Print this page
NFS Auth per-zone needs better cleanup
| Split |
Close |
| Expand all |
| Collapse all |
--- old/usr/src/uts/common/fs/nfs/nfs_auth.c
+++ new/usr/src/uts/common/fs/nfs/nfs_auth.c
1 1 /*
2 2 * CDDL HEADER START
3 3 *
4 4 * The contents of this file are subject to the terms of the
5 5 * Common Development and Distribution License (the "License").
6 6 * You may not use this file except in compliance with the License.
7 7 *
8 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 9 * or http://www.opensolaris.org/os/licensing.
10 10 * See the License for the specific language governing permissions
11 11 * and limitations under the License.
12 12 *
13 13 * When distributing Covered Code, include this CDDL HEADER in each
14 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 15 * If applicable, add the following below this CDDL HEADER, with the
16 16 * fields enclosed by brackets "[]" replaced with your own identifying
17 17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 18 *
19 19 * CDDL HEADER END
20 20 */
21 21
22 22 /*
23 23 * Copyright (c) 1995, 2010, Oracle and/or its affiliates. All rights reserved.
24 24 * Copyright (c) 2015 by Delphix. All rights reserved.
25 25 * Copyright 2018 Nexenta Systems, Inc. All rights reserved.
26 26 */
27 27
28 28 #include <sys/param.h>
29 29 #include <sys/errno.h>
30 30 #include <sys/vfs.h>
31 31 #include <sys/vnode.h>
32 32 #include <sys/cred.h>
33 33 #include <sys/cmn_err.h>
34 34 #include <sys/systm.h>
35 35 #include <sys/kmem.h>
36 36 #include <sys/pathname.h>
37 37 #include <sys/utsname.h>
38 38 #include <sys/debug.h>
39 39 #include <sys/door.h>
40 40 #include <sys/sdt.h>
41 41 #include <sys/thread.h>
42 42 #include <sys/avl.h>
43 43
44 44 #include <rpc/types.h>
45 45 #include <rpc/auth.h>
46 46 #include <rpc/clnt.h>
47 47
48 48 #include <nfs/nfs.h>
49 49 #include <nfs/export.h>
50 50 #include <nfs/nfs_clnt.h>
51 51 #include <nfs/auth.h>
52 52
53 53 static struct kmem_cache *exi_cache_handle;
54 54 static void exi_cache_reclaim(void *);
55 55 static void exi_cache_trim(struct exportinfo *exi);
56 56 static void *nfsauth_zone_init(zoneid_t);
57 57 static void nfsauth_zone_shutdown(zoneid_t zoneid, void *data);
58 58 static void nfsauth_zone_fini(zoneid_t, void *);
59 59
60 60 extern pri_t minclsyspri;
61 61
62 62 /* NFS auth cache statistics */
63 63 volatile uint_t nfsauth_cache_hit;
64 64 volatile uint_t nfsauth_cache_miss;
65 65 volatile uint_t nfsauth_cache_refresh;
66 66 volatile uint_t nfsauth_cache_reclaim;
67 67 volatile uint_t exi_cache_auth_reclaim_failed;
68 68 volatile uint_t exi_cache_clnt_reclaim_failed;
69 69
70 70 /*
71 71 * The lifetime of an auth cache entry:
72 72 * ------------------------------------
73 73 *
74 74 * An auth cache entry is created with both the auth_time
75 75 * and auth_freshness times set to the current time.
76 76 *
77 77 * Upon every client access which results in a hit, the
78 78 * auth_time will be updated.
79 79 *
80 80 * If a client access determines that the auth_freshness
81 81 * indicates that the entry is STALE, then it will be
82 82 * refreshed. Note that this will explicitly reset
83 83 * auth_time.
84 84 *
85 85 * When the REFRESH successfully occurs, then the
86 86 * auth_freshness is updated.
87 87 *
88 88 * There are two ways for an entry to leave the cache:
89 89 *
90 90 * 1) Purged by an action on the export (remove or changed)
91 91 * 2) Memory backpressure from the kernel (check against NFSAUTH_CACHE_TRIM)
92 92 *
93 93 * For 2) we check the timeout value against auth_time.
94 94 */
95 95
96 96 /*
97 97 * Number of seconds until we mark for refresh an auth cache entry.
98 98 */
99 99 #define NFSAUTH_CACHE_REFRESH 600
100 100
101 101 /*
102 102 * Number of idle seconds until we yield to backpressure
103 103 * to trim a cache entry.
104 104 */
105 105 #define NFSAUTH_CACHE_TRIM 3600
106 106
107 107 /*
108 108 * While we could encapuslate the exi_list inside the
109 109 * exi structure, we can't do that for the auth_list.
110 110 * So, to keep things looking clean, we keep them both
111 111 * in these external lists.
112 112 */
113 113 typedef struct refreshq_exi_node {
114 114 struct exportinfo *ren_exi;
115 115 list_t ren_authlist;
116 116 list_node_t ren_node;
117 117 } refreshq_exi_node_t;
118 118
119 119 typedef struct refreshq_auth_node {
120 120 struct auth_cache *ran_auth;
121 121 char *ran_netid;
122 122 list_node_t ran_node;
123 123 } refreshq_auth_node_t;
124 124
125 125 /*
126 126 * Used to manipulate things on the refreshq_queue. Note that the refresh
127 127 * thread will effectively pop a node off of the queue, at which point it
128 128 * will no longer need to hold the mutex.
129 129 */
130 130 static kmutex_t refreshq_lock;
131 131 static list_t refreshq_queue;
132 132 static kcondvar_t refreshq_cv;
133 133
134 134 /*
135 135 * If there is ever a problem with loading the module, then nfsauth_fini()
136 136 * needs to be called to remove state. In that event, since the refreshq
137 137 * thread has been started, they need to work together to get rid of state.
138 138 */
139 139 typedef enum nfsauth_refreshq_thread_state {
140 140 REFRESHQ_THREAD_RUNNING,
141 141 REFRESHQ_THREAD_FINI_REQ,
142 142 REFRESHQ_THREAD_HALTED,
143 143 REFRESHQ_THREAD_NEED_CREATE
144 144 } nfsauth_refreshq_thread_state_t;
145 145
146 146 typedef struct nfsauth_globals {
147 147 kmutex_t mountd_lock;
148 148 door_handle_t mountd_dh;
149 149
150 150 /*
151 151 * Used to manipulate things on the refreshq_queue. Note that the
152 152 * refresh thread will effectively pop a node off of the queue,
153 153 * at which point it will no longer need to hold the mutex.
154 154 */
155 155 kmutex_t refreshq_lock;
156 156 list_t refreshq_queue;
157 157 kcondvar_t refreshq_cv;
158 158
159 159 /*
160 160 * A list_t would be overkill. These are auth_cache entries which are
161 161 * no longer linked to an exi. It should be the case that all of their
162 162 * states are NFS_AUTH_INVALID, i.e., the only way to be put on this
163 163 * list is iff their state indicated that they had been placed on the
164 164 * refreshq_queue.
165 165 *
166 166 * Note that while there is no link from the exi or back to the exi,
167 167 * the exi can not go away until these entries are harvested.
168 168 */
169 169 struct auth_cache *refreshq_dead_entries;
170 170 nfsauth_refreshq_thread_state_t refreshq_thread_state;
171 171
172 172 } nfsauth_globals_t;
173 173
174 174 static void nfsauth_free_node(struct auth_cache *);
175 175 static void nfsauth_refresh_thread(nfsauth_globals_t *);
176 176
177 177 static int nfsauth_cache_compar(const void *, const void *);
178 178
179 179 static zone_key_t nfsauth_zone_key;
180 180
181 181 void
182 182 mountd_args(uint_t did)
183 183 {
184 184 nfsauth_globals_t *nag;
185 185
186 186 nag = zone_getspecific(nfsauth_zone_key, curzone);
187 187 mutex_enter(&nag->mountd_lock);
188 188 if (nag->mountd_dh != NULL)
189 189 door_ki_rele(nag->mountd_dh);
190 190 nag->mountd_dh = door_ki_lookup(did);
191 191 mutex_exit(&nag->mountd_lock);
192 192 }
193 193
194 194 void
195 195 nfsauth_init(void)
196 196 {
197 197 zone_key_create(&nfsauth_zone_key, nfsauth_zone_init,
198 198 nfsauth_zone_shutdown, nfsauth_zone_fini);
199 199
200 200 exi_cache_handle = kmem_cache_create("exi_cache_handle",
201 201 sizeof (struct auth_cache), 0, NULL, NULL,
202 202 exi_cache_reclaim, NULL, NULL, 0);
203 203 }
204 204
205 205 void
206 206 nfsauth_fini(void)
207 207 {
208 208 kmem_cache_destroy(exi_cache_handle);
209 209 }
210 210
211 211 /*ARGSUSED*/
212 212 static void *
213 213 nfsauth_zone_init(zoneid_t zoneid)
214 214 {
215 215 nfsauth_globals_t *nag;
216 216
217 217 nag = kmem_zalloc(sizeof (*nag), KM_SLEEP);
218 218
219 219 /*
220 220 * mountd can be restarted by smf(5). We need to make sure
221 221 * the updated door handle will safely make it to mountd_dh.
222 222 */
223 223 mutex_init(&nag->mountd_lock, NULL, MUTEX_DEFAULT, NULL);
224 224 mutex_init(&nag->refreshq_lock, NULL, MUTEX_DEFAULT, NULL);
225 225 list_create(&nag->refreshq_queue, sizeof (refreshq_exi_node_t),
226 226 offsetof(refreshq_exi_node_t, ren_node));
227 227 cv_init(&nag->refreshq_cv, NULL, CV_DEFAULT, NULL);
228 228 nag->refreshq_thread_state = REFRESHQ_THREAD_NEED_CREATE;
229 229
230 230 return (nag);
231 231 }
232 232
233 233 /*ARGSUSED*/
234 234 static void
235 235 nfsauth_zone_shutdown(zoneid_t zoneid, void *data)
236 236 {
237 237 refreshq_exi_node_t *ren;
238 238 nfsauth_globals_t *nag = data;
239 239
240 240 /* Prevent the nfsauth_refresh_thread from getting new work */
241 241 mutex_enter(&nag->refreshq_lock);
242 242 if (nag->refreshq_thread_state == REFRESHQ_THREAD_RUNNING) {
243 243 nag->refreshq_thread_state = REFRESHQ_THREAD_FINI_REQ;
244 244 cv_broadcast(&nag->refreshq_cv);
245 245
246 246 /* Wait for nfsauth_refresh_thread() to exit */
247 247 while (nag->refreshq_thread_state != REFRESHQ_THREAD_HALTED)
248 248 cv_wait(&nag->refreshq_cv, &nag->refreshq_lock);
249 249 }
250 250 mutex_exit(&nag->refreshq_lock);
251 251
252 252 /*
253 253 * Walk the exi_list and in turn, walk the auth_lists and free all
254 254 * lists. In addition, free INVALID auth_cache entries.
255 255 */
256 256 while ((ren = list_remove_head(&nag->refreshq_queue))) {
257 257 refreshq_auth_node_t *ran;
258 258
259 259 while ((ran = list_remove_head(&ren->ren_authlist)) != NULL) {
260 260 struct auth_cache *p = ran->ran_auth;
261 261 if (p->auth_state == NFS_AUTH_INVALID)
262 262 nfsauth_free_node(p);
263 263 strfree(ran->ran_netid);
264 264 kmem_free(ran, sizeof (*ran));
265 265 }
266 266
267 267 list_destroy(&ren->ren_authlist);
268 268 exi_rele(ren->ren_exi);
269 269 kmem_free(ren, sizeof (*ren));
270 270 }
271 271 }
272 272
|
↓ open down ↓ |
272 lines elided |
↑ open up ↑ |
273 273 /*ARGSUSED*/
274 274 static void
275 275 nfsauth_zone_fini(zoneid_t zoneid, void *data)
276 276 {
277 277 nfsauth_globals_t *nag = data;
278 278
279 279 list_destroy(&nag->refreshq_queue);
280 280 cv_destroy(&nag->refreshq_cv);
281 281 mutex_destroy(&nag->refreshq_lock);
282 282 mutex_destroy(&nag->mountd_lock);
283 + /* Extra cleanup. */
284 + if (nag->mountd_dh != NULL)
285 + door_ki_rele(nag->mountd_dh);
283 286 kmem_free(nag, sizeof (*nag));
284 287 }
285 288
286 289 /*
287 290 * Convert the address in a netbuf to
288 291 * a hash index for the auth_cache table.
289 292 */
290 293 static int
291 294 hash(struct netbuf *a)
292 295 {
293 296 int i, h = 0;
294 297
295 298 for (i = 0; i < a->len; i++)
296 299 h ^= a->buf[i];
297 300
298 301 return (h & (AUTH_TABLESIZE - 1));
299 302 }
300 303
301 304 /*
302 305 * Mask out the components of an
303 306 * address that do not identify
304 307 * a host. For socket addresses the
305 308 * masking gets rid of the port number.
306 309 */
307 310 static void
308 311 addrmask(struct netbuf *addr, struct netbuf *mask)
309 312 {
310 313 int i;
311 314
312 315 for (i = 0; i < addr->len; i++)
313 316 addr->buf[i] &= mask->buf[i];
314 317 }
315 318
316 319 /*
317 320 * nfsauth4_access is used for NFS V4 auth checking. Besides doing
318 321 * the common nfsauth_access(), it will check if the client can
319 322 * have a limited access to this vnode even if the security flavor
320 323 * used does not meet the policy.
321 324 */
322 325 int
323 326 nfsauth4_access(struct exportinfo *exi, vnode_t *vp, struct svc_req *req,
324 327 cred_t *cr, uid_t *uid, gid_t *gid, uint_t *ngids, gid_t **gids)
325 328 {
326 329 int access;
327 330
328 331 access = nfsauth_access(exi, req, cr, uid, gid, ngids, gids);
329 332
330 333 /*
331 334 * There are cases that the server needs to allow the client
332 335 * to have a limited view.
333 336 *
334 337 * e.g.
335 338 * /export is shared as "sec=sys,rw=dfs-test-4,sec=krb5,rw"
336 339 * /export/home is shared as "sec=sys,rw"
337 340 *
338 341 * When the client mounts /export with sec=sys, the client
339 342 * would get a limited view with RO access on /export to see
340 343 * "home" only because the client is allowed to access
341 344 * /export/home with auth_sys.
342 345 */
343 346 if (access & NFSAUTH_DENIED || access & NFSAUTH_WRONGSEC) {
344 347 /*
345 348 * Allow ro permission with LIMITED view if there is a
346 349 * sub-dir exported under vp.
347 350 */
348 351 if (has_visible(exi, vp))
349 352 return (NFSAUTH_LIMITED);
350 353 }
351 354
352 355 return (access);
353 356 }
354 357
355 358 static void
356 359 sys_log(const char *msg)
357 360 {
358 361 static time_t tstamp = 0;
359 362 time_t now;
360 363
361 364 /*
362 365 * msg is shown (at most) once per minute
363 366 */
364 367 now = gethrestime_sec();
365 368 if ((tstamp + 60) < now) {
366 369 tstamp = now;
367 370 cmn_err(CE_WARN, msg);
368 371 }
369 372 }
370 373
371 374 /*
372 375 * Callup to the mountd to get access information in the kernel.
373 376 */
374 377 static bool_t
375 378 nfsauth_retrieve(nfsauth_globals_t *nag, struct exportinfo *exi,
376 379 char *req_netid, int flavor, struct netbuf *addr, int *access,
377 380 cred_t *clnt_cred, uid_t *srv_uid, gid_t *srv_gid, uint_t *srv_gids_cnt,
378 381 gid_t **srv_gids)
379 382 {
380 383 varg_t varg = {0};
381 384 nfsauth_res_t res = {0};
382 385 XDR xdrs;
383 386 size_t absz;
384 387 caddr_t abuf;
385 388 int last = 0;
386 389 door_arg_t da;
387 390 door_info_t di;
388 391 door_handle_t dh;
389 392 uint_t ntries = 0;
390 393
391 394 /*
392 395 * No entry in the cache for this client/flavor
393 396 * so we need to call the nfsauth service in the
394 397 * mount daemon.
395 398 */
396 399
397 400 varg.vers = V_PROTO;
398 401 varg.arg_u.arg.cmd = NFSAUTH_ACCESS;
399 402 varg.arg_u.arg.areq.req_client.n_len = addr->len;
400 403 varg.arg_u.arg.areq.req_client.n_bytes = addr->buf;
401 404 varg.arg_u.arg.areq.req_netid = req_netid;
402 405 varg.arg_u.arg.areq.req_path = exi->exi_export.ex_path;
403 406 varg.arg_u.arg.areq.req_flavor = flavor;
404 407 varg.arg_u.arg.areq.req_clnt_uid = crgetuid(clnt_cred);
405 408 varg.arg_u.arg.areq.req_clnt_gid = crgetgid(clnt_cred);
406 409 varg.arg_u.arg.areq.req_clnt_gids.len = crgetngroups(clnt_cred);
407 410 varg.arg_u.arg.areq.req_clnt_gids.val = (gid_t *)crgetgroups(clnt_cred);
408 411
409 412 DTRACE_PROBE1(nfsserv__func__nfsauth__varg, varg_t *, &varg);
410 413
411 414 /*
412 415 * Setup the XDR stream for encoding the arguments. Notice that
413 416 * in addition to the args having variable fields (req_netid and
414 417 * req_path), the argument data structure is itself versioned,
415 418 * so we need to make sure we can size the arguments buffer
416 419 * appropriately to encode all the args. If we can't get sizing
417 420 * info _or_ properly encode the arguments, there's really no
418 421 * point in continuting, so we fail the request.
419 422 */
420 423 if ((absz = xdr_sizeof(xdr_varg, &varg)) == 0) {
421 424 *access = NFSAUTH_DENIED;
422 425 return (FALSE);
423 426 }
424 427
425 428 abuf = (caddr_t)kmem_alloc(absz, KM_SLEEP);
426 429 xdrmem_create(&xdrs, abuf, absz, XDR_ENCODE);
427 430 if (!xdr_varg(&xdrs, &varg)) {
428 431 XDR_DESTROY(&xdrs);
429 432 goto fail;
430 433 }
431 434 XDR_DESTROY(&xdrs);
432 435
433 436 /*
434 437 * Prepare the door arguments
435 438 *
436 439 * We don't know the size of the message the daemon
437 440 * will pass back to us. By setting rbuf to NULL,
438 441 * we force the door code to allocate a buf of the
439 442 * appropriate size. We must set rsize > 0, however,
440 443 * else the door code acts as if no response was
441 444 * expected and doesn't pass the data to us.
442 445 */
443 446 da.data_ptr = (char *)abuf;
444 447 da.data_size = absz;
445 448 da.desc_ptr = NULL;
446 449 da.desc_num = 0;
447 450 da.rbuf = NULL;
448 451 da.rsize = 1;
449 452
450 453 retry:
451 454 mutex_enter(&nag->mountd_lock);
452 455 dh = nag->mountd_dh;
453 456 if (dh != NULL)
454 457 door_ki_hold(dh);
455 458 mutex_exit(&nag->mountd_lock);
456 459
457 460 if (dh == NULL) {
458 461 /*
459 462 * The rendezvous point has not been established yet!
460 463 * This could mean that either mountd(1m) has not yet
461 464 * been started or that _this_ routine nuked the door
462 465 * handle after receiving an EINTR for a REVOKED door.
463 466 *
464 467 * Returning NFSAUTH_DROP will cause the NFS client
465 468 * to retransmit the request, so let's try to be more
466 469 * rescillient and attempt for ntries before we bail.
467 470 */
468 471 if (++ntries % NFSAUTH_DR_TRYCNT) {
469 472 delay(hz);
470 473 goto retry;
471 474 }
472 475
473 476 kmem_free(abuf, absz);
474 477
475 478 sys_log("nfsauth: mountd has not established door");
476 479 *access = NFSAUTH_DROP;
477 480 return (FALSE);
478 481 }
479 482
480 483 ntries = 0;
481 484
482 485 /*
483 486 * Now that we've got what we need, place the call.
484 487 */
485 488 switch (door_ki_upcall_limited(dh, &da, NULL, SIZE_MAX, 0)) {
486 489 case 0: /* Success */
487 490 door_ki_rele(dh);
488 491
489 492 if (da.data_ptr == NULL && da.data_size == 0) {
490 493 /*
491 494 * The door_return that contained the data
492 495 * failed! We're here because of the 2nd
493 496 * door_return (w/o data) such that we can
494 497 * get control of the thread (and exit
495 498 * gracefully).
496 499 */
497 500 DTRACE_PROBE1(nfsserv__func__nfsauth__door__nil,
498 501 door_arg_t *, &da);
499 502 goto fail;
500 503 }
501 504
502 505 break;
503 506
504 507 case EAGAIN:
505 508 /*
506 509 * Server out of resources; back off for a bit
507 510 */
508 511 door_ki_rele(dh);
509 512 delay(hz);
510 513 goto retry;
511 514 /* NOTREACHED */
512 515
513 516 case EINTR:
514 517 if (!door_ki_info(dh, &di)) {
515 518 door_ki_rele(dh);
516 519
517 520 if (di.di_attributes & DOOR_REVOKED) {
518 521 /*
519 522 * The server barfed and revoked
520 523 * the (existing) door on us; we
521 524 * want to wait to give smf(5) a
522 525 * chance to restart mountd(1m)
523 526 * and establish a new door handle.
524 527 */
525 528 mutex_enter(&nag->mountd_lock);
526 529 if (dh == nag->mountd_dh) {
527 530 door_ki_rele(nag->mountd_dh);
528 531 nag->mountd_dh = NULL;
529 532 }
530 533 mutex_exit(&nag->mountd_lock);
531 534 delay(hz);
532 535 goto retry;
533 536 }
534 537 /*
535 538 * If the door was _not_ revoked on us,
536 539 * then more than likely we took an INTR,
537 540 * so we need to fail the operation.
538 541 */
539 542 goto fail;
540 543 }
541 544 /*
542 545 * The only failure that can occur from getting
543 546 * the door info is EINVAL, so we let the code
544 547 * below handle it.
545 548 */
546 549 /* FALLTHROUGH */
547 550
548 551 case EBADF:
549 552 case EINVAL:
550 553 default:
551 554 /*
552 555 * If we have a stale door handle, give smf a last
553 556 * chance to start it by sleeping for a little bit.
554 557 * If we're still hosed, we'll fail the call.
555 558 *
556 559 * Since we're going to reacquire the door handle
557 560 * upon the retry, we opt to sleep for a bit and
558 561 * _not_ to clear mountd_dh. If mountd restarted
559 562 * and was able to set mountd_dh, we should see
560 563 * the new instance; if not, we won't get caught
561 564 * up in the retry/DELAY loop.
562 565 */
563 566 door_ki_rele(dh);
564 567 if (!last) {
565 568 delay(hz);
566 569 last++;
567 570 goto retry;
568 571 }
569 572 sys_log("nfsauth: stale mountd door handle");
570 573 goto fail;
571 574 }
572 575
573 576 ASSERT(da.rbuf != NULL);
574 577
575 578 /*
576 579 * No door errors encountered; setup the XDR stream for decoding
577 580 * the results. If we fail to decode the results, we've got no
578 581 * other recourse than to fail the request.
579 582 */
580 583 xdrmem_create(&xdrs, da.rbuf, da.rsize, XDR_DECODE);
581 584 if (!xdr_nfsauth_res(&xdrs, &res)) {
582 585 xdr_free(xdr_nfsauth_res, (char *)&res);
583 586 XDR_DESTROY(&xdrs);
584 587 kmem_free(da.rbuf, da.rsize);
585 588 goto fail;
586 589 }
587 590 XDR_DESTROY(&xdrs);
588 591 kmem_free(da.rbuf, da.rsize);
589 592
590 593 DTRACE_PROBE1(nfsserv__func__nfsauth__results, nfsauth_res_t *, &res);
591 594 switch (res.stat) {
592 595 case NFSAUTH_DR_OKAY:
593 596 *access = res.ares.auth_perm;
594 597 *srv_uid = res.ares.auth_srv_uid;
595 598 *srv_gid = res.ares.auth_srv_gid;
596 599 *srv_gids_cnt = res.ares.auth_srv_gids.len;
597 600 *srv_gids = kmem_alloc(*srv_gids_cnt * sizeof (gid_t),
598 601 KM_SLEEP);
599 602 bcopy(res.ares.auth_srv_gids.val, *srv_gids,
600 603 *srv_gids_cnt * sizeof (gid_t));
601 604 break;
602 605
603 606 case NFSAUTH_DR_EFAIL:
604 607 case NFSAUTH_DR_DECERR:
605 608 case NFSAUTH_DR_BADCMD:
606 609 default:
607 610 xdr_free(xdr_nfsauth_res, (char *)&res);
608 611 fail:
609 612 *access = NFSAUTH_DENIED;
610 613 kmem_free(abuf, absz);
611 614 return (FALSE);
612 615 /* NOTREACHED */
613 616 }
614 617
615 618 xdr_free(xdr_nfsauth_res, (char *)&res);
616 619 kmem_free(abuf, absz);
617 620
618 621 return (TRUE);
619 622 }
620 623
621 624 static void
622 625 nfsauth_refresh_thread(nfsauth_globals_t *nag)
623 626 {
624 627 refreshq_exi_node_t *ren;
625 628 refreshq_auth_node_t *ran;
626 629
627 630 struct exportinfo *exi;
628 631
629 632 int access;
630 633 bool_t retrieval;
631 634
632 635 callb_cpr_t cprinfo;
633 636
634 637 CALLB_CPR_INIT(&cprinfo, &nag->refreshq_lock, callb_generic_cpr,
635 638 "nfsauth_refresh");
636 639
637 640 for (;;) {
638 641 mutex_enter(&nag->refreshq_lock);
639 642 if (nag->refreshq_thread_state != REFRESHQ_THREAD_RUNNING) {
640 643 /* Keep the hold on the lock! */
641 644 break;
642 645 }
643 646
644 647 ren = list_remove_head(&nag->refreshq_queue);
645 648 if (ren == NULL) {
646 649 CALLB_CPR_SAFE_BEGIN(&cprinfo);
647 650 cv_wait(&nag->refreshq_cv, &nag->refreshq_lock);
648 651 CALLB_CPR_SAFE_END(&cprinfo, &nag->refreshq_lock);
649 652 mutex_exit(&nag->refreshq_lock);
650 653 continue;
651 654 }
652 655 mutex_exit(&nag->refreshq_lock);
653 656
654 657 exi = ren->ren_exi;
655 658 ASSERT(exi != NULL);
656 659
657 660 /*
658 661 * Since the ren was removed from the refreshq_queue above,
659 662 * this is the only thread aware about the ren existence, so we
660 663 * have the exclusive ownership of it and we do not need to
661 664 * protect it by any lock.
662 665 */
663 666 while ((ran = list_remove_head(&ren->ren_authlist))) {
664 667 uid_t uid;
665 668 gid_t gid;
666 669 uint_t ngids;
667 670 gid_t *gids;
668 671 struct auth_cache *p = ran->ran_auth;
669 672 char *netid = ran->ran_netid;
670 673
671 674 ASSERT(p != NULL);
672 675 ASSERT(netid != NULL);
673 676
674 677 kmem_free(ran, sizeof (refreshq_auth_node_t));
675 678
676 679 mutex_enter(&p->auth_lock);
677 680
678 681 /*
679 682 * Once the entry goes INVALID, it can not change
680 683 * state.
681 684 *
682 685 * No need to refresh entries also in a case we are
683 686 * just shutting down.
684 687 *
685 688 * In general, there is no need to hold the
686 689 * refreshq_lock to test the refreshq_thread_state. We
687 690 * do hold it at other places because there is some
688 691 * related thread synchronization (or some other tasks)
689 692 * close to the refreshq_thread_state check.
690 693 *
691 694 * The check for the refreshq_thread_state value here
692 695 * is purely advisory to allow the faster
693 696 * nfsauth_refresh_thread() shutdown. In a case we
694 697 * will miss such advisory, nothing catastrophic
695 698 * happens: we will just spin longer here before the
696 699 * shutdown.
697 700 */
698 701 if (p->auth_state == NFS_AUTH_INVALID ||
699 702 nag->refreshq_thread_state !=
700 703 REFRESHQ_THREAD_RUNNING) {
701 704 mutex_exit(&p->auth_lock);
702 705
703 706 if (p->auth_state == NFS_AUTH_INVALID)
704 707 nfsauth_free_node(p);
705 708
706 709 strfree(netid);
707 710
708 711 continue;
709 712 }
710 713
711 714 /*
712 715 * Make sure the state is valid. Note that once we
713 716 * change the state to NFS_AUTH_REFRESHING, no other
714 717 * thread will be able to work on this entry.
715 718 */
716 719 ASSERT(p->auth_state == NFS_AUTH_STALE);
717 720
718 721 p->auth_state = NFS_AUTH_REFRESHING;
719 722 mutex_exit(&p->auth_lock);
720 723
721 724 DTRACE_PROBE2(nfsauth__debug__cache__refresh,
722 725 struct exportinfo *, exi,
723 726 struct auth_cache *, p);
724 727
725 728 /*
726 729 * The first caching of the access rights
727 730 * is done with the netid pulled out of the
728 731 * request from the client. All subsequent
729 732 * users of the cache may or may not have
730 733 * the same netid. It doesn't matter. So
731 734 * when we refresh, we simply use the netid
732 735 * of the request which triggered the
733 736 * refresh attempt.
734 737 */
735 738 retrieval = nfsauth_retrieve(nag, exi, netid,
736 739 p->auth_flavor, &p->auth_clnt->authc_addr, &access,
737 740 p->auth_clnt_cred, &uid, &gid, &ngids, &gids);
738 741
739 742 /*
740 743 * This can only be set in one other place
741 744 * and the state has to be NFS_AUTH_FRESH.
742 745 */
743 746 strfree(netid);
744 747
745 748 mutex_enter(&p->auth_lock);
746 749 if (p->auth_state == NFS_AUTH_INVALID) {
747 750 mutex_exit(&p->auth_lock);
748 751 nfsauth_free_node(p);
749 752 if (retrieval == TRUE)
750 753 kmem_free(gids, ngids * sizeof (gid_t));
751 754 } else {
752 755 /*
753 756 * If we got an error, do not reset the
754 757 * time. This will cause the next access
755 758 * check for the client to reschedule this
756 759 * node.
757 760 */
758 761 if (retrieval == TRUE) {
759 762 p->auth_access = access;
760 763
761 764 p->auth_srv_uid = uid;
762 765 p->auth_srv_gid = gid;
763 766 kmem_free(p->auth_srv_gids,
764 767 p->auth_srv_ngids * sizeof (gid_t));
765 768 p->auth_srv_ngids = ngids;
766 769 p->auth_srv_gids = gids;
767 770
768 771 p->auth_freshness = gethrestime_sec();
769 772 }
770 773 p->auth_state = NFS_AUTH_FRESH;
771 774
772 775 cv_broadcast(&p->auth_cv);
773 776 mutex_exit(&p->auth_lock);
774 777 }
775 778 }
776 779
777 780 list_destroy(&ren->ren_authlist);
778 781 exi_rele(ren->ren_exi);
779 782 kmem_free(ren, sizeof (refreshq_exi_node_t));
780 783 }
781 784
782 785 nag->refreshq_thread_state = REFRESHQ_THREAD_HALTED;
783 786 cv_broadcast(&nag->refreshq_cv);
784 787 CALLB_CPR_EXIT(&cprinfo);
785 788 DTRACE_PROBE(nfsauth__nfsauth__refresh__thread__exit);
786 789 zthread_exit();
787 790 }
788 791
789 792 int
790 793 nfsauth_cache_clnt_compar(const void *v1, const void *v2)
791 794 {
792 795 int c;
793 796
794 797 const struct auth_cache_clnt *a1 = (const struct auth_cache_clnt *)v1;
795 798 const struct auth_cache_clnt *a2 = (const struct auth_cache_clnt *)v2;
796 799
797 800 if (a1->authc_addr.len < a2->authc_addr.len)
798 801 return (-1);
799 802 if (a1->authc_addr.len > a2->authc_addr.len)
800 803 return (1);
801 804
802 805 c = memcmp(a1->authc_addr.buf, a2->authc_addr.buf, a1->authc_addr.len);
803 806 if (c < 0)
804 807 return (-1);
805 808 if (c > 0)
806 809 return (1);
807 810
808 811 return (0);
809 812 }
810 813
811 814 static int
812 815 nfsauth_cache_compar(const void *v1, const void *v2)
813 816 {
814 817 int c;
815 818
816 819 const struct auth_cache *a1 = (const struct auth_cache *)v1;
817 820 const struct auth_cache *a2 = (const struct auth_cache *)v2;
818 821
819 822 if (a1->auth_flavor < a2->auth_flavor)
820 823 return (-1);
821 824 if (a1->auth_flavor > a2->auth_flavor)
822 825 return (1);
823 826
824 827 if (crgetuid(a1->auth_clnt_cred) < crgetuid(a2->auth_clnt_cred))
825 828 return (-1);
826 829 if (crgetuid(a1->auth_clnt_cred) > crgetuid(a2->auth_clnt_cred))
827 830 return (1);
828 831
829 832 if (crgetgid(a1->auth_clnt_cred) < crgetgid(a2->auth_clnt_cred))
830 833 return (-1);
831 834 if (crgetgid(a1->auth_clnt_cred) > crgetgid(a2->auth_clnt_cred))
832 835 return (1);
833 836
834 837 if (crgetngroups(a1->auth_clnt_cred) < crgetngroups(a2->auth_clnt_cred))
835 838 return (-1);
836 839 if (crgetngroups(a1->auth_clnt_cred) > crgetngroups(a2->auth_clnt_cred))
837 840 return (1);
838 841
839 842 c = memcmp(crgetgroups(a1->auth_clnt_cred),
840 843 crgetgroups(a2->auth_clnt_cred), crgetngroups(a1->auth_clnt_cred));
841 844 if (c < 0)
842 845 return (-1);
843 846 if (c > 0)
844 847 return (1);
845 848
846 849 return (0);
847 850 }
848 851
849 852 /*
850 853 * Get the access information from the cache or callup to the mountd
851 854 * to get and cache the access information in the kernel.
852 855 */
853 856 static int
854 857 nfsauth_cache_get(struct exportinfo *exi, struct svc_req *req, int flavor,
855 858 cred_t *cr, uid_t *uid, gid_t *gid, uint_t *ngids, gid_t **gids)
856 859 {
857 860 nfsauth_globals_t *nag;
858 861 struct netbuf *taddrmask;
859 862 struct netbuf addr; /* temporary copy of client's address */
860 863 const struct netbuf *claddr;
861 864 avl_tree_t *tree;
862 865 struct auth_cache ac; /* used as a template for avl_find() */
863 866 struct auth_cache_clnt *c;
864 867 struct auth_cache_clnt acc; /* used as a template for avl_find() */
865 868 struct auth_cache *p = NULL;
866 869 int access;
867 870
868 871 uid_t tmpuid;
869 872 gid_t tmpgid;
870 873 uint_t tmpngids;
871 874 gid_t *tmpgids;
872 875
873 876 avl_index_t where; /* used for avl_find()/avl_insert() */
874 877
875 878 ASSERT(cr != NULL);
876 879
877 880 ASSERT3P(curzone, ==, exi->exi_zone);
878 881 nag = zone_getspecific(nfsauth_zone_key, curzone);
879 882
880 883 /*
881 884 * Now check whether this client already
882 885 * has an entry for this flavor in the cache
883 886 * for this export.
884 887 * Get the caller's address, mask off the
885 888 * parts of the address that do not identify
886 889 * the host (port number, etc), and then hash
887 890 * it to find the chain of cache entries.
888 891 */
889 892
890 893 claddr = svc_getrpccaller(req->rq_xprt);
891 894 addr = *claddr;
892 895 addr.buf = kmem_alloc(addr.maxlen, KM_SLEEP);
893 896 bcopy(claddr->buf, addr.buf, claddr->len);
894 897
895 898 SVC_GETADDRMASK(req->rq_xprt, SVC_TATTR_ADDRMASK, (void **)&taddrmask);
896 899 ASSERT(taddrmask != NULL);
897 900 addrmask(&addr, taddrmask);
898 901
899 902 ac.auth_flavor = flavor;
900 903 ac.auth_clnt_cred = crdup(cr);
901 904
902 905 acc.authc_addr = addr;
903 906
904 907 tree = exi->exi_cache[hash(&addr)];
905 908
906 909 rw_enter(&exi->exi_cache_lock, RW_READER);
907 910 c = (struct auth_cache_clnt *)avl_find(tree, &acc, NULL);
908 911
909 912 if (c == NULL) {
910 913 struct auth_cache_clnt *nc;
911 914
912 915 rw_exit(&exi->exi_cache_lock);
913 916
914 917 nc = kmem_alloc(sizeof (*nc), KM_NOSLEEP | KM_NORMALPRI);
915 918 if (nc == NULL)
916 919 goto retrieve;
917 920
918 921 /*
919 922 * Initialize the new auth_cache_clnt
920 923 */
921 924 nc->authc_addr = addr;
922 925 nc->authc_addr.buf = kmem_alloc(addr.maxlen,
923 926 KM_NOSLEEP | KM_NORMALPRI);
924 927 if (addr.maxlen != 0 && nc->authc_addr.buf == NULL) {
925 928 kmem_free(nc, sizeof (*nc));
926 929 goto retrieve;
927 930 }
928 931 bcopy(addr.buf, nc->authc_addr.buf, addr.len);
929 932 rw_init(&nc->authc_lock, NULL, RW_DEFAULT, NULL);
930 933 avl_create(&nc->authc_tree, nfsauth_cache_compar,
931 934 sizeof (struct auth_cache),
932 935 offsetof(struct auth_cache, auth_link));
933 936
934 937 rw_enter(&exi->exi_cache_lock, RW_WRITER);
935 938 c = (struct auth_cache_clnt *)avl_find(tree, &acc, &where);
936 939 if (c == NULL) {
937 940 avl_insert(tree, nc, where);
938 941 rw_downgrade(&exi->exi_cache_lock);
939 942 c = nc;
940 943 } else {
941 944 rw_downgrade(&exi->exi_cache_lock);
942 945
943 946 avl_destroy(&nc->authc_tree);
944 947 rw_destroy(&nc->authc_lock);
945 948 kmem_free(nc->authc_addr.buf, nc->authc_addr.maxlen);
946 949 kmem_free(nc, sizeof (*nc));
947 950 }
948 951 }
949 952
950 953 ASSERT(c != NULL);
951 954
952 955 rw_enter(&c->authc_lock, RW_READER);
953 956 p = (struct auth_cache *)avl_find(&c->authc_tree, &ac, NULL);
954 957
955 958 if (p == NULL) {
956 959 struct auth_cache *np;
957 960
958 961 rw_exit(&c->authc_lock);
959 962
960 963 np = kmem_cache_alloc(exi_cache_handle,
961 964 KM_NOSLEEP | KM_NORMALPRI);
962 965 if (np == NULL) {
963 966 rw_exit(&exi->exi_cache_lock);
964 967 goto retrieve;
965 968 }
966 969
967 970 /*
968 971 * Initialize the new auth_cache
969 972 */
970 973 np->auth_clnt = c;
971 974 np->auth_flavor = flavor;
972 975 np->auth_clnt_cred = ac.auth_clnt_cred;
973 976 np->auth_srv_ngids = 0;
974 977 np->auth_srv_gids = NULL;
975 978 np->auth_time = np->auth_freshness = gethrestime_sec();
976 979 np->auth_state = NFS_AUTH_NEW;
977 980 mutex_init(&np->auth_lock, NULL, MUTEX_DEFAULT, NULL);
978 981 cv_init(&np->auth_cv, NULL, CV_DEFAULT, NULL);
979 982
980 983 rw_enter(&c->authc_lock, RW_WRITER);
981 984 rw_exit(&exi->exi_cache_lock);
982 985
983 986 p = (struct auth_cache *)avl_find(&c->authc_tree, &ac, &where);
984 987 if (p == NULL) {
985 988 avl_insert(&c->authc_tree, np, where);
986 989 rw_downgrade(&c->authc_lock);
987 990 p = np;
988 991 } else {
989 992 rw_downgrade(&c->authc_lock);
990 993
991 994 cv_destroy(&np->auth_cv);
992 995 mutex_destroy(&np->auth_lock);
993 996 crfree(ac.auth_clnt_cred);
994 997 kmem_cache_free(exi_cache_handle, np);
995 998 }
996 999 } else {
997 1000 rw_exit(&exi->exi_cache_lock);
998 1001 crfree(ac.auth_clnt_cred);
999 1002 }
1000 1003
1001 1004 mutex_enter(&p->auth_lock);
1002 1005 rw_exit(&c->authc_lock);
1003 1006
1004 1007 /*
1005 1008 * If the entry is in the WAITING state then some other thread is just
1006 1009 * retrieving the required info. The entry was either NEW, or the list
1007 1010 * of client's supplemental groups is going to be changed (either by
1008 1011 * this thread, or by some other thread). We need to wait until the
1009 1012 * nfsauth_retrieve() is done.
1010 1013 */
1011 1014 while (p->auth_state == NFS_AUTH_WAITING)
1012 1015 cv_wait(&p->auth_cv, &p->auth_lock);
1013 1016
1014 1017 /*
1015 1018 * Here the entry cannot be in WAITING or INVALID state.
1016 1019 */
1017 1020 ASSERT(p->auth_state != NFS_AUTH_WAITING);
1018 1021 ASSERT(p->auth_state != NFS_AUTH_INVALID);
1019 1022
1020 1023 /*
1021 1024 * If the cache entry is not valid yet, we need to retrieve the
1022 1025 * info ourselves.
1023 1026 */
1024 1027 if (p->auth_state == NFS_AUTH_NEW) {
1025 1028 bool_t res;
1026 1029 /*
1027 1030 * NFS_AUTH_NEW is the default output auth_state value in a
1028 1031 * case we failed somewhere below.
1029 1032 */
1030 1033 auth_state_t state = NFS_AUTH_NEW;
1031 1034
1032 1035 p->auth_state = NFS_AUTH_WAITING;
1033 1036 mutex_exit(&p->auth_lock);
1034 1037 kmem_free(addr.buf, addr.maxlen);
1035 1038 addr = p->auth_clnt->authc_addr;
1036 1039
1037 1040 atomic_inc_uint(&nfsauth_cache_miss);
1038 1041
1039 1042 res = nfsauth_retrieve(nag, exi, svc_getnetid(req->rq_xprt),
1040 1043 flavor, &addr, &access, cr, &tmpuid, &tmpgid, &tmpngids,
1041 1044 &tmpgids);
1042 1045
1043 1046 p->auth_access = access;
1044 1047 p->auth_time = p->auth_freshness = gethrestime_sec();
1045 1048
1046 1049 if (res == TRUE) {
1047 1050 if (uid != NULL)
1048 1051 *uid = tmpuid;
1049 1052 if (gid != NULL)
1050 1053 *gid = tmpgid;
1051 1054 if (ngids != NULL && gids != NULL) {
1052 1055 *ngids = tmpngids;
1053 1056 *gids = tmpgids;
1054 1057
1055 1058 /*
1056 1059 * We need a copy of gids for the
1057 1060 * auth_cache entry
1058 1061 */
1059 1062 tmpgids = kmem_alloc(tmpngids * sizeof (gid_t),
1060 1063 KM_NOSLEEP | KM_NORMALPRI);
1061 1064 if (tmpgids != NULL)
1062 1065 bcopy(*gids, tmpgids,
1063 1066 tmpngids * sizeof (gid_t));
1064 1067 }
1065 1068
1066 1069 if (tmpgids != NULL || tmpngids == 0) {
1067 1070 p->auth_srv_uid = tmpuid;
1068 1071 p->auth_srv_gid = tmpgid;
1069 1072 p->auth_srv_ngids = tmpngids;
1070 1073 p->auth_srv_gids = tmpgids;
1071 1074
1072 1075 state = NFS_AUTH_FRESH;
1073 1076 }
1074 1077 }
1075 1078
1076 1079 /*
1077 1080 * Set the auth_state and notify waiters.
1078 1081 */
1079 1082 mutex_enter(&p->auth_lock);
1080 1083 p->auth_state = state;
1081 1084 cv_broadcast(&p->auth_cv);
1082 1085 mutex_exit(&p->auth_lock);
1083 1086 } else {
1084 1087 uint_t nach;
1085 1088 time_t refresh;
1086 1089
1087 1090 refresh = gethrestime_sec() - p->auth_freshness;
1088 1091
1089 1092 p->auth_time = gethrestime_sec();
1090 1093
1091 1094 if (uid != NULL)
1092 1095 *uid = p->auth_srv_uid;
1093 1096 if (gid != NULL)
1094 1097 *gid = p->auth_srv_gid;
1095 1098 if (ngids != NULL && gids != NULL) {
1096 1099 *ngids = p->auth_srv_ngids;
1097 1100 *gids = kmem_alloc(*ngids * sizeof (gid_t), KM_SLEEP);
1098 1101 bcopy(p->auth_srv_gids, *gids, *ngids * sizeof (gid_t));
1099 1102 }
1100 1103
1101 1104 access = p->auth_access;
1102 1105
1103 1106 if ((refresh > NFSAUTH_CACHE_REFRESH) &&
1104 1107 p->auth_state == NFS_AUTH_FRESH) {
1105 1108 refreshq_auth_node_t *ran;
1106 1109 uint_t nacr;
1107 1110
1108 1111 p->auth_state = NFS_AUTH_STALE;
1109 1112 mutex_exit(&p->auth_lock);
1110 1113
1111 1114 nacr = atomic_inc_uint_nv(&nfsauth_cache_refresh);
1112 1115 DTRACE_PROBE3(nfsauth__debug__cache__stale,
1113 1116 struct exportinfo *, exi,
1114 1117 struct auth_cache *, p,
1115 1118 uint_t, nacr);
1116 1119
1117 1120 ran = kmem_alloc(sizeof (refreshq_auth_node_t),
1118 1121 KM_SLEEP);
1119 1122 ran->ran_auth = p;
1120 1123 ran->ran_netid = strdup(svc_getnetid(req->rq_xprt));
1121 1124
1122 1125 mutex_enter(&nag->refreshq_lock);
1123 1126
1124 1127 if (nag->refreshq_thread_state ==
1125 1128 REFRESHQ_THREAD_NEED_CREATE) {
1126 1129 /* Launch nfsauth refresh thread */
1127 1130 nag->refreshq_thread_state =
1128 1131 REFRESHQ_THREAD_RUNNING;
1129 1132 (void) zthread_create(NULL, 0,
1130 1133 nfsauth_refresh_thread, nag, 0,
1131 1134 minclsyspri);
1132 1135 }
1133 1136
1134 1137 /*
1135 1138 * We should not add a work queue item if the thread
1136 1139 * is not accepting them.
1137 1140 */
1138 1141 if (nag->refreshq_thread_state ==
1139 1142 REFRESHQ_THREAD_RUNNING) {
1140 1143 refreshq_exi_node_t *ren;
1141 1144
1142 1145 /*
1143 1146 * Is there an existing exi_list?
1144 1147 */
1145 1148 for (ren = list_head(&nag->refreshq_queue);
1146 1149 ren != NULL;
1147 1150 ren = list_next(&nag->refreshq_queue,
1148 1151 ren)) {
1149 1152 if (ren->ren_exi == exi) {
1150 1153 list_insert_tail(
1151 1154 &ren->ren_authlist, ran);
1152 1155 break;
1153 1156 }
1154 1157 }
1155 1158
1156 1159 if (ren == NULL) {
1157 1160 ren = kmem_alloc(
1158 1161 sizeof (refreshq_exi_node_t),
1159 1162 KM_SLEEP);
1160 1163
1161 1164 exi_hold(exi);
1162 1165 ren->ren_exi = exi;
1163 1166
1164 1167 list_create(&ren->ren_authlist,
1165 1168 sizeof (refreshq_auth_node_t),
1166 1169 offsetof(refreshq_auth_node_t,
1167 1170 ran_node));
1168 1171
1169 1172 list_insert_tail(&ren->ren_authlist,
1170 1173 ran);
1171 1174 list_insert_tail(&nag->refreshq_queue,
1172 1175 ren);
1173 1176 }
1174 1177
1175 1178 cv_broadcast(&nag->refreshq_cv);
1176 1179 } else {
1177 1180 strfree(ran->ran_netid);
1178 1181 kmem_free(ran, sizeof (refreshq_auth_node_t));
1179 1182 }
1180 1183
1181 1184 mutex_exit(&nag->refreshq_lock);
1182 1185 } else {
1183 1186 mutex_exit(&p->auth_lock);
1184 1187 }
1185 1188
1186 1189 nach = atomic_inc_uint_nv(&nfsauth_cache_hit);
1187 1190 DTRACE_PROBE2(nfsauth__debug__cache__hit,
1188 1191 uint_t, nach,
1189 1192 time_t, refresh);
1190 1193
1191 1194 kmem_free(addr.buf, addr.maxlen);
1192 1195 }
1193 1196
1194 1197 return (access);
1195 1198
1196 1199 retrieve:
1197 1200 crfree(ac.auth_clnt_cred);
1198 1201
1199 1202 /*
1200 1203 * Retrieve the required data without caching.
1201 1204 */
1202 1205
1203 1206 ASSERT(p == NULL);
1204 1207
1205 1208 atomic_inc_uint(&nfsauth_cache_miss);
1206 1209
1207 1210 if (nfsauth_retrieve(nag, exi, svc_getnetid(req->rq_xprt), flavor,
1208 1211 &addr, &access, cr, &tmpuid, &tmpgid, &tmpngids, &tmpgids)) {
1209 1212 if (uid != NULL)
1210 1213 *uid = tmpuid;
1211 1214 if (gid != NULL)
1212 1215 *gid = tmpgid;
1213 1216 if (ngids != NULL && gids != NULL) {
1214 1217 *ngids = tmpngids;
1215 1218 *gids = tmpgids;
1216 1219 } else {
1217 1220 kmem_free(tmpgids, tmpngids * sizeof (gid_t));
1218 1221 }
1219 1222 }
1220 1223
1221 1224 kmem_free(addr.buf, addr.maxlen);
1222 1225
1223 1226 return (access);
1224 1227 }
1225 1228
1226 1229 /*
1227 1230 * Check if the requesting client has access to the filesystem with
1228 1231 * a given nfs flavor number which is an explicitly shared flavor.
1229 1232 */
1230 1233 int
1231 1234 nfsauth4_secinfo_access(struct exportinfo *exi, struct svc_req *req,
1232 1235 int flavor, int perm, cred_t *cr)
1233 1236 {
1234 1237 int access;
1235 1238
1236 1239 if (! (perm & M_4SEC_EXPORTED)) {
1237 1240 return (NFSAUTH_DENIED);
1238 1241 }
1239 1242
1240 1243 /*
1241 1244 * Optimize if there are no lists
1242 1245 */
1243 1246 if ((perm & (M_ROOT | M_NONE | M_MAP)) == 0) {
1244 1247 perm &= ~M_4SEC_EXPORTED;
1245 1248 if (perm == M_RO)
1246 1249 return (NFSAUTH_RO);
1247 1250 if (perm == M_RW)
1248 1251 return (NFSAUTH_RW);
1249 1252 }
1250 1253
1251 1254 access = nfsauth_cache_get(exi, req, flavor, cr, NULL, NULL, NULL,
1252 1255 NULL);
1253 1256
1254 1257 return (access);
1255 1258 }
1256 1259
1257 1260 int
1258 1261 nfsauth_access(struct exportinfo *exi, struct svc_req *req, cred_t *cr,
1259 1262 uid_t *uid, gid_t *gid, uint_t *ngids, gid_t **gids)
1260 1263 {
1261 1264 int access, mapaccess;
1262 1265 struct secinfo *sp;
1263 1266 int i, flavor, perm;
1264 1267 int authnone_entry = -1;
1265 1268
1266 1269 /*
1267 1270 * By default root is mapped to anonymous user.
1268 1271 * This might get overriden later in nfsauth_cache_get().
1269 1272 */
1270 1273 if (crgetuid(cr) == 0) {
1271 1274 if (uid != NULL)
1272 1275 *uid = exi->exi_export.ex_anon;
1273 1276 if (gid != NULL)
1274 1277 *gid = exi->exi_export.ex_anon;
1275 1278 } else {
1276 1279 if (uid != NULL)
1277 1280 *uid = crgetuid(cr);
1278 1281 if (gid != NULL)
1279 1282 *gid = crgetgid(cr);
1280 1283 }
1281 1284
1282 1285 if (ngids != NULL)
1283 1286 *ngids = 0;
1284 1287 if (gids != NULL)
1285 1288 *gids = NULL;
1286 1289
1287 1290 /*
1288 1291 * Get the nfs flavor number from xprt.
1289 1292 */
1290 1293 flavor = (int)(uintptr_t)req->rq_xprt->xp_cookie;
1291 1294
1292 1295 /*
1293 1296 * First check the access restrictions on the filesystem. If
1294 1297 * there are no lists associated with this flavor then there's no
1295 1298 * need to make an expensive call to the nfsauth service or to
1296 1299 * cache anything.
1297 1300 */
1298 1301
1299 1302 sp = exi->exi_export.ex_secinfo;
1300 1303 for (i = 0; i < exi->exi_export.ex_seccnt; i++) {
1301 1304 if (flavor != sp[i].s_secinfo.sc_nfsnum) {
1302 1305 if (sp[i].s_secinfo.sc_nfsnum == AUTH_NONE)
1303 1306 authnone_entry = i;
1304 1307 continue;
1305 1308 }
1306 1309 break;
1307 1310 }
1308 1311
1309 1312 mapaccess = 0;
1310 1313
1311 1314 if (i >= exi->exi_export.ex_seccnt) {
1312 1315 /*
1313 1316 * Flavor not found, but use AUTH_NONE if it exists
1314 1317 */
1315 1318 if (authnone_entry == -1)
1316 1319 return (NFSAUTH_DENIED);
1317 1320 flavor = AUTH_NONE;
1318 1321 mapaccess = NFSAUTH_MAPNONE;
1319 1322 i = authnone_entry;
1320 1323 }
1321 1324
1322 1325 /*
1323 1326 * If the flavor is in the ex_secinfo list, but not an explicitly
1324 1327 * shared flavor by the user, it is a result of the nfsv4 server
1325 1328 * namespace setup. We will grant an RO permission similar for
1326 1329 * a pseudo node except that this node is a shared one.
1327 1330 *
1328 1331 * e.g. flavor in (flavor) indicates that it is not explictly
1329 1332 * shared by the user:
1330 1333 *
1331 1334 * / (sys, krb5)
1332 1335 * |
1333 1336 * export #share -o sec=sys (krb5)
1334 1337 * |
1335 1338 * secure #share -o sec=krb5
1336 1339 *
1337 1340 * In this case, when a krb5 request coming in to access
1338 1341 * /export, RO permission is granted.
1339 1342 */
1340 1343 if (!(sp[i].s_flags & M_4SEC_EXPORTED))
1341 1344 return (mapaccess | NFSAUTH_RO);
1342 1345
1343 1346 /*
1344 1347 * Optimize if there are no lists.
1345 1348 * We cannot optimize for AUTH_SYS with NGRPS (16) supplemental groups.
1346 1349 */
1347 1350 perm = sp[i].s_flags;
1348 1351 if ((perm & (M_ROOT | M_NONE | M_MAP)) == 0 && (ngroups_max <= NGRPS ||
1349 1352 flavor != AUTH_SYS || crgetngroups(cr) < NGRPS)) {
1350 1353 perm &= ~M_4SEC_EXPORTED;
1351 1354 if (perm == M_RO)
1352 1355 return (mapaccess | NFSAUTH_RO);
1353 1356 if (perm == M_RW)
1354 1357 return (mapaccess | NFSAUTH_RW);
1355 1358 }
1356 1359
1357 1360 access = nfsauth_cache_get(exi, req, flavor, cr, uid, gid, ngids, gids);
1358 1361
1359 1362 /*
1360 1363 * For both NFSAUTH_DENIED and NFSAUTH_WRONGSEC we do not care about
1361 1364 * the supplemental groups.
1362 1365 */
1363 1366 if (access & NFSAUTH_DENIED || access & NFSAUTH_WRONGSEC) {
1364 1367 if (ngids != NULL && gids != NULL) {
1365 1368 kmem_free(*gids, *ngids * sizeof (gid_t));
1366 1369 *ngids = 0;
1367 1370 *gids = NULL;
1368 1371 }
1369 1372 }
1370 1373
1371 1374 /*
1372 1375 * Client's security flavor doesn't match with "ro" or
1373 1376 * "rw" list. Try again using AUTH_NONE if present.
1374 1377 */
1375 1378 if ((access & NFSAUTH_WRONGSEC) && (flavor != AUTH_NONE)) {
1376 1379 /*
1377 1380 * Have we already encountered AUTH_NONE ?
1378 1381 */
1379 1382 if (authnone_entry != -1) {
1380 1383 mapaccess = NFSAUTH_MAPNONE;
1381 1384 access = nfsauth_cache_get(exi, req, AUTH_NONE, cr,
1382 1385 NULL, NULL, NULL, NULL);
1383 1386 } else {
1384 1387 /*
1385 1388 * Check for AUTH_NONE presence.
1386 1389 */
1387 1390 for (; i < exi->exi_export.ex_seccnt; i++) {
1388 1391 if (sp[i].s_secinfo.sc_nfsnum == AUTH_NONE) {
1389 1392 mapaccess = NFSAUTH_MAPNONE;
1390 1393 access = nfsauth_cache_get(exi, req,
1391 1394 AUTH_NONE, cr, NULL, NULL, NULL,
1392 1395 NULL);
1393 1396 break;
1394 1397 }
1395 1398 }
1396 1399 }
1397 1400 }
1398 1401
1399 1402 if (access & NFSAUTH_DENIED)
1400 1403 access = NFSAUTH_DENIED;
1401 1404
1402 1405 return (access | mapaccess);
1403 1406 }
1404 1407
1405 1408 static void
1406 1409 nfsauth_free_clnt_node(struct auth_cache_clnt *p)
1407 1410 {
1408 1411 void *cookie = NULL;
1409 1412 struct auth_cache *node;
1410 1413
1411 1414 while ((node = avl_destroy_nodes(&p->authc_tree, &cookie)) != NULL)
1412 1415 nfsauth_free_node(node);
1413 1416 avl_destroy(&p->authc_tree);
1414 1417
1415 1418 kmem_free(p->authc_addr.buf, p->authc_addr.maxlen);
1416 1419 rw_destroy(&p->authc_lock);
1417 1420
1418 1421 kmem_free(p, sizeof (*p));
1419 1422 }
1420 1423
1421 1424 static void
1422 1425 nfsauth_free_node(struct auth_cache *p)
1423 1426 {
1424 1427 crfree(p->auth_clnt_cred);
1425 1428 kmem_free(p->auth_srv_gids, p->auth_srv_ngids * sizeof (gid_t));
1426 1429 mutex_destroy(&p->auth_lock);
1427 1430 cv_destroy(&p->auth_cv);
1428 1431 kmem_cache_free(exi_cache_handle, p);
1429 1432 }
1430 1433
1431 1434 /*
1432 1435 * Free the nfsauth cache for a given export
1433 1436 */
1434 1437 void
1435 1438 nfsauth_cache_free(struct exportinfo *exi)
1436 1439 {
1437 1440 int i;
1438 1441
1439 1442 /*
1440 1443 * The only way we got here was with an exi_rele, which means that no
1441 1444 * auth cache entry is being refreshed.
1442 1445 */
1443 1446
1444 1447 for (i = 0; i < AUTH_TABLESIZE; i++) {
1445 1448 avl_tree_t *tree = exi->exi_cache[i];
1446 1449 void *cookie = NULL;
1447 1450 struct auth_cache_clnt *node;
1448 1451
1449 1452 while ((node = avl_destroy_nodes(tree, &cookie)) != NULL)
1450 1453 nfsauth_free_clnt_node(node);
1451 1454 }
1452 1455 }
1453 1456
1454 1457 /*
1455 1458 * Called by the kernel memory allocator when
1456 1459 * memory is low. Free unused cache entries.
1457 1460 * If that's not enough, the VM system will
1458 1461 * call again for some more.
1459 1462 */
1460 1463 /*ARGSUSED*/
1461 1464 void
1462 1465 exi_cache_reclaim(void *cdrarg)
1463 1466 {
1464 1467 int i;
1465 1468 struct exportinfo *exi;
1466 1469 nfs_export_t *ne = nfs_get_export();
1467 1470
1468 1471 rw_enter(&ne->exported_lock, RW_READER);
1469 1472
1470 1473 for (i = 0; i < EXPTABLESIZE; i++) {
1471 1474 for (exi = ne->exptable[i]; exi; exi = exi->fid_hash.next)
1472 1475 exi_cache_trim(exi);
1473 1476 }
1474 1477
1475 1478 rw_exit(&ne->exported_lock);
1476 1479
1477 1480 atomic_inc_uint(&nfsauth_cache_reclaim);
1478 1481 }
1479 1482
1480 1483 void
1481 1484 exi_cache_trim(struct exportinfo *exi)
1482 1485 {
1483 1486 struct auth_cache_clnt *c;
1484 1487 struct auth_cache_clnt *nextc;
1485 1488 struct auth_cache *p;
1486 1489 struct auth_cache *next;
1487 1490 int i;
1488 1491 time_t stale_time;
1489 1492 avl_tree_t *tree;
1490 1493
1491 1494 for (i = 0; i < AUTH_TABLESIZE; i++) {
1492 1495 tree = exi->exi_cache[i];
1493 1496 stale_time = gethrestime_sec() - NFSAUTH_CACHE_TRIM;
1494 1497 rw_enter(&exi->exi_cache_lock, RW_READER);
1495 1498
1496 1499 /*
1497 1500 * Free entries that have not been
1498 1501 * used for NFSAUTH_CACHE_TRIM seconds.
1499 1502 */
1500 1503 for (c = avl_first(tree); c != NULL; c = AVL_NEXT(tree, c)) {
1501 1504 /*
1502 1505 * We are being called by the kmem subsystem to reclaim
1503 1506 * memory so don't block if we can't get the lock.
1504 1507 */
1505 1508 if (rw_tryenter(&c->authc_lock, RW_WRITER) == 0) {
1506 1509 exi_cache_auth_reclaim_failed++;
1507 1510 rw_exit(&exi->exi_cache_lock);
1508 1511 return;
1509 1512 }
1510 1513
1511 1514 for (p = avl_first(&c->authc_tree); p != NULL;
1512 1515 p = next) {
1513 1516 next = AVL_NEXT(&c->authc_tree, p);
1514 1517
1515 1518 ASSERT(p->auth_state != NFS_AUTH_INVALID);
1516 1519
1517 1520 mutex_enter(&p->auth_lock);
1518 1521
1519 1522 /*
1520 1523 * We won't trim recently used and/or WAITING
1521 1524 * entries.
1522 1525 */
1523 1526 if (p->auth_time > stale_time ||
1524 1527 p->auth_state == NFS_AUTH_WAITING) {
1525 1528 mutex_exit(&p->auth_lock);
1526 1529 continue;
1527 1530 }
1528 1531
1529 1532 DTRACE_PROBE1(nfsauth__debug__trim__state,
1530 1533 auth_state_t, p->auth_state);
1531 1534
1532 1535 /*
1533 1536 * STALE and REFRESHING entries needs to be
1534 1537 * marked INVALID only because they are
1535 1538 * referenced by some other structures or
1536 1539 * threads. They will be freed later.
1537 1540 */
1538 1541 if (p->auth_state == NFS_AUTH_STALE ||
1539 1542 p->auth_state == NFS_AUTH_REFRESHING) {
1540 1543 p->auth_state = NFS_AUTH_INVALID;
1541 1544 mutex_exit(&p->auth_lock);
1542 1545
1543 1546 avl_remove(&c->authc_tree, p);
1544 1547 } else {
1545 1548 mutex_exit(&p->auth_lock);
1546 1549
1547 1550 avl_remove(&c->authc_tree, p);
1548 1551 nfsauth_free_node(p);
1549 1552 }
1550 1553 }
1551 1554 rw_exit(&c->authc_lock);
1552 1555 }
1553 1556
1554 1557 if (rw_tryupgrade(&exi->exi_cache_lock) == 0) {
1555 1558 rw_exit(&exi->exi_cache_lock);
1556 1559 exi_cache_clnt_reclaim_failed++;
1557 1560 continue;
1558 1561 }
1559 1562
1560 1563 for (c = avl_first(tree); c != NULL; c = nextc) {
1561 1564 nextc = AVL_NEXT(tree, c);
1562 1565
1563 1566 if (avl_is_empty(&c->authc_tree) == B_FALSE)
1564 1567 continue;
1565 1568
1566 1569 avl_remove(tree, c);
1567 1570
1568 1571 nfsauth_free_clnt_node(c);
1569 1572 }
1570 1573
1571 1574 rw_exit(&exi->exi_cache_lock);
1572 1575 }
1573 1576 }
|
↓ open down ↓ |
1281 lines elided |
↑ open up ↑ |
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX