summaryrefslogtreecommitdiffstats
path: root/sys/nfsserver/nfs_srvsubs.c
Commit message (Collapse)AuthorAgeFilesLines
* - Move pubflag and lockflag handling from nfsrv_fhtovp() to nfs_namei() -pjd2010-12-211-14/+15
| | | | | | | | | | | | this is the only place that is different from all the other nfsrv_fhtovp() consumers. This simplifies nfsrv_fhtovp() a bit and also eliminates one vn_lock/VOP_UNLOCK() cycle in case of NFSv3. - Implement NFSRV_FLAG_BUSY flag for nfsrv_fhtovp() that tells it to leave mount point busy. Reviewed by: kib MFC after: 5 days
* On error, unbusy file system and jump to the end, so we won't try to unlockpjd2010-12-211-0/+2
| | | | | | | NULL *vpp. Reviewed by: kib MFC after: 5 days
* After r216626 no extra { } are needed with VFS_UNLOCK_GIANT().pjd2010-12-211-2/+2
|
* Patch the regular NFS server so that it returns ESTALE to the clientrmacklem2010-03-261-0/+3
| | | | | | | | | | for all errors returned by VFS_FHTOVP(). This is required to ensure that EIO doesn't get returned to the client when ZFS is used as the server file system. Tested by: korvus AT comcast.net Reviewed by: jhb MFC after: 2 weeks
* Factor out the code shared between NFS client and server into its ownmarius2010-02-161-0/+1
| | | | | | | | module. With r203732 it became apparent that creating the sysctl nodes twice causes at least a warning, however the whole code shouldn't be present twice in the first place. Discussed with: rmacklem
* Remove the old kernel RPC implementation and the NFS_LEGACYRPC option.dfr2009-06-301-82/+4
| | | | Approved by: re
* Rework the credential code to support larger values of NGROUPS andbrooks2009-06-191-3/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | NGROUPS_MAX, eliminate ABI dependencies on them, and raise the to 1024 and 1023 respectively. (Previously they were equal, but under a close reading of POSIX, NGROUPS_MAX was defined to be too large by 1 since it is the number of supplemental groups, not total number of groups.) The bulk of the change consists of converting the struct ucred member cr_groups from a static array to a pointer. Do the equivalent in kinfo_proc. Introduce new interfaces crcopysafe() and crsetgroups() for duplicating a process credential before modifying it and for setting group lists respectively. Both interfaces take care for the details of allocating groups array. crsetgroups() takes care of truncating the group list to the current maximum (NGROUPS) if necessary. In the future, crsetgroups() may be responsible for insuring invariants such as sorting the supplemental groups to allow groupmember() to be implemented as a binary search. Because we can not change struct xucred without breaking application ABIs, we leave it alone and introduce a new XU_NGROUPS value which is always 16 and is to be used or NGRPS as appropriate for things such as NFS which need to use no more than 16 groups. When feasible, truncate the group list rather than generating an error. Minor changes: - Reduce the number of hand rolled versions of groupmember(). - Do not assign to both cr_gid and cr_groups[0]. - Modify ipfw to cache ucreds instead of part of their contents since they are immutable once referenced by more than one entity. Submitted by: Isilon Systems (initial implementation) X-MFC after: never PR: bin/113398 kern/133867
* Do not embed struct ucred into larger netcred parent structures.kan2009-05-091-0/+3
| | | | | | | | | | | | | Credential might need to hang around longer than its parent and be used outside of mnt_explock scope controlling netcred lifetime. Use separate reference-counted ucred allocated separately instead. While there, extend mnt_explock coverage in vfs_stdexpcheck and clean-up some unused declarations in new NFS code. Reported by: John Hickey PR: kern/133439 Reviewed by: dfr, kib
* Change nfsserver so that it uses the nfssvc() system call providedrmacklem2009-04-121-12/+5
| | | | | | | | | | | in sys/nfs/nfs_nfssvc.c by registering with it using the nfsd_call_nfsserver function pointer. Also, add the build glue for nfs_nfssvc.c optionally based on "nfsserver" and also as a loadable module. Submitted by: rmacklem Reviewed by: kib Approved by: kib (mentor)
* Last step of splitting up minor and unit numbers: remove minor().ed2009-01-281-2/+2
| | | | | | | | | | | | | | | | | | | | | | | Inside the kernel, the minor() function was responsible for obtaining the device minor number of a character device. Because we made device numbers dynamically allocated and independent of the unit number passed to make_dev() a long time ago, it was actually a misnomer. If you really want to obtain the device number, you should use dev2udev(). We already converted all the drivers to use dev2unit() to obtain the device unit number, which is still used by a lot of drivers. I've noticed not a single driver passes NULL to dev2unit(). Even if they would, its behaviour would make little sense. This is why I've removed the NULL check. Ths commit removes minor(), minor2unit() and unit2minor() from the kernel. Because there was a naming collision with uminor(), we can rename umajor() and uminor() back to major() and minor(). This means that the makedev(3) manual page also applies to kernel space code now. I suspect umajor() and uminor() isn't used that often in external code, but to make it easier for other parties to port their code, I've increased __FreeBSD_version to 800062.
* In the nfsrv_fhtovp(), after the vfs_getvfs() function found the pointerkib2008-11-291-3/+6
| | | | | | | | | | | | | | | | | | | to the fs, but before a vnode on the fs is locked, unmount may free fs structures, causing access to destroyed data and freed memory. Introduce a vfs_busymp() function that looks up and busies found fs while mountlist_mtx is held. Use it in nfsrv_fhtovp() and in the implementation of the handle syscalls. Two other uses of the vfs_getvfs() in the vfs_subr.c, namely in sysctl_vfs_ctl and vfs_getnewfsid seems to be ok. In particular, sysctl_vfs_ctl is protected by Giant by being a non-sleeping sysctl handler, that prevents Giant-locked unmount code to interfere with it. Noted by: tegge Reviewed by: dfr Tested by: pho MFC after: 1 month
* Allow v3 GETATTR requests even when weakly authenticated. Change the errordfr2008-11-121-2/+3
| | | | | return for for weakly authenticated requests from REJECTEDCRED to WEAKAUTH for consistency with Solaris.
* Don't depend on krpc.ko in the NFS_LEGACYRPC case.dfr2008-11-061-0/+2
|
* Unbreak NFS.des2008-11-061-0/+1
| | | | Pointy hat to: dfr
* If mountd doesn't specify a secflavor list for the mount, assume that -sec=sysdfr2008-11-051-0/+10
| | | | is what was wanted.
* Implement support for RPCSEC_GSS authentication to both the NFS clientdfr2008-11-031-10/+55
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | and server. This replaces the RPC implementation of the NFS client and server with the newer RPC implementation originally developed (actually ported from the userland sunrpc code) to support the NFS Lock Manager. I have tested this code extensively and I believe it is stable and that performance is at least equal to the legacy RPC implementation. The NFS code currently contains support for both the new RPC implementation and the older legacy implementation inherited from the original NFS codebase. The default is to use the new implementation - add the NFS_LEGACYRPC option to fall back to the old code. When I merge this support back to RELENG_7, I will probably change this so that users have to 'opt in' to get the new code. To use RPCSEC_GSS on either client or server, you must build a kernel which includes the KGSSAPI option and the crypto device. On the userland side, you must build at least a new libc, mountd, mount_nfs and gssd. You must install new versions of /etc/rc.d/gssd and /etc/rc.d/nfsd and add 'gssd_enable=YES' to /etc/rc.conf. As long as gssd is running, you should be able to mount an NFS filesystem from a server that requires RPCSEC_GSS authentication. The mount itself can happen without any kerberos credentials but all access to the filesystem will be denied unless the accessing user has a valid ticket file in the standard place (/tmp/krb5cc_<uid>). There is currently no support for situations where the ticket file is in a different place, such as when the user logged in via SSH and has delegated credentials from that login. This restriction is also present in Solaris and Linux. In theory, we could improve this in future, possibly using Brooks Davis' implementation of variant symlinks. Supporting RPCSEC_GSS on a server is nearly as simple. You must create service creds for the server in the form 'nfs/<fqdn>@<REALM>' and install them in /etc/krb5.keytab. The standard heimdal utility ktutil makes this fairly easy. After the service creds have been created, you can add a '-sec=krb5' option to /etc/exports and restart both mountd and nfsd. The only other difference an administrator should notice is that nfsd doesn't fork to create service threads any more. In normal operation, there will be two nfsd processes, one in userland waiting for TCP connections and one in the kernel handling requests. The latter process will create as many kthreads as required - these should be visible via 'top -H'. The code has some support for varying the number of service threads according to load but initially at least, nfsd uses a fixed number of threads according to the value supplied to its '-n' option. Sponsored by: Isilon Systems MFC after: 1 month
* Decontext-alize the nfsserver module.attilio2008-09-161-2/+2
| | | | | | | Now, only some few places still require thread passing (mostly the ones which access to VOP_* functions) and will be fixed once the primitive also will be. Tested by: Giovanni Trematerra <giovanni dot trematerra at gmail dot com>
* Decontextualize the couplet VOP_GETATTR / VOP_SETATTR as the passed threadattilio2008-08-281-1/+1
| | | | | | was always curthread and totally unuseful. Tested by: Giovanni Trematerra <giovanni dot trematerra at gmail dot com>
* Replaced the misleading uses of a historical artefact M_TRYWAIT with M_WAIT.ru2008-03-251-2/+2
| | | | | | | | | | Removed dead code that assumed that M_TRYWAIT can return NULL; it's not true since the advent of MBUMA. Reviewed by: arch There are ongoing disputes as to whether we want to switch to directly using UMA flags M_WAITOK/M_NOWAIT for mbuf(9) allocation.
* Use nfsrv_destroycache() only once, else it crashes the server.remko2008-01-181-1/+0
| | | | | | | PR: kern/118152 Submitted by: Bjoern Groenvall <bg at sics dot se> Approved by: imp (mentor, a while ago already), jhb MFC After: 3 days
* VOP_LOCK1() (and so VOP_LOCK()) and VOP_UNLOCK() are only used inattilio2008-01-131-5/+4
| | | | | | | | | | | conjuction with 'thread' argument passing which is always curthread. Remove the unuseful extra-argument and pass explicitly curthread to lower layer functions, when necessary. KPI results broken by this change, which should affect several ports, so version bumping and manpage update will be further committed. Tested by: kris, pho, Diego Sardina <siarodx at gmail dot com>
* vn_lock() is currently only used with the 'curthread' passed as argument.attilio2008-01-101-1/+1
| | | | | | | | | | | | | | | | Remove this argument and pass curthread directly to underlying VOP_LOCK1() VFS method. This modify makes the code cleaner and in particular remove an annoying dependence helping next lockmgr() cleanup. KPI results, obviously, changed. Manpage and FreeBSD_version will be updated through further commits. As a side note, would be valuable to say that next commits will address a similar cleanup about VFS methods, in particular vop_lock1 and vop_unlock. Tested by: Diego Sardina <siarodx at gmail dot com>, Andrea Di Pasquale <whyx dot it at gmail dot com>
* Garbage collect now-unused nfsrv_setcred() -- it's not only unused, butrwatson2007-11-041-17/+0
| | | | | | | also a purveyor of unfortunate (and now unsupported) direct frobbing of struct ucred. MFC after: 3 days
* Remove the now-unused NET_{LOCK,UNLOCK,ASSERT}_GIANT() macros, whichrwatson2007-08-061-2/+0
| | | | | | | | | | | | | | | previously conditionally acquired Giant based on debug.mpsafenet. As that has now been removed, they are no longer required. Removing them significantly simplifies error-handling in the socket layer, eliminated quite a bit of unwinding of locking in error cases. While here clean up the now unneeded opt_net.h, which previously was used for the NET_WITH_GIANT kernel option. Clean up some related gotos for consistency. Reviewed by: bz, csjp Tested by: kris Approved by: re (kensmith)
* First in a series of changes to remove the now-unused Giant compatibilityrwatson2007-07-271-4/+1
| | | | | | | | | | | | | | | | | | | | | | | | | framework for non-MPSAFE network protocols: - Remove debug_mpsafenet variable, sysctl, and tunable. - Remove NET_NEEDS_GIANT() and associate SYSINITSs used by it to force debug.mpsafenet=0 if non-MPSAFE protocols are compiled into the kernel. - Remove logic to automatically flag interrupt handlers as non-MPSAFE if debug.mpsafenet is set for an INTR_TYPE_NET handler. - Remove logic to automatically flag netisr handlers as non-MPSAFE if debug.mpsafenet is set. - Remove references in a few subsystems, including NFS and Cronyx drivers, which keyed off debug_mpsafenet to determine various aspects of their own locking behavior. - Convert NET_LOCK_GIANT(), NET_UNLOCK_GIANT(), and NET_ASSERT_GIANT into no-op's, as their entire behavior was determined by the value in debug_mpsafenet. - Alias NET_CALLOUT_MPSAFE to CALLOUT_MPSAFE. Many remaining references to NET_.*_GIANT() and NET_CALLOUT_MPSAFE are still present in subsystems, and will be removed in followup commits. Reviewed by: bz, jhb Approved by: re (kensmith)
* - Split out the part of SYSCALL_MODULE_HELPER() that builds a 'structjhb2007-04-021-9/+12
| | | | | | | | sysent' for a new system call into a new MAKE_SYSENT() macro. - Use MAKE_SYSENT() to build a full sysent for the nfssvc system call in the NFS server and use syscall_register() and syscall_deregister() to manage the nfssvc system call entry instead of manually frobbing the sysent[] array.
* - Turn all explicit giant acquires into conditional VFS_LOCK_GIANTs.jeff2007-03-171-71/+42
| | | | | | | | | | | | | | | Only ops which used namei still remained. - Implement a scheme for reducing the overhead of tracking which vops require giant by constantly reducing the number of recursive giant acquires to one, leaving us with only one vfslocked variable. - Remove all NFSD lock acquisition and release from the individual nfs ops. Careful examination has shown that they are not required. This greatly simplifies the code. Sponsored by: Isilon Systems, Inc. Discussed with: rwatson Tested by: kkenn Approved by: re
* The nfsm_srvpathsiz() macro in nfsrv_symlink() in nfs_serv.c shouldhrs2007-01-021-0/+18
| | | | | | | | | check length of the pathname in the range 0<=n<=NFS_MAXPATHLEN, not 0<n<=NFS_MAXPATHLEN. This fixes a minor interoperability problem that the FreeBSD NFS server did not allow a symlink pointing the empty pathname. MFC after: 1 week
* Push Giant a bit further off the NFS server in a number of straightrwatson2006-11-241-11/+31
| | | | | | | | | | | | | | | | | | | | | | | | forward cases by converting from unconditional acquisition of Giant around vnode operations to conditional acquisition: - Remove nfsrv_access_withgiant(), and cause nfsrv_access() to now assert that Giant will be held if it is required for the vnode. - Add nfsrv_fhtovp_locked(), which will drop the NFS server lock if required, and modify nfsrv_fhtovp() to conditionally acquire Giant if required. - In the VOP's not dealing with more than one vnode at a time (i.e., not involving a lookup), conditionally acquire Giant. This removes Giant use for MPSAFE file systems for a number of quite important RPCs, including getattr, read, write. It leaves unconditional Giant acquisitions in vnode operations that interact with the name space or more than one vnode at a time as these require further work. Tested by: kris Reviewed by: kib
* - Add a new function nfsrv_destroycache() to tear down the server requestjhb2006-08-011-1/+2
| | | | | | | | | cache when unloading the nfsserver module. This fixes a memory leak and a stale pointer. - Use callout_drain() rather than callout_stop() when unloading the nfsserver module. MFC after: 3 days
* Now that all system calls are MPSAFE, retire the SYF_MPSAFE flag used tojhb2006-07-281-1/+2
| | | | | | | | | mark system calls as being MPSAFE: - Stop conditionally acquiring Giant around system call invocations. - Remove all of the 'M' prefixes from the master system call files. - Remove support for the 'M' prefix from the script that generates the syscall-related files from the master system call files. - Don't explicitly set SYF_MPSAFE when registering nfssvc.
* Temporary workaround to prevent leak of Giant from nfsd when callingkib2006-06-051-0/+4
| | | | | | | | | lookup(). Reviewed by: tegge Tested by: "Arno J. Klaassen" <arno at heho snv jussieu fr>, "Rong-en Fan" <grafan at gmail com>, Dmitriy Kirhlarov <dimma at higis ru>, Dmitry Pryanishnikov <dmitry at atlantis dp ua> MFC after: 1 week Approved by: kan, pjd (mentors)
* rick says:cel2006-04-021-0/+6
| | | | | | | | | | | | | | | | | | | | | | The following bug was just identified in OpenBSD and it looks like the same bug exists in the other BSDen NFS servers. A Linux client (don't know which version, but you can look at http://bugzilla.kernel.org/show_bug.cgi?id=6256) does a Setattr of mtime to the server's time, where the file is mode 0664 and the client user has group access (ie. caller is not the file owner). The BSD servers fail the Setattr with EPERM, since the VA_UTIMES_NULL flag isn't set before doing the VOP_SETATTR. It seems to me that this should be allowed, since it is allowed for a local utimes(2). If so, the fix is to set VA_UTIMES_NULL for the "set-time-to-server-time" cases of setting atime and/or mtime. Submitted by: rick@snowhite.cis.uoguelph.ca Reviewed by: cel Approved by: silby MFC after: 1 week
* - Release the references acquired by VOP_GETWRITEMOUNT and vfs_getvfs().jeff2006-03-311-2/+4
| | | | | | Discussed with: tegge Tested by: kris Sponsored by: Isilon Systems, Inc.
* - Reorder calls to vrele() after calls to vput() when the vrele is ajeff2006-02-011-1/+1
| | | | | | | | | | | | directory. vrele() may lock the passed vnode, which in these cases would give an invalid lock order of child -> parent. These situations are deadlock prone although do not typically deadlock because the vrele is typically not releasing the last reference to the vnode. Users of vrele must consider it as a call to vn_lock() and order it appropriately. MFC After: 1 week Sponsored by: Isilon Systems, Inc. Tested by: kkenn
* Use the refcount API to manage the reference count for user credentialsjhb2005-09-271-1/+2
| | | | | | rather than using pool mutexes. Tested on: i386, alpha, sparc64
* avoid potential null ptr deref by free'ing excess mbufs instead ofsam2005-03-281-2/+4
| | | | | | | zero'ing their length (copied from m_adj where this code came from after the equivalent change there has had time to soak) Noticed by: Coverity Prevent analysis tool
* Don't try to create vnode_pager objects on other filesystems vnodes,phk2005-01-241-15/+0
| | | | either they did it themselves or it won't happen.
* Now that we have a non blocking version of nfsm_dissect(), change all theps2005-01-191-16/+16
| | | | | | nfsm_dissect() calls (done under the NFSD lock) to nfsm_dissect_nonblock(). Submitted by: Mohan Srinivasan
* Ditch vfs_object_create() and make the callers call VOP_CREATEVOBJECT()phk2005-01-131-1/+1
| | | | directly.
* /* -> /*- for license, minor formatting changesimp2005-01-071-1/+1
|
* If debug.mpsafenet is non-zero, run the NFS server callout withoutrwatson2004-07-241-1/+4
| | | | Giant.
* Do a pass over all modules in the kernel and make them return EOPNOTSUPPphk2004-07-151-5/+8
| | | | | | | | for unknown events. A number of modules return EINVAL in this instance, and I have left those alone for now and instead taught MOD_QUIESCE to accept this as "didn't do anything".
* Giant wasn't dropped here if we have to return EBUSY. This is bad.bmilekic2004-05-311-1/+3
|
* The NFS server modevent code manually patches the system call table torwatson2004-05-311-1/+1
| | | | | | | | | | | install nfssvc(). It also updates the argument count, but did so without setting SYF_MPSAFE, effectively removing the MPSAFE flag even when syscalls.master indicates it doesn't require Giant. This change forces the modevent to set MPSAFE as a flag to its internal notion of an argument coutn. Note: this duplication of information is a bad thing, but is a more general problem I'm not currently willing to address.
* The socket code upcalls into the NFS server using the so_upcallrwatson2004-05-241-36/+97
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | mechanism so that early processing on mbufs can be performed before a context switch to the NFS server threads. Because of this, if the socket code is running without Giant, the NFS server also needs to be able to run the upcall code without relying on the presence on Giant. This change modifies the NFS server to run using a "giant code lock" covering operation of the whole subsystem. Work is in progress to move to data-based locking as part of the NFSv4 server changes. Introduce an NFS server subsystem lock, 'nfsd_mtx', and a set of macros to operate on the lock: NFSD_LOCK_ASSERT() Assert nfsd_mtx owned by current thread NFSD_UNLOCK_ASSERT() Assert nfsd_mtx not owned by current thread NFSD_LOCK_DONTCARE() Advisory: this function doesn't care NFSD_LOCK() Lock nfsd_mtx NFSD_UNLOCK() Unlock nfsd_mtx Constify a number of global variables/structures in the NFS server code, as they are not modified and contain constants only: nfsrvv2_procid nfsrv_nfsv3_procid nonidempotent nfsv2_repstat nfsv2_type nfsrv_nfsv3_procid nfsrvv2_procid nfsrv_v2errmap nfsv3err_null nfsv3err_getattr nfsv3err_setattr nfsv3err_lookup nfsv3err_access nfsv3err_readlink nfsv3err_read nfsv3err_write nfsv3err_create nfsv3err_mkdir nfsv3err_symlink nfsv3err_mknod nfsv3err_remove nfsv3err_rmdir nfsv3err_rename nfsv3err_link nfsv3err_readdir nfsv3err_readdirplus nfsv3err_fsstat nfsv3err_fsinfo nfsv3err_pathconf nfsv3err_commit nfsrv_v3errmap There are additional structures that should be constified but due to their being passed into general purpose functions without const arguments, I have not yet converted. In general, acquire nfsd_mtx when accessing any of the global NFS structures, including struct nfssvc_sock, struct nfsd, struct nfsrv_descript. Release nfsd_mtx whenever calling into VFS, and acquire Giant for calls into VFS. Giant is not required for any part of the operation of the NFS server with the exception of calls into VFS. Giant will never by acquired in the upcall code path. However, it may operate entirely covered by Giant, or not. If debug.mpsafenet is set to 0, the system calls will acquire Giant across all operations, and the upcall will assert Giant. As such, by default, this enables locking and allows us to test assertions, but should not cause any substantial new amount of code to be run without Giant. Bugs should manifest in the form of lock assertion failures for now. This approach is similar (but not identical) to modifications to the BSD/OS NFS server code snapshot provided by BSDi as part of their SMPng snapshot. The strategy is almost the same (single lock over the NFS server), but differs in the following ways: - Our NFS client and server code bases don't overlap, which means both fewer bugs and easier locking (thanks Peter!). Also means NFSD_*() as opposed to NFS_*(). - We make broad use of assertions, whereas the BSD/OS code does not. - Made slightly different choices about how to handle macros building packets but operating with side effects. - We acquire Giant only when entering VFS from the NFS server daemon threads. - Serious bugs in BSD/OS implementation corrected -- the snapshot we received was clearly a work in progress. Based on ideas from: BSDi SMPng Snapshot Reviewed by: rick@snowhite.cis.uoguelph.ca Extensive testing by: kris
* Don't let the NFS server module be unloaded as long as there arepeadar2004-04-111-0/+2
| | | | | | | nfsd processes running Reviewed By: iedowse PR: 16299
* Remove advertising clause from University of California Regent'simp2004-04-071-4/+0
| | | | | | | license, per letter dated July 22, 1999 and email from Peter Wemm, Alan Cox and Robert Watson. Approved by: core, peter, alc, rwatson
* Convert from timeout to callout API.kan2004-03-071-1/+2
| | | | Submitted by: rwatson
* Fix some becuase -> because typos.jhb2003-12-171-1/+1
| | | | Reported by: Marco Wertejuk <wertejuk@mwcis.com>
OpenPOWER on IntegriCloud