| blob | 43411fcc1b441b7316e75f60ab59926525cc609d |
1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
22 /*
23 * Copyright 2016 Nexenta Systems, Inc. All rights reserved.
24 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
25 * Copyright (c) 2012, 2016 by Delphix. All rights reserved.
26 */
28 /*
29 * Copyright (c) 1983,1984,1985,1986,1987,1988,1989 AT&T.
30 * All Rights Reserved
31 */
33 #include <sys/param.h>
34 #include <sys/types.h>
35 #include <sys/systm.h>
36 #include <sys/cred.h>
37 #include <sys/buf.h>
38 #include <sys/vfs.h>
39 #include <sys/vnode.h>
40 #include <sys/uio.h>
41 #include <sys/errno.h>
42 #include <sys/sysmacros.h>
43 #include <sys/statvfs.h>
44 #include <sys/kmem.h>
45 #include <sys/dirent.h>
46 #include <sys/cmn_err.h>
47 #include <sys/debug.h>
48 #include <sys/systeminfo.h>
49 #include <sys/flock.h>
50 #include <sys/pathname.h>
51 #include <sys/nbmlock.h>
52 #include <sys/share.h>
53 #include <sys/atomic.h>
54 #include <sys/policy.h>
55 #include <sys/fem.h>
56 #include <sys/sdt.h>
57 #include <sys/ddi.h>
58 #include <sys/zone.h>
60 #include <sys/fs_reparse.h>
62 #include <rpc/types.h>
63 #include <rpc/auth.h>
64 #include <rpc/rpcsec_gss.h>
65 #include <rpc/svc.h>
67 #include <nfs/nfs.h>
68 #include <nfs/export.h>
69 #include <nfs/nfs_cmd.h>
70 #include <nfs/lm.h>
71 #include <nfs/nfs4.h>
73 #include <sys/strsubr.h>
74 #include <sys/strsun.h>
76 #include <inet/common.h>
77 #include <inet/ip.h>
78 #include <inet/ip6.h>
86 /* End of Tunables */
90 /*
91 * Used to bump the stateid4.seqid value and show changes in the stateid
92 */
93 #define next_stateid(sp) (++(sp)->bits.chgseq)
95 /*
96 * RFS4_MINLEN_ENTRY4: XDR-encoded size of smallest possible dirent.
97 * This is used to return NFS4ERR_TOOSMALL when clients specify
98 * maxcount that isn't large enough to hold the smallest possible
99 * XDR encoded dirent.
100 *
101 * sizeof cookie (8 bytes) +
102 * sizeof name_len (4 bytes) +
103 * sizeof smallest (padded) name (4 bytes) +
104 * sizeof bitmap4_len (12 bytes) + NOTE: we always encode len=2 bm4
105 * sizeof attrlist4_len (4 bytes) +
106 * sizeof next boolean (4 bytes)
107 *
108 * RFS4_MINLEN_RDDIR4: XDR-encoded size of READDIR op reply containing
109 * the smallest possible entry4 (assumes no attrs requested).
110 * sizeof nfsstat4 (4 bytes) +
111 * sizeof verifier4 (8 bytes) +
112 * sizeof entry4list bool (4 bytes) +
113 * sizeof entry4 (36 bytes) +
114 * sizeof eof bool (4 bytes)
115 *
116 * RFS4_MINLEN_RDDIR_BUF: minimum length of buffer server will provide to
117 * fop_readdir. Its value is the size of the maximum possible dirent
118 * for solaris. The DIRENT64_RECLEN macro returns the size of dirent
119 * required for a given name length. MAXNAMELEN is the maximum
120 * filename length allowed in Solaris. The first two DIRENT64_RECLEN()
121 * macros are to allow for . and .. entries -- just a minor tweak to try
122 * and guarantee that buffer we give to fop_readdir will be large enough
123 * to hold ., .., and the largest possible solaris dirent64.
124 */
125 #define RFS4_MINLEN_ENTRY4 36
126 #define RFS4_MINLEN_RDDIR4 (4 + NFS4_VERIFIER_SIZE + 4 + RFS4_MINLEN_ENTRY4 + 4)
127 #define RFS4_MINLEN_RDDIR_BUF \
128 (DIRENT64_RECLEN(1) + DIRENT64_RECLEN(2) + DIRENT64_RECLEN(MAXNAMELEN))
130 /*
131 * It would be better to pad to 4 bytes since that's what XDR would do,
132 * but the dirents UFS gives us are already padded to 8, so just take
133 * what we're given. Dircount is only a hint anyway. Currently the
134 * solaris kernel is ASCII only, so there's no point in calling the
135 * UTF8 functions.
136 *
137 * dirent64: named padded to provide 8 byte struct alignment
138 * d_ino(8) + d_off(8) + d_reclen(2) + d_name(namelen + null(1) + pad)
139 *
140 * cookie: uint64_t + utf8namelen: uint_t + utf8name padded to 8 bytes
141 *
142 */
143 #define DIRENT64_TO_DIRCOUNT(dp) \
144 (3 * BYTES_PER_XDR_UNIT + DIRENT64_NAMELEN((dp)->d_reclen))
150 u_longlong_t nfs4_srv_caller_id;
153 verifier4 Write4verf;
154 verifier4 Readdir4verf;
249 /*
250 * translation table for attrs
251 */
256 bool_t vfsstat;
257 };
271 /*
272 * NFS4 op dispatch table
273 */
279 };
282 /*
283 * NFS VERSION 4
284 */
286 /* RFS_NULL = 0 */
289 /* UNUSED = 1 */
292 /* UNUSED = 2 */
295 /* OP_ACCESS = 3 */
298 /* OP_CLOSE = 4 */
301 /* OP_COMMIT = 5 */
304 /* OP_CREATE = 6 */
307 /* OP_DELEGPURGE = 7 */
310 /* OP_DELEGRETURN = 8 */
313 /* OP_GETATTR = 9 */
316 /* OP_GETFH = 10 */
319 /* OP_LINK = 11 */
322 /* OP_LOCK = 12 */
325 /* OP_LOCKT = 13 */
328 /* OP_LOCKU = 14 */
331 /* OP_LOOKUP = 15 */
334 /* OP_LOOKUPP = 16 */
337 /* OP_NVERIFY = 17 */
340 /* OP_OPEN = 18 */
343 /* OP_OPENATTR = 19 */
346 /* OP_OPEN_CONFIRM = 20 */
349 /* OP_OPEN_DOWNGRADE = 21 */
352 /* OP_OPEN_PUTFH = 22 */
355 /* OP_PUTPUBFH = 23 */
358 /* OP_PUTROOTFH = 24 */
361 /* OP_READ = 25 */
364 /* OP_READDIR = 26 */
367 /* OP_READLINK = 27 */
370 /* OP_REMOVE = 28 */
373 /* OP_RENAME = 29 */
376 /* OP_RENEW = 30 */
379 /* OP_RESTOREFH = 31 */
382 /* OP_SAVEFH = 32 */
385 /* OP_SECINFO = 33 */
388 /* OP_SETATTR = 34 */
391 /* OP_SETCLIENTID = 35 */
394 /* OP_SETCLIENTID_CONFIRM = 36 */
397 /* OP_VERIFY = 37 */
400 /* OP_WRITE = 38 */
403 /* OP_RELEASE_LOCKOWNER = 39 */
405 };
409 #define OP_ILLEGAL_IDX (rfsv4disp_cnt)
411 #ifdef DEBUG
458 "rfs4_op_illegal"
459 };
460 #endif
468 #ifdef nextdp
469 #undef nextdp
470 #endif
471 #define nextdp(dp) ((struct dirent64 *)((char *)(dp) + (dp)->d_reclen))
473 fem_t deleg_rdops = {
482 };
484 fem_t deleg_wrops = {
494 };
496 int
498 {
499 timespec32_t verf;
504 /*
505 * The following algorithm attempts to find a unique verifier
506 * to be used as the write verifier returned from the server
507 * to the client. It is important that this verifier change
508 * whenever the server reboots. Of secondary importance, it
509 * is important for the verifier to be unique between two
510 * different servers.
511 *
512 * Thus, an attempt is made to use the system hostid and the
513 * current time in seconds when the nfssrv kernel module is
514 * loaded. It is assumed that an NFS server will not be able
515 * to boot and then to reboot in less than a second. If the
516 * hostid has not been set, then the current high resolution
517 * time is used. This will ensure different verifiers each
518 * time the server reboots and minimize the chances that two
519 * different servers will have the same verifier.
520 * XXX - this is broken on LP64 kernels.
521 */
526 timespec_t tverf;
531 }
538 /* Used to manage create/destroy of server state */
541 /* Used to manage access to server instance linked list */
544 /* Used to manage access to rfs4_deleg_policy */
554 }
556 void
558 {
564 }
569 }
571 void
573 {
580 }
582 void
584 {
589 }
591 /*
592 * returns true if the instance's grace period has never been started
593 */
594 int
596 {
604 }
606 /*
607 * Indicates if server instance is within the
608 * grace period.
609 */
610 int
612 {
620 }
622 int
624 {
628 }
630 /*
631 * reset all currently active grace periods
632 */
633 void
635 {
643 }
645 /*
646 * start any new instances' grace periods
647 */
648 void
650 {
658 }
662 {
668 /*
669 * Take a copy of the string, since the original may be overwritten.
670 * Sadly, no strdup() in the kernel.
671 */
672 /* allow for NUL */
677 /* associate with servinst */
681 /*
682 * Add to list of served paths.
683 * No locking required, as we're only ever called at startup.
684 */
686 /* this is the first dss_path_t */
688 /* needed for insque/remque */
694 }
697 }
699 /*
700 * Create a new server instance, and make it the currently active instance.
701 * Note that starting the grace period too early will reduce the clients'
702 * recovery window.
703 */
704 void
706 {
720 /*
721 * This initial dummy entry is required to setup for insque/remque.
722 * It must be skipped over whenever the list is traversed.
723 */
725 /* insque/remque require initial list entry to be self-terminated */
737 }
741 /* add to linked list */
744 }
747 /* make the new instance "current" */
751 }
753 /*
754 * In future, we might add a rfs4_servinst_destroy(sip) but, for now, destroy
755 * all instances directly.
756 */
757 void
759 {
761 #ifdef DEBUG
763 #endif
778 #ifdef DEBUG
779 n++;
780 #endif
781 }
783 }
785 /*
786 * Assign the current server instance to a client_t.
787 * Should be called with cp->rc_dbe held.
788 */
789 void
791 {
794 /*
795 * The lock ensures that if the current instance is in the process
796 * of changing, we will see the new one.
797 */
801 }
803 rfs4_servinst_t *
805 {
809 }
811 /* ARGSUSED */
812 static void
814 {
815 }
817 /*
818 * This is a fall-through for invalid or not implemented (yet) ops
819 */
820 /* ARGSUSED */
821 static void
824 {
826 }
828 /*
829 * Check if the security flavor, nfsnum, is in the flavor_list.
830 */
831 bool_t
833 {
839 }
841 }
843 /*
844 * Used by rfs4_op_secinfo to get the security information from the
845 * export structure associated with the component.
846 */
847 /* ARGSUSED */
848 static nfsstat4
850 {
854 fid_t fid;
865 /*
866 * If dotdotting, then need to check whether it's above the
867 * root of a filesystem, or above an export point.
868 */
871 /*
872 * If dotdotting at the root of a filesystem, then
873 * need to traverse back to the mounted-on filesystem
874 * and do the dotdot lookup there.
875 */
878 /*
879 * If at the system root, then can
880 * go up no further.
881 */
885 /*
886 * Traverse back to the mounted-on filesystem
887 */
890 /*
891 * Set the different_export flag so we remember
892 * to pick up a new exportinfo entry for
893 * this new filesystem.
894 */
898 /*
899 * If dotdotting above an export point then set
900 * the different_export to get new export info.
901 */
903 }
904 }
906 /*
907 * Get the vnode for the component "nm".
908 */
914 /*
915 * If the vnode is in a pseudo filesystem, or if the security flavor
916 * used in the request is valid but not an explicitly shared flavor,
917 * or the access bit indicates that this is a limited access,
918 * check whether this vnode is visible.
919 */
926 }
927 }
929 /*
930 * If it's a mountpoint, then traverse it.
931 */
936 }
937 /* remember that we had to traverse mountpoint */
941 /*
942 * If vp isn't a mountpoint and the vfs ptrs aren't the same,
943 * then vp is probably an LOFS object. We don't need the
944 * realvp, we just need to know that we might have crossed
945 * a server fs boundary and need to call checkexport4.
946 * (LOFS lookup hides server fs mountpoints, and actually calls
947 * traverse)
948 */
950 }
952 /*
953 * Get the export information for it.
954 */
963 }
967 else
972 /*
973 * If this vnode is a mounted-on vnode,
974 * but the mounted-on file system is not
975 * exported, send back the secinfo for
976 * the exported node that the mounted-on
977 * vnode lives in.
978 */
983 }
984 }
987 }
991 /*
992 * Create the secinfo result based on the security information
993 * from the exportinfo structure (exi).
994 *
995 * Return all flavors for a pseudo node.
996 * For a real export node, return the flavor that the client
997 * has access with.
998 */
1015 /* get oid opaque data */
1024 }
1025 }
1036 /* find out which flavors to return */
1049 ret_cnt++;
1050 }
1051 }
1053 /* Create the returning SECINFO value */
1057 /*
1058 * If the flavor is in the flavor list,
1059 * fill in resok_val.
1060 */
1073 /* get oid opaque data */
1078 KM_SLEEP);
1082 }
1083 k++;
1084 }
1087 }
1091 }
1095 }
1097 /*
1098 * SECINFO (Operation 33): Obtain required security information on
1099 * the component name in the format of (security-mechanism-oid, qop, service)
1100 * triplets.
1101 */
1102 /* ARGSUSED */
1103 static void
1106 {
1110 uint_t len;
1119 /*
1120 * Current file handle (cfh) should have been set before getting
1121 * into this function. If not, return error.
1122 */
1126 }
1131 }
1133 /*
1134 * Verify the component name. If failed, error out, but
1135 * do not error out if the component name is a "..".
1136 * SECINFO will return its parents secinfo data for SECINFO "..".
1137 */
1145 }
1146 }
1152 }
1158 }
1168 }
1177 out:
1180 }
1182 /*
1183 * Free SECINFO result.
1184 */
1185 /* ARGSUSED */
1186 static void
1188 {
1193 /* If this is not an Ok result, nothing to free. */
1196 }
1208 }
1209 }
1213 }
1215 /* ARGSUSED */
1216 static void
1219 {
1235 }
1236 #endif
1240 }
1246 /*
1247 * If the file system is exported read only, it is not appropriate
1248 * to check write permissions for regular files and directories.
1249 * Special files are interpreted by the client, so the underlying
1250 * permissions are sent back to the client for interpretation.
1251 */
1255 else
1258 /*
1259 * XXX
1260 * We need the mode so that we can correctly determine access
1261 * permissions relative to a mandatory lock file. Access to
1262 * mandatory lock files is denied on the server, so it might
1263 * as well be reflected to the server during the open.
1264 */
1270 }
1279 }
1285 }
1294 }
1302 }
1308 }
1311 out:
1314 }
1316 /* ARGSUSED */
1317 static void
1320 {
1326 vattr_t va;
1334 }
1338 }
1343 }
1348 /*
1349 * If we can't get the attributes, then we can't do the
1350 * right access checking. So, we'll fail the request.
1351 */
1355 }
1359 }
1364 else
1368 }
1374 }
1381 }
1385 out:
1388 }
1390 /*
1391 * rfs4_op_mknod is called from rfs4_op_create after all initial verification
1392 * was completed. It does the nfsv4 create for special files.
1393 */
1394 /* ARGSUSED */
1398 {
1412 }
1415 else
1430 }
1432 /*
1433 * Must specify the mode.
1434 */
1438 }
1448 }
1450 }
1452 /*
1453 * nfsv4 create is used to create non-regular files. For regular files,
1454 * use nfsv4 open.
1455 */
1456 /* ARGSUSED */
1457 static void
1460 {
1475 nfsstat4 status;
1488 }
1490 /*
1491 * If there is an unshared filesystem mounted on this vnode,
1492 * do not allow to create an object in this directory.
1493 */
1497 }
1499 /* Verify that type is correct */
1511 };
1516 }
1520 }
1525 }
1530 }
1532 /*
1533 * Name of newly created object
1534 */
1539 }
1545 }
1555 }
1577 }
1579 /* Get "before" change value */
1590 }
1595 /*
1596 * Set the default initial values for attributes when the parent
1597 * directory does not have the VSUID/VSGID bit set and they have
1598 * not been specified in createattrs.
1599 */
1603 }
1607 }
1616 }
1621 /*
1622 * Get the initial "after" sequence number, if it fails,
1623 * set to zero
1624 */
1634 }
1636 /*
1637 * symlink names must be treated as data
1638 */
1650 }
1661 }
1675 }
1684 /*
1685 * Get the initial "after" sequence number, if it fails,
1686 * set to zero
1687 */
1697 /*
1698 * va_seq is not safe over VOP calls, check it again
1699 * if it has changed zero out iva to force atomic = FALSE.
1700 */
1707 /*
1708 * probably a special file.
1709 */
1713 }
1715 /*
1716 * We know this will only generate one VOP call
1717 */
1727 }
1729 /*
1730 * Get the initial "after" sequence number, if it fails,
1731 * set to zero
1732 */
1738 }
1745 }
1747 /*
1748 * Force modified data and metadata out to stable storage.
1749 */
1758 }
1760 /*
1761 * Finish setup of cinfo response, "before" value already set.
1762 * Get "after" change value, if it fails, simply return the
1763 * before value.
1764 */
1769 }
1772 /*
1773 * True verification that object was created with correct
1774 * attrs is impossible. The attrs could have been changed
1775 * immediately after object creation. If attributes did
1776 * not verify, the only recourse for the server is to
1777 * destroy the object. Maybe if some attrs (like gid)
1778 * are set incorrectly, the object should be destroyed;
1779 * however, seems bad as a default policy. Do we really
1780 * want to destroy an object over one of the times not
1781 * verifying correctly? For these reasons, the server
1782 * currently sets bits in attrset for createattrs
1783 * that were set; however, no verification is done.
1784 *
1785 * vmask_to_nmask accounts for vattr bits set on create
1786 * [do_rfs4_set_attrs() only sets resp bits for
1787 * non-vattr/vfs bits.]
1788 * Mask off any bits set by default so as not to return
1789 * more attrset bits than were requested in createattrs
1790 */
1798 }
1800 /*
1801 * The cinfo.atomic = TRUE only if we got no errors, we have
1802 * non-zero va_seq's, and it has incremented by exactly one
1803 * during the creation and it didn't change during the fop_lookup
1804 * or fop_fsync.
1805 */
1809 else
1812 /*
1813 * Force modified metadata out to stable storage.
1814 *
1815 * if a underlying vp exists, pass it to fop_fsync
1816 */
1819 else
1825 }
1831 out:
1834 }
1836 /*ARGSUSED*/
1837 static void
1840 {
1848 }
1850 /*ARGSUSED*/
1851 static void
1854 {
1858 nfsstat4 status;
1868 /* Ensure specified filehandle matches */
1877 out:
1880 }
1882 /*
1883 * Check to see if a given "flavor" is an explicitly shared flavor.
1884 * The assumption of this routine is the "flavor" is already a valid
1885 * flavor in the secinfo list of "exi".
1886 *
1887 * e.g.
1888 * # share -o sec=flavor1 /export
1889 * # share -o sec=flavor2 /export/home
1890 *
1891 * flavor2 is not an explicitly shared flavor for /export,
1892 * however it is in the secinfo list for /export thru the
1893 * server namespace setup.
1894 */
1895 int
1897 {
1906 }
1907 }
1909 /* Should not reach this point based on the assumption */
1911 }
1913 /*
1914 * Check if the security flavor used in the request matches what is
1915 * required at the export point or at the root pseudo node (exi_root).
1916 *
1917 * returns 1 if there's a match or if exported with AUTH_NONE; 0 otherwise.
1918 *
1919 */
1920 static int
1922 {
1926 /*
1927 * Check cs->nfsflavor (from the request) against
1928 * the current export data in cs->exi.
1929 */
1935 }
1938 }
1940 /*
1941 * Check the access authority for the client and return the correct error.
1942 */
1943 nfsstat4
1945 {
1948 /*
1949 * First, check if the security flavor used in the request
1950 * are among the flavors set in the server namespace.
1951 */
1955 }
1969 }
1971 }
1973 /*
1974 * bitmap4_to_attrmask is called by getattr and readdir.
1975 * It sets up the vattr mask and determines whether vfsstat call is needed
1976 * based on the input bitmap.
1977 * Returns nfsv4 status.
1978 */
1979 static nfsstat4
1981 {
1983 uint_t va_mask;
1993 else
1996 /*
1997 * Set rdattr_error_req to true if return error per
1998 * failed entry rather than fail the readdir.
1999 */
2002 else
2005 /*
2006 * generate the va_mask
2007 * Handle the easy cases first
2008 */
2033 }
2035 /*
2036 * Check is vfsstat is needed
2037 */
2043 }
2044 /* NOTREACHED */
2045 }
2047 /*
2048 * bitmap4_get_sysattrs is called by getattr and readdir.
2049 * It calls both fop_getattr and VFS_STATVFS calls to get the attrs.
2050 * Returns nfsv4 status.
2051 */
2052 static nfsstat4
2054 {
2063 }
2064 }
2067 }
2069 static void
2071 {
2073 KM_SLEEP);
2076 }
2078 static void
2081 {
2086 /*
2087 * XXX Should do the same checks for whether the bit is set
2088 */
2093 }
2095 /*
2096 * xdr_free for getattr will be done later
2097 */
2101 }
2102 }
2104 }
2106 /*
2107 * do_rfs4_op_getattr gets the system attrs and converts into fattr4.
2108 */
2109 static nfsstat4
2112 {
2116 XDR xdr;
2117 ulong_t xdr_size;
2128 /* if no bits requested, then return empty fattr4 */
2133 }
2135 /*
2136 * return NFS4ERR_INVAL when client requests write-only attrs
2137 */
2145 /*
2146 * Now loop to get or verify the attrs
2147 */
2156 /*
2157 * Possible error values:
2158 * >0 if sv_getit failed to
2159 * get the attr; 0 if succeeded;
2160 * <0 if rdattr_error and the
2161 * attribute cannot be returned.
2162 */
2165 /*
2166 * If error then just for entry
2167 */
2173 na++;
2178 }
2180 }
2181 }
2182 }
2184 /*
2185 * If rdattr_error was set after the return value for it was assigned,
2186 * update it.
2187 */
2195 }
2202 }
2204 }
2205 }
2212 }
2216 /* freed by rfs4_op_getattr_free() */
2229 }
2230 }
2234 }
2235 done:
2243 }
2245 /* ARGSUSED */
2246 static void
2249 {
2254 nfsstat4 status;
2262 }
2267 }
2279 /* Is this a referral? */
2281 /* Older V4 Solaris client sees a link */
2284 else
2286 }
2290 }
2291 }
2293 out:
2296 }
2298 static void
2300 {
2304 }
2306 /* ARGSUSED */
2307 static void
2310 {
2318 }
2322 }
2324 /* check for reparse point at the share point */
2326 /* it's all bad */
2332 }
2334 /* check for reparse point at vp */
2336 /* it's not all bad */
2341 }
2347 out:
2350 }
2352 static void
2354 {
2362 }
2363 }
2365 /*
2366 * illegal: args: void
2367 * res : status (NFS4ERR_OP_ILLEGAL)
2368 */
2369 /* ARGSUSED */
2370 static void
2373 {
2378 }
2380 /*
2381 * link: args: SAVED_FH: file, CURRENT_FH: target directory
2382 * res: status. If success - CURRENT_FH unchanged, return change_info
2383 */
2384 /* ARGSUSED */
2385 static void
2388 {
2396 uint_t len;
2399 nfsstat4 status;
2404 /* SAVED_FH: source object */
2409 }
2411 /* CURRENT_FH: target directory */
2416 }
2418 /*
2419 * If there is a non-shared filesystem mounted on this vnode,
2420 * do not allow to link any file in this directory.
2421 */
2425 }
2430 }
2432 /* Check source object's type validity */
2436 }
2438 /* Check target directory's type */
2442 }
2447 }
2453 }
2459 }
2465 }
2471 }
2473 /* Get "before" change value */
2480 }
2490 }
2500 /*
2501 * Get the initial "after" sequence number, if it fails, set to zero
2502 */
2507 /*
2508 * Force modified data and metadata out to stable storage.
2509 */
2516 }
2518 /*
2519 * Get "after" change value, if it fails, simply return the
2520 * before value.
2521 */
2526 }
2530 /*
2531 * The cinfo.atomic = TRUE only if we have
2532 * non-zero va_seq's, and it has incremented by exactly one
2533 * during the fop_link and it didn't change during the fop_fsync.
2534 */
2538 else
2542 out:
2545 }
2547 /*
2548 * Used by rfs4_op_lookup and rfs4_op_lookupp to do the actual work.
2549 */
2551 /* ARGSUSED */
2552 static nfsstat4
2554 {
2559 nfsstat4 stat;
2560 fid_t fid;
2570 }
2574 /*
2575 * If dotdotting, then need to check whether it's
2576 * above the root of a filesystem, or above an
2577 * export point.
2578 */
2581 /*
2582 * If dotdotting at the root of a filesystem, then
2583 * need to traverse back to the mounted-on filesystem
2584 * and do the dotdot lookup there.
2585 */
2588 /*
2589 * If at the system root, then can
2590 * go up no further.
2591 */
2595 /*
2596 * Traverse back to the mounted-on filesystem
2597 */
2600 /*
2601 * Set the different_export flag so we remember
2602 * to pick up a new exportinfo entry for
2603 * this new filesystem.
2604 */
2608 /*
2609 * If dotdotting above an export point then set
2610 * the different_export to get new export info.
2611 */
2613 }
2614 }
2621 /*
2622 * If the vnode is in a pseudo filesystem, check whether it is visible.
2623 *
2624 * XXX if the vnode is a symlink and it is not visible in
2625 * a pseudo filesystem, return ENOENT (not following symlink).
2626 * V4 client can not mount such symlink. This is a regression
2627 * from V2/V3.
2628 *
2629 * In the same exported filesystem, if the security flavor used
2630 * is not an explicitly shared flavor, limit the view to the visible
2631 * list entries only. This is not a WRONGSEC case because it's already
2632 * checked via PUTROOTFH/PUTPUBFH or PUTFH.
2633 */
2640 }
2641 }
2643 /*
2644 * If it's a mountpoint, then traverse it.
2645 */
2650 /*
2651 * hold pre_tvp to counteract rele by traverse. We will
2652 * need pre_tvp below if checkexport4 fails
2653 */
2659 }
2662 /*
2663 * The vfsp comparison is to handle the case where
2664 * a LOFS mount is shared. lo_lookup traverses mount points,
2665 * and NFS is unaware of local fs transistions because
2666 * v_vfsmountedhere isn't set. For this special LOFS case,
2667 * the dir and the obj returned by lookup will have different
2668 * vfs ptrs.
2669 */
2671 }
2683 }
2687 else
2692 /*
2693 * If this vnode is a mounted-on vnode,
2694 * but the mounted-on file system is not
2695 * exported, send back the filehandle for
2696 * the mounted-on vnode, not the root of
2697 * the mounted-on file system.
2698 */
2705 }
2707 /* we're done with pre_tvp now. release extra hold */
2709 }
2713 /*
2714 * Now we do a checkauth4. The reason is that
2715 * this client/user may not have access to the new
2716 * exported file system, and if they do,
2717 * the client/user may be mapped to a different uid.
2718 *
2719 * We start with a new cr, because the checkauth4 done
2720 * in the PUT*FH operation over wrote the cred's uid,
2721 * gid, etc, and we want the real thing before calling
2722 * checkauth4()
2723 */
2736 }
2737 }
2741 err_out:
2749 }
2758 /*
2759 * if did lookup on attrdir and didn't lookup .., set named
2760 * attr fh flag
2761 */
2765 /* Assume false for now, open proc will set this */
2769 }
2771 /* ARGSUSED */
2772 static void
2775 {
2779 uint_t len;
2782 nfsstat4 status;
2790 }
2795 }
2800 }
2806 }
2812 }
2818 }
2828 }
2836 out:
2839 }
2841 /* ARGSUSED */
2842 static void
2845 {
2853 }
2858 }
2862 /*
2863 * From NFSV4 Specification, LOOKUPP should not check for
2864 * NFS4ERR_WRONGSEC. Retrun NFS4_OK instead.
2865 */
2868 }
2870 out:
2873 }
2876 /*ARGSUSED2*/
2877 static void
2880 {
2893 }
2899 }
2901 /*
2902 * If file system supports passing ACE mask to fop_access then
2903 * check for ACE_READ_NAMED_ATTRS, otherwise do legacy checks
2904 */
2909 else
2917 }
2919 /*
2920 * The CREATE_XATTR_DIR VOP flag cannot be specified if
2921 * the file system is exported read-only -- regardless of
2922 * createdir flag. Otherwise the attrdir would be created
2923 * (assuming server fs isn't mounted readonly locally). If
2924 * fop_lookup returns ENOENT in this case, the error will
2925 * be translated into EROFS. ENOSYS is mapped to ENOTSUP
2926 * because specfs has no fop_lookup op, so the macro would
2927 * return ENOSYS. EINVAL is returned by all (current)
2928 * Solaris file system implementations when any of their
2929 * restrictions are violated (xattr(dir) can't have xattrdir).
2930 * Returning NOTSUPP is more appropriate in this case
2931 * because the object will never be able to have an attrdir.
2932 */
2944 else
2947 }
2957 }
2962 /*
2963 * There is no requirement for an attrdir fh flag
2964 * because the attrdir has a vnode flag to distinguish
2965 * it from regular (non-xattr) directories. The
2966 * FH4_ATTRDIR flag is set for future sanity checks.
2967 */
2971 out:
2974 }
2976 static int
2979 {
2986 /*
2987 * Don't block on mandatory locks. If this routine returns
2988 * EAGAIN, the caller should return NFS4ERR_LOCKED.
2989 */
3003 }
3011 }
3012 }
3015 }
3017 /* ARGSUSED */
3018 static void
3021 {
3031 uoff_t offset;
3033 nfsstat4 stat;
3039 caller_context_t ct;
3049 }
3053 }
3059 }
3061 /*
3062 * Enter the critical region before calling fop_rwlock
3063 * to avoid a deadlock with write requests.
3064 */
3072 }
3073 }
3079 }
3081 }
3083 /* use loaned buffers for TCP */
3089 /*
3090 * If we can't get the attributes, then we can't do the
3091 * right access checking. So, we'll fail the request.
3092 */
3096 }
3102 }
3109 }
3114 }
3123 /* RDMA */
3130 }
3138 /* RDMA */
3144 }
3146 /*
3147 * Do not allocate memory more than maximum allowed
3148 * transfer size
3149 */
3160 /* Jump to do the read if successful */
3162 /*
3163 * Need to hold the vnode until after fop_retzcbuf()
3164 * is called.
3165 */
3168 }
3175 /* failure to setup for zero copy */
3178 }
3180 /*
3181 * If returning data via RDMA Write, then grab the chunk list. If we
3182 * aren't returning READ data w/RDMA_WRITE, then grab a mblk.
3183 */
3190 /*
3191 * mp will contain the data to be sent out in the read reply.
3192 * It will be freed after the reply has been sent.
3193 */
3199 }
3207 doio_read:
3218 }
3220 /* make mblk using zc buffers */
3224 }
3235 }
3241 else
3247 }
3250 }
3252 out:
3261 }
3263 static void
3265 {
3273 }
3274 }
3276 static void
3278 {
3285 }
3286 }
3289 /* ARGSUSED */
3290 static void
3293 {
3305 }
3316 }
3322 }
3325 /*
3326 * No filesystem is actually shared public, so we default
3327 * to exi_root. In this case, we must check whether root
3328 * is exported.
3329 */
3332 /*
3333 * if root filesystem is exported, the exportinfo struct that we
3334 * should use is what checkexport4 returns, because root_exi is
3335 * actually a mostly empty struct.
3336 */
3341 /*
3342 * it's a properly shared filesystem
3343 */
3345 }
3355 }
3358 out:
3361 }
3363 /*
3364 * XXX - issue with put*fh operations. Suppose /export/home is exported.
3365 * Suppose an NFS client goes to mount /export/home/joe. If /export, home,
3366 * or joe have restrictive search permissions, then we shouldn't let
3367 * the client get a file handle. This is easy to enforce. However, we
3368 * don't know what security flavor should be used until we resolve the
3369 * path name. Another complication is uid mapping. If root is
3370 * the user, then it will be mapped to the anonymous user by default,
3371 * but we won't know that till we've resolved the path name. And we won't
3372 * know what the anonymous user is.
3373 * Luckily, SECINFO is specified to take a full filename.
3374 * So what we will have to in rfs4_op_lookup is check that flavor of
3375 * the target object matches that of the request, and if root was the
3376 * caller, check for the root= and anon= options, and if necessary,
3377 * repeat the lookup using the right cred_t. But that's not done yet.
3378 */
3379 /* ARGSUSED */
3380 static void
3383 {
3394 }
3399 }
3405 }
3409 NULL);
3414 }
3423 }
3429 }
3435 out:
3438 }
3440 /* ARGSUSED */
3441 static void
3444 {
3447 fid_t fid;
3455 }
3462 /*
3463 * Using rootdir, the system root vnode,
3464 * get its fid.
3465 */
3472 }
3474 /*
3475 * Then use the root fsid & fid it to find out if it's exported
3476 *
3477 * If the server root isn't exported directly, then
3478 * it should at least be a pseudo export based on
3479 * one or more exports further down in the server's
3480 * file tree.
3481 */
3488 }
3490 /*
3491 * Now make a filehandle based on the root
3492 * export and root vnode.
3493 */
3498 }
3511 }
3515 out:
3518 }
3520 /*
3521 * set_rdattr_params sets up the variables used to manage what information
3522 * to get for each directory entry.
3523 */
3524 static nfsstat4
3527 {
3528 uint_t va_mask;
3529 nfsstat4 status;
3530 bitmap4 objbits;
3534 /*
3535 * could not even figure attr mask
3536 */
3538 }
3541 /*
3542 * dirent's d_ino is always correct value for mounted_on_fileid.
3543 * mntdfid_set is set once here, but mounted_on_fileid is
3544 * set in main dirent processing loop for each dirent.
3545 * The mntdfid_set is a simple optimization that lets the
3546 * server attr code avoid work when caller is readdir.
3547 */
3550 /*
3551 * Lookup entry only if client asked for any of the following:
3552 * a) vattr attrs
3553 * b) vfs attrs
3554 * c) attrs w/per-object scope requested (change, filehandle, etc)
3555 * other than mounted_on_fileid (which we can take from dirent)
3556 */
3561 else
3567 /*
3568 * If filesystem attrs are requested, get them now from the
3569 * directory vp, as most entries will have same filesystem. The only
3570 * exception are mounted over entries but we handle
3571 * those as we go (XXX mounted over detection not yet implemented).
3572 */
3578 /*
3579 * Failed to get filesystem attributes.
3580 * Return a rdattr_error for each entry, but don't fail.
3581 * However, don't get any obj-dependent attrs.
3582 */
3585 /*
3586 * At least get fileid for regular readdir output
3587 */
3590 }
3593 }
3595 /*
3596 * readlink: args: CURRENT_FH.
3597 * res: status. If success - CURRENT_FH unchanged, return linktext.
3598 */
3600 /* ARGSUSED */
3601 static void
3604 {
3618 /* CURRENT_FH: directory */
3623 }
3628 }
3630 /* Is it a referral? */
3642 }
3647 }
3649 }
3656 }
3661 }
3669 /* Get an artificial symlink based on a referral */
3680 }
3697 }
3703 }
3710 /*
3711 * Even though the conversion failed, we return
3712 * something. We just don't translate it.
3713 */
3715 }
3717 /*
3718 * treat link name as data
3719 */
3727 out:
3730 }
3732 static void
3734 {
3740 }
3741 }
3743 /*
3744 * release_lockowner:
3745 * Release any state associated with the supplied
3746 * lockowner. Note if any lo_state is holding locks we will not
3747 * rele that lo_state and thus the lockowner will not be destroyed.
3748 * A client using lock after the lock owner stateid has been released
3749 * will suffer the consequence of NFS4ERR_BAD_STATEID and would have
3750 * to reissue the lock with new_lock_owner set to TRUE.
3751 * args: lock_owner
3752 * res: status
3753 */
3754 /* ARGSUSED */
3755 static void
3758 {
3768 sysid_t sysid;
3773 /* Make sure there is a clientid around for this request */
3780 }
3787 }
3790 /*
3791 * Check for EXPIRED client. If so will reap state with in a lease
3792 * period or on next set_clientid_confirm step
3793 */
3798 }
3800 /*
3801 * If no sysid has been assigned, then no locks exist; just return.
3802 */
3808 }
3813 /*
3814 * Mark the lockowner invalid.
3815 */
3818 /*
3819 * sysid-pid pair should now not be used since the lockowner is
3820 * invalid. If the client were to instantiate the lockowner again
3821 * it would be assigned a new pid. Thus we can get the list of
3822 * current locks.
3823 */
3826 /* If we are still holding locks fail */
3832 /*
3833 * We need to unhide the lockowner so the client can
3834 * try it again. The bad thing here is if the client
3835 * has a logic error that took it here in the first place
3836 * they probably have lost accounting of the locks that it
3837 * is holding. So we may have dangling state until the
3838 * open owner state is reaped via close. One scenario
3839 * that could possibly occur is that the client has
3840 * sent the unlock request(s) in separate threads
3841 * and has not waited for the replies before sending the
3842 * RELEASE_LOCKOWNER request. Presumably, it would expect
3843 * and deal appropriately with NFS4ERR_LOCKS_HELD, by
3844 * reissuing the request.
3845 */
3849 }
3851 /*
3852 * For the corresponding client we need to check each open
3853 * owner for any opens that have lockowner state associated
3854 * with this lockowner.
3855 */
3873 }
3874 }
3876 }
3878 }
3885 out:
3888 }
3890 /*
3891 * short utility function to lookup a file and recall the delegation
3892 */
3896 {
3911 else
3913 }
3919 }
3921 /*
3922 * remove: args: CURRENT_FH: directory; name.
3923 * res: status. If success - CURRENT_FH unchanged, return change_info
3924 * for directory.
3925 */
3926 /* ARGSUSED */
3927 static void
3930 {
3937 uint_t len;
3942 nfsstat4 status;
3947 /* CURRENT_FH: directory */
3952 }
3957 }
3959 /*
3960 * If there is an unshared filesystem mounted on this vnode,
3961 * Do not allow to remove anything in this directory.
3962 */
3966 }
3971 }
3977 }
3979 /*
3980 * Lookup the file so that we can check if it's a directory
3981 */
3986 }
3992 }
3998 }
4008 }
4010 /*
4011 * Lookup the file to determine type and while we are see if
4012 * there is a file struct around and check for delegation.
4013 * We don't need to acquire va_seq before this lookup, if
4014 * it causes an update, cinfo.before will not match, which will
4015 * trigger a cache flush even if atomic is TRUE.
4016 */
4019 NULL)) {
4027 }
4028 }
4030 /* Didn't find anything to remove */
4037 }
4052 }
4054 }
4055 }
4057 /* Get dir "before" change value */
4071 }
4073 }
4076 /* Actually do the REMOVE operation */
4078 /*
4079 * Can't remove a directory that has a mounted-on filesystem.
4080 */
4084 /*
4085 * System V defines rmdir to return EEXIST,
4086 * not ENOTEMPTY, if the directory is not
4087 * empty. A System V NFS server needs to map
4088 * NFS4ERR_EXIST to NFS4ERR_NOTEMPTY to
4089 * transmit over the wire.
4090 */
4094 }
4108 /*
4109 * This is va_seq safe because we are not
4110 * manipulating dvp.
4111 */
4115 /* Remove state on file remove */
4119 }
4121 }
4123 }
4124 }
4125 }
4134 }
4142 }
4144 /*
4145 * Get the initial "after" sequence number, if it fails, set to zero
4146 */
4151 /*
4152 * Force modified data and metadata out to stable storage.
4153 */
4156 /*
4157 * Get "after" change value, if it fails, simply return the
4158 * before value.
4159 */
4164 }
4168 /*
4169 * The cinfo.atomic = TRUE only if we have
4170 * non-zero va_seq's, and it has incremented by exactly one
4171 * during the fop_remove/RMDIR and it didn't change during
4172 * the fop_fsync.
4173 */
4177 else
4182 out:
4185 }
4187 /*
4188 * rename: args: SAVED_FH: from directory, CURRENT_FH: target directory,
4189 * oldname and newname.
4190 * res: status. If success - CURRENT_FH unchanged, return change_info
4191 * for both from and target directories.
4192 */
4193 /* ARGSUSED */
4194 static void
4197 {
4214 nfsstat4 status;
4224 /* CURRENT_FH: target directory */
4229 }
4231 /* SAVED_FH: from directory */
4236 }
4241 }
4243 /*
4244 * If there is an unshared filesystem mounted on this vnode,
4245 * do not allow to rename objects in this directory.
4246 */
4250 }
4252 /*
4253 * If there is an unshared filesystem mounted on this vnode,
4254 * do not allow to rename to this directory.
4255 */
4259 }
4264 }
4269 }
4275 }
4281 }
4287 }
4291 nlen);
4297 }
4306 }
4318 }
4326 }
4338 }
4340 /*
4341 * Is the source a file and have a delegation?
4342 * We don't need to acquire va_seq before these lookups, if
4343 * it causes an update, cinfo.before will not match, which will
4344 * trigger a cache flush even if atomic is TRUE.
4345 */
4349 NULL)) {
4352 }
4353 }
4364 }
4368 /* Does the destination exist and a file and have a delegation? */
4372 NULL)) {
4375 }
4376 }
4380 /* Check for NBMAND lock on both source and target */
4387 }
4388 }
4396 }
4397 }
4399 /* Get source "before" change value */
4405 }
4409 }
4429 /* The file is gone and so should the state */
4433 }
4435 }
4437 }
4438 }
4454 }
4458 }
4467 /*
4468 * Get the initial "after" sequence number, if it fails, set to zero
4469 */
4478 /*
4479 * Force modified data and metadata out to stable storage.
4480 */
4487 }
4489 /*
4490 * Get "after" change values, if it fails, simply return the
4491 * before value.
4492 */
4497 }
4503 }
4508 /*
4509 * The cinfo.atomic = TRUE only if we have
4510 * non-zero va_seq's, and it has incremented by exactly one
4511 * during the fop_rename and it didn't change during the fop_fsync.
4512 */
4516 else
4522 else
4525 #ifdef VOLATILE_FH_TEST
4526 {
4529 /*
4530 * Add the renamed file handle to the volatile rename list
4531 */
4533 /* file handles may expire on rename */
4537 /*
4538 * Already know that nnm will be a valid string
4539 */
4546 }
4547 }
4548 }
4552 out:
4557 err_out:
4574 }
4578 }
4582 }
4584 /* ARGSUSED */
4585 static void
4588 {
4600 }
4606 }
4616 }
4621 out:
4624 }
4626 /* ARGSUSED */
4627 static void
4630 {
4635 /* No need to check cs->access - we are not accessing any object */
4639 }
4642 }
4650 out:
4653 }
4655 /* ARGSUSED */
4656 static void
4659 {
4664 /* No need to check cs->access - we are not accessing any object */
4668 }
4671 }
4675 /*
4676 * since SAVEFH is fairly rare, don't alloc space for its fh
4677 * unless necessary.
4678 */
4681 }
4685 out:
4688 }
4690 /*
4691 * rfs4_verify_attr is called when nfsv4 Setattr failed, but we wish to
4692 * return the bitmap of attrs that were set successfully. It is also
4693 * called by Verify/Nverify to test the vattr/vfsstat attrs. It should
4694 * always be called only after rfs4_do_set_attrs().
4695 *
4696 * Verify that the attributes are same as the expected ones. sargp->vap
4697 * and sargp->sbp contain the input attributes as translated from fattr4.
4698 *
4699 * This function verifies only the attrs that correspond to a vattr or
4700 * vfsstat struct. That is because of the extra step needed to get the
4701 * corresponding system structs. Other attributes have already been set or
4702 * verified by do_rfs4_set_attrs.
4703 *
4704 * Return 0 if all attrs match, -1 if some don't, error if error processing.
4705 */
4706 static int
4709 {
4713 uint_t vbit;
4719 /*
4720 * Okay to overwrite sargp->vap because we verify based
4721 * on the incoming values.
4722 */
4728 /*
4729 * Must return bitmap of successful attrs
4730 */
4733 /*
4734 * Some file systems clobber va_mask. it is probably
4735 * wrong of them to do so, nonethless we practice
4736 * defensive coding.
4737 * See bug id 4276830.
4738 */
4740 }
4741 }
4744 /*
4745 * Now get the superblock and loop on the bitmap, as there is
4746 * no simple way of translating from superblock to bitmap4.
4747 */
4753 }
4754 }
4756 /*
4757 * Now loop and verify each attribute which getattr returned
4758 * whether it's the same as the input.
4759 */
4771 /*
4772 * If vattr attribute but fop_getattr failed, or it's
4773 * superblock attribute but VFS_STATVFS failed, skip
4774 */
4780 }
4788 }
4792 }
4793 }
4794 errout:
4796 }
4798 /*
4799 * Decode the attribute to be set/verified. If the attr requires a sys op
4800 * (fop_getattr, VFS_VFSSTAT), and the request is to verify, then don't
4801 * call the sv_getit function for it, because the sys op hasn't yet been done.
4802 * Return 0 for success, error code if failed.
4803 *
4804 * Note: the decoded arg is not freed here but in nfs4_ntov_table_free.
4805 */
4806 static int
4809 {
4811 bool_t set_later;
4817 /*
4818 * don't verify yet if a vattr or sb dependent attr,
4819 * because we don't have their sys values yet.
4820 * Will be done later.
4821 */
4823 /*
4824 * ACLs are a special case, since setting the MODE
4825 * conflicts with setting the ACL. We delay setting
4826 * the ACL until all other attributes have been set.
4827 * The ACL gets set in do_rfs4_op_setattr().
4828 */
4835 }
4836 }
4837 }
4839 #ifdef DEBUG
4842 #endif
4844 }
4847 }
4850 }
4852 /*
4853 * Set vattr based on incoming fattr4 attrs - used by setattr.
4854 * Set response mask. Ignore any values that are not writable vattr attrs.
4855 */
4856 static nfsstat4
4859 nfs4_attr_cmd_t cmd)
4860 {
4865 XDR xdr;
4871 /*
4872 * Make sure that maximum attribute number can be expressed as an
4873 * 8 bit quantity.
4874 */
4881 }
4886 }
4894 /* sargp->sbp is set by the caller */
4901 /*
4902 * The following loop iterates on the nfs4_ntov_map checking
4903 * if the fbit is set in the requested bitmap.
4904 * If set then we process the arguments using the
4905 * rfs4_fattr4 conversion functions to populate the setattr
4906 * vattr and va_mask. Any settable attrs that are not using vattr
4907 * will be set in this loop.
4908 */
4912 }
4913 /*
4914 * If setattr, must be a writable attr.
4915 * If verify/nverify, must be a readable attr.
4916 */
4919 /*
4920 * Client tries to set/verify an
4921 * unsupported attribute, tries to set
4922 * a read only attr or verify a write
4923 * only one - error!
4924 */
4926 }
4927 /*
4928 * Decode the attribute to set/verify
4929 */
4935 na++;
4939 }
4946 }
4948 static nfsstat4
4951 {
4954 bool_t trunc;
4965 caller_context_t ct;
4972 NFS4ATTR_SETIT);
4974 /*
4975 * failed set attrs
4976 */
4978 }
4981 /*
4982 * no further work to be done
4983 */
4985 }
4987 /*
4988 * If we got a request to set the ACL and the MODE, only
4989 * allow changing VSUID, VSGID, and VSVTX. Attempting
4990 * to change any other bits, along with setting an ACL,
4991 * gives NFS4ERR_INVAL.
4992 */
4995 vattr_t va;
5002 }
5007 }
5008 }
5010 /* Check stateid only if size has been set */
5022 }
5024 /* XXX start of possible race with delegations */
5026 /*
5027 * We need to specially handle size changes because it is
5028 * possible for the client to create a file with read-only
5029 * modes, but with the file opened for writing. If the client
5030 * then tries to set the file size, e.g. ftruncate(3C),
5031 * fcntl(F_FREESP), the normal access checking done in
5032 * fop_setattr would prevent the client from doing it even though
5033 * it should be allowed to do so. To get around this, we do the
5034 * access checking for ourselves and use fop_space which doesn't
5035 * do the access checking.
5036 * Also the client should not be allowed to change the file
5037 * size if there is a conflicting non-blocking mandatory lock in
5038 * the region of the change.
5039 */
5041 uoff_t offset;
5042 ssize_t length;
5044 /*
5045 * ufs_setattr clears AT_SIZE from vap->va_mask, but
5046 * before returning, sarg.vap->va_mask is used to
5047 * generate the setattr reply bitmap. We also clear
5048 * AT_SIZE below before calling fop_space. For both
5049 * of these cases, the va_mask needs to be saved here
5050 * and restored after calling fop_setattr.
5051 */
5054 /*
5055 * Check any possible conflict due to NBMAND locks.
5056 * Get into critical region before fop_getattr, so the
5057 * size attribute is valid when checking conflicts.
5058 */
5062 }
5068 }
5077 }
5082 }
5083 }
5095 }
5096 }
5101 /* restore va_mask -- ufs_setattr clears AT_SIZE */
5105 /*
5106 * If an ACL was being set, it has been delayed until now,
5107 * in order to set the mode (via the fop_setattr() above) first.
5108 */
5124 }
5130 }
5131 }
5134 /* check if a monitor detected a delegation conflict */
5137 else
5140 /*
5141 * Set the response bitmap when setattr failed.
5142 * If fop_setattr partially succeeded, test by doing a
5143 * fop_getattr on the object and comparing the data
5144 * to the setattr arguments.
5145 */
5148 /*
5149 * Force modified metadata out to stable storage.
5150 */
5152 /*
5153 * Set response bitmap
5154 */
5156 }
5158 /* Return early and already have a NFSv4 error */
5159 done:
5160 /*
5161 * Except for nfs4_vmask_to_nmask_set(), vattr --> fattr
5162 * conversion sets both readable and writeable NFS4 attrs
5163 * for AT_MTIME and AT_ATIME. The line below masks out
5164 * unrequested attrs from the setattr result bitmap. This
5165 * is placed after the done: label to catch the ATTRNOTSUP
5166 * case.
5167 */
5176 }
5178 /* ARGSUSED */
5179 static void
5182 {
5192 }
5194 /*
5195 * If there is an unshared filesystem mounted on this vnode,
5196 * do not allow to setattr on this vnode.
5197 */
5201 }
5208 }
5214 out:
5217 }
5219 /* ARGSUSED */
5220 static void
5223 {
5224 /*
5225 * verify and nverify are exactly the same, except that nverify
5226 * succeeds when some argument changed, and verify succeeds when
5227 * when none changed.
5228 */
5244 }
5252 /*
5253 * do_rfs4_set_attrs will try to verify systemwide attrs,
5254 * so could return -1 for "no match".
5255 */
5259 }
5271 }
5272 done:
5275 out:
5278 }
5280 /* ARGSUSED */
5281 static void
5284 {
5285 /*
5286 * verify and nverify are exactly the same, except that nverify
5287 * succeeds when some argument changed, and verify succeeds when
5288 * when none changed.
5289 */
5307 }
5314 /*
5315 * do_rfs4_set_attrs will try to verify systemwide attrs,
5316 * so could return -1 for "no match".
5317 */
5321 }
5333 }
5334 done:
5340 }
5342 /*
5343 * XXX - This should live in an NFS header file.
5344 */
5345 #define MAX_IOVECS 12
5347 /* ARGSUSED */
5348 static void
5351 {
5357 uoff_t rlimit;
5365 nfsstat4 stat;
5367 caller_context_t ct;
5376 }
5380 }
5388 }
5390 /*
5391 * We have to enter the critical region before calling fop_rwlock
5392 * to avoid a deadlock with ufs.
5393 */
5401 }
5402 }
5407 /*
5408 * If we can't get the attributes, then we can't do the
5409 * right access checking. So, we'll fail the request.
5410 */
5414 }
5419 }
5425 }
5431 }
5436 }
5444 }
5456 iovcnt++;
5458 }
5459 #ifdef DEBUG
5460 /* should have ended on an mblk boundary */
5467 }
5468 #endif
5473 }
5485 }
5510 }
5512 /*
5513 * We're changing creds because VM may fault and we need
5514 * the cred of the current thread to be used if quota
5515 * checking is enabled.
5516 */
5528 }
5535 else
5540 out:
5546 }
5549 /* XXX put in a header file */
5552 void
5555 {
5556 uint_t i;
5562 /*
5563 * Form a reply tag by copying over the reqeuest tag.
5564 */
5576 /*
5577 * XXX for now, minorversion should be zero
5578 */
5586 }
5591 }
5609 }
5612 KM_SLEEP);
5619 /*
5620 * For now, NFS4 compound processing must be protected by
5621 * exported_lock because it can access more than one exportinfo
5622 * per compound and share/unshare can now change multiple
5623 * exinfo structs. The NFS2/3 code only refs 1 exportinfo
5624 * per proc (excluding public exinfo), and exi_count design
5625 * is sufficient to protect concurrent execution of NFS2/3
5626 * ops along with unexport. This lock will be removed as
5627 * part of the NFSv4 phase 2 namespace redesign work.
5628 */
5631 /*
5632 * If this is the first compound we've seen, we need to start all
5633 * new instances' grace periods.
5634 */
5637 /*
5638 * This must be set after rfs4_grace_start_new(), otherwise
5639 * another thread could proceed past here before the former
5640 * is finished.
5641 */
5643 }
5648 uint_t op;
5656 /*
5657 * Count the individual ops here; NULL and COMPOUND
5658 * are counted in common_dispatch()
5659 */
5670 /*
5671 * This is effectively dead code since XDR code
5672 * will have already returned BADXDR if op doesn't
5673 * decode to legal value. This only done for a
5674 * day when XDR code doesn't verify v4 opcodes.
5675 */
5681 }
5683 /*
5684 * If not at last op, and if we are to stop, then
5685 * compact the results array.
5686 */
5697 }
5698 }
5716 }
5718 /*
5719 * XXX because of what appears to be duplicate calls to rfs4_compound_free
5720 * XXX zero out the tag and array values. Need to investigate why the
5721 * XXX calls occur, but at least prevent the panic for now.
5722 */
5723 void
5725 {
5726 uint_t i;
5730 }
5734 uint_t op;
5740 }
5741 }
5744 }
5745 }
5747 /*
5748 * Process the value of the compound request rpc flags, as a bit-AND
5749 * of the individual per-op flags (idempotent, allowork, publicfh_ok)
5750 */
5751 void
5753 {
5758 uint_t op;
5764 else
5766 }
5768 }
5770 nfsstat4
5772 {
5773 nfsstat4 e;
5792 }
5794 #if defined(DEBUG) && ! defined(lint)
5796 {
5808 }
5818 }
5824 }
5826 #define LOCK_PRINT(d, s, t, f) if (d) lock_print(s, t, f)
5827 #else
5828 #define LOCK_PRINT(d, s, t, f)
5829 #endif
5831 /*ARGSUSED*/
5832 static bool_t
5834 {
5836 }
5838 /*
5839 * Look up the pathname using the vp in cs as the directory vnode.
5840 * cs->vp will be the vnode for the file on success
5841 */
5843 static nfsstat4
5846 {
5849 nfsstat4 status;
5855 }
5858 }
5867 }
5872 }
5881 }
5891 }
5893 static nfsstat4
5896 {
5897 nfsstat4 status;
5902 /* Get "before" change value */
5908 /* rfs4_lookup may VN_RELE directory */
5915 }
5917 /*
5918 * Get "after" change value, if it fails, simply return the
5919 * before value.
5920 */
5925 }
5928 /*
5929 * Validate the file is a file
5930 */
5942 }
5947 /*
5948 * It is undefined if fop_lookup will change va_seq, so
5949 * cinfo.atomic = TRUE only if we have
5950 * non-zero va_seq's, and they have not changed.
5951 */
5954 else
5957 /* Check for mandatory locking */
5960 }
5962 static nfsstat4
5965 {
5968 vattr_t va;
5970 tryagain:
5972 /*
5973 * The file open mode used is VWRITE. If the client needs
5974 * some other semantic, then it should do the access checking
5975 * itself. It would have been nice to have the file open mode
5976 * passed as part of the arguments.
5977 */
5985 /*
5986 * If we got something other than file already exists
5987 * then just return this error. Otherwise, we got
5988 * EEXIST. If we were doing a GUARDED create, then
5989 * just return this error. Otherwise, we need to
5990 * make sure that this wasn't a duplicate of an
5991 * exclusive create request.
5992 *
5993 * The assumption is made that a non-exclusive create
5994 * request will never return EEXIST.
5995 */
6000 }
6005 /*
6006 * We couldn't find the file that we thought that
6007 * we just created. So, we'll just try creating
6008 * it again.
6009 */
6015 }
6018 /* existing object must be regular file */
6024 else
6028 }
6031 }
6033 /* Check for duplicate request */
6037 /* We found the file */
6042 /* but its not our creation */
6045 }
6048 }
6051 }
6054 }
6056 static nfsstat4
6059 {
6062 bool_t readonly;
6065 /* For now we don't allow mandatory locking as per V2/V3 */
6068 }
6073 /*
6074 * If the file system is exported read only and we are trying
6075 * to open for write, then return NFS4ERR_ROFS
6076 */
6087 }
6088 }
6094 }
6097 }
6099 static nfsstat4
6102 {
6108 nfsstat4 status;
6114 uint_t buflen;
6115 bool_t created;
6117 len_t reqsize;
6119 bool_t trunc;
6120 caller_context_t ct;
6130 /* Check if the file system is read only */
6134 /*
6135 * Get the last component of path name in nm. cs will reference
6136 * the including directory on success.
6137 */
6151 }
6158 }
6163 }
6169 /*FALLTHROUGH*/
6185 else
6187 }
6194 }
6203 }
6207 /* Disallow create with a non-zero size */
6214 }
6216 }
6220 /* prohibit EXCL create of named attributes */
6225 }
6229 /*
6230 * Ensure no time overflows. Assumes underlying
6231 * filesystem supports at least 32 bits.
6232 * Truncate nsec to usec resolution to allow valid
6233 * compares even if the underlying filesystem truncates.
6234 */
6241 /*
6242 * For EXCL create, attrset is set to the server attr
6243 * used to cache the client's verifier.
6244 */
6247 }
6256 }
6269 }
6276 /*
6277 * True verification that object was created with correct
6278 * attrs is impossible. The attrs could have been changed
6279 * immediately after object creation. If attributes did
6280 * not verify, the only recourse for the server is to
6281 * destroy the object. Maybe if some attrs (like gid)
6282 * are set incorrectly, the object should be destroyed;
6283 * however, seems bad as a default policy. Do we really
6284 * want to destroy an object over one of the times not
6285 * verifying correctly? For these reasons, the server
6286 * currently sets bits in attrset for createattrs
6287 * that were set; however, no verification is done.
6288 *
6289 * vmask_to_nmask accounts for vattr bits set on create
6290 * [do_rfs4_set_attrs() only sets resp bits for
6291 * non-vattr/vfs bits.]
6292 * Mask off any bits we set by default so as not to return
6293 * more attrset bits than were requested in createattrs
6294 */
6299 /*
6300 * We did not create the vnode (we tried but it
6301 * already existed). In this case, the only createattr
6302 * that the spec allows the server to set is size,
6303 * and even then, it can only be set if it is 0.
6304 */
6308 }
6309 }
6313 /*
6314 * Get the initial "after" sequence number, if it fails,
6315 * set to zero, time to before.
6316 */
6321 }
6323 /*
6324 * create_vnode attempts to create the file exclusive,
6325 * if it already exists the fop_create will fail and
6326 * may not increase va_seq. It is atomic if
6327 * we haven't changed the directory, but if it has changed
6328 * we don't know what changed it.
6329 */
6334 else
6338 /*
6339 * The entry was created, we need to sync the
6340 * directory metadata.
6341 */
6344 /*
6345 * Get "after" change value, if it fails, simply return the
6346 * before value.
6347 */
6352 }
6356 /*
6357 * The cinfo->atomic = TRUE only if we have
6358 * non-zero va_seq's, and it has incremented by exactly one
6359 * during the create_vnode and it didn't
6360 * change during the fop_fsync.
6361 */
6365 else
6367 }
6369 /* Check for mandatory locking and that the size gets set. */
6374 /* Assume the worst */
6380 /*
6381 * Truncate the file if necessary; this would be
6382 * the case for create over an existing file.
6383 */
6390 /*
6391 * We are writing over an existing file.
6392 * Check to see if we need to recall a delegation.
6393 */
6403 }
6405 }
6421 }
6422 }
6433 }
6434 }
6438 /*
6439 * Force modified data and metadata out to stable storage.
6440 */
6447 }
6449 /* if parent dir is attrdir, set namedattr fh flag */
6458 /*
6459 * if we did not create the file, we will need to check
6460 * the access bits on the file
6461 */
6469 }
6471 }
6473 /*ARGSUSED*/
6474 static void
6479 {
6480 /* XXX Currently not using req */
6488 sysid_t sysid;
6489 nfsstat4 status;
6490 caller_context_t ct;
6496 /* get the file struct and hold a lock on it during initial open */
6502 }
6508 /* No need to keep any reference */
6512 }
6514 /* try to get the sysid before continuing */
6518 /* Not a fully formed open; "close" it */
6523 }
6525 /* Calculate the fflags for this OPEN. */
6533 /*
6534 * Calculate the new deny and access mode that this open is adding to
6535 * the file for this open owner;
6536 */
6540 /*
6541 * Calculate the new share access and share deny modes that this open
6542 * is adding to the file for this open owner;
6543 */
6549 /*
6550 * Check to see the client has already sent an open for this
6551 * open owner on this file with the same share/deny modes.
6552 * If so, we don't need to check for a conflict and we don't
6553 * need to add another shrlock. If not, then we need to
6554 * check for conflicts in deny and access before checking for
6555 * conflicts in delegation. We don't want to recall a
6556 * delegation based on an open that will eventually fail based
6557 * on shares modes.
6558 */
6566 /* Not a fully formed open; "close" it */
6571 }
6572 }
6576 /*
6577 * Check to see if this file is delegated and if so, if a
6578 * recall needs to be done.
6579 */
6587 /* if state closed while lock was dropped */
6593 /* Not a fully formed open; "close" it */
6599 }
6602 /* Let's see if the delegation was returned */
6611 /* Not a fully formed open; "close" it */
6617 }
6618 }
6619 /*
6620 * the share check passed and any delegation conflict has been
6621 * taken care of, now call vop_open.
6622 * if this is the first open then call vop_open with fflags.
6623 * if not, call vn_open_upgrade with just the upgrade flags.
6624 *
6625 * if the file has been opened already, it will have the current
6626 * access mode in the state struct. if it has no share access, then
6627 * this is a new open.
6628 *
6629 * However, if this is open with CLAIM_DLEGATE_CUR, then don't
6630 * call fop_open(), just do the open upgrade.
6631 */
6645 /* Not a fully formed open; "close" it */
6649 /* check if a monitor detected a delegation conflict */
6652 else
6655 }
6657 /*
6658 * calculate the fflags for the new mode that is being added
6659 * by this upgrade.
6660 */
6667 }
6683 /*
6684 * Check for delegation here. if the deleg argument is not
6685 * DELEG_ANY, then this is a reclaim from a client and
6686 * we must honor the delegation requested. If necessary we can
6687 * set the recall flag.
6688 */
6704 }
6710 }
6712 /*ARGSUSED*/
6713 static void
6716 {
6724 /* inhibit delegation grants during exclusive create */
6731 }
6735 /* cs->vp cs->fh now reference the desired file */
6741 /*
6742 * If rfs4_createfile set attrset, we must
6743 * clear this attrset before the response is copied.
6744 */
6747 }
6748 }
6749 else
6754 }
6756 /*ARGSUSED*/
6757 static void
6760 {
6762 vattr_t va;
6766 /* Verify that we have a regular file */
6772 else
6775 }
6782 }
6786 /*
6787 * Check if we have access to the file, Note the the file
6788 * could have originally been open UNCHECKED or GUARDED
6789 * with mode bits that will now fail, but there is nothing
6790 * we can really do about that except in the case that the
6791 * owner of the file is the one requesting the open.
6792 */
6797 }
6798 }
6800 /*
6801 * cinfo on a CLAIM_PREVIOUS is undefined, initialize to zero
6802 */
6810 }
6812 static void
6815 {
6817 nfsstat4 status;
6818 stateid4 stateid =
6822 /*
6823 * Find the state info from the stateid and confirm that the
6824 * file is delegated. If the state openowner is the same as
6825 * the supplied openowner we're done. If not, get the file
6826 * info from the found state info. Use that file info to
6827 * create the state for this lock owner. Note solaris doen't
6828 * really need the pathname to find the file. We may want to
6829 * lookup the pathname and make sure that the vp exist and
6830 * matches the vp in the file structure. However it is
6831 * possible that the pathname nolonger exists (local process
6832 * unlinks the file), so this may not be that useful.
6833 */
6839 }
6843 /*
6844 * New lock owner, create state. Since this was probably called
6845 * in response to a CB_RECALL we set deleg to DELEG_NONE
6846 */
6857 }
6859 /* Mark progress for delegation returns */
6864 }
6866 /*ARGSUSED*/
6867 static void
6870 {
6871 /*
6872 * Lookup the pathname, it must already exist since this file
6873 * was delegated.
6874 *
6875 * Find the file and state info for this vp and open owner pair.
6876 * check that they are in fact delegated.
6877 * check that the state access and deny modes are the same.
6878 *
6879 * Return the delgation possibly seting the recall flag.
6880 */
6888 /* Note we ignore oflags */
6894 }
6896 /* get the file struct and hold a lock on it during initial open */
6902 }
6911 }
6926 }
6936 }
6960 }
6962 /* XXX For now */
6972 }
6980 /*
6981 * Generic function for sequence number checks.
6982 */
6983 static rfs4_chkseq_t
6986 {
6987 /* Same sequence ids and matching operations? */
6992 }
6996 }
6998 /* If the incoming sequence is not the next expected then it is bad */
7006 }
7011 }
7013 /* Everything okay -- next expected */
7015 }
7018 static rfs4_chkseq_t
7020 {
7021 rfs4_chkseq_t rc;
7025 TRUE);
7032 }
7034 static rfs4_chkseq_t
7036 {
7037 rfs4_chkseq_t rc;
7045 }
7047 static rfs4_chkseq_t
7049 {
7059 }
7061 static void
7064 {
7071 bool_t create;
7081 }
7083 /*
7084 * Need to check clientid and lease expiration first based on
7085 * error ordering and incrementing sequence id.
7086 */
7092 }
7098 }
7101 /*
7102 * Find the open_owner for use from this point forward. Take
7103 * care in updating the sequence id based on the type of error
7104 * being returned.
7105 */
7106 retry:
7113 }
7115 /* Hold off access to the sequence space while the open is done */
7118 /*
7119 * If the open_owner existed before at the server, then check
7120 * the sequence id.
7121 */
7131 }
7139 }
7141 /*
7142 * Sequence was ok and open owner exists
7143 * check to see if we have yet to see an
7144 * open_confirm.
7145 */
7151 }
7152 }
7153 /* Grace only applies to regular-type OPENs */
7158 }
7160 /*
7161 * If previous state at the server existed then can_reclaim
7162 * will be set. If not reply NFS4ERR_NO_GRACE to the
7163 * client.
7164 */
7168 }
7171 /*
7172 * Reject the open if the client has missed the grace period
7173 */
7177 }
7179 /* Couple of up-front bookkeeping items */
7181 /*
7182 * If this is a reclaim OPEN then we should not ask
7183 * for a confirmation of the open_owner per the
7184 * protocol specification.
7185 */
7188 else
7190 }
7193 /*
7194 * If there is an unshared filesystem mounted on this vnode,
7195 * do not allow to open/create in this directory.
7196 */
7200 }
7202 /*
7203 * access must READ, WRITE, or BOTH. No access is invalid.
7204 * deny can be READ, WRITE, BOTH, or NONE.
7205 * bits not defined for access/deny are invalid.
7206 */
7212 }
7215 /*
7216 * make sure attrset is zero before response is built.
7217 */
7236 }
7238 out:
7241 /* Catch sequence id handling here to make it a little easier */
7250 /*
7251 * The protocol states that if any of these errors are
7252 * being returned, the sequence id should not be
7253 * incremented. Any other return requires an
7254 * increment.
7255 */
7258 /* Always update the lease in this case */
7261 /* Regular response - copy the result */
7265 /*
7266 * REPLAY case: Only if the previous response was OK
7267 * do we copy the filehandle. If not OK, no
7268 * filehandle to copy.
7269 */
7273 /*
7274 * If this is a replay, we must restore the
7275 * current filehandle/vp to that of what was
7276 * returned originally. Try our best to do
7277 * it.
7278 */
7288 }
7299 }
7301 /*
7302 * If this was a replay, no need to update the
7303 * sequence id. If the open_owner was not created on
7304 * this pass, then update. The first use of an
7305 * open_owner will not bump the sequence id.
7306 */
7309 /*
7310 * If the client is receiving an error and the
7311 * open_owner needs to be confirmed, there is no way
7312 * to notify the client of this fact ignoring the fact
7313 * that the server has no method of returning a
7314 * stateid to confirm. Therefore, the server needs to
7315 * mark this open_owner in a way as to avoid the
7316 * sequence id checking the next time the client uses
7317 * this open_owner.
7318 */
7321 /*
7322 * If OK response then clear the postpone flag and
7323 * reset the sequence id to keep in sync with the
7324 * client.
7325 */
7329 }
7331 }
7333 finish:
7339 end:
7342 }
7344 /*ARGSUSED*/
7345 void
7348 {
7352 nfsstat4 status;
7360 }
7366 }
7372 }
7374 /* Ensure specified filehandle matches */
7379 }
7381 /* hold off other access to open_owner while we tinker */
7390 }
7391 /*
7392 * If it is the appropriate stateid and determined to
7393 * be "OKAY" then this means that the stateid does not
7394 * need to be confirmed and the client is in error for
7395 * sending an OPEN_CONFIRM.
7396 */
7413 resop)) {
7415 /*
7416 * This is replayed stateid; if seqid matches
7417 * next expected, then client is using wrong seqid.
7418 */
7419 /* fall through */
7424 /*
7425 * Note this case is the duplicate case so
7426 * resp->status is already set.
7427 */
7431 }
7438 }
7452 }
7456 out:
7459 }
7461 /*ARGSUSED*/
7462 void
7465 {
7470 nfsstat4 status;
7481 }
7486 }
7492 }
7494 /* Ensure specified filehandle matches */
7499 }
7501 /* hold off other access to open_owner while we tinker */
7510 }
7528 /* Check the sequence id for the open owner */
7530 resop)) {
7532 /*
7533 * This is replayed stateid; if seqid matches
7534 * next expected, then client is using wrong seqid.
7535 */
7536 /* fall through */
7541 /*
7542 * Note this case is the duplicate case so
7543 * resp->status is already set.
7544 */
7548 }
7553 }
7556 /*
7557 * Check that the new access modes and deny modes are valid.
7558 * Check that no invalid bits are set.
7559 */
7566 }
7568 /*
7569 * The new modes must be a subset of the current modes and
7570 * the access must specify at least one mode. To test that
7571 * the new mode is a subset of the current modes we bitwise
7572 * AND them together and check that the result equals the new
7573 * mode. For example:
7574 * New mode, access == R and current mode, sp->rs_open_access == RW
7575 * access & sp->rs_open_access == R == access, so the new access mode
7576 * is valid. Consider access == RW, sp->rs_open_access = R
7577 * access & sp->rs_open_access == R != access, so the new access mode
7578 * is invalid.
7579 */
7588 }
7590 /*
7591 * Release any share locks associated with this stateID.
7592 * Strictly speaking, this violates the spec because the
7593 * spec effectively requires that open downgrade be atomic.
7594 * At present, fs_shrlock does not have this capability.
7595 */
7604 }
7609 /*
7610 * If the current mode has deny read and the new mode
7611 * does not, decrement the number of deny read mode bits
7612 * and if it goes to zero turn off the deny read bit
7613 * on the file.
7614 */
7620 }
7622 /*
7623 * If the current mode has deny write and the new mode
7624 * does not, decrement the number of deny write mode bits
7625 * and if it goes to zero turn off the deny write bit
7626 * on the file.
7627 */
7633 }
7635 /*
7636 * If the current mode has access read and the new mode
7637 * does not, decrement the number of access read mode bits
7638 * and if it goes to zero turn off the access read bit
7639 * on the file. set fflags to FREAD for the call to
7640 * vn_open_downgrade().
7641 */
7648 }
7650 /*
7651 * If the current mode has access write and the new mode
7652 * does not, decrement the number of access write mode bits
7653 * and if it goes to zero turn off the access write bit
7654 * on the file. set fflags to FWRITE for the call to
7655 * vn_open_downgrade().
7656 */
7663 }
7665 /* Check that the file is still accessible */
7670 /* now set the new open access and deny modes */
7674 /*
7675 * we successfully downgraded the share lock, now we need to downgrade
7676 * the open. it is possible that the downgrade was only for a deny
7677 * mode and we have nothing else to do.
7678 */
7682 /* Update the stateid */
7689 /* Update the lease */
7691 /* And the sequence */
7695 end:
7698 out:
7701 }
7705 {
7712 p++;
7713 n--;
7714 }
7717 }
7719 /*
7720 * The logic behind this function is detailed in the NFSv4 RFC in the
7721 * SETCLIENTID operation description under IMPLEMENTATION. Refer to
7722 * that section for explicit guidance to server behavior for
7723 * SETCLIENTID.
7724 */
7725 void
7728 {
7733 bool_t create;
7739 retry:
7742 /*
7743 * Save the caller's IP address
7744 */
7748 /*
7749 * Record if it is a Solaris client that cannot handle referrals.
7750 */
7753 /* Add a "yes, it's downrev" record */
7759 /* Remove any previous record */
7761 }
7763 /*
7764 * In search of an EXISTING client matching the incoming
7765 * request to establish a new client identifier at the server
7766 */
7770 /* Should never happen */
7776 }
7778 /*
7779 * Easiest case. Client identifier is newly created and is
7780 * unconfirmed. Also note that for this case, no other
7781 * entries exist for the client identifier. Nothing else to
7782 * check. Just setup the response and respond.
7783 */
7789 /* Setup callback information; CB_NULL confirmation later */
7794 }
7796 /*
7797 * An existing, confirmed client may exist but it may not have
7798 * been active for at least one lease period. If so, then
7799 * "close" the client and create a new client identifier
7800 */
7804 }
7808 else
7813 /*
7814 * We have a confirmed client, now check for an
7815 * unconfimred entry
7816 */
7818 /* If creds don't match then client identifier is inuse */
7821 /*
7822 * Some one else has established this client
7823 * id. Try and say * who they are. We will use
7824 * the call back address supplied by * the
7825 * first client.
7826 */
7842 }
7848 }
7850 /*
7851 * Confirmed, creds match, and verifier matches; must
7852 * be an update of the callback info
7853 */
7856 /* Setup callback information */
7860 /* everything okay -- move ahead */
7865 /* update the confirm_verifier and return it */
7872 }
7874 /*
7875 * Creds match but the verifier doesn't. Must search
7876 * for an unconfirmed client that would be replaced by
7877 * this request.
7878 */
7881 cp_confirmed);
7882 }
7884 /*
7885 * At this point, we have taken care of the brand new client
7886 * struct, INUSE case, update of an existing, and confirmed
7887 * client struct.
7888 */
7890 /*
7891 * check to see if things have changed while we originally
7892 * picked up the client struct. If they have, then return and
7893 * retry the processing of this SETCLIENTID request.
7894 */
7903 }
7904 /* do away with the old unconfirmed one */
7909 }
7911 /*
7912 * This search will temporarily hide the confirmed client
7913 * struct while a new client struct is created as the
7914 * unconfirmed one.
7915 */
7925 }
7927 /*
7928 * If one was not created, then a similar request must be in
7929 * process so release and start over with this one
7930 */
7936 }
7942 /* Setup callback information; CB_NULL confirmation later */
7949 out:
7952 }
7954 /*ARGSUSED*/
7955 void
7958 {
7977 }
7983 }
7985 /* If the verifier doesn't match, the record doesn't match */
7990 }
7998 }
8000 /*
8001 * Update the client's associated server instance, if it's changed
8002 * since the client was created.
8003 */
8007 /*
8008 * Record clientid in stable storage.
8009 * Must be done after server instance has been assigned.
8010 */
8016 /* don't need to rele, client_close does it */
8019 /* If needed, initiate CB_NULL call for callback path */
8023 /*
8024 * Check to see if client can perform reclaims
8025 */
8030 out:
8034 }
8037 /*ARGSUSED*/
8038 void
8041 {
8045 nfsstat4 status;
8053 }
8059 }
8061 /* Ensure specified filehandle matches */
8066 }
8068 /* hold off other access to open_owner while we tinker */
8077 }
8095 /* Check the sequence id for the open owner */
8097 resop)) {
8099 /*
8100 * This is replayed stateid; if seqid matches
8101 * next expected, then client is using wrong seqid.
8102 */
8103 /* FALL THROUGH */
8108 /*
8109 * Note this case is the duplicate case so
8110 * resp->status is already set.
8111 */
8115 }
8120 }
8124 /* Update the stateid. */
8138 end:
8141 out:
8144 }
8146 /*
8147 * Manage the counts on the file struct and close all file locks
8148 */
8149 /*ARGSUSED*/
8150 void
8152 bool_t close_of_client)
8153 {
8158 /*
8159 * If this call is part of the larger closing down of client
8160 * state then it is just easier to release all locks
8161 * associated with this client instead of going through each
8162 * individual file and cleaning locks there.
8163 */
8168 /* Is the PxFS kernel module loaded? */
8172 /* Encode the cluster nodeid in new sysid */
8176 /*
8177 * This PxFS routine removes file locks for a
8178 * client over all nodes of a cluster.
8179 */
8182 new_sysid));
8187 /* Release all locks for this client */
8198 }
8201 }
8202 }
8204 /*
8205 * Release all locks on this file by this lock owner or at
8206 * least mark the locks as having been released
8207 */
8212 /* Was this already taken care of above? */
8218 }
8220 /*
8221 * Release any shrlocks associated with this open state ID.
8222 * This must be done before the rfs4_state gets marked closed.
8223 */
8230 /*
8231 * Decrement the count for each access and deny bit that this
8232 * state has contributed to the file.
8233 * If the file counts go to zero
8234 * clear the appropriate bit in the appropriate mask.
8235 */
8241 }
8248 }
8253 }
8258 }
8266 }
8267 }
8269 /*
8270 * lock_denied: Fill in a LOCK4deneid structure given an flock64 structure.
8271 */
8272 static nfsstat4
8274 {
8287 }
8295 }
8297 /*
8298 * Its not a NFS4 lock. We take advantage that the upper 32 bits
8299 * of the client id contain the boot time for a NFS4 lock. So we
8300 * fabricate and identity by setting clientid to the sysid, and
8301 * the lock owner to the pid.
8302 */
8308 finish:
8316 else
8320 }
8322 /*
8323 * The NFSv4.0 LOCK operation does not support the blocking lock (at the
8324 * NFSv4.0 protocol level) so the client needs to resend the LOCK request in a
8325 * case the lock is denied by the NFSv4.0 server. NFSv4.0 clients are prepared
8326 * for that (obviously); they are sending the LOCK requests with some delays
8327 * between the attempts. See nfs4frlock() and nfs4_block_and_wait() for the
8328 * locking and delay implementation at the client side.
8329 *
8330 * To make the life of the clients easier, the NFSv4.0 server tries to do some
8331 * fast retries on its own (the for loop below) in a hope the lock will be
8332 * available soon. And if not, the client won't need to resend the LOCK
8333 * requests so fast to check the lock availability. This basically saves some
8334 * network traffic and tries to make sure the client gets the lock ASAP.
8335 */
8336 static int
8338 {
8347 retry:
8361 }
8362 }
8365 /* Get the owner of the lock */
8370 /*
8371 * There's a race inherent in the current fop_frlock
8372 * design where:
8373 * a: "other guy" takes a lock that conflicts with a
8374 * lock we want
8375 * b: we attempt to take our lock (non-blocking) and
8376 * the attempt fails.
8377 * c: "other guy" releases the conflicting lock
8378 * d: we ask what lock conflicts with the lock we want,
8379 * getting F_UNLCK (no lock blocks us)
8380 *
8381 * If we retry the non-blocking lock attempt in this
8382 * case (restart at step 'b') there's some possibility
8383 * that many such attempts might fail. However a test
8384 * designed to actually provoke this race shows that
8385 * the vast majority of cases require no retry, and
8386 * only a few took as many as three retries. Here's
8387 * the test outcome:
8388 *
8389 * number of retries how many times we needed
8390 * that many retries
8391 * 0 79461
8392 * 1 862
8393 * 2 49
8394 * 3 5
8395 *
8396 * Given those empirical results, we arbitrarily limit
8397 * the retry count to ten.
8398 *
8399 * If we actually make to ten retries and give up,
8400 * nothing catastrophic happens, but we're unable to
8401 * return the information about the conflicting lock to
8402 * the NFS client. That's an acceptable trade off vs.
8403 * letting this retry loop run forever.
8404 */
8407 /* No longer locked, retry */
8409 }
8414 }
8415 }
8416 }
8419 }
8421 /*ARGSUSED*/
8422 static nfsstat4
8425 {
8426 nfsstat4 status;
8433 sysid_t sysid;
8439 }
8444 /* Check for zero length. To lock to end of file use all ones for V4 */
8450 retry:
8455 }
8466 }
8476 }
8479 }
8490 /* Note that length4 is uint64_t but l_len and l_start are off64_t */
8494 }
8496 /*
8497 * N.B. FREAD has the same value as OPEN4_SHARE_ACCESS_READ and
8498 * FWRITE has the same value as OPEN4_SHARE_ACCESS_WRITE.
8499 */
8505 /*
8506 * We need to unlock sp before we call the underlying filesystem to
8507 * acquire the file lock.
8508 */
8513 /*
8514 * Make sure the file is still open. In a case the file was closed in
8515 * the meantime, clean the lock we acquired using the setlock() call
8516 * above, and return the appropriate error.
8517 */
8526 }
8535 }
8537 /*
8538 * N.B. We map error values to nfsv4 errors. This is differrent
8539 * than puterrno4 routine.
8540 */
8547 /* Can only get here if op is OP_LOCK */
8567 }
8570 }
8572 /*ARGSUSED*/
8573 void
8576 {
8579 nfsstat4 status;
8599 }
8602 /* Create a new lockowner for this instance */
8616 }
8618 /* Ensure specified filehandle matches */
8625 }
8627 /* hold off other access to open_owner while we tinker */
8653 /*
8654 * This is replayed stateid; if seqid
8655 * matches next expected, then client
8656 * is using wrong seqid.
8657 */
8658 /* FALLTHROUGH */
8663 /* This is a duplicate LOCK request */
8666 /*
8667 * For a duplicate we do not want to
8668 * create a new lockowner as it should
8669 * already exist.
8670 * Turn off the lockowner create flag.
8671 */
8673 }
8675 }
8683 }
8688 /*
8689 * Only update theh open_seqid if this is not
8690 * a duplicate request
8691 */
8694 }
8702 }
8704 /*
8705 * This is the new_lock_owner branch and the client is
8706 * supposed to be associating a new lock_owner with
8707 * the open file at this point. If we find that a
8708 * lock_owner/state association already exists and a
8709 * successful LOCK request was returned to the client,
8710 * an error is returned to the client since this is
8711 * not appropriate. The client should be using the
8712 * existing lock_owner branch.
8713 */
8720 }
8721 }
8725 /*
8726 * Only update theh open_seqid if this is not
8727 * a duplicate request
8728 */
8731 }
8733 /*
8734 * If this is a duplicate lock request, just copy the
8735 * previously saved reply and return.
8736 */
8738 /* verify that lock_seqid's match */
8747 /*
8748 * Make sure to copy the just
8749 * retrieved reply status into the
8750 * overall compound status
8751 */
8753 }
8756 }
8760 /* Make sure to update the lock sequence id */
8766 /*
8767 * This is used to signify the newly created lockowner
8768 * stateid and its sequence number. The checks for
8769 * sequence number and increment don't occur on the
8770 * very first lock request for a lockowner.
8771 */
8774 /* hold off other access to lsp while we tinker */
8783 /* get lsp and hold the lock on the underlying file struct */
8790 }
8793 /* Ensure specified filehandle matches */
8800 }
8802 /* hold off other access to lsp while we tinker */
8807 /*
8808 * The stateid looks like it was okay (expected to be
8809 * the next one)
8810 */
8812 /*
8813 * The sequence id is now checked. Determine
8814 * if this is a replay or if it is in the
8815 * expected (next) sequence. In the case of a
8816 * replay, there are two replay conditions
8817 * that may occur. The first is the normal
8818 * condition where a LOCK is done with a
8819 * NFS4_OK response and the stateid is
8820 * updated. That case is handled below when
8821 * the stateid is identified as a REPLAY. The
8822 * second is the case where an error is
8823 * returned, like NFS4ERR_DENIED, and the
8824 * sequence number is updated but the stateid
8825 * is not updated. This second case is dealt
8826 * with here. So it may seem odd that the
8827 * stateid is okay but the sequence id is a
8828 * replay but it is okay.
8829 */
8835 /*
8836 * Here is our replay and need
8837 * to verify that the last
8838 * response was an error.
8839 */
8842 }
8843 /*
8844 * This is done since the sequence id
8845 * looked like a replay but it didn't
8846 * pass our check so a BAD_SEQID is
8847 * returned as a result.
8848 */
8849 /*FALLTHROUGH*/
8854 /* Everything looks okay move ahead */
8856 }
8875 /*
8876 * This is a replayed stateid; if
8877 * seqid matches the next expected,
8878 * then client is using wrong seqid.
8879 */
8887 }
8892 }
8896 }
8898 /*
8899 * NFS4 only allows locking on regular files, so
8900 * verify type of object.
8901 */
8905 else
8908 }
8915 }
8920 }
8925 }
8933 out:
8941 }
8942 /*
8943 * Only update the "OPEN" response here if this was a new
8944 * lock_owner
8945 */
8951 end:
8955 /*
8956 * If an sp obtained, then the lsp does not represent
8957 * a lock on the file struct.
8958 */
8961 else
8963 }
8967 }
8971 }
8973 /* free function for LOCK/LOCKT */
8974 static void
8976 {
8990 }
8994 }
8996 /*ARGSUSED*/
8997 void
9000 {
9003 nfsstat4 status;
9015 }
9022 }
9024 /* Ensure specified filehandle matches */
9031 }
9033 /* hold off other access to lsp while we tinker */
9042 }
9059 /*
9060 * This is a replayed stateid; if
9061 * seqid matches the next expected,
9062 * then client is using wrong seqid.
9063 */
9071 }
9076 }
9081 /*
9082 * NFS4 only allows locking on regular files, so
9083 * verify type of object.
9084 */
9088 else
9091 }
9096 }
9101 out:
9109 end:
9115 }
9117 /*
9118 * LOCKT is a best effort routine, the client can not be guaranteed that
9119 * the status return is still in effect by the time the reply is received.
9120 * They are numerous race conditions in this routine, but we are not required
9121 * and can not be accurate.
9122 */
9123 /*ARGSUSED*/
9124 void
9127 {
9137 length4 posix_length;
9138 sysid_t sysid;
9139 pid_t pid;
9147 }
9149 /*
9150 * NFS4 only allows locking on regular files, so
9151 * verify type of object.
9152 */
9156 else
9159 }
9161 /*
9162 * Check out the clientid to ensure the server knows about it
9163 * so that we correctly inform the client of a server reboot.
9164 */
9170 }
9173 /*
9174 * Protocol doesn't allow returning NFS4ERR_STALE as
9175 * other operations do on this check so STALE_CLIENTID
9176 * is returned instead
9177 */
9180 }
9186 }
9200 }
9203 /* Check for zero length. To lock to end of file use all ones for V4 */
9209 }
9211 /* Find or create a lockowner */
9222 }
9223 retry:
9234 /* Note that length4 is uint64_t but l_len and l_start are off64_t */
9238 }
9242 /*
9243 * N.B. We map error values to nfsv4 errors. This is differrent
9244 * than puterrno4 routine.
9245 */
9254 }
9264 error);
9267 }
9269 err:
9273 out:
9276 }
9278 int
9280 {
9302 }
9306 }
9327 else
9330 }
9336 }
9338 int
9340 {
9362 NULL);
9366 }
9373 }
9375 static int
9377 {
9385 }
9390 }
9392 /* tunable to disable server referrals */
9395 /*
9396 * Find an NFS record in reparse point data.
9397 * Returns 0 for success and <0 or an errno value on failure.
9398 */
9399 int
9401 {
9413 }
9420 }
9423 }
9429 }
9434 }
9436 int
9438 {
9454 }
9456 /*
9457 * There is a user-level copy of this routine in ref_subr.c.
9458 * Changes should be kept in sync.
9459 */
9460 static int
9462 {
9473 /* count number of components in the path */
9479 }
9485 }
9489 }
9492 }
9495 }
9497 /*
9498 * There is a user-level copy of this routine in ref_subr.c.
9499 * Changes should be kept in sync.
9500 */
9501 static int
9503 {
9514 }
9516 /* count number of components to alloc buffer */
9521 }
9524 /* copy components into allocated buffer */
9531 }
9533 #define xdr_fs_locations4 xdr_fattr4_fs_locations
9535 fs_locations4 *
9537 {
9543 XDR xdr;
9546 /*
9547 * Check attrs to ensure it's a reparse point
9548 */
9552 /*
9553 * Look for an NFS record and get the type and data
9554 */
9558 /*
9559 * With the type and data, upcall to get the referral
9560 */
9572 err);
9574 }
9576 /*
9577 * We get an XDR'ed record back from the kderef call
9578 */
9587 }
9589 /*
9590 * Look at path to recover fs_root, ignoring the leading '/'
9591 */
9595 }
9599 {
9605 uint_t len;
9607 /* Get the referral */
9611 /* Deal with only the first location and first server */
9618 }
9620 /* Figure out size for "/net/" + host + /path/path/path + NULL */
9625 /* Allocate the symlink buffer and fill it */
9638 npaths++;
9640 }
9648 }
9650 /*
9651 * Check to see if we have a downrev Solaris client, so that we
9652 * can send it a symlink instead of a referral.
9653 */
9654 int
9656 {
9670 }