1 /* $NetBSD: nfs_export.c,v 1.17 2006/10/12 01:32:47 christos Exp $ */ 2 3 /*- 4 * Copyright (c) 1997, 1998, 2004, 2005 The NetBSD Foundation, Inc. 5 * All rights reserved. 6 * 7 * This code is derived from software contributed to The NetBSD Foundation 8 * by Jason R. Thorpe of the Numerical Aerospace Simulation Facility, 9 * NASA Ames Research Center. 10 * This code is derived from software contributed to The NetBSD Foundation 11 * by Charles M. Hannum. 12 * This code is derived from software contributed to The NetBSD Foundation 13 * by Julio M. Merino Vidal. 14 * 15 * Redistribution and use in source and binary forms, with or without 16 * modification, are permitted provided that the following conditions 17 * are met: 18 * 1. Redistributions of source code must retain the above copyright 19 * notice, this list of conditions and the following disclaimer. 20 * 2. Redistributions in binary form must reproduce the above copyright 21 * notice, this list of conditions and the following disclaimer in the 22 * documentation and/or other materials provided with the distribution. 23 * 3. All advertising materials mentioning features or use of this software 24 * must display the following acknowledgement: 25 * This product includes software developed by the NetBSD 26 * Foundation, Inc. and its contributors. 27 * 4. Neither the name of The NetBSD Foundation nor the names of its 28 * contributors may be used to endorse or promote products derived 29 * from this software without specific prior written permission. 30 * 31 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS 32 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED 33 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 34 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS 35 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR 36 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF 37 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS 38 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN 39 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 40 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE 41 * POSSIBILITY OF SUCH DAMAGE. 42 */ 43 44 /* 45 * Copyright (c) 1989, 1993 46 * The Regents of the University of California. All rights reserved. 47 * (c) UNIX System Laboratories, Inc. 48 * All or some portions of this file are derived from material licensed 49 * to the University of California by American Telephone and Telegraph 50 * Co. or Unix System Laboratories, Inc. and are reproduced herein with 51 * the permission of UNIX System Laboratories, Inc. 52 * 53 * Redistribution and use in source and binary forms, with or without 54 * modification, are permitted provided that the following conditions 55 * are met: 56 * 1. Redistributions of source code must retain the above copyright 57 * notice, this list of conditions and the following disclaimer. 58 * 2. Redistributions in binary form must reproduce the above copyright 59 * notice, this list of conditions and the following disclaimer in the 60 * documentation and/or other materials provided with the distribution. 61 * 3. Neither the name of the University nor the names of its contributors 62 * may be used to endorse or promote products derived from this software 63 * without specific prior written permission. 64 * 65 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 66 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 67 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 68 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 69 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 70 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 71 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 72 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 73 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 74 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 75 * SUCH DAMAGE. 76 * 77 * @(#)vfs_subr.c 8.13 (Berkeley) 4/18/94 78 */ 79 80 /* 81 * VFS exports list management. 82 */ 83 84 #include <sys/cdefs.h> 85 __KERNEL_RCSID(0, "$NetBSD: nfs_export.c,v 1.17 2006/10/12 01:32:47 christos Exp $"); 86 87 #include "opt_compat_netbsd.h" 88 #include "opt_inet.h" 89 90 #include <sys/param.h> 91 #include <sys/systm.h> 92 #include <sys/queue.h> 93 #include <sys/proc.h> 94 #include <sys/mount.h> 95 #include <sys/vnode.h> 96 #include <sys/namei.h> 97 #include <sys/errno.h> 98 #include <sys/malloc.h> 99 #include <sys/domain.h> 100 #include <sys/mbuf.h> 101 #include <sys/dirent.h> 102 #include <sys/socket.h> /* XXX for AF_MAX */ 103 #include <sys/kauth.h> 104 105 #include <net/radix.h> 106 107 #include <netinet/in.h> 108 109 #include <nfs/rpcv2.h> 110 #include <nfs/nfsproto.h> 111 #include <nfs/nfs.h> 112 #include <nfs/nfs_var.h> 113 114 /* 115 * Network address lookup element. 116 */ 117 struct netcred { 118 struct radix_node netc_rnodes[2]; 119 int netc_refcnt; 120 int netc_exflags; 121 kauth_cred_t netc_anon; 122 }; 123 124 /* 125 * Network export information. 126 */ 127 struct netexport { 128 CIRCLEQ_ENTRY(netexport) ne_list; 129 struct mount *ne_mount; 130 struct netcred ne_defexported; /* Default export */ 131 struct radix_node_head *ne_rtable[AF_MAX+1]; /* Individual exports */ 132 }; 133 CIRCLEQ_HEAD(, netexport) netexport_list = 134 CIRCLEQ_HEAD_INITIALIZER(netexport_list); 135 136 /* Malloc type used by the mount<->netexport map. */ 137 MALLOC_DEFINE(M_NFS_EXPORT, "nfs_export", "NFS export data"); 138 139 /* Publicly exported file system. */ 140 struct nfs_public nfs_pub; 141 142 /* 143 * Local prototypes. 144 */ 145 static int init_exports(struct mount *, struct netexport **); 146 static int hang_addrlist(struct mount *, struct netexport *, 147 const struct export_args *); 148 static int sacheck(struct sockaddr *); 149 static int free_netcred(struct radix_node *, void *); 150 static int export(struct netexport *, const struct export_args *); 151 static int setpublicfs(struct mount *, struct netexport *, 152 const struct export_args *); 153 static struct netcred *netcred_lookup(struct netexport *, struct mbuf *); 154 static struct netexport *netexport_lookup(const struct mount *); 155 static struct netexport *netexport_lookup_byfsid(const fsid_t *); 156 static void netexport_clear(struct netexport *); 157 static void netexport_insert(struct netexport *); 158 static void netexport_remove(struct netexport *); 159 static void netexport_wrlock(void); 160 static void netexport_wrunlock(void); 161 162 /* 163 * PUBLIC INTERFACE 164 */ 165 166 /* 167 * Declare and initialize the file system export hooks. 168 */ 169 static void nfs_export_unmount(struct mount *); 170 171 struct vfs_hooks nfs_export_hooks = { 172 nfs_export_unmount 173 }; 174 VFS_HOOKS_ATTACH(nfs_export_hooks); 175 176 /* 177 * VFS unmount hook for NFS exports. 178 * 179 * Releases NFS exports list resources if the given mount point has some. 180 * As allocation happens lazily, it may be that it doesn't has this 181 * information, although it theorically should. 182 */ 183 static void 184 nfs_export_unmount(struct mount *mp) 185 { 186 struct netexport *ne; 187 188 KASSERT(mp != NULL); 189 190 netexport_wrlock(); 191 ne = netexport_lookup(mp); 192 if (ne == NULL) { 193 netexport_wrunlock(); 194 return; 195 } 196 197 KASSERT(mp->mnt_op->vfs_vptofh != NULL && 198 mp->mnt_op->vfs_fhtovp != NULL); 199 netexport_clear(ne); 200 netexport_remove(ne); 201 netexport_wrunlock(); 202 free(ne, M_NFS_EXPORT); 203 } 204 205 /* 206 * Atomically set the NFS exports list of the given file system, replacing 207 * it with a new list of entries. 208 * 209 * Returns zero on success or an appropriate error code otherwise. 210 * 211 * Helper function for the nfssvc(2) system call (NFSSVC_SETEXPORTSLIST 212 * command). 213 */ 214 int 215 mountd_set_exports_list(const struct mountd_exports_list *mel, struct lwp *l) 216 { 217 int error; 218 #ifdef notyet 219 /* XXX: See below to see the reason why this is disabled. */ 220 size_t i; 221 #endif 222 struct mount *mp; 223 struct netexport *ne; 224 struct nameidata nd; 225 struct vnode *vp; 226 struct fid *fid; 227 size_t fid_size; 228 229 if (kauth_authorize_generic(l->l_cred, KAUTH_GENERIC_ISSUSER, 230 &l->l_acflag) != 0) 231 return EPERM; 232 233 /* Lookup the file system path. */ 234 NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF, UIO_USERSPACE, mel->mel_path, l); 235 error = namei(&nd); 236 if (error != 0) 237 return error; 238 vp = nd.ni_vp; 239 mp = vp->v_mount; 240 241 /* The selected file system may not support NFS exports, so ensure 242 * it does. */ 243 if (mp->mnt_op->vfs_vptofh == NULL || mp->mnt_op->vfs_fhtovp == NULL) { 244 error = EOPNOTSUPP; 245 goto out_locked; 246 } 247 fid_size = 0; 248 if ((error = VFS_VPTOFH(vp, NULL, &fid_size)) == E2BIG) { 249 fid = malloc(fid_size, M_TEMP, M_NOWAIT); 250 if (fid != NULL) { 251 error = VFS_VPTOFH(vp, fid, &fid_size); 252 free(fid, M_TEMP); 253 } 254 } 255 if (error != 0) { 256 error = EOPNOTSUPP; 257 goto out_locked; 258 } 259 KASSERT(mp->mnt_op->vfs_vptofh != NULL && 260 mp->mnt_op->vfs_fhtovp != NULL); 261 262 /* Mark the file system busy. */ 263 error = vfs_busy(mp, LK_NOWAIT, NULL); 264 if (error != 0) 265 goto out_locked; 266 267 netexport_wrlock(); 268 ne = netexport_lookup(mp); 269 if (ne == NULL) { 270 error = init_exports(mp, &ne); 271 if (error != 0) { 272 goto out_locked2; 273 } 274 } 275 276 KASSERT(ne != NULL); 277 KASSERT(ne->ne_mount == mp); 278 279 /* 280 * XXX: The part marked as 'notyet' works fine from the kernel's 281 * point of view, in the sense that it is able to atomically update 282 * the complete exports list for a file system. However, supporting 283 * this in mountd(8) requires a lot of work; so, for now, keep the 284 * old behavior of updating a single entry per call. 285 * 286 * When mountd(8) is fixed, just remove the second branch of this 287 * preprocessor conditional and enable the first one. 288 */ 289 #ifdef notyet 290 netexport_clear(ne); 291 for (i = 0; error == 0 && i < mel->mel_nexports; i++) 292 error = export(ne, &mel->mel_exports[i]); 293 #else 294 if (mel->mel_nexports == 0) 295 netexport_clear(ne); 296 else if (mel->mel_nexports == 1) 297 error = export(ne, &mel->mel_exports[0]); 298 else { 299 printf("mountd_set_exports_list: Cannot set more than one " 300 "entry at once (unimplemented)\n"); 301 error = EOPNOTSUPP; 302 } 303 #endif 304 305 out_locked2: 306 netexport_wrunlock(); 307 vfs_unbusy(mp); 308 309 out_locked: 310 vput(vp); 311 312 return error; 313 } 314 315 static void 316 netexport_insert(struct netexport *ne) 317 { 318 319 CIRCLEQ_INSERT_HEAD(&netexport_list, ne, ne_list); 320 } 321 322 static void 323 netexport_remove(struct netexport *ne) 324 { 325 326 CIRCLEQ_REMOVE(&netexport_list, ne, ne_list); 327 } 328 329 static struct netexport * 330 netexport_lookup(const struct mount *mp) 331 { 332 struct netexport *ne; 333 334 CIRCLEQ_FOREACH(ne, &netexport_list, ne_list) { 335 if (ne->ne_mount == mp) { 336 goto done; 337 } 338 } 339 ne = NULL; 340 done: 341 return ne; 342 } 343 344 static struct netexport * 345 netexport_lookup_byfsid(const fsid_t *fsid) 346 { 347 struct netexport *ne; 348 349 CIRCLEQ_FOREACH(ne, &netexport_list, ne_list) { 350 const struct mount *mp = ne->ne_mount; 351 352 if (mp->mnt_stat.f_fsidx.__fsid_val[0] == fsid->__fsid_val[0] && 353 mp->mnt_stat.f_fsidx.__fsid_val[1] == fsid->__fsid_val[1]) { 354 goto done; 355 } 356 } 357 ne = NULL; 358 done: 359 360 return ne; 361 } 362 363 /* 364 * Check if the file system specified by the 'mp' mount structure is 365 * exported to a client with 'anon' anonymous credentials. The 'mb' 366 * argument is an mbuf containing the network address of the client. 367 * The return parameters for the export flags for the client are returned 368 * in the address specified by 'wh'. 369 * 370 * This function is used exclusively by the NFS server. It is generally 371 * invoked before VFS_FHTOVP to validate that client has access to the 372 * file system. 373 */ 374 375 int 376 netexport_check(const fsid_t *fsid, struct mbuf *mb, struct mount **mpp, 377 int *wh, kauth_cred_t *anon) 378 { 379 struct netexport *ne; 380 struct netcred *np; 381 382 ne = netexport_lookup_byfsid(fsid); 383 if (ne == NULL) { 384 return EACCES; 385 } 386 np = netcred_lookup(ne, mb); 387 if (np == NULL) { 388 return EACCES; 389 } 390 391 *mpp = ne->ne_mount; 392 *wh = np->netc_exflags; 393 *anon = np->netc_anon; 394 395 return 0; 396 } 397 398 #ifdef COMPAT_30 399 /* 400 * Handles legacy export requests. In this case, the export information 401 * is hardcoded in a specific place of the mount arguments structure (given 402 * in data); the request for an update is given through the fspec field 403 * (also in a known location), which must be a null pointer. 404 * 405 * Returns EJUSTRETURN if the given command was not a export request. 406 * Otherwise, returns 0 on success or an appropriate error code otherwise. 407 */ 408 int 409 nfs_update_exports_30(struct mount *mp __unused, const char *path, void *data, 410 struct lwp *l) 411 { 412 int error; 413 struct { 414 const char *fspec; 415 struct export_args30 eargs; 416 } args; 417 struct mountd_exports_list mel; 418 419 mel.mel_path = path; 420 421 error = copyin(data, &args, sizeof(args)); 422 if (error != 0) 423 return EJUSTRETURN; 424 425 if (args.fspec != NULL) 426 return EJUSTRETURN; 427 428 if (args.eargs.ex_flags & 0x00020000) { 429 /* Request to delete exports. The mask above holds the 430 * value that used to be in MNT_DELEXPORT. */ 431 mel.mel_nexports = 0; 432 } else { 433 struct export_args eargs; 434 435 /* The following assumes export_args has not changed since 436 * export_args30. */ 437 memcpy(&eargs, &args.eargs, sizeof(struct export_args)); 438 439 mel.mel_nexports = 1; 440 mel.mel_exports = &eargs; 441 } 442 443 return mountd_set_exports_list(&mel, l); 444 } 445 #endif 446 447 /* 448 * INTERNAL FUNCTIONS 449 */ 450 451 /* 452 * Initializes NFS exports for the file system given in 'mp' if it supports 453 * file handles; this is determined by checking whether mp's vfs_vptofh and 454 * vfs_fhtovp operations are NULL or not. 455 * 456 * If successful, returns 0 and sets *mnpp to the address of the new 457 * mount_netexport_pair item; otherwise returns and appropriate error code 458 * and *mnpp remains unmodified. 459 */ 460 static int 461 init_exports(struct mount *mp, struct netexport **nep) 462 { 463 int error; 464 struct export_args ea; 465 struct netexport *ne; 466 467 KASSERT(mp != NULL); 468 KASSERT(mp->mnt_op->vfs_vptofh != NULL && 469 mp->mnt_op->vfs_fhtovp != NULL); 470 471 /* Ensure that we do not already have this mount point. */ 472 KASSERT(netexport_lookup(mp) == NULL); 473 474 ne = malloc(sizeof(*ne), M_NFS_EXPORT, M_WAITOK | M_ZERO); 475 ne->ne_mount = mp; 476 477 /* Set the default export entry. Handled internally by export upon 478 * first call. */ 479 memset(&ea, 0, sizeof(ea)); 480 ea.ex_root = -2; 481 if (mp->mnt_flag & MNT_RDONLY) 482 ea.ex_flags |= MNT_EXRDONLY; 483 error = export(ne, &ea); 484 if (error != 0) { 485 free(ne, M_NFS_EXPORT); 486 } else { 487 netexport_insert(ne); 488 *nep = ne; 489 } 490 491 return error; 492 } 493 494 /* 495 * Build hash lists of net addresses and hang them off the mount point. 496 * Called by export() to set up a new entry in the lists of export 497 * addresses. 498 */ 499 static int 500 hang_addrlist(struct mount *mp, struct netexport *nep, 501 const struct export_args *argp) 502 { 503 int error, i; 504 struct netcred *np, *enp; 505 struct radix_node_head *rnh; 506 struct sockaddr *saddr, *smask; 507 struct domain *dom; 508 509 smask = NULL; 510 511 if (argp->ex_addrlen == 0) { 512 if (mp->mnt_flag & MNT_DEFEXPORTED) 513 return EPERM; 514 np = &nep->ne_defexported; 515 KASSERT(np->netc_anon == NULL); 516 np->netc_anon = kauth_cred_alloc(); 517 np->netc_exflags = argp->ex_flags; 518 kauth_cred_uucvt(np->netc_anon, &argp->ex_anon); 519 mp->mnt_flag |= MNT_DEFEXPORTED; 520 return 0; 521 } 522 523 if (argp->ex_addrlen > MLEN || argp->ex_masklen > MLEN) 524 return EINVAL; 525 526 i = sizeof(struct netcred) + argp->ex_addrlen + argp->ex_masklen; 527 np = malloc(i, M_NETADDR, M_WAITOK | M_ZERO); 528 np->netc_anon = kauth_cred_alloc(); 529 saddr = (struct sockaddr *)(np + 1); 530 error = copyin(argp->ex_addr, saddr, argp->ex_addrlen); 531 if (error) 532 goto out; 533 if (saddr->sa_len > argp->ex_addrlen) 534 saddr->sa_len = argp->ex_addrlen; 535 if (sacheck(saddr) == -1) 536 return EINVAL; 537 if (argp->ex_masklen) { 538 smask = (struct sockaddr *)((caddr_t)saddr + argp->ex_addrlen); 539 error = copyin(argp->ex_mask, smask, argp->ex_masklen); 540 if (error) 541 goto out; 542 if (smask->sa_len > argp->ex_masklen) 543 smask->sa_len = argp->ex_masklen; 544 if (smask->sa_family != saddr->sa_family) 545 return EINVAL; 546 if (sacheck(smask) == -1) 547 return EINVAL; 548 } 549 i = saddr->sa_family; 550 if ((rnh = nep->ne_rtable[i]) == 0) { 551 /* 552 * Seems silly to initialize every AF when most are not 553 * used, do so on demand here 554 */ 555 DOMAIN_FOREACH(dom) { 556 if (dom->dom_family == i && dom->dom_rtattach) { 557 dom->dom_rtattach((void **)&nep->ne_rtable[i], 558 dom->dom_rtoffset); 559 break; 560 } 561 } 562 if ((rnh = nep->ne_rtable[i]) == 0) { 563 error = ENOBUFS; 564 goto out; 565 } 566 } 567 568 enp = (struct netcred *)(*rnh->rnh_addaddr)(saddr, smask, rnh, 569 np->netc_rnodes); 570 if (enp != np) { 571 if (enp == NULL) { 572 enp = (struct netcred *)(*rnh->rnh_lookup)(saddr, 573 smask, rnh); 574 if (enp == NULL) { 575 error = EPERM; 576 goto out; 577 } 578 } else 579 enp->netc_refcnt++; 580 581 goto check; 582 } else 583 enp->netc_refcnt = 1; 584 585 np->netc_exflags = argp->ex_flags; 586 kauth_cred_uucvt(np->netc_anon, &argp->ex_anon); 587 return 0; 588 check: 589 if (enp->netc_exflags != argp->ex_flags || 590 kauth_cred_uucmp(enp->netc_anon, &argp->ex_anon) != 0) 591 error = EPERM; 592 else 593 error = 0; 594 out: 595 KASSERT(np->netc_anon != NULL); 596 kauth_cred_free(np->netc_anon); 597 free(np, M_NETADDR); 598 return error; 599 } 600 601 /* 602 * Ensure that the address stored in 'sa' is valid. 603 * Returns zero on success, otherwise -1. 604 */ 605 static int 606 sacheck(struct sockaddr *sa) 607 { 608 609 switch (sa->sa_family) { 610 #ifdef INET 611 case AF_INET: { 612 struct sockaddr_in *sin = (struct sockaddr_in *)sa; 613 char *p = (char *)sin->sin_zero; 614 size_t i; 615 616 if (sin->sin_len != sizeof(*sin)) 617 return -1; 618 if (sin->sin_port != 0) 619 return -1; 620 for (i = 0; i < sizeof(sin->sin_zero); i++) 621 if (*p++ != '\0') 622 return -1; 623 return 0; 624 } 625 #endif 626 #ifdef INET6 627 case AF_INET6: { 628 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sa; 629 630 if (sin6->sin6_len != sizeof(*sin6)) 631 return -1; 632 if (sin6->sin6_port != 0) 633 return -1; 634 return 0; 635 } 636 #endif 637 default: 638 return -1; 639 } 640 } 641 642 /* 643 * Free the netcred object pointed to by the 'rn' radix node. 644 * 'w' holds a pointer to the radix tree head. 645 */ 646 static int 647 free_netcred(struct radix_node *rn, void *w) 648 { 649 struct radix_node_head *rnh = (struct radix_node_head *)w; 650 struct netcred *np = (struct netcred *)(void *)rn; 651 652 (*rnh->rnh_deladdr)(rn->rn_key, rn->rn_mask, rnh); 653 if (--(np->netc_refcnt) <= 0) { 654 KASSERT(np->netc_anon != NULL); 655 kauth_cred_free(np->netc_anon); 656 free(np, M_NETADDR); 657 } 658 return 0; 659 } 660 661 /* 662 * Clears the exports list for a given file system. 663 */ 664 static void 665 netexport_clear(struct netexport *ne) 666 { 667 struct radix_node_head *rnh; 668 struct mount *mp = ne->ne_mount; 669 int i; 670 671 if (mp->mnt_flag & MNT_EXPUBLIC) { 672 setpublicfs(NULL, NULL, NULL); 673 mp->mnt_flag &= ~MNT_EXPUBLIC; 674 } 675 676 for (i = 0; i <= AF_MAX; i++) { 677 if ((rnh = ne->ne_rtable[i]) != NULL) { 678 (*rnh->rnh_walktree)(rnh, free_netcred, rnh); 679 free(rnh, M_RTABLE); 680 ne->ne_rtable[i] = NULL; 681 } 682 } 683 684 if ((mp->mnt_flag & MNT_DEFEXPORTED) != 0) { 685 struct netcred *np = &ne->ne_defexported; 686 687 KASSERT(np->netc_anon != NULL); 688 kauth_cred_free(np->netc_anon); 689 np->netc_anon = NULL; 690 } else { 691 KASSERT(ne->ne_defexported.netc_anon == NULL); 692 } 693 694 mp->mnt_flag &= ~(MNT_EXPORTED | MNT_DEFEXPORTED); 695 } 696 697 /* 698 * Add a new export entry (described by an export_args structure) to the 699 * given file system. 700 */ 701 static int 702 export(struct netexport *nep, const struct export_args *argp) 703 { 704 struct mount *mp = nep->ne_mount; 705 int error; 706 707 if (argp->ex_flags & MNT_EXPORTED) { 708 if (argp->ex_flags & MNT_EXPUBLIC) { 709 if ((error = setpublicfs(mp, nep, argp)) != 0) 710 return error; 711 mp->mnt_flag |= MNT_EXPUBLIC; 712 } 713 if ((error = hang_addrlist(mp, nep, argp)) != 0) 714 return error; 715 mp->mnt_flag |= MNT_EXPORTED; 716 } 717 return 0; 718 } 719 720 /* 721 * Set the publicly exported filesystem (WebNFS). Currently, only 722 * one public filesystem is possible in the spec (RFC 2054 and 2055) 723 */ 724 static int 725 setpublicfs(struct mount *mp, struct netexport *nep __unused, 726 const struct export_args *argp) 727 { 728 char *cp; 729 int error; 730 struct vnode *rvp; 731 size_t fhsize; 732 733 /* 734 * mp == NULL -> invalidate the current info, the FS is 735 * no longer exported. May be called from either export 736 * or unmount, so check if it hasn't already been done. 737 */ 738 if (mp == NULL) { 739 if (nfs_pub.np_valid) { 740 nfs_pub.np_valid = 0; 741 if (nfs_pub.np_handle != NULL) { 742 free(nfs_pub.np_handle, M_TEMP); 743 nfs_pub.np_handle = NULL; 744 } 745 if (nfs_pub.np_index != NULL) { 746 FREE(nfs_pub.np_index, M_TEMP); 747 nfs_pub.np_index = NULL; 748 } 749 } 750 return 0; 751 } 752 753 /* 754 * Only one allowed at a time. 755 */ 756 if (nfs_pub.np_valid != 0 && mp != nfs_pub.np_mount) 757 return EBUSY; 758 759 /* 760 * Get real filehandle for root of exported FS. 761 */ 762 if ((error = VFS_ROOT(mp, &rvp))) 763 return error; 764 765 fhsize = 0; 766 error = vfs_composefh(rvp, NULL, &fhsize); 767 if (error != E2BIG) 768 return error; 769 nfs_pub.np_handle = malloc(fhsize, M_TEMP, M_NOWAIT); 770 if (nfs_pub.np_handle == NULL) 771 error = ENOMEM; 772 else 773 error = vfs_composefh(rvp, nfs_pub.np_handle, &fhsize); 774 if (error) 775 return error; 776 777 vput(rvp); 778 779 /* 780 * If an indexfile was specified, pull it in. 781 */ 782 if (argp->ex_indexfile != NULL) { 783 MALLOC(nfs_pub.np_index, char *, MAXNAMLEN + 1, M_TEMP, 784 M_WAITOK); 785 error = copyinstr(argp->ex_indexfile, nfs_pub.np_index, 786 MAXNAMLEN, (size_t *)0); 787 if (!error) { 788 /* 789 * Check for illegal filenames. 790 */ 791 for (cp = nfs_pub.np_index; *cp; cp++) { 792 if (*cp == '/') { 793 error = EINVAL; 794 break; 795 } 796 } 797 } 798 if (error) { 799 FREE(nfs_pub.np_index, M_TEMP); 800 return error; 801 } 802 } 803 804 nfs_pub.np_mount = mp; 805 nfs_pub.np_valid = 1; 806 return 0; 807 } 808 809 /* 810 * Lookup an export entry in the exports list that matches the address 811 * stored in 'nam'. If no entry is found, the default one is used instead 812 * (if available). 813 */ 814 static struct netcred * 815 netcred_lookup(struct netexport *ne, struct mbuf *nam) 816 { 817 struct netcred *np; 818 struct radix_node_head *rnh; 819 struct sockaddr *saddr; 820 821 if ((ne->ne_mount->mnt_flag & MNT_EXPORTED) == 0) { 822 return NULL; 823 } 824 825 /* 826 * Lookup in the export list first. 827 */ 828 np = NULL; 829 if (nam != NULL) { 830 saddr = mtod(nam, struct sockaddr *); 831 rnh = ne->ne_rtable[saddr->sa_family]; 832 if (rnh != NULL) { 833 np = (struct netcred *) 834 (*rnh->rnh_matchaddr)((caddr_t)saddr, 835 rnh); 836 if (np && np->netc_rnodes->rn_flags & RNF_ROOT) 837 np = NULL; 838 } 839 } 840 /* 841 * If no address match, use the default if it exists. 842 */ 843 if (np == NULL && ne->ne_mount->mnt_flag & MNT_DEFEXPORTED) 844 np = &ne->ne_defexported; 845 846 return np; 847 } 848 849 static struct lock netexport_lock = LOCK_INITIALIZER(PVFS, "netexp", 0, 0); 850 851 void 852 netexport_rdlock(void) 853 { 854 855 lockmgr(&netexport_lock, LK_SHARED, NULL); 856 } 857 858 void 859 netexport_rdunlock(void) 860 { 861 862 lockmgr(&netexport_lock, LK_RELEASE, NULL); 863 } 864 865 static void 866 netexport_wrlock(void) 867 { 868 869 lockmgr(&netexport_lock, LK_EXCLUSIVE, NULL); 870 } 871 872 static void 873 netexport_wrunlock(void) 874 { 875 876 lockmgr(&netexport_lock, LK_RELEASE, NULL); 877 } 878