summaryrefslogtreecommitdiffstats
path: root/sys/nfsserver
Commit message (Collapse)AuthorAgeFilesLines
* Switch the default rpc implementation for NFS back to the new code. I believedfr2008-11-141-4/+0
| | | | | | I have fixed the reported problems - if you still have trouble with it, please contact me with as much detail as possible so that I can track down any other issues as quickly as possible.
* Use the remote address for access control, not the local address. This fixesdfr2008-11-131-2/+44
| | | | | | | | the nfsd problems that some people have with the new code. Add support for the vfs.nfsrv.nfs_privport sysctl which denies access unless the client is using a port number less than 1024. Not really sure if this is particularly useful since it doesn't add any real security.
* Temporarily switch NFS back to the old RPC code while I try to diagnose anddfr2008-11-131-0/+4
| | | | | | fix the problems a few people have noticed with the new code. People who want to continue testing the new code or who need RPCSEC_GSS support should use the new option NFS_NEWRPC to select it.
* Turn (NFSERR_AUTHERR|code) status values into svcerr_auth(rqst, code) repliesdfr2008-11-121-2/+7
| | | | instead of returning a success with a bogus NFS error code.
* Allow v3 GETATTR requests even when weakly authenticated. Change the errordfr2008-11-121-2/+3
| | | | | return for for weakly authenticated requests from REJECTEDCRED to WEAKAUTH for consistency with Solaris.
* Range-check NFSv2 procedure numbers before converting to NFSv3.dfr2008-11-071-2/+7
| | | | Submitted by: csjp
* Don't depend on krpc.ko in the NFS_LEGACYRPC case.dfr2008-11-061-0/+2
|
* Unbreak NFS.des2008-11-061-0/+1
| | | | Pointy hat to: dfr
* If mountd doesn't specify a secflavor list for the mount, assume that -sec=sysdfr2008-11-051-0/+10
| | | | is what was wanted.
* Include <sys/eventhandler.h>.dfr2008-11-041-0/+1
|
* Implement support for RPCSEC_GSS authentication to both the NFS clientdfr2008-11-0311-65/+1373
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | and server. This replaces the RPC implementation of the NFS client and server with the newer RPC implementation originally developed (actually ported from the userland sunrpc code) to support the NFS Lock Manager. I have tested this code extensively and I believe it is stable and that performance is at least equal to the legacy RPC implementation. The NFS code currently contains support for both the new RPC implementation and the older legacy implementation inherited from the original NFS codebase. The default is to use the new implementation - add the NFS_LEGACYRPC option to fall back to the old code. When I merge this support back to RELENG_7, I will probably change this so that users have to 'opt in' to get the new code. To use RPCSEC_GSS on either client or server, you must build a kernel which includes the KGSSAPI option and the crypto device. On the userland side, you must build at least a new libc, mountd, mount_nfs and gssd. You must install new versions of /etc/rc.d/gssd and /etc/rc.d/nfsd and add 'gssd_enable=YES' to /etc/rc.conf. As long as gssd is running, you should be able to mount an NFS filesystem from a server that requires RPCSEC_GSS authentication. The mount itself can happen without any kerberos credentials but all access to the filesystem will be denied unless the accessing user has a valid ticket file in the standard place (/tmp/krb5cc_<uid>). There is currently no support for situations where the ticket file is in a different place, such as when the user logged in via SSH and has delegated credentials from that login. This restriction is also present in Solaris and Linux. In theory, we could improve this in future, possibly using Brooks Davis' implementation of variant symlinks. Supporting RPCSEC_GSS on a server is nearly as simple. You must create service creds for the server in the form 'nfs/<fqdn>@<REALM>' and install them in /etc/krb5.keytab. The standard heimdal utility ktutil makes this fairly easy. After the service creds have been created, you can add a '-sec=krb5' option to /etc/exports and restart both mountd and nfsd. The only other difference an administrator should notice is that nfsd doesn't fork to create service threads any more. In normal operation, there will be two nfsd processes, one in userland waiting for TCP connections and one in the kernel handling requests. The latter process will create as many kthreads as required - these should be visible via 'top -H'. The code has some support for varying the number of service threads according to load but initially at least, nfsd uses a fixed number of threads according to the value supplied to its '-n' option. Sponsored by: Isilon Systems MFC after: 1 month
* Document a few sysctls in the NFS client and server code.trhodes2008-11-022-5/+10
| | | | | | Minor style(9) where applicable. Approved by: alfred (slightly older version)
* Introduce accmode_t. This is required for NFSv4 ACLs - it will be neccessarytrasz2008-10-281-5/+6
| | | | | | | to add more V* constants, and the variables changed by this patch were often being assigned to mode_t variables, which is 16 bit. Approved by: rwatson (mentor)
* Rename three MAC entry points from _proc_ to _cred_ to reflect the factrwatson2008-10-281-1/+1
| | | | | | | that they operate directly on credentials: mac_proc_create_swapper(), mac_proc_create_init(), and mac_proc_associate_nfsd(). Update policies. Obtained from: TrustedBSD Project
* Retire the MALLOC and FREE macros. They are an abomination unto style(9).des2008-10-234-31/+31
| | | | MFC after: 3 months
* Turn XXX's for unlocked writes of NFS server statistics to simple notes,rwatson2008-10-121-2/+2
| | | | | | as we consider it a feature to exchange performance for consistency. MFC after: 3 days
* Remove the suser(9) interface from the kernel. It has been replaced fromattilio2008-09-171-2/+4
| | | | | | | | | | | | | | | | | years by the priv_check(9) interface and just very few places are left. Note that compatibility stub with older FreeBSD version (all above the 8 limit though) are left in order to reduce diffs against old versions. It is responsibility of the maintainers for any module, if they think it is the case, to axe out such cases. This patch breaks KPI so __FreeBSD_version will be bumped into a later commit. This patch needs to be credited 50-50 with rwatson@ as he found time to explain me how the priv_check() works in detail and to review patches. Tested by: Giovanni Trematerra <giovanni dot trematerra at gmail dot com> Reviewed by: rwatson
* Decontext-alize the nfsserver module.attilio2008-09-165-101/+91
| | | | | | | Now, only some few places still require thread passing (mostly the ones which access to VOP_* functions) and will be fixed once the primitive also will be. Tested by: Giovanni Trematerra <giovanni dot trematerra at gmail dot com>
* Decontextualize the couplet VOP_GETATTR / VOP_SETATTR as the passed threadattilio2008-08-282-50/+48
| | | | | | was always curthread and totally unuseful. Tested by: Giovanni Trematerra <giovanni dot trematerra at gmail dot com>
* Remove spls from NFS server setup call; expand receive socket bufferrwatson2008-06-301-8/+3
| | | | | | | locking to cover full setup of socket upcalls; remove XXX about locking. MFC after: 3 weeks
* Change the fix in the rev. 1.179 to use nfsrv_lockedpair_nd().kib2008-05-281-6/+2
| | | | | Tested by: pho MFC after: 3 days
* Initialize vfslocked prior to calling nfsm_srvmtofh where it was forgotten.kib2008-05-281-0/+3
| | | | | | Reported by: Andrew Edwards <aedwards sandvine com> Tested by: pho MFC after: 3 days
* Replaced the misleading uses of a historical artefact M_TRYWAIT with M_WAIT.ru2008-03-255-15/+15
| | | | | | | | | | Removed dead code that assumed that M_TRYWAIT can return NULL; it's not true since the advent of MBUMA. Reviewed by: arch There are ongoing disputes as to whether we want to switch to directly using UMA flags M_WAITOK/M_NOWAIT for mbuf(9) allocation.
* - Complete part of the unfinished bufobj work by consistently usingjeff2008-03-221-8/+7
| | | | | | | | | | | | | | | | | BO_LOCK/UNLOCK/MTX when manipulating the bufobj. - Create a new lock in the bufobj to lock bufobj fields independently. This leaves the vnode interlock as an 'identity' lock while the bufobj is an io lock. The bufobj lock is ordered before the vnode interlock and also before the mnt ilock. - Exploit this new lock order to simplify softdep_check_suspend(). - A few sync related functions are marked with a new XXX to note that we may not properly interlock against a non-zero bv_cnt when attempting to sync all vnodes on a mountlist. I do not believe this race is important. If I'm wrong this will make these locations easier to find. Reviewed by: kib (earlier diff) Tested by: kris, pho (earlier diff)
* Fix a regression from the last revision - don't edit the ns_rec list whiledfr2008-03-191-1/+3
| | | | not holding the lock.
* Don't call nfs_realign while holding locks.dfr2008-03-181-4/+5
| | | | Reviewed by: kib
* Fix the Giant leak in the nfsrv_remove().kib2008-03-041-2/+6
| | | | | Reported by: pluknet <pluknet gmail com> MFC after: 1 week
* Use nfsrv_destroycache() only once, else it crashes the server.remko2008-01-181-1/+0
| | | | | | | PR: kern/118152 Submitted by: Bjoern Groenvall <bg at sics dot se> Approved by: imp (mentor, a while ago already), jhb MFC After: 3 days
* VOP_LOCK1() (and so VOP_LOCK()) and VOP_UNLOCK() are only used inattilio2008-01-132-21/+20
| | | | | | | | | | | conjuction with 'thread' argument passing which is always curthread. Remove the unuseful extra-argument and pass explicitly curthread to lower layer functions, when necessary. KPI results broken by this change, which should affect several ports, so version bumping and manpage update will be further committed. Tested by: kris, pho, Diego Sardina <siarodx at gmail dot com>
* vn_lock() is currently only used with the 'curthread' passed as argument.attilio2008-01-102-14/+14
| | | | | | | | | | | | | | | | Remove this argument and pass curthread directly to underlying VOP_LOCK1() VFS method. This modify makes the code cleaner and in particular remove an annoying dependence helping next lockmgr() cleanup. KPI results, obviously, changed. Manpage and FreeBSD_version will be updated through further commits. As a side note, would be valuable to say that next commits will address a similar cleanup about VFS methods, in particular vop_lock1 and vop_unlock. Tested by: Diego Sardina <siarodx at gmail dot com>, Andrea Di Pasquale <whyx dot it at gmail dot com>
* Garbage collect now-unused nfsrv_setcred() -- it's not only unused, butrwatson2007-11-042-18/+0
| | | | | | | also a purveyor of unfortunate (and now unsupported) direct frobbing of struct ucred. MFC after: 3 days
* Rename mac_associate_nfsd_label() to mac_proc_associate_nfsd(), and moverwatson2007-10-251-1/+1
| | | | | | | | | from mac_vfs.c to mac_process.c to join other functions that setup up process labels for specific purposes. Unlike the two proc create calls, this call is intended to run after creation when a process registers as the NFS daemon, so remains an _associate_ call.. Obtained from: TrustedBSD Project
* Add a -z flag to nfsstat which zeros the NFS statistics after displayingjhb2007-10-181-1/+1
| | | | | | | | them. MFC after: 1 week Requested by: ps Submitted by: ps (6 years ago)
* Set the NFS server sockbuf high watermarks to the system defaultsmohans2007-10-121-4/+3
| | | | | | | (up form 32KB). The low highwatermark setting caused UDP fullsock request drops, throttling thruput greatly. Reported by: Kris Kennaway Approved by: re@ (Ken Smith)
* Remove the now-unused NET_{LOCK,UNLOCK,ASSERT}_GIANT() macros, whichrwatson2007-08-063-22/+4
| | | | | | | | | | | | | | | previously conditionally acquired Giant based on debug.mpsafenet. As that has now been removed, they are no longer required. Removing them significantly simplifies error-handling in the socket layer, eliminated quite a bit of unwinding of locking in error cases. While here clean up the now unneeded opt_net.h, which previously was used for the NET_WITH_GIANT kernel option. Clean up some related gotos for consistency. Reviewed by: bz, csjp Tested by: kris Approved by: re (kensmith)
* First in a series of changes to remove the now-unused Giant compatibilityrwatson2007-07-272-12/+3
| | | | | | | | | | | | | | | | | | | | | | | | | framework for non-MPSAFE network protocols: - Remove debug_mpsafenet variable, sysctl, and tunable. - Remove NET_NEEDS_GIANT() and associate SYSINITSs used by it to force debug.mpsafenet=0 if non-MPSAFE protocols are compiled into the kernel. - Remove logic to automatically flag interrupt handlers as non-MPSAFE if debug.mpsafenet is set for an INTR_TYPE_NET handler. - Remove logic to automatically flag netisr handlers as non-MPSAFE if debug.mpsafenet is set. - Remove references in a few subsystems, including NFS and Cronyx drivers, which keyed off debug_mpsafenet to determine various aspects of their own locking behavior. - Convert NET_LOCK_GIANT(), NET_UNLOCK_GIANT(), and NET_ASSERT_GIANT into no-op's, as their entire behavior was determined by the value in debug_mpsafenet. - Alias NET_CALLOUT_MPSAFE to CALLOUT_MPSAFE. Many remaining references to NET_.*_GIANT() and NET_CALLOUT_MPSAFE are still present in subsystems, and will be removed in followup commits. Reviewed by: bz, jhb Approved by: re (kensmith)
* Include priv.h to pick up suser(9) definitions, missed in an earlierrwatson2007-06-131-0/+1
| | | | | | commit. Warnings spotted by: kris
* Init timespec to zero fo quiesce warnings.mjacob2007-06-101-1/+1
|
* Remove MAC Framework access control check entry points made redundant withrwatson2007-04-221-8/+0
| | | | | | | | | | | | | | | | | | the introduction of priv(9) and MAC Framework entry points for privilege checking/granting. These entry points exactly aligned with privileges and provided no additional security context: - mac_check_sysarch_ioperm() - mac_check_kld_unload() - mac_check_settime() - mac_check_system_nfsd() Add mpo_priv_check() implementations to Biba and LOMAC policies, which, for each privilege, determine if they can be granted to processes considered unprivileged by those two policies. These mostly, but not entirely, align with the set of privileges granted in jails. Obtained from: TrustedBSD Project
* Attempt to rationalize NFS privileges:rwatson2007-04-211-1/+1
| | | | | | | | | | | - Replace PRIV_NFSD with PRIV_NFS_DAEMON, add PRIV_NFS_LOCKD. - Use PRIV_NFS_DAEMON in the NFS server. - In the NFS client, move the privilege check from nfslockdans(), which occurs every time a write is performed on /dev/nfslock, and instead do it in nfslock_open() just once. This allows us to avoid checking the saved uid for root, and just use the effective on open. Use PRIV_NFS_LOCKD.
* In nfsrv_rcv(), don't reacquire the nfs server lock until afterrwatson2007-04-151-1/+1
| | | | | | | nfs_realign() has been called, as it may sleep waiting on memory allocation. Reported by: simon
* - Split out the part of SYSCALL_MODULE_HELPER() that builds a 'structjhb2007-04-021-9/+12
| | | | | | | | sysent' for a new system call into a new MAKE_SYSENT() macro. - Use MAKE_SYSENT() to build a full sysent for the nfssvc system call in the NFS server and use syscall_register() and syscall_deregister() to manage the nfssvc system call entry instead of manually frobbing the sysent[] array.
* Initialize vfslocked to 0 before nfsm_srvmtofh() so that the variable isjhb2007-03-261-0/+1
| | | | | | | | not used uninitialized in 'nfsmout' if nfsm_srvmtofh() gets an internal error. CID: 1766 Found by: Coverity Prevent (tm)
* - Turn all explicit giant acquires into conditional VFS_LOCK_GIANTs.jeff2007-03-177-644/+236
| | | | | | | | | | | | | | | Only ops which used namei still remained. - Implement a scheme for reducing the overhead of tracking which vops require giant by constantly reducing the number of recursive giant acquires to one, leaving us with only one vfslocked variable. - Remove all NFSD lock acquisition and release from the individual nfs ops. Careful examination has shown that they are not required. This greatly simplifies the code. Sponsored by: Isilon Systems, Inc. Discussed with: rwatson Tested by: kkenn Approved by: re
* Change these descriptions of memory types used in malloc(9), as theirwkoszek2007-03-051-4/+3
| | | | | | current, rather long strings make output from vmstat -m look unpleasant. Approved by: cognet (mentor)
* Remove 'MPSAFE' annotations from the comments above most system calls: allrwatson2007-03-041-3/+0
| | | | | | | | system calls now enter without Giant held, and then in some cases, acquire Giant explicitly. Remove a number of other MPSAFE annotations in the credential code and tweak one or two other adjacent comments.
* Move vnode-to-file-handle translation from vfs_vptofh to vop_vptofh method.pjd2007-02-151-6/+6
| | | | | | | | | | | | | | | | This way we may support multiple structures in v_data vnode field within one file system without using black magic. Vnode-to-file-handle should be VOP in the first place, but was made VFS operation to keep interface as compatible as possible with SUN's VFS. BTW. Now Solaris also implements vnode-to-file-handle as VOP operation. VFS_VPTOFH() was left for API backward compatibility, but is marked for removal before 8.0-RELEASE. Approved by: mckusick Discussed with: many (on IRC) Tested with: ufs, msdosfs, cd9660, nullfs and zfs
* Get the vfs giant lock before calling nfs_access.mpp2007-02-131-3/+9
| | | | Reviewed by: mohan
* The nfsm_srvpathsiz() macro in nfsrv_symlink() in nfs_serv.c shouldhrs2007-01-022-1/+20
| | | | | | | | | check length of the pathname in the range 0<=n<=NFS_MAXPATHLEN, not 0<n<=NFS_MAXPATHLEN. This fixes a minor interoperability problem that the FreeBSD NFS server did not allow a symlink pointing the empty pathname. MFC after: 1 week
* MFp4: 92972, 98913 + one more changebz2006-12-121-9/+13
| | | | | | | In ip6_sprintf no longer use and return one of eight static buffers for printing/logging ipv6 addresses. The caller now has to hand in a sufficiently large buffer as first argument.
OpenPOWER on IntegriCloud