1 /* $NetBSD: nfs_srvsubs.c,v 1.17 2023/03/23 19:52:42 riastradh Exp $ */
2
3 /*
4 * Copyright (c) 1989, 1993
5 * The Regents of the University of California. All rights reserved.
6 *
7 * This code is derived from software contributed to Berkeley by
8 * Rick Macklem at The University of Guelph.
9 *
10 * Redistribution and use in source and binary forms, with or without
11 * modification, are permitted provided that the following conditions
12 * are met:
13 * 1. Redistributions of source code must retain the above copyright
14 * notice, this list of conditions and the following disclaimer.
15 * 2. Redistributions in binary form must reproduce the above copyright
16 * notice, this list of conditions and the following disclaimer in the
17 * documentation and/or other materials provided with the distribution.
18 * 3. Neither the name of the University nor the names of its contributors
19 * may be used to endorse or promote products derived from this software
20 * without specific prior written permission.
21 *
22 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 * SUCH DAMAGE.
33 *
34 * @(#)nfs_subs.c 8.8 (Berkeley) 5/22/95
35 */
36
37 /*
38 * Copyright 2000 Wasabi Systems, Inc.
39 * All rights reserved.
40 *
41 * Written by Frank van der Linden for Wasabi Systems, Inc.
42 *
43 * Redistribution and use in source and binary forms, with or without
44 * modification, are permitted provided that the following conditions
45 * are met:
46 * 1. Redistributions of source code must retain the above copyright
47 * notice, this list of conditions and the following disclaimer.
48 * 2. Redistributions in binary form must reproduce the above copyright
49 * notice, this list of conditions and the following disclaimer in the
50 * documentation and/or other materials provided with the distribution.
51 * 3. All advertising materials mentioning features or use of this software
52 * must display the following acknowledgement:
53 * This product includes software developed for the NetBSD Project by
54 * Wasabi Systems, Inc.
55 * 4. The name of Wasabi Systems, Inc. may not be used to endorse
56 * or promote products derived from this software without specific prior
57 * written permission.
58 *
59 * THIS SOFTWARE IS PROVIDED BY WASABI SYSTEMS, INC. ``AS IS'' AND
60 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
61 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
62 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL WASABI SYSTEMS, INC
63 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
64 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
65 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
66 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
67 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
68 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
69 * POSSIBILITY OF SUCH DAMAGE.
70 */
71
72 #include <sys/cdefs.h>
73 __KERNEL_RCSID(0, "$NetBSD: nfs_srvsubs.c,v 1.17 2023/03/23 19:52:42 riastradh Exp $");
74
75 #include <sys/param.h>
76 #include <sys/proc.h>
77 #include <sys/systm.h>
78 #include <sys/kernel.h>
79 #include <sys/kmem.h>
80 #include <sys/mount.h>
81 #include <sys/vnode.h>
82 #include <sys/namei.h>
83 #include <sys/mbuf.h>
84 #include <sys/socket.h>
85 #include <sys/stat.h>
86 #include <sys/filedesc.h>
87 #include <sys/time.h>
88 #include <sys/dirent.h>
89 #include <sys/once.h>
90 #include <sys/kauth.h>
91 #include <sys/atomic.h>
92
93 #include <uvm/uvm_extern.h>
94
95 #include <nfs/rpcv2.h>
96 #include <nfs/nfsproto.h>
97 #include <nfs/nfsnode.h>
98 #include <nfs/nfs.h>
99 #include <nfs/xdr_subs.h>
100 #include <nfs/nfsm_subs.h>
101 #include <nfs/nfsmount.h>
102 #include <nfs/nfsrtt.h>
103 #include <nfs/nfs_var.h>
104
105 #include <miscfs/specfs/specdev.h>
106
107 #include <netinet/in.h>
108
109 /*
110 * Set up nameidata for a lookup() call and do it.
111 *
112 * If pubflag is set, this call is done for a lookup operation on the
113 * public filehandle. In that case we allow crossing mountpoints and
114 * absolute pathnames. However, the caller is expected to check that
115 * the lookup result is within the public fs, and deny access if
116 * it is not.
117 */
118 int
nfs_namei(struct nameidata * ndp,nfsrvfh_t * nsfh,uint32_t len,struct nfssvc_sock * slp,struct mbuf * nam,struct mbuf ** mdp,char ** dposp,struct vnode ** retdirp,int * dirattr_retp,struct vattr * dirattrp,struct lwp * l,int kerbflag,int pubflag)119 nfs_namei(struct nameidata *ndp, nfsrvfh_t *nsfh, uint32_t len, struct nfssvc_sock *slp, struct mbuf *nam, struct mbuf **mdp, char **dposp, struct vnode **retdirp, int *dirattr_retp, struct vattr *dirattrp, struct lwp *l, int kerbflag, int pubflag)
120 {
121 int i, rem;
122 struct mbuf *md;
123 char *fromcp, *tocp, *cp, *path;
124 struct vnode *dp;
125 int error, rdonly;
126 int neverfollow;
127 struct componentname *cnp = &ndp->ni_cnd;
128
129 *retdirp = NULL;
130 ndp->ni_pathbuf = NULL;
131
132 if (len > NFS_MAXPATHLEN - 1)
133 return (ENAMETOOLONG);
134 if (len == 0)
135 return (EACCES);
136
137 /*
138 * Copy the name from the mbuf list to ndp->ni_pathbuf
139 * and set the various ndp fields appropriately.
140 */
141 path = PNBUF_GET();
142 fromcp = *dposp;
143 tocp = path;
144 md = *mdp;
145 rem = mtod(md, char *) + md->m_len - fromcp;
146 for (i = 0; i < len; i++) {
147 while (rem == 0) {
148 md = md->m_next;
149 if (md == NULL) {
150 error = EBADRPC;
151 goto out;
152 }
153 fromcp = mtod(md, void *);
154 rem = md->m_len;
155 }
156 if (*fromcp == '\0' || (!pubflag && *fromcp == '/')) {
157 error = EACCES;
158 goto out;
159 }
160 *tocp++ = *fromcp++;
161 rem--;
162 }
163 *tocp = '\0';
164 *mdp = md;
165 *dposp = fromcp;
166 len = nfsm_rndup(len)-len;
167 if (len > 0) {
168 if (rem >= len)
169 *dposp += len;
170 else if ((error = nfs_adv(mdp, dposp, len, rem)) != 0)
171 goto out;
172 }
173
174 /*
175 * Extract and set starting directory.
176 */
177 error = nfsrv_fhtovp(nsfh, false, &dp, ndp->ni_cnd.cn_cred, slp,
178 nam, &rdonly, kerbflag, pubflag);
179 if (error)
180 goto out;
181 if (dp->v_type != VDIR) {
182 vrele(dp);
183 error = ENOTDIR;
184 goto out;
185 }
186
187 if (rdonly)
188 cnp->cn_flags |= RDONLY;
189
190 *retdirp = dp;
191 if (dirattr_retp != NULL) {
192 vn_lock(dp, LK_SHARED | LK_RETRY);
193 *dirattr_retp = VOP_GETATTR(dp, dirattrp, ndp->ni_cnd.cn_cred);
194 VOP_UNLOCK(dp);
195 }
196
197 if (pubflag) {
198 /*
199 * Oh joy. For WebNFS, handle those pesky '%' escapes,
200 * and the 'native path' indicator.
201 */
202 cp = PNBUF_GET();
203 fromcp = path;
204 tocp = cp;
205 if ((unsigned char)*fromcp >= WEBNFS_SPECCHAR_START) {
206 switch ((unsigned char)*fromcp) {
207 case WEBNFS_NATIVE_CHAR:
208 /*
209 * 'Native' path for us is the same
210 * as a path according to the NFS spec,
211 * just skip the escape char.
212 */
213 fromcp++;
214 break;
215 /*
216 * More may be added in the future, range 0x80-0xff
217 */
218 default:
219 error = EIO;
220 vrele(dp);
221 PNBUF_PUT(cp);
222 goto out;
223 }
224 }
225 /*
226 * Translate the '%' escapes, URL-style.
227 */
228 while (*fromcp != '\0') {
229 if (*fromcp == WEBNFS_ESC_CHAR) {
230 if (fromcp[1] != '\0' && fromcp[2] != '\0') {
231 fromcp++;
232 *tocp++ = HEXSTRTOI(fromcp);
233 fromcp += 2;
234 continue;
235 } else {
236 error = ENOENT;
237 vrele(dp);
238 PNBUF_PUT(cp);
239 goto out;
240 }
241 } else
242 *tocp++ = *fromcp++;
243 }
244 *tocp = '\0';
245 PNBUF_PUT(path);
246 path = cp;
247 }
248
249 ndp->ni_atdir = NULL;
250 ndp->ni_pathbuf = pathbuf_assimilate(path);
251 if (ndp->ni_pathbuf == NULL) {
252 error = ENOMEM;
253 goto out;
254 }
255
256 if (pubflag) {
257 if (path[0] == '/')
258 dp = rootvnode;
259 } else {
260 cnp->cn_flags |= NOCROSSMOUNT;
261 }
262
263 neverfollow = !pubflag;
264
265 /*
266 * And call lookup() to do the real work
267 *
268 * Note: ndp->ni_pathbuf is left undestroyed on success;
269 * caller must clean it up.
270 */
271 error = lookup_for_nfsd(ndp, dp, neverfollow);
272 if (error) {
273 goto out;
274 }
275 return 0;
276
277 out:
278 if (ndp->ni_pathbuf != NULL) {
279 pathbuf_destroy(ndp->ni_pathbuf);
280 ndp->ni_pathbuf = NULL;
281 } else {
282 PNBUF_PUT(path);
283 }
284 return (error);
285 }
286
287 /*
288 * nfsrv_fhtovp() - convert a fh to a vnode ptr (optionally locked)
289 * - look up fsid in mount list (if not found ret error)
290 * - get vp and export rights by calling VFS_FHTOVP()
291 * - if cred->cr_uid == 0 or MNT_EXPORTANON set it to credanon
292 * - if not lockflag unlock it with VOP_UNLOCK()
293 */
294 int
nfsrv_fhtovp(nfsrvfh_t * nsfh,int lockflag,struct vnode ** vpp,kauth_cred_t cred,struct nfssvc_sock * slp,struct mbuf * nam,int * rdonlyp,int kerbflag,int pubflag)295 nfsrv_fhtovp(nfsrvfh_t *nsfh, int lockflag, struct vnode **vpp,
296 kauth_cred_t cred, struct nfssvc_sock *slp, struct mbuf *nam, int *rdonlyp,
297 int kerbflag, int pubflag)
298 {
299 struct mount *mp;
300 kauth_cred_t credanon;
301 int error, exflags;
302 struct sockaddr_in *saddr;
303 fhandle_t *fhp;
304
305 fhp = NFSRVFH_FHANDLE(nsfh);
306 *vpp = (struct vnode *)0;
307
308 if (nfs_ispublicfh(nsfh)) {
309 if (!pubflag || !nfs_pub.np_valid)
310 return (ESTALE);
311 fhp = nfs_pub.np_handle;
312 }
313
314 error = netexport_check(&fhp->fh_fsid, nam, &mp, &exflags, &credanon);
315 if (error) {
316 return error;
317 }
318
319 error = VFS_FHTOVP(mp, &fhp->fh_fid, LK_EXCLUSIVE, vpp);
320 if (error)
321 return (error);
322
323 if (!(exflags & (MNT_EXNORESPORT|MNT_EXPUBLIC))) {
324 saddr = mtod(nam, struct sockaddr_in *);
325 if ((saddr->sin_family == AF_INET) &&
326 ntohs(saddr->sin_port) >= IPPORT_RESERVED) {
327 vput(*vpp);
328 return (NFSERR_AUTHERR | AUTH_TOOWEAK);
329 }
330 if ((saddr->sin_family == AF_INET6) &&
331 ntohs(saddr->sin_port) >= IPV6PORT_RESERVED) {
332 vput(*vpp);
333 return (NFSERR_AUTHERR | AUTH_TOOWEAK);
334 }
335 }
336 /*
337 * Check/setup credentials.
338 */
339 if (exflags & MNT_EXKERB) {
340 if (!kerbflag) {
341 vput(*vpp);
342 return (NFSERR_AUTHERR | AUTH_TOOWEAK);
343 }
344 } else if (kerbflag) {
345 vput(*vpp);
346 return (NFSERR_AUTHERR | AUTH_TOOWEAK);
347 } else if (kauth_cred_geteuid(cred) == 0 || /* NFS maproot, see below */
348 (exflags & MNT_EXPORTANON)) {
349 /*
350 * This is used by the NFS maproot option. While we can change
351 * the secmodel on our own host, we can't change it on the
352 * clients. As means of least surprise, we're doing the
353 * traditional thing here.
354 * Should look into adding a "mapprivileged" or similar where
355 * the users can be explicitly specified...
356 * [elad, yamt 2008-03-05]
357 */
358 kauth_cred_clone(credanon, cred);
359 }
360 if (exflags & MNT_EXRDONLY)
361 *rdonlyp = 1;
362 else
363 *rdonlyp = 0;
364 if (!lockflag)
365 VOP_UNLOCK(*vpp);
366 return (0);
367 }
368
369 /*
370 * WebNFS: check if a filehandle is a public filehandle. For v3, this
371 * means a length of 0, for v2 it means all zeroes.
372 */
373 int
nfs_ispublicfh(const nfsrvfh_t * nsfh)374 nfs_ispublicfh(const nfsrvfh_t *nsfh)
375 {
376 const char *cp = (const void *)(NFSRVFH_DATA(nsfh));
377 int i;
378
379 if (NFSRVFH_SIZE(nsfh) == 0) {
380 return true;
381 }
382 if (NFSRVFH_SIZE(nsfh) != NFSX_V2FH) {
383 return false;
384 }
385 for (i = 0; i < NFSX_V2FH; i++)
386 if (*cp++ != 0)
387 return false;
388 return true;
389 }
390
391 int
nfsrv_composefh(struct vnode * vp,nfsrvfh_t * nsfh,bool v3)392 nfsrv_composefh(struct vnode *vp, nfsrvfh_t *nsfh, bool v3)
393 {
394 int error;
395 size_t fhsize;
396
397 fhsize = NFSD_MAXFHSIZE;
398 error = vfs_composefh(vp, (void *)NFSRVFH_DATA(nsfh), &fhsize);
399 if (NFSX_FHTOOBIG_P(fhsize, v3)) {
400 error = EOPNOTSUPP;
401 }
402 if (error != 0) {
403 return error;
404 }
405 if (!v3 && fhsize < NFSX_V2FH) {
406 memset((char *)NFSRVFH_DATA(nsfh) + fhsize, 0,
407 NFSX_V2FH - fhsize);
408 fhsize = NFSX_V2FH;
409 }
410 if ((fhsize % NFSX_UNSIGNED) != 0) {
411 return EOPNOTSUPP;
412 }
413 nsfh->nsfh_size = fhsize;
414 return 0;
415 }
416
417 int
nfsrv_comparefh(const nfsrvfh_t * fh1,const nfsrvfh_t * fh2)418 nfsrv_comparefh(const nfsrvfh_t *fh1, const nfsrvfh_t *fh2)
419 {
420
421 if (NFSRVFH_SIZE(fh1) != NFSRVFH_SIZE(fh2)) {
422 return NFSRVFH_SIZE(fh2) - NFSRVFH_SIZE(fh1);
423 }
424 return memcmp(NFSRVFH_DATA(fh1), NFSRVFH_DATA(fh2), NFSRVFH_SIZE(fh1));
425 }
426
427 void
nfsrv_copyfh(nfsrvfh_t * fh1,const nfsrvfh_t * fh2)428 nfsrv_copyfh(nfsrvfh_t *fh1, const nfsrvfh_t *fh2)
429 {
430 size_t size;
431
432 fh1->nsfh_size = size = NFSRVFH_SIZE(fh2);
433 memcpy(NFSRVFH_DATA(fh1), NFSRVFH_DATA(fh2), size);
434 }
435