2 * Copyright (c) 1999 Apple Computer, Inc. All rights reserved.
4 * @APPLE_LICENSE_HEADER_START@
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. Please obtain a copy of the License at
10 * http://www.opensource.apple.com/apsl/ and read it before using this
13 * The Original Code and all software distributed under the License are
14 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
15 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
16 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
17 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
18 * Please see the License for the specific language governing rights and
19 * limitations under the License.
21 * @APPLE_LICENSE_HEADER_END@
24 * Copyright (c) 1989, 1993, 1994
25 * The Regents of the University of California. All rights reserved.
27 * This code is derived from software contributed to Berkeley by
28 * Rick Macklem at The University of Guelph.
30 * Redistribution and use in source and binary forms, with or without
31 * modification, are permitted provided that the following conditions
33 * 1. Redistributions of source code must retain the above copyright
34 * notice, this list of conditions and the following disclaimer.
35 * 2. Redistributions in binary form must reproduce the above copyright
36 * notice, this list of conditions and the following disclaimer in the
37 * documentation and/or other materials provided with the distribution.
38 * 3. All advertising materials mentioning features or use of this software
39 * must display the following acknowledgement:
40 * This product includes software developed by the University of
41 * California, Berkeley and its contributors.
42 * 4. Neither the name of the University nor the names of its contributors
43 * may be used to endorse or promote products derived from this software
44 * without specific prior written permission.
46 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
47 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
48 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
49 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
50 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
51 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
52 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
53 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
54 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
55 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
60 #include <sys/param.h>
61 #include <sys/syslog.h>
62 #include <sys/ioctl.h>
66 #include <sys/ucred.h>
67 #include <sys/mount.h>
68 #include <sys/socket.h>
69 #include <sys/socketvar.h>
72 #include <rpc/pmap_clnt.h>
73 #include <rpc/pmap_prot.h>
76 #include <netiso/iso.h>
78 #include <nfs/rpcv2.h>
79 #include <nfs/nfsproto.h>
83 #include <kerberosIV/des.h>
84 #include <kerberosIV/krb.h>
100 #define syslog(e, s) fprintf(stderr,(s))
106 struct nfsd_srvargs nsd
;
107 char **Argv
= NULL
; /* pointer to argument vector */
108 char *LastArg
= NULL
; /* end of argv */
115 struct nfsrpc_fullblock kin
, kout
;
116 struct nfsrpc_fullverf kverf
;
119 NFSKERBKEYSCHED_T kerb_keysched
;
122 void nonfs
__P((int));
123 void reapchild
__P((int));
124 void setproctitle
__P((char *));
125 void usage
__P((void));
128 * Nfs server daemon mostly just a user context for nfssvc()
130 * 1 - do file descriptor and signal cleanup
131 * 2 - fork the nfsd(s)
132 * 3 - create server socket(s)
133 * 4 - register socket with portmap
135 * For connectionless protocols, just pass the socket into the kernel via.
137 * For connection based sockets, loop doing accepts. When you get a new
138 * socket from accept, pass the msgsock into the kernel via. nfssvc().
140 * -c - support iso cltp clients
141 * -r - reregister with portmapper
142 * -t - support tcp nfs clients
143 * -u - support udp nfs clients
144 * followed by "n" which is the number of nfsds' to fork off
147 main(argc
, argv
, envp
)
149 char *argv
[], *envp
[];
153 struct nfsd_args nfsdargs
;
156 struct sockaddr_in inetaddr
, inetpeer
;
158 struct sockaddr_iso isoaddr
, isopeer
;
161 fd_set ready
, sockbits
;
162 int ch
, cltpflag
, connect_type_cnt
, i
, len
, maxsock
, msgsock
;
163 int nfsdcnt
, nfssvc_flag
, on
, reregister
, sock
, tcpflag
, tcpsock
;
164 int tp4cnt
, tp4flag
, tp4sock
, tpipcnt
, tpipflag
, tpipsock
, udpflag
;
167 /* Save start and extent of argv for setproctitle. */
169 if (envp
== 0 || *envp
== 0)
173 LastArg
= envp
[-1] + strlen(envp
[-1]);
175 #define MAXNFSDCNT 64
177 nfsdcnt
= DEFNFSDCNT
;
178 cltpflag
= reregister
= tcpflag
= tp4cnt
= tp4flag
= tpipcnt
= 0;
179 tpipflag
= udpflag
= 0;
181 #define GETOPT "cn:rtu"
182 #define USAGE "[-crtu] [-n num_servers]"
184 #define GETOPT "n:rtu"
185 #define USAGE "[-rtu] [-n num_servers]"
187 while ((ch
= getopt(argc
, argv
, GETOPT
)) != EOF
)
190 nfsdcnt
= atoi(optarg
);
191 if (nfsdcnt
< 1 || nfsdcnt
> MAXNFSDCNT
) {
192 warnx("nfsd count %d; reset to %d", nfsdcnt
, DEFNFSDCNT
);
193 nfsdcnt
= DEFNFSDCNT
;
227 * Backward compatibility, trailing number is the count of daemons.
232 nfsdcnt
= atoi(argv
[0]);
233 if (nfsdcnt
< 1 || nfsdcnt
> MAXNFSDCNT
) {
234 warnx("nfsd count %d; reset to %d", nfsdcnt
, DEFNFSDCNT
);
235 nfsdcnt
= DEFNFSDCNT
;
241 (void)signal(SIGHUP
, SIG_IGN
);
242 (void)signal(SIGINT
, SIG_IGN
);
243 (void)signal(SIGQUIT
, SIG_IGN
);
244 (void)signal(SIGSYS
, nonfs
);
245 (void)signal(SIGTERM
, SIG_IGN
);
247 (void)signal(SIGCHLD
, reapchild
);
251 (!pmap_set(RPCPROG_NFS
, 2, IPPROTO_UDP
, NFS_PORT
) ||
252 !pmap_set(RPCPROG_NFS
, 3, IPPROTO_UDP
, NFS_PORT
)))
253 err(1, "can't register with portmap for UDP.");
255 (!pmap_set(RPCPROG_NFS
, 2, IPPROTO_TCP
, NFS_PORT
) ||
256 !pmap_set(RPCPROG_NFS
, 3, IPPROTO_TCP
, NFS_PORT
)))
257 err(1, "can't register with portmap for TCP.");
260 openlog("nfsd:", LOG_PID
, LOG_DAEMON
);
262 for (i
= 0; i
< nfsdcnt
; i
++) {
265 syslog(LOG_ERR
, "fork: %m");
273 setproctitle("server");
274 nfssvc_flag
= NFSSVC_NFSD
;
277 if (sizeof (struct nfsrpc_fullverf
) != RPCX_FULLVERF
||
278 sizeof (struct nfsrpc_fullblock
) != RPCX_FULLBLOCK
)
279 syslog(LOG_ERR
, "Yikes NFSKERB structs not packed!");
280 nsd
.nsd_authstr
= (u_char
*)&kt
;
281 nsd
.nsd_authlen
= sizeof (kt
);
282 nsd
.nsd_verfstr
= (u_char
*)&kverf
;
283 nsd
.nsd_verflen
= sizeof (kverf
);
285 while (nfssvc(nfssvc_flag
, &nsd
) < 0) {
286 if (errno
!= ENEEDAUTH
) {
287 syslog(LOG_ERR
, "nfssvc: %m");
290 nfssvc_flag
= NFSSVC_NFSD
| NFSSVC_AUTHINFAIL
;
293 * Get the Kerberos ticket out of the authenticator
294 * verify it and convert the principal name to a user
295 * name. The user name is then converted to a set of
296 * user credentials via the password and group file.
297 * Finally, decrypt the timestamp and validate it.
298 * For more info see the IETF Draft "Authentication
301 kt
.length
= ntohl(kt
.length
);
302 if (gettimeofday(&ktv
, (struct timezone
*)0) == 0 &&
303 kt
.length
> 0 && kt
.length
<=
304 (RPCAUTH_MAXSIZ
- 3 * NFSX_UNSIGNED
)) {
305 kin
.w1
= NFS_KERBW1(kt
);
307 (void)strcpy(inst
, "*");
308 if (krb_rd_req(&kt
, NFS_KERBSRV
,
309 inst
, nsd
.nsd_haddr
, &kauth
, "") == RD_AP_OK
&&
310 krb_kntoln(&kauth
, lnam
) == KSUCCESS
&&
311 (pwd
= getpwnam(lnam
)) != NULL
) {
313 cr
->cr_uid
= pwd
->pw_uid
;
314 cr
->cr_groups
[0] = pwd
->pw_gid
;
317 while ((grp
= getgrent()) != NULL
) {
318 if (grp
->gr_gid
== cr
->cr_groups
[0])
320 for (cpp
= grp
->gr_mem
;
322 if (!strcmp(*cpp
, lnam
))
326 cr
->cr_groups
[cr
->cr_ngroups
++]
328 if (cr
->cr_ngroups
== NGROUPS
)
334 * Get the timestamp verifier out of the
335 * authenticator and verifier strings.
340 bzero((caddr_t
)kivec
, sizeof (kivec
));
341 bcopy((caddr_t
)kauth
.session
,
342 (caddr_t
)nsd
.nsd_key
,sizeof(kauth
.session
));
345 * Decrypt the timestamp verifier in CBC mode.
350 * Validate the timestamp verifier, to
351 * check that the session key is ok.
353 nsd
.nsd_timestamp
.tv_sec
= ntohl(kout
.t1
);
354 nsd
.nsd_timestamp
.tv_usec
= ntohl(kout
.t2
);
355 nsd
.nsd_ttl
= ntohl(kout
.w1
);
356 if ((nsd
.nsd_ttl
- 1) == ntohl(kout
.w2
))
357 nfssvc_flag
= NFSSVC_NFSD
| NFSSVC_AUTHIN
;
364 /* If we are serving udp, set up the socket. */
366 if ((sock
= socket(AF_INET
, SOCK_DGRAM
, 0)) < 0) {
367 syslog(LOG_ERR
, "can't create udp socket");
370 inetaddr
.sin_family
= AF_INET
;
371 inetaddr
.sin_addr
.s_addr
= INADDR_ANY
;
372 inetaddr
.sin_port
= htons(NFS_PORT
);
373 inetaddr
.sin_len
= sizeof(inetaddr
);
375 (struct sockaddr
*)&inetaddr
, sizeof(inetaddr
)) < 0) {
376 syslog(LOG_ERR
, "can't bind udp addr");
379 if (!pmap_set(RPCPROG_NFS
, 2, IPPROTO_UDP
, NFS_PORT
) ||
380 !pmap_set(RPCPROG_NFS
, 3, IPPROTO_UDP
, NFS_PORT
)) {
381 syslog(LOG_ERR
, "can't register with udp portmap");
384 nfsdargs
.sock
= sock
;
385 nfsdargs
.name
= NULL
;
386 nfsdargs
.namelen
= 0;
387 if (nfssvc(NFSSVC_ADDSOCK
, &nfsdargs
) < 0) {
388 syslog(LOG_ERR
, "can't Add UDP socket");
395 /* If we are serving cltp, set up the socket. */
397 if ((sock
= socket(AF_ISO
, SOCK_DGRAM
, 0)) < 0) {
398 syslog(LOG_ERR
, "can't create cltp socket");
401 memset(&isoaddr
, 0, sizeof(isoaddr
));
402 isoaddr
.siso_family
= AF_ISO
;
403 isoaddr
.siso_tlen
= 2;
405 *cp
++ = (NFS_PORT
>> 8);
406 *cp
= (NFS_PORT
& 0xff);
407 isoaddr
.siso_len
= sizeof(isoaddr
);
409 (struct sockaddr
*)&isoaddr
, sizeof(isoaddr
)) < 0) {
410 syslog(LOG_ERR
, "can't bind cltp addr");
416 * Someday this should probably use "rpcbind", the son of
419 if (!pmap_set(RPCPROG_NFS
, NFS_VER2
, IPPROTO_UDP
, NFS_PORT
)) {
420 syslog(LOG_ERR
, "can't register with udp portmap");
424 nfsdargs
.sock
= sock
;
425 nfsdargs
.name
= NULL
;
426 nfsdargs
.namelen
= 0;
427 if (nfssvc(NFSSVC_ADDSOCK
, &nfsdargs
) < 0) {
428 syslog(LOG_ERR
, "can't add UDP socket");
435 /* Now set up the master server socket waiting for tcp connections. */
438 connect_type_cnt
= 0;
440 if ((tcpsock
= socket(AF_INET
, SOCK_STREAM
, 0)) < 0) {
441 syslog(LOG_ERR
, "can't create tcp socket");
444 if (setsockopt(tcpsock
,
445 SOL_SOCKET
, SO_REUSEADDR
, (char *)&on
, sizeof(on
)) < 0)
446 syslog(LOG_ERR
, "setsockopt SO_REUSEADDR: %m");
447 inetaddr
.sin_family
= AF_INET
;
448 inetaddr
.sin_addr
.s_addr
= INADDR_ANY
;
449 inetaddr
.sin_port
= htons(NFS_PORT
);
450 inetaddr
.sin_len
= sizeof(inetaddr
);
452 (struct sockaddr
*)&inetaddr
, sizeof (inetaddr
)) < 0) {
453 syslog(LOG_ERR
, "can't bind tcp addr");
456 if (listen(tcpsock
, 5) < 0) {
457 syslog(LOG_ERR
, "listen failed");
460 if (!pmap_set(RPCPROG_NFS
, 2, IPPROTO_TCP
, NFS_PORT
) ||
461 !pmap_set(RPCPROG_NFS
, 3, IPPROTO_TCP
, NFS_PORT
)) {
462 syslog(LOG_ERR
, "can't register tcp with portmap");
465 FD_SET(tcpsock
, &sockbits
);
471 /* Now set up the master server socket waiting for tp4 connections. */
473 if ((tp4sock
= socket(AF_ISO
, SOCK_SEQPACKET
, 0)) < 0) {
474 syslog(LOG_ERR
, "can't create tp4 socket");
477 if (setsockopt(tp4sock
,
478 SOL_SOCKET
, SO_REUSEADDR
, (char *)&on
, sizeof(on
)) < 0)
479 syslog(LOG_ERR
, "setsockopt SO_REUSEADDR: %m");
480 memset(&isoaddr
, 0, sizeof(isoaddr
));
481 isoaddr
.siso_family
= AF_ISO
;
482 isoaddr
.siso_tlen
= 2;
484 *cp
++ = (NFS_PORT
>> 8);
485 *cp
= (NFS_PORT
& 0xff);
486 isoaddr
.siso_len
= sizeof(isoaddr
);
488 (struct sockaddr
*)&isoaddr
, sizeof (isoaddr
)) < 0) {
489 syslog(LOG_ERR
, "can't bind tp4 addr");
492 if (listen(tp4sock
, 5) < 0) {
493 syslog(LOG_ERR
, "listen failed");
498 * Someday this should probably use "rpcbind", the son of
501 if (!pmap_set(RPCPROG_NFS
, NFS_VER2
, IPPROTO_TCP
, NFS_PORT
)) {
502 syslog(LOG_ERR
, "can't register tcp with portmap");
505 FD_SET(tp4sock
, &sockbits
);
510 /* Now set up the master server socket waiting for tpip connections. */
512 if ((tpipsock
= socket(AF_INET
, SOCK_SEQPACKET
, 0)) < 0) {
513 syslog(LOG_ERR
, "can't create tpip socket");
516 if (setsockopt(tpipsock
,
517 SOL_SOCKET
, SO_REUSEADDR
, (char *)&on
, sizeof(on
)) < 0)
518 syslog(LOG_ERR
, "setsockopt SO_REUSEADDR: %m");
519 inetaddr
.sin_family
= AF_INET
;
520 inetaddr
.sin_addr
.s_addr
= INADDR_ANY
;
521 inetaddr
.sin_port
= htons(NFS_PORT
);
522 inetaddr
.sin_len
= sizeof(inetaddr
);
524 (struct sockaddr
*)&inetaddr
, sizeof (inetaddr
)) < 0) {
525 syslog(LOG_ERR
, "can't bind tcp addr");
528 if (listen(tpipsock
, 5) < 0) {
529 syslog(LOG_ERR
, "listen failed");
534 * Someday this should probably use "rpcbind", the son of
537 if (!pmap_set(RPCPROG_NFS
, NFS_VER2
, IPPROTO_TCP
, NFS_PORT
)) {
538 syslog(LOG_ERR
, "can't register tcp with portmap");
541 FD_SET(tpipsock
, &sockbits
);
547 if (connect_type_cnt
== 0)
550 setproctitle("master");
553 * Loop forever accepting connections and passing the sockets
554 * into the kernel for the mounts.
558 if (connect_type_cnt
> 1) {
559 if (select(maxsock
+ 1,
560 &ready
, NULL
, NULL
, NULL
) < 1) {
561 syslog(LOG_ERR
, "select failed: %m");
565 if (tcpflag
&& FD_ISSET(tcpsock
, &ready
)) {
566 len
= sizeof(inetpeer
);
567 if ((msgsock
= accept(tcpsock
,
568 (struct sockaddr
*)&inetpeer
, &len
)) < 0) {
569 syslog(LOG_ERR
, "accept failed: %m");
572 memset(inetpeer
.sin_zero
, 0, sizeof(inetpeer
.sin_zero
));
573 if (setsockopt(msgsock
, SOL_SOCKET
,
574 SO_KEEPALIVE
, (char *)&on
, sizeof(on
)) < 0)
576 "setsockopt SO_KEEPALIVE: %m");
577 nfsdargs
.sock
= msgsock
;
578 nfsdargs
.name
= (caddr_t
)&inetpeer
;
579 nfsdargs
.namelen
= sizeof(inetpeer
);
580 nfssvc(NFSSVC_ADDSOCK
, &nfsdargs
);
581 (void)close(msgsock
);
584 if (tp4flag
&& FD_ISSET(tp4sock
, &ready
)) {
585 len
= sizeof(isopeer
);
586 if ((msgsock
= accept(tp4sock
,
587 (struct sockaddr
*)&isopeer
, &len
)) < 0) {
588 syslog(LOG_ERR
, "accept failed: %m");
591 if (setsockopt(msgsock
, SOL_SOCKET
,
592 SO_KEEPALIVE
, (char *)&on
, sizeof(on
)) < 0)
594 "setsockopt SO_KEEPALIVE: %m");
595 nfsdargs
.sock
= msgsock
;
596 nfsdargs
.name
= (caddr_t
)&isopeer
;
597 nfsdargs
.namelen
= len
;
598 nfssvc(NFSSVC_ADDSOCK
, &nfsdargs
);
599 (void)close(msgsock
);
601 if (tpipflag
&& FD_ISSET(tpipsock
, &ready
)) {
602 len
= sizeof(inetpeer
);
603 if ((msgsock
= accept(tpipsock
,
604 (struct sockaddr
*)&inetpeer
, &len
)) < 0) {
605 syslog(LOG_ERR
, "Accept failed: %m");
608 if (setsockopt(msgsock
, SOL_SOCKET
,
609 SO_KEEPALIVE
, (char *)&on
, sizeof(on
)) < 0)
610 syslog(LOG_ERR
, "setsockopt SO_KEEPALIVE: %m");
611 nfsdargs
.sock
= msgsock
;
612 nfsdargs
.name
= (caddr_t
)&inetpeer
;
613 nfsdargs
.namelen
= len
;
614 nfssvc(NFSSVC_ADDSOCK
, &nfsdargs
);
615 (void)close(msgsock
);
624 (void)fprintf(stderr
, "usage: nfsd %s\n", USAGE
);
632 syslog(LOG_ERR
, "missing system call: NFS not available.");
640 while (wait3(NULL
, WNOHANG
, NULL
) > 0);
651 (void)snprintf(buf
, sizeof(buf
), "nfsd-%s", a
);
652 (void)strncpy(cp
, buf
, LastArg
- cp
);