1 /* $NetBSD: nfs_syscalls.c,v 1.163 2021/06/04 10:44:58 hannken Exp $ */
2
3 /*
4 * Copyright (c) 1989, 1993
5 * The Regents of the University of California. All rights reserved.
6 *
7 * This code is derived from software contributed to Berkeley by
8 * Rick Macklem at The University of Guelph.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 * 3. Neither the name of the University nor the names of its contributors
19 * may be used to endorse or promote products derived from this software
20 * without specific prior written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 * SUCH DAMAGE.
33 *
34 * @(#)nfs_syscalls.c 8.5 (Berkeley) 3/30/95
35 */
36
37 #include <sys/cdefs.h>
38 __KERNEL_RCSID(0, "$NetBSD: nfs_syscalls.c,v 1.163 2021/06/04 10:44:58 hannken Exp $");
39
40 #include <sys/param.h>
41 #include <sys/systm.h>
42 #include <sys/kernel.h>
43 #include <sys/file.h>
44 #include <sys/stat.h>
45 #include <sys/vnode.h>
46 #include <sys/mount.h>
47 #include <sys/proc.h>
48 #include <sys/uio.h>
49 #include <sys/malloc.h>
50 #include <sys/kmem.h>
51 #include <sys/buf.h>
52 #include <sys/mbuf.h>
53 #include <sys/socket.h>
54 #include <sys/socketvar.h>
55 #include <sys/signalvar.h>
56 #include <sys/domain.h>
57 #include <sys/protosw.h>
58 #include <sys/namei.h>
59 #include <sys/syslog.h>
60 #include <sys/filedesc.h>
61 #include <sys/kthread.h>
62 #include <sys/kauth.h>
63 #include <sys/syscallargs.h>
64 #include <sys/cprng.h>
65 #include <sys/rbtree.h>
66
67 #include <netinet/in.h>
68 #include <netinet/tcp.h>
69 #include <nfs/xdr_subs.h>
70 #include <nfs/rpcv2.h>
71 #include <nfs/nfsproto.h>
72 #include <nfs/nfs.h>
73 #include <nfs/nfsm_subs.h>
74 #include <nfs/nfsrvcache.h>
75 #include <nfs/nfsmount.h>
76 #include <nfs/nfsnode.h>
77 #include <nfs/nfsrtt.h>
78 #include <nfs/nfs_var.h>
79
80 extern int32_t (*nfsrv3_procs[NFS_NPROCS])(struct nfsrv_descript *,
81 struct nfssvc_sock *,
82 struct lwp *, struct mbuf **);
83 extern int nfsrvw_procrastinate;
84 extern int nuidhash_max;
85
86 static int nfs_numnfsd = 0;
87 static struct nfsdrt nfsdrt;
88 kmutex_t nfsd_lock;
89 struct nfssvc_sockhead nfssvc_sockhead;
90 kcondvar_t nfsd_initcv;
91 struct nfssvc_sockhead nfssvc_sockpending;
92 struct nfsdidlehead nfsd_idle_head;
93
94 static rb_tree_t nfsd_tree;
95 static const rb_tree_ops_t nfsd_tree_ops;
96
97 int nfssvc_sockhead_flag;
98 int nfsd_head_flag;
99
100 struct nfssvc_sock *nfs_udpsock;
101 struct nfssvc_sock *nfs_udp6sock;
102
103 static struct nfssvc_sock *nfsrv_sockalloc(void);
104 static void nfsrv_sockfree(struct nfssvc_sock *);
105 static void nfsd_rt(int, struct nfsrv_descript *, int);
106 static int nfssvc_nfsd(struct nfssvc_copy_ops *, struct nfsd_srvargs *, void *,
107 struct lwp *);
108
109 static int nfsd_compare_nodes(void *, const void *, const void *);
110 static int nfsd_compare_key(void *, const void *, const void *);
111
112 static struct nfsd *nfsd_bake_cookie(struct nfsd *);
113 static void nfsd_toss_cookie(struct nfsd *);
114 static struct nfsd *nfsd_get(struct nfsd *);
115
116 static int nfssvc_addsock_in(struct nfsd_args *, const void *);
117 static int nfssvc_setexports_in(struct mountd_exports_list *, const void *);
118 static int nfssvc_nsd_in(struct nfsd_srvargs *, const void *);
119 static int nfssvc_nsd_out(void *, const struct nfsd_srvargs *);
120 static int nfssvc_exp_in(struct export_args *, const void *, size_t);
121
122 static const rb_tree_ops_t nfsd_tree_ops = {
123 .rbto_compare_nodes = nfsd_compare_nodes,
124 .rbto_compare_key = nfsd_compare_key,
125 .rbto_node_offset = offsetof(struct nfsd, nfsd_node),
126 };
127
128 static int
nfsd_compare_nodes(void * cookie,const void * va,const void * vb)129 nfsd_compare_nodes(void *cookie, const void *va, const void *vb)
130 {
131 const struct nfsd *na = va;
132 const struct nfsd *nb = vb;
133
134 if (na->nfsd_cookie < nb->nfsd_cookie)
135 return -1;
136 if (na->nfsd_cookie > nb->nfsd_cookie)
137 return +1;
138 return 0;
139 }
140
141 static int
nfsd_compare_key(void * cookie,const void * vn,const void * vk)142 nfsd_compare_key(void *cookie, const void *vn, const void *vk)
143 {
144 const struct nfsd *n = vn;
145 const uint32_t *k = vk;
146
147 if (n->nfsd_cookie < *k)
148 return -1;
149 if (n->nfsd_cookie > *k)
150 return +1;
151 return 0;
152 }
153
154 /*
155 * nfsd_bake_cookie(nfsd)
156 *
157 * Bake a cookie for nfsd, hang it on the tree of nfsds, and
158 * return a userland-safe pointer nfsdu neatly packed for
159 * transport in struct nfsd_srvargs::nsd_nfsd.
160 */
161 static struct nfsd *
nfsd_bake_cookie(struct nfsd * nfsd)162 nfsd_bake_cookie(struct nfsd *nfsd)
163 {
164
165 KASSERT(mutex_owned(&nfsd_lock));
166
167 do {
168 nfsd->nfsd_cookie = cprng_fast32();
169 } while (nfsd->nfsd_cookie == 0 ||
170 rb_tree_insert_node(&nfsd_tree, nfsd) != nfsd);
171
172 return (struct nfsd *)(uintptr_t)nfsd->nfsd_cookie;
173 }
174
175 /*
176 * nfsd_toss_cookie(nfsd)
177 *
178 * Toss nfsd's cookie.
179 */
180 static void
nfsd_toss_cookie(struct nfsd * nfsd)181 nfsd_toss_cookie(struct nfsd *nfsd)
182 {
183
184 KASSERT(mutex_owned(&nfsd_lock));
185 KASSERT(nfsd->nfsd_cookie != 0);
186
187 rb_tree_remove_node(&nfsd_tree, nfsd);
188 nfsd->nfsd_cookie = 0; /* paranoia */
189 }
190
191 /*
192 * nfsd_get(nfsdu)
193 *
194 * Return the struct nfsd pointer for the userland nfsdu cookie,
195 * as stored in struct nfsd_srvargs::nsd_nfsd, or NULL if nfsdu is
196 * not a current valid nfsd cookie.
197 *
198 * Caller MUST NOT hold nfsd_lock. Caller MUST NOT pass (struct
199 * nfsd *)(uintptr_t)0, which is the sentinel value for no nfsd
200 * cookie, for which the caller should check first.
201 */
202 static struct nfsd *
nfsd_get(struct nfsd * nfsdu)203 nfsd_get(struct nfsd *nfsdu)
204 {
205 uintptr_t cookie = (uintptr_t)nfsdu;
206 uint32_t key;
207 struct nfsd *nfsd;
208
209 KASSERT(cookie != 0);
210 if (cookie > UINT32_MAX)
211 return NULL;
212 key = cookie;
213
214 mutex_enter(&nfsd_lock);
215 nfsd = rb_tree_find_node(&nfsd_tree, &key);
216 mutex_exit(&nfsd_lock);
217
218 return nfsd;
219 }
220
221 static int
nfssvc_addsock_in(struct nfsd_args * nfsdarg,const void * argp)222 nfssvc_addsock_in(struct nfsd_args *nfsdarg, const void *argp)
223 {
224
225 return copyin(argp, nfsdarg, sizeof *nfsdarg);
226 }
227
228 static int
nfssvc_setexports_in(struct mountd_exports_list * mel,const void * argp)229 nfssvc_setexports_in(struct mountd_exports_list *mel, const void *argp)
230 {
231
232 return copyin(argp, mel, sizeof *mel);
233 }
234
235 static int
nfssvc_nsd_in(struct nfsd_srvargs * nsd,const void * argp)236 nfssvc_nsd_in(struct nfsd_srvargs *nsd, const void *argp)
237 {
238
239 return copyin(argp, nsd, sizeof *nsd);
240 }
241
242 static int
nfssvc_nsd_out(void * argp,const struct nfsd_srvargs * nsd)243 nfssvc_nsd_out(void *argp, const struct nfsd_srvargs *nsd)
244 {
245
246 return copyout(nsd, argp, sizeof *nsd);
247 }
248
249 static int
nfssvc_exp_in(struct export_args * exp,const void * argp,size_t nexports)250 nfssvc_exp_in(struct export_args *exp, const void *argp, size_t nexports)
251 {
252
253 return copyin(argp, exp, sizeof(*exp) * nexports);
254 }
255
256 /*
257 * NFS server system calls
258 */
259
260 static struct nfssvc_copy_ops native_ops = {
261 .addsock_in = nfssvc_addsock_in,
262 .setexports_in = nfssvc_setexports_in,
263 .nsd_in = nfssvc_nsd_in,
264 .nsd_out = nfssvc_nsd_out,
265 .exp_in = nfssvc_exp_in,
266 };
267
268 /*
269 * Nfs server pseudo system call for the nfsd's
270 * Based on the flag value it either:
271 * - adds a socket to the selection list
272 * - remains in the kernel as an nfsd
273 * - remains in the kernel as an nfsiod
274 */
275
276 int
sys_nfssvc(struct lwp * l,const struct sys_nfssvc_args * uap,register_t * retval)277 sys_nfssvc(struct lwp *l, const struct sys_nfssvc_args *uap, register_t *retval)
278 {
279 /* {
280 syscallarg(int) flag;
281 syscallarg(void *) argp;
282 } */
283 int flag = SCARG(uap, flag);
284 void *argp = SCARG(uap, argp);
285
286 return do_nfssvc(&native_ops, l, flag, argp, retval);
287 }
288
289 int
do_nfssvc(struct nfssvc_copy_ops * ops,struct lwp * l,int flag,void * argp,register_t * retval)290 do_nfssvc(struct nfssvc_copy_ops *ops, struct lwp *l, int flag, void *argp, register_t *retval)
291 {
292 int error;
293 file_t *fp;
294 struct mbuf *nam;
295 struct nfsd_args nfsdarg;
296 struct nfsd_srvargs nfsd_srvargs, *nsd = &nfsd_srvargs;
297 struct nfsd *nfsd = NULL;
298 struct nfssvc_sock *slp;
299 struct nfsuid *nuidp;
300
301 error = kauth_authorize_network(l->l_cred, KAUTH_NETWORK_NFS,
302 KAUTH_REQ_NETWORK_NFS_SVC, NULL, NULL, NULL);
303 if (error)
304 return (error);
305
306 mutex_enter(&nfsd_lock);
307 while (nfssvc_sockhead_flag & SLP_INIT) {
308 cv_wait(&nfsd_initcv, &nfsd_lock);
309 }
310 mutex_exit(&nfsd_lock);
311
312 if (flag & NFSSVC_BIOD) {
313 /* Dummy implementation of nfsios for 1.4 and earlier. */
314 error = kpause("nfsbiod", true, 0, NULL);
315 } else if (flag & NFSSVC_MNTD) {
316 error = ENOSYS;
317 } else if (flag & NFSSVC_ADDSOCK) {
318 error = ops->addsock_in(&nfsdarg, argp);
319 if (error)
320 return (error);
321 /* getsock() will use the descriptor for us */
322 if ((fp = fd_getfile(nfsdarg.sock)) == NULL)
323 return (EBADF);
324 if (fp->f_type != DTYPE_SOCKET) {
325 fd_putfile(nfsdarg.sock);
326 return (ENOTSOCK);
327 }
328 /*
329 * Get the client address for connected sockets.
330 */
331 if (nfsdarg.name == NULL || nfsdarg.namelen == 0)
332 nam = (struct mbuf *)0;
333 else {
334 error = sockargs(&nam, nfsdarg.name, nfsdarg.namelen,
335 UIO_USERSPACE, MT_SONAME);
336 if (error) {
337 fd_putfile(nfsdarg.sock);
338 return (error);
339 }
340 }
341 error = nfssvc_addsock(fp, nam);
342 fd_putfile(nfsdarg.sock);
343 } else if (flag & (NFSSVC_SETEXPORTSLIST | NFSSVC_REPLACEEXPORTSLIST)) {
344 struct export_args *args;
345 struct mountd_exports_list mel;
346
347 error = ops->setexports_in(&mel, argp);
348 if (error != 0)
349 return error;
350
351 args = (struct export_args *)malloc(mel.mel_nexports *
352 sizeof(struct export_args), M_TEMP, M_WAITOK);
353 error = ops->exp_in(args, mel.mel_exports, mel.mel_nexports);
354 if (error != 0) {
355 free(args, M_TEMP);
356 return error;
357 }
358 mel.mel_exports = args;
359
360 error = mountd_set_exports_list(&mel, l, NULL,
361 flag & (NFSSVC_SETEXPORTSLIST | NFSSVC_REPLACEEXPORTSLIST));
362
363 free(args, M_TEMP);
364 } else {
365 error = ops->nsd_in(nsd, argp);
366 if (error)
367 return (error);
368 if ((uintptr_t)nsd->nsd_nfsd != 0 &&
369 (nfsd = nfsd_get(nsd->nsd_nfsd)) == NULL)
370 return (EINVAL);
371 if ((flag & NFSSVC_AUTHIN) &&
372 nfsd != NULL &&
373 (nfsd->nfsd_slp->ns_flags & SLP_VALID)) {
374 slp = nfsd->nfsd_slp;
375
376 /*
377 * First check to see if another nfsd has already
378 * added this credential.
379 */
380 LIST_FOREACH(nuidp, NUIDHASH(slp, nsd->nsd_cr.cr_uid),
381 nu_hash) {
382 if (kauth_cred_geteuid(nuidp->nu_cr) ==
383 nsd->nsd_cr.cr_uid &&
384 (!nfsd->nfsd_nd->nd_nam2 ||
385 netaddr_match(NU_NETFAM(nuidp),
386 &nuidp->nu_haddr, nfsd->nfsd_nd->nd_nam2)))
387 break;
388 }
389 if (nuidp) {
390 kauth_cred_hold(nuidp->nu_cr);
391 nfsd->nfsd_nd->nd_cr = nuidp->nu_cr;
392 nfsd->nfsd_nd->nd_flag |= ND_KERBFULL;
393 } else {
394 /*
395 * Nope, so we will.
396 */
397 if (slp->ns_numuids < nuidhash_max) {
398 slp->ns_numuids++;
399 nuidp = kmem_alloc(sizeof(*nuidp), KM_SLEEP);
400 } else
401 nuidp = (struct nfsuid *)0;
402 if ((slp->ns_flags & SLP_VALID) == 0) {
403 if (nuidp)
404 kmem_free(nuidp, sizeof(*nuidp));
405 } else {
406 if (nuidp == (struct nfsuid *)0) {
407 nuidp = TAILQ_FIRST(&slp->ns_uidlruhead);
408 LIST_REMOVE(nuidp, nu_hash);
409 TAILQ_REMOVE(&slp->ns_uidlruhead, nuidp,
410 nu_lru);
411 if (nuidp->nu_flag & NU_NAM)
412 m_freem(nuidp->nu_nam);
413 }
414 nuidp->nu_flag = 0;
415 kauth_uucred_to_cred(nuidp->nu_cr,
416 &nsd->nsd_cr);
417 nuidp->nu_timestamp = nsd->nsd_timestamp;
418 nuidp->nu_expire = time_second + nsd->nsd_ttl;
419 /*
420 * and save the session key in nu_key.
421 */
422 memcpy(nuidp->nu_key, nsd->nsd_key,
423 sizeof(nsd->nsd_key));
424 if (nfsd->nfsd_nd->nd_nam2) {
425 struct sockaddr_in *saddr;
426
427 saddr = mtod(nfsd->nfsd_nd->nd_nam2,
428 struct sockaddr_in *);
429 switch (saddr->sin_family) {
430 case AF_INET:
431 nuidp->nu_flag |= NU_INETADDR;
432 nuidp->nu_inetaddr =
433 saddr->sin_addr.s_addr;
434 break;
435 case AF_INET6:
436 nuidp->nu_flag |= NU_NAM;
437 nuidp->nu_nam = m_copym(
438 nfsd->nfsd_nd->nd_nam2, 0,
439 M_COPYALL, M_WAIT);
440 break;
441 default:
442 kmem_free(nuidp, sizeof(*nuidp));
443 return EAFNOSUPPORT;
444 };
445 }
446 TAILQ_INSERT_TAIL(&slp->ns_uidlruhead, nuidp,
447 nu_lru);
448 LIST_INSERT_HEAD(NUIDHASH(slp, nsd->nsd_uid),
449 nuidp, nu_hash);
450 kauth_cred_hold(nuidp->nu_cr);
451 nfsd->nfsd_nd->nd_cr = nuidp->nu_cr;
452 nfsd->nfsd_nd->nd_flag |= ND_KERBFULL;
453 }
454 }
455 }
456 if ((flag & NFSSVC_AUTHINFAIL) &&
457 nfsd != NULL)
458 nfsd->nfsd_flag |= NFSD_AUTHFAIL;
459 error = nfssvc_nfsd(ops, nsd, argp, l);
460 }
461 if (error == EINTR || error == ERESTART)
462 error = 0;
463 return (error);
464 }
465
466 static struct nfssvc_sock *
nfsrv_sockalloc(void)467 nfsrv_sockalloc(void)
468 {
469 struct nfssvc_sock *slp;
470
471 slp = kmem_alloc(sizeof(*slp), KM_SLEEP);
472 memset(slp, 0, sizeof (struct nfssvc_sock));
473 mutex_init(&slp->ns_lock, MUTEX_DRIVER, IPL_SOFTNET);
474 mutex_init(&slp->ns_alock, MUTEX_DRIVER, IPL_SOFTNET);
475 cv_init(&slp->ns_cv, "nfsdsock");
476 TAILQ_INIT(&slp->ns_uidlruhead);
477 LIST_INIT(&slp->ns_tq);
478 SIMPLEQ_INIT(&slp->ns_sendq);
479 mutex_enter(&nfsd_lock);
480 TAILQ_INSERT_TAIL(&nfssvc_sockhead, slp, ns_chain);
481 mutex_exit(&nfsd_lock);
482
483 return slp;
484 }
485
486 static void
nfsrv_sockfree(struct nfssvc_sock * slp)487 nfsrv_sockfree(struct nfssvc_sock *slp)
488 {
489
490 KASSERT(slp->ns_so == NULL);
491 KASSERT(slp->ns_fp == NULL);
492 KASSERT((slp->ns_flags & SLP_VALID) == 0);
493 mutex_destroy(&slp->ns_lock);
494 mutex_destroy(&slp->ns_alock);
495 cv_destroy(&slp->ns_cv);
496 kmem_free(slp, sizeof(*slp));
497 }
498
499 /*
500 * Adds a socket to the list for servicing by nfsds.
501 */
502 int
nfssvc_addsock(file_t * fp,struct mbuf * mynam)503 nfssvc_addsock(file_t *fp, struct mbuf *mynam)
504 {
505 int siz;
506 struct nfssvc_sock *slp;
507 struct socket *so;
508 struct nfssvc_sock *tslp;
509 int error;
510 int val;
511
512 so = fp->f_socket;
513 tslp = (struct nfssvc_sock *)0;
514 /*
515 * Add it to the list, as required.
516 */
517 if (so->so_proto->pr_protocol == IPPROTO_UDP) {
518 if (so->so_proto->pr_domain->dom_family == AF_INET6)
519 tslp = nfs_udp6sock;
520 else {
521 tslp = nfs_udpsock;
522 if (tslp->ns_flags & SLP_VALID) {
523 m_freem(mynam);
524 return (EPERM);
525 }
526 }
527 }
528 if (so->so_type == SOCK_STREAM)
529 siz = NFS_MAXPACKET + sizeof (u_long);
530 else
531 siz = NFS_MAXPACKET;
532 solock(so);
533 error = soreserve(so, siz, siz);
534 sounlock(so);
535 if (error) {
536 m_freem(mynam);
537 return (error);
538 }
539
540 /*
541 * Set protocol specific options { for now TCP only } and
542 * reserve some space. For datagram sockets, this can get called
543 * repeatedly for the same socket, but that isn't harmful.
544 */
545 if (so->so_type == SOCK_STREAM) {
546 val = 1;
547 so_setsockopt(NULL, so, SOL_SOCKET, SO_KEEPALIVE, &val,
548 sizeof(val));
549 }
550 if ((so->so_proto->pr_domain->dom_family == AF_INET ||
551 so->so_proto->pr_domain->dom_family == AF_INET6) &&
552 so->so_proto->pr_protocol == IPPROTO_TCP) {
553 val = 1;
554 so_setsockopt(NULL, so, IPPROTO_TCP, TCP_NODELAY, &val,
555 sizeof(val));
556 }
557 solock(so);
558 so->so_rcv.sb_flags &= ~SB_NOINTR;
559 so->so_rcv.sb_timeo = 0;
560 so->so_snd.sb_flags &= ~SB_NOINTR;
561 so->so_snd.sb_timeo = 0;
562 sounlock(so);
563 if (tslp) {
564 slp = tslp;
565 } else {
566 slp = nfsrv_sockalloc();
567 }
568 slp->ns_so = so;
569 slp->ns_nam = mynam;
570 mutex_enter(&fp->f_lock);
571 fp->f_count++;
572 mutex_exit(&fp->f_lock);
573 slp->ns_fp = fp;
574 slp->ns_flags = SLP_VALID;
575 slp->ns_aflags = SLP_A_NEEDQ;
576 slp->ns_gflags = 0;
577 slp->ns_sflags = 0;
578 solock(so);
579 so->so_upcallarg = (void *)slp;
580 so->so_upcall = nfsrv_soupcall;
581 so->so_rcv.sb_flags |= SB_UPCALL;
582 sounlock(so);
583 nfsrv_wakenfsd(slp);
584 return (0);
585 }
586
587 /*
588 * Called by nfssvc() for nfsds. Just loops around servicing rpc requests
589 * until it is killed by a signal.
590 */
591 static int
nfssvc_nfsd(struct nfssvc_copy_ops * ops,struct nfsd_srvargs * nsd,void * argp,struct lwp * l)592 nfssvc_nfsd(struct nfssvc_copy_ops *ops, struct nfsd_srvargs *nsd,
593 void *argp, struct lwp *l)
594 {
595 struct timeval tv;
596 struct mbuf *m;
597 struct nfssvc_sock *slp;
598 struct nfsd *nfsd;
599 struct nfsrv_descript *nd = NULL;
600 struct mbuf *mreq;
601 u_quad_t cur_usec;
602 int error = 0, cacherep, siz, sotype, writes_todo;
603 struct proc *p = l->l_proc;
604 bool doreinit;
605
606 #ifndef nolint
607 cacherep = RC_DOIT;
608 writes_todo = 0;
609 #endif
610 /*
611 * If userland didn't provide an nfsd cookie, bake a fresh one;
612 * if they did provide one, look it up.
613 */
614 if ((uintptr_t)nsd->nsd_nfsd == 0) {
615 nfsd = kmem_alloc(sizeof(*nfsd), KM_SLEEP);
616 memset(nfsd, 0, sizeof (struct nfsd));
617 cv_init(&nfsd->nfsd_cv, "nfsd");
618 nfsd->nfsd_procp = p;
619 mutex_enter(&nfsd_lock);
620 while ((nfssvc_sockhead_flag & SLP_INIT) != 0) {
621 KASSERT(nfs_numnfsd == 0);
622 cv_wait(&nfsd_initcv, &nfsd_lock);
623 }
624 nsd->nsd_nfsd = nfsd_bake_cookie(nfsd);
625 nfs_numnfsd++;
626 mutex_exit(&nfsd_lock);
627 } else if ((nfsd = nfsd_get(nsd->nsd_nfsd)) == NULL) {
628 return (EINVAL);
629 }
630 KASSERT(nfsd != NULL);
631 KASSERT(nsd->nsd_nfsd != (struct nfsd *)(uintptr_t)0);
632
633 /*
634 * Loop getting rpc requests until SIGKILL.
635 */
636 for (;;) {
637 bool dummy;
638
639 preempt_point();
640
641 if (nfsd->nfsd_slp == NULL) {
642 mutex_enter(&nfsd_lock);
643 while (nfsd->nfsd_slp == NULL &&
644 (nfsd_head_flag & NFSD_CHECKSLP) == 0) {
645 SLIST_INSERT_HEAD(&nfsd_idle_head, nfsd,
646 nfsd_idle);
647 error = cv_wait_sig(&nfsd->nfsd_cv, &nfsd_lock);
648 if (error) {
649 slp = nfsd->nfsd_slp;
650 nfsd->nfsd_slp = NULL;
651 if (!slp)
652 SLIST_REMOVE(&nfsd_idle_head,
653 nfsd, nfsd, nfsd_idle);
654 mutex_exit(&nfsd_lock);
655 if (slp) {
656 nfsrv_wakenfsd(slp);
657 nfsrv_slpderef(slp);
658 }
659 goto done;
660 }
661 }
662 if (nfsd->nfsd_slp == NULL &&
663 (nfsd_head_flag & NFSD_CHECKSLP) != 0) {
664 slp = TAILQ_FIRST(&nfssvc_sockpending);
665 if (slp) {
666 KASSERT((slp->ns_gflags & SLP_G_DOREC)
667 != 0);
668 TAILQ_REMOVE(&nfssvc_sockpending, slp,
669 ns_pending);
670 slp->ns_gflags &= ~SLP_G_DOREC;
671 slp->ns_sref++;
672 nfsd->nfsd_slp = slp;
673 } else
674 nfsd_head_flag &= ~NFSD_CHECKSLP;
675 }
676 KASSERT(nfsd->nfsd_slp == NULL ||
677 nfsd->nfsd_slp->ns_sref > 0);
678 mutex_exit(&nfsd_lock);
679 if ((slp = nfsd->nfsd_slp) == NULL)
680 continue;
681 if (slp->ns_flags & SLP_VALID) {
682 bool more;
683
684 if (nfsdsock_testbits(slp, SLP_A_NEEDQ)) {
685 nfsrv_rcv(slp);
686 }
687 if (nfsdsock_testbits(slp, SLP_A_DISCONN)) {
688 nfsrv_zapsock(slp);
689 }
690 error = nfsrv_dorec(slp, nfsd, &nd, &more);
691 getmicrotime(&tv);
692 cur_usec = (u_quad_t)tv.tv_sec * 1000000 +
693 (u_quad_t)tv.tv_usec;
694 writes_todo = 0;
695 if (error) {
696 struct nfsrv_descript *nd2;
697
698 mutex_enter(&nfsd_lock);
699 nd2 = LIST_FIRST(&slp->ns_tq);
700 if (nd2 != NULL &&
701 nd2->nd_time <= cur_usec) {
702 error = 0;
703 cacherep = RC_DOIT;
704 writes_todo = 1;
705 }
706 mutex_exit(&nfsd_lock);
707 }
708 if (error == 0 && more) {
709 nfsrv_wakenfsd(slp);
710 }
711 }
712 } else {
713 error = 0;
714 slp = nfsd->nfsd_slp;
715 }
716 KASSERT(slp != NULL);
717 KASSERT(nfsd->nfsd_slp == slp);
718 if (error || (slp->ns_flags & SLP_VALID) == 0) {
719 if (nd) {
720 nfsdreq_free(nd);
721 nd = NULL;
722 }
723 nfsd->nfsd_slp = NULL;
724 nfsrv_slpderef(slp);
725 continue;
726 }
727 sotype = slp->ns_so->so_type;
728 if (nd) {
729 getmicrotime(&nd->nd_starttime);
730 if (nd->nd_nam2)
731 nd->nd_nam = nd->nd_nam2;
732 else
733 nd->nd_nam = slp->ns_nam;
734
735 /*
736 * Check to see if authorization is needed.
737 */
738 if (nfsd->nfsd_flag & NFSD_NEEDAUTH) {
739 nfsd->nfsd_flag &= ~NFSD_NEEDAUTH;
740 nsd->nsd_haddr = mtod(nd->nd_nam,
741 struct sockaddr_in *)->sin_addr.s_addr;
742 nsd->nsd_authlen = nfsd->nfsd_authlen;
743 nsd->nsd_verflen = nfsd->nfsd_verflen;
744 if (!copyout(nfsd->nfsd_authstr,
745 nsd->nsd_authstr, nfsd->nfsd_authlen) &&
746 !copyout(nfsd->nfsd_verfstr,
747 nsd->nsd_verfstr, nfsd->nfsd_verflen) &&
748 !ops->nsd_out(argp, nsd)) {
749 return (ENEEDAUTH);
750 }
751 cacherep = RC_DROPIT;
752 } else
753 cacherep = nfsrv_getcache(nd, slp, &mreq);
754
755 if (nfsd->nfsd_flag & NFSD_AUTHFAIL) {
756 nfsd->nfsd_flag &= ~NFSD_AUTHFAIL;
757 nd->nd_procnum = NFSPROC_NOOP;
758 nd->nd_repstat =
759 (NFSERR_AUTHERR | AUTH_TOOWEAK);
760 cacherep = RC_DOIT;
761 }
762 }
763
764 /*
765 * Loop to get all the write rpc relies that have been
766 * gathered together.
767 */
768 do {
769 switch (cacherep) {
770 case RC_DOIT:
771 mreq = NULL;
772 netexport_rdlock();
773 if (writes_todo || nd == NULL ||
774 (!(nd->nd_flag & ND_NFSV3) &&
775 nd->nd_procnum == NFSPROC_WRITE &&
776 nfsrvw_procrastinate > 0))
777 error = nfsrv_writegather(&nd, slp,
778 l, &mreq);
779 else
780 error =
781 (*(nfsrv3_procs[nd->nd_procnum]))
782 (nd, slp, l, &mreq);
783 netexport_rdunlock();
784 if (mreq == NULL) {
785 if (nd != NULL) {
786 if (nd->nd_nam2)
787 m_free(nd->nd_nam2);
788 }
789 break;
790 }
791 if (error) {
792 nfsstats.srv_errs++;
793 if (nd) {
794 nfsrv_updatecache(nd, false,
795 mreq);
796 if (nd->nd_nam2)
797 m_freem(nd->nd_nam2);
798 }
799 break;
800 }
801 if (nd) {
802 nfsstats.srvrpccnt[nd->nd_procnum]++;
803 nfsrv_updatecache(nd, true, mreq);
804 nd->nd_mrep = NULL;
805 }
806 /* FALLTHROUGH */
807 case RC_REPLY:
808 m = mreq;
809 siz = 0;
810 while (m) {
811 siz += m->m_len;
812 m = m->m_next;
813 }
814 if (siz <= 0 || siz > NFS_MAXPACKET) {
815 printf("mbuf siz=%d\n",siz);
816 panic("Bad nfs svc reply");
817 }
818 m = mreq;
819 m->m_pkthdr.len = siz;
820 m_reset_rcvif(m);
821 /*
822 * For stream protocols, prepend a Sun RPC
823 * Record Mark.
824 */
825 if (sotype == SOCK_STREAM) {
826 M_PREPEND(m, NFSX_UNSIGNED, M_WAIT);
827 *mtod(m, u_int32_t *) =
828 htonl(0x80000000 | siz);
829 }
830 if (nd) {
831 nd->nd_mreq = m;
832 if (nfsrtton) {
833 nfsd_rt(slp->ns_so->so_type, nd,
834 cacherep);
835 }
836 error = nfsdsock_sendreply(slp, nd);
837 nd = NULL;
838 }
839 if (error == EPIPE)
840 nfsrv_zapsock(slp);
841 if (error == EINTR || error == ERESTART) {
842 nfsd->nfsd_slp = NULL;
843 nfsrv_slpderef(slp);
844 goto done;
845 }
846 break;
847 case RC_DROPIT:
848 if (nd) {
849 if (nfsrtton)
850 nfsd_rt(sotype, nd, cacherep);
851 m_freem(nd->nd_mrep);
852 m_freem(nd->nd_nam2);
853 }
854 break;
855 }
856 if (nd) {
857 nfsdreq_free(nd);
858 nd = NULL;
859 }
860
861 /*
862 * Check to see if there are outstanding writes that
863 * need to be serviced.
864 */
865 getmicrotime(&tv);
866 cur_usec = (u_quad_t)tv.tv_sec * 1000000 +
867 (u_quad_t)tv.tv_usec;
868 mutex_enter(&nfsd_lock);
869 if (LIST_FIRST(&slp->ns_tq) &&
870 LIST_FIRST(&slp->ns_tq)->nd_time <= cur_usec) {
871 cacherep = RC_DOIT;
872 writes_todo = 1;
873 } else
874 writes_todo = 0;
875 mutex_exit(&nfsd_lock);
876 } while (writes_todo);
877 if (nfsrv_dorec(slp, nfsd, &nd, &dummy)) {
878 nfsd->nfsd_slp = NULL;
879 nfsrv_slpderef(slp);
880 }
881 }
882 done:
883 mutex_enter(&nfsd_lock);
884 nfsd_toss_cookie(nfsd);
885 doreinit = --nfs_numnfsd == 0;
886 if (doreinit)
887 nfssvc_sockhead_flag |= SLP_INIT;
888 mutex_exit(&nfsd_lock);
889 cv_destroy(&nfsd->nfsd_cv);
890 kmem_free(nfsd, sizeof(*nfsd));
891 KASSERT(nsd->nsd_nfsd != (struct nfsd *)(uintptr_t)0);
892 nsd->nsd_nfsd = (struct nfsd *)(uintptr_t)0;
893 if (doreinit)
894 nfsrv_init(true); /* Reinitialize everything */
895 return (error);
896 }
897
898 /*
899 * Shut down a socket associated with an nfssvc_sock structure.
900 * Should be called with the send lock set, if required.
901 * The trick here is to increment the sref at the start, so that the nfsds
902 * will stop using it and clear ns_flag at the end so that it will not be
903 * reassigned during cleanup.
904 *
905 * called at splsoftnet.
906 */
907 void
nfsrv_zapsock(struct nfssvc_sock * slp)908 nfsrv_zapsock(struct nfssvc_sock *slp)
909 {
910 struct nfsuid *nuidp, *nnuidp;
911 struct nfsrv_descript *nwp;
912 struct socket *so;
913 struct mbuf *m;
914
915 if (nfsdsock_drain(slp)) {
916 return;
917 }
918 mutex_enter(&nfsd_lock);
919 if (slp->ns_gflags & SLP_G_DOREC) {
920 TAILQ_REMOVE(&nfssvc_sockpending, slp, ns_pending);
921 slp->ns_gflags &= ~SLP_G_DOREC;
922 }
923 mutex_exit(&nfsd_lock);
924
925 so = slp->ns_so;
926 KASSERT(so != NULL);
927 solock(so);
928 so->so_upcall = NULL;
929 so->so_upcallarg = NULL;
930 so->so_rcv.sb_flags &= ~SB_UPCALL;
931 soshutdown(so, SHUT_RDWR);
932 sounlock(so);
933
934 m_freem(slp->ns_raw);
935 m = slp->ns_rec;
936 while (m != NULL) {
937 struct mbuf *n;
938
939 n = m->m_nextpkt;
940 m_freem(m);
941 m = n;
942 }
943 /* XXX what about freeing ns_frag ? */
944 for (nuidp = TAILQ_FIRST(&slp->ns_uidlruhead); nuidp != 0;
945 nuidp = nnuidp) {
946 nnuidp = TAILQ_NEXT(nuidp, nu_lru);
947 LIST_REMOVE(nuidp, nu_hash);
948 TAILQ_REMOVE(&slp->ns_uidlruhead, nuidp, nu_lru);
949 if (nuidp->nu_flag & NU_NAM)
950 m_freem(nuidp->nu_nam);
951 kmem_free(nuidp, sizeof(*nuidp));
952 }
953 mutex_enter(&nfsd_lock);
954 while ((nwp = LIST_FIRST(&slp->ns_tq)) != NULL) {
955 LIST_REMOVE(nwp, nd_tq);
956 mutex_exit(&nfsd_lock);
957 nfsdreq_free(nwp);
958 mutex_enter(&nfsd_lock);
959 }
960 mutex_exit(&nfsd_lock);
961 }
962
963 /*
964 * Derefence a server socket structure. If it has no more references and
965 * is no longer valid, you can throw it away.
966 */
967 void
nfsrv_slpderef(struct nfssvc_sock * slp)968 nfsrv_slpderef(struct nfssvc_sock *slp)
969 {
970 uint32_t ref;
971
972 mutex_enter(&nfsd_lock);
973 KASSERT(slp->ns_sref > 0);
974 ref = --slp->ns_sref;
975 if (ref == 0 && (slp->ns_flags & SLP_VALID) == 0) {
976 file_t *fp;
977
978 KASSERT((slp->ns_gflags & SLP_G_DOREC) == 0);
979 TAILQ_REMOVE(&nfssvc_sockhead, slp, ns_chain);
980 mutex_exit(&nfsd_lock);
981
982 fp = slp->ns_fp;
983 if (fp != NULL) {
984 slp->ns_fp = NULL;
985 KASSERT(fp != NULL);
986 KASSERT(fp->f_socket == slp->ns_so);
987 KASSERT(fp->f_count > 0);
988 closef(fp);
989 slp->ns_so = NULL;
990 }
991
992 if (slp->ns_nam)
993 m_free(slp->ns_nam);
994 nfsrv_sockfree(slp);
995 } else
996 mutex_exit(&nfsd_lock);
997 }
998
999 /*
1000 * Initialize the data structures for the server.
1001 * Handshake with any new nfsds starting up to avoid any chance of
1002 * corruption.
1003 */
1004 void
nfsrv_init(int terminating)1005 nfsrv_init(int terminating)
1006 {
1007 struct nfssvc_sock *slp;
1008
1009 if (!terminating) {
1010 mutex_init(&nfsd_lock, MUTEX_DRIVER, IPL_SOFTNET);
1011 cv_init(&nfsd_initcv, "nfsdinit");
1012 }
1013
1014 mutex_enter(&nfsd_lock);
1015 if (!terminating && (nfssvc_sockhead_flag & SLP_INIT) != 0)
1016 panic("nfsd init");
1017 nfssvc_sockhead_flag |= SLP_INIT;
1018
1019 if (terminating) {
1020 KASSERT(SLIST_EMPTY(&nfsd_idle_head));
1021 KASSERT(RB_TREE_MIN(&nfsd_tree) == NULL);
1022 while ((slp = TAILQ_FIRST(&nfssvc_sockhead)) != NULL) {
1023 mutex_exit(&nfsd_lock);
1024 KASSERT(slp->ns_sref == 0);
1025 slp->ns_sref++;
1026 nfsrv_zapsock(slp);
1027 nfsrv_slpderef(slp);
1028 mutex_enter(&nfsd_lock);
1029 }
1030 KASSERT(TAILQ_EMPTY(&nfssvc_sockpending));
1031 mutex_exit(&nfsd_lock);
1032 nfsrv_cleancache(); /* And clear out server cache */
1033 } else {
1034 mutex_exit(&nfsd_lock);
1035 nfs_pub.np_valid = 0;
1036 }
1037
1038 TAILQ_INIT(&nfssvc_sockhead);
1039 TAILQ_INIT(&nfssvc_sockpending);
1040
1041 rb_tree_init(&nfsd_tree, &nfsd_tree_ops);
1042 SLIST_INIT(&nfsd_idle_head);
1043 nfsd_head_flag &= ~NFSD_CHECKSLP;
1044
1045 nfs_udpsock = nfsrv_sockalloc();
1046 nfs_udp6sock = nfsrv_sockalloc();
1047
1048 mutex_enter(&nfsd_lock);
1049 nfssvc_sockhead_flag &= ~SLP_INIT;
1050 cv_broadcast(&nfsd_initcv);
1051 mutex_exit(&nfsd_lock);
1052 }
1053
1054 void
nfsrv_fini(void)1055 nfsrv_fini(void)
1056 {
1057
1058 nfsrv_init(true);
1059 cv_destroy(&nfsd_initcv);
1060 mutex_destroy(&nfsd_lock);
1061 }
1062
1063 /*
1064 * Add entries to the server monitor log.
1065 */
1066 static void
nfsd_rt(int sotype,struct nfsrv_descript * nd,int cacherep)1067 nfsd_rt(int sotype, struct nfsrv_descript *nd, int cacherep)
1068 {
1069 struct timeval tv;
1070 struct drt *rt;
1071
1072 rt = &nfsdrt.drt[nfsdrt.pos];
1073 if (cacherep == RC_DOIT)
1074 rt->flag = 0;
1075 else if (cacherep == RC_REPLY)
1076 rt->flag = DRT_CACHEREPLY;
1077 else
1078 rt->flag = DRT_CACHEDROP;
1079 if (sotype == SOCK_STREAM)
1080 rt->flag |= DRT_TCP;
1081 if (nd->nd_flag & ND_NFSV3)
1082 rt->flag |= DRT_NFSV3;
1083 rt->proc = nd->nd_procnum;
1084 if (mtod(nd->nd_nam, struct sockaddr *)->sa_family == AF_INET)
1085 rt->ipadr = mtod(nd->nd_nam, struct sockaddr_in *)->sin_addr.s_addr;
1086 else
1087 rt->ipadr = INADDR_ANY;
1088 getmicrotime(&tv);
1089 rt->resptime = ((tv.tv_sec - nd->nd_starttime.tv_sec) * 1000000) +
1090 (tv.tv_usec - nd->nd_starttime.tv_usec);
1091 rt->tstamp = tv;
1092 nfsdrt.pos = (nfsdrt.pos + 1) % NFSRTTLOGSIZ;
1093 }
1094