sys/fs/nfsserver/nfs_nfsdserv.c

   1 /*-
   2  * SPDX-License-Identifier: BSD-3-Clause
   3  *
   4  * Copyright (c) 1989, 1993
   5  *      The Regents of the University of California.  All rights reserved.
   6  *
   7  * This code is derived from software contributed to Berkeley by
   8  * Rick Macklem at The University of Guelph.
   9  *
  10  * Redistribution and use in source and binary forms, with or without
  11  * modification, are permitted provided that the following conditions
  12  * are met:
  13  * 1. Redistributions of source code must retain the above copyright
  14  *    notice, this list of conditions and the following disclaimer.
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  * 3. Neither the name of the University nor the names of its contributors
  19  *    may be used to endorse or promote products derived from this software
  20  *    without specific prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  32  * SUCH DAMAGE.
  33  *
  34  */
  35
  36 #include <sys/cdefs.h>
  37 __FBSDID("$FreeBSD$");
  38
  39 #include "opt_inet.h"
  40 #include "opt_inet6.h"
  41 /*
  42  * nfs version 2, 3 and 4 server calls to vnode ops
  43  * - these routines generally have 3 phases
  44  *   1 - break down and validate rpc request in mbuf list
  45  *   2 - do the vnode ops for the request, usually by calling a nfsvno_XXX()
  46  *       function in nfsd_port.c
  47  *   3 - build the rpc reply in an mbuf list
  48  * For nfsv4, these functions are called for each Op within the Compound RPC.
  49  */
  50
  51 #include <fs/nfs/nfsport.h>
  52 #include <sys/extattr.h>
  53 #include <sys/filio.h>
  54
  55 /* Global vars */
  56 extern u_int32_t newnfs_false, newnfs_true;
  57 extern enum vtype nv34tov_type[8];
  58 extern struct timeval nfsboottime;
  59 extern int nfs_rootfhset;
  60 extern int nfsrv_enable_crossmntpt;
  61 extern int nfsrv_statehashsize;
  62 extern int nfsrv_layouthashsize;
  63 extern time_t nfsdev_time;
  64 extern volatile int nfsrv_devidcnt;
  65 extern int nfsd_debuglevel;
  66 extern u_long sb_max_adj;
  67 extern int nfsrv_pnfsatime;
  68 extern int nfsrv_maxpnfsmirror;
  69 extern int nfs_maxcopyrange;
  70
  71 static int      nfs_async = 0;
  72 SYSCTL_DECL(_vfs_nfsd);
  73 SYSCTL_INT(_vfs_nfsd, OID_AUTO, async, CTLFLAG_RW, &nfs_async, 0,
  74     "Tell client that writes were synced even though they were not");
  75 extern int      nfsrv_doflexfile;
  76 SYSCTL_INT(_vfs_nfsd, OID_AUTO, default_flexfile, CTLFLAG_RW,
  77     &nfsrv_doflexfile, 0, "Make Flex File Layout the default for pNFS");
  78 static int      nfsrv_linux42server = 1;
  79 SYSCTL_INT(_vfs_nfsd, OID_AUTO, linux42server, CTLFLAG_RW,
  80     &nfsrv_linux42server, 0,
  81     "Enable Linux style NFSv4.2 server (non-RFC compliant)");
  82 static bool     nfsrv_openaccess = true;
  83 SYSCTL_BOOL(_vfs_nfsd, OID_AUTO, v4openaccess, CTLFLAG_RW,
  84     &nfsrv_openaccess, 0,
  85     "Enable Linux style NFSv4 Open access check");
  86
  87 /*
  88  * This list defines the GSS mechanisms supported.
  89  * (Don't ask me how you get these strings from the RFC stuff like
  90  *  iso(1), org(3)... but someone did it, so I don't need to know.)
  91  */
  92 static struct nfsgss_mechlist nfsgss_mechlist[] = {
  93         { 9, "\052\206\110\206\367\022\001\002\002", 11 },
  94         { 0, "", 0 },
  95 };
  96
  97 /* local functions */
  98 static void nfsrvd_symlinksub(struct nfsrv_descript *nd, struct nameidata *ndp,
  99     struct nfsvattr *nvap, fhandle_t *fhp, vnode_t *vpp,
 100     vnode_t dirp, struct nfsvattr *dirforp, struct nfsvattr *diraftp,
 101     int *diraft_retp, nfsattrbit_t *attrbitp,
 102     NFSACL_T *aclp, NFSPROC_T *p, struct nfsexstuff *exp, char *pathcp,
 103     int pathlen);
 104 static void nfsrvd_mkdirsub(struct nfsrv_descript *nd, struct nameidata *ndp,
 105     struct nfsvattr *nvap, fhandle_t *fhp, vnode_t *vpp,
 106     vnode_t dirp, struct nfsvattr *dirforp, struct nfsvattr *diraftp,
 107     int *diraft_retp, nfsattrbit_t *attrbitp, NFSACL_T *aclp,
 108     NFSPROC_T *p, struct nfsexstuff *exp);
 109
 110 /*
 111  * nfs access service (not a part of NFS V2)
 112  */
 113 int
 114 nfsrvd_access(struct nfsrv_descript *nd, __unused int isdgram,
 115     vnode_t vp, struct nfsexstuff *exp)
 116 {
 117         u_int32_t *tl;
 118         int getret, error = 0;
 119         struct nfsvattr nva;
 120         u_int32_t testmode, nfsmode, supported = 0;
 121         accmode_t deletebit;
 122         struct thread *p = curthread;
 123
 124         if (nd->nd_repstat) {
 125                 nfsrv_postopattr(nd, 1, &nva);
 126                 goto out;
 127         }
 128         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
 129         nfsmode = fxdr_unsigned(u_int32_t, *tl);
 130         if ((nd->nd_flag & ND_NFSV4) &&
 131             (nfsmode & ~(NFSACCESS_READ | NFSACCESS_LOOKUP |
 132              NFSACCESS_MODIFY | NFSACCESS_EXTEND | NFSACCESS_DELETE |
 133              NFSACCESS_EXECUTE | NFSACCESS_XAREAD | NFSACCESS_XAWRITE |
 134              NFSACCESS_XALIST))) {
 135                 nd->nd_repstat = NFSERR_INVAL;
 136                 vput(vp);
 137                 goto out;
 138         }
 139         if (nfsmode & NFSACCESS_READ) {
 140                 supported |= NFSACCESS_READ;
 141                 if (nfsvno_accchk(vp, VREAD, nd->nd_cred, exp, p,
 142                     NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
 143                         nfsmode &= ~NFSACCESS_READ;
 144         }
 145         if (nfsmode & NFSACCESS_MODIFY) {
 146                 supported |= NFSACCESS_MODIFY;
 147                 if (nfsvno_accchk(vp, VWRITE, nd->nd_cred, exp, p,
 148                     NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
 149                         nfsmode &= ~NFSACCESS_MODIFY;
 150         }
 151         if (nfsmode & NFSACCESS_EXTEND) {
 152                 supported |= NFSACCESS_EXTEND;
 153                 if (nfsvno_accchk(vp, VWRITE | VAPPEND, nd->nd_cred, exp, p,
 154                     NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
 155                         nfsmode &= ~NFSACCESS_EXTEND;
 156         }
 157         if (nfsmode & NFSACCESS_XAREAD) {
 158                 supported |= NFSACCESS_XAREAD;
 159                 if (nfsvno_accchk(vp, VREAD, nd->nd_cred, exp, p,
 160                     NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
 161                         nfsmode &= ~NFSACCESS_XAREAD;
 162         }
 163         if (nfsmode & NFSACCESS_XAWRITE) {
 164                 supported |= NFSACCESS_XAWRITE;
 165                 if (nfsvno_accchk(vp, VWRITE, nd->nd_cred, exp, p,
 166                     NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
 167                         nfsmode &= ~NFSACCESS_XAWRITE;
 168         }
 169         if (nfsmode & NFSACCESS_XALIST) {
 170                 supported |= NFSACCESS_XALIST;
 171                 if (nfsvno_accchk(vp, VREAD, nd->nd_cred, exp, p,
 172                     NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
 173                         nfsmode &= ~NFSACCESS_XALIST;
 174         }
 175         if (nfsmode & NFSACCESS_DELETE) {
 176                 supported |= NFSACCESS_DELETE;
 177                 if (vp->v_type == VDIR)
 178                         deletebit = VDELETE_CHILD;
 179                 else
 180                         deletebit = VDELETE;
 181                 if (nfsvno_accchk(vp, deletebit, nd->nd_cred, exp, p,
 182                     NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
 183                         nfsmode &= ~NFSACCESS_DELETE;
 184         }
 185         if (vnode_vtype(vp) == VDIR)
 186                 testmode = NFSACCESS_LOOKUP;
 187         else
 188                 testmode = NFSACCESS_EXECUTE;
 189         if (nfsmode & testmode) {
 190                 supported |= (nfsmode & testmode);
 191                 if (nfsvno_accchk(vp, VEXEC, nd->nd_cred, exp, p,
 192                     NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
 193                         nfsmode &= ~testmode;
 194         }
 195         nfsmode &= supported;
 196         if (nd->nd_flag & ND_NFSV3) {
 197                 getret = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
 198                 nfsrv_postopattr(nd, getret, &nva);
 199         }
 200         vput(vp);
 201         if (nd->nd_flag & ND_NFSV4) {
 202                 NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
 203                 *tl++ = txdr_unsigned(supported);
 204         } else
 205                 NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
 206         *tl = txdr_unsigned(nfsmode);
 207
 208 out:
 209         NFSEXITCODE2(0, nd);
 210         return (0);
 211 nfsmout:
 212         vput(vp);
 213         NFSEXITCODE2(error, nd);
 214         return (error);
 215 }
 216
 217 /*
 218  * nfs getattr service
 219  */
 220 int
 221 nfsrvd_getattr(struct nfsrv_descript *nd, int isdgram,
 222     vnode_t vp, __unused struct nfsexstuff *exp)
 223 {
 224         struct nfsvattr nva;
 225         fhandle_t fh;
 226         int at_root = 0, error = 0, supports_nfsv4acls;
 227         struct nfsreferral *refp;
 228         nfsattrbit_t attrbits, tmpbits;
 229         struct mount *mp;
 230         struct vnode *tvp = NULL;
 231         struct vattr va;
 232         uint64_t mounted_on_fileno = 0;
 233         accmode_t accmode;
 234         struct thread *p = curthread;
 235
 236         if (nd->nd_repstat)
 237                 goto out;
 238         if (nd->nd_flag & ND_NFSV4) {
 239                 error = nfsrv_getattrbits(nd, &attrbits, NULL, NULL);
 240                 if (error) {
 241                         vput(vp);
 242                         goto out;
 243                 }
 244
 245                 /*
 246                  * Check for a referral.
 247                  */
 248                 refp = nfsv4root_getreferral(vp, NULL, 0);
 249                 if (refp != NULL) {
 250                         (void) nfsrv_putreferralattr(nd, &attrbits, refp, 1,
 251                             &nd->nd_repstat);
 252                         vput(vp);
 253                         goto out;
 254                 }
 255                 if (nd->nd_repstat == 0) {
 256                         accmode = 0;
 257                         NFSSET_ATTRBIT(&tmpbits, &attrbits);
 258
 259                         /*
 260                          * GETATTR with write-only attr time_access_set and time_modify_set
 261                          * should return NFS4ERR_INVAL.
 262                          */
 263                         if (NFSISSET_ATTRBIT(&tmpbits, NFSATTRBIT_TIMEACCESSSET) ||
 264                                         NFSISSET_ATTRBIT(&tmpbits, NFSATTRBIT_TIMEMODIFYSET)){
 265                                 error = NFSERR_INVAL;
 266                                 vput(vp);
 267                                 goto out;
 268                         }
 269                         if (NFSISSET_ATTRBIT(&tmpbits, NFSATTRBIT_ACL)) {
 270                                 NFSCLRBIT_ATTRBIT(&tmpbits, NFSATTRBIT_ACL);
 271                                 accmode |= VREAD_ACL;
 272                         }
 273                         if (NFSNONZERO_ATTRBIT(&tmpbits))
 274                                 accmode |= VREAD_ATTRIBUTES;
 275                         if (accmode != 0)
 276                                 nd->nd_repstat = nfsvno_accchk(vp, accmode,
 277                                     nd->nd_cred, exp, p, NFSACCCHK_NOOVERRIDE,
 278                                     NFSACCCHK_VPISLOCKED, NULL);
 279                 }
 280         }
 281         if (!nd->nd_repstat)
 282                 nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1, &attrbits);
 283         if (!nd->nd_repstat) {
 284                 if (nd->nd_flag & ND_NFSV4) {
 285                         if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_FILEHANDLE))
 286                                 nd->nd_repstat = nfsvno_getfh(vp, &fh, p);
 287                         if (!nd->nd_repstat)
 288                                 nd->nd_repstat = nfsrv_checkgetattr(nd, vp,
 289                                     &nva, &attrbits, p);
 290                         if (nd->nd_repstat == 0) {
 291                                 supports_nfsv4acls = nfs_supportsnfsv4acls(vp);
 292                                 mp = vp->v_mount;
 293                                 if (nfsrv_enable_crossmntpt != 0 &&
 294                                     vp->v_type == VDIR &&
 295                                     (vp->v_vflag & VV_ROOT) != 0 &&
 296                                     vp != rootvnode) {
 297                                         tvp = mp->mnt_vnodecovered;
 298                                         VREF(tvp);
 299                                         at_root = 1;
 300                                 } else
 301                                         at_root = 0;
 302                                 vfs_ref(mp);
 303                                 NFSVOPUNLOCK(vp);
 304                                 if (at_root != 0) {
 305                                         if ((nd->nd_repstat =
 306                                              NFSVOPLOCK(tvp, LK_SHARED)) == 0) {
 307                                                 nd->nd_repstat = VOP_GETATTR(
 308                                                     tvp, &va, nd->nd_cred);
 309                                                 vput(tvp);
 310                                         } else
 311                                                 vrele(tvp);
 312                                         if (nd->nd_repstat == 0)
 313                                                 mounted_on_fileno = (uint64_t)
 314                                                     va.va_fileid;
 315                                         else
 316                                                 at_root = 0;
 317                                 }
 318                                 if (nd->nd_repstat == 0)
 319                                         nd->nd_repstat = vfs_busy(mp, 0);
 320                                 vfs_rel(mp);
 321                                 if (nd->nd_repstat == 0) {
 322                                         (void)nfsvno_fillattr(nd, mp, vp, &nva,
 323                                             &fh, 0, &attrbits, nd->nd_cred, p,
 324                                             isdgram, 1, supports_nfsv4acls,
 325                                             at_root, mounted_on_fileno);
 326                                         vfs_unbusy(mp);
 327                                 }
 328                                 vrele(vp);
 329                         } else
 330                                 vput(vp);
 331                 } else {
 332                         nfsrv_fillattr(nd, &nva);
 333                         vput(vp);
 334                 }
 335         } else {
 336                 vput(vp);
 337         }
 338
 339 out:
 340         NFSEXITCODE2(error, nd);
 341         return (error);
 342 }
 343
 344 /*
 345  * nfs setattr service
 346  */
 347 int
 348 nfsrvd_setattr(struct nfsrv_descript *nd, __unused int isdgram,
 349     vnode_t vp, struct nfsexstuff *exp)
 350 {
 351         struct nfsvattr nva, nva2;
 352         u_int32_t *tl;
 353         int preat_ret = 1, postat_ret = 1, gcheck = 0, error = 0;
 354         int gotproxystateid;
 355         struct timespec guard = { 0, 0 };
 356         nfsattrbit_t attrbits, retbits;
 357         nfsv4stateid_t stateid;
 358         NFSACL_T *aclp = NULL;
 359         struct thread *p = curthread;
 360
 361         if (nd->nd_repstat) {
 362                 nfsrv_wcc(nd, preat_ret, &nva2, postat_ret, &nva);
 363                 goto out;
 364         }
 365 #ifdef NFS4_ACL_EXTATTR_NAME
 366         aclp = acl_alloc(M_WAITOK);
 367         aclp->acl_cnt = 0;
 368 #endif
 369         gotproxystateid = 0;
 370         NFSVNO_ATTRINIT(&nva);
 371         if (nd->nd_flag & ND_NFSV4) {
 372                 NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID);
 373                 stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
 374                 stateid.other[0] = *tl++;
 375                 stateid.other[1] = *tl++;
 376                 stateid.other[2] = *tl;
 377                 if (stateid.other[0] == 0x55555555 &&
 378                     stateid.other[1] == 0x55555555 &&
 379                     stateid.other[2] == 0x55555555 &&
 380                     stateid.seqid == 0xffffffff)
 381                         gotproxystateid = 1;
 382         }
 383         error = nfsrv_sattr(nd, vp, &nva, &attrbits, aclp, p);
 384         if (error)
 385                 goto nfsmout;
 386
 387         /* For NFSv4, only va_uid is used from nva2. */
 388         NFSZERO_ATTRBIT(&retbits);
 389         NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_OWNER);
 390         preat_ret = nfsvno_getattr(vp, &nva2, nd, p, 1, &retbits);
 391         if (!nd->nd_repstat)
 392                 nd->nd_repstat = preat_ret;
 393
 394         NFSZERO_ATTRBIT(&retbits);
 395         if (nd->nd_flag & ND_NFSV3) {
 396                 NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
 397                 gcheck = fxdr_unsigned(int, *tl);
 398                 if (gcheck) {
 399                         NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
 400                         fxdr_nfsv3time(tl, &guard);
 401                 }
 402                 if (!nd->nd_repstat && gcheck &&
 403                     (nva2.na_ctime.tv_sec != guard.tv_sec ||
 404                      nva2.na_ctime.tv_nsec != guard.tv_nsec))
 405                         nd->nd_repstat = NFSERR_NOT_SYNC;
 406                 if (nd->nd_repstat) {
 407                         vput(vp);
 408 #ifdef NFS4_ACL_EXTATTR_NAME
 409                         acl_free(aclp);
 410 #endif
 411                         nfsrv_wcc(nd, preat_ret, &nva2, postat_ret, &nva);
 412                         goto out;
 413                 }
 414         } else if (!nd->nd_repstat && (nd->nd_flag & ND_NFSV4))
 415                 nd->nd_repstat = nfsrv_checkuidgid(nd, &nva);
 416
 417         /*
 418          * Now that we have all the fields, lets do it.
 419          * If the size is being changed write access is required, otherwise
 420          * just check for a read only file system.
 421          */
 422         if (!nd->nd_repstat) {
 423                 if (NFSVNO_NOTSETSIZE(&nva)) {
 424                         if (NFSVNO_EXRDONLY(exp) ||
 425                             (vfs_flags(vp->v_mount) & MNT_RDONLY))
 426                                 nd->nd_repstat = EROFS;
 427                 } else {
 428                         if (vnode_vtype(vp) != VREG)
 429                                 nd->nd_repstat = EINVAL;
 430                         else if (nva2.na_uid != nd->nd_cred->cr_uid ||
 431                             NFSVNO_EXSTRICTACCESS(exp))
 432                                 nd->nd_repstat = nfsvno_accchk(vp,
 433                                     VWRITE, nd->nd_cred, exp, p,
 434                                     NFSACCCHK_NOOVERRIDE,
 435                                     NFSACCCHK_VPISLOCKED, NULL);
 436                 }
 437         }
 438         /*
 439          * Proxy operations from the MDS are allowed via the all 0s special
 440          * stateid.
 441          */
 442         if (nd->nd_repstat == 0 && (nd->nd_flag & ND_NFSV4) != 0 &&
 443             gotproxystateid == 0)
 444                 nd->nd_repstat = nfsrv_checksetattr(vp, nd, &stateid,
 445                     &nva, &attrbits, exp, p);
 446
 447         if (!nd->nd_repstat && (nd->nd_flag & ND_NFSV4)) {
 448             /*
 449              * For V4, try setting the attrbutes in sets, so that the
 450              * reply bitmap will be correct for an error case.
 451              */
 452             if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_OWNER) ||
 453                 NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_OWNERGROUP)) {
 454                 NFSVNO_ATTRINIT(&nva2);
 455                 NFSVNO_SETATTRVAL(&nva2, uid, nva.na_uid);
 456                 NFSVNO_SETATTRVAL(&nva2, gid, nva.na_gid);
 457                 nd->nd_repstat = nfsvno_setattr(vp, &nva2, nd->nd_cred, p,
 458                     exp);
 459                 if (!nd->nd_repstat) {
 460                     if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_OWNER))
 461                         NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_OWNER);
 462                     if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_OWNERGROUP))
 463                         NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_OWNERGROUP);
 464                 }
 465             }
 466             if (!nd->nd_repstat &&
 467                 NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_SIZE)) {
 468                 NFSVNO_ATTRINIT(&nva2);
 469                 NFSVNO_SETATTRVAL(&nva2, size, nva.na_size);
 470                 nd->nd_repstat = nfsvno_setattr(vp, &nva2, nd->nd_cred, p,
 471                     exp);
 472                 if (!nd->nd_repstat)
 473                     NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_SIZE);
 474             }
 475             if (!nd->nd_repstat &&
 476                 (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_TIMEACCESSSET) ||
 477                  NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_TIMEMODIFYSET))) {
 478                 NFSVNO_ATTRINIT(&nva2);
 479                 NFSVNO_SETATTRVAL(&nva2, atime, nva.na_atime);
 480                 NFSVNO_SETATTRVAL(&nva2, mtime, nva.na_mtime);
 481                 if (nva.na_vaflags & VA_UTIMES_NULL) {
 482                         nva2.na_vaflags |= VA_UTIMES_NULL;
 483                         NFSVNO_SETACTIVE(&nva2, vaflags);
 484                 }
 485                 nd->nd_repstat = nfsvno_setattr(vp, &nva2, nd->nd_cred, p,
 486                     exp);
 487                 if (!nd->nd_repstat) {
 488                     if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_TIMEACCESSSET))
 489                         NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_TIMEACCESSSET);
 490                     if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_TIMEMODIFYSET))
 491                         NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_TIMEMODIFYSET);
 492                 }
 493             }
 494             if (!nd->nd_repstat &&
 495                 (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_MODE) ||
 496                  NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_MODESETMASKED))) {
 497                 NFSVNO_ATTRINIT(&nva2);
 498                 NFSVNO_SETATTRVAL(&nva2, mode, nva.na_mode);
 499                 nd->nd_repstat = nfsvno_setattr(vp, &nva2, nd->nd_cred, p,
 500                     exp);
 501                 if (!nd->nd_repstat) {
 502                     if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_MODE))
 503                         NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_MODE);
 504                     if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_MODESETMASKED))
 505                         NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_MODESETMASKED);
 506                 }
 507             }
 508
 509 #ifdef NFS4_ACL_EXTATTR_NAME
 510             if (!nd->nd_repstat && aclp->acl_cnt > 0 &&
 511                 NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_ACL)) {
 512                 nd->nd_repstat = nfsrv_setacl(vp, aclp, nd->nd_cred, p);
 513                 if (!nd->nd_repstat)
 514                     NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_ACL);
 515             }
 516 #endif
 517         } else if (!nd->nd_repstat) {
 518                 nd->nd_repstat = nfsvno_setattr(vp, &nva, nd->nd_cred, p,
 519                     exp);
 520         }
 521         if (nd->nd_flag & (ND_NFSV2 | ND_NFSV3)) {
 522                 postat_ret = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
 523                 if (!nd->nd_repstat)
 524                         nd->nd_repstat = postat_ret;
 525         }
 526         vput(vp);
 527 #ifdef NFS4_ACL_EXTATTR_NAME
 528         acl_free(aclp);
 529 #endif
 530         if (nd->nd_flag & ND_NFSV3)
 531                 nfsrv_wcc(nd, preat_ret, &nva2, postat_ret, &nva);
 532         else if (nd->nd_flag & ND_NFSV4)
 533                 (void) nfsrv_putattrbit(nd, &retbits);
 534         else if (!nd->nd_repstat)
 535                 nfsrv_fillattr(nd, &nva);
 536
 537 out:
 538         NFSEXITCODE2(0, nd);
 539         return (0);
 540 nfsmout:
 541         vput(vp);
 542 #ifdef NFS4_ACL_EXTATTR_NAME
 543         acl_free(aclp);
 544 #endif
 545         if (nd->nd_flag & ND_NFSV4) {
 546                 /*
 547                  * For all nd_repstat, the V4 reply includes a bitmap,
 548                  * even NFSERR_BADXDR, which is what this will end up
 549                  * returning.
 550                  */
 551                 (void) nfsrv_putattrbit(nd, &retbits);
 552         }
 553         NFSEXITCODE2(error, nd);
 554         return (error);
 555 }
 556
 557 /*
 558  * nfs lookup rpc
 559  * (Also performs lookup parent for v4)
 560  */
 561 int
 562 nfsrvd_lookup(struct nfsrv_descript *nd, __unused int isdgram,
 563     vnode_t dp, vnode_t *vpp, fhandle_t *fhp, struct nfsexstuff *exp)
 564 {
 565         struct nameidata named;
 566         vnode_t vp, dirp = NULL;
 567         int error = 0, dattr_ret = 1;
 568         struct nfsvattr nva, dattr;
 569         char *bufp;
 570         u_long *hashp;
 571         struct thread *p = curthread;
 572
 573         if (nd->nd_repstat) {
 574                 nfsrv_postopattr(nd, dattr_ret, &dattr);
 575                 goto out;
 576         }
 577
 578         /*
 579          * For some reason, if dp is a symlink, the error
 580          * returned is supposed to be NFSERR_SYMLINK and not NFSERR_NOTDIR.
 581          */
 582         if (dp->v_type == VLNK && (nd->nd_flag & ND_NFSV4)) {
 583                 nd->nd_repstat = NFSERR_SYMLINK;
 584                 vrele(dp);
 585                 goto out;
 586         }
 587
 588         NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, LOOKUP,
 589             LOCKLEAF | SAVESTART);
 590         nfsvno_setpathbuf(&named, &bufp, &hashp);
 591         error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
 592         if (error) {
 593                 vrele(dp);
 594                 nfsvno_relpathbuf(&named);
 595                 goto out;
 596         }
 597         if (!nd->nd_repstat) {
 598                 nd->nd_repstat = nfsvno_namei(nd, &named, dp, 0, exp, p, &dirp);
 599         } else {
 600                 vrele(dp);
 601                 nfsvno_relpathbuf(&named);
 602         }
 603         if (nd->nd_repstat) {
 604                 if (dirp) {
 605                         if (nd->nd_flag & ND_NFSV3)
 606                                 dattr_ret = nfsvno_getattr(dirp, &dattr, nd, p,
 607                                     0, NULL);
 608                         vrele(dirp);
 609                 }
 610                 if (nd->nd_flag & ND_NFSV3)
 611                         nfsrv_postopattr(nd, dattr_ret, &dattr);
 612                 goto out;
 613         }
 614         if (named.ni_startdir)
 615                 vrele(named.ni_startdir);
 616         nfsvno_relpathbuf(&named);
 617         vp = named.ni_vp;
 618         if ((nd->nd_flag & ND_NFSV4) != 0 && !NFSVNO_EXPORTED(exp) &&
 619             vp->v_type != VDIR && vp->v_type != VLNK)
 620                 /*
 621                  * Only allow lookup of VDIR and VLNK for traversal of
 622                  * non-exported volumes during NFSv4 mounting.
 623                  */
 624                 nd->nd_repstat = ENOENT;
 625         if (nd->nd_repstat == 0)
 626                 nd->nd_repstat = nfsvno_getfh(vp, fhp, p);
 627         if (!(nd->nd_flag & ND_NFSV4) && !nd->nd_repstat)
 628                 nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
 629         if (vpp != NULL && nd->nd_repstat == 0)
 630                 *vpp = vp;
 631         else
 632                 vput(vp);
 633         if (dirp) {
 634                 if (nd->nd_flag & ND_NFSV3)
 635                         dattr_ret = nfsvno_getattr(dirp, &dattr, nd, p, 0,
 636                             NULL);
 637                 vrele(dirp);
 638         }
 639         if (nd->nd_repstat) {
 640                 if (nd->nd_flag & ND_NFSV3)
 641                         nfsrv_postopattr(nd, dattr_ret, &dattr);
 642                 goto out;
 643         }
 644         if (nd->nd_flag & ND_NFSV2) {
 645                 (void) nfsm_fhtom(nd, (u_int8_t *)fhp, 0, 0);
 646                 nfsrv_fillattr(nd, &nva);
 647         } else if (nd->nd_flag & ND_NFSV3) {
 648                 (void) nfsm_fhtom(nd, (u_int8_t *)fhp, 0, 0);
 649                 nfsrv_postopattr(nd, 0, &nva);
 650                 nfsrv_postopattr(nd, dattr_ret, &dattr);
 651         }
 652
 653 out:
 654         NFSEXITCODE2(error, nd);
 655         return (error);
 656 }
 657
 658 /*
 659  * nfs readlink service
 660  */
 661 int
 662 nfsrvd_readlink(struct nfsrv_descript *nd, __unused int isdgram,
 663     vnode_t vp, __unused struct nfsexstuff *exp)
 664 {
 665         u_int32_t *tl;
 666         struct mbuf *mp = NULL, *mpend = NULL;
 667         int getret = 1, len;
 668         struct nfsvattr nva;
 669         struct thread *p = curthread;
 670
 671         if (nd->nd_repstat) {
 672                 nfsrv_postopattr(nd, getret, &nva);
 673                 goto out;
 674         }
 675         if (vnode_vtype(vp) != VLNK) {
 676                 if (nd->nd_flag & ND_NFSV2)
 677                         nd->nd_repstat = ENXIO;
 678                 else
 679                         nd->nd_repstat = EINVAL;
 680         }
 681         if (!nd->nd_repstat)
 682                 nd->nd_repstat = nfsvno_readlink(vp, nd->nd_cred, p,
 683                     &mp, &mpend, &len);
 684         if (nd->nd_flag & ND_NFSV3)
 685                 getret = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
 686         vput(vp);
 687         if (nd->nd_flag & ND_NFSV3)
 688                 nfsrv_postopattr(nd, getret, &nva);
 689         if (nd->nd_repstat)
 690                 goto out;
 691         NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
 692         *tl = txdr_unsigned(len);
 693         if (mp != NULL) {
 694                 nd->nd_mb->m_next = mp;
 695                 nd->nd_mb = mpend;
 696                 nd->nd_bpos = mtod(mpend, caddr_t) + mpend->m_len;
 697         }
 698
 699 out:
 700         NFSEXITCODE2(0, nd);
 701         return (0);
 702 }
 703
 704 /*
 705  * nfs read service
 706  */
 707 int
 708 nfsrvd_read(struct nfsrv_descript *nd, __unused int isdgram,
 709     vnode_t vp, struct nfsexstuff *exp)
 710 {
 711         u_int32_t *tl;
 712         int error = 0, cnt, getret = 1, gotproxystateid, reqlen, eof = 0;
 713         struct mbuf *m2, *m3;
 714         struct nfsvattr nva;
 715         off_t off = 0x0;
 716         struct nfsstate st, *stp = &st;
 717         struct nfslock lo, *lop = &lo;
 718         nfsv4stateid_t stateid;
 719         nfsquad_t clientid;
 720         struct thread *p = curthread;
 721
 722         if (nd->nd_repstat) {
 723                 nfsrv_postopattr(nd, getret, &nva);
 724                 goto out;
 725         }
 726         if (nd->nd_flag & ND_NFSV2) {
 727                 NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
 728                 off = (off_t)fxdr_unsigned(u_int32_t, *tl++);
 729                 reqlen = fxdr_unsigned(int, *tl);
 730         } else if (nd->nd_flag & ND_NFSV3) {
 731                 NFSM_DISSECT(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
 732                 off = fxdr_hyper(tl);
 733                 tl += 2;
 734                 reqlen = fxdr_unsigned(int, *tl);
 735         } else {
 736                 NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID + 3*NFSX_UNSIGNED);
 737                 reqlen = fxdr_unsigned(int, *(tl + 6));
 738         }
 739         if (reqlen > NFS_SRVMAXDATA(nd)) {
 740                 reqlen = NFS_SRVMAXDATA(nd);
 741         } else if (reqlen < 0) {
 742                 error = EBADRPC;
 743                 goto nfsmout;
 744         }
 745         gotproxystateid = 0;
 746         if (nd->nd_flag & ND_NFSV4) {
 747                 stp->ls_flags = (NFSLCK_CHECK | NFSLCK_READACCESS);
 748                 lop->lo_flags = NFSLCK_READ;
 749                 stp->ls_ownerlen = 0;
 750                 stp->ls_op = NULL;
 751                 stp->ls_uid = nd->nd_cred->cr_uid;
 752                 stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
 753                 clientid.lval[0] = stp->ls_stateid.other[0] = *tl++;
 754                 clientid.lval[1] = stp->ls_stateid.other[1] = *tl++;
 755                 if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
 756                         if ((nd->nd_flag & ND_NFSV41) != 0)
 757                                 clientid.qval = nd->nd_clientid.qval;
 758                         else if (nd->nd_clientid.qval != clientid.qval)
 759                                 printf("EEK1 multiple clids\n");
 760                 } else {
 761                         if ((nd->nd_flag & ND_NFSV41) != 0)
 762                                 printf("EEK! no clientid from session\n");
 763                         nd->nd_flag |= ND_IMPLIEDCLID;
 764                         nd->nd_clientid.qval = clientid.qval;
 765                 }
 766                 stp->ls_stateid.other[2] = *tl++;
 767                 /*
 768                  * Don't allow the client to use a special stateid for a DS op.
 769                  */
 770                 if ((nd->nd_flag & ND_DSSERVER) != 0 &&
 771                     ((stp->ls_stateid.other[0] == 0x0 &&
 772                     stp->ls_stateid.other[1] == 0x0 &&
 773                     stp->ls_stateid.other[2] == 0x0) ||
 774                     (stp->ls_stateid.other[0] == 0xffffffff &&
 775                     stp->ls_stateid.other[1] == 0xffffffff &&
 776                     stp->ls_stateid.other[2] == 0xffffffff) ||
 777                     stp->ls_stateid.seqid != 0))
 778                         nd->nd_repstat = NFSERR_BADSTATEID;
 779                 /* However, allow the proxy stateid. */
 780                 if (stp->ls_stateid.seqid == 0xffffffff &&
 781                     stp->ls_stateid.other[0] == 0x55555555 &&
 782                     stp->ls_stateid.other[1] == 0x55555555 &&
 783                     stp->ls_stateid.other[2] == 0x55555555)
 784                         gotproxystateid = 1;
 785                 off = fxdr_hyper(tl);
 786                 lop->lo_first = off;
 787                 tl += 2;
 788                 lop->lo_end = off + reqlen;
 789                 /*
 790                  * Paranoia, just in case it wraps around.
 791                  */
 792                 if (lop->lo_end < off)
 793                         lop->lo_end = NFS64BITSSET;
 794         }
 795         if (vnode_vtype(vp) != VREG) {
 796                 if (nd->nd_flag & ND_NFSV3)
 797                         nd->nd_repstat = EINVAL;
 798                 else
 799                         nd->nd_repstat = (vnode_vtype(vp) == VDIR) ? EISDIR :
 800                             EINVAL;
 801         }
 802         getret = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
 803         if (!nd->nd_repstat)
 804                 nd->nd_repstat = getret;
 805         if (!nd->nd_repstat &&
 806             (nva.na_uid != nd->nd_cred->cr_uid ||
 807              NFSVNO_EXSTRICTACCESS(exp))) {
 808                 nd->nd_repstat = nfsvno_accchk(vp, VREAD,
 809                     nd->nd_cred, exp, p,
 810                     NFSACCCHK_ALLOWOWNER, NFSACCCHK_VPISLOCKED, NULL);
 811                 if (nd->nd_repstat)
 812                         nd->nd_repstat = nfsvno_accchk(vp, VEXEC,
 813                             nd->nd_cred, exp, p, NFSACCCHK_ALLOWOWNER,
 814                             NFSACCCHK_VPISLOCKED, NULL);
 815         }
 816         /*
 817          * DS reads are marked by ND_DSSERVER or use the proxy special
 818          * stateid.
 819          */
 820         if (nd->nd_repstat == 0 && (nd->nd_flag & (ND_NFSV4 | ND_DSSERVER)) ==
 821             ND_NFSV4 && gotproxystateid == 0)
 822                 nd->nd_repstat = nfsrv_lockctrl(vp, &stp, &lop, NULL, clientid,
 823                     &stateid, exp, nd, p);
 824         if (nd->nd_repstat) {
 825                 vput(vp);
 826                 if (nd->nd_flag & ND_NFSV3)
 827                         nfsrv_postopattr(nd, getret, &nva);
 828                 goto out;
 829         }
 830         if (off >= nva.na_size) {
 831                 cnt = 0;
 832                 eof = 1;
 833         } else if (reqlen == 0)
 834                 cnt = 0;
 835         else if ((off + reqlen) >= nva.na_size) {
 836                 cnt = nva.na_size - off;
 837                 eof = 1;
 838         } else
 839                 cnt = reqlen;
 840         m3 = NULL;
 841         if (cnt > 0) {
 842                 nd->nd_repstat = nfsvno_read(vp, off, cnt, nd->nd_cred, p,
 843                     &m3, &m2);
 844                 if (!(nd->nd_flag & ND_NFSV4)) {
 845                         getret = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
 846                         if (!nd->nd_repstat)
 847                                 nd->nd_repstat = getret;
 848                 }
 849                 if (nd->nd_repstat) {
 850                         vput(vp);
 851                         if (m3)
 852                                 m_freem(m3);
 853                         if (nd->nd_flag & ND_NFSV3)
 854                                 nfsrv_postopattr(nd, getret, &nva);
 855                         goto out;
 856                 }
 857         }
 858         vput(vp);
 859         if (nd->nd_flag & ND_NFSV2) {
 860                 nfsrv_fillattr(nd, &nva);
 861                 NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
 862         } else {
 863                 if (nd->nd_flag & ND_NFSV3) {
 864                         nfsrv_postopattr(nd, getret, &nva);
 865                         NFSM_BUILD(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
 866                         *tl++ = txdr_unsigned(cnt);
 867                 } else
 868                         NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
 869                 if (eof)
 870                         *tl++ = newnfs_true;
 871                 else
 872                         *tl++ = newnfs_false;
 873         }
 874         *tl = txdr_unsigned(cnt);
 875         if (m3) {
 876                 nd->nd_mb->m_next = m3;
 877                 nd->nd_mb = m2;
 878                 nd->nd_bpos = mtod(m2, caddr_t) + m2->m_len;
 879         }
 880
 881 out:
 882         NFSEXITCODE2(0, nd);
 883         return (0);
 884 nfsmout:
 885         vput(vp);
 886         NFSEXITCODE2(error, nd);
 887         return (error);
 888 }
 889
 890 /*
 891  * nfs write service
 892  */
 893 int
 894 nfsrvd_write(struct nfsrv_descript *nd, __unused int isdgram,
 895     vnode_t vp, struct nfsexstuff *exp)
 896 {
 897         u_int32_t *tl;
 898         struct nfsvattr nva, forat;
 899         int aftat_ret = 1, retlen, len, error = 0, forat_ret = 1;
 900         int gotproxystateid, stable = NFSWRITE_FILESYNC;
 901         off_t off;
 902         struct nfsstate st, *stp = &st;
 903         struct nfslock lo, *lop = &lo;
 904         nfsv4stateid_t stateid;
 905         nfsquad_t clientid;
 906         nfsattrbit_t attrbits;
 907         struct thread *p = curthread;
 908
 909         if (nd->nd_repstat) {
 910                 nfsrv_wcc(nd, forat_ret, &forat, aftat_ret, &nva);
 911                 goto out;
 912         }
 913         gotproxystateid = 0;
 914         if (nd->nd_flag & ND_NFSV2) {
 915                 NFSM_DISSECT(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
 916                 off = (off_t)fxdr_unsigned(u_int32_t, *++tl);
 917                 tl += 2;
 918                 retlen = len = fxdr_unsigned(int32_t, *tl);
 919         } else if (nd->nd_flag & ND_NFSV3) {
 920                 NFSM_DISSECT(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
 921                 off = fxdr_hyper(tl);
 922                 tl += 3;
 923                 stable = fxdr_unsigned(int, *tl++);
 924                 retlen = len = fxdr_unsigned(int32_t, *tl);
 925         } else {
 926                 NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID + 4 * NFSX_UNSIGNED);
 927                 stp->ls_flags = (NFSLCK_CHECK | NFSLCK_WRITEACCESS);
 928                 lop->lo_flags = NFSLCK_WRITE;
 929                 stp->ls_ownerlen = 0;
 930                 stp->ls_op = NULL;
 931                 stp->ls_uid = nd->nd_cred->cr_uid;
 932                 stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
 933                 clientid.lval[0] = stp->ls_stateid.other[0] = *tl++;
 934                 clientid.lval[1] = stp->ls_stateid.other[1] = *tl++;
 935                 if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
 936                         if ((nd->nd_flag & ND_NFSV41) != 0)
 937                                 clientid.qval = nd->nd_clientid.qval;
 938                         else if (nd->nd_clientid.qval != clientid.qval)
 939                                 printf("EEK2 multiple clids\n");
 940                 } else {
 941                         if ((nd->nd_flag & ND_NFSV41) != 0)
 942                                 printf("EEK! no clientid from session\n");
 943                         nd->nd_flag |= ND_IMPLIEDCLID;
 944                         nd->nd_clientid.qval = clientid.qval;
 945                 }
 946                 stp->ls_stateid.other[2] = *tl++;
 947                 /*
 948                  * Don't allow the client to use a special stateid for a DS op.
 949                  */
 950                 if ((nd->nd_flag & ND_DSSERVER) != 0 &&
 951                     ((stp->ls_stateid.other[0] == 0x0 &&
 952                     stp->ls_stateid.other[1] == 0x0 &&
 953                     stp->ls_stateid.other[2] == 0x0) ||
 954                     (stp->ls_stateid.other[0] == 0xffffffff &&
 955                     stp->ls_stateid.other[1] == 0xffffffff &&
 956                     stp->ls_stateid.other[2] == 0xffffffff) ||
 957                     stp->ls_stateid.seqid != 0))
 958                         nd->nd_repstat = NFSERR_BADSTATEID;
 959                 /* However, allow the proxy stateid. */
 960                 if (stp->ls_stateid.seqid == 0xffffffff &&
 961                     stp->ls_stateid.other[0] == 0x55555555 &&
 962                     stp->ls_stateid.other[1] == 0x55555555 &&
 963                     stp->ls_stateid.other[2] == 0x55555555)
 964                         gotproxystateid = 1;
 965                 off = fxdr_hyper(tl);
 966                 lop->lo_first = off;
 967                 tl += 2;
 968                 stable = fxdr_unsigned(int, *tl++);
 969                 retlen = len = fxdr_unsigned(int32_t, *tl);
 970                 lop->lo_end = off + len;
 971                 /*
 972                  * Paranoia, just in case it wraps around, which shouldn't
 973                  * ever happen anyhow.
 974                  */
 975                 if (lop->lo_end < lop->lo_first)
 976                         lop->lo_end = NFS64BITSSET;
 977         }
 978
 979         if (retlen > NFS_SRVMAXIO || retlen < 0)
 980                 nd->nd_repstat = EIO;
 981         if (vnode_vtype(vp) != VREG && !nd->nd_repstat) {
 982                 if (nd->nd_flag & ND_NFSV3)
 983                         nd->nd_repstat = EINVAL;
 984                 else
 985                         nd->nd_repstat = (vnode_vtype(vp) == VDIR) ? EISDIR :
 986                             EINVAL;
 987         }
 988         NFSZERO_ATTRBIT(&attrbits);
 989         NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_OWNER);
 990         forat_ret = nfsvno_getattr(vp, &forat, nd, p, 1, &attrbits);
 991         if (!nd->nd_repstat)
 992                 nd->nd_repstat = forat_ret;
 993         if (!nd->nd_repstat &&
 994             (forat.na_uid != nd->nd_cred->cr_uid ||
 995              NFSVNO_EXSTRICTACCESS(exp)))
 996                 nd->nd_repstat = nfsvno_accchk(vp, VWRITE,
 997                     nd->nd_cred, exp, p,
 998                     NFSACCCHK_ALLOWOWNER, NFSACCCHK_VPISLOCKED, NULL);
 999         /*
1000          * DS reads are marked by ND_DSSERVER or use the proxy special
1001          * stateid.
1002          */
1003         if (nd->nd_repstat == 0 && (nd->nd_flag & (ND_NFSV4 | ND_DSSERVER)) ==
1004             ND_NFSV4 && gotproxystateid == 0)
1005                 nd->nd_repstat = nfsrv_lockctrl(vp, &stp, &lop, NULL, clientid,
1006                     &stateid, exp, nd, p);
1007         if (nd->nd_repstat) {
1008                 vput(vp);
1009                 if (nd->nd_flag & ND_NFSV3)
1010                         nfsrv_wcc(nd, forat_ret, &forat, aftat_ret, &nva);
1011                 goto out;
1012         }
1013
1014         /*
1015          * For NFS Version 2, it is not obvious what a write of zero length
1016          * should do, but I might as well be consistent with Version 3,
1017          * which is to return ok so long as there are no permission problems.
1018          */
1019         if (retlen > 0) {
1020                 nd->nd_repstat = nfsvno_write(vp, off, retlen, &stable,
1021                     nd->nd_md, nd->nd_dpos, nd->nd_cred, p);
1022                 error = nfsm_advance(nd, NFSM_RNDUP(retlen), -1);
1023                 if (error)
1024                         goto nfsmout;
1025         }
1026         if (nd->nd_flag & ND_NFSV4)
1027                 aftat_ret = 0;
1028         else
1029                 aftat_ret = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
1030         vput(vp);
1031         if (!nd->nd_repstat)
1032                 nd->nd_repstat = aftat_ret;
1033         if (nd->nd_flag & (ND_NFSV3 | ND_NFSV4)) {
1034                 if (nd->nd_flag & ND_NFSV3)
1035                         nfsrv_wcc(nd, forat_ret, &forat, aftat_ret, &nva);
1036                 if (nd->nd_repstat)
1037                         goto out;
1038                 NFSM_BUILD(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
1039                 *tl++ = txdr_unsigned(retlen);
1040                 /*
1041                  * If nfs_async is set, then pretend the write was FILESYNC.
1042                  * Warning: Doing this violates RFC1813 and runs a risk
1043                  * of data written by a client being lost when the server
1044                  * crashes/reboots.
1045                  */
1046                 if (stable == NFSWRITE_UNSTABLE && nfs_async == 0)
1047                         *tl++ = txdr_unsigned(stable);
1048                 else
1049                         *tl++ = txdr_unsigned(NFSWRITE_FILESYNC);
1050                 /*
1051                  * Actually, there is no need to txdr these fields,
1052                  * but it may make the values more human readable,
1053                  * for debugging purposes.
1054                  */
1055                 *tl++ = txdr_unsigned(nfsboottime.tv_sec);
1056                 *tl = txdr_unsigned(nfsboottime.tv_usec);
1057         } else if (!nd->nd_repstat)
1058                 nfsrv_fillattr(nd, &nva);
1059
1060 out:
1061         NFSEXITCODE2(0, nd);
1062         return (0);
1063 nfsmout:
1064         vput(vp);
1065         NFSEXITCODE2(error, nd);
1066         return (error);
1067 }
1068
1069 /*
1070  * nfs create service (creates regular files for V2 and V3. Spec. files for V2.)
1071  * now does a truncate to 0 length via. setattr if it already exists
1072  * The core creation routine has been extracted out into nfsrv_creatsub(),
1073  * so it can also be used by nfsrv_open() for V4.
1074  */
1075 int
1076 nfsrvd_create(struct nfsrv_descript *nd, __unused int isdgram,
1077     vnode_t dp, struct nfsexstuff *exp)
1078 {
1079         struct nfsvattr nva, dirfor, diraft;
1080         struct nfsv2_sattr *sp;
1081         struct nameidata named;
1082         u_int32_t *tl;
1083         int error = 0, tsize, dirfor_ret = 1, diraft_ret = 1;
1084         int how = NFSCREATE_UNCHECKED, exclusive_flag = 0;
1085         NFSDEV_T rdev = 0;
1086         vnode_t vp = NULL, dirp = NULL;
1087         fhandle_t fh;
1088         char *bufp;
1089         u_long *hashp;
1090         enum vtype vtyp;
1091         int32_t cverf[2], tverf[2] = { 0, 0 };
1092         struct thread *p = curthread;
1093
1094         if (nd->nd_repstat) {
1095                 nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1096                 goto out;
1097         }
1098         NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, CREATE,
1099             LOCKPARENT | LOCKLEAF | SAVESTART | NOCACHE);
1100         nfsvno_setpathbuf(&named, &bufp, &hashp);
1101         error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
1102         if (error)
1103                 goto nfsmout;
1104         if (!nd->nd_repstat) {
1105                 NFSVNO_ATTRINIT(&nva);
1106                 if (nd->nd_flag & ND_NFSV2) {
1107                         NFSM_DISSECT(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
1108                         vtyp = IFTOVT(fxdr_unsigned(u_int32_t, sp->sa_mode));
1109                         if (vtyp == VNON)
1110                                 vtyp = VREG;
1111                         NFSVNO_SETATTRVAL(&nva, type, vtyp);
1112                         NFSVNO_SETATTRVAL(&nva, mode,
1113                             nfstov_mode(sp->sa_mode));
1114                         switch (nva.na_type) {
1115                         case VREG:
1116                                 tsize = fxdr_unsigned(int32_t, sp->sa_size);
1117                                 if (tsize != -1)
1118                                         NFSVNO_SETATTRVAL(&nva, size,
1119                                             (u_quad_t)tsize);
1120                                 break;
1121                         case VCHR:
1122                         case VBLK:
1123                         case VFIFO:
1124                                 rdev = fxdr_unsigned(NFSDEV_T, sp->sa_size);
1125                                 break;
1126                         default:
1127                                 break;
1128                         }
1129                 } else {
1130                         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1131                         how = fxdr_unsigned(int, *tl);
1132                         switch (how) {
1133                         case NFSCREATE_GUARDED:
1134                         case NFSCREATE_UNCHECKED:
1135                                 error = nfsrv_sattr(nd, NULL, &nva, NULL, NULL, p);
1136                                 if (error)
1137                                         goto nfsmout;
1138                                 break;
1139                         case NFSCREATE_EXCLUSIVE:
1140                                 NFSM_DISSECT(tl, u_int32_t *, NFSX_VERF);
1141                                 cverf[0] = *tl++;
1142                                 cverf[1] = *tl;
1143                                 exclusive_flag = 1;
1144                                 break;
1145                         }
1146                         NFSVNO_SETATTRVAL(&nva, type, VREG);
1147                 }
1148         }
1149         if (nd->nd_repstat) {
1150                 nfsvno_relpathbuf(&named);
1151                 if (nd->nd_flag & ND_NFSV3) {
1152                         dirfor_ret = nfsvno_getattr(dp, &dirfor, nd, p, 1,
1153                             NULL);
1154                         nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret,
1155                             &diraft);
1156                 }
1157                 vput(dp);
1158                 goto out;
1159         }
1160
1161         nd->nd_repstat = nfsvno_namei(nd, &named, dp, 1, exp, p, &dirp);
1162         if (dirp) {
1163                 if (nd->nd_flag & ND_NFSV2) {
1164                         vrele(dirp);
1165                         dirp = NULL;
1166                 } else {
1167                         dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0,
1168                             NULL);
1169                 }
1170         }
1171         if (nd->nd_repstat) {
1172                 if (nd->nd_flag & ND_NFSV3)
1173                         nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret,
1174                             &diraft);
1175                 if (dirp)
1176                         vrele(dirp);
1177                 goto out;
1178         }
1179
1180         if (!(nd->nd_flag & ND_NFSV2)) {
1181                 switch (how) {
1182                 case NFSCREATE_GUARDED:
1183                         if (named.ni_vp)
1184                                 nd->nd_repstat = EEXIST;
1185                         break;
1186                 case NFSCREATE_UNCHECKED:
1187                         break;
1188                 case NFSCREATE_EXCLUSIVE:
1189                         if (named.ni_vp == NULL)
1190                                 NFSVNO_SETATTRVAL(&nva, mode, 0);
1191                         break;
1192                 }
1193         }
1194
1195         /*
1196          * Iff doesn't exist, create it
1197          * otherwise just truncate to 0 length
1198          *   should I set the mode too ?
1199          */
1200         nd->nd_repstat = nfsvno_createsub(nd, &named, &vp, &nva,
1201             &exclusive_flag, cverf, rdev, exp);
1202
1203         if (!nd->nd_repstat) {
1204                 nd->nd_repstat = nfsvno_getfh(vp, &fh, p);
1205                 if (!nd->nd_repstat)
1206                         nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1,
1207                             NULL);
1208                 vput(vp);
1209                 if (!nd->nd_repstat) {
1210                         tverf[0] = nva.na_atime.tv_sec;
1211                         tverf[1] = nva.na_atime.tv_nsec;
1212                 }
1213         }
1214         if (nd->nd_flag & ND_NFSV2) {
1215                 if (!nd->nd_repstat) {
1216                         (void) nfsm_fhtom(nd, (u_int8_t *)&fh, 0, 0);
1217                         nfsrv_fillattr(nd, &nva);
1218                 }
1219         } else {
1220                 if (exclusive_flag && !nd->nd_repstat && (cverf[0] != tverf[0]
1221                     || cverf[1] != tverf[1]))
1222                         nd->nd_repstat = EEXIST;
1223                 diraft_ret = nfsvno_getattr(dirp, &diraft, nd, p, 0, NULL);
1224                 vrele(dirp);
1225                 if (!nd->nd_repstat) {
1226                         (void) nfsm_fhtom(nd, (u_int8_t *)&fh, 0, 1);
1227                         nfsrv_postopattr(nd, 0, &nva);
1228                 }
1229                 nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1230         }
1231
1232 out:
1233         NFSEXITCODE2(0, nd);
1234         return (0);
1235 nfsmout:
1236         vput(dp);
1237         nfsvno_relpathbuf(&named);
1238         NFSEXITCODE2(error, nd);
1239         return (error);
1240 }
1241
1242 /*
1243  * nfs v3 mknod service (and v4 create)
1244  */
1245 int
1246 nfsrvd_mknod(struct nfsrv_descript *nd, __unused int isdgram,
1247     vnode_t dp, vnode_t *vpp, fhandle_t *fhp, struct nfsexstuff *exp)
1248 {
1249         struct nfsvattr nva, dirfor, diraft;
1250         u_int32_t *tl;
1251         struct nameidata named;
1252         int error = 0, dirfor_ret = 1, diraft_ret = 1, pathlen;
1253         u_int32_t major, minor;
1254         enum vtype vtyp = VNON;
1255         nfstype nfs4type = NFNON;
1256         vnode_t vp, dirp = NULL;
1257         nfsattrbit_t attrbits;
1258         char *bufp = NULL, *pathcp = NULL;
1259         u_long *hashp, cnflags;
1260         NFSACL_T *aclp = NULL;
1261         struct thread *p = curthread;
1262
1263         NFSVNO_ATTRINIT(&nva);
1264         cnflags = (LOCKPARENT | SAVESTART);
1265         if (nd->nd_repstat) {
1266                 nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1267                 goto out;
1268         }
1269 #ifdef NFS4_ACL_EXTATTR_NAME
1270         aclp = acl_alloc(M_WAITOK);
1271         aclp->acl_cnt = 0;
1272 #endif
1273
1274         /*
1275          * For V4, the creation stuff is here, Yuck!
1276          */
1277         if (nd->nd_flag & ND_NFSV4) {
1278                 NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1279                 vtyp = nfsv34tov_type(*tl);
1280                 nfs4type = fxdr_unsigned(nfstype, *tl);
1281                 switch (nfs4type) {
1282                 case NFLNK:
1283                         error = nfsvno_getsymlink(nd, &nva, p, &pathcp,
1284                             &pathlen);
1285                         if (error)
1286                                 goto nfsmout;
1287                         break;
1288                 case NFCHR:
1289                 case NFBLK:
1290                         NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1291                         major = fxdr_unsigned(u_int32_t, *tl++);
1292                         minor = fxdr_unsigned(u_int32_t, *tl);
1293                         nva.na_rdev = NFSMAKEDEV(major, minor);
1294                         break;
1295                 case NFSOCK:
1296                 case NFFIFO:
1297                         break;
1298                 case NFDIR:
1299                         cnflags = (LOCKPARENT | SAVENAME);
1300                         break;
1301                 default:
1302                         nd->nd_repstat = NFSERR_BADTYPE;
1303                         vrele(dp);
1304 #ifdef NFS4_ACL_EXTATTR_NAME
1305                         acl_free(aclp);
1306 #endif
1307                         goto out;
1308                 }
1309         }
1310         NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, CREATE, cnflags | NOCACHE);
1311         nfsvno_setpathbuf(&named, &bufp, &hashp);
1312         error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
1313         if (error)
1314                 goto nfsmout;
1315         if (!nd->nd_repstat) {
1316                 if (nd->nd_flag & ND_NFSV3) {
1317                         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1318                         vtyp = nfsv34tov_type(*tl);
1319                 }
1320                 error = nfsrv_sattr(nd, NULL, &nva, &attrbits, aclp, p);
1321                 if (error)
1322                         goto nfsmout;
1323                 nva.na_type = vtyp;
1324                 if (!nd->nd_repstat && (nd->nd_flag & ND_NFSV3) &&
1325                     (vtyp == VCHR || vtyp == VBLK)) {
1326                         NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1327                         major = fxdr_unsigned(u_int32_t, *tl++);
1328                         minor = fxdr_unsigned(u_int32_t, *tl);
1329                         nva.na_rdev = NFSMAKEDEV(major, minor);
1330                 }
1331         }
1332
1333         dirfor_ret = nfsvno_getattr(dp, &dirfor, nd, p, 0, NULL);
1334         if (!nd->nd_repstat && (nd->nd_flag & ND_NFSV4)) {
1335                 if (!dirfor_ret && NFSVNO_ISSETGID(&nva) &&
1336                     dirfor.na_gid == nva.na_gid)
1337                         NFSVNO_UNSET(&nva, gid);
1338                 nd->nd_repstat = nfsrv_checkuidgid(nd, &nva);
1339         }
1340         if (nd->nd_repstat) {
1341                 vrele(dp);
1342 #ifdef NFS4_ACL_EXTATTR_NAME
1343                 acl_free(aclp);
1344 #endif
1345                 nfsvno_relpathbuf(&named);
1346                 if (pathcp)
1347                         free(pathcp, M_TEMP);
1348                 if (nd->nd_flag & ND_NFSV3)
1349                         nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret,
1350                             &diraft);
1351                 goto out;
1352         }
1353
1354         /*
1355          * Yuck! For V4, mkdir and link are here and some V4 clients don't fill
1356          * in va_mode, so we'll have to set a default here.
1357          */
1358         if (NFSVNO_NOTSETMODE(&nva)) {
1359                 if (vtyp == VLNK)
1360                         nva.na_mode = 0755;
1361                 else
1362                         nva.na_mode = 0400;
1363         }
1364
1365         if (vtyp == VDIR)
1366                 named.ni_cnd.cn_flags |= WILLBEDIR;
1367         nd->nd_repstat = nfsvno_namei(nd, &named, dp, 0, exp, p, &dirp);
1368         if (nd->nd_repstat) {
1369                 if (dirp) {
1370                         if (nd->nd_flag & ND_NFSV3)
1371                                 dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd,
1372                                     p, 0, NULL);
1373                         vrele(dirp);
1374                 }
1375 #ifdef NFS4_ACL_EXTATTR_NAME
1376                 acl_free(aclp);
1377 #endif
1378                 if (nd->nd_flag & ND_NFSV3)
1379                         nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret,
1380                             &diraft);
1381                 goto out;
1382         }
1383         if (dirp)
1384                 dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0, NULL);
1385
1386         if ((nd->nd_flag & ND_NFSV4) && (vtyp == VDIR || vtyp == VLNK)) {
1387                 if (vtyp == VDIR) {
1388                         nfsrvd_mkdirsub(nd, &named, &nva, fhp, vpp, dirp,
1389                             &dirfor, &diraft, &diraft_ret, &attrbits, aclp, p,
1390                             exp);
1391 #ifdef NFS4_ACL_EXTATTR_NAME
1392                         acl_free(aclp);
1393 #endif
1394                         goto out;
1395                 } else if (vtyp == VLNK) {
1396                         nfsrvd_symlinksub(nd, &named, &nva, fhp, vpp, dirp,
1397                             &dirfor, &diraft, &diraft_ret, &attrbits,
1398                             aclp, p, exp, pathcp, pathlen);
1399 #ifdef NFS4_ACL_EXTATTR_NAME
1400                         acl_free(aclp);
1401 #endif
1402                         free(pathcp, M_TEMP);
1403                         goto out;
1404                 }
1405         }
1406
1407         nd->nd_repstat = nfsvno_mknod(&named, &nva, nd->nd_cred, p);
1408         if (!nd->nd_repstat) {
1409                 vp = named.ni_vp;
1410                 nfsrv_fixattr(nd, vp, &nva, aclp, p, &attrbits, exp);
1411                 nd->nd_repstat = nfsvno_getfh(vp, fhp, p);
1412                 if ((nd->nd_flag & ND_NFSV3) && !nd->nd_repstat)
1413                         nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1,
1414                             NULL);
1415                 if (vpp != NULL && nd->nd_repstat == 0) {
1416                         NFSVOPUNLOCK(vp);
1417                         *vpp = vp;
1418                 } else
1419                         vput(vp);
1420         }
1421
1422         diraft_ret = nfsvno_getattr(dirp, &diraft, nd, p, 0, NULL);
1423         vrele(dirp);
1424         if (!nd->nd_repstat) {
1425                 if (nd->nd_flag & ND_NFSV3) {
1426                         (void) nfsm_fhtom(nd, (u_int8_t *)fhp, 0, 1);
1427                         nfsrv_postopattr(nd, 0, &nva);
1428                 } else {
1429                         NFSM_BUILD(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
1430                         *tl++ = newnfs_false;
1431                         txdr_hyper(dirfor.na_filerev, tl);
1432                         tl += 2;
1433                         txdr_hyper(diraft.na_filerev, tl);
1434                         (void) nfsrv_putattrbit(nd, &attrbits);
1435                 }
1436         }
1437         if (nd->nd_flag & ND_NFSV3)
1438                 nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1439 #ifdef NFS4_ACL_EXTATTR_NAME
1440         acl_free(aclp);
1441 #endif
1442
1443 out:
1444         NFSEXITCODE2(0, nd);
1445         return (0);
1446 nfsmout:
1447         vrele(dp);
1448 #ifdef NFS4_ACL_EXTATTR_NAME
1449         acl_free(aclp);
1450 #endif
1451         if (bufp)
1452                 nfsvno_relpathbuf(&named);
1453         if (pathcp)
1454                 free(pathcp, M_TEMP);
1455
1456         NFSEXITCODE2(error, nd);
1457         return (error);
1458 }
1459
1460 /*
1461  * nfs remove service
1462  */
1463 int
1464 nfsrvd_remove(struct nfsrv_descript *nd, __unused int isdgram,
1465     vnode_t dp, struct nfsexstuff *exp)
1466 {
1467         struct nameidata named;
1468         u_int32_t *tl;
1469         int error = 0, dirfor_ret = 1, diraft_ret = 1;
1470         vnode_t dirp = NULL;
1471         struct nfsvattr dirfor, diraft;
1472         char *bufp;
1473         u_long *hashp;
1474         struct thread *p = curthread;
1475
1476         if (nd->nd_repstat) {
1477                 nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1478                 goto out;
1479         }
1480         NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, DELETE,
1481             LOCKPARENT | LOCKLEAF);
1482         nfsvno_setpathbuf(&named, &bufp, &hashp);
1483         error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
1484         if (error) {
1485                 vput(dp);
1486                 nfsvno_relpathbuf(&named);
1487                 goto out;
1488         }
1489         if (!nd->nd_repstat) {
1490                 nd->nd_repstat = nfsvno_namei(nd, &named, dp, 1, exp, p, &dirp);
1491         } else {
1492                 vput(dp);
1493                 nfsvno_relpathbuf(&named);
1494         }
1495         if (dirp) {
1496                 if (!(nd->nd_flag & ND_NFSV2)) {
1497                         dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0,
1498                             NULL);
1499                 } else {
1500                         vrele(dirp);
1501                         dirp = NULL;
1502                 }
1503         }
1504         if (!nd->nd_repstat) {
1505                 if (nd->nd_flag & ND_NFSV4) {
1506                         if (vnode_vtype(named.ni_vp) == VDIR)
1507                                 nd->nd_repstat = nfsvno_rmdirsub(&named, 1,
1508                                     nd->nd_cred, p, exp);
1509                         else
1510                                 nd->nd_repstat = nfsvno_removesub(&named, 1,
1511                                     nd->nd_cred, p, exp);
1512                 } else if (nd->nd_procnum == NFSPROC_RMDIR) {
1513                         nd->nd_repstat = nfsvno_rmdirsub(&named, 0,
1514                             nd->nd_cred, p, exp);
1515                 } else {
1516                         nd->nd_repstat = nfsvno_removesub(&named, 0,
1517                             nd->nd_cred, p, exp);
1518                 }
1519         }
1520         if (!(nd->nd_flag & ND_NFSV2)) {
1521                 if (dirp) {
1522                         diraft_ret = nfsvno_getattr(dirp, &diraft, nd, p, 0,
1523                             NULL);
1524                         vrele(dirp);
1525                 }
1526                 if (nd->nd_flag & ND_NFSV3) {
1527                         nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret,
1528                             &diraft);
1529                 } else if (!nd->nd_repstat) {
1530                         NFSM_BUILD(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
1531                         *tl++ = newnfs_false;
1532                         txdr_hyper(dirfor.na_filerev, tl);
1533                         tl += 2;
1534                         txdr_hyper(diraft.na_filerev, tl);
1535                 }
1536         }
1537
1538 out:
1539         NFSEXITCODE2(error, nd);
1540         return (error);
1541 }
1542
1543 /*
1544  * nfs rename service
1545  */
1546 int
1547 nfsrvd_rename(struct nfsrv_descript *nd, int isdgram,
1548     vnode_t dp, vnode_t todp, struct nfsexstuff *exp, struct nfsexstuff *toexp)
1549 {
1550         u_int32_t *tl;
1551         int error = 0, fdirfor_ret = 1, fdiraft_ret = 1;
1552         int tdirfor_ret = 1, tdiraft_ret = 1;
1553         struct nameidata fromnd, tond;
1554         vnode_t fdirp = NULL, tdirp = NULL, tdp = NULL;
1555         struct nfsvattr fdirfor, fdiraft, tdirfor, tdiraft;
1556         struct nfsexstuff tnes;
1557         struct nfsrvfh tfh;
1558         char *bufp, *tbufp = NULL;
1559         u_long *hashp;
1560         fhandle_t fh;
1561         struct thread *p = curthread;
1562
1563         if (nd->nd_repstat) {
1564                 nfsrv_wcc(nd, fdirfor_ret, &fdirfor, fdiraft_ret, &fdiraft);
1565                 nfsrv_wcc(nd, tdirfor_ret, &tdirfor, tdiraft_ret, &tdiraft);
1566                 goto out;
1567         }
1568         if (!(nd->nd_flag & ND_NFSV2))
1569                 fdirfor_ret = nfsvno_getattr(dp, &fdirfor, nd, p, 1, NULL);
1570         tond.ni_cnd.cn_nameiop = 0;
1571         tond.ni_startdir = NULL;
1572         NFSNAMEICNDSET(&fromnd.ni_cnd, nd->nd_cred, DELETE, WANTPARENT | SAVESTART);
1573         nfsvno_setpathbuf(&fromnd, &bufp, &hashp);
1574         error = nfsrv_parsename(nd, bufp, hashp, &fromnd.ni_pathlen);
1575         if (error) {
1576                 vput(dp);
1577                 if (todp)
1578                         vrele(todp);
1579                 nfsvno_relpathbuf(&fromnd);
1580                 goto out;
1581         }
1582         /*
1583          * Unlock dp in this code section, so it is unlocked before
1584          * tdp gets locked. This avoids a potential LOR if tdp is the
1585          * parent directory of dp.
1586          */
1587         if (nd->nd_flag & ND_NFSV4) {
1588                 tdp = todp;
1589                 tnes = *toexp;
1590                 if (dp != tdp) {
1591                         NFSVOPUNLOCK(dp);
1592                         /* Might lock tdp. */
1593                         tdirfor_ret = nfsvno_getattr(tdp, &tdirfor, nd, p, 0,
1594                             NULL);
1595                 } else {
1596                         tdirfor_ret = nfsvno_getattr(tdp, &tdirfor, nd, p, 1,
1597                             NULL);
1598                         NFSVOPUNLOCK(dp);
1599                 }
1600         } else {
1601                 tfh.nfsrvfh_len = 0;
1602                 error = nfsrv_mtofh(nd, &tfh);
1603                 if (error == 0)
1604                         error = nfsvno_getfh(dp, &fh, p);
1605                 if (error) {
1606                         vput(dp);
1607                         /* todp is always NULL except NFSv4 */
1608                         nfsvno_relpathbuf(&fromnd);
1609                         goto out;
1610                 }
1611
1612                 /* If this is the same file handle, just VREF() the vnode. */
1613                 if (tfh.nfsrvfh_len == NFSX_MYFH &&
1614                     !NFSBCMP(tfh.nfsrvfh_data, &fh, NFSX_MYFH)) {
1615                         VREF(dp);
1616                         tdp = dp;
1617                         tnes = *exp;
1618                         tdirfor_ret = nfsvno_getattr(tdp, &tdirfor, nd, p, 1,
1619                             NULL);
1620                         NFSVOPUNLOCK(dp);
1621                 } else {
1622                         NFSVOPUNLOCK(dp);
1623                         nd->nd_cred->cr_uid = nd->nd_saveduid;
1624                         nfsd_fhtovp(nd, &tfh, LK_EXCLUSIVE, &tdp, &tnes, NULL,
1625                             0); /* Locks tdp. */
1626                         if (tdp) {
1627                                 tdirfor_ret = nfsvno_getattr(tdp, &tdirfor, nd,
1628                                     p, 1, NULL);
1629                                 NFSVOPUNLOCK(tdp);
1630                         }
1631                 }
1632         }
1633         NFSNAMEICNDSET(&tond.ni_cnd, nd->nd_cred, RENAME, LOCKPARENT | LOCKLEAF | NOCACHE | SAVESTART);
1634         nfsvno_setpathbuf(&tond, &tbufp, &hashp);
1635         if (!nd->nd_repstat) {
1636                 error = nfsrv_parsename(nd, tbufp, hashp, &tond.ni_pathlen);
1637                 if (error) {
1638                         if (tdp)
1639                                 vrele(tdp);
1640                         vrele(dp);
1641                         nfsvno_relpathbuf(&fromnd);
1642                         nfsvno_relpathbuf(&tond);
1643                         goto out;
1644                 }
1645         }
1646         if (nd->nd_repstat) {
1647                 if (nd->nd_flag & ND_NFSV3) {
1648                         nfsrv_wcc(nd, fdirfor_ret, &fdirfor, fdiraft_ret,
1649                             &fdiraft);
1650                         nfsrv_wcc(nd, tdirfor_ret, &tdirfor, tdiraft_ret,
1651                             &tdiraft);
1652                 }
1653                 if (tdp)
1654                         vrele(tdp);
1655                 vrele(dp);
1656                 nfsvno_relpathbuf(&fromnd);
1657                 nfsvno_relpathbuf(&tond);
1658                 goto out;
1659         }
1660
1661         /*
1662          * Done parsing, now down to business.
1663          */
1664         nd->nd_repstat = nfsvno_namei(nd, &fromnd, dp, 0, exp, p, &fdirp);
1665         if (nd->nd_repstat) {
1666                 if (nd->nd_flag & ND_NFSV3) {
1667                         nfsrv_wcc(nd, fdirfor_ret, &fdirfor, fdiraft_ret,
1668                             &fdiraft);
1669                         nfsrv_wcc(nd, tdirfor_ret, &tdirfor, tdiraft_ret,
1670                             &tdiraft);
1671                 }
1672                 if (fdirp)
1673                         vrele(fdirp);
1674                 if (tdp)
1675                         vrele(tdp);
1676                 nfsvno_relpathbuf(&tond);
1677                 goto out;
1678         }
1679         if (vnode_vtype(fromnd.ni_vp) == VDIR)
1680                 tond.ni_cnd.cn_flags |= WILLBEDIR;
1681         nd->nd_repstat = nfsvno_namei(nd, &tond, tdp, 0, &tnes, p, &tdirp);
1682         nd->nd_repstat = nfsvno_rename(&fromnd, &tond, nd->nd_repstat,
1683             nd->nd_flag, nd->nd_cred, p);
1684         if (fdirp)
1685                 fdiraft_ret = nfsvno_getattr(fdirp, &fdiraft, nd, p, 0, NULL);
1686         if (tdirp)
1687                 tdiraft_ret = nfsvno_getattr(tdirp, &tdiraft, nd, p, 0, NULL);
1688         if (fdirp)
1689                 vrele(fdirp);
1690         if (tdirp)
1691                 vrele(tdirp);
1692         if (nd->nd_flag & ND_NFSV3) {
1693                 nfsrv_wcc(nd, fdirfor_ret, &fdirfor, fdiraft_ret, &fdiraft);
1694                 nfsrv_wcc(nd, tdirfor_ret, &tdirfor, tdiraft_ret, &tdiraft);
1695         } else if ((nd->nd_flag & ND_NFSV4) && !nd->nd_repstat) {
1696                 NFSM_BUILD(tl, u_int32_t *, 10 * NFSX_UNSIGNED);
1697                 *tl++ = newnfs_false;
1698                 txdr_hyper(fdirfor.na_filerev, tl);
1699                 tl += 2;
1700                 txdr_hyper(fdiraft.na_filerev, tl);
1701                 tl += 2;
1702                 *tl++ = newnfs_false;
1703                 txdr_hyper(tdirfor.na_filerev, tl);
1704                 tl += 2;
1705                 txdr_hyper(tdiraft.na_filerev, tl);
1706         }
1707
1708 out:
1709         NFSEXITCODE2(error, nd);
1710         return (error);
1711 }
1712
1713 /*
1714  * nfs link service
1715  */
1716 int
1717 nfsrvd_link(struct nfsrv_descript *nd, int isdgram,
1718     vnode_t vp, vnode_t tovp, struct nfsexstuff *exp, struct nfsexstuff *toexp)
1719 {
1720         struct nameidata named;
1721         u_int32_t *tl;
1722         int error = 0, dirfor_ret = 1, diraft_ret = 1, getret = 1;
1723         vnode_t dirp = NULL, dp = NULL;
1724         struct nfsvattr dirfor, diraft, at;
1725         struct nfsexstuff tnes;
1726         struct nfsrvfh dfh;
1727         char *bufp;
1728         u_long *hashp;
1729         struct thread *p = curthread;
1730
1731         if (nd->nd_repstat) {
1732                 nfsrv_postopattr(nd, getret, &at);
1733                 nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1734                 goto out;
1735         }
1736         NFSVOPUNLOCK(vp);
1737         if (vnode_vtype(vp) == VDIR) {
1738                 if (nd->nd_flag & ND_NFSV4)
1739                         nd->nd_repstat = NFSERR_ISDIR;
1740                 else
1741                         nd->nd_repstat = NFSERR_INVAL;
1742                 if (tovp)
1743                         vrele(tovp);
1744         }
1745         if (!nd->nd_repstat) {
1746                 if (nd->nd_flag & ND_NFSV4) {
1747                         dp = tovp;
1748                         tnes = *toexp;
1749                 } else {
1750                         error = nfsrv_mtofh(nd, &dfh);
1751                         if (error) {
1752                                 vrele(vp);
1753                                 /* tovp is always NULL unless NFSv4 */
1754                                 goto out;
1755                         }
1756                         nfsd_fhtovp(nd, &dfh, LK_EXCLUSIVE, &dp, &tnes, NULL, 0);
1757                         if (dp)
1758                                 NFSVOPUNLOCK(dp);
1759                 }
1760         }
1761         NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, CREATE,
1762             LOCKPARENT | SAVENAME | NOCACHE);
1763         if (!nd->nd_repstat) {
1764                 nfsvno_setpathbuf(&named, &bufp, &hashp);
1765                 error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
1766                 if (error) {
1767                         vrele(vp);
1768                         if (dp)
1769                                 vrele(dp);
1770                         nfsvno_relpathbuf(&named);
1771                         goto out;
1772                 }
1773                 if (!nd->nd_repstat) {
1774                         nd->nd_repstat = nfsvno_namei(nd, &named, dp, 0, &tnes,
1775                             p, &dirp);
1776                 } else {
1777                         if (dp)
1778                                 vrele(dp);
1779                         nfsvno_relpathbuf(&named);
1780                 }
1781         }
1782         if (dirp) {
1783                 if (nd->nd_flag & ND_NFSV2) {
1784                         vrele(dirp);
1785                         dirp = NULL;
1786                 } else {
1787                         dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0,
1788                             NULL);
1789                 }
1790         }
1791         if (!nd->nd_repstat)
1792                 nd->nd_repstat = nfsvno_link(&named, vp, nd->nd_cred, p, exp);
1793         if (nd->nd_flag & ND_NFSV3)
1794                 getret = nfsvno_getattr(vp, &at, nd, p, 0, NULL);
1795         if (dirp) {
1796                 diraft_ret = nfsvno_getattr(dirp, &diraft, nd, p, 0, NULL);
1797                 vrele(dirp);
1798         }
1799         vrele(vp);
1800         if (nd->nd_flag & ND_NFSV3) {
1801                 nfsrv_postopattr(nd, getret, &at);
1802                 nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1803         } else if ((nd->nd_flag & ND_NFSV4) && !nd->nd_repstat) {
1804                 NFSM_BUILD(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
1805                 *tl++ = newnfs_false;
1806                 txdr_hyper(dirfor.na_filerev, tl);
1807                 tl += 2;
1808                 txdr_hyper(diraft.na_filerev, tl);
1809         }
1810
1811 out:
1812         NFSEXITCODE2(error, nd);
1813         return (error);
1814 }
1815
1816 /*
1817  * nfs symbolic link service
1818  */
1819 int
1820 nfsrvd_symlink(struct nfsrv_descript *nd, __unused int isdgram,
1821     vnode_t dp, vnode_t *vpp, fhandle_t *fhp, struct nfsexstuff *exp)
1822 {
1823         struct nfsvattr nva, dirfor, diraft;
1824         struct nameidata named;
1825         int error = 0, dirfor_ret = 1, diraft_ret = 1, pathlen;
1826         vnode_t dirp = NULL;
1827         char *bufp, *pathcp = NULL;
1828         u_long *hashp;
1829         struct thread *p = curthread;
1830
1831         if (nd->nd_repstat) {
1832                 nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1833                 goto out;
1834         }
1835         if (vpp)
1836                 *vpp = NULL;
1837         NFSVNO_ATTRINIT(&nva);
1838         NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, CREATE,
1839             LOCKPARENT | SAVESTART | NOCACHE);
1840         nfsvno_setpathbuf(&named, &bufp, &hashp);
1841         error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
1842         if (!error && !nd->nd_repstat)
1843                 error = nfsvno_getsymlink(nd, &nva, p, &pathcp, &pathlen);
1844         if (error) {
1845                 vrele(dp);
1846                 nfsvno_relpathbuf(&named);
1847                 goto out;
1848         }
1849         if (!nd->nd_repstat) {
1850                 nd->nd_repstat = nfsvno_namei(nd, &named, dp, 0, exp, p, &dirp);
1851         } else {
1852                 vrele(dp);
1853                 nfsvno_relpathbuf(&named);
1854         }
1855         if (dirp != NULL && !(nd->nd_flag & ND_NFSV3)) {
1856                 vrele(dirp);
1857                 dirp = NULL;
1858         }
1859
1860         /*
1861          * And call nfsrvd_symlinksub() to do the common code. It will
1862          * return EBADRPC upon a parsing error, 0 otherwise.
1863          */
1864         if (!nd->nd_repstat) {
1865                 if (dirp != NULL)
1866                         dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0,
1867                             NULL);
1868                 nfsrvd_symlinksub(nd, &named, &nva, fhp, vpp, dirp,
1869                     &dirfor, &diraft, &diraft_ret, NULL, NULL, p, exp,
1870                     pathcp, pathlen);
1871         } else if (dirp != NULL) {
1872                 dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0, NULL);
1873                 vrele(dirp);
1874         }
1875         if (pathcp)
1876                 free(pathcp, M_TEMP);
1877
1878         if (nd->nd_flag & ND_NFSV3) {
1879                 if (!nd->nd_repstat) {
1880                         (void) nfsm_fhtom(nd, (u_int8_t *)fhp, 0, 1);
1881                         nfsrv_postopattr(nd, 0, &nva);
1882                 }
1883                 nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1884         }
1885
1886 out:
1887         NFSEXITCODE2(error, nd);
1888         return (error);
1889 }
1890
1891 /*
1892  * Common code for creating a symbolic link.
1893  */
1894 static void
1895 nfsrvd_symlinksub(struct nfsrv_descript *nd, struct nameidata *ndp,
1896     struct nfsvattr *nvap, fhandle_t *fhp, vnode_t *vpp,
1897     vnode_t dirp, struct nfsvattr *dirforp, struct nfsvattr *diraftp,
1898     int *diraft_retp, nfsattrbit_t *attrbitp,
1899     NFSACL_T *aclp, NFSPROC_T *p, struct nfsexstuff *exp, char *pathcp,
1900     int pathlen)
1901 {
1902         u_int32_t *tl;
1903
1904         nd->nd_repstat = nfsvno_symlink(ndp, nvap, pathcp, pathlen,
1905             !(nd->nd_flag & ND_NFSV2), nd->nd_saveduid, nd->nd_cred, p, exp);
1906         if (!nd->nd_repstat && !(nd->nd_flag & ND_NFSV2)) {
1907                 nfsrv_fixattr(nd, ndp->ni_vp, nvap, aclp, p, attrbitp, exp);
1908                 if (nd->nd_flag & ND_NFSV3) {
1909                         nd->nd_repstat = nfsvno_getfh(ndp->ni_vp, fhp, p);
1910                         if (!nd->nd_repstat)
1911                                 nd->nd_repstat = nfsvno_getattr(ndp->ni_vp,
1912                                     nvap, nd, p, 1, NULL);
1913                 }
1914                 if (vpp != NULL && nd->nd_repstat == 0) {
1915                         NFSVOPUNLOCK(ndp->ni_vp);
1916                         *vpp = ndp->ni_vp;
1917                 } else
1918                         vput(ndp->ni_vp);
1919         }
1920         if (dirp) {
1921                 *diraft_retp = nfsvno_getattr(dirp, diraftp, nd, p, 0, NULL);
1922                 vrele(dirp);
1923         }
1924         if ((nd->nd_flag & ND_NFSV4) && !nd->nd_repstat) {
1925                 NFSM_BUILD(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
1926                 *tl++ = newnfs_false;
1927                 txdr_hyper(dirforp->na_filerev, tl);
1928                 tl += 2;
1929                 txdr_hyper(diraftp->na_filerev, tl);
1930                 (void) nfsrv_putattrbit(nd, attrbitp);
1931         }
1932
1933         NFSEXITCODE2(0, nd);
1934 }
1935
1936 /*
1937  * nfs mkdir service
1938  */
1939 int
1940 nfsrvd_mkdir(struct nfsrv_descript *nd, __unused int isdgram,
1941     vnode_t dp, vnode_t *vpp, fhandle_t *fhp, struct nfsexstuff *exp)
1942 {
1943         struct nfsvattr nva, dirfor, diraft;
1944         struct nameidata named;
1945         u_int32_t *tl;
1946         int error = 0, dirfor_ret = 1, diraft_ret = 1;
1947         vnode_t dirp = NULL;
1948         char *bufp;
1949         u_long *hashp;
1950         struct thread *p = curthread;
1951
1952         if (nd->nd_repstat) {
1953                 nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1954                 goto out;
1955         }
1956         NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, CREATE,
1957             LOCKPARENT | SAVENAME | NOCACHE);
1958         nfsvno_setpathbuf(&named, &bufp, &hashp);
1959         error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
1960         if (error)
1961                 goto nfsmout;
1962         if (!nd->nd_repstat) {
1963                 NFSVNO_ATTRINIT(&nva);
1964                 if (nd->nd_flag & ND_NFSV3) {
1965                         error = nfsrv_sattr(nd, NULL, &nva, NULL, NULL, p);
1966                         if (error)
1967                                 goto nfsmout;
1968                 } else {
1969                         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1970                         nva.na_mode = nfstov_mode(*tl++);
1971                 }
1972         }
1973         if (!nd->nd_repstat) {
1974                 nd->nd_repstat = nfsvno_namei(nd, &named, dp, 0, exp, p, &dirp);
1975         } else {
1976                 vrele(dp);
1977                 nfsvno_relpathbuf(&named);
1978         }
1979         if (dirp != NULL && !(nd->nd_flag & ND_NFSV3)) {
1980                 vrele(dirp);
1981                 dirp = NULL;
1982         }
1983         if (nd->nd_repstat) {
1984                 if (dirp != NULL) {
1985                         dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0,
1986                             NULL);
1987                         vrele(dirp);
1988                 }
1989                 if (nd->nd_flag & ND_NFSV3)
1990                         nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret,
1991                             &diraft);
1992                 goto out;
1993         }
1994         if (dirp != NULL)
1995                 dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0, NULL);
1996
1997         /*
1998          * Call nfsrvd_mkdirsub() for the code common to V4 as well.
1999          */
2000         nfsrvd_mkdirsub(nd, &named, &nva, fhp, vpp, dirp, &dirfor, &diraft,
2001             &diraft_ret, NULL, NULL, p, exp);
2002
2003         if (nd->nd_flag & ND_NFSV3) {
2004                 if (!nd->nd_repstat) {
2005                         (void) nfsm_fhtom(nd, (u_int8_t *)fhp, 0, 1);
2006                         nfsrv_postopattr(nd, 0, &nva);
2007                 }
2008                 nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
2009         } else if (!nd->nd_repstat) {
2010                 (void) nfsm_fhtom(nd, (u_int8_t *)fhp, 0, 0);
2011                 nfsrv_fillattr(nd, &nva);
2012         }
2013
2014 out:
2015         NFSEXITCODE2(0, nd);
2016         return (0);
2017 nfsmout:
2018         vrele(dp);
2019         nfsvno_relpathbuf(&named);
2020         NFSEXITCODE2(error, nd);
2021         return (error);
2022 }
2023
2024 /*
2025  * Code common to mkdir for V2,3 and 4.
2026  */
2027 static void
2028 nfsrvd_mkdirsub(struct nfsrv_descript *nd, struct nameidata *ndp,
2029     struct nfsvattr *nvap, fhandle_t *fhp, vnode_t *vpp,
2030     vnode_t dirp, struct nfsvattr *dirforp, struct nfsvattr *diraftp,
2031     int *diraft_retp, nfsattrbit_t *attrbitp, NFSACL_T *aclp,
2032     NFSPROC_T *p, struct nfsexstuff *exp)
2033 {
2034         vnode_t vp;
2035         u_int32_t *tl;
2036
2037         NFSVNO_SETATTRVAL(nvap, type, VDIR);
2038         nd->nd_repstat = nfsvno_mkdir(ndp, nvap, nd->nd_saveduid,
2039             nd->nd_cred, p, exp);
2040         if (!nd->nd_repstat) {
2041                 vp = ndp->ni_vp;
2042                 nfsrv_fixattr(nd, vp, nvap, aclp, p, attrbitp, exp);
2043                 nd->nd_repstat = nfsvno_getfh(vp, fhp, p);
2044                 if (!(nd->nd_flag & ND_NFSV4) && !nd->nd_repstat)
2045                         nd->nd_repstat = nfsvno_getattr(vp, nvap, nd, p, 1,
2046                             NULL);
2047                 if (vpp && !nd->nd_repstat) {
2048                         NFSVOPUNLOCK(vp);
2049                         *vpp = vp;
2050                 } else {
2051                         vput(vp);
2052                 }
2053         }
2054         if (dirp) {
2055                 *diraft_retp = nfsvno_getattr(dirp, diraftp, nd, p, 0, NULL);
2056                 vrele(dirp);
2057         }
2058         if ((nd->nd_flag & ND_NFSV4) && !nd->nd_repstat) {
2059                 NFSM_BUILD(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
2060                 *tl++ = newnfs_false;
2061                 txdr_hyper(dirforp->na_filerev, tl);
2062                 tl += 2;
2063                 txdr_hyper(diraftp->na_filerev, tl);
2064                 (void) nfsrv_putattrbit(nd, attrbitp);
2065         }
2066
2067         NFSEXITCODE2(0, nd);
2068 }
2069
2070 /*
2071  * nfs commit service
2072  */
2073 int
2074 nfsrvd_commit(struct nfsrv_descript *nd, __unused int isdgram,
2075     vnode_t vp, __unused struct nfsexstuff *exp)
2076 {
2077         struct nfsvattr bfor, aft;
2078         u_int32_t *tl;
2079         int error = 0, for_ret = 1, aft_ret = 1, cnt;
2080         u_int64_t off;
2081         struct thread *p = curthread;
2082
2083        if (nd->nd_repstat) {
2084                 nfsrv_wcc(nd, for_ret, &bfor, aft_ret, &aft);
2085                 goto out;
2086         }
2087
2088         /* Return NFSERR_ISDIR in NFSv4 when commit on a directory. */
2089         if (vp->v_type != VREG) {
2090                 if (nd->nd_flag & ND_NFSV3)
2091                         error = NFSERR_NOTSUPP;
2092                 else
2093                         error = (vp->v_type == VDIR) ? NFSERR_ISDIR : NFSERR_INVAL;
2094                 goto nfsmout;
2095         }
2096         NFSM_DISSECT(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
2097
2098         /*
2099          * XXX At this time VOP_FSYNC() does not accept offset and byte
2100          * count parameters, so these arguments are useless (someday maybe).
2101          */
2102         off = fxdr_hyper(tl);
2103         tl += 2;
2104         cnt = fxdr_unsigned(int, *tl);
2105         if (nd->nd_flag & ND_NFSV3)
2106                 for_ret = nfsvno_getattr(vp, &bfor, nd, p, 1, NULL);
2107         nd->nd_repstat = nfsvno_fsync(vp, off, cnt, nd->nd_cred, p);
2108         if (nd->nd_flag & ND_NFSV3) {
2109                 aft_ret = nfsvno_getattr(vp, &aft, nd, p, 1, NULL);
2110                 nfsrv_wcc(nd, for_ret, &bfor, aft_ret, &aft);
2111         }
2112         vput(vp);
2113         if (!nd->nd_repstat) {
2114                 NFSM_BUILD(tl, u_int32_t *, NFSX_VERF);
2115                 *tl++ = txdr_unsigned(nfsboottime.tv_sec);
2116                 *tl = txdr_unsigned(nfsboottime.tv_usec);
2117         }
2118
2119 out:
2120         NFSEXITCODE2(0, nd);
2121         return (0);
2122 nfsmout:
2123         vput(vp);
2124         NFSEXITCODE2(error, nd);
2125         return (error);
2126 }
2127
2128 /*
2129  * nfs statfs service
2130  */
2131 int
2132 nfsrvd_statfs(struct nfsrv_descript *nd, __unused int isdgram,
2133     vnode_t vp, __unused struct nfsexstuff *exp)
2134 {
2135         struct statfs *sf;
2136         u_int32_t *tl;
2137         int getret = 1;
2138         struct nfsvattr at;
2139         u_quad_t tval;
2140         struct thread *p = curthread;
2141
2142         sf = NULL;
2143         if (nd->nd_repstat) {
2144                 nfsrv_postopattr(nd, getret, &at);
2145                 goto out;
2146         }
2147         sf = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
2148         nd->nd_repstat = nfsvno_statfs(vp, sf);
2149         getret = nfsvno_getattr(vp, &at, nd, p, 1, NULL);
2150         vput(vp);
2151         if (nd->nd_flag & ND_NFSV3)
2152                 nfsrv_postopattr(nd, getret, &at);
2153         if (nd->nd_repstat)
2154                 goto out;
2155         if (nd->nd_flag & ND_NFSV2) {
2156                 NFSM_BUILD(tl, u_int32_t *, NFSX_V2STATFS);
2157                 *tl++ = txdr_unsigned(NFS_V2MAXDATA);
2158                 *tl++ = txdr_unsigned(sf->f_bsize);
2159                 *tl++ = txdr_unsigned(sf->f_blocks);
2160                 *tl++ = txdr_unsigned(sf->f_bfree);
2161                 *tl = txdr_unsigned(sf->f_bavail);
2162         } else {
2163                 NFSM_BUILD(tl, u_int32_t *, NFSX_V3STATFS);
2164                 tval = (u_quad_t)sf->f_blocks;
2165                 tval *= (u_quad_t)sf->f_bsize;
2166                 txdr_hyper(tval, tl); tl += 2;
2167                 tval = (u_quad_t)sf->f_bfree;
2168                 tval *= (u_quad_t)sf->f_bsize;
2169                 txdr_hyper(tval, tl); tl += 2;
2170                 tval = (u_quad_t)sf->f_bavail;
2171                 tval *= (u_quad_t)sf->f_bsize;
2172                 txdr_hyper(tval, tl); tl += 2;
2173                 tval = (u_quad_t)sf->f_files;
2174                 txdr_hyper(tval, tl); tl += 2;
2175                 tval = (u_quad_t)sf->f_ffree;
2176                 txdr_hyper(tval, tl); tl += 2;
2177                 tval = (u_quad_t)sf->f_ffree;
2178                 txdr_hyper(tval, tl); tl += 2;
2179                 *tl = 0;
2180         }
2181
2182 out:
2183         free(sf, M_STATFS);
2184         NFSEXITCODE2(0, nd);
2185         return (0);
2186 }
2187
2188 /*
2189  * nfs fsinfo service
2190  */
2191 int
2192 nfsrvd_fsinfo(struct nfsrv_descript *nd, int isdgram,
2193     vnode_t vp, __unused struct nfsexstuff *exp)
2194 {
2195         u_int32_t *tl;
2196         struct nfsfsinfo fs;
2197         int getret = 1;
2198         struct nfsvattr at;
2199         struct thread *p = curthread;
2200
2201         if (nd->nd_repstat) {
2202                 nfsrv_postopattr(nd, getret, &at);
2203                 goto out;
2204         }
2205         getret = nfsvno_getattr(vp, &at, nd, p, 1, NULL);
2206         nfsvno_getfs(&fs, isdgram);
2207         vput(vp);
2208         nfsrv_postopattr(nd, getret, &at);
2209         NFSM_BUILD(tl, u_int32_t *, NFSX_V3FSINFO);
2210         *tl++ = txdr_unsigned(fs.fs_rtmax);
2211         *tl++ = txdr_unsigned(fs.fs_rtpref);
2212         *tl++ = txdr_unsigned(fs.fs_rtmult);
2213         *tl++ = txdr_unsigned(fs.fs_wtmax);
2214         *tl++ = txdr_unsigned(fs.fs_wtpref);
2215         *tl++ = txdr_unsigned(fs.fs_wtmult);
2216         *tl++ = txdr_unsigned(fs.fs_dtpref);
2217         txdr_hyper(fs.fs_maxfilesize, tl);
2218         tl += 2;
2219         txdr_nfsv3time(&fs.fs_timedelta, tl);
2220         tl += 2;
2221         *tl = txdr_unsigned(fs.fs_properties);
2222
2223 out:
2224         NFSEXITCODE2(0, nd);
2225         return (0);
2226 }
2227
2228 /*
2229  * nfs pathconf service
2230  */
2231 int
2232 nfsrvd_pathconf(struct nfsrv_descript *nd, __unused int isdgram,
2233     vnode_t vp, __unused struct nfsexstuff *exp)
2234 {
2235         struct nfsv3_pathconf *pc;
2236         int getret = 1;
2237         long linkmax, namemax, chownres, notrunc;
2238         struct nfsvattr at;
2239         struct thread *p = curthread;
2240
2241         if (nd->nd_repstat) {
2242                 nfsrv_postopattr(nd, getret, &at);
2243                 goto out;
2244         }
2245         nd->nd_repstat = nfsvno_pathconf(vp, _PC_LINK_MAX, &linkmax,
2246             nd->nd_cred, p);
2247         if (!nd->nd_repstat)
2248                 nd->nd_repstat = nfsvno_pathconf(vp, _PC_NAME_MAX, &namemax,
2249                     nd->nd_cred, p);
2250         if (!nd->nd_repstat)
2251                 nd->nd_repstat=nfsvno_pathconf(vp, _PC_CHOWN_RESTRICTED,
2252                     &chownres, nd->nd_cred, p);
2253         if (!nd->nd_repstat)
2254                 nd->nd_repstat = nfsvno_pathconf(vp, _PC_NO_TRUNC, &notrunc,
2255                     nd->nd_cred, p);
2256         getret = nfsvno_getattr(vp, &at, nd, p, 1, NULL);
2257         vput(vp);
2258         nfsrv_postopattr(nd, getret, &at);
2259         if (!nd->nd_repstat) {
2260                 NFSM_BUILD(pc, struct nfsv3_pathconf *, NFSX_V3PATHCONF);
2261                 pc->pc_linkmax = txdr_unsigned(linkmax);
2262                 pc->pc_namemax = txdr_unsigned(namemax);
2263                 pc->pc_notrunc = txdr_unsigned(notrunc);
2264                 pc->pc_chownrestricted = txdr_unsigned(chownres);
2265
2266                 /*
2267                  * These should probably be supported by VOP_PATHCONF(), but
2268                  * until msdosfs is exportable (why would you want to?), the
2269                  * Unix defaults should be ok.
2270                  */
2271                 pc->pc_caseinsensitive = newnfs_false;
2272                 pc->pc_casepreserving = newnfs_true;
2273         }
2274
2275 out:
2276         NFSEXITCODE2(0, nd);
2277         return (0);
2278 }
2279
2280 /*
2281  * nfsv4 lock service
2282  */
2283 int
2284 nfsrvd_lock(struct nfsrv_descript *nd, __unused int isdgram,
2285     vnode_t vp, struct nfsexstuff *exp)
2286 {
2287         u_int32_t *tl;
2288         int i;
2289         struct nfsstate *stp = NULL;
2290         struct nfslock *lop;
2291         struct nfslockconflict cf;
2292         int error = 0;
2293         u_short flags = NFSLCK_LOCK, lflags;
2294         u_int64_t offset, len;
2295         nfsv4stateid_t stateid;
2296         nfsquad_t clientid;
2297         struct thread *p = curthread;
2298
2299         NFSM_DISSECT(tl, u_int32_t *, 7 * NFSX_UNSIGNED);
2300         i = fxdr_unsigned(int, *tl++);
2301         switch (i) {
2302         case NFSV4LOCKT_READW:
2303                 flags |= NFSLCK_BLOCKING;
2304         case NFSV4LOCKT_READ:
2305                 lflags = NFSLCK_READ;
2306                 break;
2307         case NFSV4LOCKT_WRITEW:
2308                 flags |= NFSLCK_BLOCKING;
2309         case NFSV4LOCKT_WRITE:
2310                 lflags = NFSLCK_WRITE;
2311                 break;
2312         default:
2313                 nd->nd_repstat = NFSERR_BADXDR;
2314                 goto nfsmout;
2315         }
2316         if (*tl++ == newnfs_true)
2317                 flags |= NFSLCK_RECLAIM;
2318         offset = fxdr_hyper(tl);
2319         tl += 2;
2320         len = fxdr_hyper(tl);
2321         tl += 2;
2322         if (*tl == newnfs_true)
2323                 flags |= NFSLCK_OPENTOLOCK;
2324         if (flags & NFSLCK_OPENTOLOCK) {
2325                 NFSM_DISSECT(tl, u_int32_t *, 5 * NFSX_UNSIGNED + NFSX_STATEID);
2326                 i = fxdr_unsigned(int, *(tl+4+(NFSX_STATEID / NFSX_UNSIGNED)));
2327                 if (i <= 0 || i > NFSV4_OPAQUELIMIT) {
2328                         nd->nd_repstat = NFSERR_BADXDR;
2329                         goto nfsmout;
2330                 }
2331                 stp = malloc(sizeof (struct nfsstate) + i,
2332                         M_NFSDSTATE, M_WAITOK);
2333                 stp->ls_ownerlen = i;
2334                 stp->ls_op = nd->nd_rp;
2335                 stp->ls_seq = fxdr_unsigned(int, *tl++);
2336                 stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
2337                 NFSBCOPY((caddr_t)tl, (caddr_t)stp->ls_stateid.other,
2338                         NFSX_STATEIDOTHER);
2339                 tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
2340
2341                 /*
2342                  * For the special stateid of other all 0s and seqid == 1, set
2343                  * the stateid to the current stateid, if it is set.
2344                  */
2345                 if ((nd->nd_flag & ND_NFSV41) != 0 &&
2346                     stp->ls_stateid.seqid == 1 &&
2347                     stp->ls_stateid.other[0] == 0 &&
2348                     stp->ls_stateid.other[1] == 0 &&
2349                     stp->ls_stateid.other[2] == 0) {
2350                         if ((nd->nd_flag & ND_CURSTATEID) != 0) {
2351                                 stp->ls_stateid = nd->nd_curstateid;
2352                                 stp->ls_stateid.seqid = 0;
2353                         } else {
2354                                 nd->nd_repstat = NFSERR_BADSTATEID;
2355                                 goto nfsmout;
2356                         }
2357                 }
2358
2359                 stp->ls_opentolockseq = fxdr_unsigned(int, *tl++);
2360                 clientid.lval[0] = *tl++;
2361                 clientid.lval[1] = *tl++;
2362                 if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
2363                         if ((nd->nd_flag & ND_NFSV41) != 0)
2364                                 clientid.qval = nd->nd_clientid.qval;
2365                         else if (nd->nd_clientid.qval != clientid.qval)
2366                                 printf("EEK3 multiple clids\n");
2367                 } else {
2368                         if ((nd->nd_flag & ND_NFSV41) != 0)
2369                                 printf("EEK! no clientid from session\n");
2370                         nd->nd_flag |= ND_IMPLIEDCLID;
2371                         nd->nd_clientid.qval = clientid.qval;
2372                 }
2373                 error = nfsrv_mtostr(nd, stp->ls_owner, stp->ls_ownerlen);
2374                 if (error)
2375                         goto nfsmout;
2376         } else {
2377                 NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID + NFSX_UNSIGNED);
2378                 stp = malloc(sizeof (struct nfsstate),
2379                         M_NFSDSTATE, M_WAITOK);
2380                 stp->ls_ownerlen = 0;
2381                 stp->ls_op = nd->nd_rp;
2382                 stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
2383                 NFSBCOPY((caddr_t)tl, (caddr_t)stp->ls_stateid.other,
2384                         NFSX_STATEIDOTHER);
2385                 tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
2386
2387                 /*
2388                  * For the special stateid of other all 0s and seqid == 1, set
2389                  * the stateid to the current stateid, if it is set.
2390                  */
2391                 if ((nd->nd_flag & ND_NFSV41) != 0 &&
2392                     stp->ls_stateid.seqid == 1 &&
2393                     stp->ls_stateid.other[0] == 0 &&
2394                     stp->ls_stateid.other[1] == 0 &&
2395                     stp->ls_stateid.other[2] == 0) {
2396                         if ((nd->nd_flag & ND_CURSTATEID) != 0) {
2397                                 stp->ls_stateid = nd->nd_curstateid;
2398                                 stp->ls_stateid.seqid = 0;
2399                         } else {
2400                                 nd->nd_repstat = NFSERR_BADSTATEID;
2401                                 goto nfsmout;
2402                         }
2403                 }
2404
2405                 stp->ls_seq = fxdr_unsigned(int, *tl);
2406                 clientid.lval[0] = stp->ls_stateid.other[0];
2407                 clientid.lval[1] = stp->ls_stateid.other[1];
2408                 if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
2409                         if ((nd->nd_flag & ND_NFSV41) != 0)
2410                                 clientid.qval = nd->nd_clientid.qval;
2411                         else if (nd->nd_clientid.qval != clientid.qval)
2412                                 printf("EEK4 multiple clids\n");
2413                 } else {
2414                         if ((nd->nd_flag & ND_NFSV41) != 0)
2415                                 printf("EEK! no clientid from session\n");
2416                         nd->nd_flag |= ND_IMPLIEDCLID;
2417                         nd->nd_clientid.qval = clientid.qval;
2418                 }
2419         }
2420         lop = malloc(sizeof (struct nfslock),
2421                 M_NFSDLOCK, M_WAITOK);
2422         lop->lo_first = offset;
2423         if (len == NFS64BITSSET) {
2424                 lop->lo_end = NFS64BITSSET;
2425         } else {
2426                 lop->lo_end = offset + len;
2427                 if (lop->lo_end <= lop->lo_first)
2428                         nd->nd_repstat = NFSERR_INVAL;
2429         }
2430         lop->lo_flags = lflags;
2431         stp->ls_flags = flags;
2432         stp->ls_uid = nd->nd_cred->cr_uid;
2433
2434         /*
2435          * Do basic access checking.
2436          */
2437         if (!nd->nd_repstat && vnode_vtype(vp) != VREG) {
2438             if (vnode_vtype(vp) == VDIR)
2439                 nd->nd_repstat = NFSERR_ISDIR;
2440             else
2441                 nd->nd_repstat = NFSERR_INVAL;
2442         }
2443         if (!nd->nd_repstat) {
2444             if (lflags & NFSLCK_WRITE) {
2445                 nd->nd_repstat = nfsvno_accchk(vp, VWRITE,
2446                     nd->nd_cred, exp, p, NFSACCCHK_ALLOWOWNER,
2447                     NFSACCCHK_VPISLOCKED, NULL);
2448             } else {
2449                 nd->nd_repstat = nfsvno_accchk(vp, VREAD,
2450                     nd->nd_cred, exp, p, NFSACCCHK_ALLOWOWNER,
2451                     NFSACCCHK_VPISLOCKED, NULL);
2452                 if (nd->nd_repstat)
2453                     nd->nd_repstat = nfsvno_accchk(vp, VEXEC,
2454                         nd->nd_cred, exp, p, NFSACCCHK_ALLOWOWNER,
2455                         NFSACCCHK_VPISLOCKED, NULL);
2456             }
2457         }
2458
2459         /*
2460          * We call nfsrv_lockctrl() even if nd_repstat set, so that the
2461          * seqid# gets updated. nfsrv_lockctrl() will return the value
2462          * of nd_repstat, if it gets that far.
2463          */
2464         nd->nd_repstat = nfsrv_lockctrl(vp, &stp, &lop, &cf, clientid,
2465                 &stateid, exp, nd, p);
2466         if (lop)
2467                 free(lop, M_NFSDLOCK);
2468         if (stp)
2469                 free(stp, M_NFSDSTATE);
2470         if (!nd->nd_repstat) {
2471                 /* For NFSv4.1, set the Current StateID. */
2472                 if ((nd->nd_flag & ND_NFSV41) != 0) {
2473                         nd->nd_curstateid = stateid;
2474                         nd->nd_flag |= ND_CURSTATEID;
2475                 }
2476                 NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
2477                 *tl++ = txdr_unsigned(stateid.seqid);
2478                 NFSBCOPY((caddr_t)stateid.other,(caddr_t)tl,NFSX_STATEIDOTHER);
2479         } else if (nd->nd_repstat == NFSERR_DENIED) {
2480                 NFSM_BUILD(tl, u_int32_t *, 7 * NFSX_UNSIGNED);
2481                 txdr_hyper(cf.cl_first, tl);
2482                 tl += 2;
2483                 if (cf.cl_end == NFS64BITSSET)
2484                         len = NFS64BITSSET;
2485                 else
2486                         len = cf.cl_end - cf.cl_first;
2487                 txdr_hyper(len, tl);
2488                 tl += 2;
2489                 if (cf.cl_flags == NFSLCK_WRITE)
2490                         *tl++ = txdr_unsigned(NFSV4LOCKT_WRITE);
2491                 else
2492                         *tl++ = txdr_unsigned(NFSV4LOCKT_READ);
2493                 *tl++ = stateid.other[0];
2494                 *tl = stateid.other[1];
2495                 (void) nfsm_strtom(nd, cf.cl_owner, cf.cl_ownerlen);
2496         }
2497         vput(vp);
2498         NFSEXITCODE2(0, nd);
2499         return (0);
2500 nfsmout:
2501         vput(vp);
2502         if (stp)
2503                 free(stp, M_NFSDSTATE);
2504         NFSEXITCODE2(error, nd);
2505         return (error);
2506 }
2507
2508 /*
2509  * nfsv4 lock test service
2510  */
2511 int
2512 nfsrvd_lockt(struct nfsrv_descript *nd, __unused int isdgram,
2513     vnode_t vp, struct nfsexstuff *exp)
2514 {
2515         u_int32_t *tl;
2516         int i;
2517         struct nfsstate *stp = NULL;
2518         struct nfslock lo, *lop = &lo;
2519         struct nfslockconflict cf;
2520         int error = 0;
2521         nfsv4stateid_t stateid;
2522         nfsquad_t clientid;
2523         u_int64_t len;
2524         struct thread *p = curthread;
2525
2526         NFSM_DISSECT(tl, u_int32_t *, 8 * NFSX_UNSIGNED);
2527         i = fxdr_unsigned(int, *(tl + 7));
2528         if (i <= 0 || i > NFSV4_OPAQUELIMIT) {
2529                 nd->nd_repstat = NFSERR_BADXDR;
2530                 goto nfsmout;
2531         }
2532         stp = malloc(sizeof (struct nfsstate) + i,
2533             M_NFSDSTATE, M_WAITOK);
2534         stp->ls_ownerlen = i;
2535         stp->ls_op = NULL;
2536         stp->ls_flags = NFSLCK_TEST;
2537         stp->ls_uid = nd->nd_cred->cr_uid;
2538         i = fxdr_unsigned(int, *tl++);
2539         switch (i) {
2540         case NFSV4LOCKT_READW:
2541                 stp->ls_flags |= NFSLCK_BLOCKING;
2542         case NFSV4LOCKT_READ:
2543                 lo.lo_flags = NFSLCK_READ;
2544                 break;
2545         case NFSV4LOCKT_WRITEW:
2546                 stp->ls_flags |= NFSLCK_BLOCKING;
2547         case NFSV4LOCKT_WRITE:
2548                 lo.lo_flags = NFSLCK_WRITE;
2549                 break;
2550         default:
2551                 nd->nd_repstat = NFSERR_BADXDR;
2552                 goto nfsmout;
2553         }
2554         lo.lo_first = fxdr_hyper(tl);
2555         tl += 2;
2556         len = fxdr_hyper(tl);
2557         if (len == NFS64BITSSET) {
2558                 lo.lo_end = NFS64BITSSET;
2559         } else {
2560                 lo.lo_end = lo.lo_first + len;
2561                 if (lo.lo_end <= lo.lo_first)
2562                         nd->nd_repstat = NFSERR_INVAL;
2563         }
2564         tl += 2;
2565         clientid.lval[0] = *tl++;
2566         clientid.lval[1] = *tl;
2567         if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
2568                 if ((nd->nd_flag & ND_NFSV41) != 0)
2569                         clientid.qval = nd->nd_clientid.qval;
2570                 else if (nd->nd_clientid.qval != clientid.qval)
2571                         printf("EEK5 multiple clids\n");
2572         } else {
2573                 if ((nd->nd_flag & ND_NFSV41) != 0)
2574                         printf("EEK! no clientid from session\n");
2575                 nd->nd_flag |= ND_IMPLIEDCLID;
2576                 nd->nd_clientid.qval = clientid.qval;
2577         }
2578         error = nfsrv_mtostr(nd, stp->ls_owner, stp->ls_ownerlen);
2579         if (error)
2580                 goto nfsmout;
2581         if (!nd->nd_repstat && vnode_vtype(vp) != VREG) {
2582             if (vnode_vtype(vp) == VDIR)
2583                 nd->nd_repstat = NFSERR_ISDIR;
2584             else
2585                 nd->nd_repstat = NFSERR_INVAL;
2586         }
2587         if (!nd->nd_repstat)
2588           nd->nd_repstat = nfsrv_lockctrl(vp, &stp, &lop, &cf, clientid,
2589             &stateid, exp, nd, p);
2590         if (nd->nd_repstat) {
2591             if (nd->nd_repstat == NFSERR_DENIED) {
2592                 NFSM_BUILD(tl, u_int32_t *, 7 * NFSX_UNSIGNED);
2593                 txdr_hyper(cf.cl_first, tl);
2594                 tl += 2;
2595                 if (cf.cl_end == NFS64BITSSET)
2596                         len = NFS64BITSSET;
2597                 else
2598                         len = cf.cl_end - cf.cl_first;
2599                 txdr_hyper(len, tl);
2600                 tl += 2;
2601                 if (cf.cl_flags == NFSLCK_WRITE)
2602                         *tl++ = txdr_unsigned(NFSV4LOCKT_WRITE);
2603                 else
2604                         *tl++ = txdr_unsigned(NFSV4LOCKT_READ);
2605                 *tl++ = stp->ls_stateid.other[0];
2606                 *tl = stp->ls_stateid.other[1];
2607                 (void) nfsm_strtom(nd, cf.cl_owner, cf.cl_ownerlen);
2608             }
2609         }
2610         vput(vp);
2611         if (stp)
2612                 free(stp, M_NFSDSTATE);
2613         NFSEXITCODE2(0, nd);
2614         return (0);
2615 nfsmout:
2616         vput(vp);
2617         if (stp)
2618                 free(stp, M_NFSDSTATE);
2619         NFSEXITCODE2(error, nd);
2620         return (error);
2621 }
2622
2623 /*
2624  * nfsv4 unlock service
2625  */
2626 int
2627 nfsrvd_locku(struct nfsrv_descript *nd, __unused int isdgram,
2628     vnode_t vp, struct nfsexstuff *exp)
2629 {
2630         u_int32_t *tl;
2631         int i;
2632         struct nfsstate *stp;
2633         struct nfslock *lop;
2634         int error = 0;
2635         nfsv4stateid_t stateid;
2636         nfsquad_t clientid;
2637         u_int64_t len;
2638         struct thread *p = curthread;
2639
2640         NFSM_DISSECT(tl, u_int32_t *, 6 * NFSX_UNSIGNED + NFSX_STATEID);
2641         stp = malloc(sizeof (struct nfsstate),
2642             M_NFSDSTATE, M_WAITOK);
2643         lop = malloc(sizeof (struct nfslock),
2644             M_NFSDLOCK, M_WAITOK);
2645         stp->ls_flags = NFSLCK_UNLOCK;
2646         lop->lo_flags = NFSLCK_UNLOCK;
2647         stp->ls_op = nd->nd_rp;
2648         i = fxdr_unsigned(int, *tl++);
2649         switch (i) {
2650         case NFSV4LOCKT_READW:
2651                 stp->ls_flags |= NFSLCK_BLOCKING;
2652         case NFSV4LOCKT_READ:
2653                 break;
2654         case NFSV4LOCKT_WRITEW:
2655                 stp->ls_flags |= NFSLCK_BLOCKING;
2656         case NFSV4LOCKT_WRITE:
2657                 break;
2658         default:
2659                 nd->nd_repstat = NFSERR_BADXDR;
2660                 free(stp, M_NFSDSTATE);
2661                 free(lop, M_NFSDLOCK);
2662                 goto nfsmout;
2663         }
2664         stp->ls_ownerlen = 0;
2665         stp->ls_uid = nd->nd_cred->cr_uid;
2666         stp->ls_seq = fxdr_unsigned(int, *tl++);
2667         stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
2668         NFSBCOPY((caddr_t)tl, (caddr_t)stp->ls_stateid.other,
2669             NFSX_STATEIDOTHER);
2670         tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
2671
2672         /*
2673          * For the special stateid of other all 0s and seqid == 1, set the
2674          * stateid to the current stateid, if it is set.
2675          */
2676         if ((nd->nd_flag & ND_NFSV41) != 0 && stp->ls_stateid.seqid == 1 &&
2677             stp->ls_stateid.other[0] == 0 && stp->ls_stateid.other[1] == 0 &&
2678             stp->ls_stateid.other[2] == 0) {
2679                 if ((nd->nd_flag & ND_CURSTATEID) != 0) {
2680                         stp->ls_stateid = nd->nd_curstateid;
2681                         stp->ls_stateid.seqid = 0;
2682                 } else {
2683                         nd->nd_repstat = NFSERR_BADSTATEID;
2684                         goto nfsmout;
2685                 }
2686         }
2687
2688         lop->lo_first = fxdr_hyper(tl);
2689         tl += 2;
2690         len = fxdr_hyper(tl);
2691         if (len == NFS64BITSSET) {
2692                 lop->lo_end = NFS64BITSSET;
2693         } else {
2694                 lop->lo_end = lop->lo_first + len;
2695                 if (lop->lo_end <= lop->lo_first)
2696                         nd->nd_repstat = NFSERR_INVAL;
2697         }
2698         clientid.lval[0] = stp->ls_stateid.other[0];
2699         clientid.lval[1] = stp->ls_stateid.other[1];
2700         if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
2701                 if ((nd->nd_flag & ND_NFSV41) != 0)
2702                         clientid.qval = nd->nd_clientid.qval;
2703                 else if (nd->nd_clientid.qval != clientid.qval)
2704                         printf("EEK6 multiple clids\n");
2705         } else {
2706                 if ((nd->nd_flag & ND_NFSV41) != 0)
2707                         printf("EEK! no clientid from session\n");
2708                 nd->nd_flag |= ND_IMPLIEDCLID;
2709                 nd->nd_clientid.qval = clientid.qval;
2710         }
2711         if (!nd->nd_repstat && vnode_vtype(vp) != VREG) {
2712             if (vnode_vtype(vp) == VDIR)
2713                 nd->nd_repstat = NFSERR_ISDIR;
2714             else
2715                 nd->nd_repstat = NFSERR_INVAL;
2716         }
2717         /*
2718          * Call nfsrv_lockctrl() even if nd_repstat is set, so that the
2719          * seqid# gets incremented. nfsrv_lockctrl() will return the
2720          * value of nd_repstat, if it gets that far.
2721          */
2722         nd->nd_repstat = nfsrv_lockctrl(vp, &stp, &lop, NULL, clientid,
2723             &stateid, exp, nd, p);
2724         if (stp)
2725                 free(stp, M_NFSDSTATE);
2726         if (lop)
2727                 free(lop, M_NFSDLOCK);
2728         if (!nd->nd_repstat) {
2729                 NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
2730                 *tl++ = txdr_unsigned(stateid.seqid);
2731                 NFSBCOPY((caddr_t)stateid.other,(caddr_t)tl,NFSX_STATEIDOTHER);
2732         }
2733 nfsmout:
2734         vput(vp);
2735         NFSEXITCODE2(error, nd);
2736         return (error);
2737 }
2738
2739 /*
2740  * nfsv4 open service
2741  */
2742 int
2743 nfsrvd_open(struct nfsrv_descript *nd, __unused int isdgram,
2744     vnode_t dp, vnode_t *vpp, __unused fhandle_t *fhp, struct nfsexstuff *exp)
2745 {
2746         u_int32_t *tl;
2747         int i, retext;
2748         struct nfsstate *stp = NULL;
2749         int error = 0, create, claim, exclusive_flag = 0, override;
2750         u_int32_t rflags = NFSV4OPEN_LOCKTYPEPOSIX, acemask;
2751         int how = NFSCREATE_UNCHECKED;
2752         int32_t cverf[2], tverf[2] = { 0, 0 };
2753         vnode_t vp = NULL, dirp = NULL;
2754         struct nfsvattr nva, dirfor, diraft;
2755         struct nameidata named;
2756         nfsv4stateid_t stateid, delegstateid;
2757         nfsattrbit_t attrbits;
2758         nfsquad_t clientid;
2759         char *bufp = NULL;
2760         u_long *hashp;
2761         NFSACL_T *aclp = NULL;
2762         struct thread *p = curthread;
2763
2764 #ifdef NFS4_ACL_EXTATTR_NAME
2765         aclp = acl_alloc(M_WAITOK);
2766         aclp->acl_cnt = 0;
2767 #endif
2768         NFSZERO_ATTRBIT(&attrbits);
2769         named.ni_startdir = NULL;
2770         named.ni_cnd.cn_nameiop = 0;
2771         NFSM_DISSECT(tl, u_int32_t *, 6 * NFSX_UNSIGNED);
2772         i = fxdr_unsigned(int, *(tl + 5));
2773         if (i <= 0 || i > NFSV4_OPAQUELIMIT) {
2774                 nd->nd_repstat = NFSERR_BADXDR;
2775                 goto nfsmout;
2776         }
2777         stp = malloc(sizeof (struct nfsstate) + i,
2778             M_NFSDSTATE, M_WAITOK);
2779         stp->ls_ownerlen = i;
2780         stp->ls_op = nd->nd_rp;
2781         stp->ls_flags = NFSLCK_OPEN;
2782         stp->ls_uid = nd->nd_cred->cr_uid;
2783         stp->ls_seq = fxdr_unsigned(u_int32_t, *tl++);
2784         i = fxdr_unsigned(int, *tl++);
2785         retext = 0;
2786         if ((i & (NFSV4OPEN_WANTDELEGMASK | NFSV4OPEN_WANTSIGNALDELEG |
2787             NFSV4OPEN_WANTPUSHDELEG)) != 0 && (nd->nd_flag & ND_NFSV41) != 0) {
2788                 retext = 1;
2789                 /* For now, ignore these. */
2790                 i &= ~(NFSV4OPEN_WANTPUSHDELEG | NFSV4OPEN_WANTSIGNALDELEG);
2791                 switch (i & NFSV4OPEN_WANTDELEGMASK) {
2792                 case NFSV4OPEN_WANTANYDELEG:
2793                         stp->ls_flags |= (NFSLCK_WANTRDELEG |
2794                             NFSLCK_WANTWDELEG);
2795                         i &= ~NFSV4OPEN_WANTDELEGMASK;
2796                         break;
2797                 case NFSV4OPEN_WANTREADDELEG:
2798                         stp->ls_flags |= NFSLCK_WANTRDELEG;
2799                         i &= ~NFSV4OPEN_WANTDELEGMASK;
2800                         break;
2801                 case NFSV4OPEN_WANTWRITEDELEG:
2802                         stp->ls_flags |= NFSLCK_WANTWDELEG;
2803                         i &= ~NFSV4OPEN_WANTDELEGMASK;
2804                         break;
2805                 case NFSV4OPEN_WANTNODELEG:
2806                         stp->ls_flags |= NFSLCK_WANTNODELEG;
2807                         i &= ~NFSV4OPEN_WANTDELEGMASK;
2808                         break;
2809                 case NFSV4OPEN_WANTCANCEL:
2810                         printf("NFSv4: ignore Open WantCancel\n");
2811                         i &= ~NFSV4OPEN_WANTDELEGMASK;
2812                         break;
2813                 default:
2814                         /* nd_repstat will be set to NFSERR_INVAL below. */
2815                         break;
2816                 }
2817         }
2818         switch (i) {
2819         case NFSV4OPEN_ACCESSREAD:
2820                 stp->ls_flags |= NFSLCK_READACCESS;
2821                 break;
2822         case NFSV4OPEN_ACCESSWRITE:
2823                 stp->ls_flags |= NFSLCK_WRITEACCESS;
2824                 break;
2825         case NFSV4OPEN_ACCESSBOTH:
2826                 stp->ls_flags |= (NFSLCK_READACCESS | NFSLCK_WRITEACCESS);
2827                 break;
2828         default:
2829                 nd->nd_repstat = NFSERR_INVAL;
2830         }
2831         i = fxdr_unsigned(int, *tl++);
2832         switch (i) {
2833         case NFSV4OPEN_DENYNONE:
2834                 break;
2835         case NFSV4OPEN_DENYREAD:
2836                 stp->ls_flags |= NFSLCK_READDENY;
2837                 break;
2838         case NFSV4OPEN_DENYWRITE:
2839                 stp->ls_flags |= NFSLCK_WRITEDENY;
2840                 break;
2841         case NFSV4OPEN_DENYBOTH:
2842                 stp->ls_flags |= (NFSLCK_READDENY | NFSLCK_WRITEDENY);
2843                 break;
2844         default:
2845                 nd->nd_repstat = NFSERR_INVAL;
2846         }
2847         clientid.lval[0] = *tl++;
2848         clientid.lval[1] = *tl;
2849         if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
2850                 if ((nd->nd_flag & ND_NFSV41) != 0)
2851                         clientid.qval = nd->nd_clientid.qval;
2852                 else if (nd->nd_clientid.qval != clientid.qval)
2853                         printf("EEK7 multiple clids\n");
2854         } else {
2855                 if ((nd->nd_flag & ND_NFSV41) != 0)
2856                         printf("EEK! no clientid from session\n");
2857                 nd->nd_flag |= ND_IMPLIEDCLID;
2858                 nd->nd_clientid.qval = clientid.qval;
2859         }
2860         error = nfsrv_mtostr(nd, stp->ls_owner, stp->ls_ownerlen);
2861         if (error)
2862                 goto nfsmout;
2863         NFSVNO_ATTRINIT(&nva);
2864         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2865         create = fxdr_unsigned(int, *tl);
2866         if (!nd->nd_repstat)
2867                 nd->nd_repstat = nfsvno_getattr(dp, &dirfor, nd, p, 0, NULL);
2868         if (create == NFSV4OPEN_CREATE) {
2869                 nva.na_type = VREG;
2870                 nva.na_mode = 0;
2871                 NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2872                 how = fxdr_unsigned(int, *tl);
2873                 switch (how) {
2874                 case NFSCREATE_UNCHECKED:
2875                 case NFSCREATE_GUARDED:
2876                         error = nfsv4_sattr(nd, NULL, &nva, &attrbits, aclp, p);
2877                         if (error)
2878                                 goto nfsmout;
2879                         /*
2880                          * If the na_gid being set is the same as that of
2881                          * the directory it is going in, clear it, since
2882                          * that is what will be set by default. This allows
2883                          * a user that isn't in that group to do the create.
2884                          */
2885                         if (!nd->nd_repstat && NFSVNO_ISSETGID(&nva) &&
2886                             nva.na_gid == dirfor.na_gid)
2887                                 NFSVNO_UNSET(&nva, gid);
2888                         if (!nd->nd_repstat)
2889                                 nd->nd_repstat = nfsrv_checkuidgid(nd, &nva);
2890                         break;
2891                 case NFSCREATE_EXCLUSIVE:
2892                         NFSM_DISSECT(tl, u_int32_t *, NFSX_VERF);
2893                         cverf[0] = *tl++;
2894                         cverf[1] = *tl;
2895                         break;
2896                 case NFSCREATE_EXCLUSIVE41:
2897                         NFSM_DISSECT(tl, u_int32_t *, NFSX_VERF);
2898                         cverf[0] = *tl++;
2899                         cverf[1] = *tl;
2900                         error = nfsv4_sattr(nd, NULL, &nva, &attrbits, aclp, p);
2901                         if (error != 0)
2902                                 goto nfsmout;
2903                         if (NFSISSET_ATTRBIT(&attrbits,
2904                             NFSATTRBIT_TIMEACCESSSET))
2905                                 nd->nd_repstat = NFSERR_INVAL;
2906                         /*
2907                          * If the na_gid being set is the same as that of
2908                          * the directory it is going in, clear it, since
2909                          * that is what will be set by default. This allows
2910                          * a user that isn't in that group to do the create.
2911                          */
2912                         if (nd->nd_repstat == 0 && NFSVNO_ISSETGID(&nva) &&
2913                             nva.na_gid == dirfor.na_gid)
2914                                 NFSVNO_UNSET(&nva, gid);
2915                         if (nd->nd_repstat == 0)
2916                                 nd->nd_repstat = nfsrv_checkuidgid(nd, &nva);
2917                         break;
2918                 default:
2919                         nd->nd_repstat = NFSERR_BADXDR;
2920                         goto nfsmout;
2921                 }
2922         } else if (create != NFSV4OPEN_NOCREATE) {
2923                 nd->nd_repstat = NFSERR_BADXDR;
2924                 goto nfsmout;
2925         }
2926
2927         /*
2928          * Now, handle the claim, which usually includes looking up a
2929          * name in the directory referenced by dp. The exception is
2930          * NFSV4OPEN_CLAIMPREVIOUS.
2931          */
2932         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2933         claim = fxdr_unsigned(int, *tl);
2934         if (claim == NFSV4OPEN_CLAIMDELEGATECUR) {
2935                 NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID);
2936                 stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
2937                 NFSBCOPY((caddr_t)tl,(caddr_t)stateid.other,NFSX_STATEIDOTHER);
2938                 stp->ls_flags |= NFSLCK_DELEGCUR;
2939         } else if (claim == NFSV4OPEN_CLAIMDELEGATEPREV) {
2940                 stp->ls_flags |= NFSLCK_DELEGPREV;
2941         }
2942         if (claim == NFSV4OPEN_CLAIMNULL || claim == NFSV4OPEN_CLAIMDELEGATECUR
2943             || claim == NFSV4OPEN_CLAIMDELEGATEPREV) {
2944                 if (!nd->nd_repstat && create == NFSV4OPEN_CREATE &&
2945                     claim != NFSV4OPEN_CLAIMNULL)
2946                         nd->nd_repstat = NFSERR_INVAL;
2947                 if (nd->nd_repstat) {
2948                         nd->nd_repstat = nfsrv_opencheck(clientid,
2949                             &stateid, stp, NULL, nd, p, nd->nd_repstat);
2950                         goto nfsmout;
2951                 }
2952                 if (create == NFSV4OPEN_CREATE)
2953                     NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, CREATE,
2954                         LOCKPARENT | LOCKLEAF | SAVESTART | NOCACHE);
2955                 else
2956                     NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, LOOKUP,
2957                         LOCKLEAF | SAVESTART);
2958                 nfsvno_setpathbuf(&named, &bufp, &hashp);
2959                 error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
2960                 if (error) {
2961                         vrele(dp);
2962 #ifdef NFS4_ACL_EXTATTR_NAME
2963                         acl_free(aclp);
2964 #endif
2965                         free(stp, M_NFSDSTATE);
2966                         nfsvno_relpathbuf(&named);
2967                         NFSEXITCODE2(error, nd);
2968                         return (error);
2969                 }
2970                 if (!nd->nd_repstat) {
2971                         nd->nd_repstat = nfsvno_namei(nd, &named, dp, 0, exp,
2972                             p, &dirp);
2973                 } else {
2974                         vrele(dp);
2975                         nfsvno_relpathbuf(&named);
2976                 }
2977                 if (create == NFSV4OPEN_CREATE) {
2978                     switch (how) {
2979                     case NFSCREATE_UNCHECKED:
2980                         if (named.ni_vp) {
2981                                 /*
2982                                  * Clear the setable attribute bits, except
2983                                  * for Size, if it is being truncated.
2984                                  */
2985                                 NFSZERO_ATTRBIT(&attrbits);
2986                                 if (NFSVNO_ISSETSIZE(&nva))
2987                                         NFSSETBIT_ATTRBIT(&attrbits,
2988                                             NFSATTRBIT_SIZE);
2989                         }
2990                         break;
2991                     case NFSCREATE_GUARDED:
2992                         if (named.ni_vp && !nd->nd_repstat)
2993                                 nd->nd_repstat = EEXIST;
2994                         break;
2995                     case NFSCREATE_EXCLUSIVE:
2996                         exclusive_flag = 1;
2997                         if (!named.ni_vp)
2998                                 nva.na_mode = 0;
2999                         break;
3000                     case NFSCREATE_EXCLUSIVE41:
3001                         exclusive_flag = 1;
3002                         break;
3003                     }
3004                 }
3005                 nfsvno_open(nd, &named, clientid, &stateid, stp,
3006                     &exclusive_flag, &nva, cverf, create, aclp, &attrbits,
3007                     nd->nd_cred, exp, &vp);
3008         } else if (claim == NFSV4OPEN_CLAIMPREVIOUS || claim ==
3009             NFSV4OPEN_CLAIMFH) {
3010                 if (claim == NFSV4OPEN_CLAIMPREVIOUS) {
3011                         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
3012                         i = fxdr_unsigned(int, *tl);
3013                         switch (i) {
3014                         case NFSV4OPEN_DELEGATEREAD:
3015                                 stp->ls_flags |= NFSLCK_DELEGREAD;
3016                                 break;
3017                         case NFSV4OPEN_DELEGATEWRITE:
3018                                 stp->ls_flags |= NFSLCK_DELEGWRITE;
3019                         case NFSV4OPEN_DELEGATENONE:
3020                                 break;
3021                         default:
3022                                 nd->nd_repstat = NFSERR_BADXDR;
3023                                 goto nfsmout;
3024                         }
3025                         stp->ls_flags |= NFSLCK_RECLAIM;
3026                 } else {
3027                         /* CLAIM_NULL_FH */
3028                         if (nd->nd_repstat == 0 && create == NFSV4OPEN_CREATE)
3029                                 nd->nd_repstat = NFSERR_INVAL;
3030                 }
3031                 vp = dp;
3032                 NFSVOPLOCK(vp, LK_EXCLUSIVE | LK_RETRY);
3033                 if (!VN_IS_DOOMED(vp))
3034                         nd->nd_repstat = nfsrv_opencheck(clientid, &stateid,
3035                             stp, vp, nd, p, nd->nd_repstat);
3036                 else
3037                         nd->nd_repstat = NFSERR_PERM;
3038         } else {
3039                 nd->nd_repstat = NFSERR_BADXDR;
3040                 goto nfsmout;
3041         }
3042
3043         /*
3044          * Do basic access checking.
3045          */
3046         if (!nd->nd_repstat && vnode_vtype(vp) != VREG) {
3047                 /*
3048                  * The IETF working group decided that this is the correct
3049                  * error return for all non-regular files.
3050                  */
3051                 nd->nd_repstat = (vp->v_type == VDIR) ? NFSERR_ISDIR : NFSERR_SYMLINK;
3052         }
3053
3054         /*
3055          * If the Open is being done for a file that already exists, apply
3056          * normal permission checking including for the file owner, if
3057          * vfs.nfsd.v4openaccess is set.
3058          * Previously, the owner was always allowed to open the file to
3059          * be consistent with the NFS tradition of always allowing the
3060          * owner of the file to write to the file regardless of permissions.
3061          * It now appears that the Linux client expects the owner
3062          * permissions to be checked for opens that are not creating the
3063          * file.  I believe the correct approach is to use the Access
3064          * operation's results to be consistent with NFSv3, but that is
3065          * not what the current Linux client appears to be doing.
3066          * Since both the Linux and OpenSolaris NFSv4 servers do this check,
3067          * I have enabled it by default.
3068          * If this semantic change causes a problem, it can be disabled by
3069          * setting the sysctl vfs.nfsd.v4openaccess to 0 to re-enable the
3070          * previous semantics.
3071          */
3072         if (nfsrv_openaccess && create == NFSV4OPEN_NOCREATE)
3073                 override = NFSACCCHK_NOOVERRIDE;
3074         else
3075                 override = NFSACCCHK_ALLOWOWNER;
3076         if (!nd->nd_repstat && (stp->ls_flags & NFSLCK_WRITEACCESS))
3077             nd->nd_repstat = nfsvno_accchk(vp, VWRITE, nd->nd_cred,
3078                 exp, p, override, NFSACCCHK_VPISLOCKED, NULL);
3079         if (!nd->nd_repstat && (stp->ls_flags & NFSLCK_READACCESS)) {
3080             nd->nd_repstat = nfsvno_accchk(vp, VREAD, nd->nd_cred,
3081                 exp, p, override, NFSACCCHK_VPISLOCKED, NULL);
3082             if (nd->nd_repstat)
3083                 nd->nd_repstat = nfsvno_accchk(vp, VEXEC,
3084                     nd->nd_cred, exp, p, override,
3085                     NFSACCCHK_VPISLOCKED, NULL);
3086         }
3087
3088         if (!nd->nd_repstat) {
3089                 nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
3090                 if (!nd->nd_repstat) {
3091                         tverf[0] = nva.na_atime.tv_sec;
3092                         tverf[1] = nva.na_atime.tv_nsec;
3093                 }
3094         }
3095         if (!nd->nd_repstat && exclusive_flag && (cverf[0] != tverf[0] ||
3096             cverf[1] != tverf[1]))
3097                 nd->nd_repstat = EEXIST;
3098         /*
3099          * Do the open locking/delegation stuff.
3100          */
3101         if (!nd->nd_repstat)
3102             nd->nd_repstat = nfsrv_openctrl(nd, vp, &stp, clientid, &stateid,
3103                 &delegstateid, &rflags, exp, p, nva.na_filerev);
3104
3105         /*
3106          * vp must be unlocked before the call to nfsvno_getattr(dirp,...)
3107          * below, to avoid a deadlock with the lookup in nfsvno_namei() above.
3108          * (ie: Leave the NFSVOPUNLOCK() about here.)
3109          */
3110         if (vp)
3111                 NFSVOPUNLOCK(vp);
3112         if (stp)
3113                 free(stp, M_NFSDSTATE);
3114         if (!nd->nd_repstat && dirp)
3115                 nd->nd_repstat = nfsvno_getattr(dirp, &diraft, nd, p, 0, NULL);
3116         if (!nd->nd_repstat) {
3117                 /* For NFSv4.1, set the Current StateID. */
3118                 if ((nd->nd_flag & ND_NFSV41) != 0) {
3119                         nd->nd_curstateid = stateid;
3120                         nd->nd_flag |= ND_CURSTATEID;
3121                 }
3122                 NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID + 6 * NFSX_UNSIGNED);
3123                 *tl++ = txdr_unsigned(stateid.seqid);
3124                 NFSBCOPY((caddr_t)stateid.other,(caddr_t)tl,NFSX_STATEIDOTHER);
3125                 tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
3126                 if (claim == NFSV4OPEN_CLAIMPREVIOUS) {
3127                         *tl++ = newnfs_true;
3128                         *tl++ = 0;
3129                         *tl++ = 0;
3130                         *tl++ = 0;
3131                         *tl++ = 0;
3132                 } else {
3133                         *tl++ = newnfs_false;   /* Since dirp is not locked */
3134                         txdr_hyper(dirfor.na_filerev, tl);
3135                         tl += 2;
3136                         txdr_hyper(diraft.na_filerev, tl);
3137                         tl += 2;
3138                 }
3139                 *tl = txdr_unsigned(rflags & NFSV4OPEN_RFLAGS);
3140                 (void) nfsrv_putattrbit(nd, &attrbits);
3141                 NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3142                 if (rflags & NFSV4OPEN_READDELEGATE)
3143                         *tl = txdr_unsigned(NFSV4OPEN_DELEGATEREAD);
3144                 else if (rflags & NFSV4OPEN_WRITEDELEGATE)
3145                         *tl = txdr_unsigned(NFSV4OPEN_DELEGATEWRITE);
3146                 else if (retext != 0) {
3147                         *tl = txdr_unsigned(NFSV4OPEN_DELEGATENONEEXT);
3148                         if ((rflags & NFSV4OPEN_WDNOTWANTED) != 0) {
3149                                 NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3150                                 *tl = txdr_unsigned(NFSV4OPEN_NOTWANTED);
3151                         } else if ((rflags & NFSV4OPEN_WDSUPPFTYPE) != 0) {
3152                                 NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3153                                 *tl = txdr_unsigned(NFSV4OPEN_NOTSUPPFTYPE);
3154                         } else if ((rflags & NFSV4OPEN_WDCONTENTION) != 0) {
3155                                 NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3156                                 *tl++ = txdr_unsigned(NFSV4OPEN_CONTENTION);
3157                                 *tl = newnfs_false;
3158                         } else if ((rflags & NFSV4OPEN_WDRESOURCE) != 0) {
3159                                 NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3160                                 *tl++ = txdr_unsigned(NFSV4OPEN_RESOURCE);
3161                                 *tl = newnfs_false;
3162                         } else {
3163                                 NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3164                                 *tl = txdr_unsigned(NFSV4OPEN_NOTWANTED);
3165                         }
3166                 } else
3167                         *tl = txdr_unsigned(NFSV4OPEN_DELEGATENONE);
3168                 if (rflags & (NFSV4OPEN_READDELEGATE|NFSV4OPEN_WRITEDELEGATE)) {
3169                         NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID+NFSX_UNSIGNED);
3170                         *tl++ = txdr_unsigned(delegstateid.seqid);
3171                         NFSBCOPY((caddr_t)delegstateid.other, (caddr_t)tl,
3172                             NFSX_STATEIDOTHER);
3173                         tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
3174                         if (rflags & NFSV4OPEN_RECALL)
3175                                 *tl = newnfs_true;
3176                         else
3177                                 *tl = newnfs_false;
3178                         if (rflags & NFSV4OPEN_WRITEDELEGATE) {
3179                                 NFSM_BUILD(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
3180                                 *tl++ = txdr_unsigned(NFSV4OPEN_LIMITSIZE);
3181                                 txdr_hyper(nva.na_size, tl);
3182                         }
3183                         NFSM_BUILD(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
3184                         *tl++ = txdr_unsigned(NFSV4ACE_ALLOWEDTYPE);
3185                         *tl++ = txdr_unsigned(0x0);
3186                         acemask = NFSV4ACE_ALLFILESMASK;
3187                         if (nva.na_mode & S_IRUSR)
3188                             acemask |= NFSV4ACE_READMASK;
3189                         if (nva.na_mode & S_IWUSR)
3190                             acemask |= NFSV4ACE_WRITEMASK;
3191                         if (nva.na_mode & S_IXUSR)
3192                             acemask |= NFSV4ACE_EXECUTEMASK;
3193                         *tl = txdr_unsigned(acemask);
3194                         (void) nfsm_strtom(nd, "OWNER@", 6);
3195                 }
3196                 *vpp = vp;
3197         } else if (vp) {
3198                 vrele(vp);
3199         }
3200         if (dirp)
3201                 vrele(dirp);
3202 #ifdef NFS4_ACL_EXTATTR_NAME
3203         acl_free(aclp);
3204 #endif
3205         NFSEXITCODE2(0, nd);
3206         return (0);
3207 nfsmout:
3208         vrele(dp);
3209 #ifdef NFS4_ACL_EXTATTR_NAME
3210         acl_free(aclp);
3211 #endif
3212         if (stp)
3213                 free(stp, M_NFSDSTATE);
3214         NFSEXITCODE2(error, nd);
3215         return (error);
3216 }
3217
3218 /*
3219  * nfsv4 close service
3220  */
3221 int
3222 nfsrvd_close(struct nfsrv_descript *nd, __unused int isdgram,
3223     vnode_t vp, __unused struct nfsexstuff *exp)
3224 {
3225         u_int32_t *tl;
3226         struct nfsstate st, *stp = &st;
3227         int error = 0, writeacc;
3228         nfsv4stateid_t stateid;
3229         nfsquad_t clientid;
3230         struct nfsvattr na;
3231         struct thread *p = curthread;
3232
3233         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED + NFSX_STATEID);
3234         stp->ls_seq = fxdr_unsigned(u_int32_t, *tl++);
3235         stp->ls_ownerlen = 0;
3236         stp->ls_op = nd->nd_rp;
3237         stp->ls_uid = nd->nd_cred->cr_uid;
3238         stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
3239         NFSBCOPY((caddr_t)tl, (caddr_t)stp->ls_stateid.other,
3240             NFSX_STATEIDOTHER);
3241
3242         /*
3243          * For the special stateid of other all 0s and seqid == 1, set the
3244          * stateid to the current stateid, if it is set.
3245          */
3246         if ((nd->nd_flag & ND_NFSV41) != 0 && stp->ls_stateid.seqid == 1 &&
3247             stp->ls_stateid.other[0] == 0 && stp->ls_stateid.other[1] == 0 &&
3248             stp->ls_stateid.other[2] == 0) {
3249                 if ((nd->nd_flag & ND_CURSTATEID) != 0)
3250                         stp->ls_stateid = nd->nd_curstateid;
3251                 else {
3252                         nd->nd_repstat = NFSERR_BADSTATEID;
3253                         goto nfsmout;
3254                 }
3255         }
3256
3257         stp->ls_flags = NFSLCK_CLOSE;
3258         clientid.lval[0] = stp->ls_stateid.other[0];
3259         clientid.lval[1] = stp->ls_stateid.other[1];
3260         if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
3261                 if ((nd->nd_flag & ND_NFSV41) != 0)
3262                         clientid.qval = nd->nd_clientid.qval;
3263                 else if (nd->nd_clientid.qval != clientid.qval)
3264                         printf("EEK8 multiple clids\n");
3265         } else {
3266                 if ((nd->nd_flag & ND_NFSV41) != 0)
3267                         printf("EEK! no clientid from session\n");
3268                 nd->nd_flag |= ND_IMPLIEDCLID;
3269                 nd->nd_clientid.qval = clientid.qval;
3270         }
3271         nd->nd_repstat = nfsrv_openupdate(vp, stp, clientid, &stateid, nd, p,
3272             &writeacc);
3273         /* For pNFS, update the attributes. */
3274         if (writeacc != 0 || nfsrv_pnfsatime != 0)
3275                 nfsrv_updatemdsattr(vp, &na, p);
3276         vput(vp);
3277         if (!nd->nd_repstat) {
3278                 /*
3279                  * If the stateid that has been closed is the current stateid,
3280                  * unset it.
3281                  */
3282                 if ((nd->nd_flag & ND_CURSTATEID) != 0 &&
3283                     stateid.other[0] == nd->nd_curstateid.other[0] &&
3284                     stateid.other[1] == nd->nd_curstateid.other[1] &&
3285                     stateid.other[2] == nd->nd_curstateid.other[2])
3286                         nd->nd_flag &= ~ND_CURSTATEID;
3287                 NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
3288                 *tl++ = txdr_unsigned(stateid.seqid);
3289                 NFSBCOPY((caddr_t)stateid.other,(caddr_t)tl,NFSX_STATEIDOTHER);
3290         }
3291         NFSEXITCODE2(0, nd);
3292         return (0);
3293 nfsmout:
3294         vput(vp);
3295         NFSEXITCODE2(error, nd);
3296         return (error);
3297 }
3298
3299 /*
3300  * nfsv4 delegpurge service
3301  */
3302 int
3303 nfsrvd_delegpurge(struct nfsrv_descript *nd, __unused int isdgram,
3304     __unused vnode_t vp, __unused struct nfsexstuff *exp)
3305 {
3306         u_int32_t *tl;
3307         int error = 0;
3308         nfsquad_t clientid;
3309         struct thread *p = curthread;
3310
3311         if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
3312                 nd->nd_repstat = NFSERR_WRONGSEC;
3313                 goto nfsmout;
3314         }
3315         NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3316         clientid.lval[0] = *tl++;
3317         clientid.lval[1] = *tl;
3318         if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
3319                 if ((nd->nd_flag & ND_NFSV41) != 0)
3320                         clientid.qval = nd->nd_clientid.qval;
3321                 else if (nd->nd_clientid.qval != clientid.qval)
3322                         printf("EEK9 multiple clids\n");
3323         } else {
3324                 if ((nd->nd_flag & ND_NFSV41) != 0)
3325                         printf("EEK! no clientid from session\n");
3326                 nd->nd_flag |= ND_IMPLIEDCLID;
3327                 nd->nd_clientid.qval = clientid.qval;
3328         }
3329         nd->nd_repstat = nfsrv_delegupdate(nd, clientid, NULL, NULL,
3330             NFSV4OP_DELEGPURGE, nd->nd_cred, p, NULL);
3331 nfsmout:
3332         NFSEXITCODE2(error, nd);
3333         return (error);
3334 }
3335
3336 /*
3337  * nfsv4 delegreturn service
3338  */
3339 int
3340 nfsrvd_delegreturn(struct nfsrv_descript *nd, __unused int isdgram,
3341     vnode_t vp, __unused struct nfsexstuff *exp)
3342 {
3343         u_int32_t *tl;
3344         int error = 0, writeacc;
3345         nfsv4stateid_t stateid;
3346         nfsquad_t clientid;
3347         struct nfsvattr na;
3348         struct thread *p = curthread;
3349
3350         NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID);
3351         stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
3352         NFSBCOPY((caddr_t)tl, (caddr_t)stateid.other, NFSX_STATEIDOTHER);
3353         clientid.lval[0] = stateid.other[0];
3354         clientid.lval[1] = stateid.other[1];
3355         if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
3356                 if ((nd->nd_flag & ND_NFSV41) != 0)
3357                         clientid.qval = nd->nd_clientid.qval;
3358                 else if (nd->nd_clientid.qval != clientid.qval)
3359                         printf("EEK10 multiple clids\n");
3360         } else {
3361                 if ((nd->nd_flag & ND_NFSV41) != 0)
3362                         printf("EEK! no clientid from session\n");
3363                 nd->nd_flag |= ND_IMPLIEDCLID;
3364                 nd->nd_clientid.qval = clientid.qval;
3365         }
3366         nd->nd_repstat = nfsrv_delegupdate(nd, clientid, &stateid, vp,
3367             NFSV4OP_DELEGRETURN, nd->nd_cred, p, &writeacc);
3368         /* For pNFS, update the attributes. */
3369         if (writeacc != 0 || nfsrv_pnfsatime != 0)
3370                 nfsrv_updatemdsattr(vp, &na, p);
3371 nfsmout:
3372         vput(vp);
3373         NFSEXITCODE2(error, nd);
3374         return (error);
3375 }
3376
3377 /*
3378  * nfsv4 get file handle service
3379  */
3380 int
3381 nfsrvd_getfh(struct nfsrv_descript *nd, __unused int isdgram,
3382     vnode_t vp, __unused struct nfsexstuff *exp)
3383 {
3384         fhandle_t fh;
3385         struct thread *p = curthread;
3386
3387         nd->nd_repstat = nfsvno_getfh(vp, &fh, p);
3388         vput(vp);
3389         if (!nd->nd_repstat)
3390                 (void) nfsm_fhtom(nd, (u_int8_t *)&fh, 0, 0);
3391         NFSEXITCODE2(0, nd);
3392         return (0);
3393 }
3394
3395 /*
3396  * nfsv4 open confirm service
3397  */
3398 int
3399 nfsrvd_openconfirm(struct nfsrv_descript *nd, __unused int isdgram,
3400     vnode_t vp, __unused struct nfsexstuff *exp)
3401 {
3402         u_int32_t *tl;
3403         struct nfsstate st, *stp = &st;
3404         int error = 0;
3405         nfsv4stateid_t stateid;
3406         nfsquad_t clientid;
3407         struct thread *p = curthread;
3408
3409         if ((nd->nd_flag & ND_NFSV41) != 0) {
3410                 nd->nd_repstat = NFSERR_NOTSUPP;
3411                 goto nfsmout;
3412         }
3413         NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID + NFSX_UNSIGNED);
3414         stp->ls_ownerlen = 0;
3415         stp->ls_op = nd->nd_rp;
3416         stp->ls_uid = nd->nd_cred->cr_uid;
3417         stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
3418         NFSBCOPY((caddr_t)tl, (caddr_t)stp->ls_stateid.other,
3419             NFSX_STATEIDOTHER);
3420         tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
3421         stp->ls_seq = fxdr_unsigned(u_int32_t, *tl);
3422         stp->ls_flags = NFSLCK_CONFIRM;
3423         clientid.lval[0] = stp->ls_stateid.other[0];
3424         clientid.lval[1] = stp->ls_stateid.other[1];
3425         if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
3426                 if ((nd->nd_flag & ND_NFSV41) != 0)
3427                         clientid.qval = nd->nd_clientid.qval;
3428                 else if (nd->nd_clientid.qval != clientid.qval)
3429                         printf("EEK11 multiple clids\n");
3430         } else {
3431                 if ((nd->nd_flag & ND_NFSV41) != 0)
3432                         printf("EEK! no clientid from session\n");
3433                 nd->nd_flag |= ND_IMPLIEDCLID;
3434                 nd->nd_clientid.qval = clientid.qval;
3435         }
3436         nd->nd_repstat = nfsrv_openupdate(vp, stp, clientid, &stateid, nd, p,
3437             NULL);
3438         if (!nd->nd_repstat) {
3439                 NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
3440                 *tl++ = txdr_unsigned(stateid.seqid);
3441                 NFSBCOPY((caddr_t)stateid.other,(caddr_t)tl,NFSX_STATEIDOTHER);
3442         }
3443 nfsmout:
3444         vput(vp);
3445         NFSEXITCODE2(error, nd);
3446         return (error);
3447 }
3448
3449 /*
3450  * nfsv4 open downgrade service
3451  */
3452 int
3453 nfsrvd_opendowngrade(struct nfsrv_descript *nd, __unused int isdgram,
3454     vnode_t vp, __unused struct nfsexstuff *exp)
3455 {
3456         u_int32_t *tl;
3457         int i;
3458         struct nfsstate st, *stp = &st;
3459         int error = 0;
3460         nfsv4stateid_t stateid;
3461         nfsquad_t clientid;
3462         struct thread *p = curthread;
3463
3464         /* opendowngrade can only work on a file object.*/
3465         if (vp->v_type != VREG) {
3466                 error = NFSERR_INVAL;
3467                 goto nfsmout;
3468         }
3469         NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID + 3 * NFSX_UNSIGNED);
3470         stp->ls_ownerlen = 0;
3471         stp->ls_op = nd->nd_rp;
3472         stp->ls_uid = nd->nd_cred->cr_uid;
3473         stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
3474         NFSBCOPY((caddr_t)tl, (caddr_t)stp->ls_stateid.other,
3475             NFSX_STATEIDOTHER);
3476         tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
3477
3478         /*
3479          * For the special stateid of other all 0s and seqid == 1, set the
3480          * stateid to the current stateid, if it is set.
3481          */
3482         if ((nd->nd_flag & ND_NFSV41) != 0 && stp->ls_stateid.seqid == 1 &&
3483             stp->ls_stateid.other[0] == 0 && stp->ls_stateid.other[1] == 0 &&
3484             stp->ls_stateid.other[2] == 0) {
3485                 if ((nd->nd_flag & ND_CURSTATEID) != 0)
3486                         stp->ls_stateid = nd->nd_curstateid;
3487                 else {
3488                         nd->nd_repstat = NFSERR_BADSTATEID;
3489                         goto nfsmout;
3490                 }
3491         }
3492
3493         stp->ls_seq = fxdr_unsigned(u_int32_t, *tl++);
3494         i = fxdr_unsigned(int, *tl++);
3495         if ((nd->nd_flag & ND_NFSV41) != 0)
3496                 i &= ~NFSV4OPEN_WANTDELEGMASK;
3497         switch (i) {
3498         case NFSV4OPEN_ACCESSREAD:
3499                 stp->ls_flags = (NFSLCK_READACCESS | NFSLCK_DOWNGRADE);
3500                 break;
3501         case NFSV4OPEN_ACCESSWRITE:
3502                 stp->ls_flags = (NFSLCK_WRITEACCESS | NFSLCK_DOWNGRADE);
3503                 break;
3504         case NFSV4OPEN_ACCESSBOTH:
3505                 stp->ls_flags = (NFSLCK_READACCESS | NFSLCK_WRITEACCESS |
3506                     NFSLCK_DOWNGRADE);
3507                 break;
3508         default:
3509                 nd->nd_repstat = NFSERR_INVAL;
3510         }
3511         i = fxdr_unsigned(int, *tl);
3512         switch (i) {
3513         case NFSV4OPEN_DENYNONE:
3514                 break;
3515         case NFSV4OPEN_DENYREAD:
3516                 stp->ls_flags |= NFSLCK_READDENY;
3517                 break;
3518         case NFSV4OPEN_DENYWRITE:
3519                 stp->ls_flags |= NFSLCK_WRITEDENY;
3520                 break;
3521         case NFSV4OPEN_DENYBOTH:
3522                 stp->ls_flags |= (NFSLCK_READDENY | NFSLCK_WRITEDENY);
3523                 break;
3524         default:
3525                 nd->nd_repstat = NFSERR_INVAL;
3526         }
3527
3528         clientid.lval[0] = stp->ls_stateid.other[0];
3529         clientid.lval[1] = stp->ls_stateid.other[1];
3530         if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
3531                 if ((nd->nd_flag & ND_NFSV41) != 0)
3532                         clientid.qval = nd->nd_clientid.qval;
3533                 else if (nd->nd_clientid.qval != clientid.qval)
3534                         printf("EEK12 multiple clids\n");
3535         } else {
3536                 if ((nd->nd_flag & ND_NFSV41) != 0)
3537                         printf("EEK! no clientid from session\n");
3538                 nd->nd_flag |= ND_IMPLIEDCLID;
3539                 nd->nd_clientid.qval = clientid.qval;
3540         }
3541         if (!nd->nd_repstat)
3542                 nd->nd_repstat = nfsrv_openupdate(vp, stp, clientid, &stateid,
3543                     nd, p, NULL);
3544         if (!nd->nd_repstat) {
3545                 /* For NFSv4.1, set the Current StateID. */
3546                 if ((nd->nd_flag & ND_NFSV41) != 0) {
3547                         nd->nd_curstateid = stateid;
3548                         nd->nd_flag |= ND_CURSTATEID;
3549                 }
3550                 NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
3551                 *tl++ = txdr_unsigned(stateid.seqid);
3552                 NFSBCOPY((caddr_t)stateid.other,(caddr_t)tl,NFSX_STATEIDOTHER);
3553         }
3554 nfsmout:
3555         vput(vp);
3556         NFSEXITCODE2(error, nd);
3557         return (error);
3558 }
3559
3560 /*
3561  * nfsv4 renew lease service
3562  */
3563 int
3564 nfsrvd_renew(struct nfsrv_descript *nd, __unused int isdgram,
3565     __unused vnode_t vp, __unused struct nfsexstuff *exp)
3566 {
3567         u_int32_t *tl;
3568         int error = 0;
3569         nfsquad_t clientid;
3570         struct thread *p = curthread;
3571
3572         if ((nd->nd_flag & ND_NFSV41) != 0) {
3573                 nd->nd_repstat = NFSERR_NOTSUPP;
3574                 goto nfsmout;
3575         }
3576         if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
3577                 nd->nd_repstat = NFSERR_WRONGSEC;
3578                 goto nfsmout;
3579         }
3580         NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
3581         clientid.lval[0] = *tl++;
3582         clientid.lval[1] = *tl;
3583         if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
3584                 if ((nd->nd_flag & ND_NFSV41) != 0)
3585                         clientid.qval = nd->nd_clientid.qval;
3586                 else if (nd->nd_clientid.qval != clientid.qval)
3587                         printf("EEK13 multiple clids\n");
3588         } else {
3589                 if ((nd->nd_flag & ND_NFSV41) != 0)
3590                         printf("EEK! no clientid from session\n");
3591                 nd->nd_flag |= ND_IMPLIEDCLID;
3592                 nd->nd_clientid.qval = clientid.qval;
3593         }
3594         nd->nd_repstat = nfsrv_getclient(clientid, (CLOPS_RENEWOP|CLOPS_RENEW),
3595             NULL, NULL, (nfsquad_t)((u_quad_t)0), 0, nd, p);
3596 nfsmout:
3597         NFSEXITCODE2(error, nd);
3598         return (error);
3599 }
3600
3601 /*
3602  * nfsv4 security info service
3603  */
3604 int
3605 nfsrvd_secinfo(struct nfsrv_descript *nd, int isdgram,
3606     vnode_t dp, struct nfsexstuff *exp)
3607 {
3608         u_int32_t *tl;
3609         int len;
3610         struct nameidata named;
3611         vnode_t dirp = NULL, vp;
3612         struct nfsrvfh fh;
3613         struct nfsexstuff retnes;
3614         u_int32_t *sizp;
3615         int error = 0, savflag, i;
3616         char *bufp;
3617         u_long *hashp;
3618         struct thread *p = curthread;
3619
3620         /*
3621          * All this just to get the export flags for the name.
3622          */
3623         NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, LOOKUP,
3624             LOCKLEAF | SAVESTART);
3625         nfsvno_setpathbuf(&named, &bufp, &hashp);
3626         error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
3627         if (error) {
3628                 vput(dp);
3629                 nfsvno_relpathbuf(&named);
3630                 goto out;
3631         }
3632         if (!nd->nd_repstat) {
3633                 nd->nd_repstat = nfsvno_namei(nd, &named, dp, 1, exp, p, &dirp);
3634         } else {
3635                 vput(dp);
3636                 nfsvno_relpathbuf(&named);
3637         }
3638         if (dirp)
3639                 vrele(dirp);
3640         if (nd->nd_repstat)
3641                 goto out;
3642         vrele(named.ni_startdir);
3643         nfsvno_relpathbuf(&named);
3644         fh.nfsrvfh_len = NFSX_MYFH;
3645         vp = named.ni_vp;
3646         nd->nd_repstat = nfsvno_getfh(vp, (fhandle_t *)fh.nfsrvfh_data, p);
3647         vput(vp);
3648         savflag = nd->nd_flag;
3649         if (!nd->nd_repstat) {
3650                 nfsd_fhtovp(nd, &fh, LK_SHARED, &vp, &retnes, NULL, 0);
3651                 if (vp)
3652                         vput(vp);
3653         }
3654         nd->nd_flag = savflag;
3655         if (nd->nd_repstat)
3656                 goto out;
3657
3658         /*
3659          * Finally have the export flags for name, so we can create
3660          * the security info.
3661          */
3662         len = 0;
3663         NFSM_BUILD(sizp, u_int32_t *, NFSX_UNSIGNED);
3664         for (i = 0; i < retnes.nes_numsecflavor; i++) {
3665                 if (retnes.nes_secflavors[i] == AUTH_SYS) {
3666                         NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3667                         *tl = txdr_unsigned(RPCAUTH_UNIX);
3668                         len++;
3669                 } else if (retnes.nes_secflavors[i] == RPCSEC_GSS_KRB5) {
3670                         NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3671                         *tl++ = txdr_unsigned(RPCAUTH_GSS);
3672                         (void) nfsm_strtom(nd, nfsgss_mechlist[KERBV_MECH].str,
3673                             nfsgss_mechlist[KERBV_MECH].len);
3674                         NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3675                         *tl++ = txdr_unsigned(GSS_KERBV_QOP);
3676                         *tl = txdr_unsigned(RPCAUTHGSS_SVCNONE);
3677                         len++;
3678                 } else if (retnes.nes_secflavors[i] == RPCSEC_GSS_KRB5I) {
3679                         NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3680                         *tl++ = txdr_unsigned(RPCAUTH_GSS);
3681                         (void) nfsm_strtom(nd, nfsgss_mechlist[KERBV_MECH].str,
3682                             nfsgss_mechlist[KERBV_MECH].len);
3683                         NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3684                         *tl++ = txdr_unsigned(GSS_KERBV_QOP);
3685                         *tl = txdr_unsigned(RPCAUTHGSS_SVCINTEGRITY);
3686                         len++;
3687                 } else if (retnes.nes_secflavors[i] == RPCSEC_GSS_KRB5P) {
3688                         NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3689                         *tl++ = txdr_unsigned(RPCAUTH_GSS);
3690                         (void) nfsm_strtom(nd, nfsgss_mechlist[KERBV_MECH].str,
3691                             nfsgss_mechlist[KERBV_MECH].len);
3692                         NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3693                         *tl++ = txdr_unsigned(GSS_KERBV_QOP);
3694                         *tl = txdr_unsigned(RPCAUTHGSS_SVCPRIVACY);
3695                         len++;
3696                 }
3697         }
3698         *sizp = txdr_unsigned(len);
3699
3700 out:
3701         NFSEXITCODE2(error, nd);
3702         return (error);
3703 }
3704
3705 /*
3706  * nfsv4 set client id service
3707  */
3708 int
3709 nfsrvd_setclientid(struct nfsrv_descript *nd, __unused int isdgram,
3710     __unused vnode_t vp, __unused struct nfsexstuff *exp)
3711 {
3712         u_int32_t *tl;
3713         int i;
3714         int error = 0, idlen;
3715         struct nfsclient *clp = NULL;
3716 #ifdef INET
3717         struct sockaddr_in *rin;
3718 #endif
3719 #ifdef INET6
3720         struct sockaddr_in6 *rin6;
3721 #endif
3722 #if defined(INET) || defined(INET6)
3723         u_char *ucp, *ucp2;
3724 #endif
3725         u_char *verf, *addrbuf;
3726         nfsquad_t clientid, confirm;
3727         struct thread *p = curthread;
3728
3729         if ((nd->nd_flag & ND_NFSV41) != 0) {
3730                 nd->nd_repstat = NFSERR_NOTSUPP;
3731                 goto nfsmout;
3732         }
3733         if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
3734                 nd->nd_repstat = NFSERR_WRONGSEC;
3735                 goto out;
3736         }
3737         NFSM_DISSECT(tl, u_int32_t *, NFSX_VERF + NFSX_UNSIGNED);
3738         verf = (u_char *)tl;
3739         tl += (NFSX_VERF / NFSX_UNSIGNED);
3740         i = fxdr_unsigned(int, *tl);
3741         if (i > NFSV4_OPAQUELIMIT || i <= 0) {
3742                 nd->nd_repstat = NFSERR_BADXDR;
3743                 goto nfsmout;
3744         }
3745         idlen = i;
3746         if (nd->nd_flag & ND_GSS)
3747                 i += nd->nd_princlen;
3748         clp = malloc(sizeof(struct nfsclient) + i, M_NFSDCLIENT, M_WAITOK |
3749             M_ZERO);
3750         clp->lc_stateid = malloc(sizeof(struct nfsstatehead) *
3751             nfsrv_statehashsize, M_NFSDCLIENT, M_WAITOK);
3752         NFSINITSOCKMUTEX(&clp->lc_req.nr_mtx);
3753         /* Allocated large enough for an AF_INET or AF_INET6 socket. */
3754         clp->lc_req.nr_nam = malloc(sizeof(struct sockaddr_in6), M_SONAME,
3755             M_WAITOK | M_ZERO);
3756         clp->lc_req.nr_cred = NULL;
3757         NFSBCOPY(verf, clp->lc_verf, NFSX_VERF);
3758         clp->lc_idlen = idlen;
3759         error = nfsrv_mtostr(nd, clp->lc_id, idlen);
3760         if (error)
3761                 goto nfsmout;
3762         if (nd->nd_flag & ND_GSS) {
3763                 clp->lc_flags = LCL_GSS;
3764                 if (nd->nd_flag & ND_GSSINTEGRITY)
3765                         clp->lc_flags |= LCL_GSSINTEGRITY;
3766                 else if (nd->nd_flag & ND_GSSPRIVACY)
3767                         clp->lc_flags |= LCL_GSSPRIVACY;
3768         } else {
3769                 clp->lc_flags = 0;
3770         }
3771         if ((nd->nd_flag & ND_GSS) && nd->nd_princlen > 0) {
3772                 clp->lc_flags |= LCL_NAME;
3773                 clp->lc_namelen = nd->nd_princlen;
3774                 clp->lc_name = &clp->lc_id[idlen];
3775                 NFSBCOPY(nd->nd_principal, clp->lc_name, clp->lc_namelen);
3776         } else {
3777                 clp->lc_uid = nd->nd_cred->cr_uid;
3778                 clp->lc_gid = nd->nd_cred->cr_gid;
3779         }
3780         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
3781         clp->lc_program = fxdr_unsigned(u_int32_t, *tl);
3782         error = nfsrv_getclientipaddr(nd, clp);
3783         if (error)
3784                 goto nfsmout;
3785         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
3786         clp->lc_callback = fxdr_unsigned(u_int32_t, *tl);
3787
3788         /*
3789          * nfsrv_setclient() does the actual work of adding it to the
3790          * client list. If there is no error, the structure has been
3791          * linked into the client list and clp should no longer be used
3792          * here. When an error is returned, it has not been linked in,
3793          * so it should be free'd.
3794          */
3795         nd->nd_repstat = nfsrv_setclient(nd, &clp, &clientid, &confirm, p);
3796         if (nd->nd_repstat == NFSERR_CLIDINUSE) {
3797                 /*
3798                  * 8 is the maximum length of the port# string.
3799                  */
3800                 addrbuf = malloc(INET6_ADDRSTRLEN + 8, M_TEMP, M_WAITOK);
3801                 switch (clp->lc_req.nr_nam->sa_family) {
3802 #ifdef INET
3803                 case AF_INET:
3804                         if (clp->lc_flags & LCL_TCPCALLBACK)
3805                                 (void) nfsm_strtom(nd, "tcp", 3);
3806                         else
3807                                 (void) nfsm_strtom(nd, "udp", 3);
3808                         rin = (struct sockaddr_in *)clp->lc_req.nr_nam;
3809                         ucp = (u_char *)&rin->sin_addr.s_addr;
3810                         ucp2 = (u_char *)&rin->sin_port;
3811                         sprintf(addrbuf, "%d.%d.%d.%d.%d.%d", ucp[0] & 0xff,
3812                             ucp[1] & 0xff, ucp[2] & 0xff, ucp[3] & 0xff,
3813                             ucp2[0] & 0xff, ucp2[1] & 0xff);
3814                         break;
3815 #endif
3816 #ifdef INET6
3817                 case AF_INET6:
3818                         if (clp->lc_flags & LCL_TCPCALLBACK)
3819                                 (void) nfsm_strtom(nd, "tcp6", 4);
3820                         else
3821                                 (void) nfsm_strtom(nd, "udp6", 4);
3822                         rin6 = (struct sockaddr_in6 *)clp->lc_req.nr_nam;
3823                         ucp = inet_ntop(AF_INET6, &rin6->sin6_addr, addrbuf,
3824                             INET6_ADDRSTRLEN);
3825                         if (ucp != NULL)
3826                                 i = strlen(ucp);
3827                         else
3828                                 i = 0;
3829                         ucp2 = (u_char *)&rin6->sin6_port;
3830                         sprintf(&addrbuf[i], ".%d.%d", ucp2[0] & 0xff,
3831                             ucp2[1] & 0xff);
3832                         break;
3833 #endif
3834                 }
3835                 (void) nfsm_strtom(nd, addrbuf, strlen(addrbuf));
3836                 free(addrbuf, M_TEMP);
3837         }
3838         if (clp) {
3839                 free(clp->lc_req.nr_nam, M_SONAME);
3840                 NFSFREEMUTEX(&clp->lc_req.nr_mtx);
3841                 free(clp->lc_stateid, M_NFSDCLIENT);
3842                 free(clp, M_NFSDCLIENT);
3843         }
3844         if (!nd->nd_repstat) {
3845                 NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_HYPER);
3846                 *tl++ = clientid.lval[0];
3847                 *tl++ = clientid.lval[1];
3848                 *tl++ = confirm.lval[0];
3849                 *tl = confirm.lval[1];
3850         }
3851
3852 out:
3853         NFSEXITCODE2(0, nd);
3854         return (0);
3855 nfsmout:
3856         if (clp) {
3857                 free(clp->lc_req.nr_nam, M_SONAME);
3858                 NFSFREEMUTEX(&clp->lc_req.nr_mtx);
3859                 free(clp->lc_stateid, M_NFSDCLIENT);
3860                 free(clp, M_NFSDCLIENT);
3861         }
3862         NFSEXITCODE2(error, nd);
3863         return (error);
3864 }
3865
3866 /*
3867  * nfsv4 set client id confirm service
3868  */
3869 int
3870 nfsrvd_setclientidcfrm(struct nfsrv_descript *nd,
3871     __unused int isdgram, __unused vnode_t vp,
3872     __unused struct nfsexstuff *exp)
3873 {
3874         u_int32_t *tl;
3875         int error = 0;
3876         nfsquad_t clientid, confirm;
3877         struct thread *p = curthread;
3878
3879         if ((nd->nd_flag & ND_NFSV41) != 0) {
3880                 nd->nd_repstat = NFSERR_NOTSUPP;
3881                 goto nfsmout;
3882         }
3883         if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
3884                 nd->nd_repstat = NFSERR_WRONGSEC;
3885                 goto nfsmout;
3886         }
3887         NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_HYPER);
3888         clientid.lval[0] = *tl++;
3889         clientid.lval[1] = *tl++;
3890         confirm.lval[0] = *tl++;
3891         confirm.lval[1] = *tl;
3892
3893         /*
3894          * nfsrv_getclient() searches the client list for a match and
3895          * returns the appropriate NFSERR status.
3896          */
3897         nd->nd_repstat = nfsrv_getclient(clientid, (CLOPS_CONFIRM|CLOPS_RENEW),
3898             NULL, NULL, confirm, 0, nd, p);
3899 nfsmout:
3900         NFSEXITCODE2(error, nd);
3901         return (error);
3902 }
3903
3904 /*
3905  * nfsv4 verify service
3906  */
3907 int
3908 nfsrvd_verify(struct nfsrv_descript *nd, int isdgram,
3909     vnode_t vp, __unused struct nfsexstuff *exp)
3910 {
3911         int error = 0, ret, fhsize = NFSX_MYFH;
3912         struct nfsvattr nva;
3913         struct statfs *sf;
3914         struct nfsfsinfo fs;
3915         fhandle_t fh;
3916         struct thread *p = curthread;
3917
3918         sf = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
3919         nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
3920         if (!nd->nd_repstat)
3921                 nd->nd_repstat = nfsvno_statfs(vp, sf);
3922         if (!nd->nd_repstat)
3923                 nd->nd_repstat = nfsvno_getfh(vp, &fh, p);
3924         if (!nd->nd_repstat) {
3925                 nfsvno_getfs(&fs, isdgram);
3926                 error = nfsv4_loadattr(nd, vp, &nva, NULL, &fh, fhsize, NULL,
3927                     sf, NULL, &fs, NULL, 1, &ret, NULL, NULL, p, nd->nd_cred);
3928                 if (!error) {
3929                         if (nd->nd_procnum == NFSV4OP_NVERIFY) {
3930                                 if (ret == 0)
3931                                         nd->nd_repstat = NFSERR_SAME;
3932                                 else if (ret != NFSERR_NOTSAME)
3933                                         nd->nd_repstat = ret;
3934                         } else if (ret)
3935                                 nd->nd_repstat = ret;
3936                 }
3937         }
3938         vput(vp);
3939         free(sf, M_STATFS);
3940         NFSEXITCODE2(error, nd);
3941         return (error);
3942 }
3943
3944 /*
3945  * nfs openattr rpc
3946  */
3947 int
3948 nfsrvd_openattr(struct nfsrv_descript *nd, __unused int isdgram,
3949     vnode_t dp, __unused vnode_t *vpp, __unused fhandle_t *fhp,
3950     __unused struct nfsexstuff *exp)
3951 {
3952         u_int32_t *tl;
3953         int error = 0, createdir __unused;
3954
3955         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
3956         createdir = fxdr_unsigned(int, *tl);
3957         nd->nd_repstat = NFSERR_NOTSUPP;
3958 nfsmout:
3959         vrele(dp);
3960         NFSEXITCODE2(error, nd);
3961         return (error);
3962 }
3963
3964 /*
3965  * nfsv4 release lock owner service
3966  */
3967 int
3968 nfsrvd_releaselckown(struct nfsrv_descript *nd, __unused int isdgram,
3969     __unused vnode_t vp, __unused struct nfsexstuff *exp)
3970 {
3971         u_int32_t *tl;
3972         struct nfsstate *stp = NULL;
3973         int error = 0, len;
3974         nfsquad_t clientid;
3975         struct thread *p = curthread;
3976
3977         if ((nd->nd_flag & ND_NFSV41) != 0) {
3978                 nd->nd_repstat = NFSERR_NOTSUPP;
3979                 goto nfsmout;
3980         }
3981         if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
3982                 nd->nd_repstat = NFSERR_WRONGSEC;
3983                 goto nfsmout;
3984         }
3985         NFSM_DISSECT(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
3986         len = fxdr_unsigned(int, *(tl + 2));
3987         if (len <= 0 || len > NFSV4_OPAQUELIMIT) {
3988                 nd->nd_repstat = NFSERR_BADXDR;
3989                 goto nfsmout;
3990         }
3991         stp = malloc(sizeof (struct nfsstate) + len,
3992             M_NFSDSTATE, M_WAITOK);
3993         stp->ls_ownerlen = len;
3994         stp->ls_op = NULL;
3995         stp->ls_flags = NFSLCK_RELEASE;
3996         stp->ls_uid = nd->nd_cred->cr_uid;
3997         clientid.lval[0] = *tl++;
3998         clientid.lval[1] = *tl;
3999         if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
4000                 if ((nd->nd_flag & ND_NFSV41) != 0)
4001                         clientid.qval = nd->nd_clientid.qval;
4002                 else if (nd->nd_clientid.qval != clientid.qval)
4003                         printf("EEK14 multiple clids\n");
4004         } else {
4005                 if ((nd->nd_flag & ND_NFSV41) != 0)
4006                         printf("EEK! no clientid from session\n");
4007                 nd->nd_flag |= ND_IMPLIEDCLID;
4008                 nd->nd_clientid.qval = clientid.qval;
4009         }
4010         error = nfsrv_mtostr(nd, stp->ls_owner, len);
4011         if (error)
4012                 goto nfsmout;
4013         nd->nd_repstat = nfsrv_releaselckown(stp, clientid, p);
4014         free(stp, M_NFSDSTATE);
4015
4016         NFSEXITCODE2(0, nd);
4017         return (0);
4018 nfsmout:
4019         if (stp)
4020                 free(stp, M_NFSDSTATE);
4021         NFSEXITCODE2(error, nd);
4022         return (error);
4023 }
4024
4025 /*
4026  * nfsv4 exchange_id service
4027  */
4028 int
4029 nfsrvd_exchangeid(struct nfsrv_descript *nd, __unused int isdgram,
4030     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4031 {
4032         uint32_t *tl;
4033         int error = 0, i, idlen;
4034         struct nfsclient *clp = NULL;
4035         nfsquad_t clientid, confirm;
4036         uint8_t *verf;
4037         uint32_t sp4type, v41flags;
4038         uint64_t owner_minor;
4039         struct timespec verstime;
4040 #ifdef INET
4041         struct sockaddr_in *sin, *rin;
4042 #endif
4043 #ifdef INET6
4044         struct sockaddr_in6 *sin6, *rin6;
4045 #endif
4046         struct thread *p = curthread;
4047
4048         if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
4049                 nd->nd_repstat = NFSERR_WRONGSEC;
4050                 goto nfsmout;
4051         }
4052         NFSM_DISSECT(tl, u_int32_t *, NFSX_VERF + NFSX_UNSIGNED);
4053         verf = (uint8_t *)tl;
4054         tl += (NFSX_VERF / NFSX_UNSIGNED);
4055         i = fxdr_unsigned(int, *tl);
4056         if (i > NFSV4_OPAQUELIMIT || i <= 0) {
4057                 nd->nd_repstat = NFSERR_BADXDR;
4058                 goto nfsmout;
4059         }
4060         idlen = i;
4061         if (nd->nd_flag & ND_GSS)
4062                 i += nd->nd_princlen;
4063         clp = malloc(sizeof(struct nfsclient) + i, M_NFSDCLIENT, M_WAITOK |
4064             M_ZERO);
4065         clp->lc_stateid = malloc(sizeof(struct nfsstatehead) *
4066             nfsrv_statehashsize, M_NFSDCLIENT, M_WAITOK);
4067         NFSINITSOCKMUTEX(&clp->lc_req.nr_mtx);
4068         /* Allocated large enough for an AF_INET or AF_INET6 socket. */
4069         clp->lc_req.nr_nam = malloc(sizeof(struct sockaddr_in6), M_SONAME,
4070             M_WAITOK | M_ZERO);
4071         switch (nd->nd_nam->sa_family) {
4072 #ifdef INET
4073         case AF_INET:
4074                 rin = (struct sockaddr_in *)clp->lc_req.nr_nam;
4075                 sin = (struct sockaddr_in *)nd->nd_nam;
4076                 rin->sin_family = AF_INET;
4077                 rin->sin_len = sizeof(struct sockaddr_in);
4078                 rin->sin_port = 0;
4079                 rin->sin_addr.s_addr = sin->sin_addr.s_addr;
4080                 break;
4081 #endif
4082 #ifdef INET6
4083         case AF_INET6:
4084                 rin6 = (struct sockaddr_in6 *)clp->lc_req.nr_nam;
4085                 sin6 = (struct sockaddr_in6 *)nd->nd_nam;
4086                 rin6->sin6_family = AF_INET6;
4087                 rin6->sin6_len = sizeof(struct sockaddr_in6);
4088                 rin6->sin6_port = 0;
4089                 rin6->sin6_addr = sin6->sin6_addr;
4090                 break;
4091 #endif
4092         }
4093         clp->lc_req.nr_cred = NULL;
4094         NFSBCOPY(verf, clp->lc_verf, NFSX_VERF);
4095         clp->lc_idlen = idlen;
4096         error = nfsrv_mtostr(nd, clp->lc_id, idlen);
4097         if (error != 0)
4098                 goto nfsmout;
4099         if ((nd->nd_flag & ND_GSS) != 0) {
4100                 clp->lc_flags = LCL_GSS | LCL_NFSV41;
4101                 if ((nd->nd_flag & ND_GSSINTEGRITY) != 0)
4102                         clp->lc_flags |= LCL_GSSINTEGRITY;
4103                 else if ((nd->nd_flag & ND_GSSPRIVACY) != 0)
4104                         clp->lc_flags |= LCL_GSSPRIVACY;
4105         } else
4106                 clp->lc_flags = LCL_NFSV41;
4107         if ((nd->nd_flag & ND_NFSV42) != 0)
4108                 clp->lc_flags |= LCL_NFSV42;
4109         if ((nd->nd_flag & ND_GSS) != 0 && nd->nd_princlen > 0) {
4110                 clp->lc_flags |= LCL_NAME;
4111                 clp->lc_namelen = nd->nd_princlen;
4112                 clp->lc_name = &clp->lc_id[idlen];
4113                 NFSBCOPY(nd->nd_principal, clp->lc_name, clp->lc_namelen);
4114         } else {
4115                 clp->lc_uid = nd->nd_cred->cr_uid;
4116                 clp->lc_gid = nd->nd_cred->cr_gid;
4117         }
4118         NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
4119         v41flags = fxdr_unsigned(uint32_t, *tl++);
4120         if ((v41flags & ~(NFSV4EXCH_SUPPMOVEDREFER | NFSV4EXCH_SUPPMOVEDMIGR |
4121             NFSV4EXCH_BINDPRINCSTATEID | NFSV4EXCH_MASKPNFS |
4122             NFSV4EXCH_UPDCONFIRMEDRECA)) != 0) {
4123                 nd->nd_repstat = NFSERR_INVAL;
4124                 goto nfsmout;
4125         }
4126         if ((v41flags & NFSV4EXCH_UPDCONFIRMEDRECA) != 0)
4127                 confirm.lval[1] = 1;
4128         else
4129                 confirm.lval[1] = 0;
4130         if (nfsrv_devidcnt == 0)
4131                 v41flags = NFSV4EXCH_USENONPNFS | NFSV4EXCH_USEPNFSDS;
4132         else
4133                 v41flags = NFSV4EXCH_USEPNFSMDS;
4134         sp4type = fxdr_unsigned(uint32_t, *tl);
4135         if (sp4type != NFSV4EXCH_SP4NONE) {
4136                 nd->nd_repstat = NFSERR_NOTSUPP;
4137                 goto nfsmout;
4138         }
4139
4140         /*
4141          * nfsrv_setclient() does the actual work of adding it to the
4142          * client list. If there is no error, the structure has been
4143          * linked into the client list and clp should no longer be used
4144          * here. When an error is returned, it has not been linked in,
4145          * so it should be free'd.
4146          */
4147         nd->nd_repstat = nfsrv_setclient(nd, &clp, &clientid, &confirm, p);
4148         if (clp != NULL) {
4149                 free(clp->lc_req.nr_nam, M_SONAME);
4150                 NFSFREEMUTEX(&clp->lc_req.nr_mtx);
4151                 free(clp->lc_stateid, M_NFSDCLIENT);
4152                 free(clp, M_NFSDCLIENT);
4153         }
4154         if (nd->nd_repstat == 0) {
4155                 if (confirm.lval[1] != 0)
4156                         v41flags |= NFSV4EXCH_CONFIRMEDR;
4157                 NFSM_BUILD(tl, uint32_t *, 2 * NFSX_HYPER + 3 * NFSX_UNSIGNED);
4158                 *tl++ = clientid.lval[0];                       /* ClientID */
4159                 *tl++ = clientid.lval[1];
4160                 *tl++ = txdr_unsigned(confirm.lval[0]);         /* SequenceID */
4161                 *tl++ = txdr_unsigned(v41flags);                /* Exch flags */
4162                 *tl++ = txdr_unsigned(NFSV4EXCH_SP4NONE);       /* No SSV */
4163                 owner_minor = 0;                                /* Owner */
4164                 txdr_hyper(owner_minor, tl);                    /* Minor */
4165                 (void)nfsm_strtom(nd, nd->nd_cred->cr_prison->pr_hostuuid,
4166                     strlen(nd->nd_cred->cr_prison->pr_hostuuid)); /* Major */
4167                 (void)nfsm_strtom(nd, nd->nd_cred->cr_prison->pr_hostuuid,
4168                     strlen(nd->nd_cred->cr_prison->pr_hostuuid)); /* Scope */
4169                 NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
4170                 *tl = txdr_unsigned(1);
4171                 (void)nfsm_strtom(nd, "freebsd.org", strlen("freebsd.org"));
4172                 (void)nfsm_strtom(nd, version, strlen(version));
4173                 NFSM_BUILD(tl, uint32_t *, NFSX_V4TIME);
4174                 verstime.tv_sec = 1293840000;           /* Jan 1, 2011 */
4175                 verstime.tv_nsec = 0;
4176                 txdr_nfsv4time(&verstime, tl);
4177         }
4178         NFSEXITCODE2(0, nd);
4179         return (0);
4180 nfsmout:
4181         if (clp != NULL) {
4182                 free(clp->lc_req.nr_nam, M_SONAME);
4183                 NFSFREEMUTEX(&clp->lc_req.nr_mtx);
4184                 free(clp->lc_stateid, M_NFSDCLIENT);
4185                 free(clp, M_NFSDCLIENT);
4186         }
4187         NFSEXITCODE2(error, nd);
4188         return (error);
4189 }
4190
4191 /*
4192  * nfsv4 create session service
4193  */
4194 int
4195 nfsrvd_createsession(struct nfsrv_descript *nd, __unused int isdgram,
4196     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4197 {
4198         uint32_t *tl;
4199         int error = 0;
4200         nfsquad_t clientid, confirm;
4201         struct nfsdsession *sep = NULL;
4202         uint32_t rdmacnt;
4203         struct thread *p = curthread;
4204
4205         if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
4206                 nd->nd_repstat = NFSERR_WRONGSEC;
4207                 goto nfsmout;
4208         }
4209         sep = (struct nfsdsession *)malloc(sizeof(struct nfsdsession),
4210             M_NFSDSESSION, M_WAITOK | M_ZERO);
4211         sep->sess_refcnt = 1;
4212         mtx_init(&sep->sess_cbsess.nfsess_mtx, "nfscbsession", NULL, MTX_DEF);
4213         NFSM_DISSECT(tl, uint32_t *, NFSX_HYPER + 2 * NFSX_UNSIGNED);
4214         clientid.lval[0] = *tl++;
4215         clientid.lval[1] = *tl++;
4216         confirm.lval[0] = fxdr_unsigned(uint32_t, *tl++);
4217         sep->sess_crflags = fxdr_unsigned(uint32_t, *tl);
4218         /* Persistent sessions and RDMA are not supported. */
4219         sep->sess_crflags &= NFSV4CRSESS_CONNBACKCHAN;
4220
4221         /* Fore channel attributes. */
4222         NFSM_DISSECT(tl, uint32_t *, 7 * NFSX_UNSIGNED);
4223         tl++;                                   /* Header pad always 0. */
4224         sep->sess_maxreq = fxdr_unsigned(uint32_t, *tl++);
4225         if (sep->sess_maxreq > sb_max_adj - NFS_MAXXDR) {
4226                 sep->sess_maxreq = sb_max_adj - NFS_MAXXDR;
4227                 printf("Consider increasing kern.ipc.maxsockbuf\n");
4228         }
4229         sep->sess_maxresp = fxdr_unsigned(uint32_t, *tl++);
4230         if (sep->sess_maxresp > sb_max_adj - NFS_MAXXDR) {
4231                 sep->sess_maxresp = sb_max_adj - NFS_MAXXDR;
4232                 printf("Consider increasing kern.ipc.maxsockbuf\n");
4233         }
4234         sep->sess_maxrespcached = fxdr_unsigned(uint32_t, *tl++);
4235         sep->sess_maxops = fxdr_unsigned(uint32_t, *tl++);
4236         sep->sess_maxslots = fxdr_unsigned(uint32_t, *tl++);
4237         if (sep->sess_maxslots > NFSV4_SLOTS)
4238                 sep->sess_maxslots = NFSV4_SLOTS;
4239         rdmacnt = fxdr_unsigned(uint32_t, *tl);
4240         if (rdmacnt > 1) {
4241                 nd->nd_repstat = NFSERR_BADXDR;
4242                 goto nfsmout;
4243         } else if (rdmacnt == 1)
4244                 NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
4245
4246         /* Back channel attributes. */
4247         NFSM_DISSECT(tl, uint32_t *, 7 * NFSX_UNSIGNED);
4248         tl++;                                   /* Header pad always 0. */
4249         sep->sess_cbmaxreq = fxdr_unsigned(uint32_t, *tl++);
4250         sep->sess_cbmaxresp = fxdr_unsigned(uint32_t, *tl++);
4251         sep->sess_cbmaxrespcached = fxdr_unsigned(uint32_t, *tl++);
4252         sep->sess_cbmaxops = fxdr_unsigned(uint32_t, *tl++);
4253         sep->sess_cbsess.nfsess_foreslots = fxdr_unsigned(uint32_t, *tl++);
4254         rdmacnt = fxdr_unsigned(uint32_t, *tl);
4255         if (rdmacnt > 1) {
4256                 nd->nd_repstat = NFSERR_BADXDR;
4257                 goto nfsmout;
4258         } else if (rdmacnt == 1)
4259                 NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
4260
4261         NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
4262         sep->sess_cbprogram = fxdr_unsigned(uint32_t, *tl);
4263
4264         /*
4265          * nfsrv_getclient() searches the client list for a match and
4266          * returns the appropriate NFSERR status.
4267          */
4268         nd->nd_repstat = nfsrv_getclient(clientid, CLOPS_CONFIRM | CLOPS_RENEW,
4269             NULL, sep, confirm, sep->sess_cbprogram, nd, p);
4270         if (nd->nd_repstat == 0) {
4271                 NFSM_BUILD(tl, uint32_t *, NFSX_V4SESSIONID);
4272                 NFSBCOPY(sep->sess_sessionid, tl, NFSX_V4SESSIONID);
4273                 NFSM_BUILD(tl, uint32_t *, 18 * NFSX_UNSIGNED);
4274                 *tl++ = txdr_unsigned(confirm.lval[0]); /* sequenceid */
4275                 *tl++ = txdr_unsigned(sep->sess_crflags);
4276
4277                 /* Fore channel attributes. */
4278                 *tl++ = 0;
4279                 *tl++ = txdr_unsigned(sep->sess_maxreq);
4280                 *tl++ = txdr_unsigned(sep->sess_maxresp);
4281                 *tl++ = txdr_unsigned(sep->sess_maxrespcached);
4282                 *tl++ = txdr_unsigned(sep->sess_maxops);
4283                 *tl++ = txdr_unsigned(sep->sess_maxslots);
4284                 *tl++ = txdr_unsigned(1);
4285                 *tl++ = txdr_unsigned(0);                       /* No RDMA. */
4286
4287                 /* Back channel attributes. */
4288                 *tl++ = 0;
4289                 *tl++ = txdr_unsigned(sep->sess_cbmaxreq);
4290                 *tl++ = txdr_unsigned(sep->sess_cbmaxresp);
4291                 *tl++ = txdr_unsigned(sep->sess_cbmaxrespcached);
4292                 *tl++ = txdr_unsigned(sep->sess_cbmaxops);
4293                 *tl++ = txdr_unsigned(sep->sess_cbsess.nfsess_foreslots);
4294                 *tl++ = txdr_unsigned(1);
4295                 *tl = txdr_unsigned(0);                 /* No RDMA. */
4296         }
4297 nfsmout:
4298         if (nd->nd_repstat != 0 && sep != NULL)
4299                 free(sep, M_NFSDSESSION);
4300         NFSEXITCODE2(error, nd);
4301         return (error);
4302 }
4303
4304 /*
4305  * nfsv4 sequence service
4306  */
4307 int
4308 nfsrvd_sequence(struct nfsrv_descript *nd, __unused int isdgram,
4309     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4310 {
4311         uint32_t *tl;
4312         uint32_t highest_slotid, sequenceid, sflags, target_highest_slotid;
4313         int cache_this, error = 0;
4314         struct thread *p = curthread;
4315
4316         if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
4317                 nd->nd_repstat = NFSERR_WRONGSEC;
4318                 goto nfsmout;
4319         }
4320         NFSM_DISSECT(tl, uint32_t *, NFSX_V4SESSIONID);
4321         NFSBCOPY(tl, nd->nd_sessionid, NFSX_V4SESSIONID);
4322         NFSM_DISSECT(tl, uint32_t *, 4 * NFSX_UNSIGNED);
4323         sequenceid = fxdr_unsigned(uint32_t, *tl++);
4324         nd->nd_slotid = fxdr_unsigned(uint32_t, *tl++);
4325         highest_slotid = fxdr_unsigned(uint32_t, *tl++);
4326         if (*tl == newnfs_true)
4327                 cache_this = 1;
4328         else
4329                 cache_this = 0;
4330         nd->nd_flag |= ND_HASSEQUENCE;
4331         nd->nd_repstat = nfsrv_checksequence(nd, sequenceid, &highest_slotid,
4332             &target_highest_slotid, cache_this, &sflags, p);
4333         if (nd->nd_repstat == 0) {
4334                 NFSM_BUILD(tl, uint32_t *, NFSX_V4SESSIONID);
4335                 NFSBCOPY(nd->nd_sessionid, tl, NFSX_V4SESSIONID);
4336                 NFSM_BUILD(tl, uint32_t *, 5 * NFSX_UNSIGNED);
4337                 *tl++ = txdr_unsigned(sequenceid);
4338                 *tl++ = txdr_unsigned(nd->nd_slotid);
4339                 *tl++ = txdr_unsigned(highest_slotid);
4340                 *tl++ = txdr_unsigned(target_highest_slotid);
4341                 *tl = txdr_unsigned(sflags);
4342         }
4343 nfsmout:
4344         NFSEXITCODE2(error, nd);
4345         return (error);
4346 }
4347
4348 /*
4349  * nfsv4 reclaim complete service
4350  */
4351 int
4352 nfsrvd_reclaimcomplete(struct nfsrv_descript *nd, __unused int isdgram,
4353     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4354 {
4355         uint32_t *tl;
4356         int error = 0, onefs;
4357
4358         if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
4359                 nd->nd_repstat = NFSERR_WRONGSEC;
4360                 goto nfsmout;
4361         }
4362         NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
4363         /*
4364          * I believe that a ReclaimComplete with rca_one_fs == TRUE is only
4365          * to be used after a file system has been transferred to a different
4366          * file server.  However, RFC5661 is somewhat vague w.r.t. this and
4367          * the ESXi 6.7 client does both a ReclaimComplete with rca_one_fs
4368          * == TRUE and one with ReclaimComplete with rca_one_fs == FALSE.
4369          * Therefore, just ignore the rca_one_fs == TRUE operation and return
4370          * NFS_OK without doing anything.
4371          */
4372         onefs = 0;
4373         if (*tl == newnfs_true)
4374                 onefs = 1;
4375         nd->nd_repstat = nfsrv_checkreclaimcomplete(nd, onefs);
4376 nfsmout:
4377         NFSEXITCODE2(error, nd);
4378         return (error);
4379 }
4380
4381 /*
4382  * nfsv4 destroy clientid service
4383  */
4384 int
4385 nfsrvd_destroyclientid(struct nfsrv_descript *nd, __unused int isdgram,
4386     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4387 {
4388         uint32_t *tl;
4389         nfsquad_t clientid;
4390         int error = 0;
4391         struct thread *p = curthread;
4392
4393         if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
4394                 nd->nd_repstat = NFSERR_WRONGSEC;
4395                 goto nfsmout;
4396         }
4397         NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_UNSIGNED);
4398         clientid.lval[0] = *tl++;
4399         clientid.lval[1] = *tl;
4400         nd->nd_repstat = nfsrv_destroyclient(clientid, p);
4401 nfsmout:
4402         NFSEXITCODE2(error, nd);
4403         return (error);
4404 }
4405
4406 /*
4407  * nfsv4 bind connection to session service
4408  */
4409 int
4410 nfsrvd_bindconnsess(struct nfsrv_descript *nd, __unused int isdgram,
4411     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4412 {
4413         uint32_t *tl;
4414         uint8_t sessid[NFSX_V4SESSIONID];
4415         int error = 0, foreaft;
4416
4417         if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
4418                 nd->nd_repstat = NFSERR_WRONGSEC;
4419                 goto nfsmout;
4420         }
4421         NFSM_DISSECT(tl, uint32_t *, NFSX_V4SESSIONID + 2 * NFSX_UNSIGNED);
4422         NFSBCOPY(tl, sessid, NFSX_V4SESSIONID);
4423         tl += (NFSX_V4SESSIONID / NFSX_UNSIGNED);
4424         foreaft = fxdr_unsigned(int, *tl++);
4425         if (*tl == newnfs_true) {
4426                 /* RDMA is not supported. */
4427                 nd->nd_repstat = NFSERR_NOTSUPP;
4428                 goto nfsmout;
4429         }
4430
4431         nd->nd_repstat = nfsrv_bindconnsess(nd, sessid, &foreaft);
4432         if (nd->nd_repstat == 0) {
4433                 NFSM_BUILD(tl, uint32_t *, NFSX_V4SESSIONID + 2 *
4434                     NFSX_UNSIGNED);
4435                 NFSBCOPY(sessid, tl, NFSX_V4SESSIONID);
4436                 tl += (NFSX_V4SESSIONID / NFSX_UNSIGNED);
4437                 *tl++ = txdr_unsigned(foreaft);
4438                 *tl = newnfs_false;
4439         }
4440 nfsmout:
4441         NFSEXITCODE2(error, nd);
4442         return (error);
4443 }
4444
4445 /*
4446  * nfsv4 destroy session service
4447  */
4448 int
4449 nfsrvd_destroysession(struct nfsrv_descript *nd, __unused int isdgram,
4450     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4451 {
4452         uint8_t *cp, sessid[NFSX_V4SESSIONID];
4453         int error = 0;
4454
4455         if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
4456                 nd->nd_repstat = NFSERR_WRONGSEC;
4457                 goto nfsmout;
4458         }
4459         NFSM_DISSECT(cp, uint8_t *, NFSX_V4SESSIONID);
4460         NFSBCOPY(cp, sessid, NFSX_V4SESSIONID);
4461         nd->nd_repstat = nfsrv_destroysession(nd, sessid);
4462 nfsmout:
4463         NFSEXITCODE2(error, nd);
4464         return (error);
4465 }
4466
4467 /*
4468  * nfsv4 free stateid service
4469  */
4470 int
4471 nfsrvd_freestateid(struct nfsrv_descript *nd, __unused int isdgram,
4472     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4473 {
4474         uint32_t *tl;
4475         nfsv4stateid_t stateid;
4476         int error = 0;
4477         struct thread *p = curthread;
4478
4479         if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
4480                 nd->nd_repstat = NFSERR_WRONGSEC;
4481                 goto nfsmout;
4482         }
4483         NFSM_DISSECT(tl, uint32_t *, NFSX_STATEID);
4484         stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
4485         NFSBCOPY(tl, stateid.other, NFSX_STATEIDOTHER);
4486
4487         /*
4488          * For the special stateid of other all 0s and seqid == 1, set the
4489          * stateid to the current stateid, if it is set.
4490          */
4491         if (stateid.seqid == 1 && stateid.other[0] == 0 &&
4492             stateid.other[1] == 0 && stateid.other[2] == 0) {
4493                 if ((nd->nd_flag & ND_CURSTATEID) != 0) {
4494                         stateid = nd->nd_curstateid;
4495                         stateid.seqid = 0;
4496                 } else {
4497                         nd->nd_repstat = NFSERR_BADSTATEID;
4498                         goto nfsmout;
4499                 }
4500         }
4501
4502         nd->nd_repstat = nfsrv_freestateid(nd, &stateid, p);
4503
4504         /* If the current stateid has been free'd, unset it. */
4505         if (nd->nd_repstat == 0 && (nd->nd_flag & ND_CURSTATEID) != 0 &&
4506             stateid.other[0] == nd->nd_curstateid.other[0] &&
4507             stateid.other[1] == nd->nd_curstateid.other[1] &&
4508             stateid.other[2] == nd->nd_curstateid.other[2])
4509                 nd->nd_flag &= ~ND_CURSTATEID;
4510 nfsmout:
4511         NFSEXITCODE2(error, nd);
4512         return (error);
4513 }
4514
4515 /*
4516  * nfsv4 layoutget service
4517  */
4518 int
4519 nfsrvd_layoutget(struct nfsrv_descript *nd, __unused int isdgram,
4520     vnode_t vp, struct nfsexstuff *exp)
4521 {
4522         uint32_t *tl;
4523         nfsv4stateid_t stateid;
4524         int error = 0, layoutlen, layouttype, iomode, maxcnt, retonclose;
4525         uint64_t offset, len, minlen;
4526         char *layp;
4527         struct thread *p = curthread;
4528
4529         if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
4530                 nd->nd_repstat = NFSERR_WRONGSEC;
4531                 goto nfsmout;
4532         }
4533         NFSM_DISSECT(tl, uint32_t *, 4 * NFSX_UNSIGNED + 3 * NFSX_HYPER +
4534             NFSX_STATEID);
4535         tl++;           /* Signal layout available. Ignore for now. */
4536         layouttype = fxdr_unsigned(int, *tl++);
4537         iomode = fxdr_unsigned(int, *tl++);
4538         offset = fxdr_hyper(tl); tl += 2;
4539         len = fxdr_hyper(tl); tl += 2;
4540         minlen = fxdr_hyper(tl); tl += 2;
4541         stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
4542         NFSBCOPY(tl, stateid.other, NFSX_STATEIDOTHER);
4543         tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
4544         maxcnt = fxdr_unsigned(int, *tl);
4545         NFSD_DEBUG(4, "layoutget ltyp=%d iom=%d off=%ju len=%ju mlen=%ju\n",
4546             layouttype, iomode, (uintmax_t)offset, (uintmax_t)len,
4547             (uintmax_t)minlen);
4548         if (len < minlen ||
4549             (minlen != UINT64_MAX && offset + minlen < offset) ||
4550             (len != UINT64_MAX && offset + len < offset)) {
4551                 nd->nd_repstat = NFSERR_INVAL;
4552                 goto nfsmout;
4553         }
4554
4555         /*
4556          * For the special stateid of other all 0s and seqid == 1, set the
4557          * stateid to the current stateid, if it is set.
4558          */
4559         if (stateid.seqid == 1 && stateid.other[0] == 0 &&
4560             stateid.other[1] == 0 && stateid.other[2] == 0) {
4561                 if ((nd->nd_flag & ND_CURSTATEID) != 0) {
4562                         stateid = nd->nd_curstateid;
4563                         stateid.seqid = 0;
4564                 } else {
4565                         nd->nd_repstat = NFSERR_BADSTATEID;
4566                         goto nfsmout;
4567                 }
4568         }
4569
4570         layp = NULL;
4571         if (layouttype == NFSLAYOUT_NFSV4_1_FILES && nfsrv_maxpnfsmirror == 1)
4572                 layp = malloc(NFSX_V4FILELAYOUT, M_TEMP, M_WAITOK);
4573         else if (layouttype == NFSLAYOUT_FLEXFILE)
4574                 layp = malloc(NFSX_V4FLEXLAYOUT(nfsrv_maxpnfsmirror), M_TEMP,
4575                     M_WAITOK);
4576         else
4577                 nd->nd_repstat = NFSERR_UNKNLAYOUTTYPE;
4578         if (layp != NULL)
4579                 nd->nd_repstat = nfsrv_layoutget(nd, vp, exp, layouttype,
4580                     &iomode, &offset, &len, minlen, &stateid, maxcnt,
4581                     &retonclose, &layoutlen, layp, nd->nd_cred, p);
4582         NFSD_DEBUG(4, "nfsrv_layoutget stat=%u layoutlen=%d\n", nd->nd_repstat,
4583             layoutlen);
4584         if (nd->nd_repstat == 0) {
4585                 /* For NFSv4.1, set the Current StateID. */
4586                 if ((nd->nd_flag & ND_NFSV41) != 0) {
4587                         nd->nd_curstateid = stateid;
4588                         nd->nd_flag |= ND_CURSTATEID;
4589                 }
4590                 NFSM_BUILD(tl, uint32_t *, 4 * NFSX_UNSIGNED + NFSX_STATEID +
4591                     2 * NFSX_HYPER);
4592                 *tl++ = txdr_unsigned(retonclose);
4593                 *tl++ = txdr_unsigned(stateid.seqid);
4594                 NFSBCOPY(stateid.other, tl, NFSX_STATEIDOTHER);
4595                 tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
4596                 *tl++ = txdr_unsigned(1);       /* Only returns one layout. */
4597                 txdr_hyper(offset, tl); tl += 2;
4598                 txdr_hyper(len, tl); tl += 2;
4599                 *tl++ = txdr_unsigned(iomode);
4600                 *tl = txdr_unsigned(layouttype);
4601                 nfsm_strtom(nd, layp, layoutlen);
4602         } else if (nd->nd_repstat == NFSERR_LAYOUTTRYLATER) {
4603                 NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
4604                 *tl = newnfs_false;
4605         }
4606         free(layp, M_TEMP);
4607 nfsmout:
4608         vput(vp);
4609         NFSEXITCODE2(error, nd);
4610         return (error);
4611 }
4612
4613 /*
4614  * nfsv4 layoutcommit service
4615  */
4616 int
4617 nfsrvd_layoutcommit(struct nfsrv_descript *nd, __unused int isdgram,
4618     vnode_t vp, struct nfsexstuff *exp)
4619 {
4620         uint32_t *tl;
4621         nfsv4stateid_t stateid;
4622         int error = 0, hasnewoff, hasnewmtime, layouttype, maxcnt, reclaim;
4623         int hasnewsize;
4624         uint64_t offset, len, newoff = 0, newsize;
4625         struct timespec newmtime;
4626         char *layp;
4627         struct thread *p = curthread;
4628
4629         layp = NULL;
4630         if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
4631                 nd->nd_repstat = NFSERR_WRONGSEC;
4632                 goto nfsmout;
4633         }
4634         NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_UNSIGNED + 2 * NFSX_HYPER +
4635             NFSX_STATEID);
4636         offset = fxdr_hyper(tl); tl += 2;
4637         len = fxdr_hyper(tl); tl += 2;
4638         reclaim = fxdr_unsigned(int, *tl++);
4639         stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
4640         NFSBCOPY(tl, stateid.other, NFSX_STATEIDOTHER);
4641         tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
4642         /*
4643          * For the special stateid of other all 0s and seqid == 1, set the
4644          * stateid to the current stateid, if it is set.
4645          */
4646         if (stateid.seqid == 1 && stateid.other[0] == 0 &&
4647             stateid.other[1] == 0 && stateid.other[2] == 0) {
4648                 if ((nd->nd_flag & ND_CURSTATEID) != 0) {
4649                         stateid = nd->nd_curstateid;
4650                         stateid.seqid = 0;
4651                 } else {
4652                         nd->nd_repstat = NFSERR_BADSTATEID;
4653                         goto nfsmout;
4654                 }
4655         }
4656
4657         hasnewoff = fxdr_unsigned(int, *tl);
4658         if (hasnewoff != 0) {
4659                 NFSM_DISSECT(tl, uint32_t *, NFSX_HYPER + NFSX_UNSIGNED);
4660                 newoff = fxdr_hyper(tl); tl += 2;
4661         } else
4662                 NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
4663         hasnewmtime = fxdr_unsigned(int, *tl);
4664         if (hasnewmtime != 0) {
4665                 NFSM_DISSECT(tl, uint32_t *, NFSX_V4TIME + 2 * NFSX_UNSIGNED);
4666                 fxdr_nfsv4time(tl, &newmtime);
4667                 tl += (NFSX_V4TIME / NFSX_UNSIGNED);
4668         } else
4669                 NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_UNSIGNED);
4670         layouttype = fxdr_unsigned(int, *tl++);
4671         maxcnt = fxdr_unsigned(int, *tl);
4672         if (maxcnt > 0) {
4673                 layp = malloc(maxcnt + 1, M_TEMP, M_WAITOK);
4674                 error = nfsrv_mtostr(nd, layp, maxcnt);
4675                 if (error != 0)
4676                         goto nfsmout;
4677         }
4678         nd->nd_repstat = nfsrv_layoutcommit(nd, vp, layouttype, hasnewoff,
4679             newoff, offset, len, hasnewmtime, &newmtime, reclaim, &stateid,
4680             maxcnt, layp, &hasnewsize, &newsize, nd->nd_cred, p);
4681         NFSD_DEBUG(4, "nfsrv_layoutcommit stat=%u\n", nd->nd_repstat);
4682         if (nd->nd_repstat == 0) {
4683                 if (hasnewsize != 0) {
4684                         NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED + NFSX_HYPER);
4685                         *tl++ = newnfs_true;
4686                         txdr_hyper(newsize, tl);
4687                 } else {
4688                         NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
4689                         *tl = newnfs_false;
4690                 }
4691         }
4692 nfsmout:
4693         free(layp, M_TEMP);
4694         vput(vp);
4695         NFSEXITCODE2(error, nd);
4696         return (error);
4697 }
4698
4699 /*
4700  * nfsv4 layoutreturn service
4701  */
4702 int
4703 nfsrvd_layoutreturn(struct nfsrv_descript *nd, __unused int isdgram,
4704     vnode_t vp, struct nfsexstuff *exp)
4705 {
4706         uint32_t *tl, *layp;
4707         nfsv4stateid_t stateid;
4708         int error = 0, fnd, kind, layouttype, iomode, maxcnt, reclaim;
4709         uint64_t offset, len;
4710         struct thread *p = curthread;
4711
4712         layp = NULL;
4713         if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
4714                 nd->nd_repstat = NFSERR_WRONGSEC;
4715                 goto nfsmout;
4716         }
4717         NFSM_DISSECT(tl, uint32_t *, 4 * NFSX_UNSIGNED);
4718         reclaim = *tl++;
4719         layouttype = fxdr_unsigned(int, *tl++);
4720         iomode = fxdr_unsigned(int, *tl++);
4721         kind = fxdr_unsigned(int, *tl);
4722         NFSD_DEBUG(4, "layoutreturn recl=%d ltyp=%d iom=%d kind=%d\n", reclaim,
4723             layouttype, iomode, kind);
4724         if (kind == NFSV4LAYOUTRET_FILE) {
4725                 NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_HYPER + NFSX_STATEID +
4726                     NFSX_UNSIGNED);
4727                 offset = fxdr_hyper(tl); tl += 2;
4728                 len = fxdr_hyper(tl); tl += 2;
4729                 stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
4730                 NFSBCOPY(tl, stateid.other, NFSX_STATEIDOTHER);
4731                 tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
4732
4733                 /*
4734                  * For the special stateid of other all 0s and seqid == 1, set
4735                  * the stateid to the current stateid, if it is set.
4736                  */
4737                 if (stateid.seqid == 1 && stateid.other[0] == 0 &&
4738                     stateid.other[1] == 0 && stateid.other[2] == 0) {
4739                         if ((nd->nd_flag & ND_CURSTATEID) != 0) {
4740                                 stateid = nd->nd_curstateid;
4741                                 stateid.seqid = 0;
4742                         } else {
4743                                 nd->nd_repstat = NFSERR_BADSTATEID;
4744                                 goto nfsmout;
4745                         }
4746                 }
4747
4748                 maxcnt = fxdr_unsigned(int, *tl);
4749                 if (maxcnt > 0) {
4750                         layp = malloc(maxcnt + 1, M_TEMP, M_WAITOK);
4751                         error = nfsrv_mtostr(nd, (char *)layp, maxcnt);
4752                         if (error != 0)
4753                                 goto nfsmout;
4754                 }
4755         } else {
4756                 if (reclaim == newnfs_true) {
4757                         nd->nd_repstat = NFSERR_INVAL;
4758                         goto nfsmout;
4759                 }
4760                 offset = len = 0;
4761                 maxcnt = 0;
4762         }
4763         nd->nd_repstat = nfsrv_layoutreturn(nd, vp, layouttype, iomode,
4764             offset, len, reclaim, kind, &stateid, maxcnt, layp, &fnd,
4765             nd->nd_cred, p);
4766         NFSD_DEBUG(4, "nfsrv_layoutreturn stat=%u fnd=%d\n", nd->nd_repstat,
4767             fnd);
4768         if (nd->nd_repstat == 0) {
4769                 NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
4770                 if (fnd != 0) {
4771                         *tl = newnfs_true;
4772                         NFSM_BUILD(tl, uint32_t *, NFSX_STATEID);
4773                         *tl++ = txdr_unsigned(stateid.seqid);
4774                         NFSBCOPY(stateid.other, tl, NFSX_STATEIDOTHER);
4775                 } else
4776                         *tl = newnfs_false;
4777         }
4778 nfsmout:
4779         free(layp, M_TEMP);
4780         vput(vp);
4781         NFSEXITCODE2(error, nd);
4782         return (error);
4783 }
4784
4785 /*
4786  * nfsv4 layout error service
4787  */
4788 int
4789 nfsrvd_layouterror(struct nfsrv_descript *nd, __unused int isdgram,
4790     vnode_t vp, struct nfsexstuff *exp)
4791 {
4792         uint32_t *tl;
4793         nfsv4stateid_t stateid;
4794         int cnt, error = 0, i, stat;
4795         int opnum __unused;
4796         char devid[NFSX_V4DEVICEID];
4797         uint64_t offset, len;
4798
4799         if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
4800                 nd->nd_repstat = NFSERR_WRONGSEC;
4801                 goto nfsmout;
4802         }
4803         NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_HYPER + NFSX_STATEID +
4804             NFSX_UNSIGNED);
4805         offset = fxdr_hyper(tl); tl += 2;
4806         len = fxdr_hyper(tl); tl += 2;
4807         stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
4808         NFSBCOPY(tl, stateid.other, NFSX_STATEIDOTHER);
4809         tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
4810         cnt = fxdr_unsigned(int, *tl);
4811         NFSD_DEBUG(4, "layouterror off=%ju len=%ju cnt=%d\n", (uintmax_t)offset,
4812             (uintmax_t)len, cnt);
4813         /*
4814          * For the special stateid of other all 0s and seqid == 1, set
4815          * the stateid to the current stateid, if it is set.
4816          */
4817         if (stateid.seqid == 1 && stateid.other[0] == 0 &&
4818             stateid.other[1] == 0 && stateid.other[2] == 0) {
4819                 if ((nd->nd_flag & ND_CURSTATEID) != 0) {
4820                         stateid = nd->nd_curstateid;
4821                         stateid.seqid = 0;
4822                 } else {
4823                         nd->nd_repstat = NFSERR_BADSTATEID;
4824                         goto nfsmout;
4825                 }
4826         }
4827
4828         /*
4829          * Ignore offset, len and stateid for now.
4830          */
4831         for (i = 0; i < cnt; i++) {
4832                 NFSM_DISSECT(tl, uint32_t *, NFSX_V4DEVICEID + 2 *
4833                     NFSX_UNSIGNED);
4834                 NFSBCOPY(tl, devid, NFSX_V4DEVICEID);
4835                 tl += (NFSX_V4DEVICEID / NFSX_UNSIGNED);
4836                 stat = fxdr_unsigned(int, *tl++);
4837                 opnum = fxdr_unsigned(int, *tl);
4838                 NFSD_DEBUG(4, "nfsrvd_layouterr op=%d stat=%d\n", opnum, stat);
4839                 /*
4840                  * Except for NFSERR_ACCES and NFSERR_STALE errors,
4841                  * disable the mirror.
4842                  */
4843                 if (stat != NFSERR_ACCES && stat != NFSERR_STALE)
4844                         nfsrv_delds(devid, curthread);
4845         }
4846 nfsmout:
4847         vput(vp);
4848         NFSEXITCODE2(error, nd);
4849         return (error);
4850 }
4851
4852 /*
4853  * nfsv4 layout stats service
4854  */
4855 int
4856 nfsrvd_layoutstats(struct nfsrv_descript *nd, __unused int isdgram,
4857     vnode_t vp, struct nfsexstuff *exp)
4858 {
4859         uint32_t *tl;
4860         nfsv4stateid_t stateid;
4861         int cnt, error = 0;
4862         int layouttype __unused;
4863         char devid[NFSX_V4DEVICEID] __unused;
4864         uint64_t offset, len, readcount, readbytes, writecount, writebytes
4865             __unused;
4866
4867         if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
4868                 nd->nd_repstat = NFSERR_WRONGSEC;
4869                 goto nfsmout;
4870         }
4871         NFSM_DISSECT(tl, uint32_t *, 6 * NFSX_HYPER + NFSX_STATEID +
4872             NFSX_V4DEVICEID + 2 * NFSX_UNSIGNED);
4873         offset = fxdr_hyper(tl); tl += 2;
4874         len = fxdr_hyper(tl); tl += 2;
4875         stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
4876         NFSBCOPY(tl, stateid.other, NFSX_STATEIDOTHER);
4877         tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
4878         readcount = fxdr_hyper(tl); tl += 2;
4879         readbytes = fxdr_hyper(tl); tl += 2;
4880         writecount = fxdr_hyper(tl); tl += 2;
4881         writebytes = fxdr_hyper(tl); tl += 2;
4882         NFSBCOPY(tl, devid, NFSX_V4DEVICEID);
4883         tl += (NFSX_V4DEVICEID / NFSX_UNSIGNED);
4884         layouttype = fxdr_unsigned(int, *tl++);
4885         cnt = fxdr_unsigned(int, *tl);
4886         error = nfsm_advance(nd, NFSM_RNDUP(cnt), -1);
4887         if (error != 0)
4888                 goto nfsmout;
4889         NFSD_DEBUG(4, "layoutstats cnt=%d\n", cnt);
4890         /*
4891          * For the special stateid of other all 0s and seqid == 1, set
4892          * the stateid to the current stateid, if it is set.
4893          */
4894         if (stateid.seqid == 1 && stateid.other[0] == 0 &&
4895             stateid.other[1] == 0 && stateid.other[2] == 0) {
4896                 if ((nd->nd_flag & ND_CURSTATEID) != 0) {
4897                         stateid = nd->nd_curstateid;
4898                         stateid.seqid = 0;
4899                 } else {
4900                         nd->nd_repstat = NFSERR_BADSTATEID;
4901                         goto nfsmout;
4902                 }
4903         }
4904
4905         /*
4906          * No use for the stats for now.
4907          */
4908 nfsmout:
4909         vput(vp);
4910         NFSEXITCODE2(error, nd);
4911         return (error);
4912 }
4913
4914 /*
4915  * nfsv4 io_advise service
4916  */
4917 int
4918 nfsrvd_ioadvise(struct nfsrv_descript *nd, __unused int isdgram,
4919     vnode_t vp, struct nfsexstuff *exp)
4920 {
4921         uint32_t *tl;
4922         nfsv4stateid_t stateid;
4923         nfsattrbit_t hints;
4924         int error = 0, ret;
4925         off_t offset, len;
4926
4927         if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
4928                 nd->nd_repstat = NFSERR_WRONGSEC;
4929                 goto nfsmout;
4930         }
4931         NFSM_DISSECT(tl, uint32_t *, NFSX_STATEID + 2 * NFSX_HYPER);
4932         stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
4933         NFSBCOPY(tl, stateid.other, NFSX_STATEIDOTHER);
4934         tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
4935         offset = fxdr_hyper(tl); tl += 2;
4936         len = fxdr_hyper(tl);
4937         error = nfsrv_getattrbits(nd, &hints, NULL, NULL);
4938         if (error != 0)
4939                 goto nfsmout;
4940         /*
4941          * For the special stateid of other all 0s and seqid == 1, set
4942          * the stateid to the current stateid, if it is set.
4943          */
4944         if (stateid.seqid == 1 && stateid.other[0] == 0 &&
4945             stateid.other[1] == 0 && stateid.other[2] == 0) {
4946                 if ((nd->nd_flag & ND_CURSTATEID) != 0) {
4947                         stateid = nd->nd_curstateid;
4948                         stateid.seqid = 0;
4949                 } else {
4950                         nd->nd_repstat = NFSERR_BADSTATEID;
4951                         goto nfsmout;
4952                 }
4953         }
4954
4955         if (offset < 0) {
4956                 nd->nd_repstat = NFSERR_INVAL;
4957                 goto nfsmout;
4958         }
4959         if (len < 0)
4960                 len = 0;
4961         if (vp->v_type != VREG) {
4962                 if (vp->v_type == VDIR)
4963                         nd->nd_repstat = NFSERR_ISDIR;
4964                 else
4965                         nd->nd_repstat = NFSERR_WRONGTYPE;
4966                 goto nfsmout;
4967         }
4968
4969         /*
4970          * For now, we can only handle WILLNEED and DONTNEED and don't use
4971          * the stateid.
4972          */
4973         if ((NFSISSET_ATTRBIT(&hints, NFSV4IOHINT_WILLNEED) &&
4974             !NFSISSET_ATTRBIT(&hints, NFSV4IOHINT_DONTNEED)) ||
4975             (NFSISSET_ATTRBIT(&hints, NFSV4IOHINT_DONTNEED) &&
4976             !NFSISSET_ATTRBIT(&hints, NFSV4IOHINT_WILLNEED))) {
4977                 NFSVOPUNLOCK(vp);
4978                 if (NFSISSET_ATTRBIT(&hints, NFSV4IOHINT_WILLNEED)) {
4979                         ret = VOP_ADVISE(vp, offset, len, POSIX_FADV_WILLNEED);
4980                         NFSZERO_ATTRBIT(&hints);
4981                         if (ret == 0)
4982                                 NFSSETBIT_ATTRBIT(&hints, NFSV4IOHINT_WILLNEED);
4983                         else
4984                                 NFSSETBIT_ATTRBIT(&hints, NFSV4IOHINT_NORMAL);
4985                 } else {
4986                         ret = VOP_ADVISE(vp, offset, len, POSIX_FADV_DONTNEED);
4987                         NFSZERO_ATTRBIT(&hints);
4988                         if (ret == 0)
4989                                 NFSSETBIT_ATTRBIT(&hints, NFSV4IOHINT_DONTNEED);
4990                         else
4991                                 NFSSETBIT_ATTRBIT(&hints, NFSV4IOHINT_NORMAL);
4992                 }
4993                 vrele(vp);
4994         } else {
4995                 NFSZERO_ATTRBIT(&hints);
4996                 NFSSETBIT_ATTRBIT(&hints, NFSV4IOHINT_NORMAL);
4997                 vput(vp);
4998         }
4999         nfsrv_putattrbit(nd, &hints);
5000         NFSEXITCODE2(error, nd);
5001         return (error);
5002 nfsmout:
5003         vput(vp);
5004         NFSEXITCODE2(error, nd);
5005         return (error);
5006 }
5007
5008 /*
5009  * nfsv4 getdeviceinfo service
5010  */
5011 int
5012 nfsrvd_getdevinfo(struct nfsrv_descript *nd, __unused int isdgram,
5013     __unused vnode_t vp, __unused struct nfsexstuff *exp)
5014 {
5015         uint32_t *tl, maxcnt, notify[NFSV4_NOTIFYBITMAP];
5016         int cnt, devaddrlen, error = 0, i, layouttype;
5017         char devid[NFSX_V4DEVICEID], *devaddr;
5018         time_t dev_time;
5019
5020         if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
5021                 nd->nd_repstat = NFSERR_WRONGSEC;
5022                 goto nfsmout;
5023         }
5024         NFSM_DISSECT(tl, uint32_t *, 3 * NFSX_UNSIGNED + NFSX_V4DEVICEID);
5025         NFSBCOPY(tl, devid, NFSX_V4DEVICEID);
5026         tl += (NFSX_V4DEVICEID / NFSX_UNSIGNED);
5027         layouttype = fxdr_unsigned(int, *tl++);
5028         maxcnt = fxdr_unsigned(uint32_t, *tl++);
5029         cnt = fxdr_unsigned(int, *tl);
5030         NFSD_DEBUG(4, "getdevinfo ltyp=%d maxcnt=%u bitcnt=%d\n", layouttype,
5031             maxcnt, cnt);
5032         if (cnt > NFSV4_NOTIFYBITMAP || cnt < 0) {
5033                 nd->nd_repstat = NFSERR_INVAL;
5034                 goto nfsmout;
5035         }
5036         if (cnt > 0) {
5037                 NFSM_DISSECT(tl, uint32_t *, cnt * NFSX_UNSIGNED);
5038                 for (i = 0; i < cnt; i++)
5039                         notify[i] = fxdr_unsigned(uint32_t, *tl++);
5040         }
5041         for (i = cnt; i < NFSV4_NOTIFYBITMAP; i++)
5042                 notify[i] = 0;
5043
5044         /*
5045          * Check that the device id is not stale.  Device ids are recreated
5046          * each time the nfsd threads are restarted.
5047          */
5048         NFSBCOPY(devid, &dev_time, sizeof(dev_time));
5049         if (dev_time != nfsdev_time) {
5050                 nd->nd_repstat = NFSERR_NOENT;
5051                 goto nfsmout;
5052         }
5053
5054         /* Look for the device id. */
5055         nd->nd_repstat = nfsrv_getdevinfo(devid, layouttype, &maxcnt,
5056             notify, &devaddrlen, &devaddr);
5057         NFSD_DEBUG(4, "nfsrv_getdevinfo stat=%u\n", nd->nd_repstat);
5058         if (nd->nd_repstat == 0) {
5059                 NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
5060                 *tl = txdr_unsigned(layouttype);
5061                 nfsm_strtom(nd, devaddr, devaddrlen);
5062                 cnt = 0;
5063                 for (i = 0; i < NFSV4_NOTIFYBITMAP; i++) {
5064                         if (notify[i] != 0)
5065                                 cnt = i + 1;
5066                 }
5067                 NFSM_BUILD(tl, uint32_t *, (cnt + 1) * NFSX_UNSIGNED);
5068                 *tl++ = txdr_unsigned(cnt);
5069                 for (i = 0; i < cnt; i++)
5070                         *tl++ = txdr_unsigned(notify[i]);
5071         } else if (nd->nd_repstat == NFSERR_TOOSMALL) {
5072                 NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
5073                 *tl = txdr_unsigned(maxcnt);
5074         }
5075 nfsmout:
5076         NFSEXITCODE2(error, nd);
5077         return (error);
5078 }
5079
5080 /*
5081  * nfsv4 test stateid service
5082  */
5083 int
5084 nfsrvd_teststateid(struct nfsrv_descript *nd, __unused int isdgram,
5085     __unused vnode_t vp, __unused struct nfsexstuff *exp)
5086 {
5087         uint32_t *tl;
5088         nfsv4stateid_t *stateidp = NULL, *tstateidp;
5089         int cnt, error = 0, i, ret;
5090         struct thread *p = curthread;
5091
5092         if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
5093                 nd->nd_repstat = NFSERR_WRONGSEC;
5094                 goto nfsmout;
5095         }
5096         NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
5097         cnt = fxdr_unsigned(int, *tl);
5098         if (cnt <= 0 || cnt > 1024) {
5099                 nd->nd_repstat = NFSERR_BADXDR;
5100                 goto nfsmout;
5101         }
5102         stateidp = mallocarray(cnt, sizeof(nfsv4stateid_t), M_TEMP, M_WAITOK);
5103         tstateidp = stateidp;
5104         for (i = 0; i < cnt; i++) {
5105                 NFSM_DISSECT(tl, uint32_t *, NFSX_STATEID);
5106                 tstateidp->seqid = fxdr_unsigned(uint32_t, *tl++);
5107                 NFSBCOPY(tl, tstateidp->other, NFSX_STATEIDOTHER);
5108                 tstateidp++;
5109         }
5110         NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
5111         *tl = txdr_unsigned(cnt);
5112         tstateidp = stateidp;
5113         for (i = 0; i < cnt; i++) {
5114                 ret = nfsrv_teststateid(nd, tstateidp, p);
5115                 NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
5116                 *tl = txdr_unsigned(ret);
5117                 tstateidp++;
5118         }
5119 nfsmout:
5120         free(stateidp, M_TEMP);
5121         NFSEXITCODE2(error, nd);
5122         return (error);
5123 }
5124
5125 /*
5126  * nfs allocate service
5127  */
5128 int
5129 nfsrvd_allocate(struct nfsrv_descript *nd, __unused int isdgram,
5130     vnode_t vp, struct nfsexstuff *exp)
5131 {
5132         uint32_t *tl;
5133         struct nfsvattr forat;
5134         int error = 0, forat_ret = 1, gotproxystateid;
5135         off_t off, len;
5136         struct nfsstate st, *stp = &st;
5137         struct nfslock lo, *lop = &lo;
5138         nfsv4stateid_t stateid;
5139         nfsquad_t clientid;
5140         nfsattrbit_t attrbits;
5141
5142         if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
5143                 nd->nd_repstat = NFSERR_WRONGSEC;
5144                 goto nfsmout;
5145         }
5146         gotproxystateid = 0;
5147         NFSM_DISSECT(tl, uint32_t *, NFSX_STATEID + 2 * NFSX_HYPER);
5148         stp->ls_flags = (NFSLCK_CHECK | NFSLCK_WRITEACCESS);
5149         lop->lo_flags = NFSLCK_WRITE;
5150         stp->ls_ownerlen = 0;
5151         stp->ls_op = NULL;
5152         stp->ls_uid = nd->nd_cred->cr_uid;
5153         stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
5154         clientid.lval[0] = stp->ls_stateid.other[0] = *tl++;
5155         clientid.lval[1] = stp->ls_stateid.other[1] = *tl++;
5156         if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
5157                 if ((nd->nd_flag & ND_NFSV41) != 0)
5158                         clientid.qval = nd->nd_clientid.qval;
5159                 else if (nd->nd_clientid.qval != clientid.qval)
5160                         printf("EEK2 multiple clids\n");
5161         } else {
5162                 if ((nd->nd_flag & ND_NFSV41) != 0)
5163                         printf("EEK! no clientid from session\n");
5164                 nd->nd_flag |= ND_IMPLIEDCLID;
5165                 nd->nd_clientid.qval = clientid.qval;
5166         }
5167         stp->ls_stateid.other[2] = *tl++;
5168         /*
5169          * Don't allow this to be done for a DS.
5170          */
5171         if ((nd->nd_flag & ND_DSSERVER) != 0)
5172                 nd->nd_repstat = NFSERR_NOTSUPP;
5173         /* However, allow the proxy stateid. */
5174         if (stp->ls_stateid.seqid == 0xffffffff &&
5175             stp->ls_stateid.other[0] == 0x55555555 &&
5176             stp->ls_stateid.other[1] == 0x55555555 &&
5177             stp->ls_stateid.other[2] == 0x55555555)
5178                 gotproxystateid = 1;
5179         off = fxdr_hyper(tl); tl += 2;
5180         lop->lo_first = off;
5181         len = fxdr_hyper(tl);
5182         lop->lo_end = off + len;
5183         /*
5184          * Paranoia, just in case it wraps around, which shouldn't
5185          * ever happen anyhow.
5186          */
5187         if (nd->nd_repstat == 0 && (lop->lo_end < lop->lo_first || len <= 0))
5188                 nd->nd_repstat = NFSERR_INVAL;
5189
5190         if (nd->nd_repstat == 0 && vnode_vtype(vp) != VREG)
5191                 nd->nd_repstat = NFSERR_WRONGTYPE;
5192         NFSZERO_ATTRBIT(&attrbits);
5193         NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_OWNER);
5194         forat_ret = nfsvno_getattr(vp, &forat, nd, curthread, 1, &attrbits);
5195         if (nd->nd_repstat == 0)
5196                 nd->nd_repstat = forat_ret;
5197         if (nd->nd_repstat == 0 && (forat.na_uid != nd->nd_cred->cr_uid ||
5198              NFSVNO_EXSTRICTACCESS(exp)))
5199                 nd->nd_repstat = nfsvno_accchk(vp, VWRITE, nd->nd_cred, exp,
5200                     curthread, NFSACCCHK_ALLOWOWNER, NFSACCCHK_VPISLOCKED,
5201                     NULL);
5202         if (nd->nd_repstat == 0 && gotproxystateid == 0)
5203                 nd->nd_repstat = nfsrv_lockctrl(vp, &stp, &lop, NULL, clientid,
5204                     &stateid, exp, nd, curthread);
5205
5206         if (nd->nd_repstat == 0)
5207                 nd->nd_repstat = nfsvno_allocate(vp, off, len, nd->nd_cred,
5208                     curthread);
5209         vput(vp);
5210         NFSEXITCODE2(0, nd);
5211         return (0);
5212 nfsmout:
5213         vput(vp);
5214         NFSEXITCODE2(error, nd);
5215         return (error);
5216 }
5217
5218 /*
5219  * nfs copy service
5220  */
5221 int
5222 nfsrvd_copy_file_range(struct nfsrv_descript *nd, __unused int isdgram,
5223     vnode_t vp, vnode_t tovp, struct nfsexstuff *exp, struct nfsexstuff *toexp)
5224 {
5225         uint32_t *tl;
5226         struct nfsvattr at;
5227         int cnt, error = 0, ret;
5228         off_t inoff, outoff;
5229         uint64_t len;
5230         size_t xfer;
5231         struct nfsstate inst, outst, *instp = &inst, *outstp = &outst;
5232         struct nfslock inlo, outlo, *inlop = &inlo, *outlop = &outlo;
5233         nfsquad_t clientid;
5234         nfsv4stateid_t stateid;
5235         nfsattrbit_t attrbits;
5236         void *rl_rcookie, *rl_wcookie;
5237
5238         rl_rcookie = rl_wcookie = NULL;
5239         if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
5240                 nd->nd_repstat = NFSERR_WRONGSEC;
5241                 goto nfsmout;
5242         }
5243         if (nfsrv_devidcnt > 0) {
5244                 /*
5245                  * For a pNFS server, reply NFSERR_NOTSUPP so that the client
5246                  * will do the copy via I/O on the DS(s).
5247                  */
5248                 nd->nd_repstat = NFSERR_NOTSUPP;
5249                 goto nfsmout;
5250         }
5251         if (vp == tovp) {
5252                 /* Copying a byte range within the same file is not allowed. */
5253                 nd->nd_repstat = NFSERR_INVAL;
5254                 goto nfsmout;
5255         }
5256         NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_STATEID + 3 * NFSX_HYPER +
5257             3 * NFSX_UNSIGNED);
5258         instp->ls_flags = (NFSLCK_CHECK | NFSLCK_READACCESS);
5259         inlop->lo_flags = NFSLCK_READ;
5260         instp->ls_ownerlen = 0;
5261         instp->ls_op = NULL;
5262         instp->ls_uid = nd->nd_cred->cr_uid;
5263         instp->ls_stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
5264         clientid.lval[0] = instp->ls_stateid.other[0] = *tl++;
5265         clientid.lval[1] = instp->ls_stateid.other[1] = *tl++;
5266         if ((nd->nd_flag & ND_IMPLIEDCLID) != 0)
5267                 clientid.qval = nd->nd_clientid.qval;
5268         instp->ls_stateid.other[2] = *tl++;
5269         outstp->ls_flags = (NFSLCK_CHECK | NFSLCK_WRITEACCESS);
5270         outlop->lo_flags = NFSLCK_WRITE;
5271         outstp->ls_ownerlen = 0;
5272         outstp->ls_op = NULL;
5273         outstp->ls_uid = nd->nd_cred->cr_uid;
5274         outstp->ls_stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
5275         outstp->ls_stateid.other[0] = *tl++;
5276         outstp->ls_stateid.other[1] = *tl++;
5277         outstp->ls_stateid.other[2] = *tl++;
5278         inoff = fxdr_hyper(tl); tl += 2;
5279         inlop->lo_first = inoff;
5280         outoff = fxdr_hyper(tl); tl += 2;
5281         outlop->lo_first = outoff;
5282         len = fxdr_hyper(tl); tl += 2;
5283         if (len == 0) {
5284                 /* len == 0 means to EOF. */
5285                 inlop->lo_end = OFF_MAX;
5286                 outlop->lo_end = OFF_MAX;
5287         } else {
5288                 inlop->lo_end = inlop->lo_first + len;
5289                 outlop->lo_end = outlop->lo_first + len;
5290         }
5291
5292         /*
5293          * At this time only consecutive, synchronous copy is supported,
5294          * so ca_consecutive and ca_synchronous can be ignored.
5295          */
5296         tl += 2;
5297
5298         cnt = fxdr_unsigned(int, *tl);
5299         if ((nd->nd_flag & ND_DSSERVER) != 0 || cnt != 0)
5300                 nd->nd_repstat = NFSERR_NOTSUPP;
5301         if (nd->nd_repstat == 0 && (inoff > OFF_MAX || outoff > OFF_MAX ||
5302             inlop->lo_end > OFF_MAX || outlop->lo_end > OFF_MAX ||
5303             inlop->lo_end < inlop->lo_first || outlop->lo_end <
5304             outlop->lo_first))
5305                 nd->nd_repstat = NFSERR_INVAL;
5306
5307         if (nd->nd_repstat == 0 && vnode_vtype(vp) != VREG)
5308                 nd->nd_repstat = NFSERR_WRONGTYPE;
5309
5310         /* Check permissions for the input file. */
5311         NFSZERO_ATTRBIT(&attrbits);
5312         NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_OWNER);
5313         ret = nfsvno_getattr(vp, &at, nd, curthread, 1, &attrbits);
5314         if (nd->nd_repstat == 0)
5315                 nd->nd_repstat = ret;
5316         if (nd->nd_repstat == 0 && (at.na_uid != nd->nd_cred->cr_uid ||
5317              NFSVNO_EXSTRICTACCESS(exp)))
5318                 nd->nd_repstat = nfsvno_accchk(vp, VREAD, nd->nd_cred, exp,
5319                     curthread, NFSACCCHK_ALLOWOWNER, NFSACCCHK_VPISLOCKED,
5320                     NULL);
5321         if (nd->nd_repstat == 0)
5322                 nd->nd_repstat = nfsrv_lockctrl(vp, &instp, &inlop, NULL,
5323                     clientid, &stateid, exp, nd, curthread);
5324         NFSVOPUNLOCK(vp);
5325         if (nd->nd_repstat != 0)
5326                 goto out;
5327
5328         error = NFSVOPLOCK(tovp, LK_SHARED);
5329         if (error != 0)
5330                 goto out;
5331         if (vnode_vtype(tovp) != VREG)
5332                 nd->nd_repstat = NFSERR_WRONGTYPE;
5333
5334         /* For the output file, we only need the Owner attribute. */
5335         ret = nfsvno_getattr(tovp, &at, nd, curthread, 1, &attrbits);
5336         if (nd->nd_repstat == 0)
5337                 nd->nd_repstat = ret;
5338         if (nd->nd_repstat == 0 && (at.na_uid != nd->nd_cred->cr_uid ||
5339              NFSVNO_EXSTRICTACCESS(exp)))
5340                 nd->nd_repstat = nfsvno_accchk(tovp, VWRITE, nd->nd_cred, toexp,
5341                     curthread, NFSACCCHK_ALLOWOWNER, NFSACCCHK_VPISLOCKED,
5342                     NULL);
5343         if (nd->nd_repstat == 0)
5344                 nd->nd_repstat = nfsrv_lockctrl(tovp, &outstp, &outlop, NULL,
5345                     clientid, &stateid, toexp, nd, curthread);
5346         NFSVOPUNLOCK(tovp);
5347
5348         /* Range lock the byte ranges for both invp and outvp. */
5349         if (nd->nd_repstat == 0) {
5350                 for (;;) {
5351                         if (len == 0) {
5352                                 rl_wcookie = vn_rangelock_wlock(tovp, outoff,
5353                                     OFF_MAX);
5354                                 rl_rcookie = vn_rangelock_tryrlock(vp, inoff,
5355                                     OFF_MAX);
5356                         } else {
5357                                 rl_wcookie = vn_rangelock_wlock(tovp, outoff,
5358                                     outoff + len);
5359                                 rl_rcookie = vn_rangelock_tryrlock(vp, inoff,
5360                                     inoff + len);
5361                         }
5362                         if (rl_rcookie != NULL)
5363                                 break;
5364                         vn_rangelock_unlock(tovp, rl_wcookie);
5365                         if (len == 0)
5366                                 rl_rcookie = vn_rangelock_rlock(vp, inoff,
5367                                     OFF_MAX);
5368                         else
5369                                 rl_rcookie = vn_rangelock_rlock(vp, inoff,
5370                                     inoff + len);
5371                         vn_rangelock_unlock(vp, rl_rcookie);
5372                 }
5373
5374                 error = NFSVOPLOCK(vp, LK_SHARED);
5375                 if (error == 0) {
5376                         ret = nfsvno_getattr(vp, &at, nd, curthread, 1, NULL);
5377                         if (ret == 0) {
5378                                 /*
5379                                  * Since invp is range locked, na_size should
5380                                  * not change.
5381                                  */
5382                                 if (len == 0 && at.na_size > inoff) {
5383                                         /*
5384                                          * If len == 0, set it based on invp's
5385                                          * size. If offset is past EOF, just
5386                                          * leave len == 0.
5387                                          */
5388                                         len = at.na_size - inoff;
5389                                 } else if (nfsrv_linux42server == 0 &&
5390                                     inoff + len > at.na_size) {
5391                                         /*
5392                                          * RFC-7862 says that NFSERR_INVAL must
5393                                          * be returned when inoff + len exceeds
5394                                          * the file size, however the NFSv4.2
5395                                          * Linux client likes to do this, so
5396                                          * only check if nfsrv_linux42server
5397                                          * is not set.
5398                                          */
5399                                         nd->nd_repstat = NFSERR_INVAL;
5400                                 }
5401                         }
5402                         NFSVOPUNLOCK(vp);
5403                         if (ret != 0 && nd->nd_repstat == 0)
5404                                 nd->nd_repstat = ret;
5405                 } else if (nd->nd_repstat == 0)
5406                         nd->nd_repstat = error;
5407         }
5408
5409         /*
5410          * Do the actual copy to an upper limit of vfs.nfs.maxcopyrange.
5411          * This limit is applied to ensure that the RPC replies in a
5412          * reasonable time.
5413          */
5414         if (len > nfs_maxcopyrange)
5415                 xfer = nfs_maxcopyrange;
5416         else
5417                 xfer = len;
5418         if (nd->nd_repstat == 0) {
5419                 nd->nd_repstat = vn_copy_file_range(vp, &inoff, tovp, &outoff,
5420                     &xfer, 0, nd->nd_cred, nd->nd_cred, NULL);
5421                 if (nd->nd_repstat == 0)
5422                         len = xfer;
5423         }
5424
5425         /* Unlock the ranges. */
5426         if (rl_rcookie != NULL)
5427                 vn_rangelock_unlock(vp, rl_rcookie);
5428         if (rl_wcookie != NULL)
5429                 vn_rangelock_unlock(tovp, rl_wcookie);
5430
5431         if (nd->nd_repstat == 0) {
5432                 NFSM_BUILD(tl, uint32_t *, 4 * NFSX_UNSIGNED + NFSX_HYPER +
5433                     NFSX_VERF);
5434                 *tl++ = txdr_unsigned(0);       /* No callback ids. */
5435                 txdr_hyper(len, tl); tl += 2;
5436                 *tl++ = txdr_unsigned(NFSWRITE_UNSTABLE);
5437                 *tl++ = txdr_unsigned(nfsboottime.tv_sec);
5438                 *tl++ = txdr_unsigned(nfsboottime.tv_usec);
5439                 *tl++ = newnfs_true;
5440                 *tl = newnfs_true;
5441         }
5442 out:
5443         vrele(vp);
5444         vrele(tovp);
5445         NFSEXITCODE2(error, nd);
5446         return (error);
5447 nfsmout:
5448         vput(vp);
5449         vrele(tovp);
5450         NFSEXITCODE2(error, nd);
5451         return (error);
5452 }
5453
5454 /*
5455  * nfs seek service
5456  */
5457 int
5458 nfsrvd_seek(struct nfsrv_descript *nd, __unused int isdgram,
5459     vnode_t vp, struct nfsexstuff *exp)
5460 {
5461         uint32_t *tl;
5462         struct nfsvattr at;
5463         int content, error = 0;
5464         off_t off;
5465         u_long cmd;
5466         nfsattrbit_t attrbits;
5467         bool eof;
5468
5469         if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
5470                 nd->nd_repstat = NFSERR_WRONGSEC;
5471                 goto nfsmout;
5472         }
5473         NFSM_DISSECT(tl, uint32_t *, NFSX_STATEID + NFSX_HYPER + NFSX_UNSIGNED);
5474         /* Ignore the stateid for now. */
5475         tl += (NFSX_STATEID / NFSX_UNSIGNED);
5476         off = fxdr_hyper(tl); tl += 2;
5477         content = fxdr_unsigned(int, *tl);
5478         if (content == NFSV4CONTENT_DATA)
5479                 cmd = FIOSEEKDATA;
5480         else if (content == NFSV4CONTENT_HOLE)
5481                 cmd = FIOSEEKHOLE;
5482         else
5483                 nd->nd_repstat = NFSERR_BADXDR;
5484         if (nd->nd_repstat == 0 && vnode_vtype(vp) == VDIR)
5485                 nd->nd_repstat = NFSERR_ISDIR;
5486         if (nd->nd_repstat == 0 && vnode_vtype(vp) != VREG)
5487                 nd->nd_repstat = NFSERR_WRONGTYPE;
5488         if (nd->nd_repstat == 0 && off < 0)
5489                 nd->nd_repstat = NFSERR_NXIO;
5490         if (nd->nd_repstat == 0) {
5491                 /* Check permissions for the input file. */
5492                 NFSZERO_ATTRBIT(&attrbits);
5493                 NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_OWNER);
5494                 nd->nd_repstat = nfsvno_getattr(vp, &at, nd, curthread, 1,
5495                     &attrbits);
5496         }
5497         if (nd->nd_repstat == 0 && (at.na_uid != nd->nd_cred->cr_uid ||
5498              NFSVNO_EXSTRICTACCESS(exp)))
5499                 nd->nd_repstat = nfsvno_accchk(vp, VREAD, nd->nd_cred, exp,
5500                     curthread, NFSACCCHK_ALLOWOWNER, NFSACCCHK_VPISLOCKED,
5501                     NULL);
5502         if (nd->nd_repstat != 0)
5503                 goto nfsmout;
5504
5505         /* nfsvno_seek() unlocks and vrele()s the vp. */
5506         nd->nd_repstat = nfsvno_seek(nd, vp, cmd, &off, content, &eof,
5507             nd->nd_cred, curthread);
5508         if (nd->nd_repstat == 0 && eof && content == NFSV4CONTENT_DATA &&
5509             nfsrv_linux42server != 0)
5510                 nd->nd_repstat = NFSERR_NXIO;
5511         if (nd->nd_repstat == 0) {
5512                 NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED + NFSX_HYPER);
5513                 if (eof)
5514                         *tl++ = newnfs_true;
5515                 else
5516                         *tl++ = newnfs_false;
5517                 txdr_hyper(off, tl);
5518         }
5519         NFSEXITCODE2(error, nd);
5520         return (error);
5521 nfsmout:
5522         vput(vp);
5523         NFSEXITCODE2(error, nd);
5524         return (error);
5525 }
5526
5527 /*
5528  * nfs get extended attribute service
5529  */
5530 int
5531 nfsrvd_getxattr(struct nfsrv_descript *nd, __unused int isdgram,
5532     vnode_t vp, __unused struct nfsexstuff *exp)
5533 {
5534         uint32_t *tl;
5535         struct mbuf *mp = NULL, *mpend = NULL;
5536         int error, len;
5537         char *name;
5538         struct thread *p = curthread;
5539
5540         error = 0;
5541         if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
5542                 nd->nd_repstat = NFSERR_WRONGSEC;
5543                 goto nfsmout;
5544         }
5545         NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
5546         len = fxdr_unsigned(int, *tl);
5547         if (len <= 0) {
5548                 nd->nd_repstat = NFSERR_BADXDR;
5549                 goto nfsmout;
5550         }
5551         if (len > EXTATTR_MAXNAMELEN) {
5552                 nd->nd_repstat = NFSERR_NOXATTR;
5553                 goto nfsmout;
5554         }
5555         name = malloc(len + 1, M_TEMP, M_WAITOK);
5556         nd->nd_repstat = nfsrv_mtostr(nd, name, len);
5557         if (nd->nd_repstat == 0)
5558                 nd->nd_repstat = nfsvno_getxattr(vp, name, nd->nd_maxresp,
5559                     nd->nd_cred, p, &mp, &mpend, &len);
5560         if (nd->nd_repstat == ENOATTR)
5561                 nd->nd_repstat = NFSERR_NOXATTR;
5562         else if (nd->nd_repstat == EOPNOTSUPP)
5563                 nd->nd_repstat = NFSERR_NOTSUPP;
5564         if (nd->nd_repstat == 0) {
5565                 NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
5566                 *tl = txdr_unsigned(len);
5567                 if (len > 0) {
5568                         nd->nd_mb->m_next = mp;
5569                         nd->nd_mb = mpend;
5570                         nd->nd_bpos = mtod(mpend, caddr_t) + mpend->m_len;
5571                 }
5572         }
5573         free(name, M_TEMP);
5574
5575 nfsmout:
5576         if (nd->nd_repstat == 0)
5577                 nd->nd_repstat = error;
5578         vput(vp);
5579         NFSEXITCODE2(0, nd);
5580         return (0);
5581 }
5582
5583 /*
5584  * nfs set extended attribute service
5585  */
5586 int
5587 nfsrvd_setxattr(struct nfsrv_descript *nd, __unused int isdgram,
5588     vnode_t vp, __unused struct nfsexstuff *exp)
5589 {
5590         uint32_t *tl;
5591         struct nfsvattr ova, nva;
5592         nfsattrbit_t attrbits;
5593         int error, len, opt;
5594         char *name;
5595         size_t siz;
5596         struct thread *p = curthread;
5597
5598         error = 0;
5599         name = NULL;
5600         if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
5601                 nd->nd_repstat = NFSERR_WRONGSEC;
5602                 goto nfsmout;
5603         }
5604         NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_UNSIGNED);
5605         opt = fxdr_unsigned(int, *tl++);
5606         len = fxdr_unsigned(int, *tl);
5607         if (len <= 0) {
5608                 nd->nd_repstat = NFSERR_BADXDR;
5609                 goto nfsmout;
5610         }
5611         if (len > EXTATTR_MAXNAMELEN) {
5612                 nd->nd_repstat = NFSERR_NOXATTR;
5613                 goto nfsmout;
5614         }
5615         name = malloc(len + 1, M_TEMP, M_WAITOK);
5616         error = nfsrv_mtostr(nd, name, len);
5617         if (error != 0)
5618                 goto nfsmout;
5619         NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
5620         len = fxdr_unsigned(int, *tl);
5621         if (len < 0 || len > IOSIZE_MAX) {
5622                 nd->nd_repstat = NFSERR_XATTR2BIG;
5623                 goto nfsmout;
5624         }
5625         switch (opt) {
5626         case NFSV4SXATTR_CREATE:
5627                 error = VOP_GETEXTATTR(vp, EXTATTR_NAMESPACE_USER, name, NULL,
5628                     &siz, nd->nd_cred, p);
5629                 if (error != ENOATTR)
5630                         nd->nd_repstat = NFSERR_EXIST;
5631                 error = 0;
5632                 break;
5633         case NFSV4SXATTR_REPLACE:
5634                 error = VOP_GETEXTATTR(vp, EXTATTR_NAMESPACE_USER, name, NULL,
5635                     &siz, nd->nd_cred, p);
5636                 if (error != 0)
5637                         nd->nd_repstat = NFSERR_NOXATTR;
5638                 break;
5639         case NFSV4SXATTR_EITHER:
5640                 break;
5641         default:
5642                 nd->nd_repstat = NFSERR_BADXDR;
5643         }
5644         if (nd->nd_repstat != 0)
5645                 goto nfsmout;
5646
5647         /* Now, do the Set Extended attribute, with Change before and after. */
5648         NFSZERO_ATTRBIT(&attrbits);
5649         NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_CHANGE);
5650         nd->nd_repstat = nfsvno_getattr(vp, &ova, nd, p, 1, &attrbits);
5651         if (nd->nd_repstat == 0) {
5652                 nd->nd_repstat = nfsvno_setxattr(vp, name, len, nd->nd_md,
5653                     nd->nd_dpos, nd->nd_cred, p);
5654                 if (nd->nd_repstat == ENXIO)
5655                         nd->nd_repstat = NFSERR_XATTR2BIG;
5656         }
5657         if (nd->nd_repstat == 0 && len > 0)
5658                 nd->nd_repstat = nfsm_advance(nd, NFSM_RNDUP(len), -1);
5659         if (nd->nd_repstat == 0)
5660                 nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1, &attrbits);
5661         if (nd->nd_repstat == 0) {
5662                 NFSM_BUILD(tl, uint32_t *, 2 * NFSX_HYPER + NFSX_UNSIGNED);
5663                 *tl++ = newnfs_true;
5664                 txdr_hyper(ova.na_filerev, tl); tl += 2;
5665                 txdr_hyper(nva.na_filerev, tl);
5666         }
5667
5668 nfsmout:
5669         free(name, M_TEMP);
5670         if (nd->nd_repstat == 0)
5671                 nd->nd_repstat = error;
5672         vput(vp);
5673         NFSEXITCODE2(0, nd);
5674         return (0);
5675 }
5676
5677 /*
5678  * nfs remove extended attribute service
5679  */
5680 int
5681 nfsrvd_rmxattr(struct nfsrv_descript *nd, __unused int isdgram,
5682     vnode_t vp, __unused struct nfsexstuff *exp)
5683 {
5684         uint32_t *tl;
5685         struct nfsvattr ova, nva;
5686         nfsattrbit_t attrbits;
5687         int error, len;
5688         char *name;
5689         struct thread *p = curthread;
5690
5691         error = 0;
5692         name = NULL;
5693         if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
5694                 nd->nd_repstat = NFSERR_WRONGSEC;
5695                 goto nfsmout;
5696         }
5697         NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
5698         len = fxdr_unsigned(int, *tl);
5699         if (len <= 0) {
5700                 nd->nd_repstat = NFSERR_BADXDR;
5701                 goto nfsmout;
5702         }
5703         if (len > EXTATTR_MAXNAMELEN) {
5704                 nd->nd_repstat = NFSERR_NOXATTR;
5705                 goto nfsmout;
5706         }
5707         name = malloc(len + 1, M_TEMP, M_WAITOK);
5708         error = nfsrv_mtostr(nd, name, len);
5709         if (error != 0)
5710                 goto nfsmout;
5711
5712         if ((nd->nd_flag & ND_IMPLIEDCLID) == 0) {
5713                 printf("EEK! nfsrvd_rmxattr: no implied clientid\n");
5714                 error = NFSERR_NOXATTR;
5715                 goto nfsmout;
5716         }
5717         /*
5718          * Now, do the Remove Extended attribute, with Change before and
5719          * after.
5720         */
5721         NFSZERO_ATTRBIT(&attrbits);
5722         NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_CHANGE);
5723         nd->nd_repstat = nfsvno_getattr(vp, &ova, nd, p, 1, &attrbits);
5724         if (nd->nd_repstat == 0) {
5725                 nd->nd_repstat = nfsvno_rmxattr(nd, vp, name, nd->nd_cred, p);
5726                 if (nd->nd_repstat == ENOATTR)
5727                         nd->nd_repstat = NFSERR_NOXATTR;
5728         }
5729         if (nd->nd_repstat == 0)
5730                 nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1, &attrbits);
5731         if (nd->nd_repstat == 0) {
5732                 NFSM_BUILD(tl, uint32_t *, 2 * NFSX_HYPER + NFSX_UNSIGNED);
5733                 *tl++ = newnfs_true;
5734                 txdr_hyper(ova.na_filerev, tl); tl += 2;
5735                 txdr_hyper(nva.na_filerev, tl);
5736         }
5737
5738 nfsmout:
5739         free(name, M_TEMP);
5740         if (nd->nd_repstat == 0)
5741                 nd->nd_repstat = error;
5742         vput(vp);
5743         NFSEXITCODE2(0, nd);
5744         return (0);
5745 }
5746
5747 /*
5748  * nfs list extended attribute service
5749  */
5750 int
5751 nfsrvd_listxattr(struct nfsrv_descript *nd, __unused int isdgram,
5752     vnode_t vp, __unused struct nfsexstuff *exp)
5753 {
5754         uint32_t cnt, *tl, len, len2, i, pos, retlen;
5755         int error;
5756         uint64_t cookie, cookie2;
5757         u_char *buf;
5758         bool eof;
5759         struct thread *p = curthread;
5760
5761         error = 0;
5762         buf = NULL;
5763         if (nfs_rootfhset == 0 || nfsd_checkrootexp(nd) != 0) {
5764                 nd->nd_repstat = NFSERR_WRONGSEC;
5765                 goto nfsmout;
5766         }
5767         NFSM_DISSECT(tl, uint32_t *, NFSX_HYPER + NFSX_UNSIGNED);
5768         /*
5769          * The cookie doesn't need to be in net byte order, but FreeBSD
5770          * does so to make it more readable in packet traces.
5771          */
5772         cookie = fxdr_hyper(tl); tl += 2;
5773         len = fxdr_unsigned(uint32_t, *tl);
5774         if (len == 0 || cookie >= IOSIZE_MAX) {
5775                 nd->nd_repstat = NFSERR_BADXDR;
5776                 goto nfsmout;
5777         }
5778         if (len > nd->nd_maxresp - NFS_MAXXDR)
5779                 len = nd->nd_maxresp - NFS_MAXXDR;
5780         len2 = len;
5781         nd->nd_repstat = nfsvno_listxattr(vp, cookie, nd->nd_cred, p, &buf,
5782             &len, &eof);
5783         if (nd->nd_repstat == EOPNOTSUPP)
5784                 nd->nd_repstat = NFSERR_NOTSUPP;
5785         if (nd->nd_repstat == 0) {
5786                 cookie2 = cookie + len;
5787                 if (cookie2 < cookie)
5788                         nd->nd_repstat = NFSERR_BADXDR;
5789         }
5790         if (nd->nd_repstat == 0) {
5791                 /* Now copy the entries out. */
5792                 retlen = NFSX_HYPER + 2 * NFSX_UNSIGNED;
5793                 if (len == 0 && retlen <= len2) {
5794                         /* The cookie was at eof. */
5795                         NFSM_BUILD(tl, uint32_t *, NFSX_HYPER + 2 *
5796                             NFSX_UNSIGNED);
5797                         txdr_hyper(cookie2, tl); tl += 2;
5798                         *tl++ = txdr_unsigned(0);
5799                         *tl = newnfs_true;
5800                         goto nfsmout;
5801                 }
5802
5803                 /* Sanity check the cookie. */
5804                 for (pos = 0; pos < len; pos += (i + 1)) {
5805                         if (pos == cookie)
5806                                 break;
5807                         i = buf[pos];
5808                 }
5809                 if (pos != cookie) {
5810                         nd->nd_repstat = NFSERR_INVAL;
5811                         goto nfsmout;
5812                 }
5813
5814                 /* Loop around copying the entrie(s) out. */
5815                 cnt = 0;
5816                 len -= cookie;
5817                 i = buf[pos];
5818                 while (i < len && len2 >= retlen + NFSM_RNDUP(i) +
5819                     NFSX_UNSIGNED) {
5820                         if (cnt == 0) {
5821                                 NFSM_BUILD(tl, uint32_t *, NFSX_HYPER +
5822                                     NFSX_UNSIGNED);
5823                                 txdr_hyper(cookie2, tl); tl += 2;
5824                         }
5825                         retlen += nfsm_strtom(nd, &buf[pos + 1], i);
5826                         len -= (i + 1);
5827                         pos += (i + 1);
5828                         i = buf[pos];
5829                         cnt++;
5830                 }
5831                 /*
5832                  * eof is set true/false by nfsvno_listxattr(), but if we
5833                  * can't copy all entries returned by nfsvno_listxattr(),
5834                  * we are not at eof.
5835                  */
5836                 if (len > 0)
5837                         eof = false;
5838                 if (cnt > 0) {
5839                         /* *tl is set above. */
5840                         *tl = txdr_unsigned(cnt);
5841                         NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
5842                         if (eof)
5843                                 *tl = newnfs_true;
5844                         else
5845                                 *tl = newnfs_false;
5846                 } else
5847                         nd->nd_repstat = NFSERR_TOOSMALL;
5848         }
5849
5850 nfsmout:
5851         free(buf, M_TEMP);
5852         if (nd->nd_repstat == 0)
5853                 nd->nd_repstat = error;
5854         vput(vp);
5855         NFSEXITCODE2(0, nd);
5856         return (0);
5857 }
5858
5859 /*
5860  * nfsv4 service not supported
5861  */
5862 int
5863 nfsrvd_notsupp(struct nfsrv_descript *nd, __unused int isdgram,
5864     __unused vnode_t vp, __unused struct nfsexstuff *exp)
5865 {
5866
5867         nd->nd_repstat = NFSERR_NOTSUPP;
5868         NFSEXITCODE2(0, nd);
5869         return (0);
5870 }
5871