1/*	$NetBSD: nfs_nfsdkrpc.c,v 1.4 2016/12/13 21:50:32 pgoyette Exp $	*/
2/*-
3 * Copyright (c) 1989, 1993
4 *	The Regents of the University of California.  All rights reserved.
5 *
6 * This code is derived from software contributed to Berkeley by
7 * Rick Macklem at The University of Guelph.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 *    notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 *    notice, this list of conditions and the following disclaimer in the
16 *    documentation and/or other materials provided with the distribution.
17 * 4. Neither the name of the University nor the names of its contributors
18 *    may be used to endorse or promote products derived from this software
19 *    without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 *
33 */
34
35#include <sys/cdefs.h>
36/* __FBSDID("FreeBSD: head/sys/fs/nfsserver/nfs_nfsdkrpc.c 299203 2016-05-06 23:40:37Z pfg "); */
37__RCSID("$NetBSD: nfs_nfsdkrpc.c,v 1.4 2016/12/13 21:50:32 pgoyette Exp $");
38
39#ifdef _KERNEL_OPT
40#include "opt_inet6.h"
41#if 0
42#include "opt_kgssapi.h"
43#endif
44#endif
45
46#include <fs/nfs/common/nfsport.h>
47
48#include <rpc/rpc.h>
49#include <rpc/rpcsec_gss.h>
50
51#include <fs/nfs/common/nfs_fha.h>
52#include <fs/nfs/server/nfs_fha_new.h>
53
54#if 0
55#include <security/mac/mac_framework.h>
56#endif
57
58NFSDLOCKMUTEX;
59NFSV4ROOTLOCKMUTEX;
60struct nfsv4lock nfsd_suspend_lock;
61
62/*
63 * Mapping of old NFS Version 2 RPC numbers to generic numbers.
64 */
65int newnfs_nfsv3_procid[NFS_V3NPROCS] = {
66	NFSPROC_NULL,
67	NFSPROC_GETATTR,
68	NFSPROC_SETATTR,
69	NFSPROC_NOOP,
70	NFSPROC_LOOKUP,
71	NFSPROC_READLINK,
72	NFSPROC_READ,
73	NFSPROC_NOOP,
74	NFSPROC_WRITE,
75	NFSPROC_CREATE,
76	NFSPROC_REMOVE,
77	NFSPROC_RENAME,
78	NFSPROC_LINK,
79	NFSPROC_SYMLINK,
80	NFSPROC_MKDIR,
81	NFSPROC_RMDIR,
82	NFSPROC_READDIR,
83	NFSPROC_FSSTAT,
84	NFSPROC_NOOP,
85	NFSPROC_NOOP,
86	NFSPROC_NOOP,
87	NFSPROC_NOOP,
88};
89
90
91SYSCTL_DECL(_vfs_nfsd);
92
93SVCPOOL		*nfsrvd_pool;
94
95static int	nfs_privport = 0;
96SYSCTL_INT(_vfs_nfsd, OID_AUTO, nfs_privport, CTLFLAG_RWTUN,
97    &nfs_privport, 0,
98    "Only allow clients using a privileged port for NFSv2 and 3");
99
100static int	nfs_minvers = NFS_VER2;
101SYSCTL_INT(_vfs_nfsd, OID_AUTO, server_min_nfsvers, CTLFLAG_RWTUN,
102    &nfs_minvers, 0, "The lowest version of NFS handled by the server");
103
104static int	nfs_maxvers = NFS_VER4;
105SYSCTL_INT(_vfs_nfsd, OID_AUTO, server_max_nfsvers, CTLFLAG_RWTUN,
106    &nfs_maxvers, 0, "The highest version of NFS handled by the server");
107
108static int nfs_proc(struct nfsrv_descript *, u_int32_t, SVCXPRT *xprt,
109    struct nfsrvcache **);
110
111extern u_long sb_max_adj;
112extern int newnfs_numnfsd;
113extern struct proc *nfsd_master_proc;
114
115/*
116 * NFS server system calls
117 */
118
119static void
120nfssvc_program(struct svc_req *rqst, SVCXPRT *xprt)
121{
122	struct nfsrv_descript nd;
123	struct nfsrvcache *rp = NULL;
124	int cacherep, credflavor;
125
126	memset(&nd, 0, sizeof(nd));
127	if (rqst->rq_vers == NFS_VER2) {
128		if (rqst->rq_proc > NFSV2PROC_STATFS ||
129		    newnfs_nfsv3_procid[rqst->rq_proc] == NFSPROC_NOOP) {
130			svcerr_noproc(rqst);
131			svc_freereq(rqst);
132			goto out;
133		}
134		nd.nd_procnum = newnfs_nfsv3_procid[rqst->rq_proc];
135		nd.nd_flag = ND_NFSV2;
136	} else if (rqst->rq_vers == NFS_VER3) {
137		if (rqst->rq_proc >= NFS_V3NPROCS) {
138			svcerr_noproc(rqst);
139			svc_freereq(rqst);
140			goto out;
141		}
142		nd.nd_procnum = rqst->rq_proc;
143		nd.nd_flag = ND_NFSV3;
144	} else {
145		if (rqst->rq_proc != NFSPROC_NULL &&
146		    rqst->rq_proc != NFSV4PROC_COMPOUND) {
147			svcerr_noproc(rqst);
148			svc_freereq(rqst);
149			goto out;
150		}
151		nd.nd_procnum = rqst->rq_proc;
152		nd.nd_flag = ND_NFSV4;
153	}
154
155	/*
156	 * Note: we want rq_addr, not svc_getrpccaller for nd_nam2 -
157	 * NFS_SRVMAXDATA uses a NULL value for nd_nam2 to detect TCP
158	 * mounts.
159	 */
160	nd.nd_mrep = rqst->rq_args;
161	rqst->rq_args = NULL;
162	newnfs_realign(&nd.nd_mrep, M_WAITOK);
163	nd.nd_md = nd.nd_mrep;
164	nd.nd_dpos = mtod(nd.nd_md, caddr_t);
165	nd.nd_nam = svc_getrpccaller(rqst);
166	nd.nd_nam2 = rqst->rq_addr;
167	nd.nd_mreq = NULL;
168	nd.nd_cred = NULL;
169
170	if (nfs_privport && (nd.nd_flag & ND_NFSV4) == 0) {
171		/* Check if source port is privileged */
172		u_short port;
173		struct sockaddr *nam = nd.nd_nam;
174		struct sockaddr_in *sin;
175
176		sin = (struct sockaddr_in *)nam;
177		/*
178		 * INET/INET6 - same code:
179		 *    sin_port and sin6_port are at same offset
180		 */
181		port = ntohs(sin->sin_port);
182		if (port >= IPPORT_RESERVED &&
183		    nd.nd_procnum != NFSPROC_NULL) {
184#ifdef INET6
185			char b6[INET6_ADDRSTRLEN];
186#if defined(_MODULE)
187			/* Do not use ip6_sprintf: the nfs module should work without INET6. */
188#define	ip6_sprintf(buf, a)						\
189			(snprintf((buf), sizeof(buf), "%x:%x:%x:%x:%x:%x:%x:%x",	\
190			    (a)->s6_addr16[0], (a)->s6_addr16[1],	\
191			    (a)->s6_addr16[2], (a)->s6_addr16[3],	\
192			    (a)->s6_addr16[4], (a)->s6_addr16[5],	\
193			    (a)->s6_addr16[6], (a)->s6_addr16[7]),	\
194			    (buf))
195#endif
196#endif
197			printf("NFS request from unprivileged port (%s:%d)\n",
198#ifdef INET6
199			    sin->sin_family == AF_INET6 ?
200			    ip6_sprintf(b6, &satosin6(sin)->sin6_addr) :
201#if defined(_MODULE)
202#undef ip6_sprintf
203#endif
204#endif
205			    inet_ntoa(sin->sin_addr), port);
206			svcerr_weakauth(rqst);
207			svc_freereq(rqst);
208			m_freem(nd.nd_mrep);
209			goto out;
210		}
211	}
212
213	if (nd.nd_procnum != NFSPROC_NULL) {
214		if (!svc_getcred(rqst, &nd.nd_cred, &credflavor)) {
215			svcerr_weakauth(rqst);
216			svc_freereq(rqst);
217			m_freem(nd.nd_mrep);
218			goto out;
219		}
220
221		/* Set the flag based on credflavor */
222		if (credflavor == RPCSEC_GSS_KRB5) {
223			nd.nd_flag |= ND_GSS;
224		} else if (credflavor == RPCSEC_GSS_KRB5I) {
225			nd.nd_flag |= (ND_GSS | ND_GSSINTEGRITY);
226		} else if (credflavor == RPCSEC_GSS_KRB5P) {
227			nd.nd_flag |= (ND_GSS | ND_GSSPRIVACY);
228		} else if (credflavor != AUTH_SYS) {
229			svcerr_weakauth(rqst);
230			svc_freereq(rqst);
231			m_freem(nd.nd_mrep);
232			goto out;
233		}
234
235#ifdef MAC
236		mac_cred_associate_nfsd(nd.nd_cred);
237#endif
238		/*
239		 * Get a refcnt (shared lock) on nfsd_suspend_lock.
240		 * NFSSVC_SUSPENDNFSD will take an exclusive lock on
241		 * nfsd_suspend_lock to suspend these threads.
242		 * The call to nfsv4_lock() that precedes nfsv4_getref()
243		 * ensures that the acquisition of the exclusive lock
244		 * takes priority over acquisition of the shared lock by
245		 * waiting for any exclusive lock request to complete.
246		 * This must be done here, before the check of
247		 * nfsv4root exports by nfsvno_v4rootexport().
248		 */
249		NFSLOCKV4ROOTMUTEX();
250		nfsv4_lock(&nfsd_suspend_lock, 0, NULL, NFSV4ROOTLOCKMUTEXPTR,
251		    NULL);
252		nfsv4_getref(&nfsd_suspend_lock, NULL, NFSV4ROOTLOCKMUTEXPTR,
253		    NULL);
254		NFSUNLOCKV4ROOTMUTEX();
255
256		if ((nd.nd_flag & ND_NFSV4) != 0) {
257			nd.nd_repstat = nfsvno_v4rootexport(&nd);
258			if (nd.nd_repstat != 0) {
259				NFSLOCKV4ROOTMUTEX();
260				nfsv4_relref(&nfsd_suspend_lock);
261				NFSUNLOCKV4ROOTMUTEX();
262				svcerr_weakauth(rqst);
263				svc_freereq(rqst);
264				m_freem(nd.nd_mrep);
265				goto out;
266			}
267		}
268
269		cacherep = nfs_proc(&nd, rqst->rq_xid, xprt, &rp);
270		NFSLOCKV4ROOTMUTEX();
271		nfsv4_relref(&nfsd_suspend_lock);
272		NFSUNLOCKV4ROOTMUTEX();
273	} else {
274		NFSMGET(nd.nd_mreq);
275		nd.nd_mreq->m_len = 0;
276		cacherep = RC_REPLY;
277	}
278	if (nd.nd_mrep != NULL)
279		m_freem(nd.nd_mrep);
280
281	if (nd.nd_cred != NULL)
282		crfree(nd.nd_cred);
283
284	if (cacherep == RC_DROPIT) {
285		if (nd.nd_mreq != NULL)
286			m_freem(nd.nd_mreq);
287		svc_freereq(rqst);
288		goto out;
289	}
290
291	if (nd.nd_mreq == NULL) {
292		svcerr_decode(rqst);
293		svc_freereq(rqst);
294		goto out;
295	}
296
297	if (nd.nd_repstat & NFSERR_AUTHERR) {
298		svcerr_auth(rqst, nd.nd_repstat & ~NFSERR_AUTHERR);
299		if (nd.nd_mreq != NULL)
300			m_freem(nd.nd_mreq);
301	} else if (!svc_sendreply_mbuf(rqst, nd.nd_mreq)) {
302		svcerr_systemerr(rqst);
303	}
304	if (rp != NULL) {
305		nfsrvd_sentcache(rp, (rqst->rq_reply_seq != 0 ||
306		    SVC_ACK(xprt, NULL)), rqst->rq_reply_seq);
307	}
308	svc_freereq(rqst);
309
310out:
311	if (softdep_ast_cleanup != NULL)
312		softdep_ast_cleanup();
313	NFSEXITCODE(0);
314}
315
316/*
317 * Check the cache and, optionally, do the RPC.
318 * Return the appropriate cache response.
319 */
320static int
321nfs_proc(struct nfsrv_descript *nd, u_int32_t xid, SVCXPRT *xprt,
322    struct nfsrvcache **rpp)
323{
324	struct thread *td = curthread;
325	int cacherep = RC_DOIT, isdgram, taglen = -1;
326	struct mbuf *m;
327	u_char tag[NFSV4_SMALLSTR + 1], *tagstr = NULL;
328	u_int32_t minorvers = 0;
329	uint32_t ack;
330
331	*rpp = NULL;
332	if (nd->nd_nam2 == NULL) {
333		nd->nd_flag |= ND_STREAMSOCK;
334		isdgram = 0;
335	} else {
336		isdgram = 1;
337	}
338
339	/*
340	 * Two cases:
341	 * 1 - For NFSv2 over UDP, if we are near our malloc/mget
342	 *     limit, just drop the request. There is no
343	 *     NFSERR_RESOURCE or NFSERR_DELAY for NFSv2 and the
344	 *     client will timeout/retry over UDP in a little while.
345	 * 2 - nd_repstat == 0 && nd_mreq == NULL, which
346	 *     means a normal nfs rpc, so check the cache
347	 */
348	if ((nd->nd_flag & ND_NFSV2) && nd->nd_nam2 != NULL &&
349	    nfsrv_mallocmget_limit()) {
350		cacherep = RC_DROPIT;
351	} else {
352		/*
353		 * For NFSv3, play it safe and assume that the client is
354		 * doing retries on the same TCP connection.
355		 */
356		if ((nd->nd_flag & (ND_NFSV4 | ND_STREAMSOCK)) ==
357		    ND_STREAMSOCK)
358			nd->nd_flag |= ND_SAMETCPCONN;
359		nd->nd_retxid = xid;
360		nd->nd_tcpconntime = NFSD_MONOSEC;
361		nd->nd_sockref = xprt->xp_sockref;
362		if ((nd->nd_flag & ND_NFSV4) != 0)
363			nfsd_getminorvers(nd, tag, &tagstr, &taglen,
364			    &minorvers);
365		if ((nd->nd_flag & ND_NFSV41) != 0)
366			/* NFSv4.1 caches replies in the session slots. */
367			cacherep = RC_DOIT;
368		else {
369			cacherep = nfsrvd_getcache(nd);
370			ack = 0;
371			SVC_ACK(xprt, &ack);
372			nfsrc_trimcache(xprt->xp_sockref, ack, 0);
373		}
374	}
375
376	/*
377	 * Handle the request. There are three cases.
378	 * RC_DOIT - do the RPC
379	 * RC_REPLY - return the reply already created
380	 * RC_DROPIT - just throw the request away
381	 */
382	if (cacherep == RC_DOIT) {
383		if ((nd->nd_flag & ND_NFSV41) != 0)
384			nd->nd_xprt = xprt;
385		nfsrvd_dorpc(nd, isdgram, tagstr, taglen, minorvers, td);
386		if ((nd->nd_flag & ND_NFSV41) != 0) {
387			if (nd->nd_repstat != NFSERR_REPLYFROMCACHE &&
388			    (nd->nd_flag & ND_SAVEREPLY) != 0) {
389				/* Cache a copy of the reply. */
390				m = m_copym(nd->nd_mreq, 0, M_COPYALL,
391				    M_WAITOK);
392			} else
393				m = NULL;
394			if ((nd->nd_flag & ND_HASSEQUENCE) != 0)
395				nfsrv_cache_session(nd->nd_sessionid,
396				    nd->nd_slotid, nd->nd_repstat, &m);
397			if (nd->nd_repstat == NFSERR_REPLYFROMCACHE)
398				nd->nd_repstat = 0;
399			cacherep = RC_REPLY;
400		} else {
401			if (nd->nd_repstat == NFSERR_DONTREPLY)
402				cacherep = RC_DROPIT;
403			else
404				cacherep = RC_REPLY;
405			*rpp = nfsrvd_updatecache(nd);
406		}
407	}
408	if (tagstr != NULL && taglen > NFSV4_SMALLSTR)
409		free(tagstr, M_TEMP);
410
411	NFSEXITCODE2(0, nd);
412	return (cacherep);
413}
414
415static void
416nfssvc_loss(SVCXPRT *xprt)
417{
418	uint32_t ack;
419
420	ack = 0;
421	SVC_ACK(xprt, &ack);
422	nfsrc_trimcache(xprt->xp_sockref, ack, 1);
423}
424
425/*
426 * Adds a socket to the list for servicing by nfsds.
427 */
428int
429nfsrvd_addsock(struct file *fp)
430{
431	int siz;
432	struct socket *so;
433	int error = 0;
434	SVCXPRT *xprt;
435	static u_int64_t sockref = 0;
436
437	so = fp->f_data;
438
439	siz = sb_max_adj;
440	error = soreserve(so, siz, siz);
441	if (error)
442		goto out;
443
444	/*
445	 * Steal the socket from userland so that it doesn't close
446	 * unexpectedly.
447	 */
448	if (so->so_type == SOCK_DGRAM)
449		xprt = svc_dg_create(nfsrvd_pool, so, 0, 0);
450	else
451		xprt = svc_vc_create(nfsrvd_pool, so, 0, 0);
452	if (xprt) {
453		fp->f_ops = &badfileops;
454		fp->f_data = NULL;
455		xprt->xp_sockref = ++sockref;
456		if (nfs_minvers == NFS_VER2)
457			svc_reg(xprt, NFS_PROG, NFS_VER2, nfssvc_program,
458			    NULL);
459		if (nfs_minvers <= NFS_VER3 && nfs_maxvers >= NFS_VER3)
460			svc_reg(xprt, NFS_PROG, NFS_VER3, nfssvc_program,
461			    NULL);
462		if (nfs_maxvers >= NFS_VER4)
463			svc_reg(xprt, NFS_PROG, NFS_VER4, nfssvc_program,
464			    NULL);
465		if (so->so_type == SOCK_STREAM)
466			svc_loss_reg(xprt, nfssvc_loss);
467		SVC_RELEASE(xprt);
468	}
469
470out:
471	NFSEXITCODE(error);
472	return (error);
473}
474
475/*
476 * Called by nfssvc() for nfsds. Just loops around servicing rpc requests
477 * until it is killed by a signal.
478 */
479int
480nfsrvd_nfsd(struct thread *td, struct nfsd_nfsd_args *args)
481{
482	char principal[MAXHOSTNAMELEN + 5];
483	struct proc *p;
484	int error = 0;
485	bool_t ret2, ret3, ret4;
486
487	error = copyinstr(args->principal, principal, sizeof (principal),
488	    NULL);
489	if (error)
490		goto out;
491
492	/*
493	 * Only the first nfsd actually does any work. The RPC code
494	 * adds threads to it as needed. Any extra processes offered
495	 * by nfsd just exit. If nfsd is new enough, it will call us
496	 * once with a structure that specifies how many threads to
497	 * use.
498	 */
499	NFSD_LOCK();
500	if (newnfs_numnfsd == 0) {
501		p = td->td_proc;
502		PROC_LOCK(p);
503		p->p_flag2 |= P2_AST_SU;
504		PROC_UNLOCK(p);
505		newnfs_numnfsd++;
506
507		NFSD_UNLOCK();
508
509		/* An empty string implies AUTH_SYS only. */
510		if (principal[0] != '\0') {
511			ret2 = rpc_gss_set_svc_name_call(principal,
512			    "kerberosv5", GSS_C_INDEFINITE, NFS_PROG, NFS_VER2);
513			ret3 = rpc_gss_set_svc_name_call(principal,
514			    "kerberosv5", GSS_C_INDEFINITE, NFS_PROG, NFS_VER3);
515			ret4 = rpc_gss_set_svc_name_call(principal,
516			    "kerberosv5", GSS_C_INDEFINITE, NFS_PROG, NFS_VER4);
517
518			if (!ret2 || !ret3 || !ret4)
519				printf("nfsd: can't register svc name\n");
520		}
521
522		nfsrvd_pool->sp_minthreads = args->minthreads;
523		nfsrvd_pool->sp_maxthreads = args->maxthreads;
524
525		svc_run(nfsrvd_pool);
526
527		if (principal[0] != '\0') {
528			rpc_gss_clear_svc_name_call(NFS_PROG, NFS_VER2);
529			rpc_gss_clear_svc_name_call(NFS_PROG, NFS_VER3);
530			rpc_gss_clear_svc_name_call(NFS_PROG, NFS_VER4);
531		}
532
533		NFSD_LOCK();
534		newnfs_numnfsd--;
535		nfsrvd_init(1);
536		PROC_LOCK(p);
537		p->p_flag2 &= ~P2_AST_SU;
538		PROC_UNLOCK(p);
539	}
540	NFSD_UNLOCK();
541
542out:
543	NFSEXITCODE(error);
544	return (error);
545}
546
547/*
548 * Initialize the data structures for the server.
549 * Handshake with any new nfsds starting up to avoid any chance of
550 * corruption.
551 */
552void
553nfsrvd_init(int terminating)
554{
555
556	NFSD_LOCK_ASSERT();
557
558	if (terminating) {
559		nfsd_master_proc = NULL;
560		NFSD_UNLOCK();
561		nfsrv_freeallbackchannel_xprts();
562		svcpool_destroy(nfsrvd_pool);
563		nfsrvd_pool = NULL;
564		NFSD_LOCK();
565	}
566
567	NFSD_UNLOCK();
568
569	nfsrvd_pool = svcpool_create("nfsd", SYSCTL_STATIC_CHILDREN(_vfs_nfsd));
570	nfsrvd_pool->sp_rcache = NULL;
571	nfsrvd_pool->sp_assign = fhanew_assign;
572	nfsrvd_pool->sp_done = fha_nd_complete;
573
574	NFSD_LOCK();
575}
576
577