock, now we need to downgrade
7601 * the open. it is possible that the downgrade was only for a deny
7602 * mode and we have nothing else to do.
7603 */
7607 /* Update the stateid */
7614 /* Update the lease */
7616 /* And the sequence */
7620 end:
7623 out:
7626 }
7630 {
7637 p++;
7638 n--;
7639 }
7642 }
7644 /*
7645 * The logic behind this function is detailed in the NFSv4 RFC in the
7646 * SETCLIENTID operation description under IMPLEMENTATION. Refer to
7647 * that section for explicit guidance to server behavior for
7648 * SETCLIENTID.
7649 */
7650 void
7653 {
7658 bool_t create;
7664 retry:
7667 /*
7668 * Save the caller's IP address
7669 */
7673 /*
7674 * Record if it is a Solaris client that cannot handle referrals.
7675 */
7678 /* Add a "yes, it's downrev" record */
7684 /* Remove any previous record */
7686 }
7688 /*
7689 * In search of an EXISTING client matching the incoming
7690 * request to establish a new client identifier at the server
7691 */
7695 /* Should never happen */
7701 }
7703 /*
7704 * Easiest case. Client identifier is newly created and is
7705 * unconfirmed. Also note that for this case, no other
7706 * entries exist for the client identifier. Nothing else to
7707 * check. Just setup the response and respond.
7708 */
7714 /* Setup callback information; CB_NULL confirmation later */
7719 }
7721 /*
7722 * An existing, confirmed client may exist but it may not have
7723 * been active for at least one lease period. If so, then
7724 * "close" the client and create a new client identifier
7725 */
7729 }
7733 else
7738 /*
7739 * We have a confirmed client, now check for an
7740 * unconfimred entry
7741 */
7743 /* If creds don't match then client identifier is inuse */
7746 /*
7747 * Some one else has established this client
7748 * id. Try and say * who they are. We will use
7749 * the call back address supplied by * the
7750 * first client.
7751 */
7767 }
7773 }
7775 /*
7776 * Confirmed, creds match, and verifier matches; must
7777 * be an update of the callback info
7778 */
7781 /* Setup callback information */
7785 /* everything okay -- move ahead */
7790 /* update the confirm_verifier and return it */
7797 }
7799 /*
7800 * Creds match but the verifier doesn't. Must search
7801 * for an unconfirmed client that would be replaced by
7802 * this request.
7803 */
7806 cp_confirmed);
7807 }
7809 /*
7810 * At this point, we have taken care of the brand new client
7811 * struct, INUSE case, update of an existing, and confirmed
7812 * client struct.
7813 */
7815 /*
7816 * check to see if things have changed while we originally
7817 * picked up the client struct. If they have, then return and
7818 * retry the processing of this SETCLIENTID request.
7819 */
7828 }
7829 /* do away with the old unconfirmed one */
7834 }
7836 /*
7837 * This search will temporarily hide the confirmed client
7838 * struct while a new client struct is created as the
7839 * unconfirmed one.
7840 */
7850 }
7852 /*
7853 * If one was not created, then a similar request must be in
7854 * process so release and start over with this one
7855 */
7861 }
7867 /* Setup callback information; CB_NULL confirmation later */
7874 out:
7877 }
7879 /*ARGSUSED*/
7880 void
7883 {
7902 }
7908 }
7910 /* If the verifier doesn't match, the record doesn't match */
7915 }
7923 }
7925 /*
7926 * Update the client's associated server instance, if it's changed
7927 * since the client was created.
7928 */
7932 /*
7933 * Record clientid in stable storage.
7934 * Must be done after server instance has been assigned.
7935 */
7941 /* don't need to rele, client_close does it */
7944 /* If needed, initiate CB_NULL call for callback path */
7948 /*
7949 * Check to see if client can perform reclaims
7950 */
7955 out:
7959 }
7962 /*ARGSUSED*/
7963 void
7966 {
7970 nfsstat4 status;
7978 }
7984 }
7986 /* Ensure specified filehandle matches */
7991 }
7993 /* hold off other access to open_owner while we tinker */
8002 }
8020 /* Check the sequence id for the open owner */
8022 resop)) {
8024 /*
8025 * This is replayed stateid; if seqid matches
8026 * next expected, then client is using wrong seqid.
8027 */
8028 /* FALL THROUGH */
8033 /*
8034 * Note this case is the duplicate case so
8035 * resp->status is already set.
8036 */
8040 }
8045 }
8049 /* Update the stateid. */
8063 end:
8066 out:
8069 }
8071 /*
8072 * Manage the counts on the file struct and close all file locks
8073 */
8074 /*ARGSUSED*/
8075 void
8077 bool_t close_of_client)
8078 {
8083 /*
8084 * If this call is part of the larger closing down of client
8085 * state then it is just easier to release all locks
8086 * associated with this client instead of going through each
8087 * individual file and cleaning locks there.
8088 */
8093 /* Is the PxFS kernel module loaded? */
8097 /* Encode the cluster nodeid in new sysid */
8101 /*
8102 * This PxFS routine removes file locks for a
8103 * client over all nodes of a cluster.
8104 */
8107 new_sysid));
8112 /* Release all locks for this client */
8123 }
8126 }
8127 }
8129 /*
8130 * Release all locks on this file by this lock owner or at
8131 * least mark the locks as having been released
8132 */
8137 /* Was this already taken care of above? */
8143 }
8145 /*
8146 * Release any shrlocks associated with this open state ID.
8147 * This must be done before the rfs4_state gets marked closed.
8148 */
8155 /*
8156 * Decrement the count for each access and deny bit that this
8157 * state has contributed to the file.
8158 * If the file counts go to zero
8159 * clear the appropriate bit in the appropriate mask.
8160 */
8166 }
8173 }
8178 }
8183 }
8191 }
8192 }
8194 /*
8195 * lock_denied: Fill in a LOCK4deneid structure given an flock64 structure.
8196 */
8197 static nfsstat4
8199 {
8212 }
8220 }
8222 /*
8223 * Its not a NFS4 lock. We take advantage that the upper 32 bits
8224 * of the client id contain the boot time for a NFS4 lock. So we
8225 * fabricate and identity by setting clientid to the sysid, and
8226 * the lock owner to the pid.
8227 */
8233 finish:
8241 else
8245 }
8247 /*
8248 * The NFSv4.0 LOCK operation does not support the blocking lock (at the
8249 * NFSv4.0 protocol level) so the client needs to resend the LOCK request in a
8250 * case the lock is denied by the NFSv4.0 server. NFSv4.0 clients are prepared
8251 * for that (obviously); they are sending the LOCK requests with some delays
8252 * between the attempts. See nfs4frlock() and nfs4_block_and_wait() for the
8253 * locking and delay implementation at the client side.
8254 *
8255 * To make the life of the clients easier, the NFSv4.0 server tries to do some
8256 * fast retries on its own (the for loop below) in a hope the lock will be
8257 * available soon. And if not, the client won't need to resend the LOCK
8258 * requests so fast to check the lock availability. This basically saves some
8259 * network traffic and tries to make sure the client gets the lock ASAP.
8260 */
8261 static int
8263 {
8272 retry:
8286 }
8287 }
8290 /* Get the owner of the lock */
8295 /*
8296 * There's a race inherent in the current fop_frlock
8297 * design where:
8298 * a: "other guy" takes a lock that conflicts with a
8299 * lock we want
8300 * b: we attempt to take our lock (non-blocking) and
8301 * the attempt fails.
8302 * c: "other guy" releases the conflicting lock
8303 * d: we ask what lock conflicts with the lock we want,
8304 * getting F_UNLCK (no lock blocks us)
8305 *
8306 * If we retry the non-blocking lock attempt in this
8307 * case (restart at step 'b') there's some possibility
8308 * that many such attempts might fail. However a test
8309 * designed to actually provoke this race shows that
8310 * the vast majority of cases require no retry, and
8311 * only a few took as many as three retries. Here's
8312 * the test outcome:
8313 *
8314 * number of retries how many times we needed
8315 * that many retries
8316 * 0 79461
8317 * 1 862
8318 * 2 49
8319 * 3 5
8320 *
8321 * Given those empirical results, we arbitrarily limit
8322 * the retry count to ten.
8323 *
8324 * If we actually make to ten retries and give up,
8325 * nothing catastrophic happens, but we're unable to
8326 * return the information about the conflicting lock to
8327 * the NFS client. That's an acceptable trade off vs.
8328 * letting this retry loop run forever.
8329 */
8332 /* No longer locked, retry */
8334 }
8339 }
8340 }
8341 }
8344 }
8346 /*ARGSUSED*/
8347 static nfsstat4
8350 {
8351 nfsstat4 status;
8358 sysid_t sysid;
8364 }
8369 /* Check for zero length. To lock to end of file use all ones for V4 */
8375 retry:
8380 }
8391 }
8401 }
8404 }
8415 /* Note that length4 is uint64_t but l_len and l_start are off64_t */
8419 }
8421 /*
8422 * N.B. FREAD has the same value as OPEN4_SHARE_ACCESS_READ and
8423 * FWRITE has the same value as OPEN4_SHARE_ACCESS_WRITE.
8424 */
8430 /*
8431 * We need to unlock sp before we call the underlying filesystem to
8432 * acquire the file lock.
8433 */
8438 /*
8439 * Make sure the file is still open. In a case the file was closed in
8440 * the meantime, clean the lock we acquired using the setlock() call
8441 * above, and return the appropriate error.
8442 */
8451 }
8460 }
8462 /*
8463 * N.B. We map error values to nfsv4 errors. This is differrent
8464 * than puterrno4 routine.
8465 */
8472 /* Can only get here if op is OP_LOCK */
8492 }
8495 }
8497 /*ARGSUSED*/
8498 void
8501 {
8504 nfsstat4 status;
8524 }
8527 /* Create a new lockowner for this instance */
8541 }
8543 /* Ensure specified filehandle matches */
8550 }
8552 /* hold off other access to open_owner while we tinker */
8578 /*
8579 * This is replayed stateid; if seqid
8580 * matches next expected, then client
8581 * is using wrong seqid.
8582 */
8583 /* FALLTHROUGH */
8588 /* This is a duplicate LOCK request */
8591 /*
8592 * For a duplicate we do not want to
8593 * create a new lockowner as it should
8594 * already exist.
8595 * Turn off the lockowner create flag.
8596 */
8598 }
8600 }
8608 }
8613 /*
8614 * Only update theh open_seqid if this is not
8615 * a duplicate request
8616 */
8619 }
8627 }
8629 /*
8630 * This is the new_lock_owner branch and the client is
8631 * supposed to be associating a new lock_owner with
8632 * the open file at this point. If we find that a
8633 * lock_owner/state association already exists and a
8634 * successful LOCK request was returned to the client,
8635 * an error is returned to the client since this is
8636 * not appropriate. The client should be using the
8637 * existing lock_owner branch.
8638 */
8645 }
8646 }
8650 /*
8651 * Only update theh open_seqid if this is not
8652 * a duplicate request
8653 */
8656 }
8658 /*
8659 * If this is a duplicate lock request, just copy the
8660 * previously saved reply and return.
8661 */
8663 /* verify that lock_seqid's match */
8672 /*
8673 * Make sure to copy the just
8674 * retrieved reply status into the
8675 * overall compound status
8676 */
8678 }
8681 }
8685 /* Make sure to update the lock sequence id */
8691 /*
8692 * This is used to signify the newly created lockowner
8693 * stateid and its sequence number. The checks for
8694 * sequence number and increment don't occur on the
8695 * very first lock request for a lockowner.
8696 */
8699 /* hold off other access to lsp while we tinker */
8708 /* get lsp and hold the lock on the underlying file struct */
8715 }
8718 /* Ensure specified filehandle matches */
8725 }
8727 /* hold off other access to lsp while we tinker */
8732 /*
8733 * The stateid looks like it was okay (expected to be
8734 * the next one)
8735 */
8737 /*
8738 * The sequence id is now checked. Determine
8739 * if this is a replay or if it is in the
8740 * expected (next) sequence. In the case of a
8741 * replay, there are two replay conditions
8742 * that may occur. The first is the normal
8743 * condition where a LOCK is done with a
8744 * NFS4_OK response and the stateid is
8745 * updated. That case is handled below when
8746 * the stateid is identified as a REPLAY. The
8747 * second is the case where an error is
8748 * returned, like NFS4ERR_DENIED, and the
8749 * sequence number is updated but the stateid
8750 * is not updated. This second case is dealt
8751 * with here. So it may seem odd that the
8752 * stateid is okay but the sequence id is a
8753 * replay but it is okay.
8754 */
8760 /*
8761 * Here is our replay and need
8762 * to verify that the last
8763 * response was an error.
8764 */
8767 }
8768 /*
8769 * This is done since the sequence id
8770 * looked like a replay but it didn't
8771 * pass our check so a BAD_SEQID is
8772 * returned as a result.
8773 */
8774 /*FALLTHROUGH*/
8779 /* Everything looks okay move ahead */
8781 }
8800 /*
8801 * This is a replayed stateid; if
8802 * seqid matches the next expected,
8803 * then client is using wrong seqid.
8804 */
8812 }
8817 }
8821 }
8823 /*
8824 * NFS4 only allows locking on regular files, so
8825 * verify type of object.
8826 */
8830 else
8833 }
8840 }
8845 }
8850 }
8858 out:
8866 }
8867 /*
8868 * Only update the "OPEN" response here if this was a new
8869 * lock_owner
8870 */
8876 end:
8880 /*
8881 * If an sp obtained, then the lsp does not represent
8882 * a lock on the file struct.
8883 */
8886 else
8888 }
8892 }
8896 }
8898 /* free function for LOCK/LOCKT */
8899 static void
8901 {
8915 }
8919 }
8921 /*ARGSUSED*/
8922 void
8925 {
8928 nfsstat4 status;
8940 }
8947 }
8949 /* Ensure specified filehandle matches */
8956 }
8958 /* hold off other access to lsp while we tinker */
8967 }
8984 /*
8985 * This is a replayed stateid; if
8986 * seqid matches the next expected,
8987 * then client is using wrong seqid.
8988 */
8996 }
9001 }
9006 /*
9007 * NFS4 only allows locking on regular files, so
9008 * verify type of object.
9009 */
9013 else
9016 }
9021 }
9026 out:
9034 end:
9040 }
9042 /*
9043 * LOCKT is a best effort routine, the client can not be guaranteed that
9044 * the status return is still in effect by the time the reply is received.
9045 * They are numerous race conditions in this routine, but we are not required
9046 * and can not be accurate.
9047 */
9048 /*ARGSUSED*/
9049 void
9052 {
9062 length4 posix_length;
9063 sysid_t sysid;
9064 pid_t pid;
9072 }
9074 /*
9075 * NFS4 only allows locking on regular files, so
9076 * verify type of object.
9077 */
9081 else
9084 }
9086 /*
9087 * Check out the clientid to ensure the server knows about it
9088 * so that we correctly inform the client of a server reboot.
9089 */
9095 }
9098 /*
9099 * Protocol doesn't allow returning NFS4ERR_STALE as
9100 * other operations do on this check so STALE_CLIENTID
9101 * is returned instead
9102 */
9105 }
9111 }
9125 }
9128 /* Check for zero length. To lock to end of file use all ones for V4 */
9134 }
9136 /* Find or create a lockowner */
9147 }
9148 retry:
9159 /* Note that length4 is uint64_t but l_len and l_start are off64_t */
9163 }
9167 /*
9168 * N.B. We map error values to nfsv4 errors. This is differrent
9169 * than puterrno4 routine.
9170 */
9179 }
9189 error);
9192 }
9194 err:
9198 out:
9201 }
9203 int
9205 {
9227 }
9231 }
9252 else
9255 }
9261 }
9263 int
9265 {
9287 NULL);
9291 }
9298 }
9300 static int
9302 {
9310 }
9315 }
9317 /* tunable to disable server referrals */
9320 /*
9321 * Find an NFS record in reparse point data.
9322 * Returns 0 for success and <0 or an errno value on failure.
9323 */
9324 int
9326 {
9338 }
9345 }
9348 }
9354 }
9359 }
9361 int
9363 {
9379 }
9381 /*
9382 * There is a user-level copy of this routine in ref_subr.c.
9383 * Changes should be kept in sync.
9384 */
9385 static int
9387 {
9398 /* count number of components in the path */
9404 }
9410 }
9414 }
9417 }
9420 }
9422 /*
9423 * There is a user-level copy of this routine in ref_subr.c.
9424 * Changes should be kept in sync.
9425 */
9426 static int
9428 {
9439 }
9441 /* count number of components to alloc buffer */
9446 }
9449 /* copy components into allocated buffer */
9456 }
9458 #define xdr_fs_locations4 xdr_fattr4_fs_locations
9460 fs_locations4 *
9462 {
9468 XDR xdr;
9471 /*
9472 * Check attrs to ensure it's a reparse point
9473 */
9477 /*
9478 * Look for an NFS record and get the type and data
9479 */
9483 /*
9484 * With the type and data, upcall to get the referral
9485 */
9497 err);
9499 }
9501 /*
9502 * We get an XDR'ed record back from the kderef call
9503 */
9512 }
9514 /*
9515 * Look at path to recover fs_root, ignoring the leading '/'
9516 */
9520 }
9524 {
9530 uint_t len;
9532 /* Get the referral */
9536 /* Deal with only the first location and first server */
9543 }
9545 /* Figure out size for "/net/" + host + /path/path/path + NULL */
9550 /* Allocate the symlink buffer and fill it */
9563 npaths++;
9565 }
9573 }
9575 /*
9576 * Check to see if we have a downrev Solaris client, so that we
9577 * can send it a symlink instead of a referral.
9578 */
9579 int
9581 {
9595 }