1/* $NetBSD: nfs_serv.c,v 1.172 2015/04/21 03:19:03 riastradh Exp $ */
2
3/*
4 * Copyright (c) 1989, 1993
5 * The Regents of the University of California. All rights reserved.
6 *
7 * This code is derived from software contributed to Berkeley by
8 * Rick Macklem at The University of Guelph.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 * 3. Neither the name of the University nor the names of its contributors
19 * may be used to endorse or promote products derived from this software
20 * without specific prior written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 * SUCH DAMAGE.
33 *
34 * @(#)nfs_serv.c 8.8 (Berkeley) 7/31/95
35 */
36
37/*
38 * nfs version 2 and 3 server calls to vnode ops
39 * - these routines generally have 3 phases
40 * 1 - break down and validate rpc request in mbuf list
41 * 2 - do the vnode ops for the request
42 * (surprisingly ?? many are very similar to syscalls in vfs_syscalls.c)
43 * 3 - build the rpc reply in an mbuf list
44 * nb:
45 * - do not mix the phases, since the nfsm_?? macros can return failures
46 * on a bad rpc or similar and do not do any vrele() or vput()'s
47 *
48 * - the nfsm_reply() macro generates an nfs rpc reply with the nfs
49 * error number iff error != 0 whereas
50 * returning an error from the server function implies a fatal error
51 * such as a badly constructed rpc request that should be dropped without
52 * a reply.
53 * For Version 3, nfsm_reply() does not return for the error case, since
54 * most version 3 rpcs return more than the status for error cases.
55 */
56
57#include <sys/cdefs.h>
58__KERNEL_RCSID(0, "$NetBSD: nfs_serv.c,v 1.172 2015/04/21 03:19:03 riastradh Exp $");
59
60#include <sys/param.h>
61#include <sys/systm.h>
62#include <sys/proc.h>
63#include <sys/file.h>
64#include <sys/namei.h>
65#include <sys/vnode.h>
66#include <sys/mount.h>
67#include <sys/socket.h>
68#include <sys/socketvar.h>
69#include <sys/mbuf.h>
70#include <sys/dirent.h>
71#include <sys/stat.h>
72#include <sys/kernel.h>
73#include <sys/hash.h>
74#include <sys/kauth.h>
75#include <sys/module.h>
76#include <sys/syscall.h>
77#include <sys/syscallargs.h>
78#include <sys/syscallvar.h>
79
80#include <uvm/uvm.h>
81
82#include <nfs/nfsproto.h>
83#include <nfs/rpcv2.h>
84#include <nfs/nfs.h>
85#include <nfs/xdr_subs.h>
86#include <nfs/nfsm_subs.h>
87#include <nfs/nfs_var.h>
88
89MODULE(MODULE_CLASS_MISC, nfsserver, "nfs");
90
91/* Global vars */
92extern u_int32_t nfs_xdrneg1;
93extern u_int32_t nfs_false, nfs_true;
94extern const enum vtype nv3tov_type[8];
95extern struct nfsstats nfsstats;
96extern const nfstype nfsv2_type[9];
97extern const nfstype nfsv3_type[9];
98int nfsrvw_procrastinate = NFS_GATHERDELAY * 1000;
99bool nfsd_use_loan = true; /* use page-loan for READ OP */
100
101#define nqsrv_getl(vp, rw) /* nothing */
102
103static const struct syscall_package nfsserver_syscalls[] = {
104 { SYS_nfssvc, 0, (sy_call_t *)sys_nfssvc },
105 { 0, 0, NULL },
106};
107
108static int
109nfsserver_modcmd(modcmd_t cmd, void *arg)
110{
111 extern struct vfs_hooks nfs_export_hooks; /* XXX */
112 int error;
113
114 switch (cmd) {
115 case MODULE_CMD_INIT:
116 error = syscall_establish(NULL, nfsserver_syscalls);
117 if (error != 0) {
118 return error;
119 }
120 nfs_init(); /* XXX for monolithic kernel */
121 netexport_init();
122 nfsrv_initcache(); /* Init the server request cache */
123 nfsrv_init(0); /* Init server data structures */
124 vfs_hooks_attach(&nfs_export_hooks);
125 nfs_timer_srvinit(nfsrv_timer);
126 return 0;
127 case MODULE_CMD_FINI:
128 error = syscall_disestablish(NULL, nfsserver_syscalls);
129 if (error != 0) {
130 return error;
131 }
132 /*
133 * Kill export list before detaching VFS hooks, so we
134 * we don't leak state due to a concurrent umount().
135 */
136 netexport_fini();
137 vfs_hooks_detach(&nfs_export_hooks);
138
139 /* Kill timer before server goes away. */
140 nfs_timer_srvfini();
141 nfsrv_fini();
142
143 /* Server uses server cache, so kill cache last. */
144 nfsrv_finicache();
145 nfs_fini();
146 return 0;
147 case MODULE_CMD_AUTOUNLOAD:
148 if (netexport_hasexports())
149 return EBUSY;
150 /*FALLTHROUGH*/
151 default:
152 return ENOTTY;
153 }
154}
155
156/*
157 * nfs v3 access service
158 */
159int
160nfsrv3_access(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
161{
162 struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
163 struct mbuf *nam = nfsd->nd_nam;
164 char *dpos = nfsd->nd_dpos;
165 kauth_cred_t cred = nfsd->nd_cr;
166 struct vnode *vp;
167 nfsrvfh_t nsfh;
168 u_int32_t *tl;
169 int32_t t1;
170 char *bpos;
171 int error = 0, rdonly, cache = 0, getret;
172 char *cp2;
173 struct mbuf *mb, *mreq __unused;
174 struct vattr va;
175 u_long inmode, testmode, outmode;
176 u_quad_t frev;
177
178 nfsm_srvmtofh(&nsfh);
179 nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
180 error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam, &rdonly,
181 (nfsd->nd_flag & ND_KERBAUTH), false);
182 if (error) {
183 nfsm_reply(NFSX_UNSIGNED);
184 nfsm_srvpostop_attr(1, (struct vattr *)0);
185 return (0);
186 }
187 inmode = fxdr_unsigned(u_int32_t, *tl);
188 outmode = 0;
189 if ((inmode & NFSV3ACCESS_READ) &&
190 nfsrv_access(vp, VREAD, cred, rdonly, lwp, 0) == 0)
191 outmode |= NFSV3ACCESS_READ;
192 if (vp->v_type != VDIR) {
193 testmode = inmode & (NFSV3ACCESS_MODIFY | NFSV3ACCESS_EXTEND);
194 if (testmode &&
195 nfsrv_access(vp, VWRITE, cred, rdonly, lwp, 0) == 0)
196 outmode |= testmode;
197 if ((inmode & NFSV3ACCESS_EXECUTE) &&
198 nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 0) == 0)
199 outmode |= NFSV3ACCESS_EXECUTE;
200 } else {
201 testmode = inmode & (NFSV3ACCESS_MODIFY | NFSV3ACCESS_EXTEND |
202 NFSV3ACCESS_DELETE);
203 if (testmode &&
204 nfsrv_access(vp, VWRITE, cred, rdonly, lwp, 0) == 0)
205 outmode |= testmode;
206 if ((inmode & NFSV3ACCESS_LOOKUP) &&
207 nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 0) == 0)
208 outmode |= NFSV3ACCESS_LOOKUP;
209 }
210 getret = VOP_GETATTR(vp, &va, cred);
211 vput(vp);
212 nfsm_reply(NFSX_POSTOPATTR(1) + NFSX_UNSIGNED);
213 nfsm_srvpostop_attr(getret, &va);
214 nfsm_build(tl, u_int32_t *, NFSX_UNSIGNED);
215 *tl = txdr_unsigned(outmode);
216 nfsm_srvdone;
217}
218
219/*
220 * nfs getattr service
221 */
222int
223nfsrv_getattr(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
224{
225 struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
226 struct mbuf *nam = nfsd->nd_nam;
227 char *dpos = nfsd->nd_dpos;
228 kauth_cred_t cred = nfsd->nd_cr;
229 struct nfs_fattr *fp;
230 struct vattr va;
231 struct vnode *vp;
232 nfsrvfh_t nsfh;
233 u_int32_t *tl;
234 int32_t t1;
235 char *bpos;
236 int error = 0, rdonly, cache = 0;
237 char *cp2;
238 struct mbuf *mb, *mreq __unused;
239 u_quad_t frev;
240
241 nfsm_srvmtofh(&nsfh);
242 error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam, &rdonly,
243 (nfsd->nd_flag & ND_KERBAUTH), false);
244 if (error) {
245 nfsm_reply(0);
246 return (0);
247 }
248 nqsrv_getl(vp, ND_READ);
249 error = VOP_GETATTR(vp, &va, cred);
250 vput(vp);
251 nfsm_reply(NFSX_FATTR(nfsd->nd_flag & ND_NFSV3));
252 if (error)
253 return (0);
254 nfsm_build(fp, struct nfs_fattr *, NFSX_FATTR(nfsd->nd_flag & ND_NFSV3));
255 nfsm_srvfillattr(&va, fp);
256 nfsm_srvdone;
257}
258
259/*
260 * nfs setattr service
261 */
262int
263nfsrv_setattr(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
264{
265 struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
266 struct mbuf *nam = nfsd->nd_nam;
267 char *dpos = nfsd->nd_dpos;
268 kauth_cred_t cred = nfsd->nd_cr;
269 struct vattr va, preat;
270 struct nfsv2_sattr *sp;
271 struct nfs_fattr *fp;
272 struct vnode *vp;
273 nfsrvfh_t nsfh;
274 u_int32_t *tl;
275 int32_t t1;
276 char *bpos;
277 int error = 0, rdonly, cache = 0, preat_ret = 1, postat_ret = 1;
278 int v3 = (nfsd->nd_flag & ND_NFSV3), gcheck = 0;
279 char *cp2;
280 struct mbuf *mb, *mreq __unused;
281 u_quad_t frev;
282 struct timespec guard;
283
284 memset(&guard, 0, sizeof guard); /* XXX gcc */
285
286 nfsm_srvmtofh(&nsfh);
287 vattr_null(&va);
288 if (v3) {
289 nfsm_srvsattr(&va);
290 nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
291 gcheck = fxdr_unsigned(int, *tl);
292 if (gcheck) {
293 nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
294 fxdr_nfsv3time(tl, &guard);
295 }
296 } else {
297 nfsm_dissect(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
298 /*
299 * Nah nah nah nah na nah
300 * There is a bug in the Sun client that puts 0xffff in the mode
301 * field of sattr when it should put in 0xffffffff. The u_short
302 * doesn't sign extend.
303 * --> check the low order 2 bytes for 0xffff
304 */
305 if ((fxdr_unsigned(int, sp->sa_mode) & 0xffff) != 0xffff)
306 va.va_mode = nfstov_mode(sp->sa_mode);
307 if (sp->sa_uid != nfs_xdrneg1)
308 va.va_uid = fxdr_unsigned(uid_t, sp->sa_uid);
309 if (sp->sa_gid != nfs_xdrneg1)
310 va.va_gid = fxdr_unsigned(gid_t, sp->sa_gid);
311 if (sp->sa_size != nfs_xdrneg1)
312 va.va_size = fxdr_unsigned(u_quad_t, sp->sa_size);
313 if (sp->sa_atime.nfsv2_sec != nfs_xdrneg1) {
314#ifdef notyet
315 fxdr_nfsv2time(&sp->sa_atime, &va.va_atime);
316#else
317 va.va_atime.tv_sec =
318 fxdr_unsigned(u_int32_t,sp->sa_atime.nfsv2_sec);
319 va.va_atime.tv_nsec = 0;
320#endif
321 }
322 if (sp->sa_mtime.nfsv2_sec != nfs_xdrneg1)
323 fxdr_nfsv2time(&sp->sa_mtime, &va.va_mtime);
324
325 }
326
327 /*
328 * Now that we have all the fields, lets do it.
329 */
330 error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam, &rdonly,
331 (nfsd->nd_flag & ND_KERBAUTH), false);
332 if (error) {
333 nfsm_reply(2 * NFSX_UNSIGNED);
334 nfsm_srvwcc_data(preat_ret, &preat, postat_ret, &va);
335 return (0);
336 }
337 nqsrv_getl(vp, ND_WRITE);
338 if (v3) {
339 error = preat_ret = VOP_GETATTR(vp, &preat, cred);
340 if (!error && gcheck &&
341 (preat.va_ctime.tv_sec != guard.tv_sec ||
342 preat.va_ctime.tv_nsec != guard.tv_nsec))
343 error = NFSERR_NOT_SYNC;
344 if (error) {
345 vput(vp);
346 nfsm_reply(NFSX_WCCDATA(v3));
347 nfsm_srvwcc_data(preat_ret, &preat, postat_ret, &va);
348 return (0);
349 }
350 }
351
352 /*
353 * If the size is being changed write acces is required, otherwise
354 * just check for a read only file system.
355 */
356 if (va.va_size == ((u_quad_t)((quad_t) -1))) {
357 if (rdonly || (vp->v_mount->mnt_flag & MNT_RDONLY)) {
358 error = EROFS;
359 goto out;
360 }
361 } else {
362 if (vp->v_type == VDIR) {
363 error = EISDIR;
364 goto out;
365 } else if ((error = nfsrv_access(vp, VWRITE, cred, rdonly,
366 lwp, 0)) != 0)
367 goto out;
368 }
369 error = VOP_SETATTR(vp, &va, cred);
370 postat_ret = VOP_GETATTR(vp, &va, cred);
371 if (!error)
372 error = postat_ret;
373out:
374 vput(vp);
375 nfsm_reply(NFSX_WCCORFATTR(v3));
376 if (v3) {
377 nfsm_srvwcc_data(preat_ret, &preat, postat_ret, &va);
378 return (0);
379 } else {
380 nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
381 nfsm_srvfillattr(&va, fp);
382 }
383 nfsm_srvdone;
384}
385
386/*
387 * nfs lookup rpc
388 */
389int
390nfsrv_lookup(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
391{
392 struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
393 struct mbuf *nam = nfsd->nd_nam;
394 char *dpos = nfsd->nd_dpos;
395 kauth_cred_t cred = nfsd->nd_cr;
396 struct nfs_fattr *fp;
397 struct nameidata nd, ind, *ndp = &nd;
398 struct pathbuf *ipb = NULL;
399 struct vnode *vp, *dirp;
400 nfsrvfh_t nsfh;
401 char *cp;
402 u_int32_t *tl;
403 int32_t t1;
404 char *bpos;
405 int error = 0, cache = 0, dirattr_ret = 1;
406 uint32_t len;
407 int v3 = (nfsd->nd_flag & ND_NFSV3), pubflag;
408 char *cp2;
409 struct mbuf *mb, *mreq __unused;
410 struct vattr va, dirattr;
411 u_quad_t frev;
412
413 nfsm_srvmtofh(&nsfh);
414 nfsm_srvnamesiz(len);
415
416 pubflag = nfs_ispublicfh(&nsfh);
417
418 nd.ni_cnd.cn_cred = cred;
419 nd.ni_cnd.cn_nameiop = LOOKUP;
420 nd.ni_cnd.cn_flags = LOCKLEAF;
421 error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
422 &dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), pubflag);
423
424 if (!error && pubflag) {
425 if (nd.ni_vp->v_type == VDIR && nfs_pub.np_index != NULL &&
426 (ipb = pathbuf_create(nfs_pub.np_index)) != NULL) {
427 /*
428 * Setup call to lookup() to see if we can find
429 * the index file. Arguably, this doesn't belong
430 * in a kernel.. Ugh.
431 */
432 ind = nd;
433 VOP_UNLOCK(nd.ni_vp);
434 ind.ni_pathbuf = ipb;
435
436 error = lookup_for_nfsd_index(&ind, nd.ni_vp);
437 if (!error) {
438 /*
439 * Found an index file. Get rid of
440 * the old references.
441 */
442 if (dirp)
443 vrele(dirp);
444 dirp = nd.ni_vp;
445 ndp = &ind;
446 } else
447 error = 0;
448 }
449 /*
450 * If the public filehandle was used, check that this lookup
451 * didn't result in a filehandle outside the publicly exported
452 * filesystem.
453 */
454
455 if (!error && ndp->ni_vp->v_mount != nfs_pub.np_mount) {
456 vput(nd.ni_vp);
457 error = EPERM;
458 }
459 }
460
461 if (error) {
462 if (nd.ni_pathbuf != NULL) {
463 pathbuf_destroy(nd.ni_pathbuf);
464 }
465 if (ipb != NULL) {
466 pathbuf_destroy(ipb);
467 }
468 if (dirp) {
469 if (v3) {
470 vn_lock(dirp, LK_SHARED | LK_RETRY);
471 dirattr_ret = VOP_GETATTR(dirp, &dirattr, cred);
472 vput(dirp);
473 } else
474 vrele(dirp);
475 }
476 nfsm_reply(NFSX_POSTOPATTR(v3));
477 nfsm_srvpostop_attr(dirattr_ret, &dirattr);
478 return (0);
479 }
480
481 nqsrv_getl(ndp->ni_startdir, ND_READ);
482 pathbuf_destroy(nd.ni_pathbuf);
483 if (ipb != NULL) {
484 pathbuf_destroy(ipb);
485 }
486 vp = ndp->ni_vp;
487 error = nfsrv_composefh(vp, &nsfh, v3);
488 if (!error)
489 error = VOP_GETATTR(vp, &va, cred);
490 vput(vp);
491 if (dirp) {
492 if (v3) {
493 vn_lock(dirp, LK_SHARED | LK_RETRY);
494 dirattr_ret = VOP_GETATTR(dirp, &dirattr, cred);
495 vput(dirp);
496 } else
497 vrele(dirp);
498 }
499 nfsm_reply(NFSX_SRVFH(&nsfh, v3) + NFSX_POSTOPORFATTR(v3) +
500 NFSX_POSTOPATTR(v3));
501 if (error) {
502 nfsm_srvpostop_attr(dirattr_ret, &dirattr);
503 return (0);
504 }
505 nfsm_srvfhtom(&nsfh, v3);
506 if (v3) {
507 nfsm_srvpostop_attr(0, &va);
508 nfsm_srvpostop_attr(dirattr_ret, &dirattr);
509 } else {
510 nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
511 nfsm_srvfillattr(&va, fp);
512 }
513 nfsm_srvdone;
514}
515
516/*
517 * nfs readlink service
518 */
519int
520nfsrv_readlink(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
521{
522 struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
523 struct mbuf *nam = nfsd->nd_nam;
524 char *dpos = nfsd->nd_dpos;
525 kauth_cred_t cred = nfsd->nd_cr;
526 struct iovec iv[(NFS_MAXPATHLEN+MLEN-1)/MLEN];
527 struct iovec *ivp = iv;
528 struct mbuf *mp;
529 u_int32_t *tl;
530 int32_t t1;
531 char *bpos;
532 int error = 0, rdonly, cache = 0, i, padlen, getret;
533 uint32_t len;
534 int v3 = (nfsd->nd_flag & ND_NFSV3);
535 char *cp2;
536 struct mbuf *mb, *mp2 = NULL, *mp3 = NULL, *mreq __unused;
537 struct vnode *vp;
538 struct vattr attr;
539 nfsrvfh_t nsfh;
540 struct uio io, *uiop = &io;
541 u_quad_t frev;
542
543 nfsm_srvmtofh(&nsfh);
544 len = 0;
545 i = 0;
546 while (len < NFS_MAXPATHLEN) {
547 mp = m_get(M_WAIT, MT_DATA);
548 MCLAIM(mp, &nfs_mowner);
549 m_clget(mp, M_WAIT);
550 mp->m_len = NFSMSIZ(mp);
551 if (len == 0)
552 mp3 = mp2 = mp;
553 else {
554 mp2->m_next = mp;
555 mp2 = mp;
556 }
557 if ((len+mp->m_len) > NFS_MAXPATHLEN) {
558 mp->m_len = NFS_MAXPATHLEN-len;
559 len = NFS_MAXPATHLEN;
560 } else
561 len += mp->m_len;
562 ivp->iov_base = mtod(mp, void *);
563 ivp->iov_len = mp->m_len;
564 i++;
565 ivp++;
566 }
567 uiop->uio_iov = iv;
568 uiop->uio_iovcnt = i;
569 uiop->uio_offset = 0;
570 uiop->uio_resid = len;
571 uiop->uio_rw = UIO_READ;
572 UIO_SETUP_SYSSPACE(uiop);
573 error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
574 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
575 if (error) {
576 m_freem(mp3);
577 nfsm_reply(2 * NFSX_UNSIGNED);
578 nfsm_srvpostop_attr(1, (struct vattr *)0);
579 return (0);
580 }
581 if (vp->v_type != VLNK) {
582 if (v3)
583 error = EINVAL;
584 else
585 error = ENXIO;
586 goto out;
587 }
588 nqsrv_getl(vp, ND_READ);
589 error = VOP_READLINK(vp, uiop, cred);
590out:
591 getret = VOP_GETATTR(vp, &attr, cred);
592 vput(vp);
593 if (error)
594 m_freem(mp3);
595 nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_UNSIGNED);
596 if (v3) {
597 nfsm_srvpostop_attr(getret, &attr);
598 if (error)
599 return (0);
600 }
601 len -= uiop->uio_resid;
602 padlen = nfsm_padlen(len);
603 if (uiop->uio_resid || padlen)
604 nfs_zeropad(mp3, uiop->uio_resid, padlen);
605 nfsm_build(tl, u_int32_t *, NFSX_UNSIGNED);
606 *tl = txdr_unsigned(len);
607 mb->m_next = mp3;
608 nfsm_srvdone;
609}
610
611/*
612 * nfs read service
613 */
614int
615nfsrv_read(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
616{
617 struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
618 struct mbuf *nam = nfsd->nd_nam;
619 char *dpos = nfsd->nd_dpos;
620 kauth_cred_t cred = nfsd->nd_cr;
621 struct mbuf *m;
622 struct nfs_fattr *fp;
623 u_int32_t *tl;
624 int32_t t1;
625 int i;
626 char *bpos;
627 int error = 0, rdonly, cache = 0, getret;
628 int v3 = (nfsd->nd_flag & ND_NFSV3);
629 uint32_t reqlen, len, cnt, left;
630 int padlen;
631 char *cp2;
632 struct mbuf *mb, *mreq;
633 struct vnode *vp;
634 nfsrvfh_t nsfh;
635 struct uio io, *uiop = &io;
636 struct vattr va;
637 off_t off;
638 u_quad_t frev;
639
640 nfsm_srvmtofh(&nsfh);
641 if (v3) {
642 nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
643 off = fxdr_hyper(tl);
644 } else {
645 nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
646 off = (off_t)fxdr_unsigned(u_int32_t, *tl);
647 }
648 nfsm_dissect(tl, uint32_t *, NFSX_UNSIGNED);
649 reqlen = fxdr_unsigned(uint32_t, *tl);
650 reqlen = MIN(reqlen, NFS_SRVMAXDATA(nfsd));
651 error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
652 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
653 if (error) {
654 nfsm_reply(2 * NFSX_UNSIGNED);
655 nfsm_srvpostop_attr(1, (struct vattr *)0);
656 return (0);
657 }
658 if (vp->v_type != VREG) {
659 if (v3)
660 error = EINVAL;
661 else
662 error = (vp->v_type == VDIR) ? EISDIR : EACCES;
663 }
664 if (!error) {
665 nqsrv_getl(vp, ND_READ);
666 if ((error = nfsrv_access(vp, VREAD, cred, rdonly, lwp, 1)) != 0)
667 error = nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 1);
668 }
669 getret = VOP_GETATTR(vp, &va, cred);
670 if (!error)
671 error = getret;
672 if (error) {
673 vput(vp);
674 nfsm_reply(NFSX_POSTOPATTR(v3));
675 nfsm_srvpostop_attr(getret, &va);
676 return (0);
677 }
678 if (off >= va.va_size)
679 cnt = 0;
680 else if ((off + reqlen) > va.va_size)
681 cnt = va.va_size - off;
682 else
683 cnt = reqlen;
684 nfsm_reply(NFSX_POSTOPORFATTR(v3) + 3 * NFSX_UNSIGNED+nfsm_rndup(cnt));
685 if (v3) {
686 nfsm_build(tl, u_int32_t *, NFSX_V3FATTR + 4 * NFSX_UNSIGNED);
687 *tl++ = nfs_true;
688 fp = (struct nfs_fattr *)tl;
689 tl += (NFSX_V3FATTR / sizeof (u_int32_t));
690 } else {
691 nfsm_build(tl, u_int32_t *, NFSX_V2FATTR + NFSX_UNSIGNED);
692 fp = (struct nfs_fattr *)tl;
693 tl += (NFSX_V2FATTR / sizeof (u_int32_t));
694 }
695 len = left = cnt;
696 if (cnt > 0) {
697 if (nfsd_use_loan) {
698 struct vm_page **pgpp;
699 voff_t pgoff = trunc_page(off);
700 int npages;
701 vaddr_t lva;
702
703 npages = (round_page(off + cnt) - pgoff) >> PAGE_SHIFT;
704 KASSERT(npages <= M_EXT_MAXPAGES); /* XXX */
705
706 /* allocate kva for mbuf data */
707 lva = sokvaalloc(pgoff, npages << PAGE_SHIFT,
708 slp->ns_so);
709 if (lva == 0) {
710 /* fall back to VOP_READ */
711 goto loan_fail;
712 }
713
714 /* allocate mbuf */
715 m = m_get(M_WAIT, MT_DATA);
716 MCLAIM(m, &nfs_mowner);
717 pgpp = m->m_ext.ext_pgs;
718
719 /* loan pages */
720 error = uvm_loanuobjpages(&vp->v_uobj, pgoff, npages,
721 pgpp);
722 if (error) {
723 sokvafree(lva, npages << PAGE_SHIFT);
724 m_free(m);
725 if (error == EBUSY)
726 goto loan_fail;
727 goto read_error;
728 }
729
730 /* associate kva to mbuf */
731 MEXTADD(m, (void *)(lva + ((vaddr_t)off & PAGE_MASK)),
732 cnt, M_MBUF, soloanfree, slp->ns_so);
733 m->m_flags |= M_EXT_PAGES | M_EXT_ROMAP;
734 m->m_len = cnt;
735
736 /* map pages */
737 for (i = 0; i < npages; i++) {
738 pmap_kenter_pa(lva, VM_PAGE_TO_PHYS(pgpp[i]),
739 VM_PROT_READ, 0);
740 lva += PAGE_SIZE;
741 }
742
743 pmap_update(pmap_kernel());
744
745 mb->m_next = m;
746 mb = m;
747 error = 0;
748 uiop->uio_resid = 0;
749 } else {
750 struct iovec *iv;
751 struct iovec *iv2;
752 struct mbuf *m2;
753 int siz;
754loan_fail:
755 /*
756 * Generate the mbuf list with the uio_iov ref. to it.
757 */
758 i = 0;
759 m = m2 = mb;
760 while (left > 0) {
761 siz = min(M_TRAILINGSPACE(m), left);
762 if (siz > 0) {
763 left -= siz;
764 i++;
765 }
766 if (left > 0) {
767 m = m_get(M_WAIT, MT_DATA);
768 MCLAIM(m, &nfs_mowner);
769 m_clget(m, M_WAIT);
770 m->m_len = 0;
771 m2->m_next = m;
772 m2 = m;
773 }
774 }
775 iv = malloc(i * sizeof(struct iovec), M_TEMP, M_WAITOK);
776 uiop->uio_iov = iv2 = iv;
777 m = mb;
778 left = cnt;
779 i = 0;
780 while (left > 0) {
781 if (m == NULL)
782 panic("nfsrv_read iov");
783 siz = min(M_TRAILINGSPACE(m), left);
784 if (siz > 0) {
785 iv->iov_base = mtod(m, char *) +
786 m->m_len;
787 iv->iov_len = siz;
788 m->m_len += siz;
789 left -= siz;
790 iv++;
791 i++;
792 }
793 m = m->m_next;
794 }
795 uiop->uio_iovcnt = i;
796 uiop->uio_offset = off;
797 uiop->uio_resid = cnt;
798 uiop->uio_rw = UIO_READ;
799 UIO_SETUP_SYSSPACE(uiop);
800 error = VOP_READ(vp, uiop, IO_NODELOCKED, cred);
801 free((void *)iv2, M_TEMP);
802 }
803read_error:
804 if (error || (getret = VOP_GETATTR(vp, &va, cred)) != 0){
805 if (!error)
806 error = getret;
807 m_freem(mreq);
808 vput(vp);
809 nfsm_reply(NFSX_POSTOPATTR(v3));
810 nfsm_srvpostop_attr(getret, &va);
811 return (0);
812 }
813 } else {
814 uiop->uio_resid = 0;
815 }
816 vput(vp);
817 nfsm_srvfillattr(&va, fp);
818 len -= uiop->uio_resid;
819 padlen = nfsm_padlen(len);
820 if (uiop->uio_resid || padlen)
821 nfs_zeropad(mb, uiop->uio_resid, padlen);
822 if (v3) {
823 /* count */
824 *tl++ = txdr_unsigned(len);
825 /* eof */
826 if (off + len >= va.va_size)
827 *tl++ = nfs_true;
828 else
829 *tl++ = nfs_false;
830 }
831 *tl = txdr_unsigned(len);
832 nfsm_srvdone;
833}
834
835/*
836 * nfs write service
837 */
838int
839nfsrv_write(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
840{
841 struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
842 struct mbuf *nam = nfsd->nd_nam;
843 char *dpos = nfsd->nd_dpos;
844 kauth_cred_t cred = nfsd->nd_cr;
845 struct iovec *ivp;
846 int i, cnt;
847 struct mbuf *mp;
848 struct nfs_fattr *fp;
849 struct iovec *iv;
850 struct vattr va, forat;
851 u_int32_t *tl;
852 int32_t t1;
853 char *bpos;
854 int error = 0, rdonly, cache = 0, len, forat_ret = 1;
855 int ioflags, aftat_ret = 1, retlen, zeroing, adjust;
856 int stable = NFSV3WRITE_FILESYNC;
857 int v3 = (nfsd->nd_flag & ND_NFSV3);
858 char *cp2;
859 struct mbuf *mb, *mreq __unused;
860 struct vnode *vp;
861 nfsrvfh_t nsfh;
862 struct uio io, *uiop = &io;
863 off_t off;
864 u_quad_t frev;
865
866 if (mrep == NULL) {
867 *mrq = NULL;
868 return (0);
869 }
870 nfsm_srvmtofh(&nsfh);
871 if (v3) {
872 nfsm_dissect(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
873 off = fxdr_hyper(tl);
874 tl += 3;
875 stable = fxdr_unsigned(int, *tl++);
876 } else {
877 nfsm_dissect(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
878 off = (off_t)fxdr_unsigned(u_int32_t, *++tl);
879 tl += 2;
880 }
881 retlen = len = fxdr_unsigned(int32_t, *tl);
882 cnt = i = 0;
883
884 /*
885 * For NFS Version 2, it is not obvious what a write of zero length
886 * should do, but I might as well be consistent with Version 3,
887 * which is to return ok so long as there are no permission problems.
888 */
889 if (len > 0) {
890 zeroing = 1;
891 mp = mrep;
892 while (mp) {
893 if (mp == md) {
894 zeroing = 0;
895 adjust = dpos - mtod(mp, char *);
896 mp->m_len -= adjust;
897 if (mp->m_len > 0 && adjust > 0)
898 NFSMADV(mp, adjust);
899 }
900 if (zeroing)
901 mp->m_len = 0;
902 else if (mp->m_len > 0) {
903 i += mp->m_len;
904 if (i > len) {
905 mp->m_len -= (i - len);
906 zeroing = 1;
907 }
908 if (mp->m_len > 0)
909 cnt++;
910 }
911 mp = mp->m_next;
912 }
913 }
914 if (len > NFS_MAXDATA || len < 0 || i < len) {
915 error = EIO;
916 nfsm_reply(2 * NFSX_UNSIGNED);
917 nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
918 return (0);
919 }
920 error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
921 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
922 if (error) {
923 nfsm_reply(2 * NFSX_UNSIGNED);
924 nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
925 return (0);
926 }
927 if (v3)
928 forat_ret = VOP_GETATTR(vp, &forat, cred);
929 if (vp->v_type != VREG) {
930 if (v3)
931 error = EINVAL;
932 else
933 error = (vp->v_type == VDIR) ? EISDIR : EACCES;
934 }
935 if (!error) {
936 nqsrv_getl(vp, ND_WRITE);
937 error = nfsrv_access(vp, VWRITE, cred, rdonly, lwp, 1);
938 }
939 if (error) {
940 vput(vp);
941 nfsm_reply(NFSX_WCCDATA(v3));
942 nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
943 return (0);
944 }
945
946 if (len > 0) {
947 ivp = malloc(cnt * sizeof (struct iovec), M_TEMP, M_WAITOK);
948 uiop->uio_iov = iv = ivp;
949 uiop->uio_iovcnt = cnt;
950 mp = mrep;
951 while (mp) {
952 if (mp->m_len > 0) {
953 ivp->iov_base = mtod(mp, void *);
954 ivp->iov_len = mp->m_len;
955 ivp++;
956 }
957 mp = mp->m_next;
958 }
959
960 /*
961 * XXX
962 * The IO_METASYNC flag indicates that all metadata (and not
963 * just enough to ensure data integrity) must be written to
964 * stable storage synchronously.
965 * (IO_METASYNC is not yet implemented in 4.4BSD-Lite.)
966 */
967 if (stable == NFSV3WRITE_UNSTABLE)
968 ioflags = IO_NODELOCKED;
969 else if (stable == NFSV3WRITE_DATASYNC)
970 ioflags = (IO_SYNC | IO_NODELOCKED);
971 else
972 ioflags = (IO_METASYNC | IO_SYNC | IO_NODELOCKED);
973 uiop->uio_resid = len;
974 uiop->uio_rw = UIO_WRITE;
975 uiop->uio_offset = off;
976 UIO_SETUP_SYSSPACE(uiop);
977 error = VOP_WRITE(vp, uiop, ioflags, cred);
978 nfsstats.srvvop_writes++;
979 free(iv, M_TEMP);
980 }
981 aftat_ret = VOP_GETATTR(vp, &va, cred);
982 vput(vp);
983 if (!error)
984 error = aftat_ret;
985 nfsm_reply(NFSX_PREOPATTR(v3) + NFSX_POSTOPORFATTR(v3) +
986 2 * NFSX_UNSIGNED + NFSX_WRITEVERF(v3));
987 if (v3) {
988 nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
989 if (error)
990 return (0);
991 nfsm_build(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
992 *tl++ = txdr_unsigned(retlen);
993 if (stable == NFSV3WRITE_UNSTABLE)
994 *tl++ = txdr_unsigned(stable);
995 else
996 *tl++ = txdr_unsigned(NFSV3WRITE_FILESYNC);
997 /*
998 * Actually, there is no need to txdr these fields,
999 * but it may make the values more human readable,
1000 * for debugging purposes.
1001 */
1002 *tl++ = txdr_unsigned(boottime.tv_sec);
1003 *tl = txdr_unsigned(boottime.tv_nsec / 1000);
1004 } else {
1005 nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
1006 nfsm_srvfillattr(&va, fp);
1007 }
1008 nfsm_srvdone;
1009}
1010
1011/*
1012 * XXX elad: the original NFSW_SAMECRED() macro also made sure the
1013 * two nd_flag fields of the descriptors contained
1014 * ND_KERBAUTH.
1015 */
1016static int
1017nfsrv_samecred(kauth_cred_t cred1, kauth_cred_t cred2)
1018{
1019 int i, do_ngroups;
1020
1021 if (kauth_cred_geteuid(cred1) != kauth_cred_geteuid(cred2))
1022 return (0);
1023 if (kauth_cred_ngroups(cred1) != kauth_cred_ngroups(cred2))
1024 return (0);
1025 do_ngroups = kauth_cred_ngroups(cred1);
1026 for (i = 0; i < do_ngroups; i++)
1027 if (kauth_cred_group(cred1, i) !=
1028 kauth_cred_group(cred2, i))
1029 return (0);
1030
1031 return (1);
1032}
1033
1034static struct nfsrvw_delayhash *
1035nfsrv_nwdelayhash(struct nfssvc_sock *slp, const nfsrvfh_t *nsfh)
1036{
1037 uint32_t hash;
1038
1039 hash = hash32_buf(NFSRVFH_DATA(nsfh), NFSRVFH_SIZE(nsfh),
1040 HASH32_BUF_INIT);
1041 return &slp->ns_wdelayhashtbl[hash % NFS_WDELAYHASHSIZ];
1042}
1043
1044/*
1045 * NFS write service with write gathering support. Called when
1046 * nfsrvw_procrastinate > 0.
1047 * See: Chet Juszczak, "Improving the Write Performance of an NFS Server",
1048 * in Proc. of the Winter 1994 Usenix Conference, pg. 247-259, San Franscisco,
1049 * Jan. 1994.
1050 */
1051int
1052nfsrv_writegather(struct nfsrv_descript **ndp, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
1053{
1054 struct timeval now;
1055 struct iovec *ivp;
1056 struct mbuf *mp;
1057 struct nfsrv_descript *wp, *nfsd, *owp, *swp;
1058 struct nfs_fattr *fp;
1059 int i = 0;
1060 struct iovec *iov;
1061 struct nfsrvw_delayhash *wpp;
1062 kauth_cred_t cred;
1063 struct vattr va, forat;
1064 u_int32_t *tl;
1065 int32_t t1;
1066 char *bpos, *dpos;
1067 int error = 0, rdonly, cache = 0, len = 0, forat_ret = 1;
1068 int ioflags, aftat_ret = 1, adjust, v3, zeroing;
1069 char *cp2;
1070 struct mbuf *mb, *mreq, *mrep, *md;
1071 struct vnode *vp;
1072 struct uio io, *uiop = &io;
1073 u_quad_t frev, cur_usec;
1074
1075 *mrq = NULL;
1076 if (*ndp) {
1077 nfsd = *ndp;
1078 *ndp = NULL;
1079 mrep = nfsd->nd_mrep;
1080 md = nfsd->nd_md;
1081 dpos = nfsd->nd_dpos;
1082 cred = nfsd->nd_cr;
1083 v3 = (nfsd->nd_flag & ND_NFSV3);
1084 LIST_INIT(&nfsd->nd_coalesce);
1085 nfsd->nd_mreq = NULL;
1086 nfsd->nd_stable = NFSV3WRITE_FILESYNC;
1087 getmicrotime(&now);
1088 cur_usec = (u_quad_t)now.tv_sec * 1000000 + (u_quad_t)now.tv_usec;
1089 nfsd->nd_time = cur_usec + nfsrvw_procrastinate;
1090
1091 /*
1092 * Now, get the write header..
1093 */
1094 nfsm_srvmtofh(&nfsd->nd_fh);
1095 if (v3) {
1096 nfsm_dissect(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
1097 nfsd->nd_off = fxdr_hyper(tl);
1098 tl += 3;
1099 nfsd->nd_stable = fxdr_unsigned(int, *tl++);
1100 } else {
1101 nfsm_dissect(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
1102 nfsd->nd_off = (off_t)fxdr_unsigned(u_int32_t, *++tl);
1103 tl += 2;
1104 }
1105 len = fxdr_unsigned(int32_t, *tl);
1106 nfsd->nd_len = len;
1107 nfsd->nd_eoff = nfsd->nd_off + len;
1108
1109 /*
1110 * Trim the header out of the mbuf list and trim off any trailing
1111 * junk so that the mbuf list has only the write data.
1112 */
1113 zeroing = 1;
1114 i = 0;
1115 mp = mrep;
1116 while (mp) {
1117 if (mp == md) {
1118 zeroing = 0;
1119 adjust = dpos - mtod(mp, char *);
1120 mp->m_len -= adjust;
1121 if (mp->m_len > 0 && adjust > 0)
1122 NFSMADV(mp, adjust);
1123 }
1124 if (zeroing)
1125 mp->m_len = 0;
1126 else {
1127 i += mp->m_len;
1128 if (i > len) {
1129 mp->m_len -= (i - len);
1130 zeroing = 1;
1131 }
1132 }
1133 mp = mp->m_next;
1134 }
1135 if (len > NFS_MAXDATA || len < 0 || i < len) {
1136nfsmout:
1137 m_freem(mrep);
1138 error = EIO;
1139 nfsm_writereply(2 * NFSX_UNSIGNED, v3);
1140 if (v3)
1141 nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
1142 nfsd->nd_mreq = mreq;
1143 nfsd->nd_mrep = NULL;
1144 nfsd->nd_time = 0;
1145 }
1146
1147 /*
1148 * Add this entry to the hash and time queues.
1149 */
1150 owp = NULL;
1151 mutex_enter(&nfsd_lock);
1152 wp = LIST_FIRST(&slp->ns_tq);
1153 while (wp && wp->nd_time < nfsd->nd_time) {
1154 owp = wp;
1155 wp = LIST_NEXT(wp, nd_tq);
1156 }
1157 if (owp) {
1158 LIST_INSERT_AFTER(owp, nfsd, nd_tq);
1159 } else {
1160 LIST_INSERT_HEAD(&slp->ns_tq, nfsd, nd_tq);
1161 }
1162 if (nfsd->nd_mrep) {
1163 wpp = nfsrv_nwdelayhash(slp, &nfsd->nd_fh);
1164 owp = NULL;
1165 wp = LIST_FIRST(wpp);
1166 while (wp && nfsrv_comparefh(&nfsd->nd_fh, &wp->nd_fh)) {
1167 owp = wp;
1168 wp = LIST_NEXT(wp, nd_hash);
1169 }
1170 while (wp && wp->nd_off < nfsd->nd_off &&
1171 !nfsrv_comparefh(&nfsd->nd_fh, &wp->nd_fh)) {
1172 owp = wp;
1173 wp = LIST_NEXT(wp, nd_hash);
1174 }
1175 if (owp) {
1176 LIST_INSERT_AFTER(owp, nfsd, nd_hash);
1177
1178 /*
1179 * Search the hash list for overlapping entries and
1180 * coalesce.
1181 */
1182 for(; nfsd && NFSW_CONTIG(owp, nfsd); nfsd = wp) {
1183 wp = LIST_NEXT(nfsd, nd_hash);
1184 if (nfsrv_samecred(owp->nd_cr, nfsd->nd_cr))
1185 nfsrvw_coalesce(owp, nfsd);
1186 }
1187 } else {
1188 LIST_INSERT_HEAD(wpp, nfsd, nd_hash);
1189 }
1190 }
1191 mutex_exit(&nfsd_lock);
1192 }
1193
1194 /*
1195 * Now, do VOP_WRITE()s for any one(s) that need to be done now
1196 * and generate the associated reply mbuf list(s).
1197 */
1198loop1:
1199 getmicrotime(&now);
1200 cur_usec = (u_quad_t)now.tv_sec * 1000000 + (u_quad_t)now.tv_usec;
1201 mutex_enter(&nfsd_lock);
1202 for (nfsd = LIST_FIRST(&slp->ns_tq); nfsd; nfsd = owp) {
1203 owp = LIST_NEXT(nfsd, nd_tq);
1204 if (nfsd->nd_time > cur_usec)
1205 break;
1206 if (nfsd->nd_mreq)
1207 continue;
1208 LIST_REMOVE(nfsd, nd_tq);
1209 LIST_REMOVE(nfsd, nd_hash);
1210 mutex_exit(&nfsd_lock);
1211
1212 mrep = nfsd->nd_mrep;
1213 nfsd->nd_mrep = NULL;
1214 cred = nfsd->nd_cr;
1215 v3 = (nfsd->nd_flag & ND_NFSV3);
1216 forat_ret = aftat_ret = 1;
1217 error = nfsrv_fhtovp(&nfsd->nd_fh, 1, &vp, cred, slp,
1218 nfsd->nd_nam, &rdonly, (nfsd->nd_flag & ND_KERBAUTH),
1219 false);
1220 if (!error) {
1221 if (v3)
1222 forat_ret = VOP_GETATTR(vp, &forat, cred);
1223 if (vp->v_type != VREG) {
1224 if (v3)
1225 error = EINVAL;
1226 else
1227 error = (vp->v_type == VDIR) ? EISDIR : EACCES;
1228 }
1229 } else
1230 vp = NULL;
1231 if (!error) {
1232 nqsrv_getl(vp, ND_WRITE);
1233 error = nfsrv_access(vp, VWRITE, cred, rdonly, lwp, 1);
1234 }
1235
1236 if (nfsd->nd_stable == NFSV3WRITE_UNSTABLE)
1237 ioflags = IO_NODELOCKED;
1238 else if (nfsd->nd_stable == NFSV3WRITE_DATASYNC)
1239 ioflags = (IO_SYNC | IO_NODELOCKED);
1240 else
1241 ioflags = (IO_METASYNC | IO_SYNC | IO_NODELOCKED);
1242 uiop->uio_rw = UIO_WRITE;
1243 uiop->uio_offset = nfsd->nd_off;
1244 uiop->uio_resid = nfsd->nd_eoff - nfsd->nd_off;
1245 UIO_SETUP_SYSSPACE(uiop);
1246 if (uiop->uio_resid > 0) {
1247 mp = mrep;
1248 i = 0;
1249 while (mp) {
1250 if (mp->m_len > 0)
1251 i++;
1252 mp = mp->m_next;
1253 }
1254 uiop->uio_iovcnt = i;
1255 iov = malloc(i * sizeof (struct iovec), M_TEMP, M_WAITOK);
1256 uiop->uio_iov = ivp = iov;
1257 mp = mrep;
1258 while (mp) {
1259 if (mp->m_len > 0) {
1260 ivp->iov_base = mtod(mp, void *);
1261 ivp->iov_len = mp->m_len;
1262 ivp++;
1263 }
1264 mp = mp->m_next;
1265 }
1266 if (!error) {
1267 error = VOP_WRITE(vp, uiop, ioflags, cred);
1268 nfsstats.srvvop_writes++;
1269 }
1270 free((void *)iov, M_TEMP);
1271 }
1272 m_freem(mrep);
1273 if (vp) {
1274 aftat_ret = VOP_GETATTR(vp, &va, cred);
1275 vput(vp);
1276 }
1277
1278 /*
1279 * Loop around generating replies for all write rpcs that have
1280 * now been completed.
1281 */
1282 swp = nfsd;
1283 do {
1284 if (error) {
1285 nfsm_writereply(NFSX_WCCDATA(v3), v3);
1286 if (v3) {
1287 nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
1288 }
1289 } else {
1290 nfsm_writereply(NFSX_PREOPATTR(v3) +
1291 NFSX_POSTOPORFATTR(v3) + 2 * NFSX_UNSIGNED +
1292 NFSX_WRITEVERF(v3), v3);
1293 if (v3) {
1294 nfsm_srvwcc_data(forat_ret, &forat, aftat_ret, &va);
1295 nfsm_build(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
1296 *tl++ = txdr_unsigned(nfsd->nd_len);
1297 *tl++ = txdr_unsigned(swp->nd_stable);
1298 /*
1299 * Actually, there is no need to txdr these fields,
1300 * but it may make the values more human readable,
1301 * for debugging purposes.
1302 */
1303 *tl++ = txdr_unsigned(boottime.tv_sec);
1304 *tl = txdr_unsigned(boottime.tv_nsec / 1000);
1305 } else {
1306 nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
1307 nfsm_srvfillattr(&va, fp);
1308 }
1309 }
1310 nfsd->nd_mreq = mreq;
1311 if (nfsd->nd_mrep)
1312 panic("nfsrv_write: nd_mrep not free");
1313
1314 /*
1315 * Done. Put it at the head of the timer queue so that
1316 * the final phase can return the reply.
1317 */
1318 mutex_enter(&nfsd_lock);
1319 if (nfsd != swp) {
1320 nfsd->nd_time = 0;
1321 LIST_INSERT_HEAD(&slp->ns_tq, nfsd, nd_tq);
1322 }
1323 nfsd = LIST_FIRST(&swp->nd_coalesce);
1324 if (nfsd) {
1325 LIST_REMOVE(nfsd, nd_tq);
1326 }
1327 mutex_exit(&nfsd_lock);
1328 } while (nfsd);
1329 swp->nd_time = 0;
1330
1331 mutex_enter(&nfsd_lock);
1332 LIST_INSERT_HEAD(&slp->ns_tq, swp, nd_tq);
1333 mutex_exit(&nfsd_lock);
1334 goto loop1;
1335 }
1336 mutex_exit(&nfsd_lock);
1337 nfs_timer_start();
1338
1339 /*
1340 * Search for a reply to return.
1341 */
1342 mutex_enter(&nfsd_lock);
1343 LIST_FOREACH(nfsd, &slp->ns_tq, nd_tq) {
1344 if (nfsd->nd_mreq) {
1345 LIST_REMOVE(nfsd, nd_tq);
1346 *mrq = nfsd->nd_mreq;
1347 *ndp = nfsd;
1348 break;
1349 }
1350 }
1351 mutex_exit(&nfsd_lock);
1352 return (0);
1353}
1354
1355/*
1356 * Coalesce the write request nfsd into owp. To do this we must:
1357 * - remove nfsd from the queues
1358 * - merge nfsd->nd_mrep into owp->nd_mrep
1359 * - update the nd_eoff and nd_stable for owp
1360 * - put nfsd on owp's nd_coalesce list
1361 * NB: Must be called at splsoftclock().
1362 */
1363void
1364nfsrvw_coalesce(struct nfsrv_descript *owp, struct nfsrv_descript *nfsd)
1365{
1366 int overlap;
1367 struct mbuf *mp;
1368 struct nfsrv_descript *m;
1369
1370 KASSERT(mutex_owned(&nfsd_lock));
1371
1372 LIST_REMOVE(nfsd, nd_hash);
1373 LIST_REMOVE(nfsd, nd_tq);
1374 if (owp->nd_eoff < nfsd->nd_eoff) {
1375 overlap = owp->nd_eoff - nfsd->nd_off;
1376 if (overlap < 0)
1377 panic("nfsrv_coalesce: bad off");
1378 if (overlap > 0)
1379 m_adj(nfsd->nd_mrep, overlap);
1380 mp = owp->nd_mrep;
1381 while (mp->m_next)
1382 mp = mp->m_next;
1383 mp->m_next = nfsd->nd_mrep;
1384 owp->nd_eoff = nfsd->nd_eoff;
1385 } else
1386 m_freem(nfsd->nd_mrep);
1387 nfsd->nd_mrep = NULL;
1388 if (nfsd->nd_stable == NFSV3WRITE_FILESYNC)
1389 owp->nd_stable = NFSV3WRITE_FILESYNC;
1390 else if (nfsd->nd_stable == NFSV3WRITE_DATASYNC &&
1391 owp->nd_stable == NFSV3WRITE_UNSTABLE)
1392 owp->nd_stable = NFSV3WRITE_DATASYNC;
1393 LIST_INSERT_HEAD(&owp->nd_coalesce, nfsd, nd_tq);
1394 /*
1395 * nfsd might hold coalesce elements! Move them to owp.
1396 * Otherwise, requests may be lost and clients will be stuck.
1397 */
1398 while ((m = LIST_FIRST(&nfsd->nd_coalesce)) != NULL) {
1399 LIST_REMOVE(m, nd_tq);
1400 LIST_INSERT_HEAD(&owp->nd_coalesce, m, nd_tq);
1401 }
1402}
1403
1404/*
1405 * nfs create service
1406 * now does a truncate to 0 length via. setattr if it already exists
1407 */
1408int
1409nfsrv_create(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
1410{
1411 struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
1412 struct mbuf *nam = nfsd->nd_nam;
1413 char *dpos = nfsd->nd_dpos;
1414 kauth_cred_t cred = nfsd->nd_cr;
1415 struct nfs_fattr *fp;
1416 struct vattr va, dirfor, diraft;
1417 struct nfsv2_sattr *sp;
1418 u_int32_t *tl;
1419 struct nameidata nd;
1420 char *cp;
1421 int32_t t1;
1422 char *bpos;
1423 int error = 0, cache = 0, len, tsize, dirfor_ret = 1, diraft_ret = 1;
1424 int rdev = 0, abort = 0;
1425 int v3 = (nfsd->nd_flag & ND_NFSV3), how, exclusive_flag = 0;
1426 char *cp2;
1427 struct mbuf *mb, *mreq __unused;
1428 struct vnode *vp = NULL, *dirp = NULL;
1429 nfsrvfh_t nsfh;
1430 u_quad_t frev, tempsize;
1431 u_char cverf[NFSX_V3CREATEVERF];
1432
1433 nd.ni_cnd.cn_nameiop = 0;
1434 nfsm_srvmtofh(&nsfh);
1435 nfsm_srvnamesiz(len);
1436 nd.ni_cnd.cn_cred = cred;
1437 nd.ni_cnd.cn_nameiop = CREATE;
1438 nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF;
1439 error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
1440 &dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1441 if (dirp && v3) {
1442 dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
1443 }
1444 if (error) {
1445 nfsm_reply(NFSX_WCCDATA(v3));
1446 nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1447 if (dirp)
1448 vrele(dirp);
1449 if (nd.ni_pathbuf != NULL) {
1450 pathbuf_destroy(nd.ni_pathbuf);
1451 nd.ni_pathbuf = NULL;
1452 }
1453 return (0);
1454 }
1455 abort = 1;
1456 vattr_null(&va);
1457 if (v3) {
1458 va.va_mode = 0;
1459 nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
1460 how = fxdr_unsigned(int, *tl);
1461 switch (how) {
1462 case NFSV3CREATE_GUARDED:
1463 if (nd.ni_vp) {
1464 error = EEXIST;
1465 break;
1466 }
1467 case NFSV3CREATE_UNCHECKED:
1468 nfsm_srvsattr(&va);
1469 break;
1470 case NFSV3CREATE_EXCLUSIVE:
1471 nfsm_dissect(cp, void *, NFSX_V3CREATEVERF);
1472 memcpy(cverf, cp, NFSX_V3CREATEVERF);
1473 exclusive_flag = 1;
1474 break;
1475 };
1476 va.va_type = VREG;
1477 } else {
1478 nfsm_dissect(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
1479 va.va_type = IFTOVT(fxdr_unsigned(u_int32_t, sp->sa_mode));
1480 if (va.va_type == VNON)
1481 va.va_type = VREG;
1482 va.va_mode = nfstov_mode(sp->sa_mode);
1483 switch (va.va_type) {
1484 case VREG:
1485 tsize = fxdr_unsigned(int32_t, sp->sa_size);
1486 if (tsize != -1)
1487 va.va_size = (u_quad_t)tsize;
1488 break;
1489 case VCHR:
1490 case VBLK:
1491 case VFIFO:
1492 rdev = fxdr_unsigned(int32_t, sp->sa_size);
1493 break;
1494 default:
1495 break;
1496 };
1497 }
1498
1499 /*
1500 * Iff doesn't exist, create it
1501 * otherwise just truncate to 0 length
1502 * should I set the mode too ??
1503 */
1504 if (nd.ni_vp == NULL) {
1505 if (va.va_type == VREG || va.va_type == VSOCK) {
1506 nqsrv_getl(nd.ni_dvp, ND_WRITE);
1507 error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
1508 if (!error) {
1509 vn_lock(nd.ni_vp, LK_EXCLUSIVE | LK_RETRY);
1510 if (exclusive_flag) {
1511 exclusive_flag = 0;
1512 vattr_null(&va);
1513 /*
1514 * XXX
1515 * assuming NFSX_V3CREATEVERF
1516 * == sizeof(nfstime3)
1517 */
1518 fxdr_nfsv3time(cverf, &va.va_atime);
1519 error = VOP_SETATTR(nd.ni_vp, &va,
1520 cred);
1521 }
1522 }
1523 } else if (va.va_type == VCHR || va.va_type == VBLK ||
1524 va.va_type == VFIFO) {
1525 if (va.va_type == VCHR && rdev == 0xffffffff)
1526 va.va_type = VFIFO;
1527 if (va.va_type != VFIFO &&
1528 (error = kauth_authorize_system(cred,
1529 KAUTH_SYSTEM_MKNOD, 0, NULL, NULL, NULL))) {
1530 VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1531 vput(nd.ni_dvp);
1532 abort = 0;
1533 nfsm_reply(0);
1534 if (nd.ni_pathbuf != NULL) {
1535 pathbuf_destroy(nd.ni_pathbuf);
1536 nd.ni_pathbuf = NULL;
1537 }
1538 return (error);
1539 } else
1540 va.va_rdev = (dev_t)rdev;
1541 nqsrv_getl(nd.ni_dvp, ND_WRITE);
1542 error = VOP_MKNOD(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd,
1543 &va);
1544 if (!error) {
1545 vn_lock(nd.ni_vp, LK_EXCLUSIVE | LK_RETRY);
1546 } else {
1547 nfsm_reply(0);
1548 }
1549 } else {
1550 VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1551 if (nd.ni_pathbuf != NULL) {
1552 pathbuf_destroy(nd.ni_pathbuf);
1553 nd.ni_pathbuf = NULL;
1554 }
1555 error = ENXIO;
1556 abort = 0;
1557 }
1558 vp = nd.ni_vp;
1559 } else {
1560 VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1561 if (nd.ni_pathbuf != NULL) {
1562 pathbuf_destroy(nd.ni_pathbuf);
1563 nd.ni_pathbuf = NULL;
1564 }
1565 vp = nd.ni_vp;
1566 abort = 0;
1567 if (!error && va.va_size != -1) {
1568 error = nfsrv_access(vp, VWRITE, cred,
1569 (nd.ni_cnd.cn_flags & RDONLY), lwp, 0);
1570 if (!error) {
1571 nqsrv_getl(vp, ND_WRITE);
1572 tempsize = va.va_size;
1573 vattr_null(&va);
1574 va.va_size = tempsize;
1575 error = VOP_SETATTR(vp, &va, cred);
1576 }
1577 }
1578 if (error)
1579 vput(vp);
1580 }
1581 if (!error) {
1582 error = nfsrv_composefh(vp, &nsfh, v3);
1583 if (!error)
1584 error = VOP_GETATTR(vp, &va, cred);
1585 vput(vp);
1586 }
1587 if (nd.ni_dvp == vp)
1588 vrele(nd.ni_dvp);
1589 else
1590 vput(nd.ni_dvp);
1591 if (v3) {
1592 if (exclusive_flag && !error) {
1593 /*
1594 * XXX assuming NFSX_V3CREATEVERF == sizeof(nfstime3)
1595 */
1596 char oldverf[NFSX_V3CREATEVERF];
1597
1598 txdr_nfsv3time(&va.va_atime, oldverf);
1599 if (memcmp(cverf, oldverf, NFSX_V3CREATEVERF))
1600 error = EEXIST;
1601 }
1602 if (dirp) {
1603 vn_lock(dirp, LK_SHARED | LK_RETRY);
1604 diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
1605 VOP_UNLOCK(dirp);
1606 }
1607 }
1608 if (dirp) {
1609 vrele(dirp);
1610 dirp = NULL;
1611 }
1612 if (nd.ni_pathbuf != NULL) {
1613 pathbuf_destroy(nd.ni_pathbuf);
1614 nd.ni_pathbuf = NULL;
1615 }
1616 abort = 0;
1617 nfsm_reply(NFSX_SRVFH(&nsfh, v3) + NFSX_FATTR(v3) + NFSX_WCCDATA(v3));
1618 if (v3) {
1619 if (!error) {
1620 nfsm_srvpostop_fh(&nsfh);
1621 nfsm_srvpostop_attr(0, &va);
1622 }
1623 nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1624 } else {
1625 nfsm_srvfhtom(&nsfh, v3);
1626 nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
1627 nfsm_srvfillattr(&va, fp);
1628 }
1629 return (0);
1630nfsmout:
1631 if (dirp)
1632 vrele(dirp);
1633 if (abort) {
1634 VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1635 if (nd.ni_dvp == nd.ni_vp)
1636 vrele(nd.ni_dvp);
1637 else
1638 vput(nd.ni_dvp);
1639 if (nd.ni_vp)
1640 vput(nd.ni_vp);
1641 }
1642 if (nd.ni_pathbuf != NULL) {
1643 pathbuf_destroy(nd.ni_pathbuf);
1644 nd.ni_pathbuf = NULL;
1645 }
1646 return (error);
1647}
1648
1649/*
1650 * nfs v3 mknod service
1651 */
1652int
1653nfsrv_mknod(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
1654{
1655 struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
1656 struct mbuf *nam = nfsd->nd_nam;
1657 char *dpos = nfsd->nd_dpos;
1658 kauth_cred_t cred = nfsd->nd_cr;
1659 struct vattr va, dirfor, diraft;
1660 u_int32_t *tl;
1661 struct nameidata nd;
1662 int32_t t1;
1663 char *bpos;
1664 int error = 0, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
1665 int abort = 0;
1666 u_int32_t major, minor;
1667 enum vtype vtyp;
1668 char *cp2;
1669 struct mbuf *mb, *mreq __unused;
1670 struct vnode *vp, *dirp = (struct vnode *)0;
1671 nfsrvfh_t nsfh;
1672 u_quad_t frev;
1673
1674 nd.ni_cnd.cn_nameiop = 0;
1675 nfsm_srvmtofh(&nsfh);
1676 nfsm_srvnamesiz(len);
1677 nd.ni_cnd.cn_cred = cred;
1678 nd.ni_cnd.cn_nameiop = CREATE;
1679 nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF;
1680 error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
1681 &dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1682 if (dirp)
1683 dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
1684 if (error) {
1685 nfsm_reply(NFSX_WCCDATA(1));
1686 nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1687 if (dirp)
1688 vrele(dirp);
1689 if (nd.ni_pathbuf != NULL) {
1690 pathbuf_destroy(nd.ni_pathbuf);
1691 nd.ni_pathbuf = NULL;
1692 }
1693 return (0);
1694 }
1695 abort = 1;
1696 nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
1697 vtyp = nfsv3tov_type(*tl);
1698 if (vtyp != VCHR && vtyp != VBLK && vtyp != VSOCK && vtyp != VFIFO) {
1699 error = NFSERR_BADTYPE;
1700 goto abort;
1701 }
1702 vattr_null(&va);
1703 va.va_mode = 0;
1704 nfsm_srvsattr(&va);
1705 if (vtyp == VCHR || vtyp == VBLK) {
1706 dev_t rdev;
1707
1708 nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1709 major = fxdr_unsigned(u_int32_t, *tl++);
1710 minor = fxdr_unsigned(u_int32_t, *tl);
1711 rdev = makedev(major, minor);
1712 if (major(rdev) != major || minor(rdev) != minor) {
1713 error = EINVAL;
1714 goto abort;
1715 }
1716 va.va_rdev = rdev;
1717 }
1718
1719 /*
1720 * Iff doesn't exist, create it.
1721 */
1722 if (nd.ni_vp) {
1723 error = EEXIST;
1724abort:
1725 VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1726 if (nd.ni_vp)
1727 vput(nd.ni_vp);
1728 if (nd.ni_pathbuf != NULL) {
1729 pathbuf_destroy(nd.ni_pathbuf);
1730 nd.ni_pathbuf = NULL;
1731 }
1732 goto out;
1733 }
1734 va.va_type = vtyp;
1735 if (vtyp == VSOCK) {
1736 nqsrv_getl(nd.ni_dvp, ND_WRITE);
1737 error = VOP_CREATE(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
1738 } else {
1739 if (va.va_type != VFIFO &&
1740 (error = kauth_authorize_system(cred,
1741 KAUTH_SYSTEM_MKNOD, 0, NULL, NULL, NULL))) {
1742 VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1743 vput(nd.ni_dvp);
1744 goto out;
1745 }
1746 nqsrv_getl(nd.ni_dvp, ND_WRITE);
1747 error = VOP_MKNOD(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
1748 if (error)
1749 goto out;
1750 }
1751 if (!error) {
1752 vn_lock(nd.ni_vp, LK_EXCLUSIVE | LK_RETRY);
1753 }
1754out:
1755 vp = nd.ni_vp;
1756 if (!error) {
1757 error = nfsrv_composefh(vp, &nsfh, true);
1758 if (!error)
1759 error = VOP_GETATTR(vp, &va, cred);
1760 vput(vp);
1761 }
1762 if (nd.ni_dvp == nd.ni_vp)
1763 vrele(nd.ni_dvp);
1764 else
1765 vput(nd.ni_dvp);
1766 if (dirp) {
1767 vn_lock(dirp, LK_SHARED | LK_RETRY);
1768 diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
1769 VOP_UNLOCK(dirp);
1770 vrele(dirp);
1771 dirp = NULL;
1772 }
1773 if (nd.ni_pathbuf != NULL) {
1774 pathbuf_destroy(nd.ni_pathbuf);
1775 nd.ni_pathbuf = NULL;
1776 }
1777 abort = 0;
1778 nfsm_reply(NFSX_SRVFH(&nsfh, true) + NFSX_POSTOPATTR(1) +
1779 NFSX_WCCDATA(1));
1780 if (!error) {
1781 nfsm_srvpostop_fh(&nsfh);
1782 nfsm_srvpostop_attr(0, &va);
1783 }
1784 nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1785 return (0);
1786nfsmout:
1787 if (abort) {
1788 VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1789 if (nd.ni_dvp == nd.ni_vp)
1790 vrele(nd.ni_dvp);
1791 else
1792 vput(nd.ni_dvp);
1793 if (nd.ni_vp)
1794 vput(nd.ni_vp);
1795 }
1796 if (nd.ni_pathbuf != NULL) {
1797 pathbuf_destroy(nd.ni_pathbuf);
1798 nd.ni_pathbuf = NULL;
1799 }
1800 if (dirp)
1801 vrele(dirp);
1802 return (error);
1803}
1804
1805/*
1806 * nfs remove service
1807 */
1808int
1809nfsrv_remove(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
1810{
1811 struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
1812 struct mbuf *nam = nfsd->nd_nam;
1813 char *dpos = nfsd->nd_dpos;
1814 kauth_cred_t cred = nfsd->nd_cr;
1815 struct nameidata nd;
1816 u_int32_t *tl;
1817 int32_t t1;
1818 char *bpos;
1819 int error = 0, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
1820 int v3 = (nfsd->nd_flag & ND_NFSV3);
1821 char *cp2;
1822 struct mbuf *mb, *mreq __unused;
1823 struct vnode *vp, *dirp;
1824 struct vattr dirfor, diraft;
1825 nfsrvfh_t nsfh;
1826 u_quad_t frev;
1827
1828#ifndef nolint
1829 vp = (struct vnode *)0;
1830#endif
1831 nfsm_srvmtofh(&nsfh);
1832 nfsm_srvnamesiz(len);
1833 nd.ni_cnd.cn_cred = cred;
1834 nd.ni_cnd.cn_nameiop = DELETE;
1835 nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF;
1836 error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
1837 &dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1838 if (error == 0 && dirp && v3) {
1839 if (nd.ni_dvp == nd.ni_vp)
1840 vn_lock(dirp, LK_SHARED | LK_RETRY);
1841 dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
1842 if (nd.ni_dvp == nd.ni_vp)
1843 VOP_UNLOCK(dirp);
1844 }
1845 if (!error) {
1846 vp = nd.ni_vp;
1847 if (vp->v_type == VDIR) {
1848 error = EPERM;
1849 goto out;
1850 }
1851 /*
1852 * The root of a mounted filesystem cannot be deleted.
1853 */
1854 if (vp->v_vflag & VV_ROOT) {
1855 error = EBUSY;
1856 }
1857out:
1858 if (!error) {
1859 nqsrv_getl(nd.ni_dvp, ND_WRITE);
1860 nqsrv_getl(vp, ND_WRITE);
1861 error = VOP_REMOVE(nd.ni_dvp, nd.ni_vp, &nd.ni_cnd);
1862 } else {
1863 VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
1864 if (nd.ni_dvp == vp)
1865 vrele(nd.ni_dvp);
1866 else
1867 vput(nd.ni_dvp);
1868 vput(vp);
1869 }
1870 }
1871 if (nd.ni_pathbuf != NULL) {
1872 pathbuf_destroy(nd.ni_pathbuf);
1873 nd.ni_pathbuf = NULL;
1874 }
1875 if (dirp) {
1876 if (v3) {
1877 vn_lock(dirp, LK_SHARED | LK_RETRY);
1878 diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
1879 VOP_UNLOCK(dirp);
1880 }
1881 vrele(dirp);
1882 }
1883 nfsm_reply(NFSX_WCCDATA(v3));
1884 if (v3) {
1885 nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
1886 return (0);
1887 }
1888 nfsm_srvdone;
1889}
1890
1891/*
1892 * nfs rename service
1893 */
1894int
1895nfsrv_rename(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
1896{
1897 struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
1898 struct mbuf *nam = nfsd->nd_nam;
1899 char *dpos = nfsd->nd_dpos;
1900 kauth_cred_t cred = nfsd->nd_cr;
1901 u_int32_t *tl;
1902 int32_t t1;
1903 char *bpos;
1904 int error = 0, cache = 0, fdirfor_ret = 1, fdiraft_ret = 1;
1905 uint32_t len, len2;
1906 int tdirfor_ret = 1, tdiraft_ret = 1;
1907 int v3 = (nfsd->nd_flag & ND_NFSV3);
1908 char *cp2;
1909 struct mbuf *mb, *mreq __unused;
1910 struct nameidata fromnd, tond;
1911 struct vnode *fvp, *tvp, *tdvp;
1912 struct vnode *fdirp = NULL, *tdirp = NULL;
1913 struct mount *localfs = NULL;
1914 struct vattr fdirfor, fdiraft, tdirfor, tdiraft;
1915 nfsrvfh_t fnsfh, tnsfh;
1916 u_quad_t frev;
1917 uid_t saved_uid;
1918
1919#ifndef nolint
1920 fvp = (struct vnode *)0;
1921#endif
1922 fromnd.ni_cnd.cn_nameiop = 0;
1923 tond.ni_cnd.cn_nameiop = 0;
1924 nfsm_srvmtofh(&fnsfh);
1925 nfsm_srvnamesiz(len);
1926 /*
1927 * Remember our original uid so that we can reset cr_uid before
1928 * the second nfs_namei() call, in case it is remapped.
1929 */
1930 saved_uid = kauth_cred_geteuid(cred);
1931 fromnd.ni_cnd.cn_cred = cred;
1932 fromnd.ni_cnd.cn_nameiop = DELETE;
1933 fromnd.ni_cnd.cn_flags = LOCKPARENT;
1934 error = nfs_namei(&fromnd, &fnsfh, len, slp, nam, &md,
1935 &dpos, &fdirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
1936 if (error == 0 && fdirp && v3) {
1937 if (fromnd.ni_dvp == fromnd.ni_vp)
1938 vn_lock(fdirp, LK_SHARED | LK_RETRY);
1939 fdirfor_ret = VOP_GETATTR(fdirp, &fdirfor, cred);
1940 if (fromnd.ni_dvp == fromnd.ni_vp)
1941 VOP_UNLOCK(fdirp);
1942 }
1943 if (error) {
1944 fromnd.ni_cnd.cn_nameiop = 0;
1945 nfsm_reply(2 * NFSX_WCCDATA(v3));
1946 nfsm_srvwcc_data(fdirfor_ret, &fdirfor, fdiraft_ret, &fdiraft);
1947 nfsm_srvwcc_data(tdirfor_ret, &tdirfor, tdiraft_ret, &tdiraft);
1948 if (fdirp)
1949 vrele(fdirp);
1950 if (fromnd.ni_pathbuf != NULL) {
1951 pathbuf_destroy(fromnd.ni_pathbuf);
1952 }
1953 return (0);
1954 }
1955 if (fromnd.ni_dvp != fromnd.ni_vp) {
1956 VOP_UNLOCK(fromnd.ni_dvp);
1957 }
1958 fvp = fromnd.ni_vp;
1959
1960 localfs = fvp->v_mount;
1961 error = VFS_RENAMELOCK_ENTER(localfs);
1962 if (error) {
1963 VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
1964 vrele(fromnd.ni_dvp);
1965 vrele(fvp);
1966 goto out1;
1967 }
1968
1969 /* Copied, regrettably, from vfs_syscalls.c (q.v.) */
1970 vrele(fvp);
1971 if ((fromnd.ni_cnd.cn_namelen == 1 &&
1972 fromnd.ni_cnd.cn_nameptr[0] == '.') ||
1973 (fromnd.ni_cnd.cn_namelen == 2 &&
1974 fromnd.ni_cnd.cn_nameptr[0] == '.' &&
1975 fromnd.ni_cnd.cn_nameptr[1] == '.')) {
1976 error = EINVAL;
1977 VFS_RENAMELOCK_EXIT(localfs);
1978 VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
1979 vrele(fromnd.ni_dvp);
1980 goto out1;
1981 }
1982 vn_lock(fromnd.ni_dvp, LK_EXCLUSIVE | LK_RETRY);
1983 error = relookup(fromnd.ni_dvp, &fromnd.ni_vp, &fromnd.ni_cnd, 0);
1984 if (error) {
1985 VOP_UNLOCK(fromnd.ni_dvp);
1986 VFS_RENAMELOCK_EXIT(localfs);
1987 VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
1988 vrele(fromnd.ni_dvp);
1989 goto out1;
1990 }
1991 VOP_UNLOCK(fromnd.ni_vp);
1992 if (fromnd.ni_dvp != fromnd.ni_vp)
1993 VOP_UNLOCK(fromnd.ni_dvp);
1994 fvp = fromnd.ni_vp;
1995
1996 nfsm_srvmtofh(&tnsfh);
1997 if (v3) {
1998 nfsm_dissect(tl, uint32_t *, NFSX_UNSIGNED);
1999 len2 = fxdr_unsigned(uint32_t, *tl);
2000 /* len2 will be checked by nfs_namei */
2001 }
2002 else {
2003 /* NFSv2 */
2004 nfsm_strsiz(len2, NFS_MAXNAMLEN);
2005 }
2006 kauth_cred_seteuid(cred, saved_uid);
2007 tond.ni_cnd.cn_cred = cred;
2008 tond.ni_cnd.cn_nameiop = RENAME;
2009 tond.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF | NOCACHE;
2010 error = nfs_namei(&tond, &tnsfh, len2, slp, nam, &md,
2011 &dpos, &tdirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
2012 if (tdirp && v3) {
2013 tdirfor_ret = VOP_GETATTR(tdirp, &tdirfor, cred);
2014 }
2015 if (error) {
2016 VFS_RENAMELOCK_EXIT(localfs);
2017 VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
2018 vrele(fromnd.ni_dvp);
2019 vrele(fvp);
2020 goto out1;
2021 }
2022 tdvp = tond.ni_dvp;
2023 tvp = tond.ni_vp;
2024 if (tvp != NULL) {
2025 if (fvp->v_type == VDIR && tvp->v_type != VDIR) {
2026 if (v3)
2027 error = EEXIST;
2028 else
2029 error = EISDIR;
2030 goto out;
2031 } else if (fvp->v_type != VDIR && tvp->v_type == VDIR) {
2032 if (v3)
2033 error = EEXIST;
2034 else
2035 error = ENOTDIR;
2036 goto out;
2037 }
2038 if (tvp->v_type == VDIR && tvp->v_mountedhere) {
2039 if (v3)
2040 error = EXDEV;
2041 else
2042 error = ENOTEMPTY;
2043 goto out;
2044 }
2045 }
2046 if (fvp->v_type == VDIR && fvp->v_mountedhere) {
2047 if (v3)
2048 error = EXDEV;
2049 else
2050 error = ENOTEMPTY;
2051 goto out;
2052 }
2053 if (fvp->v_mount != tdvp->v_mount) {
2054 if (v3)
2055 error = EXDEV;
2056 else
2057 error = ENOTEMPTY;
2058 goto out;
2059 }
2060 if (fvp == tdvp) {
2061 if (v3)
2062 error = EINVAL;
2063 else
2064 error = ENOTEMPTY;
2065 }
2066 /*
2067 * If source is the same as the destination (that is the
2068 * same vnode with the same name in the same directory),
2069 * then there is nothing to do.
2070 */
2071 if (fvp == tvp && fromnd.ni_dvp == tdvp &&
2072 fromnd.ni_cnd.cn_namelen == tond.ni_cnd.cn_namelen &&
2073 !memcmp(fromnd.ni_cnd.cn_nameptr, tond.ni_cnd.cn_nameptr,
2074 fromnd.ni_cnd.cn_namelen))
2075 error = -1;
2076out:
2077 if (!error) {
2078 nqsrv_getl(fromnd.ni_dvp, ND_WRITE);
2079 nqsrv_getl(tdvp, ND_WRITE);
2080 if (tvp) {
2081 nqsrv_getl(tvp, ND_WRITE);
2082 }
2083 error = VOP_RENAME(fromnd.ni_dvp, fromnd.ni_vp, &fromnd.ni_cnd,
2084 tond.ni_dvp, tond.ni_vp, &tond.ni_cnd);
2085 VFS_RENAMELOCK_EXIT(localfs);
2086 } else {
2087 VOP_ABORTOP(tond.ni_dvp, &tond.ni_cnd);
2088 if (tdvp == tvp)
2089 vrele(tdvp);
2090 else
2091 vput(tdvp);
2092 if (tvp)
2093 vput(tvp);
2094 VFS_RENAMELOCK_EXIT(localfs);
2095 VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
2096 vrele(fromnd.ni_dvp);
2097 vrele(fvp);
2098 if (error == -1)
2099 error = 0;
2100 }
2101 if (tond.ni_pathbuf != NULL) {
2102 pathbuf_destroy(tond.ni_pathbuf);
2103 tond.ni_pathbuf = NULL;
2104 }
2105 tond.ni_cnd.cn_nameiop = 0;
2106out1:
2107 if (fdirp) {
2108 if (v3) {
2109 vn_lock(fdirp, LK_SHARED | LK_RETRY);
2110 fdiraft_ret = VOP_GETATTR(fdirp, &fdiraft, cred);
2111 VOP_UNLOCK(fdirp);
2112 }
2113 vrele(fdirp);
2114 fdirp = NULL;
2115 }
2116 if (tdirp) {
2117 if (v3) {
2118 vn_lock(tdirp, LK_SHARED | LK_RETRY);
2119 tdiraft_ret = VOP_GETATTR(tdirp, &tdiraft, cred);
2120 VOP_UNLOCK(tdirp);
2121 }
2122 vrele(tdirp);
2123 tdirp = NULL;
2124 }
2125 pathbuf_destroy(fromnd.ni_pathbuf);
2126 fromnd.ni_pathbuf = NULL;
2127 fromnd.ni_cnd.cn_nameiop = 0;
2128 localfs = NULL;
2129 nfsm_reply(2 * NFSX_WCCDATA(v3));
2130 if (v3) {
2131 nfsm_srvwcc_data(fdirfor_ret, &fdirfor, fdiraft_ret, &fdiraft);
2132 nfsm_srvwcc_data(tdirfor_ret, &tdirfor, tdiraft_ret, &tdiraft);
2133 }
2134 return (0);
2135
2136nfsmout:
2137 if (fdirp)
2138 vrele(fdirp);
2139#ifdef notdef
2140 if (tdirp)
2141 vrele(tdirp);
2142#endif
2143 if (tond.ni_cnd.cn_nameiop) {
2144 if (tond.ni_pathbuf != NULL) {
2145 pathbuf_destroy(tond.ni_pathbuf);
2146 tond.ni_pathbuf = NULL;
2147 }
2148 }
2149 if (localfs) {
2150 VFS_RENAMELOCK_EXIT(localfs);
2151 }
2152 if (fromnd.ni_cnd.cn_nameiop) {
2153 VOP_ABORTOP(fromnd.ni_dvp, &fromnd.ni_cnd);
2154 if (fromnd.ni_pathbuf != NULL) {
2155 pathbuf_destroy(fromnd.ni_pathbuf);
2156 fromnd.ni_pathbuf = NULL;
2157 }
2158 vrele(fromnd.ni_dvp);
2159 vrele(fvp);
2160 }
2161 return (error);
2162}
2163
2164/*
2165 * nfs link service
2166 */
2167int
2168nfsrv_link(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2169{
2170 struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2171 struct mbuf *nam = nfsd->nd_nam;
2172 char *dpos = nfsd->nd_dpos;
2173 kauth_cred_t cred = nfsd->nd_cr;
2174 struct nameidata nd;
2175 u_int32_t *tl;
2176 int32_t t1;
2177 char *bpos;
2178 int error = 0, rdonly, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
2179 int getret = 1, v3 = (nfsd->nd_flag & ND_NFSV3);
2180 char *cp2;
2181 struct mbuf *mb, *mreq __unused;
2182 struct vnode *vp, *xp, *dirp = (struct vnode *)0;
2183 struct vattr dirfor, diraft, at;
2184 nfsrvfh_t nsfh, dnsfh;
2185 u_quad_t frev;
2186
2187 nfsm_srvmtofh(&nsfh);
2188 nfsm_srvmtofh(&dnsfh);
2189 nfsm_srvnamesiz(len);
2190 error = nfsrv_fhtovp(&nsfh, false, &vp, cred, slp, nam,
2191 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
2192 if (error) {
2193 nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_WCCDATA(v3));
2194 nfsm_srvpostop_attr(getret, &at);
2195 nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2196 return (0);
2197 }
2198 if (vp->v_type == VDIR) {
2199 error = EPERM;
2200 goto out1;
2201 }
2202 nd.ni_cnd.cn_cred = cred;
2203 nd.ni_cnd.cn_nameiop = CREATE;
2204 nd.ni_cnd.cn_flags = LOCKPARENT;
2205 error = nfs_namei(&nd, &dnsfh, len, slp, nam, &md, &dpos,
2206 &dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
2207 if (dirp && v3) {
2208 dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
2209 }
2210 if (error)
2211 goto out1;
2212 xp = nd.ni_vp;
2213 if (xp != NULL) {
2214 error = EEXIST;
2215 goto out;
2216 }
2217 xp = nd.ni_dvp;
2218 if (vp->v_mount != xp->v_mount)
2219 error = EXDEV;
2220out:
2221 if (!error) {
2222 nqsrv_getl(vp, ND_WRITE);
2223 nqsrv_getl(xp, ND_WRITE);
2224 error = VOP_LINK(nd.ni_dvp, vp, &nd.ni_cnd);
2225 if (nd.ni_dvp != nd.ni_vp)
2226 VOP_UNLOCK(nd.ni_dvp);
2227 vrele(nd.ni_dvp);
2228 } else {
2229 VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2230 if (nd.ni_dvp == nd.ni_vp)
2231 vrele(nd.ni_dvp);
2232 else
2233 vput(nd.ni_dvp);
2234 if (nd.ni_vp)
2235 vrele(nd.ni_vp);
2236 }
2237out1:
2238 if (v3) {
2239 vn_lock(vp, LK_SHARED | LK_RETRY);
2240 getret = VOP_GETATTR(vp, &at, cred);
2241 VOP_UNLOCK(vp);
2242 }
2243 if (dirp) {
2244 if (v3) {
2245 vn_lock(dirp, LK_SHARED | LK_RETRY);
2246 diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
2247 VOP_UNLOCK(dirp);
2248 }
2249 vrele(dirp);
2250 }
2251 vrele(vp);
2252 if (nd.ni_pathbuf != NULL) {
2253 pathbuf_destroy(nd.ni_pathbuf);
2254 nd.ni_pathbuf = NULL;
2255 }
2256 nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_WCCDATA(v3));
2257 if (v3) {
2258 nfsm_srvpostop_attr(getret, &at);
2259 nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2260 return (0);
2261 }
2262 nfsm_srvdone;
2263}
2264
2265/*
2266 * nfs symbolic link service
2267 */
2268int
2269nfsrv_symlink(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2270{
2271 struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2272 struct mbuf *nam = nfsd->nd_nam;
2273 char *dpos = nfsd->nd_dpos;
2274 kauth_cred_t cred = nfsd->nd_cr;
2275 struct vattr va, dirfor, diraft;
2276 struct nameidata nd;
2277 u_int32_t *tl;
2278 int32_t t1;
2279 struct nfsv2_sattr *sp;
2280 char *bpos, *pathcp = NULL, *cp2;
2281 struct uio io;
2282 struct iovec iv;
2283 int error = 0, cache = 0, dirfor_ret = 1, diraft_ret = 1, abort = 0;
2284 uint32_t len, len2;
2285 int v3 = (nfsd->nd_flag & ND_NFSV3);
2286 struct mbuf *mb, *mreq __unused;
2287 struct vnode *dirp = (struct vnode *)0;
2288 nfsrvfh_t nsfh;
2289 u_quad_t frev;
2290
2291 nd.ni_cnd.cn_nameiop = 0;
2292 nfsm_srvmtofh(&nsfh);
2293 nfsm_srvnamesiz(len);
2294 nd.ni_cnd.cn_cred = cred;
2295 nd.ni_cnd.cn_nameiop = CREATE;
2296 nd.ni_cnd.cn_flags = LOCKPARENT;
2297 error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
2298 &dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
2299 if (dirp && v3) {
2300 dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
2301 }
2302 if (error)
2303 goto out;
2304 abort = 1;
2305 vattr_null(&va);
2306 va.va_type = VLNK;
2307 if (v3) {
2308 va.va_mode = 0;
2309 nfsm_srvsattr(&va);
2310 nfsm_dissect(tl, uint32_t *, NFSX_UNSIGNED);
2311 len2 = fxdr_unsigned(uint32_t, *tl);
2312 if (len2 > PATH_MAX) {
2313 /* XXX should check _PC_NO_TRUNC */
2314 error = ENAMETOOLONG;
2315 goto abortop;
2316 }
2317 }
2318 else {
2319 /* NFSv2 */
2320 nfsm_strsiz(len2, NFS_MAXPATHLEN);
2321 }
2322 pathcp = malloc(len2 + 1, M_TEMP, M_WAITOK);
2323 iv.iov_base = pathcp;
2324 iv.iov_len = len2;
2325 io.uio_resid = len2;
2326 io.uio_offset = 0;
2327 io.uio_iov = &iv;
2328 io.uio_iovcnt = 1;
2329 io.uio_rw = UIO_READ;
2330 UIO_SETUP_SYSSPACE(&io);
2331 nfsm_mtouio(&io, len2);
2332 if (!v3) {
2333 nfsm_dissect(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
2334 va.va_mode = fxdr_unsigned(u_int16_t, sp->sa_mode);
2335 }
2336 *(pathcp + len2) = '\0';
2337 if (nd.ni_vp) {
2338 error = EEXIST;
2339abortop:
2340 VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2341 if (nd.ni_dvp == nd.ni_vp)
2342 vrele(nd.ni_dvp);
2343 else
2344 vput(nd.ni_dvp);
2345 if (nd.ni_vp)
2346 vrele(nd.ni_vp);
2347 goto out;
2348 }
2349 nqsrv_getl(nd.ni_dvp, ND_WRITE);
2350 error = VOP_SYMLINK(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va, pathcp);
2351 if (!error) {
2352 if (v3) {
2353 vn_lock(nd.ni_vp, LK_SHARED | LK_RETRY);
2354 error = nfsrv_composefh(nd.ni_vp, &nsfh, v3);
2355 if (!error)
2356 error = VOP_GETATTR(nd.ni_vp, &va, cred);
2357 vput(nd.ni_vp);
2358 } else {
2359 vrele(nd.ni_vp);
2360 }
2361 }
2362 vput(nd.ni_dvp);
2363out:
2364 if (pathcp)
2365 free(pathcp, M_TEMP);
2366 if (dirp) {
2367 if (v3) {
2368 vn_lock(dirp, LK_SHARED | LK_RETRY);
2369 diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
2370 VOP_UNLOCK(dirp);
2371 }
2372 vrele(dirp);
2373 dirp = NULL;
2374 }
2375 if (nd.ni_pathbuf != NULL) {
2376 pathbuf_destroy(nd.ni_pathbuf);
2377 nd.ni_pathbuf = NULL;
2378 }
2379 abort = 0;
2380 nfsm_reply(NFSX_SRVFH(&nsfh, v3) + NFSX_POSTOPATTR(v3) +
2381 NFSX_WCCDATA(v3));
2382 if (v3) {
2383 if (!error) {
2384 nfsm_srvpostop_fh(&nsfh);
2385 nfsm_srvpostop_attr(0, &va);
2386 }
2387 nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2388 }
2389 return (0);
2390nfsmout:
2391 if (abort) {
2392 VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2393 if (nd.ni_dvp == nd.ni_vp)
2394 vrele(nd.ni_dvp);
2395 else
2396 vput(nd.ni_dvp);
2397 if (nd.ni_vp)
2398 vrele(nd.ni_vp);
2399 if (nd.ni_pathbuf != NULL) {
2400 pathbuf_destroy(nd.ni_pathbuf);
2401 nd.ni_pathbuf = NULL;
2402 }
2403 }
2404 if (dirp)
2405 vrele(dirp);
2406 if (pathcp)
2407 free(pathcp, M_TEMP);
2408 return (error);
2409}
2410
2411/*
2412 * nfs mkdir service
2413 */
2414int
2415nfsrv_mkdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2416{
2417 struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2418 struct mbuf *nam = nfsd->nd_nam;
2419 char *dpos = nfsd->nd_dpos;
2420 kauth_cred_t cred = nfsd->nd_cr;
2421 struct vattr va, dirfor, diraft;
2422 struct nfs_fattr *fp;
2423 struct nameidata nd;
2424 char *cp;
2425 u_int32_t *tl;
2426 int32_t t1;
2427 char *bpos;
2428 int error = 0, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
2429 int abort = 0;
2430 int v3 = (nfsd->nd_flag & ND_NFSV3);
2431 char *cp2;
2432 struct mbuf *mb, *mreq __unused;
2433 struct vnode *vp, *dirp = (struct vnode *)0;
2434 nfsrvfh_t nsfh;
2435 u_quad_t frev;
2436
2437 nfsm_srvmtofh(&nsfh);
2438 nfsm_srvnamesiz(len);
2439 nd.ni_cnd.cn_cred = cred;
2440 nd.ni_cnd.cn_nameiop = CREATE;
2441 nd.ni_cnd.cn_flags = LOCKPARENT;
2442 error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
2443 &dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
2444 if (dirp && v3) {
2445 dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
2446 }
2447 if (error) {
2448 if (nd.ni_pathbuf != NULL) {
2449 pathbuf_destroy(nd.ni_pathbuf);
2450 nd.ni_pathbuf = NULL;
2451 }
2452 nfsm_reply(NFSX_WCCDATA(v3));
2453 nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2454 if (dirp)
2455 vrele(dirp);
2456 return (0);
2457 }
2458 abort = 1;
2459 vattr_null(&va);
2460 if (v3) {
2461 va.va_mode = 0;
2462 nfsm_srvsattr(&va);
2463 } else {
2464 nfsm_dissect(tl, u_int32_t *, NFSX_UNSIGNED);
2465 va.va_mode = nfstov_mode(*tl++);
2466 }
2467 va.va_type = VDIR;
2468 vp = nd.ni_vp;
2469 if (vp != NULL) {
2470 VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2471 if (nd.ni_dvp == vp)
2472 vrele(nd.ni_dvp);
2473 else
2474 vput(nd.ni_dvp);
2475 vrele(vp);
2476 error = EEXIST;
2477 goto out;
2478 }
2479 nqsrv_getl(nd.ni_dvp, ND_WRITE);
2480 error = VOP_MKDIR(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &va);
2481 if (!error) {
2482 vp = nd.ni_vp;
2483 vn_lock(vp, LK_SHARED | LK_RETRY);
2484 error = nfsrv_composefh(vp, &nsfh, v3);
2485 if (!error)
2486 error = VOP_GETATTR(vp, &va, cred);
2487 vput(vp);
2488 }
2489 vput(nd.ni_dvp);
2490out:
2491 if (dirp) {
2492 if (v3) {
2493 vn_lock(dirp, LK_SHARED | LK_RETRY);
2494 diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
2495 VOP_UNLOCK(dirp);
2496 }
2497 vrele(dirp);
2498 dirp = NULL;
2499 }
2500 if (nd.ni_pathbuf != NULL) {
2501 pathbuf_destroy(nd.ni_pathbuf);
2502 nd.ni_pathbuf = NULL;
2503 }
2504 abort = 0;
2505 nfsm_reply(NFSX_SRVFH(&nsfh, v3) + NFSX_POSTOPATTR(v3) +
2506 NFSX_WCCDATA(v3));
2507 if (v3) {
2508 if (!error) {
2509 nfsm_srvpostop_fh(&nsfh);
2510 nfsm_srvpostop_attr(0, &va);
2511 }
2512 nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2513 } else {
2514 nfsm_srvfhtom(&nsfh, v3);
2515 nfsm_build(fp, struct nfs_fattr *, NFSX_V2FATTR);
2516 nfsm_srvfillattr(&va, fp);
2517 }
2518 return (0);
2519nfsmout:
2520 if (abort) {
2521 VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2522 if (nd.ni_dvp == nd.ni_vp)
2523 vrele(nd.ni_dvp);
2524 else
2525 vput(nd.ni_dvp);
2526 if (nd.ni_vp)
2527 vrele(nd.ni_vp);
2528 if (nd.ni_pathbuf != NULL) {
2529 pathbuf_destroy(nd.ni_pathbuf);
2530 nd.ni_pathbuf = NULL;
2531 }
2532 }
2533 if (dirp)
2534 vrele(dirp);
2535 return (error);
2536}
2537
2538/*
2539 * nfs rmdir service
2540 */
2541int
2542nfsrv_rmdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2543{
2544 struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2545 struct mbuf *nam = nfsd->nd_nam;
2546 char *dpos = nfsd->nd_dpos;
2547 kauth_cred_t cred = nfsd->nd_cr;
2548 u_int32_t *tl;
2549 int32_t t1;
2550 char *bpos;
2551 int error = 0, cache = 0, len, dirfor_ret = 1, diraft_ret = 1;
2552 int v3 = (nfsd->nd_flag & ND_NFSV3);
2553 char *cp2;
2554 struct mbuf *mb, *mreq __unused;
2555 struct vnode *vp, *dirp = (struct vnode *)0;
2556 struct vattr dirfor, diraft;
2557 nfsrvfh_t nsfh;
2558 struct nameidata nd;
2559 u_quad_t frev;
2560
2561 nfsm_srvmtofh(&nsfh);
2562 nfsm_srvnamesiz(len);
2563 nd.ni_cnd.cn_cred = cred;
2564 nd.ni_cnd.cn_nameiop = DELETE;
2565 nd.ni_cnd.cn_flags = LOCKPARENT | LOCKLEAF;
2566 error = nfs_namei(&nd, &nsfh, len, slp, nam, &md, &dpos,
2567 &dirp, lwp, (nfsd->nd_flag & ND_KERBAUTH), false);
2568 if (dirp && v3) {
2569 dirfor_ret = VOP_GETATTR(dirp, &dirfor, cred);
2570 }
2571 if (error) {
2572 if (nd.ni_pathbuf != NULL) {
2573 pathbuf_destroy(nd.ni_pathbuf);
2574 nd.ni_pathbuf = NULL;
2575 }
2576 nfsm_reply(NFSX_WCCDATA(v3));
2577 nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2578 if (dirp)
2579 vrele(dirp);
2580 return (0);
2581 }
2582 vp = nd.ni_vp;
2583 if (vp->v_type != VDIR) {
2584 error = ENOTDIR;
2585 goto out;
2586 }
2587 /*
2588 * No rmdir "." please.
2589 */
2590 if (nd.ni_dvp == vp) {
2591 error = EINVAL;
2592 goto out;
2593 }
2594 /*
2595 * The root of a mounted filesystem cannot be deleted.
2596 */
2597 if (vp->v_vflag & VV_ROOT)
2598 error = EBUSY;
2599out:
2600 if (!error) {
2601 nqsrv_getl(nd.ni_dvp, ND_WRITE);
2602 nqsrv_getl(vp, ND_WRITE);
2603 error = VOP_RMDIR(nd.ni_dvp, nd.ni_vp, &nd.ni_cnd);
2604 } else {
2605 VOP_ABORTOP(nd.ni_dvp, &nd.ni_cnd);
2606 if (nd.ni_dvp == nd.ni_vp)
2607 vrele(nd.ni_dvp);
2608 else
2609 vput(nd.ni_dvp);
2610 vput(vp);
2611 }
2612 if (nd.ni_pathbuf != NULL) {
2613 pathbuf_destroy(nd.ni_pathbuf);
2614 nd.ni_pathbuf = NULL;
2615 }
2616 if (dirp) {
2617 if (v3) {
2618 vn_lock(dirp, LK_SHARED | LK_RETRY);
2619 diraft_ret = VOP_GETATTR(dirp, &diraft, cred);
2620 VOP_UNLOCK(dirp);
2621 }
2622 vrele(dirp);
2623 }
2624 nfsm_reply(NFSX_WCCDATA(v3));
2625 if (v3) {
2626 nfsm_srvwcc_data(dirfor_ret, &dirfor, diraft_ret, &diraft);
2627 return (0);
2628 }
2629 nfsm_srvdone;
2630}
2631
2632/*
2633 * nfs readdir service
2634 * - mallocs what it thinks is enough to read
2635 * count rounded up to a multiple of NFS_SRVDIRBLKSIZ <= NFS_MAXREADDIR
2636 * - calls VOP_READDIR()
2637 * - loops around building the reply
2638 * if the output generated exceeds count break out of loop
2639 * The nfsm_clget macro is used here so that the reply will be packed
2640 * tightly in mbuf clusters.
2641 * - it only knows that it has encountered eof when the VOP_READDIR()
2642 * reads nothing
2643 * - as such one readdir rpc will return eof false although you are there
2644 * and then the next will return eof
2645 * - it trims out records with d_fileno == 0
2646 * this doesn't matter for Unix clients, but they might confuse clients
2647 * for other os'.
2648 * - it trims out records with d_type == DT_WHT
2649 * these cannot be seen through NFS (unless we extend the protocol)
2650 * NB: It is tempting to set eof to true if the VOP_READDIR() reads less
2651 * than requested, but this may not apply to all filesystems. For
2652 * example, client NFS does not { although it is never remote mounted
2653 * anyhow }
2654 * The alternate call nfsrv_readdirplus() does lookups as well.
2655 * PS: The NFS protocol spec. does not clarify what the "count" byte
2656 * argument is a count of.. just name strings and file id's or the
2657 * entire reply rpc or ...
2658 * I tried just file name and id sizes and it confused the Sun client,
2659 * so I am using the full rpc size now. The "paranoia.." comment refers
2660 * to including the status longwords that are not a part of the dir.
2661 * "entry" structures, but are in the rpc.
2662 */
2663
2664#define NFS_SRVDIRBLKSIZ 1024
2665
2666struct flrep {
2667 nfsuint64 fl_off;
2668 u_int32_t fl_postopok;
2669 struct nfs_fattr fl_fattr; /* XXX: must be of fattr3 size */
2670 u_int32_t fl_fhok;
2671 u_int32_t fl_fhsize;
2672 /* handle comes here, filled in dynamically */
2673};
2674
2675int
2676nfsrv_readdir(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2677{
2678 struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2679 struct mbuf *nam = nfsd->nd_nam;
2680 char *dpos = nfsd->nd_dpos;
2681 kauth_cred_t cred = nfsd->nd_cr;
2682 char *bp, *be;
2683 struct mbuf *mp;
2684 struct dirent *dp;
2685 char *cp;
2686 u_int32_t *tl;
2687 int32_t t1;
2688 char *bpos;
2689 struct mbuf *mb, *mreq __unused, *mp2;
2690 char *cpos, *cend, *cp2, *rbuf;
2691 struct vnode *vp;
2692 struct vattr at;
2693 nfsrvfh_t nsfh;
2694 struct uio io;
2695 struct iovec iv;
2696 int len, nlen, rem, xfer, tsiz, i, error = 0, getret = 1;
2697 int siz, cnt, fullsiz, eofflag, rdonly, cache = 0, ncookies;
2698 int v3 = (nfsd->nd_flag & ND_NFSV3);
2699 u_quad_t frev, off, toff;
2700#ifdef NFS3_STRICTVERF
2701 u_quad_t verf;
2702#endif
2703 off_t *cookies = NULL, *cookiep;
2704 nfsuint64 jar;
2705
2706 nfsm_srvmtofh(&nsfh);
2707 if (v3) {
2708 nfsm_dissect(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
2709 toff = fxdr_hyper(tl);
2710 tl += 2;
2711#ifdef NFS3_STRICTVERF
2712 verf = fxdr_hyper(tl);
2713#endif
2714 tl += 2;
2715 } else {
2716 nfsm_dissect(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2717 toff = fxdr_unsigned(u_quad_t, *tl++);
2718 }
2719 off = toff;
2720 cnt = fxdr_unsigned(int, *tl);
2721 siz = ((cnt + NFS_SRVDIRBLKSIZ - 1) & ~(NFS_SRVDIRBLKSIZ - 1));
2722 xfer = NFS_SRVMAXDATA(nfsd);
2723 if (siz > xfer)
2724 siz = xfer;
2725 fullsiz = siz;
2726 error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
2727 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
2728 if (!error && vp->v_type != VDIR) {
2729 error = ENOTDIR;
2730 vput(vp);
2731 }
2732 if (error) {
2733 nfsm_reply(NFSX_UNSIGNED);
2734 nfsm_srvpostop_attr(getret, &at);
2735 return (0);
2736 }
2737 nqsrv_getl(vp, ND_READ);
2738 if (v3) {
2739 error = getret = VOP_GETATTR(vp, &at, cred);
2740#ifdef NFS3_STRICTVERF
2741 /*
2742 * XXX This check is too strict for Solaris 2.5 clients.
2743 */
2744 if (!error && toff && verf != at.va_filerev)
2745 error = NFSERR_BAD_COOKIE;
2746#endif
2747 }
2748 if (!error)
2749 error = nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 0);
2750 if (error) {
2751 vput(vp);
2752 nfsm_reply(NFSX_POSTOPATTR(v3));
2753 nfsm_srvpostop_attr(getret, &at);
2754 return (0);
2755 }
2756 VOP_UNLOCK(vp);
2757 rbuf = malloc(siz, M_TEMP, M_WAITOK);
2758again:
2759 iv.iov_base = rbuf;
2760 iv.iov_len = fullsiz;
2761 io.uio_iov = &iv;
2762 io.uio_iovcnt = 1;
2763 io.uio_offset = (off_t)off;
2764 io.uio_resid = fullsiz;
2765 io.uio_rw = UIO_READ;
2766 UIO_SETUP_SYSSPACE(&io);
2767 eofflag = 0;
2768 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
2769
2770 error = VOP_READDIR(vp, &io, cred, &eofflag, &cookies, &ncookies);
2771
2772 off = (off_t)io.uio_offset;
2773 if (!cookies && !error)
2774 error = NFSERR_PERM;
2775 if (v3) {
2776 getret = VOP_GETATTR(vp, &at, cred);
2777 if (!error)
2778 error = getret;
2779 }
2780
2781 VOP_UNLOCK(vp);
2782 if (error) {
2783 vrele(vp);
2784 free((void *)rbuf, M_TEMP);
2785 if (cookies)
2786 free((void *)cookies, M_TEMP);
2787 nfsm_reply(NFSX_POSTOPATTR(v3));
2788 nfsm_srvpostop_attr(getret, &at);
2789 return (0);
2790 }
2791 if (io.uio_resid) {
2792 siz -= io.uio_resid;
2793
2794 /*
2795 * If nothing read, return eof
2796 * rpc reply
2797 */
2798 if (siz == 0) {
2799 vrele(vp);
2800 nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_COOKIEVERF(v3) +
2801 2 * NFSX_UNSIGNED);
2802 if (v3) {
2803 nfsm_srvpostop_attr(getret, &at);
2804 nfsm_build(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
2805 txdr_hyper(at.va_filerev, tl);
2806 tl += 2;
2807 } else
2808 nfsm_build(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2809 *tl++ = nfs_false;
2810 *tl = nfs_true;
2811 free((void *)rbuf, M_TEMP);
2812 free((void *)cookies, M_TEMP);
2813 return (0);
2814 }
2815 }
2816
2817 /*
2818 * Check for degenerate cases of nothing useful read.
2819 * If so go try again
2820 */
2821 cpos = rbuf;
2822 cend = rbuf + siz;
2823 dp = (struct dirent *)cpos;
2824 cookiep = cookies;
2825
2826 while (cpos < cend && ncookies > 0 &&
2827 (dp->d_fileno == 0 || dp->d_type == DT_WHT)) {
2828 cpos += dp->d_reclen;
2829 dp = (struct dirent *)cpos;
2830 cookiep++;
2831 ncookies--;
2832 }
2833 if (cpos >= cend || ncookies == 0) {
2834 toff = off;
2835 siz = fullsiz;
2836 free(cookies, M_TEMP);
2837 cookies = NULL;
2838 goto again;
2839 }
2840
2841 len = 3 * NFSX_UNSIGNED; /* paranoia, probably can be 0 */
2842 nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_COOKIEVERF(v3) + siz);
2843 if (v3) {
2844 nfsm_srvpostop_attr(getret, &at);
2845 nfsm_build(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
2846 txdr_hyper(at.va_filerev, tl);
2847 }
2848 mp = mp2 = mb;
2849 bp = bpos;
2850 be = bp + M_TRAILINGSPACE(mp);
2851
2852 /* Loop through the records and build reply */
2853 while (cpos < cend && ncookies > 0) {
2854 if (dp->d_fileno != 0 && dp->d_type != DT_WHT) {
2855 nlen = dp->d_namlen;
2856 rem = nfsm_rndup(nlen)-nlen;
2857 len += (4 * NFSX_UNSIGNED + nlen + rem);
2858 if (v3)
2859 len += 2 * NFSX_UNSIGNED;
2860 if (len > cnt) {
2861 eofflag = 0;
2862 break;
2863 }
2864 /*
2865 * Build the directory record xdr from
2866 * the dirent entry.
2867 */
2868 nfsm_clget;
2869 *tl = nfs_true;
2870 bp += NFSX_UNSIGNED;
2871 if (v3) {
2872 nfsm_clget;
2873 *tl = txdr_unsigned(dp->d_fileno >> 32);
2874 bp += NFSX_UNSIGNED;
2875 }
2876 nfsm_clget;
2877 *tl = txdr_unsigned(dp->d_fileno);
2878 bp += NFSX_UNSIGNED;
2879 nfsm_clget;
2880 *tl = txdr_unsigned(nlen);
2881 bp += NFSX_UNSIGNED;
2882
2883 /* And loop around copying the name */
2884 xfer = nlen;
2885 cp = dp->d_name;
2886 while (xfer > 0) {
2887 nfsm_clget;
2888 if ((bp+xfer) > be)
2889 tsiz = be-bp;
2890 else
2891 tsiz = xfer;
2892 memcpy(bp, cp, tsiz);
2893 bp += tsiz;
2894 xfer -= tsiz;
2895 if (xfer > 0)
2896 cp += tsiz;
2897 }
2898 /* And null pad to an int32_t boundary */
2899 for (i = 0; i < rem; i++)
2900 *bp++ = '\0';
2901 nfsm_clget;
2902
2903 /* Finish off the record */
2904 txdr_hyper(*cookiep, &jar);
2905 if (v3) {
2906 *tl = jar.nfsuquad[0];
2907 bp += NFSX_UNSIGNED;
2908 nfsm_clget;
2909 }
2910 *tl = jar.nfsuquad[1];
2911 bp += NFSX_UNSIGNED;
2912 }
2913 cpos += dp->d_reclen;
2914 dp = (struct dirent *)cpos;
2915 cookiep++;
2916 ncookies--;
2917 }
2918 vrele(vp);
2919 nfsm_clget;
2920 *tl = nfs_false;
2921 bp += NFSX_UNSIGNED;
2922 nfsm_clget;
2923 if (eofflag)
2924 *tl = nfs_true;
2925 else
2926 *tl = nfs_false;
2927 bp += NFSX_UNSIGNED;
2928 if (mp != mb) {
2929 if (bp < be)
2930 mp->m_len = bp - mtod(mp, char *);
2931 } else
2932 mp->m_len += bp - bpos;
2933 free((void *)rbuf, M_TEMP);
2934 free((void *)cookies, M_TEMP);
2935 nfsm_srvdone;
2936}
2937
2938int
2939nfsrv_readdirplus(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
2940{
2941 struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
2942 struct mbuf *nam = nfsd->nd_nam;
2943 char *dpos = nfsd->nd_dpos;
2944 kauth_cred_t cred = nfsd->nd_cr;
2945 char *bp, *be;
2946 struct mbuf *mp;
2947 struct dirent *dp;
2948 char *cp;
2949 u_int32_t *tl;
2950 int32_t t1;
2951 char *bpos;
2952 struct mbuf *mb, *mreq __unused, *mp2;
2953 char *cpos, *cend, *cp2, *rbuf;
2954 struct vnode *vp, *nvp;
2955 struct flrep fl;
2956 nfsrvfh_t nsfh;
2957 struct uio io;
2958 struct iovec iv;
2959 struct vattr va, at, *vap = &va;
2960 struct nfs_fattr *fp;
2961 int len, nlen, rem, xfer, tsiz, i, error = 0, getret = 1;
2962 int siz, cnt, fullsiz, eofflag, rdonly, cache = 0, dirlen, ncookies;
2963 u_quad_t frev, off, toff;
2964#ifdef NFS3_STRICTVERF
2965 u_quad_t verf;
2966#endif
2967 off_t *cookies = NULL, *cookiep;
2968
2969 nfsm_srvmtofh(&nsfh);
2970 nfsm_dissect(tl, u_int32_t *, 6 * NFSX_UNSIGNED);
2971 toff = fxdr_hyper(tl);
2972 tl += 2;
2973#ifdef NFS3_STRICTVERF
2974 verf = fxdr_hyper(tl);
2975#endif
2976 tl += 2;
2977 siz = fxdr_unsigned(int, *tl++);
2978 cnt = fxdr_unsigned(int, *tl);
2979 off = toff;
2980 siz = ((siz + NFS_SRVDIRBLKSIZ - 1) & ~(NFS_SRVDIRBLKSIZ - 1));
2981 xfer = NFS_SRVMAXDATA(nfsd);
2982 if (siz > xfer)
2983 siz = xfer;
2984 fullsiz = siz;
2985 error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
2986 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
2987 if (!error && vp->v_type != VDIR) {
2988 error = ENOTDIR;
2989 vput(vp);
2990 }
2991 if (error) {
2992 nfsm_reply(NFSX_UNSIGNED);
2993 nfsm_srvpostop_attr(getret, &at);
2994 return (0);
2995 }
2996 error = getret = VOP_GETATTR(vp, &at, cred);
2997#ifdef NFS3_STRICTVERF
2998 /*
2999 * XXX This check is too strict for Solaris 2.5 clients.
3000 */
3001 if (!error && toff && verf != at.va_filerev)
3002 error = NFSERR_BAD_COOKIE;
3003#endif
3004 if (!error) {
3005 nqsrv_getl(vp, ND_READ);
3006 error = nfsrv_access(vp, VEXEC, cred, rdonly, lwp, 0);
3007 }
3008 if (error) {
3009 vput(vp);
3010 nfsm_reply(NFSX_V3POSTOPATTR);
3011 nfsm_srvpostop_attr(getret, &at);
3012 return (0);
3013 }
3014 VOP_UNLOCK(vp);
3015
3016 rbuf = malloc(siz, M_TEMP, M_WAITOK);
3017again:
3018 iv.iov_base = rbuf;
3019 iv.iov_len = fullsiz;
3020 io.uio_iov = &iv;
3021 io.uio_iovcnt = 1;
3022 io.uio_offset = (off_t)off;
3023 io.uio_resid = fullsiz;
3024 io.uio_rw = UIO_READ;
3025 UIO_SETUP_SYSSPACE(&io);
3026 eofflag = 0;
3027
3028 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
3029
3030 error = VOP_READDIR(vp, &io, cred, &eofflag, &cookies, &ncookies);
3031
3032 off = (u_quad_t)io.uio_offset;
3033 getret = VOP_GETATTR(vp, &at, cred);
3034
3035 VOP_UNLOCK(vp);
3036
3037 /*
3038 * If the VGET operation doesn't work for this filesystem,
3039 * we can't support readdirplus. Returning NOTSUPP should
3040 * make clients fall back to plain readdir.
3041 * There's no need to check for VPTOFH as well, we wouldn't
3042 * even be here otherwise.
3043 */
3044 if (!getret) {
3045 if ((getret = VFS_VGET(vp->v_mount, at.va_fileid, &nvp)))
3046 getret = (getret == EOPNOTSUPP) ?
3047 NFSERR_NOTSUPP : NFSERR_IO;
3048 else
3049 vput(nvp);
3050 }
3051
3052 if (!cookies && !error)
3053 error = NFSERR_PERM;
3054 if (!error)
3055 error = getret;
3056 if (error) {
3057 vrele(vp);
3058 if (cookies)
3059 free((void *)cookies, M_TEMP);
3060 free((void *)rbuf, M_TEMP);
3061 nfsm_reply(NFSX_V3POSTOPATTR);
3062 nfsm_srvpostop_attr(getret, &at);
3063 return (0);
3064 }
3065 if (io.uio_resid) {
3066 siz -= io.uio_resid;
3067
3068 /*
3069 * If nothing read, return eof
3070 * rpc reply
3071 */
3072 if (siz == 0) {
3073 vrele(vp);
3074 nfsm_reply(NFSX_V3POSTOPATTR + NFSX_V3COOKIEVERF +
3075 2 * NFSX_UNSIGNED);
3076 nfsm_srvpostop_attr(getret, &at);
3077 nfsm_build(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
3078 txdr_hyper(at.va_filerev, tl);
3079 tl += 2;
3080 *tl++ = nfs_false;
3081 *tl = nfs_true;
3082 free((void *)cookies, M_TEMP);
3083 free((void *)rbuf, M_TEMP);
3084 return (0);
3085 }
3086 }
3087
3088 /*
3089 * Check for degenerate cases of nothing useful read.
3090 * If so go try again
3091 */
3092 cpos = rbuf;
3093 cend = rbuf + siz;
3094 dp = (struct dirent *)cpos;
3095 cookiep = cookies;
3096
3097 while (cpos < cend && ncookies > 0 &&
3098 (dp->d_fileno == 0 || dp->d_type == DT_WHT)) {
3099 cpos += dp->d_reclen;
3100 dp = (struct dirent *)cpos;
3101 cookiep++;
3102 ncookies--;
3103 }
3104 if (cpos >= cend || ncookies == 0) {
3105 toff = off;
3106 siz = fullsiz;
3107 free(cookies, M_TEMP);
3108 cookies = NULL;
3109 goto again;
3110 }
3111
3112 dirlen = len = NFSX_V3POSTOPATTR + NFSX_V3COOKIEVERF + 2 * NFSX_UNSIGNED;
3113 nfsm_reply(cnt);
3114 nfsm_srvpostop_attr(getret, &at);
3115 nfsm_build(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3116 txdr_hyper(at.va_filerev, tl);
3117 mp = mp2 = mb;
3118 bp = bpos;
3119 be = bp + M_TRAILINGSPACE(mp);
3120
3121 /* Loop through the records and build reply */
3122 while (cpos < cend && ncookies > 0) {
3123 if (dp->d_fileno != 0 && dp->d_type != DT_WHT) {
3124 nfsrvfh_t nnsfh;
3125
3126 nlen = dp->d_namlen;
3127 rem = nfsm_rndup(nlen)-nlen;
3128
3129 /*
3130 * For readdir_and_lookup get the vnode using
3131 * the file number.
3132 */
3133 if (VFS_VGET(vp->v_mount, dp->d_fileno, &nvp))
3134 goto invalid;
3135 if (nfsrv_composefh(nvp, &nnsfh, true)) {
3136 vput(nvp);
3137 goto invalid;
3138 }
3139 if (VOP_GETATTR(nvp, vap, cred)) {
3140 vput(nvp);
3141 goto invalid;
3142 }
3143 vput(nvp);
3144
3145 /*
3146 * If either the dircount or maxcount will be
3147 * exceeded, get out now. Both of these lengths
3148 * are calculated conservatively, including all
3149 * XDR overheads.
3150 */
3151 len += (8 * NFSX_UNSIGNED + nlen + rem + NFSX_V3FH +
3152 NFSX_V3POSTOPATTR);
3153 dirlen += (6 * NFSX_UNSIGNED + nlen + rem);
3154 if (len > cnt || dirlen > fullsiz) {
3155 eofflag = 0;
3156 break;
3157 }
3158
3159 /*
3160 * Build the directory record xdr from
3161 * the dirent entry.
3162 */
3163 fp = (struct nfs_fattr *)&fl.fl_fattr;
3164 nfsm_srvfillattr(vap, fp);
3165 fl.fl_fhsize = txdr_unsigned(NFSX_V3FH);
3166 fl.fl_fhok = nfs_true;
3167 fl.fl_postopok = nfs_true;
3168 txdr_hyper(*cookiep, fl.fl_off.nfsuquad);
3169
3170 nfsm_clget;
3171 *tl = nfs_true;
3172 bp += NFSX_UNSIGNED;
3173 nfsm_clget;
3174 *tl = txdr_unsigned(dp->d_fileno >> 32);
3175 bp += NFSX_UNSIGNED;
3176 nfsm_clget;
3177 *tl = txdr_unsigned(dp->d_fileno);
3178 bp += NFSX_UNSIGNED;
3179 nfsm_clget;
3180 *tl = txdr_unsigned(nlen);
3181 bp += NFSX_UNSIGNED;
3182
3183 /* And loop around copying the name */
3184 xfer = nlen;
3185 cp = dp->d_name;
3186 while (xfer > 0) {
3187 nfsm_clget;
3188 if ((bp + xfer) > be)
3189 tsiz = be - bp;
3190 else
3191 tsiz = xfer;
3192 memcpy(bp, cp, tsiz);
3193 bp += tsiz;
3194 xfer -= tsiz;
3195 if (xfer > 0)
3196 cp += tsiz;
3197 }
3198 /* And null pad to an int32_t boundary */
3199 for (i = 0; i < rem; i++)
3200 *bp++ = '\0';
3201
3202 /*
3203 * Now copy the flrep structure out.
3204 */
3205 xfer = sizeof(struct flrep);
3206 cp = (void *)&fl;
3207 while (xfer > 0) {
3208 nfsm_clget;
3209 if ((bp + xfer) > be)
3210 tsiz = be - bp;
3211 else
3212 tsiz = xfer;
3213 memcpy(bp, cp, tsiz);
3214 bp += tsiz;
3215 xfer -= tsiz;
3216 if (xfer > 0)
3217 cp += tsiz;
3218 }
3219
3220 /*
3221 * ... and filehandle.
3222 */
3223 xfer = NFSRVFH_SIZE(&nnsfh);
3224 cp = NFSRVFH_DATA(&nnsfh);
3225 while (xfer > 0) {
3226 nfsm_clget;
3227 if ((bp + xfer) > be)
3228 tsiz = be - bp;
3229 else
3230 tsiz = xfer;
3231 memcpy(bp, cp, tsiz);
3232 bp += tsiz;
3233 xfer -= tsiz;
3234 if (xfer > 0)
3235 cp += tsiz;
3236 }
3237 }
3238invalid:
3239 cpos += dp->d_reclen;
3240 dp = (struct dirent *)cpos;
3241 cookiep++;
3242 ncookies--;
3243 }
3244 vrele(vp);
3245 nfsm_clget;
3246 *tl = nfs_false;
3247 bp += NFSX_UNSIGNED;
3248 nfsm_clget;
3249 if (eofflag)
3250 *tl = nfs_true;
3251 else
3252 *tl = nfs_false;
3253 bp += NFSX_UNSIGNED;
3254 if (mp != mb) {
3255 if (bp < be)
3256 mp->m_len = bp - mtod(mp, char *);
3257 } else
3258 mp->m_len += bp - bpos;
3259 free((void *)cookies, M_TEMP);
3260 free((void *)rbuf, M_TEMP);
3261 nfsm_srvdone;
3262}
3263
3264/*
3265 * nfs commit service
3266 */
3267int
3268nfsrv_commit(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
3269{
3270 struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
3271 struct mbuf *nam = nfsd->nd_nam;
3272 char *dpos = nfsd->nd_dpos;
3273 kauth_cred_t cred = nfsd->nd_cr;
3274 struct vattr bfor, aft;
3275 struct vnode *vp;
3276 nfsrvfh_t nsfh;
3277 u_int32_t *tl;
3278 int32_t t1;
3279 char *bpos;
3280 int error = 0, rdonly, for_ret = 1, aft_ret = 1, cache = 0;
3281 uint32_t cnt;
3282 char *cp2;
3283 struct mbuf *mb, *mreq __unused;
3284 u_quad_t frev, off, end;
3285
3286 nfsm_srvmtofh(&nsfh);
3287 nfsm_dissect(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
3288
3289 off = fxdr_hyper(tl);
3290 tl += 2;
3291 cnt = fxdr_unsigned(uint32_t, *tl);
3292 error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
3293 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
3294 if (error) {
3295 nfsm_reply(2 * NFSX_UNSIGNED);
3296 nfsm_srvwcc_data(for_ret, &bfor, aft_ret, &aft);
3297 return (0);
3298 }
3299 for_ret = VOP_GETATTR(vp, &bfor, cred);
3300 end = (cnt > 0) ? off + cnt : vp->v_size;
3301 if (end < off || end > vp->v_size)
3302 end = vp->v_size;
3303 if (off < vp->v_size)
3304 error = VOP_FSYNC(vp, cred, FSYNC_WAIT, off, end);
3305 /* else error == 0, from nfsrv_fhtovp() */
3306 aft_ret = VOP_GETATTR(vp, &aft, cred);
3307 vput(vp);
3308 nfsm_reply(NFSX_V3WCCDATA + NFSX_V3WRITEVERF);
3309 nfsm_srvwcc_data(for_ret, &bfor, aft_ret, &aft);
3310 if (!error) {
3311 nfsm_build(tl, u_int32_t *, NFSX_V3WRITEVERF);
3312 *tl++ = txdr_unsigned(boottime.tv_sec);
3313 *tl = txdr_unsigned(boottime.tv_nsec / 1000);
3314 } else {
3315 return (0);
3316 }
3317 nfsm_srvdone;
3318}
3319
3320/*
3321 * nfs statfs service
3322 */
3323int
3324nfsrv_statfs(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
3325{
3326 struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
3327 struct mbuf *nam = nfsd->nd_nam;
3328 char *dpos = nfsd->nd_dpos;
3329 kauth_cred_t cred = nfsd->nd_cr;
3330 struct statvfs *sf = NULL;
3331 struct nfs_statfs *sfp;
3332 u_int32_t *tl;
3333 int32_t t1;
3334 char *bpos;
3335 int error = 0, rdonly, cache = 0, getret = 1;
3336 int v3 = (nfsd->nd_flag & ND_NFSV3);
3337 char *cp2;
3338 struct mbuf *mb, *mreq __unused;
3339 struct vnode *vp;
3340 struct vattr at;
3341 nfsrvfh_t nsfh;
3342 u_quad_t frev, tval;
3343
3344 nfsm_srvmtofh(&nsfh);
3345 error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
3346 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
3347 if (error) {
3348 nfsm_reply(NFSX_UNSIGNED);
3349 nfsm_srvpostop_attr(getret, &at);
3350 return (0);
3351 }
3352 sf = malloc(sizeof(*sf), M_TEMP, M_WAITOK);
3353 error = VFS_STATVFS(vp->v_mount, sf);
3354 getret = VOP_GETATTR(vp, &at, cred);
3355 vput(vp);
3356 nfsm_reply(NFSX_POSTOPATTR(v3) + NFSX_STATFS(v3));
3357 if (v3)
3358 nfsm_srvpostop_attr(getret, &at);
3359 if (error) {
3360 free(sf, M_TEMP);
3361 return (0);
3362 }
3363 nfsm_build(sfp, struct nfs_statfs *, NFSX_STATFS(v3));
3364 if (v3) {
3365 tval = (u_quad_t)((quad_t)sf->f_blocks * (quad_t)sf->f_frsize);
3366 txdr_hyper(tval, &sfp->sf_tbytes);
3367 tval = (u_quad_t)((quad_t)sf->f_bfree * (quad_t)sf->f_frsize);
3368 txdr_hyper(tval, &sfp->sf_fbytes);
3369 tval = (u_quad_t)((quad_t)sf->f_bavail * (quad_t)sf->f_frsize);
3370 txdr_hyper(tval, &sfp->sf_abytes);
3371 tval = (u_quad_t)sf->f_files;
3372 txdr_hyper(tval, &sfp->sf_tfiles);
3373 tval = (u_quad_t)sf->f_ffree;
3374 txdr_hyper(tval, &sfp->sf_ffiles);
3375 txdr_hyper(tval, &sfp->sf_afiles);
3376 sfp->sf_invarsec = 0;
3377 } else {
3378 sfp->sf_tsize = txdr_unsigned(NFS_MAXDGRAMDATA);
3379 sfp->sf_bsize = txdr_unsigned(sf->f_frsize);
3380 sfp->sf_blocks = txdr_unsigned(sf->f_blocks);
3381 sfp->sf_bfree = txdr_unsigned(sf->f_bfree);
3382 sfp->sf_bavail = txdr_unsigned(sf->f_bavail);
3383 }
3384nfsmout:
3385 if (sf)
3386 free(sf, M_TEMP);
3387 return error;
3388}
3389
3390/*
3391 * nfs fsinfo service
3392 */
3393int
3394nfsrv_fsinfo(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
3395{
3396 struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
3397 struct mbuf *nam = nfsd->nd_nam;
3398 char *dpos = nfsd->nd_dpos;
3399 kauth_cred_t cred = nfsd->nd_cr;
3400 u_int32_t *tl;
3401 struct nfsv3_fsinfo *sip;
3402 int32_t t1;
3403 char *bpos;
3404 int error = 0, rdonly, cache = 0, getret = 1;
3405 uint32_t maxdata;
3406 char *cp2;
3407 struct mbuf *mb, *mreq __unused;
3408 struct vnode *vp;
3409 struct vattr at;
3410 nfsrvfh_t nsfh;
3411 u_quad_t frev, maxfsize;
3412 struct statvfs *sb;
3413
3414 nfsm_srvmtofh(&nsfh);
3415 error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
3416 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
3417 if (error) {
3418 nfsm_reply(NFSX_UNSIGNED);
3419 nfsm_srvpostop_attr(getret, &at);
3420 return (0);
3421 }
3422
3423 /* XXX Try to make a guess on the max file size. */
3424 sb = malloc(sizeof(*sb), M_TEMP, M_WAITOK);
3425 VFS_STATVFS(vp->v_mount, sb);
3426 maxfsize = (u_quad_t)0x80000000 * sb->f_frsize - 1;
3427 free(sb, M_TEMP);
3428
3429 getret = VOP_GETATTR(vp, &at, cred);
3430 vput(vp);
3431 nfsm_reply(NFSX_V3POSTOPATTR + NFSX_V3FSINFO);
3432 nfsm_srvpostop_attr(getret, &at);
3433 nfsm_build(sip, struct nfsv3_fsinfo *, NFSX_V3FSINFO);
3434
3435 /*
3436 * XXX
3437 * There should be file system VFS OP(s) to get this information.
3438 * For now, assume ufs.
3439 */
3440 if (slp->ns_so->so_type == SOCK_DGRAM)
3441 maxdata = NFS_MAXDGRAMDATA;
3442 else
3443 maxdata = NFS_MAXDATA;
3444 sip->fs_rtmax = txdr_unsigned(maxdata);
3445 sip->fs_rtpref = txdr_unsigned(maxdata);
3446 sip->fs_rtmult = txdr_unsigned(NFS_FABLKSIZE);
3447 sip->fs_wtmax = txdr_unsigned(maxdata);
3448 sip->fs_wtpref = txdr_unsigned(maxdata);
3449 sip->fs_wtmult = txdr_unsigned(NFS_FABLKSIZE);
3450 sip->fs_dtpref = txdr_unsigned(maxdata);
3451 txdr_hyper(maxfsize, &sip->fs_maxfilesize);
3452 sip->fs_timedelta.nfsv3_sec = 0;
3453 sip->fs_timedelta.nfsv3_nsec = txdr_unsigned(1);
3454 sip->fs_properties = txdr_unsigned(NFSV3FSINFO_LINK |
3455 NFSV3FSINFO_SYMLINK | NFSV3FSINFO_HOMOGENEOUS |
3456 NFSV3FSINFO_CANSETTIME);
3457 nfsm_srvdone;
3458}
3459
3460/*
3461 * nfs pathconf service
3462 */
3463int
3464nfsrv_pathconf(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp, struct lwp *lwp, struct mbuf **mrq)
3465{
3466 struct mbuf *mrep = nfsd->nd_mrep, *md = nfsd->nd_md;
3467 struct mbuf *nam = nfsd->nd_nam;
3468 char *dpos = nfsd->nd_dpos;
3469 kauth_cred_t cred = nfsd->nd_cr;
3470 u_int32_t *tl;
3471 struct nfsv3_pathconf *pc;
3472 int32_t t1;
3473 char *bpos;
3474 int error = 0, rdonly, cache = 0, getret = 1;
3475 register_t linkmax, namemax, chownres, notrunc;
3476 char *cp2;
3477 struct mbuf *mb, *mreq __unused;
3478 struct vnode *vp;
3479 struct vattr at;
3480 nfsrvfh_t nsfh;
3481 u_quad_t frev;
3482
3483 nfsm_srvmtofh(&nsfh);
3484 error = nfsrv_fhtovp(&nsfh, 1, &vp, cred, slp, nam,
3485 &rdonly, (nfsd->nd_flag & ND_KERBAUTH), false);
3486 if (error) {
3487 nfsm_reply(NFSX_UNSIGNED);
3488 nfsm_srvpostop_attr(getret, &at);
3489 return (0);
3490 }
3491 error = VOP_PATHCONF(vp, _PC_LINK_MAX, &linkmax);
3492 if (!error)
3493 error = VOP_PATHCONF(vp, _PC_NAME_MAX, &namemax);
3494 if (!error)
3495 error = VOP_PATHCONF(vp, _PC_CHOWN_RESTRICTED, &chownres);
3496 if (!error)
3497 error = VOP_PATHCONF(vp, _PC_NO_TRUNC, &notrunc);
3498 getret = VOP_GETATTR(vp, &at, cred);
3499 vput(vp);
3500 nfsm_reply(NFSX_V3POSTOPATTR + NFSX_V3PATHCONF);
3501 nfsm_srvpostop_attr(getret, &at);
3502 if (error)
3503 return (0);
3504 nfsm_build(pc, struct nfsv3_pathconf *, NFSX_V3PATHCONF);
3505
3506 pc->pc_linkmax = txdr_unsigned(linkmax);
3507 pc->pc_namemax = txdr_unsigned(namemax);
3508 pc->pc_notrunc = txdr_unsigned(notrunc);
3509 pc->pc_chownrestricted = txdr_unsigned(chownres);
3510
3511 /*
3512 * These should probably be supported by VOP_PATHCONF(), but
3513 * until msdosfs is exportable (why would you want to?), the
3514 * Unix defaults should be ok.
3515 */
3516 pc->pc_caseinsensitive = nfs_false;
3517 pc->pc_casepreserving = nfs_true;
3518 nfsm_srvdone;
3519}
3520
3521/*
3522 * Null operation, used by clients to ping server
3523 */
3524/* ARGSUSED */
3525int
3526nfsrv_null(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
3527 struct lwp *lwp, struct mbuf **mrq)
3528{
3529 struct mbuf *mrep = nfsd->nd_mrep;
3530 char *bpos;
3531 int error = NFSERR_RETVOID, cache = 0;
3532 struct mbuf *mb, *mreq __unused;
3533 u_quad_t frev;
3534
3535 nfsm_reply(0);
3536nfsmout:
3537 return (0);
3538}
3539
3540/*
3541 * No operation, used for obsolete procedures
3542 */
3543/* ARGSUSED */
3544int
3545nfsrv_noop(struct nfsrv_descript *nfsd, struct nfssvc_sock *slp,
3546 struct lwp *lwp, struct mbuf **mrq)
3547{
3548 struct mbuf *mrep = nfsd->nd_mrep;
3549 char *bpos;
3550 int error, cache = 0;
3551 struct mbuf *mb, *mreq __unused;
3552 u_quad_t frev;
3553
3554 if (nfsd->nd_repstat)
3555 error = nfsd->nd_repstat;
3556 else
3557 error = EPROCUNAVAIL;
3558 nfsm_reply(0);
3559nfsmout:
3560 return (0);
3561}
3562
3563/*
3564 * Perform access checking for vnodes obtained from file handles that would
3565 * refer to files already opened by a Unix client. You cannot just use
3566 * vn_writechk() and VOP_ACCESS() for two reasons.
3567 * 1 - You must check for exported rdonly as well as MNT_RDONLY for the write case
3568 * 2 - The owner is to be given access irrespective of mode bits for some
3569 * operations, so that processes that chmod after opening a file don't
3570 * break. I don't like this because it opens a security hole, but since
3571 * the nfs server opens a security hole the size of a barn door anyhow,
3572 * what the heck.
3573 *
3574 * The exception to rule 2 is EPERM. If a file is IMMUTABLE, VOP_ACCESS()
3575 * will return EPERM instead of EACCES. EPERM is always an error.
3576 */
3577int
3578nfsrv_access(struct vnode *vp, int flags, kauth_cred_t cred, int rdonly, struct lwp *lwp, int override)
3579{
3580 struct vattr vattr;
3581 int error;
3582 if (flags & VWRITE) {
3583 /* Just vn_writechk() changed to check rdonly */
3584 /*
3585 * Disallow write attempts on read-only file systems;
3586 * unless the file is a socket or a block or character
3587 * device resident on the file system.
3588 */
3589 if (rdonly || (vp->v_mount->mnt_flag & MNT_RDONLY)) {
3590 switch (vp->v_type) {
3591 case VREG:
3592 case VDIR:
3593 case VLNK:
3594 return (EROFS);
3595 default:
3596 break;
3597 }
3598 }
3599
3600 /*
3601 * If the vnode is in use as a process's text,
3602 * we can't allow writing.
3603 */
3604 if (vp->v_iflag & VI_TEXT)
3605 return (ETXTBSY);
3606 }
3607 error = VOP_GETATTR(vp, &vattr, cred);
3608 if (error)
3609 return (error);
3610 error = VOP_ACCESS(vp, flags, cred);
3611 /*
3612 * Allow certain operations for the owner (reads and writes
3613 * on files that are already open).
3614 */
3615 if (override && error == EACCES && kauth_cred_geteuid(cred) == vattr.va_uid)
3616 error = 0;
3617 return error;
3618}
3619