+ /* handle NFSv4 delegation returns */
+ while ((nmp->nm_vers >= NFS_VER4) && !(nmp->nm_state & NFSSTA_FORCE) &&
+ (nmp->nm_sockflags & NMSOCK_READY) && !(nmp->nm_state & NFSSTA_RECOVER) &&
+ ((np = TAILQ_FIRST(&nmp->nm_dreturnq)))) {
+ lck_mtx_unlock(&nmp->nm_lock);
+ nfs4_delegation_return(np, R_RECOVER, thd, nmp->nm_mcred);
+ lck_mtx_lock(&nmp->nm_lock);
+ }
+ /* do resends, if necessary/possible */
+ while ((((nmp->nm_sockflags & NMSOCK_READY) && !(nmp->nm_state & NFSSTA_RECOVER)) || (nmp->nm_state & NFSSTA_FORCE)) &&
+ ((req = TAILQ_FIRST(&nmp->nm_resendq)))) {
+ if (req->r_resendtime)
+ microuptime(&now);
+ while (req && !(nmp->nm_state & NFSSTA_FORCE) && req->r_resendtime && (now.tv_sec < req->r_resendtime))
+ req = TAILQ_NEXT(req, r_rchain);
+ if (!req)
+ break;
+ TAILQ_REMOVE(&nmp->nm_resendq, req, r_rchain);
+ req->r_rchain.tqe_next = NFSREQNOLIST;
+ lck_mtx_unlock(&nmp->nm_lock);
+ lck_mtx_lock(&req->r_mtx);
+ if (req->r_error || req->r_nmrep.nmc_mhead) {
+ dofinish = req->r_callback.rcb_func && !(req->r_flags & R_WAITSENT);
+ req->r_flags &= ~R_RESENDQ;
+ wakeup(req);
+ lck_mtx_unlock(&req->r_mtx);
+ if (dofinish)
+ nfs_asyncio_finish(req);
+ lck_mtx_lock(&nmp->nm_lock);
+ continue;
+ }
+ if ((req->r_flags & R_RESTART) || nfs_request_using_gss(req)) {
+ req->r_flags &= ~R_RESTART;
+ req->r_resendtime = 0;
+ lck_mtx_unlock(&req->r_mtx);
+ /* async RPCs on GSS mounts need to be rebuilt and resent. */
+ nfs_reqdequeue(req);
+ if (nfs_request_using_gss(req)) {
+ nfs_gss_clnt_rpcdone(req);
+ error = nfs_gss_clnt_args_restore(req);
+ if (error == ENEEDAUTH)
+ req->r_xid = 0;
+ }
+ NFS_SOCK_DBG("nfs async%s restart: p %d x 0x%llx f 0x%x rtt %d\n",
+ nfs_request_using_gss(req) ? " gss" : "", req->r_procnum, req->r_xid,
+ req->r_flags, req->r_rtt);
+ error = !req->r_nmp ? ENXIO : 0; /* unmounted? */
+ if (!error)
+ error = nfs_sigintr(nmp, req, req->r_thread, 0);
+ if (!error)
+ error = nfs_request_add_header(req);
+ if (!error)
+ error = nfs_request_send(req, 0);
+ lck_mtx_lock(&req->r_mtx);
+ if (req->r_flags & R_RESENDQ)
+ req->r_flags &= ~R_RESENDQ;
+ if (error)
+ req->r_error = error;
+ wakeup(req);
+ dofinish = error && req->r_callback.rcb_func && !(req->r_flags & R_WAITSENT);
+ lck_mtx_unlock(&req->r_mtx);
+ if (dofinish)
+ nfs_asyncio_finish(req);
+ lck_mtx_lock(&nmp->nm_lock);
+ error = 0;
+ continue;
+ }
+ NFS_SOCK_DBG("nfs async resend: p %d x 0x%llx f 0x%x rtt %d\n",
+ req->r_procnum, req->r_xid, req->r_flags, req->r_rtt);
+ error = !req->r_nmp ? ENXIO : 0; /* unmounted? */
+ if (!error)
+ error = nfs_sigintr(nmp, req, req->r_thread, 0);
+ if (!error) {
+ req->r_flags |= R_SENDING;
+ lck_mtx_unlock(&req->r_mtx);
+ error = nfs_send(req, 0);
+ lck_mtx_lock(&req->r_mtx);
+ if (!error) {
+ if (req->r_flags & R_RESENDQ)
+ req->r_flags &= ~R_RESENDQ;
+ wakeup(req);
+ lck_mtx_unlock(&req->r_mtx);
+ lck_mtx_lock(&nmp->nm_lock);
+ continue;
+ }
+ }
+ req->r_error = error;
+ if (req->r_flags & R_RESENDQ)
+ req->r_flags &= ~R_RESENDQ;
+ wakeup(req);
+ dofinish = req->r_callback.rcb_func && !(req->r_flags & R_WAITSENT);
+ lck_mtx_unlock(&req->r_mtx);
+ if (dofinish)
+ nfs_asyncio_finish(req);
+ lck_mtx_lock(&nmp->nm_lock);
+ }
+ if (nmp->nm_deadto_start)
+ nfs_mount_check_dead_timeout(nmp);
+ if (nmp->nm_state & (NFSSTA_FORCE|NFSSTA_DEAD))
+ break;
+ /* check monitored nodes, if necessary/possible */
+ if (!LIST_EMPTY(&nmp->nm_monlist)) {
+ nmp->nm_state |= NFSSTA_MONITOR_SCAN;
+ LIST_FOREACH(np, &nmp->nm_monlist, n_monlink) {
+ if (!(nmp->nm_sockflags & NMSOCK_READY) || (nmp->nm_state & (NFSSTA_RECOVER|NFSSTA_UNMOUNTING|NFSSTA_FORCE)))
+ break;
+ np->n_mflag |= NMMONSCANINPROG;
+ lck_mtx_unlock(&nmp->nm_lock);
+ error = nfs_getattr(np, NULL, vfs_context_kernel(), (NGA_UNCACHED|NGA_MONITOR));
+ if (!error && ISSET(np->n_flag, NUPDATESIZE)) /* update quickly to avoid multiple events */
+ nfs_data_update_size(np, 0);
+ lck_mtx_lock(&nmp->nm_lock);
+ np->n_mflag &= ~NMMONSCANINPROG;
+ if (np->n_mflag & NMMONSCANWANT) {
+ np->n_mflag &= ~NMMONSCANWANT;
+ wakeup(&np->n_mflag);
+ }
+ if (error || !(nmp->nm_sockflags & NMSOCK_READY) || (nmp->nm_state & (NFSSTA_RECOVER|NFSSTA_UNMOUNTING|NFSSTA_FORCE)))
+ break;
+ }
+ nmp->nm_state &= ~NFSSTA_MONITOR_SCAN;
+ if (nmp->nm_state & NFSSTA_UNMOUNTING)
+ wakeup(&nmp->nm_state); /* let unmounting thread know scan is done */
+ }
+ if ((nmp->nm_sockflags & NMSOCK_READY) || (nmp->nm_state & (NFSSTA_RECOVER|NFSSTA_UNMOUNTING))) {
+ if (nmp->nm_deadto_start || !TAILQ_EMPTY(&nmp->nm_resendq) ||
+ (nmp->nm_state & NFSSTA_RECOVER))
+ ts.tv_sec = 1;
+ else
+ ts.tv_sec = 5;
+ msleep(&nmp->nm_sockthd, &nmp->nm_lock, PSOCK, "nfssockthread", &ts);
+ }
+ }
+
+ /* If we're unmounting, send the unmount RPC, if requested/appropriate. */
+ if ((nmp->nm_sockflags & NMSOCK_UNMOUNT) &&
+ (nmp->nm_state & NFSSTA_MOUNTED) && NMFLAG(nmp, CALLUMNT) &&
+ (nmp->nm_vers < NFS_VER4) && !(nmp->nm_state & (NFSSTA_FORCE|NFSSTA_DEAD))) {
+ lck_mtx_unlock(&nmp->nm_lock);
+ nfs3_umount_rpc(nmp, vfs_context_kernel(),
+ (nmp->nm_sockflags & NMSOCK_READY) ? 6 : 2);
+ lck_mtx_lock(&nmp->nm_lock);
+ }
+
+ if (nmp->nm_sockthd == thd)
+ nmp->nm_sockthd = NULL;
+ lck_mtx_unlock(&nmp->nm_lock);
+ wakeup(&nmp->nm_sockthd);
+ thread_terminate(thd);
+}
+
+/* start or wake a mount's socket thread */
+void
+nfs_mount_sock_thread_wake(struct nfsmount *nmp)
+{
+ if (nmp->nm_sockthd)
+ wakeup(&nmp->nm_sockthd);
+ else if (kernel_thread_start(nfs_mount_sock_thread, nmp, &nmp->nm_sockthd) == KERN_SUCCESS)
+ thread_deallocate(nmp->nm_sockthd);
+}
+
+/*
+ * Check if we should mark the mount dead because the
+ * unresponsive mount has reached the dead timeout.
+ * (must be called with nmp locked)
+ */
+void
+nfs_mount_check_dead_timeout(struct nfsmount *nmp)
+{
+ struct timeval now;
+
+ if (nmp->nm_deadto_start == 0)
+ return;
+ if (nmp->nm_state & NFSSTA_DEAD)
+ return;
+ nfs_is_squishy(nmp);
+ if (nmp->nm_curdeadtimeout <= 0)
+ return;
+ microuptime(&now);
+ if ((now.tv_sec - nmp->nm_deadto_start) < nmp->nm_curdeadtimeout)
+ return;
+ printf("nfs server %s: %sdead\n", vfs_statfs(nmp->nm_mountp)->f_mntfromname,
+ (nmp->nm_curdeadtimeout != nmp->nm_deadtimeout) ? "squished " : "");
+ nmp->nm_state |= NFSSTA_DEAD;
+ vfs_event_signal(&vfs_statfs(nmp->nm_mountp)->f_fsid, VQ_DEAD, 0);
+}
+
+/*
+ * NFS callback channel socket state
+ */
+struct nfs_callback_socket
+{
+ TAILQ_ENTRY(nfs_callback_socket) ncbs_link;
+ socket_t ncbs_so; /* the socket */
+ struct sockaddr_storage ncbs_saddr; /* socket address */
+ struct nfs_rpc_record_state ncbs_rrs; /* RPC record parsing state */
+ time_t ncbs_stamp; /* last accessed at */
+ uint32_t ncbs_flags; /* see below */
+};
+#define NCBSOCK_UPCALL 0x0001
+#define NCBSOCK_UPCALLWANT 0x0002
+#define NCBSOCK_DEAD 0x0004
+
+/*
+ * NFS callback channel state
+ *
+ * One listening socket for accepting socket connections from servers and
+ * a list of connected sockets to handle callback requests on.
+ * Mounts registered with the callback channel are assigned IDs and
+ * put on a list so that the callback request handling code can match
+ * the requests up with mounts.
+ */
+socket_t nfs4_cb_so = NULL;
+socket_t nfs4_cb_so6 = NULL;
+in_port_t nfs4_cb_port = 0;
+in_port_t nfs4_cb_port6 = 0;
+uint32_t nfs4_cb_id = 0;
+uint32_t nfs4_cb_so_usecount = 0;
+TAILQ_HEAD(nfs4_cb_sock_list,nfs_callback_socket) nfs4_cb_socks;
+TAILQ_HEAD(nfs4_cb_mount_list,nfsmount) nfs4_cb_mounts;
+
+int nfs4_cb_handler(struct nfs_callback_socket *, mbuf_t);
+
+/*
+ * Set up the callback channel for the NFS mount.
+ *
+ * Initializes the callback channel socket state and
+ * assigns a callback ID to the mount.
+ */
+void
+nfs4_mount_callback_setup(struct nfsmount *nmp)
+{
+ struct sockaddr_in sin;
+ struct sockaddr_in6 sin6;
+ socket_t so = NULL;
+ socket_t so6 = NULL;
+ struct timeval timeo;
+ int error, on = 1;
+ in_port_t port;
+
+ lck_mtx_lock(nfs_global_mutex);
+ if (nfs4_cb_id == 0) {
+ TAILQ_INIT(&nfs4_cb_mounts);
+ TAILQ_INIT(&nfs4_cb_socks);
+ nfs4_cb_id++;
+ }
+ nmp->nm_cbid = nfs4_cb_id++;
+ if (nmp->nm_cbid == 0)
+ nmp->nm_cbid = nfs4_cb_id++;
+ nfs4_cb_so_usecount++;
+ TAILQ_INSERT_HEAD(&nfs4_cb_mounts, nmp, nm_cblink);
+
+ if (nfs4_cb_so) {
+ lck_mtx_unlock(nfs_global_mutex);
+ return;
+ }
+
+ /* IPv4 */
+ error = sock_socket(AF_INET, SOCK_STREAM, IPPROTO_TCP, nfs4_cb_accept, NULL, &nfs4_cb_so);
+ if (error) {
+ log(LOG_INFO, "nfs callback setup: error %d creating listening IPv4 socket\n", error);
+ goto fail;
+ }
+ so = nfs4_cb_so;
+
+ sock_setsockopt(so, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
+ sin.sin_len = sizeof(struct sockaddr_in);
+ sin.sin_family = AF_INET;
+ sin.sin_addr.s_addr = htonl(INADDR_ANY);
+ sin.sin_port = htons(nfs_callback_port); /* try to use specified port */
+ error = sock_bind(so, (struct sockaddr *)&sin);
+ if (error) {
+ log(LOG_INFO, "nfs callback setup: error %d binding listening IPv4 socket\n", error);
+ goto fail;
+ }
+ error = sock_getsockname(so, (struct sockaddr *)&sin, sin.sin_len);
+ if (error) {
+ log(LOG_INFO, "nfs callback setup: error %d getting listening IPv4 socket port\n", error);
+ goto fail;
+ }
+ nfs4_cb_port = ntohs(sin.sin_port);
+
+ error = sock_listen(so, 32);
+ if (error) {
+ log(LOG_INFO, "nfs callback setup: error %d on IPv4 listen\n", error);
+ goto fail;
+ }
+
+ /* receive timeout shouldn't matter. If timeout on send, we'll want to drop the socket */
+ timeo.tv_usec = 0;
+ timeo.tv_sec = 60;
+ error = sock_setsockopt(so, SOL_SOCKET, SO_RCVTIMEO, &timeo, sizeof(timeo));
+ if (error)
+ log(LOG_INFO, "nfs callback setup: error %d setting IPv4 socket rx timeout\n", error);
+ error = sock_setsockopt(so, SOL_SOCKET, SO_SNDTIMEO, &timeo, sizeof(timeo));
+ if (error)
+ log(LOG_INFO, "nfs callback setup: error %d setting IPv4 socket tx timeout\n", error);
+ sock_setsockopt(so, IPPROTO_TCP, TCP_NODELAY, &on, sizeof(on));
+ sock_setsockopt(so, SOL_SOCKET, SO_NOADDRERR, &on, sizeof(on));
+ sock_setsockopt(so, SOL_SOCKET, SO_UPCALLCLOSEWAIT, &on, sizeof(on));
+ error = 0;
+
+ /* IPv6 */
+ error = sock_socket(AF_INET6, SOCK_STREAM, IPPROTO_TCP, nfs4_cb_accept, NULL, &nfs4_cb_so6);
+ if (error) {
+ log(LOG_INFO, "nfs callback setup: error %d creating listening IPv6 socket\n", error);
+ goto fail;
+ }
+ so6 = nfs4_cb_so6;
+
+ sock_setsockopt(so6, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
+ sock_setsockopt(so6, IPPROTO_IPV6, IPV6_V6ONLY, &on, sizeof(on));
+ /* try to use specified port or same port as IPv4 */
+ port = nfs_callback_port ? nfs_callback_port : nfs4_cb_port;
+ipv6_bind_again:
+ sin6.sin6_len = sizeof(struct sockaddr_in6);
+ sin6.sin6_family = AF_INET6;
+ sin6.sin6_addr = in6addr_any;
+ sin6.sin6_port = htons(port);
+ error = sock_bind(so6, (struct sockaddr *)&sin6);
+ if (error) {
+ if (port != nfs_callback_port) {
+ /* if we simply tried to match the IPv4 port, then try any port */
+ port = 0;
+ goto ipv6_bind_again;
+ }
+ log(LOG_INFO, "nfs callback setup: error %d binding listening IPv6 socket\n", error);
+ goto fail;
+ }
+ error = sock_getsockname(so6, (struct sockaddr *)&sin6, sin6.sin6_len);
+ if (error) {
+ log(LOG_INFO, "nfs callback setup: error %d getting listening IPv6 socket port\n", error);
+ goto fail;
+ }
+ nfs4_cb_port6 = ntohs(sin6.sin6_port);
+
+ error = sock_listen(so6, 32);
+ if (error) {
+ log(LOG_INFO, "nfs callback setup: error %d on IPv6 listen\n", error);
+ goto fail;
+ }
+
+ /* receive timeout shouldn't matter. If timeout on send, we'll want to drop the socket */
+ timeo.tv_usec = 0;
+ timeo.tv_sec = 60;
+ error = sock_setsockopt(so6, SOL_SOCKET, SO_RCVTIMEO, &timeo, sizeof(timeo));
+ if (error)
+ log(LOG_INFO, "nfs callback setup: error %d setting IPv6 socket rx timeout\n", error);
+ error = sock_setsockopt(so6, SOL_SOCKET, SO_SNDTIMEO, &timeo, sizeof(timeo));
+ if (error)
+ log(LOG_INFO, "nfs callback setup: error %d setting IPv6 socket tx timeout\n", error);
+ sock_setsockopt(so6, IPPROTO_TCP, TCP_NODELAY, &on, sizeof(on));
+ sock_setsockopt(so6, SOL_SOCKET, SO_NOADDRERR, &on, sizeof(on));
+ sock_setsockopt(so6, SOL_SOCKET, SO_UPCALLCLOSEWAIT, &on, sizeof(on));
+ error = 0;
+
+fail:
+ if (error) {
+ nfs4_cb_so = nfs4_cb_so6 = NULL;
+ lck_mtx_unlock(nfs_global_mutex);
+ if (so) {
+ sock_shutdown(so, SHUT_RDWR);
+ sock_close(so);
+ }
+ if (so6) {
+ sock_shutdown(so6, SHUT_RDWR);
+ sock_close(so6);
+ }
+ } else {
+ lck_mtx_unlock(nfs_global_mutex);
+ }
+}
+
+/*
+ * Shut down the callback channel for the NFS mount.
+ *
+ * Clears the mount's callback ID and releases the mounts
+ * reference on the callback socket. Last reference dropped
+ * will also shut down the callback socket(s).
+ */
+void
+nfs4_mount_callback_shutdown(struct nfsmount *nmp)
+{
+ struct nfs_callback_socket *ncbsp;
+ socket_t so, so6;
+ struct nfs4_cb_sock_list cb_socks;
+ struct timespec ts = {1,0};
+
+ lck_mtx_lock(nfs_global_mutex);
+ TAILQ_REMOVE(&nfs4_cb_mounts, nmp, nm_cblink);
+ /* wait for any callbacks in progress to complete */
+ while (nmp->nm_cbrefs)
+ msleep(&nmp->nm_cbrefs, nfs_global_mutex, PSOCK, "cbshutwait", &ts);
+ nmp->nm_cbid = 0;
+ if (--nfs4_cb_so_usecount) {
+ lck_mtx_unlock(nfs_global_mutex);
+ return;
+ }
+ so = nfs4_cb_so;
+ so6 = nfs4_cb_so6;
+ nfs4_cb_so = nfs4_cb_so6 = NULL;
+ TAILQ_INIT(&cb_socks);
+ TAILQ_CONCAT(&cb_socks, &nfs4_cb_socks, ncbs_link);
+ lck_mtx_unlock(nfs_global_mutex);
+ if (so) {
+ sock_shutdown(so, SHUT_RDWR);
+ sock_close(so);
+ }
+ if (so6) {
+ sock_shutdown(so6, SHUT_RDWR);
+ sock_close(so6);
+ }
+ while ((ncbsp = TAILQ_FIRST(&cb_socks))) {
+ TAILQ_REMOVE(&cb_socks, ncbsp, ncbs_link);
+ sock_shutdown(ncbsp->ncbs_so, SHUT_RDWR);
+ sock_close(ncbsp->ncbs_so);
+ nfs_rpc_record_state_cleanup(&ncbsp->ncbs_rrs);
+ FREE(ncbsp, M_TEMP);
+ }
+}
+
+/*
+ * Check periodically for stale/unused nfs callback sockets
+ */
+#define NFS4_CB_TIMER_PERIOD 30
+#define NFS4_CB_IDLE_MAX 300
+void
+nfs4_callback_timer(__unused void *param0, __unused void *param1)
+{
+ struct nfs_callback_socket *ncbsp, *nextncbsp;
+ struct timeval now;
+
+loop:
+ lck_mtx_lock(nfs_global_mutex);
+ if (TAILQ_EMPTY(&nfs4_cb_socks)) {
+ nfs4_callback_timer_on = 0;
+ lck_mtx_unlock(nfs_global_mutex);
+ return;
+ }
+ microuptime(&now);
+ TAILQ_FOREACH_SAFE(ncbsp, &nfs4_cb_socks, ncbs_link, nextncbsp) {
+ if (!(ncbsp->ncbs_flags & NCBSOCK_DEAD) &&
+ (now.tv_sec < (ncbsp->ncbs_stamp + NFS4_CB_IDLE_MAX)))
+ continue;
+ TAILQ_REMOVE(&nfs4_cb_socks, ncbsp, ncbs_link);
+ lck_mtx_unlock(nfs_global_mutex);
+ sock_shutdown(ncbsp->ncbs_so, SHUT_RDWR);
+ sock_close(ncbsp->ncbs_so);
+ nfs_rpc_record_state_cleanup(&ncbsp->ncbs_rrs);
+ FREE(ncbsp, M_TEMP);
+ goto loop;
+ }
+ nfs4_callback_timer_on = 1;
+ nfs_interval_timer_start(nfs4_callback_timer_call,
+ NFS4_CB_TIMER_PERIOD * 1000);
+ lck_mtx_unlock(nfs_global_mutex);
+}
+
+/*
+ * Accept a new callback socket.
+ */
+void
+nfs4_cb_accept(socket_t so, __unused void *arg, __unused int waitflag)
+{
+ socket_t newso = NULL;
+ struct nfs_callback_socket *ncbsp;
+ struct nfsmount *nmp;
+ struct timeval timeo, now;
+ int error, on = 1, ip;
+
+ if (so == nfs4_cb_so)
+ ip = 4;
+ else if (so == nfs4_cb_so6)
+ ip = 6;
+ else
+ return;
+
+ /* allocate/initialize a new nfs_callback_socket */
+ MALLOC(ncbsp, struct nfs_callback_socket *, sizeof(struct nfs_callback_socket), M_TEMP, M_WAITOK);
+ if (!ncbsp) {
+ log(LOG_ERR, "nfs callback accept: no memory for new socket\n");
+ return;
+ }
+ bzero(ncbsp, sizeof(*ncbsp));
+ ncbsp->ncbs_saddr.ss_len = (ip == 4) ? sizeof(struct sockaddr_in) : sizeof(struct sockaddr_in6);
+ nfs_rpc_record_state_init(&ncbsp->ncbs_rrs);
+
+ /* accept a new socket */
+ error = sock_accept(so, (struct sockaddr*)&ncbsp->ncbs_saddr,
+ ncbsp->ncbs_saddr.ss_len, MSG_DONTWAIT,
+ nfs4_cb_rcv, ncbsp, &newso);
+ if (error) {
+ log(LOG_INFO, "nfs callback accept: error %d accepting IPv%d socket\n", error, ip);
+ FREE(ncbsp, M_TEMP);
+ return;
+ }
+
+ /* set up the new socket */
+ /* receive timeout shouldn't matter. If timeout on send, we'll want to drop the socket */
+ timeo.tv_usec = 0;
+ timeo.tv_sec = 60;
+ error = sock_setsockopt(newso, SOL_SOCKET, SO_RCVTIMEO, &timeo, sizeof(timeo));
+ if (error)
+ log(LOG_INFO, "nfs callback socket: error %d setting IPv%d socket rx timeout\n", error, ip);
+ error = sock_setsockopt(newso, SOL_SOCKET, SO_SNDTIMEO, &timeo, sizeof(timeo));
+ if (error)
+ log(LOG_INFO, "nfs callback socket: error %d setting IPv%d socket tx timeout\n", error, ip);
+ sock_setsockopt(newso, IPPROTO_TCP, TCP_NODELAY, &on, sizeof(on));
+ sock_setsockopt(newso, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on));
+ sock_setsockopt(newso, SOL_SOCKET, SO_NOADDRERR, &on, sizeof(on));
+ sock_setsockopt(newso, SOL_SOCKET, SO_UPCALLCLOSEWAIT, &on, sizeof(on));
+
+ ncbsp->ncbs_so = newso;
+ microuptime(&now);
+ ncbsp->ncbs_stamp = now.tv_sec;
+
+ lck_mtx_lock(nfs_global_mutex);
+
+ /* add it to the list */
+ TAILQ_INSERT_HEAD(&nfs4_cb_socks, ncbsp, ncbs_link);
+
+ /* verify it's from a host we have mounted */
+ TAILQ_FOREACH(nmp, &nfs4_cb_mounts, nm_cblink) {
+ /* check if socket's source address matches this mount's server address */
+ if (!nmp->nm_saddr)
+ continue;
+ if (nfs_sockaddr_cmp((struct sockaddr*)&ncbsp->ncbs_saddr, nmp->nm_saddr) == 0)
+ break;
+ }
+ if (!nmp) /* we don't want this socket, mark it dead */
+ ncbsp->ncbs_flags |= NCBSOCK_DEAD;
+
+ /* make sure the callback socket cleanup timer is running */
+ /* (shorten the timer if we've got a socket we don't want) */
+ if (!nfs4_callback_timer_on) {
+ nfs4_callback_timer_on = 1;
+ nfs_interval_timer_start(nfs4_callback_timer_call,
+ !nmp ? 500 : (NFS4_CB_TIMER_PERIOD * 1000));
+ } else if (!nmp && (nfs4_callback_timer_on < 2)) {
+ nfs4_callback_timer_on = 2;
+ thread_call_cancel(nfs4_callback_timer_call);
+ nfs_interval_timer_start(nfs4_callback_timer_call, 500);
+ }
+
+ lck_mtx_unlock(nfs_global_mutex);
+}
+
+/*
+ * Receive mbufs from callback sockets into RPC records and process each record.
+ * Detect connection has been closed and shut down.
+ */
+void
+nfs4_cb_rcv(socket_t so, void *arg, __unused int waitflag)
+{
+ struct nfs_callback_socket *ncbsp = arg;
+ struct timespec ts = {1,0};
+ struct timeval now;
+ mbuf_t m;
+ int error = 0, recv = 1;
+
+ lck_mtx_lock(nfs_global_mutex);
+ while (ncbsp->ncbs_flags & NCBSOCK_UPCALL) {
+ /* wait if upcall is already in progress */
+ ncbsp->ncbs_flags |= NCBSOCK_UPCALLWANT;
+ msleep(ncbsp, nfs_global_mutex, PSOCK, "cbupcall", &ts);
+ }
+ ncbsp->ncbs_flags |= NCBSOCK_UPCALL;
+ lck_mtx_unlock(nfs_global_mutex);
+
+ /* loop while we make error-free progress */
+ while (!error && recv) {
+ error = nfs_rpc_record_read(so, &ncbsp->ncbs_rrs, MSG_DONTWAIT, &recv, &m);
+ if (m) /* handle the request */
+ error = nfs4_cb_handler(ncbsp, m);
+ }
+
+ /* note: no error and no data indicates server closed its end */
+ if ((error != EWOULDBLOCK) && (error || !recv)) {
+ /*
+ * Socket is either being closed or should be.
+ * We can't close the socket in the context of the upcall.
+ * So we mark it as dead and leave it for the cleanup timer to reap.
+ */
+ ncbsp->ncbs_stamp = 0;
+ ncbsp->ncbs_flags |= NCBSOCK_DEAD;
+ } else {
+ microuptime(&now);
+ ncbsp->ncbs_stamp = now.tv_sec;
+ }
+
+ lck_mtx_lock(nfs_global_mutex);
+ ncbsp->ncbs_flags &= ~NCBSOCK_UPCALL;
+ lck_mtx_unlock(nfs_global_mutex);
+ wakeup(ncbsp);
+}
+
+/*
+ * Handle an NFS callback channel request.
+ */
+int
+nfs4_cb_handler(struct nfs_callback_socket *ncbsp, mbuf_t mreq)
+{
+ socket_t so = ncbsp->ncbs_so;
+ struct nfsm_chain nmreq, nmrep;
+ mbuf_t mhead = NULL, mrest = NULL, m;
+ struct msghdr msg;
+ struct nfsmount *nmp;
+ fhandle_t fh;
+ nfsnode_t np;
+ nfs_stateid stateid;
+ uint32_t bitmap[NFS_ATTR_BITMAP_LEN], rbitmap[NFS_ATTR_BITMAP_LEN], bmlen, truncate, attrbytes;
+ uint32_t val, xid, procnum, taglen, cbid, numops, op, status;
+ uint32_t auth_type, auth_len;
+ uint32_t numres, *pnumres;
+ int error = 0, replen, len;
+ size_t sentlen = 0;
+
+ xid = numops = op = status = procnum = taglen = cbid = 0;
+
+ nfsm_chain_dissect_init(error, &nmreq, mreq);
+ nfsm_chain_get_32(error, &nmreq, xid); // RPC XID
+ nfsm_chain_get_32(error, &nmreq, val); // RPC Call
+ nfsm_assert(error, (val == RPC_CALL), EBADRPC);
+ nfsm_chain_get_32(error, &nmreq, val); // RPC Version
+ nfsm_assert(error, (val == RPC_VER2), ERPCMISMATCH);
+ nfsm_chain_get_32(error, &nmreq, val); // RPC Program Number
+ nfsm_assert(error, (val == NFS4_CALLBACK_PROG), EPROGUNAVAIL);
+ nfsm_chain_get_32(error, &nmreq, val); // NFS Callback Program Version Number
+ nfsm_assert(error, (val == NFS4_CALLBACK_PROG_VERSION), EPROGMISMATCH);
+ nfsm_chain_get_32(error, &nmreq, procnum); // NFS Callback Procedure Number
+ nfsm_assert(error, (procnum <= NFSPROC4_CB_COMPOUND), EPROCUNAVAIL);
+
+ /* Handle authentication */
+ /* XXX just ignore auth for now - handling kerberos may be tricky */
+ nfsm_chain_get_32(error, &nmreq, auth_type); // RPC Auth Flavor
+ nfsm_chain_get_32(error, &nmreq, auth_len); // RPC Auth Length
+ nfsm_assert(error, (auth_len <= RPCAUTH_MAXSIZ), EBADRPC);
+ if (!error && (auth_len > 0))
+ nfsm_chain_adv(error, &nmreq, nfsm_rndup(auth_len));
+ nfsm_chain_adv(error, &nmreq, NFSX_UNSIGNED); // verifier flavor (should be AUTH_NONE)
+ nfsm_chain_get_32(error, &nmreq, auth_len); // verifier length
+ nfsm_assert(error, (auth_len <= RPCAUTH_MAXSIZ), EBADRPC);
+ if (!error && (auth_len > 0))
+ nfsm_chain_adv(error, &nmreq, nfsm_rndup(auth_len));
+ if (error) {
+ status = error;
+ error = 0;
+ goto nfsmout;
+ }
+
+ switch (procnum) {
+ case NFSPROC4_CB_NULL:
+ status = NFSERR_RETVOID;
+ break;
+ case NFSPROC4_CB_COMPOUND:
+ /* tag, minorversion, cb ident, numops, op array */
+ nfsm_chain_get_32(error, &nmreq, taglen); /* tag length */
+ nfsm_assert(error, (val <= NFS4_OPAQUE_LIMIT), EBADRPC);
+
+ /* start building the body of the response */
+ nfsm_mbuf_get(error, &mrest, nfsm_rndup(taglen) + 5*NFSX_UNSIGNED);
+ nfsm_chain_init(&nmrep, mrest);
+
+ /* copy tag from request to response */
+ nfsm_chain_add_32(error, &nmrep, taglen); /* tag length */
+ for (len = (int)taglen; !error && (len > 0); len -= NFSX_UNSIGNED) {
+ nfsm_chain_get_32(error, &nmreq, val);
+ nfsm_chain_add_32(error, &nmrep, val);
+ }
+
+ /* insert number of results placeholder */
+ numres = 0;
+ nfsm_chain_add_32(error, &nmrep, numres);
+ pnumres = (uint32_t*)(nmrep.nmc_ptr - NFSX_UNSIGNED);
+
+ nfsm_chain_get_32(error, &nmreq, val); /* minorversion */
+ nfsm_assert(error, (val == 0), NFSERR_MINOR_VERS_MISMATCH);
+ nfsm_chain_get_32(error, &nmreq, cbid); /* callback ID */
+ nfsm_chain_get_32(error, &nmreq, numops); /* number of operations */
+ if (error) {
+ if ((error == EBADRPC) || (error == NFSERR_MINOR_VERS_MISMATCH))
+ status = error;
+ else if ((error == ENOBUFS) || (error == ENOMEM))
+ status = NFSERR_RESOURCE;
+ else
+ status = NFSERR_SERVERFAULT;
+ error = 0;
+ nfsm_chain_null(&nmrep);
+ goto nfsmout;
+ }
+ /* match the callback ID to a registered mount */
+ lck_mtx_lock(nfs_global_mutex);
+ TAILQ_FOREACH(nmp, &nfs4_cb_mounts, nm_cblink) {
+ if (nmp->nm_cbid != cbid)
+ continue;
+ /* verify socket's source address matches this mount's server address */
+ if (!nmp->nm_saddr)
+ continue;
+ if (nfs_sockaddr_cmp((struct sockaddr*)&ncbsp->ncbs_saddr, nmp->nm_saddr) == 0)
+ break;
+ }
+ /* mark the NFS mount as busy */
+ if (nmp)
+ nmp->nm_cbrefs++;
+ lck_mtx_unlock(nfs_global_mutex);
+ if (!nmp) {
+ /* if no mount match, just drop socket. */
+ error = EPERM;
+ nfsm_chain_null(&nmrep);
+ goto out;
+ }
+
+ /* process ops, adding results to mrest */
+ while (numops > 0) {
+ numops--;
+ nfsm_chain_get_32(error, &nmreq, op);
+ if (error)
+ break;
+ switch (op) {
+ case NFS_OP_CB_GETATTR:
+ // (FH, BITMAP) -> (STATUS, BITMAP, ATTRS)
+ np = NULL;
+ nfsm_chain_get_fh(error, &nmreq, NFS_VER4, &fh);
+ bmlen = NFS_ATTR_BITMAP_LEN;
+ nfsm_chain_get_bitmap(error, &nmreq, bitmap, bmlen);
+ if (error) {
+ status = error;
+ error = 0;
+ numops = 0; /* don't process any more ops */
+ } else {
+ /* find the node for the file handle */
+ error = nfs_nget(nmp->nm_mountp, NULL, NULL, fh.fh_data, fh.fh_len, NULL, NULL, RPCAUTH_UNKNOWN, NG_NOCREATE, &np);
+ if (error || !np) {
+ status = NFSERR_BADHANDLE;
+ error = 0;
+ np = NULL;
+ numops = 0; /* don't process any more ops */
+ }
+ }
+ nfsm_chain_add_32(error, &nmrep, op);
+ nfsm_chain_add_32(error, &nmrep, status);
+ if (!error && (status == EBADRPC))
+ error = status;
+ if (np) {
+ /* only allow returning size, change, and mtime attrs */
+ NFS_CLEAR_ATTRIBUTES(&rbitmap);
+ attrbytes = 0;
+ if (NFS_BITMAP_ISSET(&bitmap, NFS_FATTR_CHANGE)) {
+ NFS_BITMAP_SET(&rbitmap, NFS_FATTR_CHANGE);
+ attrbytes += 2 * NFSX_UNSIGNED;
+ }
+ if (NFS_BITMAP_ISSET(&bitmap, NFS_FATTR_SIZE)) {
+ NFS_BITMAP_SET(&rbitmap, NFS_FATTR_SIZE);
+ attrbytes += 2 * NFSX_UNSIGNED;
+ }
+ if (NFS_BITMAP_ISSET(&bitmap, NFS_FATTR_TIME_MODIFY)) {
+ NFS_BITMAP_SET(&rbitmap, NFS_FATTR_TIME_MODIFY);
+ attrbytes += 3 * NFSX_UNSIGNED;
+ }
+ nfsm_chain_add_bitmap(error, &nmrep, rbitmap, NFS_ATTR_BITMAP_LEN);
+ nfsm_chain_add_32(error, &nmrep, attrbytes);
+ if (NFS_BITMAP_ISSET(&bitmap, NFS_FATTR_CHANGE))
+ nfsm_chain_add_64(error, &nmrep,
+ np->n_vattr.nva_change + ((np->n_flag & NMODIFIED) ? 1 : 0));
+ if (NFS_BITMAP_ISSET(&bitmap, NFS_FATTR_SIZE))
+ nfsm_chain_add_64(error, &nmrep, np->n_size);
+ if (NFS_BITMAP_ISSET(&bitmap, NFS_FATTR_TIME_MODIFY)) {
+ nfsm_chain_add_64(error, &nmrep, np->n_vattr.nva_timesec[NFSTIME_MODIFY]);
+ nfsm_chain_add_32(error, &nmrep, np->n_vattr.nva_timensec[NFSTIME_MODIFY]);
+ }
+ nfs_node_unlock(np);
+ vnode_put(NFSTOV(np));
+ np = NULL;
+ }
+ /*
+ * If we hit an error building the reply, we can't easily back up.
+ * So we'll just update the status and hope the server ignores the
+ * extra garbage.
+ */
+ break;
+ case NFS_OP_CB_RECALL:
+ // (STATEID, TRUNCATE, FH) -> (STATUS)
+ np = NULL;
+ nfsm_chain_get_stateid(error, &nmreq, &stateid);
+ nfsm_chain_get_32(error, &nmreq, truncate);
+ nfsm_chain_get_fh(error, &nmreq, NFS_VER4, &fh);
+ if (error) {
+ status = error;
+ error = 0;
+ numops = 0; /* don't process any more ops */
+ } else {
+ /* find the node for the file handle */
+ error = nfs_nget(nmp->nm_mountp, NULL, NULL, fh.fh_data, fh.fh_len, NULL, NULL, RPCAUTH_UNKNOWN, NG_NOCREATE, &np);
+ if (error || !np) {
+ status = NFSERR_BADHANDLE;
+ error = 0;
+ np = NULL;
+ numops = 0; /* don't process any more ops */
+ } else if (!(np->n_openflags & N_DELEG_MASK) ||
+ bcmp(&np->n_dstateid, &stateid, sizeof(stateid))) {
+ /* delegation stateid state doesn't match */
+ status = NFSERR_BAD_STATEID;
+ numops = 0; /* don't process any more ops */
+ }
+ if (!status) /* add node to recall queue, and wake socket thread */
+ nfs4_delegation_return_enqueue(np);
+ if (np) {
+ nfs_node_unlock(np);
+ vnode_put(NFSTOV(np));
+ }
+ }
+ nfsm_chain_add_32(error, &nmrep, op);
+ nfsm_chain_add_32(error, &nmrep, status);
+ if (!error && (status == EBADRPC))
+ error = status;
+ break;
+ case NFS_OP_CB_ILLEGAL:
+ default:
+ nfsm_chain_add_32(error, &nmrep, NFS_OP_CB_ILLEGAL);
+ status = NFSERR_OP_ILLEGAL;
+ nfsm_chain_add_32(error, &nmrep, status);
+ numops = 0; /* don't process any more ops */
+ break;
+ }
+ numres++;
+ }
+
+ if (!status && error) {
+ if (error == EBADRPC)
+ status = error;
+ else if ((error == ENOBUFS) || (error == ENOMEM))
+ status = NFSERR_RESOURCE;
+ else
+ status = NFSERR_SERVERFAULT;
+ error = 0;
+ }
+
+ /* Now, set the numres field */
+ *pnumres = txdr_unsigned(numres);
+ nfsm_chain_build_done(error, &nmrep);
+ nfsm_chain_null(&nmrep);
+
+ /* drop the callback reference on the mount */
+ lck_mtx_lock(nfs_global_mutex);
+ nmp->nm_cbrefs--;
+ if (!nmp->nm_cbid)
+ wakeup(&nmp->nm_cbrefs);
+ lck_mtx_unlock(nfs_global_mutex);
+ break;
+ }
+
+nfsmout:
+ if (status == EBADRPC)
+ OSAddAtomic64(1, &nfsstats.rpcinvalid);
+
+ /* build reply header */
+ error = mbuf_gethdr(MBUF_WAITOK, MBUF_TYPE_DATA, &mhead);
+ nfsm_chain_init(&nmrep, mhead);
+ nfsm_chain_add_32(error, &nmrep, 0); /* insert space for an RPC record mark */
+ nfsm_chain_add_32(error, &nmrep, xid);
+ nfsm_chain_add_32(error, &nmrep, RPC_REPLY);
+ if ((status == ERPCMISMATCH) || (status & NFSERR_AUTHERR)) {
+ nfsm_chain_add_32(error, &nmrep, RPC_MSGDENIED);
+ if (status & NFSERR_AUTHERR) {
+ nfsm_chain_add_32(error, &nmrep, RPC_AUTHERR);
+ nfsm_chain_add_32(error, &nmrep, (status & ~NFSERR_AUTHERR));
+ } else {
+ nfsm_chain_add_32(error, &nmrep, RPC_MISMATCH);
+ nfsm_chain_add_32(error, &nmrep, RPC_VER2);
+ nfsm_chain_add_32(error, &nmrep, RPC_VER2);
+ }
+ } else {
+ /* reply status */
+ nfsm_chain_add_32(error, &nmrep, RPC_MSGACCEPTED);
+ /* XXX RPCAUTH_NULL verifier */
+ nfsm_chain_add_32(error, &nmrep, RPCAUTH_NULL);
+ nfsm_chain_add_32(error, &nmrep, 0);
+ /* accepted status */
+ switch (status) {
+ case EPROGUNAVAIL:
+ nfsm_chain_add_32(error, &nmrep, RPC_PROGUNAVAIL);
+ break;
+ case EPROGMISMATCH:
+ nfsm_chain_add_32(error, &nmrep, RPC_PROGMISMATCH);
+ nfsm_chain_add_32(error, &nmrep, NFS4_CALLBACK_PROG_VERSION);
+ nfsm_chain_add_32(error, &nmrep, NFS4_CALLBACK_PROG_VERSION);
+ break;
+ case EPROCUNAVAIL:
+ nfsm_chain_add_32(error, &nmrep, RPC_PROCUNAVAIL);
+ break;
+ case EBADRPC:
+ nfsm_chain_add_32(error, &nmrep, RPC_GARBAGE);
+ break;
+ default:
+ nfsm_chain_add_32(error, &nmrep, RPC_SUCCESS);
+ if (status != NFSERR_RETVOID)
+ nfsm_chain_add_32(error, &nmrep, status);
+ break;
+ }
+ }
+ nfsm_chain_build_done(error, &nmrep);
+ if (error) {
+ nfsm_chain_null(&nmrep);
+ goto out;
+ }
+ error = mbuf_setnext(nmrep.nmc_mcur, mrest);
+ if (error) {
+ printf("nfs cb: mbuf_setnext failed %d\n", error);
+ goto out;
+ }
+ mrest = NULL;
+ /* Calculate the size of the reply */
+ replen = 0;
+ for (m = nmrep.nmc_mhead; m; m = mbuf_next(m))
+ replen += mbuf_len(m);
+ mbuf_pkthdr_setlen(mhead, replen);
+ error = mbuf_pkthdr_setrcvif(mhead, NULL);
+ nfsm_chain_set_recmark(error, &nmrep, (replen - NFSX_UNSIGNED) | 0x80000000);
+ nfsm_chain_null(&nmrep);
+
+ /* send the reply */
+ bzero(&msg, sizeof(msg));
+ error = sock_sendmbuf(so, &msg, mhead, 0, &sentlen);
+ mhead = NULL;
+ if (!error && ((int)sentlen != replen))
+ error = EWOULDBLOCK;
+ if (error == EWOULDBLOCK) /* inability to send response is considered fatal */
+ error = ETIMEDOUT;
+out:
+ if (error)
+ nfsm_chain_cleanup(&nmrep);
+ if (mhead)
+ mbuf_freem(mhead);
+ if (mrest)
+ mbuf_freem(mrest);
+ if (mreq)
+ mbuf_freem(mreq);
+ return (error);
+}
+
+
+/*
+ * Initialize an nfs_rpc_record_state structure.
+ */
+void
+nfs_rpc_record_state_init(struct nfs_rpc_record_state *nrrsp)
+{
+ bzero(nrrsp, sizeof(*nrrsp));
+ nrrsp->nrrs_markerleft = sizeof(nrrsp->nrrs_fragleft);
+}
+
+/*
+ * Clean up an nfs_rpc_record_state structure.
+ */
+void
+nfs_rpc_record_state_cleanup(struct nfs_rpc_record_state *nrrsp)
+{
+ if (nrrsp->nrrs_m) {
+ mbuf_freem(nrrsp->nrrs_m);
+ nrrsp->nrrs_m = nrrsp->nrrs_mlast = NULL;
+ }
+}
+
+/*
+ * Read the next (marked) RPC record from the socket.
+ *
+ * *recvp returns if any data was received.
+ * *mp returns the next complete RPC record
+ */
+int
+nfs_rpc_record_read(socket_t so, struct nfs_rpc_record_state *nrrsp, int flags, int *recvp, mbuf_t *mp)
+{
+ struct iovec aio;
+ struct msghdr msg;
+ size_t rcvlen;
+ int error = 0;
+ mbuf_t m;
+
+ *recvp = 0;
+ *mp = NULL;
+
+ /* read the TCP RPC record marker */
+ while (!error && nrrsp->nrrs_markerleft) {
+ aio.iov_base = ((char*)&nrrsp->nrrs_fragleft +
+ sizeof(nrrsp->nrrs_fragleft) - nrrsp->nrrs_markerleft);
+ aio.iov_len = nrrsp->nrrs_markerleft;
+ bzero(&msg, sizeof(msg));
+ msg.msg_iov = &aio;
+ msg.msg_iovlen = 1;
+ error = sock_receive(so, &msg, flags, &rcvlen);
+ if (error || !rcvlen)
+ break;
+ *recvp = 1;
+ nrrsp->nrrs_markerleft -= rcvlen;
+ if (nrrsp->nrrs_markerleft)
+ continue;
+ /* record marker complete */
+ nrrsp->nrrs_fragleft = ntohl(nrrsp->nrrs_fragleft);
+ if (nrrsp->nrrs_fragleft & 0x80000000) {
+ nrrsp->nrrs_lastfrag = 1;
+ nrrsp->nrrs_fragleft &= ~0x80000000;
+ }
+ nrrsp->nrrs_reclen += nrrsp->nrrs_fragleft;
+ if (nrrsp->nrrs_reclen > NFS_MAXPACKET) {
+ /* This is SERIOUS! We are out of sync with the sender. */
+ log(LOG_ERR, "impossible RPC record length (%d) on callback", nrrsp->nrrs_reclen);
+ error = EFBIG;
+ }
+ }
+
+ /* read the TCP RPC record fragment */
+ while (!error && !nrrsp->nrrs_markerleft && nrrsp->nrrs_fragleft) {
+ m = NULL;
+ rcvlen = nrrsp->nrrs_fragleft;
+ error = sock_receivembuf(so, NULL, &m, flags, &rcvlen);
+ if (error || !rcvlen || !m)
+ break;
+ *recvp = 1;
+ /* append mbufs to list */
+ nrrsp->nrrs_fragleft -= rcvlen;
+ if (!nrrsp->nrrs_m) {
+ nrrsp->nrrs_m = m;
+ } else {
+ error = mbuf_setnext(nrrsp->nrrs_mlast, m);
+ if (error) {
+ printf("nfs tcp rcv: mbuf_setnext failed %d\n", error);
+ mbuf_freem(m);
+ break;
+ }
+ }
+ while (mbuf_next(m))
+ m = mbuf_next(m);
+ nrrsp->nrrs_mlast = m;
projects / apple / xnu.git / blobdiff