sys/fs/nfsserver/nfs_nfsdserv.c

   1 /*-
   2  * SPDX-License-Identifier: BSD-3-Clause
   3  *
   4  * Copyright (c) 1989, 1993
   5  *      The Regents of the University of California.  All rights reserved.
   6  *
   7  * This code is derived from software contributed to Berkeley by
   8  * Rick Macklem at The University of Guelph.
   9  *
  10  * Redistribution and use in source and binary forms, with or without
  11  * modification, are permitted provided that the following conditions
  12  * are met:
  13  * 1. Redistributions of source code must retain the above copyright
  14  *    notice, this list of conditions and the following disclaimer.
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  * 3. Neither the name of the University nor the names of its contributors
  19  *    may be used to endorse or promote products derived from this software
  20  *    without specific prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  32  * SUCH DAMAGE.
  33  *
  34  */
  35
  36 #include <sys/cdefs.h>
  37 __FBSDID("$FreeBSD$");
  38
  39 #include "opt_inet.h"
  40 #include "opt_inet6.h"
  41 /*
  42  * nfs version 2, 3 and 4 server calls to vnode ops
  43  * - these routines generally have 3 phases
  44  *   1 - break down and validate rpc request in mbuf list
  45  *   2 - do the vnode ops for the request, usually by calling a nfsvno_XXX()
  46  *       function in nfsd_port.c
  47  *   3 - build the rpc reply in an mbuf list
  48  * For nfsv4, these functions are called for each Op within the Compound RPC.
  49  */
  50
  51 #include <fs/nfs/nfsport.h>
  52 #include <sys/extattr.h>
  53 #include <sys/filio.h>
  54
  55 /* Global vars */
  56 extern u_int32_t newnfs_false, newnfs_true;
  57 extern enum vtype nv34tov_type[8];
  58 extern struct timeval nfsboottime;
  59 extern int nfsrv_enable_crossmntpt;
  60 extern int nfsrv_statehashsize;
  61 extern int nfsrv_layouthashsize;
  62 extern time_t nfsdev_time;
  63 extern volatile int nfsrv_devidcnt;
  64 extern int nfsd_debuglevel;
  65 extern u_long sb_max_adj;
  66 extern int nfsrv_pnfsatime;
  67 extern int nfsrv_maxpnfsmirror;
  68 extern uint32_t nfs_srvmaxio;
  69
  70 static int      nfs_async = 0;
  71 SYSCTL_DECL(_vfs_nfsd);
  72 SYSCTL_INT(_vfs_nfsd, OID_AUTO, async, CTLFLAG_RW, &nfs_async, 0,
  73     "Tell client that writes were synced even though they were not");
  74 extern int      nfsrv_doflexfile;
  75 SYSCTL_INT(_vfs_nfsd, OID_AUTO, default_flexfile, CTLFLAG_RW,
  76     &nfsrv_doflexfile, 0, "Make Flex File Layout the default for pNFS");
  77 static int      nfsrv_linux42server = 1;
  78 SYSCTL_INT(_vfs_nfsd, OID_AUTO, linux42server, CTLFLAG_RW,
  79     &nfsrv_linux42server, 0,
  80     "Enable Linux style NFSv4.2 server (non-RFC compliant)");
  81 static bool     nfsrv_openaccess = true;
  82 SYSCTL_BOOL(_vfs_nfsd, OID_AUTO, v4openaccess, CTLFLAG_RW,
  83     &nfsrv_openaccess, 0,
  84     "Enable Linux style NFSv4 Open access check");
  85 static char nfsrv_scope[NFSV4_OPAQUELIMIT];
  86 SYSCTL_STRING(_vfs_nfsd, OID_AUTO, scope, CTLFLAG_RWTUN,
  87     &nfsrv_scope, NFSV4_OPAQUELIMIT, "Server scope");
  88 static char nfsrv_owner_major[NFSV4_OPAQUELIMIT];
  89 SYSCTL_STRING(_vfs_nfsd, OID_AUTO, owner_major, CTLFLAG_RWTUN,
  90     &nfsrv_owner_major, NFSV4_OPAQUELIMIT, "Server owner major");
  91 static uint64_t nfsrv_owner_minor;
  92 SYSCTL_U64(_vfs_nfsd, OID_AUTO, owner_minor, CTLFLAG_RWTUN,
  93     &nfsrv_owner_minor, 0, "Server owner minor");
  94 /*
  95  * Only enable this if all your exported file systems
  96  * (or pNFS DSs for the pNFS case) support VOP_ALLOCATE.
  97  */
  98 static bool     nfsrv_doallocate = false;
  99 SYSCTL_BOOL(_vfs_nfsd, OID_AUTO, enable_v42allocate, CTLFLAG_RW,
 100     &nfsrv_doallocate, 0,
 101     "Enable NFSv4.2 Allocate operation");
 102
 103 /*
 104  * This list defines the GSS mechanisms supported.
 105  * (Don't ask me how you get these strings from the RFC stuff like
 106  *  iso(1), org(3)... but someone did it, so I don't need to know.)
 107  */
 108 static struct nfsgss_mechlist nfsgss_mechlist[] = {
 109         { 9, "\052\206\110\206\367\022\001\002\002", 11 },
 110         { 0, "", 0 },
 111 };
 112
 113 /* local functions */
 114 static void nfsrvd_symlinksub(struct nfsrv_descript *nd, struct nameidata *ndp,
 115     struct nfsvattr *nvap, fhandle_t *fhp, vnode_t *vpp,
 116     vnode_t dirp, struct nfsvattr *dirforp, struct nfsvattr *diraftp,
 117     int *diraft_retp, nfsattrbit_t *attrbitp,
 118     NFSACL_T *aclp, NFSPROC_T *p, struct nfsexstuff *exp, char *pathcp,
 119     int pathlen);
 120 static void nfsrvd_mkdirsub(struct nfsrv_descript *nd, struct nameidata *ndp,
 121     struct nfsvattr *nvap, fhandle_t *fhp, vnode_t *vpp,
 122     vnode_t dirp, struct nfsvattr *dirforp, struct nfsvattr *diraftp,
 123     int *diraft_retp, nfsattrbit_t *attrbitp, NFSACL_T *aclp,
 124     NFSPROC_T *p, struct nfsexstuff *exp);
 125
 126 /*
 127  * nfs access service (not a part of NFS V2)
 128  */
 129 int
 130 nfsrvd_access(struct nfsrv_descript *nd, __unused int isdgram,
 131     vnode_t vp, struct nfsexstuff *exp)
 132 {
 133         u_int32_t *tl;
 134         int getret, error = 0;
 135         struct nfsvattr nva;
 136         u_int32_t testmode, nfsmode, supported = 0;
 137         accmode_t deletebit;
 138         struct thread *p = curthread;
 139
 140         if (nd->nd_repstat) {
 141                 nfsrv_postopattr(nd, 1, &nva);
 142                 goto out;
 143         }
 144         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
 145         nfsmode = fxdr_unsigned(u_int32_t, *tl);
 146         if ((nd->nd_flag & ND_NFSV4) &&
 147             (nfsmode & ~(NFSACCESS_READ | NFSACCESS_LOOKUP |
 148              NFSACCESS_MODIFY | NFSACCESS_EXTEND | NFSACCESS_DELETE |
 149              NFSACCESS_EXECUTE | NFSACCESS_XAREAD | NFSACCESS_XAWRITE |
 150              NFSACCESS_XALIST))) {
 151                 nd->nd_repstat = NFSERR_INVAL;
 152                 vput(vp);
 153                 goto out;
 154         }
 155         if (nfsmode & NFSACCESS_READ) {
 156                 supported |= NFSACCESS_READ;
 157                 if (nfsvno_accchk(vp, VREAD, nd->nd_cred, exp, p,
 158                     NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
 159                         nfsmode &= ~NFSACCESS_READ;
 160         }
 161         if (nfsmode & NFSACCESS_MODIFY) {
 162                 supported |= NFSACCESS_MODIFY;
 163                 if (nfsvno_accchk(vp, VWRITE, nd->nd_cred, exp, p,
 164                     NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
 165                         nfsmode &= ~NFSACCESS_MODIFY;
 166         }
 167         if (nfsmode & NFSACCESS_EXTEND) {
 168                 supported |= NFSACCESS_EXTEND;
 169                 if (nfsvno_accchk(vp, VWRITE | VAPPEND, nd->nd_cred, exp, p,
 170                     NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
 171                         nfsmode &= ~NFSACCESS_EXTEND;
 172         }
 173         if (nfsmode & NFSACCESS_XAREAD) {
 174                 supported |= NFSACCESS_XAREAD;
 175                 if (nfsvno_accchk(vp, VREAD, nd->nd_cred, exp, p,
 176                     NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
 177                         nfsmode &= ~NFSACCESS_XAREAD;
 178         }
 179         if (nfsmode & NFSACCESS_XAWRITE) {
 180                 supported |= NFSACCESS_XAWRITE;
 181                 if (nfsvno_accchk(vp, VWRITE, nd->nd_cred, exp, p,
 182                     NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
 183                         nfsmode &= ~NFSACCESS_XAWRITE;
 184         }
 185         if (nfsmode & NFSACCESS_XALIST) {
 186                 supported |= NFSACCESS_XALIST;
 187                 if (nfsvno_accchk(vp, VREAD, nd->nd_cred, exp, p,
 188                     NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
 189                         nfsmode &= ~NFSACCESS_XALIST;
 190         }
 191         if (nfsmode & NFSACCESS_DELETE) {
 192                 supported |= NFSACCESS_DELETE;
 193                 if (vp->v_type == VDIR)
 194                         deletebit = VDELETE_CHILD;
 195                 else
 196                         deletebit = VDELETE;
 197                 if (nfsvno_accchk(vp, deletebit, nd->nd_cred, exp, p,
 198                     NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
 199                         nfsmode &= ~NFSACCESS_DELETE;
 200         }
 201         if (vp->v_type == VDIR)
 202                 testmode = NFSACCESS_LOOKUP;
 203         else
 204                 testmode = NFSACCESS_EXECUTE;
 205         if (nfsmode & testmode) {
 206                 supported |= (nfsmode & testmode);
 207                 if (nfsvno_accchk(vp, VEXEC, nd->nd_cred, exp, p,
 208                     NFSACCCHK_NOOVERRIDE, NFSACCCHK_VPISLOCKED, &supported))
 209                         nfsmode &= ~testmode;
 210         }
 211         nfsmode &= supported;
 212         if (nd->nd_flag & ND_NFSV3) {
 213                 getret = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
 214                 nfsrv_postopattr(nd, getret, &nva);
 215         }
 216         vput(vp);
 217         if (nd->nd_flag & ND_NFSV4) {
 218                 NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
 219                 *tl++ = txdr_unsigned(supported);
 220         } else
 221                 NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
 222         *tl = txdr_unsigned(nfsmode);
 223
 224 out:
 225         NFSEXITCODE2(0, nd);
 226         return (0);
 227 nfsmout:
 228         vput(vp);
 229         NFSEXITCODE2(error, nd);
 230         return (error);
 231 }
 232
 233 /*
 234  * nfs getattr service
 235  */
 236 int
 237 nfsrvd_getattr(struct nfsrv_descript *nd, int isdgram,
 238     vnode_t vp, __unused struct nfsexstuff *exp)
 239 {
 240         struct nfsvattr nva;
 241         fhandle_t fh;
 242         int at_root = 0, error = 0, supports_nfsv4acls;
 243         struct nfsreferral *refp;
 244         nfsattrbit_t attrbits, tmpbits;
 245         struct mount *mp;
 246         struct vnode *tvp = NULL;
 247         struct vattr va;
 248         uint64_t mounted_on_fileno = 0;
 249         accmode_t accmode;
 250         struct thread *p = curthread;
 251
 252         if (nd->nd_repstat)
 253                 goto out;
 254         if (nd->nd_flag & ND_NFSV4) {
 255                 error = nfsrv_getattrbits(nd, &attrbits, NULL, NULL);
 256                 if (error) {
 257                         vput(vp);
 258                         goto out;
 259                 }
 260
 261                 /*
 262                  * Check for a referral.
 263                  */
 264                 refp = nfsv4root_getreferral(vp, NULL, 0);
 265                 if (refp != NULL) {
 266                         (void) nfsrv_putreferralattr(nd, &attrbits, refp, 1,
 267                             &nd->nd_repstat);
 268                         vput(vp);
 269                         goto out;
 270                 }
 271                 if (nd->nd_repstat == 0) {
 272                         accmode = 0;
 273                         NFSSET_ATTRBIT(&tmpbits, &attrbits);
 274
 275                         /*
 276                          * GETATTR with write-only attr time_access_set and time_modify_set
 277                          * should return NFS4ERR_INVAL.
 278                          */
 279                         if (NFSISSET_ATTRBIT(&tmpbits, NFSATTRBIT_TIMEACCESSSET) ||
 280                                         NFSISSET_ATTRBIT(&tmpbits, NFSATTRBIT_TIMEMODIFYSET)){
 281                                 error = NFSERR_INVAL;
 282                                 vput(vp);
 283                                 goto out;
 284                         }
 285                         if (NFSISSET_ATTRBIT(&tmpbits, NFSATTRBIT_ACL)) {
 286                                 NFSCLRBIT_ATTRBIT(&tmpbits, NFSATTRBIT_ACL);
 287                                 accmode |= VREAD_ACL;
 288                         }
 289                         if (NFSNONZERO_ATTRBIT(&tmpbits))
 290                                 accmode |= VREAD_ATTRIBUTES;
 291                         if (accmode != 0)
 292                                 nd->nd_repstat = nfsvno_accchk(vp, accmode,
 293                                     nd->nd_cred, exp, p, NFSACCCHK_NOOVERRIDE,
 294                                     NFSACCCHK_VPISLOCKED, NULL);
 295                 }
 296         }
 297         if (!nd->nd_repstat)
 298                 nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1, &attrbits);
 299         if (!nd->nd_repstat) {
 300                 if (nd->nd_flag & ND_NFSV4) {
 301                         if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_FILEHANDLE))
 302                                 nd->nd_repstat = nfsvno_getfh(vp, &fh, p);
 303                         if (!nd->nd_repstat)
 304                                 nd->nd_repstat = nfsrv_checkgetattr(nd, vp,
 305                                     &nva, &attrbits, p);
 306                         if (nd->nd_repstat == 0) {
 307                                 supports_nfsv4acls = nfs_supportsnfsv4acls(vp);
 308                                 mp = vp->v_mount;
 309                                 if (nfsrv_enable_crossmntpt != 0 &&
 310                                     vp->v_type == VDIR &&
 311                                     (vp->v_vflag & VV_ROOT) != 0 &&
 312                                     vp != rootvnode) {
 313                                         tvp = mp->mnt_vnodecovered;
 314                                         VREF(tvp);
 315                                         at_root = 1;
 316                                 } else
 317                                         at_root = 0;
 318                                 vfs_ref(mp);
 319                                 NFSVOPUNLOCK(vp);
 320                                 if (at_root != 0) {
 321                                         if ((nd->nd_repstat =
 322                                              NFSVOPLOCK(tvp, LK_SHARED)) == 0) {
 323                                                 nd->nd_repstat = VOP_GETATTR(
 324                                                     tvp, &va, nd->nd_cred);
 325                                                 vput(tvp);
 326                                         } else
 327                                                 vrele(tvp);
 328                                         if (nd->nd_repstat == 0)
 329                                                 mounted_on_fileno = (uint64_t)
 330                                                     va.va_fileid;
 331                                         else
 332                                                 at_root = 0;
 333                                 }
 334                                 if (nd->nd_repstat == 0)
 335                                         nd->nd_repstat = vfs_busy(mp, 0);
 336                                 vfs_rel(mp);
 337                                 if (nd->nd_repstat == 0) {
 338                                         (void)nfsvno_fillattr(nd, mp, vp, &nva,
 339                                             &fh, 0, &attrbits, nd->nd_cred, p,
 340                                             isdgram, 1, supports_nfsv4acls,
 341                                             at_root, mounted_on_fileno);
 342                                         vfs_unbusy(mp);
 343                                 }
 344                                 vrele(vp);
 345                         } else
 346                                 vput(vp);
 347                 } else {
 348                         nfsrv_fillattr(nd, &nva);
 349                         vput(vp);
 350                 }
 351         } else {
 352                 vput(vp);
 353         }
 354
 355 out:
 356         NFSEXITCODE2(error, nd);
 357         return (error);
 358 }
 359
 360 /*
 361  * nfs setattr service
 362  */
 363 int
 364 nfsrvd_setattr(struct nfsrv_descript *nd, __unused int isdgram,
 365     vnode_t vp, struct nfsexstuff *exp)
 366 {
 367         struct nfsvattr nva, nva2;
 368         u_int32_t *tl;
 369         int preat_ret = 1, postat_ret = 1, gcheck = 0, error = 0;
 370         int gotproxystateid;
 371         struct timespec guard = { 0, 0 };
 372         nfsattrbit_t attrbits, retbits;
 373         nfsv4stateid_t stateid;
 374         NFSACL_T *aclp = NULL;
 375         struct thread *p = curthread;
 376
 377         if (nd->nd_repstat) {
 378                 nfsrv_wcc(nd, preat_ret, &nva2, postat_ret, &nva);
 379                 goto out;
 380         }
 381 #ifdef NFS4_ACL_EXTATTR_NAME
 382         aclp = acl_alloc(M_WAITOK);
 383         aclp->acl_cnt = 0;
 384 #endif
 385         gotproxystateid = 0;
 386         NFSVNO_ATTRINIT(&nva);
 387         if (nd->nd_flag & ND_NFSV4) {
 388                 NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID);
 389                 stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
 390                 stateid.other[0] = *tl++;
 391                 stateid.other[1] = *tl++;
 392                 stateid.other[2] = *tl;
 393                 if (stateid.other[0] == 0x55555555 &&
 394                     stateid.other[1] == 0x55555555 &&
 395                     stateid.other[2] == 0x55555555 &&
 396                     stateid.seqid == 0xffffffff)
 397                         gotproxystateid = 1;
 398         }
 399         error = nfsrv_sattr(nd, vp, &nva, &attrbits, aclp, p);
 400         if (error)
 401                 goto nfsmout;
 402
 403         /* For NFSv4, only va_uid is used from nva2. */
 404         NFSZERO_ATTRBIT(&retbits);
 405         NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_OWNER);
 406         preat_ret = nfsvno_getattr(vp, &nva2, nd, p, 1, &retbits);
 407         if (!nd->nd_repstat)
 408                 nd->nd_repstat = preat_ret;
 409
 410         NFSZERO_ATTRBIT(&retbits);
 411         if (nd->nd_flag & ND_NFSV3) {
 412                 NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
 413                 gcheck = fxdr_unsigned(int, *tl);
 414                 if (gcheck) {
 415                         NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
 416                         fxdr_nfsv3time(tl, &guard);
 417                 }
 418                 if (!nd->nd_repstat && gcheck &&
 419                     (nva2.na_ctime.tv_sec != guard.tv_sec ||
 420                      nva2.na_ctime.tv_nsec != guard.tv_nsec))
 421                         nd->nd_repstat = NFSERR_NOT_SYNC;
 422                 if (nd->nd_repstat) {
 423                         vput(vp);
 424 #ifdef NFS4_ACL_EXTATTR_NAME
 425                         acl_free(aclp);
 426 #endif
 427                         nfsrv_wcc(nd, preat_ret, &nva2, postat_ret, &nva);
 428                         goto out;
 429                 }
 430         } else if (!nd->nd_repstat && (nd->nd_flag & ND_NFSV4))
 431                 nd->nd_repstat = nfsrv_checkuidgid(nd, &nva);
 432
 433         /*
 434          * Now that we have all the fields, lets do it.
 435          * If the size is being changed write access is required, otherwise
 436          * just check for a read only file system.
 437          */
 438         if (!nd->nd_repstat) {
 439                 if (NFSVNO_NOTSETSIZE(&nva)) {
 440                         if (NFSVNO_EXRDONLY(exp) ||
 441                             (vp->v_mount->mnt_flag & MNT_RDONLY))
 442                                 nd->nd_repstat = EROFS;
 443                 } else {
 444                         if (vp->v_type != VREG)
 445                                 nd->nd_repstat = EINVAL;
 446                         else if (nva2.na_uid != nd->nd_cred->cr_uid ||
 447                             NFSVNO_EXSTRICTACCESS(exp))
 448                                 nd->nd_repstat = nfsvno_accchk(vp,
 449                                     VWRITE, nd->nd_cred, exp, p,
 450                                     NFSACCCHK_NOOVERRIDE,
 451                                     NFSACCCHK_VPISLOCKED, NULL);
 452                 }
 453         }
 454         /*
 455          * Proxy operations from the MDS are allowed via the all 0s special
 456          * stateid.
 457          */
 458         if (nd->nd_repstat == 0 && (nd->nd_flag & ND_NFSV4) != 0 &&
 459             gotproxystateid == 0)
 460                 nd->nd_repstat = nfsrv_checksetattr(vp, nd, &stateid,
 461                     &nva, &attrbits, exp, p);
 462
 463         if (!nd->nd_repstat && (nd->nd_flag & ND_NFSV4)) {
 464             /*
 465              * For V4, try setting the attributes in sets, so that the
 466              * reply bitmap will be correct for an error case.
 467              */
 468             if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_OWNER) ||
 469                 NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_OWNERGROUP)) {
 470                 NFSVNO_ATTRINIT(&nva2);
 471                 NFSVNO_SETATTRVAL(&nva2, uid, nva.na_uid);
 472                 NFSVNO_SETATTRVAL(&nva2, gid, nva.na_gid);
 473                 nd->nd_repstat = nfsvno_setattr(vp, &nva2, nd->nd_cred, p,
 474                     exp);
 475                 if (!nd->nd_repstat) {
 476                     if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_OWNER))
 477                         NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_OWNER);
 478                     if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_OWNERGROUP))
 479                         NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_OWNERGROUP);
 480                 }
 481             }
 482             if (!nd->nd_repstat &&
 483                 NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_SIZE)) {
 484                 NFSVNO_ATTRINIT(&nva2);
 485                 NFSVNO_SETATTRVAL(&nva2, size, nva.na_size);
 486                 nd->nd_repstat = nfsvno_setattr(vp, &nva2, nd->nd_cred, p,
 487                     exp);
 488                 if (!nd->nd_repstat)
 489                     NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_SIZE);
 490             }
 491             if (!nd->nd_repstat &&
 492                 (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_TIMEACCESSSET) ||
 493                  NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_TIMEMODIFYSET))) {
 494                 NFSVNO_ATTRINIT(&nva2);
 495                 NFSVNO_SETATTRVAL(&nva2, atime, nva.na_atime);
 496                 NFSVNO_SETATTRVAL(&nva2, mtime, nva.na_mtime);
 497                 if (nva.na_vaflags & VA_UTIMES_NULL) {
 498                         nva2.na_vaflags |= VA_UTIMES_NULL;
 499                         NFSVNO_SETACTIVE(&nva2, vaflags);
 500                 }
 501                 nd->nd_repstat = nfsvno_setattr(vp, &nva2, nd->nd_cred, p,
 502                     exp);
 503                 if (!nd->nd_repstat) {
 504                     if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_TIMEACCESSSET))
 505                         NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_TIMEACCESSSET);
 506                     if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_TIMEMODIFYSET))
 507                         NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_TIMEMODIFYSET);
 508                 }
 509             }
 510             if (!nd->nd_repstat &&
 511                 NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_TIMECREATE)) {
 512                 NFSVNO_ATTRINIT(&nva2);
 513                 NFSVNO_SETATTRVAL(&nva2, btime, nva.na_btime);
 514                 nd->nd_repstat = nfsvno_setattr(vp, &nva2, nd->nd_cred, p,
 515                     exp);
 516                 if (!nd->nd_repstat)
 517                     NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_TIMECREATE);
 518             }
 519             if (!nd->nd_repstat &&
 520                 (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_MODE) ||
 521                  NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_MODESETMASKED))) {
 522                 NFSVNO_ATTRINIT(&nva2);
 523                 NFSVNO_SETATTRVAL(&nva2, mode, nva.na_mode);
 524                 nd->nd_repstat = nfsvno_setattr(vp, &nva2, nd->nd_cred, p,
 525                     exp);
 526                 if (!nd->nd_repstat) {
 527                     if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_MODE))
 528                         NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_MODE);
 529                     if (NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_MODESETMASKED))
 530                         NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_MODESETMASKED);
 531                 }
 532             }
 533
 534 #ifdef NFS4_ACL_EXTATTR_NAME
 535             if (!nd->nd_repstat && aclp->acl_cnt > 0 &&
 536                 NFSISSET_ATTRBIT(&attrbits, NFSATTRBIT_ACL)) {
 537                 nd->nd_repstat = nfsrv_setacl(vp, aclp, nd->nd_cred, p);
 538                 if (!nd->nd_repstat)
 539                     NFSSETBIT_ATTRBIT(&retbits, NFSATTRBIT_ACL);
 540             }
 541 #endif
 542         } else if (!nd->nd_repstat) {
 543                 nd->nd_repstat = nfsvno_setattr(vp, &nva, nd->nd_cred, p,
 544                     exp);
 545         }
 546         if (nd->nd_flag & (ND_NFSV2 | ND_NFSV3)) {
 547                 postat_ret = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
 548                 if (!nd->nd_repstat)
 549                         nd->nd_repstat = postat_ret;
 550         }
 551         vput(vp);
 552 #ifdef NFS4_ACL_EXTATTR_NAME
 553         acl_free(aclp);
 554 #endif
 555         if (nd->nd_flag & ND_NFSV3)
 556                 nfsrv_wcc(nd, preat_ret, &nva2, postat_ret, &nva);
 557         else if (nd->nd_flag & ND_NFSV4)
 558                 (void) nfsrv_putattrbit(nd, &retbits);
 559         else if (!nd->nd_repstat)
 560                 nfsrv_fillattr(nd, &nva);
 561
 562 out:
 563         NFSEXITCODE2(0, nd);
 564         return (0);
 565 nfsmout:
 566         vput(vp);
 567 #ifdef NFS4_ACL_EXTATTR_NAME
 568         acl_free(aclp);
 569 #endif
 570         if (nd->nd_flag & ND_NFSV4) {
 571                 /*
 572                  * For all nd_repstat, the V4 reply includes a bitmap,
 573                  * even NFSERR_BADXDR, which is what this will end up
 574                  * returning.
 575                  */
 576                 (void) nfsrv_putattrbit(nd, &retbits);
 577         }
 578         NFSEXITCODE2(error, nd);
 579         return (error);
 580 }
 581
 582 /*
 583  * nfs lookup rpc
 584  * (Also performs lookup parent for v4)
 585  */
 586 int
 587 nfsrvd_lookup(struct nfsrv_descript *nd, __unused int isdgram,
 588     vnode_t dp, vnode_t *vpp, fhandle_t *fhp, struct nfsexstuff *exp)
 589 {
 590         struct nameidata named;
 591         vnode_t vp, dirp = NULL;
 592         int error = 0, dattr_ret = 1;
 593         struct nfsvattr nva, dattr;
 594         char *bufp;
 595         u_long *hashp;
 596         struct thread *p = curthread;
 597
 598         if (nd->nd_repstat) {
 599                 nfsrv_postopattr(nd, dattr_ret, &dattr);
 600                 goto out;
 601         }
 602
 603         /*
 604          * For some reason, if dp is a symlink, the error
 605          * returned is supposed to be NFSERR_SYMLINK and not NFSERR_NOTDIR.
 606          */
 607         if (dp->v_type == VLNK && (nd->nd_flag & ND_NFSV4)) {
 608                 nd->nd_repstat = NFSERR_SYMLINK;
 609                 vrele(dp);
 610                 goto out;
 611         }
 612
 613         NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, LOOKUP,
 614             LOCKLEAF);
 615         nfsvno_setpathbuf(&named, &bufp, &hashp);
 616         error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
 617         if (error) {
 618                 vrele(dp);
 619                 nfsvno_relpathbuf(&named);
 620                 goto out;
 621         }
 622         if (!nd->nd_repstat) {
 623                 nd->nd_repstat = nfsvno_namei(nd, &named, dp, 0, exp, &dirp);
 624         } else {
 625                 vrele(dp);
 626                 nfsvno_relpathbuf(&named);
 627         }
 628         if (nd->nd_repstat) {
 629                 if (dirp) {
 630                         if (nd->nd_flag & ND_NFSV3)
 631                                 dattr_ret = nfsvno_getattr(dirp, &dattr, nd, p,
 632                                     0, NULL);
 633                         vrele(dirp);
 634                 }
 635                 if (nd->nd_flag & ND_NFSV3)
 636                         nfsrv_postopattr(nd, dattr_ret, &dattr);
 637                 goto out;
 638         }
 639         nfsvno_relpathbuf(&named);
 640         vp = named.ni_vp;
 641         if ((nd->nd_flag & ND_NFSV4) != 0 && !NFSVNO_EXPORTED(exp) &&
 642             vp->v_type != VDIR && vp->v_type != VLNK)
 643                 /*
 644                  * Only allow lookup of VDIR and VLNK for traversal of
 645                  * non-exported volumes during NFSv4 mounting.
 646                  */
 647                 nd->nd_repstat = ENOENT;
 648         if (nd->nd_repstat == 0) {
 649                 nd->nd_repstat = nfsvno_getfh(vp, fhp, p);
 650                 /*
 651                  * EOPNOTSUPP indicates the file system cannot be exported,
 652                  * so just pretend the entry does not exist.
 653                  */
 654                 if (nd->nd_repstat == EOPNOTSUPP)
 655                         nd->nd_repstat = ENOENT;
 656         }
 657         if (!(nd->nd_flag & ND_NFSV4) && !nd->nd_repstat)
 658                 nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
 659         if (vpp != NULL && nd->nd_repstat == 0)
 660                 *vpp = vp;
 661         else
 662                 vput(vp);
 663         if (dirp) {
 664                 if (nd->nd_flag & ND_NFSV3)
 665                         dattr_ret = nfsvno_getattr(dirp, &dattr, nd, p, 0,
 666                             NULL);
 667                 vrele(dirp);
 668         }
 669         if (nd->nd_repstat) {
 670                 if (nd->nd_flag & ND_NFSV3)
 671                         nfsrv_postopattr(nd, dattr_ret, &dattr);
 672                 goto out;
 673         }
 674         if (nd->nd_flag & ND_NFSV2) {
 675                 (void)nfsm_fhtom(NULL, nd, (u_int8_t *)fhp, 0, 0);
 676                 nfsrv_fillattr(nd, &nva);
 677         } else if (nd->nd_flag & ND_NFSV3) {
 678                 (void)nfsm_fhtom(NULL, nd, (u_int8_t *)fhp, 0, 0);
 679                 nfsrv_postopattr(nd, 0, &nva);
 680                 nfsrv_postopattr(nd, dattr_ret, &dattr);
 681         }
 682
 683 out:
 684         NFSEXITCODE2(error, nd);
 685         return (error);
 686 }
 687
 688 /*
 689  * nfs readlink service
 690  */
 691 int
 692 nfsrvd_readlink(struct nfsrv_descript *nd, __unused int isdgram,
 693     vnode_t vp, __unused struct nfsexstuff *exp)
 694 {
 695         u_int32_t *tl;
 696         struct mbuf *mp = NULL, *mpend = NULL;
 697         int getret = 1, len;
 698         struct nfsvattr nva;
 699         struct thread *p = curthread;
 700         uint16_t off;
 701
 702         if (nd->nd_repstat) {
 703                 nfsrv_postopattr(nd, getret, &nva);
 704                 goto out;
 705         }
 706         if (vp->v_type != VLNK) {
 707                 if (nd->nd_flag & ND_NFSV2)
 708                         nd->nd_repstat = ENXIO;
 709                 else
 710                         nd->nd_repstat = EINVAL;
 711         }
 712         if (nd->nd_repstat == 0) {
 713                 if ((nd->nd_flag & ND_EXTPG) != 0)
 714                         nd->nd_repstat = nfsvno_readlink(vp, nd->nd_cred,
 715                             nd->nd_maxextsiz, p, &mp, &mpend, &len);
 716                 else
 717                         nd->nd_repstat = nfsvno_readlink(vp, nd->nd_cred,
 718                             0, p, &mp, &mpend, &len);
 719         }
 720         if (nd->nd_flag & ND_NFSV3)
 721                 getret = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
 722         vput(vp);
 723         if (nd->nd_flag & ND_NFSV3)
 724                 nfsrv_postopattr(nd, getret, &nva);
 725         if (nd->nd_repstat)
 726                 goto out;
 727         NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
 728         *tl = txdr_unsigned(len);
 729         if (mp != NULL) {
 730                 nd->nd_mb->m_next = mp;
 731                 nd->nd_mb = mpend;
 732                 if ((mpend->m_flags & M_EXTPG) != 0) {
 733                         nd->nd_bextpg = mpend->m_epg_npgs - 1;
 734                         nd->nd_bpos = (char *)(void *)
 735                             PHYS_TO_DMAP(mpend->m_epg_pa[nd->nd_bextpg]);
 736                         off = (nd->nd_bextpg == 0) ? mpend->m_epg_1st_off : 0;
 737                         nd->nd_bpos += off + mpend->m_epg_last_len;
 738                         nd->nd_bextpgsiz = PAGE_SIZE - mpend->m_epg_last_len -
 739                             off;
 740                 } else
 741                         nd->nd_bpos = mtod(mpend, char *) + mpend->m_len;
 742         }
 743
 744 out:
 745         NFSEXITCODE2(0, nd);
 746         return (0);
 747 }
 748
 749 /*
 750  * nfs read service
 751  */
 752 int
 753 nfsrvd_read(struct nfsrv_descript *nd, __unused int isdgram,
 754     vnode_t vp, struct nfsexstuff *exp)
 755 {
 756         u_int32_t *tl;
 757         int error = 0, cnt, getret = 1, gotproxystateid, reqlen, eof = 0;
 758         struct mbuf *m2, *m3;
 759         struct nfsvattr nva;
 760         off_t off = 0x0;
 761         struct nfsstate st, *stp = &st;
 762         struct nfslock lo, *lop = &lo;
 763         nfsv4stateid_t stateid;
 764         nfsquad_t clientid;
 765         struct thread *p = curthread;
 766         uint16_t poff;
 767
 768         if (nd->nd_repstat) {
 769                 nfsrv_postopattr(nd, getret, &nva);
 770                 goto out;
 771         }
 772         if (nd->nd_flag & ND_NFSV2) {
 773                 NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
 774                 off = (off_t)fxdr_unsigned(u_int32_t, *tl++);
 775                 reqlen = fxdr_unsigned(int, *tl);
 776         } else if (nd->nd_flag & ND_NFSV3) {
 777                 NFSM_DISSECT(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
 778                 off = fxdr_hyper(tl);
 779                 tl += 2;
 780                 reqlen = fxdr_unsigned(int, *tl);
 781         } else {
 782                 NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID + 3*NFSX_UNSIGNED);
 783                 reqlen = fxdr_unsigned(int, *(tl + 6));
 784         }
 785         if (reqlen > NFS_SRVMAXDATA(nd)) {
 786                 reqlen = NFS_SRVMAXDATA(nd);
 787         } else if (reqlen < 0) {
 788                 error = EBADRPC;
 789                 goto nfsmout;
 790         }
 791         gotproxystateid = 0;
 792         if (nd->nd_flag & ND_NFSV4) {
 793                 stp->ls_flags = (NFSLCK_CHECK | NFSLCK_READACCESS);
 794                 lop->lo_flags = NFSLCK_READ;
 795                 stp->ls_ownerlen = 0;
 796                 stp->ls_op = NULL;
 797                 stp->ls_uid = nd->nd_cred->cr_uid;
 798                 stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
 799                 clientid.lval[0] = stp->ls_stateid.other[0] = *tl++;
 800                 clientid.lval[1] = stp->ls_stateid.other[1] = *tl++;
 801                 if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
 802                         if ((nd->nd_flag & ND_NFSV41) != 0)
 803                                 clientid.qval = nd->nd_clientid.qval;
 804                         else if (nd->nd_clientid.qval != clientid.qval)
 805                                 printf("EEK1 multiple clids\n");
 806                 } else {
 807                         if ((nd->nd_flag & ND_NFSV41) != 0)
 808                                 printf("EEK! no clientid from session\n");
 809                         nd->nd_flag |= ND_IMPLIEDCLID;
 810                         nd->nd_clientid.qval = clientid.qval;
 811                 }
 812                 stp->ls_stateid.other[2] = *tl++;
 813                 /*
 814                  * Don't allow the client to use a special stateid for a DS op.
 815                  */
 816                 if ((nd->nd_flag & ND_DSSERVER) != 0 &&
 817                     ((stp->ls_stateid.other[0] == 0x0 &&
 818                     stp->ls_stateid.other[1] == 0x0 &&
 819                     stp->ls_stateid.other[2] == 0x0) ||
 820                     (stp->ls_stateid.other[0] == 0xffffffff &&
 821                     stp->ls_stateid.other[1] == 0xffffffff &&
 822                     stp->ls_stateid.other[2] == 0xffffffff) ||
 823                     stp->ls_stateid.seqid != 0))
 824                         nd->nd_repstat = NFSERR_BADSTATEID;
 825                 /* However, allow the proxy stateid. */
 826                 if (stp->ls_stateid.seqid == 0xffffffff &&
 827                     stp->ls_stateid.other[0] == 0x55555555 &&
 828                     stp->ls_stateid.other[1] == 0x55555555 &&
 829                     stp->ls_stateid.other[2] == 0x55555555)
 830                         gotproxystateid = 1;
 831                 off = fxdr_hyper(tl);
 832                 lop->lo_first = off;
 833                 tl += 2;
 834                 lop->lo_end = off + reqlen;
 835                 /*
 836                  * Paranoia, just in case it wraps around.
 837                  */
 838                 if (lop->lo_end < off)
 839                         lop->lo_end = NFS64BITSSET;
 840         }
 841         if (vp->v_type != VREG) {
 842                 if (nd->nd_flag & ND_NFSV3)
 843                         nd->nd_repstat = EINVAL;
 844                 else
 845                         nd->nd_repstat = (vp->v_type == VDIR) ? EISDIR :
 846                             EINVAL;
 847         }
 848         getret = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
 849         if (!nd->nd_repstat)
 850                 nd->nd_repstat = getret;
 851         if (!nd->nd_repstat &&
 852             (nva.na_uid != nd->nd_cred->cr_uid ||
 853              NFSVNO_EXSTRICTACCESS(exp))) {
 854                 nd->nd_repstat = nfsvno_accchk(vp, VREAD,
 855                     nd->nd_cred, exp, p,
 856                     NFSACCCHK_ALLOWOWNER, NFSACCCHK_VPISLOCKED, NULL);
 857                 if (nd->nd_repstat)
 858                         nd->nd_repstat = nfsvno_accchk(vp, VEXEC,
 859                             nd->nd_cred, exp, p, NFSACCCHK_ALLOWOWNER,
 860                             NFSACCCHK_VPISLOCKED, NULL);
 861         }
 862         /*
 863          * DS reads are marked by ND_DSSERVER or use the proxy special
 864          * stateid.
 865          */
 866         if (nd->nd_repstat == 0 && (nd->nd_flag & (ND_NFSV4 | ND_DSSERVER)) ==
 867             ND_NFSV4 && gotproxystateid == 0)
 868                 nd->nd_repstat = nfsrv_lockctrl(vp, &stp, &lop, NULL, clientid,
 869                     &stateid, exp, nd, p);
 870         if (nd->nd_repstat) {
 871                 vput(vp);
 872                 if (nd->nd_flag & ND_NFSV3)
 873                         nfsrv_postopattr(nd, getret, &nva);
 874                 goto out;
 875         }
 876         if (off >= nva.na_size) {
 877                 cnt = 0;
 878                 eof = 1;
 879         } else if (reqlen == 0)
 880                 cnt = 0;
 881         else if ((off + reqlen) >= nva.na_size) {
 882                 cnt = nva.na_size - off;
 883                 eof = 1;
 884         } else
 885                 cnt = reqlen;
 886         m3 = NULL;
 887         if (cnt > 0) {
 888                 /*
 889                  * If cnt > MCLBYTES and the reply will not be saved, use
 890                  * ext_pgs mbufs for TLS.
 891                  * For NFSv4.0, we do not know for sure if the reply will
 892                  * be saved, so do not use ext_pgs mbufs for NFSv4.0.
 893                  * Always use ext_pgs mbufs if ND_EXTPG is set.
 894                  */
 895                 if ((nd->nd_flag & ND_EXTPG) != 0 || (cnt > MCLBYTES &&
 896                     (nd->nd_flag & (ND_TLS | ND_SAVEREPLY)) == ND_TLS &&
 897                     (nd->nd_flag & (ND_NFSV4 | ND_NFSV41)) != ND_NFSV4))
 898                         nd->nd_repstat = nfsvno_read(vp, off, cnt, nd->nd_cred,
 899                             nd->nd_maxextsiz, p, &m3, &m2);
 900                 else
 901                         nd->nd_repstat = nfsvno_read(vp, off, cnt, nd->nd_cred,
 902                             0, p, &m3, &m2);
 903                 if (!(nd->nd_flag & ND_NFSV4)) {
 904                         getret = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
 905                         if (!nd->nd_repstat)
 906                                 nd->nd_repstat = getret;
 907                 }
 908                 if (nd->nd_repstat) {
 909                         vput(vp);
 910                         if (m3)
 911                                 m_freem(m3);
 912                         if (nd->nd_flag & ND_NFSV3)
 913                                 nfsrv_postopattr(nd, getret, &nva);
 914                         goto out;
 915                 }
 916         }
 917         vput(vp);
 918         if (nd->nd_flag & ND_NFSV2) {
 919                 nfsrv_fillattr(nd, &nva);
 920                 NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
 921         } else {
 922                 if (nd->nd_flag & ND_NFSV3) {
 923                         nfsrv_postopattr(nd, getret, &nva);
 924                         NFSM_BUILD(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
 925                         *tl++ = txdr_unsigned(cnt);
 926                 } else
 927                         NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
 928                 if (eof)
 929                         *tl++ = newnfs_true;
 930                 else
 931                         *tl++ = newnfs_false;
 932         }
 933         *tl = txdr_unsigned(cnt);
 934         if (m3) {
 935                 nd->nd_mb->m_next = m3;
 936                 nd->nd_mb = m2;
 937                 if ((m2->m_flags & M_EXTPG) != 0) {
 938                         nd->nd_flag |= ND_EXTPG;
 939                         nd->nd_bextpg = m2->m_epg_npgs - 1;
 940                         nd->nd_bpos = (char *)(void *)
 941                             PHYS_TO_DMAP(m2->m_epg_pa[nd->nd_bextpg]);
 942                         poff = (nd->nd_bextpg == 0) ? m2->m_epg_1st_off : 0;
 943                         nd->nd_bpos += poff + m2->m_epg_last_len;
 944                         nd->nd_bextpgsiz = PAGE_SIZE - m2->m_epg_last_len -
 945                             poff;
 946                 } else
 947                         nd->nd_bpos = mtod(m2, char *) + m2->m_len;
 948         }
 949
 950 out:
 951         NFSEXITCODE2(0, nd);
 952         return (0);
 953 nfsmout:
 954         vput(vp);
 955         NFSEXITCODE2(error, nd);
 956         return (error);
 957 }
 958
 959 /*
 960  * nfs write service
 961  */
 962 int
 963 nfsrvd_write(struct nfsrv_descript *nd, __unused int isdgram,
 964     vnode_t vp, struct nfsexstuff *exp)
 965 {
 966         u_int32_t *tl;
 967         struct nfsvattr nva, forat;
 968         int aftat_ret = 1, retlen, len, error = 0, forat_ret = 1;
 969         int gotproxystateid, stable = NFSWRITE_FILESYNC;
 970         off_t off;
 971         struct nfsstate st, *stp = &st;
 972         struct nfslock lo, *lop = &lo;
 973         nfsv4stateid_t stateid;
 974         nfsquad_t clientid;
 975         nfsattrbit_t attrbits;
 976         struct thread *p = curthread;
 977
 978         if (nd->nd_repstat) {
 979                 nfsrv_wcc(nd, forat_ret, &forat, aftat_ret, &nva);
 980                 goto out;
 981         }
 982         gotproxystateid = 0;
 983         if (nd->nd_flag & ND_NFSV2) {
 984                 NFSM_DISSECT(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
 985                 off = (off_t)fxdr_unsigned(u_int32_t, *++tl);
 986                 tl += 2;
 987                 retlen = len = fxdr_unsigned(int32_t, *tl);
 988         } else if (nd->nd_flag & ND_NFSV3) {
 989                 NFSM_DISSECT(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
 990                 off = fxdr_hyper(tl);
 991                 tl += 3;
 992                 stable = fxdr_unsigned(int, *tl++);
 993                 retlen = len = fxdr_unsigned(int32_t, *tl);
 994         } else {
 995                 NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID + 4 * NFSX_UNSIGNED);
 996                 stp->ls_flags = (NFSLCK_CHECK | NFSLCK_WRITEACCESS);
 997                 lop->lo_flags = NFSLCK_WRITE;
 998                 stp->ls_ownerlen = 0;
 999                 stp->ls_op = NULL;
1000                 stp->ls_uid = nd->nd_cred->cr_uid;
1001                 stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
1002                 clientid.lval[0] = stp->ls_stateid.other[0] = *tl++;
1003                 clientid.lval[1] = stp->ls_stateid.other[1] = *tl++;
1004                 if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
1005                         if ((nd->nd_flag & ND_NFSV41) != 0)
1006                                 clientid.qval = nd->nd_clientid.qval;
1007                         else if (nd->nd_clientid.qval != clientid.qval)
1008                                 printf("EEK2 multiple clids\n");
1009                 } else {
1010                         if ((nd->nd_flag & ND_NFSV41) != 0)
1011                                 printf("EEK! no clientid from session\n");
1012                         nd->nd_flag |= ND_IMPLIEDCLID;
1013                         nd->nd_clientid.qval = clientid.qval;
1014                 }
1015                 stp->ls_stateid.other[2] = *tl++;
1016                 /*
1017                  * Don't allow the client to use a special stateid for a DS op.
1018                  */
1019                 if ((nd->nd_flag & ND_DSSERVER) != 0 &&
1020                     ((stp->ls_stateid.other[0] == 0x0 &&
1021                     stp->ls_stateid.other[1] == 0x0 &&
1022                     stp->ls_stateid.other[2] == 0x0) ||
1023                     (stp->ls_stateid.other[0] == 0xffffffff &&
1024                     stp->ls_stateid.other[1] == 0xffffffff &&
1025                     stp->ls_stateid.other[2] == 0xffffffff) ||
1026                     stp->ls_stateid.seqid != 0))
1027                         nd->nd_repstat = NFSERR_BADSTATEID;
1028                 /* However, allow the proxy stateid. */
1029                 if (stp->ls_stateid.seqid == 0xffffffff &&
1030                     stp->ls_stateid.other[0] == 0x55555555 &&
1031                     stp->ls_stateid.other[1] == 0x55555555 &&
1032                     stp->ls_stateid.other[2] == 0x55555555)
1033                         gotproxystateid = 1;
1034                 off = fxdr_hyper(tl);
1035                 lop->lo_first = off;
1036                 tl += 2;
1037                 stable = fxdr_unsigned(int, *tl++);
1038                 retlen = len = fxdr_unsigned(int32_t, *tl);
1039                 lop->lo_end = off + len;
1040                 /*
1041                  * Paranoia, just in case it wraps around, which shouldn't
1042                  * ever happen anyhow.
1043                  */
1044                 if (lop->lo_end < lop->lo_first)
1045                         lop->lo_end = NFS64BITSSET;
1046         }
1047
1048         if (retlen > nfs_srvmaxio || retlen < 0)
1049                 nd->nd_repstat = EIO;
1050         if (vp->v_type != VREG && !nd->nd_repstat) {
1051                 if (nd->nd_flag & ND_NFSV3)
1052                         nd->nd_repstat = EINVAL;
1053                 else
1054                         nd->nd_repstat = (vp->v_type == VDIR) ? EISDIR :
1055                             EINVAL;
1056         }
1057         NFSZERO_ATTRBIT(&attrbits);
1058         NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_OWNER);
1059         forat_ret = nfsvno_getattr(vp, &forat, nd, p, 1, &attrbits);
1060         if (!nd->nd_repstat)
1061                 nd->nd_repstat = forat_ret;
1062         if (!nd->nd_repstat &&
1063             (forat.na_uid != nd->nd_cred->cr_uid ||
1064              NFSVNO_EXSTRICTACCESS(exp)))
1065                 nd->nd_repstat = nfsvno_accchk(vp, VWRITE,
1066                     nd->nd_cred, exp, p,
1067                     NFSACCCHK_ALLOWOWNER, NFSACCCHK_VPISLOCKED, NULL);
1068         /*
1069          * DS reads are marked by ND_DSSERVER or use the proxy special
1070          * stateid.
1071          */
1072         if (nd->nd_repstat == 0 && (nd->nd_flag & (ND_NFSV4 | ND_DSSERVER)) ==
1073             ND_NFSV4 && gotproxystateid == 0)
1074                 nd->nd_repstat = nfsrv_lockctrl(vp, &stp, &lop, NULL, clientid,
1075                     &stateid, exp, nd, p);
1076         if (nd->nd_repstat) {
1077                 vput(vp);
1078                 if (nd->nd_flag & ND_NFSV3)
1079                         nfsrv_wcc(nd, forat_ret, &forat, aftat_ret, &nva);
1080                 goto out;
1081         }
1082
1083         /*
1084          * For NFS Version 2, it is not obvious what a write of zero length
1085          * should do, but I might as well be consistent with Version 3,
1086          * which is to return ok so long as there are no permission problems.
1087          */
1088         if (retlen > 0) {
1089                 nd->nd_repstat = nfsvno_write(vp, off, retlen, &stable,
1090                     nd->nd_md, nd->nd_dpos, nd->nd_cred, p);
1091                 error = nfsm_advance(nd, NFSM_RNDUP(retlen), -1);
1092                 if (error)
1093                         goto nfsmout;
1094         }
1095         if (nd->nd_flag & ND_NFSV4)
1096                 aftat_ret = 0;
1097         else
1098                 aftat_ret = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
1099         vput(vp);
1100         if (!nd->nd_repstat)
1101                 nd->nd_repstat = aftat_ret;
1102         if (nd->nd_flag & (ND_NFSV3 | ND_NFSV4)) {
1103                 if (nd->nd_flag & ND_NFSV3)
1104                         nfsrv_wcc(nd, forat_ret, &forat, aftat_ret, &nva);
1105                 if (nd->nd_repstat)
1106                         goto out;
1107                 NFSM_BUILD(tl, u_int32_t *, 4 * NFSX_UNSIGNED);
1108                 *tl++ = txdr_unsigned(retlen);
1109                 /*
1110                  * If nfs_async is set, then pretend the write was FILESYNC.
1111                  * Warning: Doing this violates RFC1813 and runs a risk
1112                  * of data written by a client being lost when the server
1113                  * crashes/reboots.
1114                  */
1115                 if (stable == NFSWRITE_UNSTABLE && nfs_async == 0)
1116                         *tl++ = txdr_unsigned(stable);
1117                 else
1118                         *tl++ = txdr_unsigned(NFSWRITE_FILESYNC);
1119                 /*
1120                  * Actually, there is no need to txdr these fields,
1121                  * but it may make the values more human readable,
1122                  * for debugging purposes.
1123                  */
1124                 *tl++ = txdr_unsigned(nfsboottime.tv_sec);
1125                 *tl = txdr_unsigned(nfsboottime.tv_usec);
1126         } else if (!nd->nd_repstat)
1127                 nfsrv_fillattr(nd, &nva);
1128
1129 out:
1130         NFSEXITCODE2(0, nd);
1131         return (0);
1132 nfsmout:
1133         vput(vp);
1134         NFSEXITCODE2(error, nd);
1135         return (error);
1136 }
1137
1138 /*
1139  * nfs create service (creates regular files for V2 and V3. Spec. files for V2.)
1140  * now does a truncate to 0 length via. setattr if it already exists
1141  * The core creation routine has been extracted out into nfsrv_creatsub(),
1142  * so it can also be used by nfsrv_open() for V4.
1143  */
1144 int
1145 nfsrvd_create(struct nfsrv_descript *nd, __unused int isdgram,
1146     vnode_t dp, struct nfsexstuff *exp)
1147 {
1148         struct nfsvattr nva, dirfor, diraft;
1149         struct nfsv2_sattr *sp;
1150         struct nameidata named;
1151         u_int32_t *tl;
1152         int error = 0, tsize, dirfor_ret = 1, diraft_ret = 1;
1153         int how = NFSCREATE_UNCHECKED, exclusive_flag = 0;
1154         NFSDEV_T rdev = 0;
1155         vnode_t vp = NULL, dirp = NULL;
1156         fhandle_t fh;
1157         char *bufp;
1158         u_long *hashp;
1159         enum vtype vtyp;
1160         int32_t cverf[2], tverf[2] = { 0, 0 };
1161         struct thread *p = curthread;
1162
1163         if (nd->nd_repstat) {
1164                 nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1165                 goto out;
1166         }
1167         NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, CREATE,
1168             LOCKPARENT | LOCKLEAF | NOCACHE);
1169         nfsvno_setpathbuf(&named, &bufp, &hashp);
1170         error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
1171         if (error)
1172                 goto nfsmout;
1173         if (!nd->nd_repstat) {
1174                 NFSVNO_ATTRINIT(&nva);
1175                 if (nd->nd_flag & ND_NFSV2) {
1176                         NFSM_DISSECT(sp, struct nfsv2_sattr *, NFSX_V2SATTR);
1177                         vtyp = IFTOVT(fxdr_unsigned(u_int32_t, sp->sa_mode));
1178                         if (vtyp == VNON)
1179                                 vtyp = VREG;
1180                         NFSVNO_SETATTRVAL(&nva, type, vtyp);
1181                         NFSVNO_SETATTRVAL(&nva, mode,
1182                             nfstov_mode(sp->sa_mode));
1183                         switch (nva.na_type) {
1184                         case VREG:
1185                                 tsize = fxdr_unsigned(int32_t, sp->sa_size);
1186                                 if (tsize != -1)
1187                                         NFSVNO_SETATTRVAL(&nva, size,
1188                                             (u_quad_t)tsize);
1189                                 break;
1190                         case VCHR:
1191                         case VBLK:
1192                         case VFIFO:
1193                                 rdev = fxdr_unsigned(NFSDEV_T, sp->sa_size);
1194                                 break;
1195                         default:
1196                                 break;
1197                         }
1198                 } else {
1199                         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1200                         how = fxdr_unsigned(int, *tl);
1201                         switch (how) {
1202                         case NFSCREATE_GUARDED:
1203                         case NFSCREATE_UNCHECKED:
1204                                 error = nfsrv_sattr(nd, NULL, &nva, NULL, NULL, p);
1205                                 if (error)
1206                                         goto nfsmout;
1207                                 break;
1208                         case NFSCREATE_EXCLUSIVE:
1209                                 NFSM_DISSECT(tl, u_int32_t *, NFSX_VERF);
1210                                 cverf[0] = *tl++;
1211                                 cverf[1] = *tl;
1212                                 exclusive_flag = 1;
1213                                 break;
1214                         }
1215                         NFSVNO_SETATTRVAL(&nva, type, VREG);
1216                 }
1217         }
1218         if (nd->nd_repstat) {
1219                 nfsvno_relpathbuf(&named);
1220                 if (nd->nd_flag & ND_NFSV3) {
1221                         dirfor_ret = nfsvno_getattr(dp, &dirfor, nd, p, 1,
1222                             NULL);
1223                         nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret,
1224                             &diraft);
1225                 }
1226                 vput(dp);
1227                 goto out;
1228         }
1229
1230         nd->nd_repstat = nfsvno_namei(nd, &named, dp, 1, exp, &dirp);
1231         if (dirp) {
1232                 if (nd->nd_flag & ND_NFSV2) {
1233                         vrele(dirp);
1234                         dirp = NULL;
1235                 } else {
1236                         dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0,
1237                             NULL);
1238                 }
1239         }
1240         if (nd->nd_repstat) {
1241                 if (nd->nd_flag & ND_NFSV3)
1242                         nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret,
1243                             &diraft);
1244                 if (dirp)
1245                         vrele(dirp);
1246                 goto out;
1247         }
1248
1249         if (!(nd->nd_flag & ND_NFSV2)) {
1250                 switch (how) {
1251                 case NFSCREATE_GUARDED:
1252                         if (named.ni_vp)
1253                                 nd->nd_repstat = EEXIST;
1254                         break;
1255                 case NFSCREATE_UNCHECKED:
1256                         break;
1257                 case NFSCREATE_EXCLUSIVE:
1258                         if (named.ni_vp == NULL)
1259                                 NFSVNO_SETATTRVAL(&nva, mode, 0);
1260                         break;
1261                 }
1262         }
1263
1264         /*
1265          * Iff doesn't exist, create it
1266          * otherwise just truncate to 0 length
1267          *   should I set the mode too ?
1268          */
1269         nd->nd_repstat = nfsvno_createsub(nd, &named, &vp, &nva,
1270             &exclusive_flag, cverf, rdev, exp);
1271
1272         if (!nd->nd_repstat) {
1273                 nd->nd_repstat = nfsvno_getfh(vp, &fh, p);
1274                 if (!nd->nd_repstat)
1275                         nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1,
1276                             NULL);
1277                 vput(vp);
1278                 if (!nd->nd_repstat) {
1279                         tverf[0] = nva.na_atime.tv_sec;
1280                         tverf[1] = nva.na_atime.tv_nsec;
1281                 }
1282         }
1283         if (nd->nd_flag & ND_NFSV2) {
1284                 if (!nd->nd_repstat) {
1285                         (void)nfsm_fhtom(NULL, nd, (u_int8_t *)&fh, 0, 0);
1286                         nfsrv_fillattr(nd, &nva);
1287                 }
1288         } else {
1289                 if (exclusive_flag && !nd->nd_repstat && (cverf[0] != tverf[0]
1290                     || cverf[1] != tverf[1]))
1291                         nd->nd_repstat = EEXIST;
1292                 diraft_ret = nfsvno_getattr(dirp, &diraft, nd, p, 0, NULL);
1293                 vrele(dirp);
1294                 if (!nd->nd_repstat) {
1295                         (void)nfsm_fhtom(NULL, nd, (u_int8_t *)&fh, 0, 1);
1296                         nfsrv_postopattr(nd, 0, &nva);
1297                 }
1298                 nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1299         }
1300
1301 out:
1302         NFSEXITCODE2(0, nd);
1303         return (0);
1304 nfsmout:
1305         vput(dp);
1306         nfsvno_relpathbuf(&named);
1307         NFSEXITCODE2(error, nd);
1308         return (error);
1309 }
1310
1311 /*
1312  * nfs v3 mknod service (and v4 create)
1313  */
1314 int
1315 nfsrvd_mknod(struct nfsrv_descript *nd, __unused int isdgram,
1316     vnode_t dp, vnode_t *vpp, fhandle_t *fhp, struct nfsexstuff *exp)
1317 {
1318         struct nfsvattr nva, dirfor, diraft;
1319         u_int32_t *tl;
1320         struct nameidata named;
1321         int error = 0, dirfor_ret = 1, diraft_ret = 1, pathlen;
1322         u_int32_t major, minor;
1323         enum vtype vtyp = VNON;
1324         nfstype nfs4type = NFNON;
1325         vnode_t vp, dirp = NULL;
1326         nfsattrbit_t attrbits;
1327         char *bufp = NULL, *pathcp = NULL;
1328         u_long *hashp, cnflags;
1329         NFSACL_T *aclp = NULL;
1330         struct thread *p = curthread;
1331
1332         NFSVNO_ATTRINIT(&nva);
1333         cnflags = LOCKPARENT;
1334         if (nd->nd_repstat) {
1335                 nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1336                 goto out;
1337         }
1338 #ifdef NFS4_ACL_EXTATTR_NAME
1339         aclp = acl_alloc(M_WAITOK);
1340         aclp->acl_cnt = 0;
1341 #endif
1342
1343         /*
1344          * For V4, the creation stuff is here, Yuck!
1345          */
1346         if (nd->nd_flag & ND_NFSV4) {
1347                 NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1348                 vtyp = nfsv34tov_type(*tl);
1349                 nfs4type = fxdr_unsigned(nfstype, *tl);
1350                 switch (nfs4type) {
1351                 case NFLNK:
1352                         error = nfsvno_getsymlink(nd, &nva, p, &pathcp,
1353                             &pathlen);
1354                         if (error)
1355                                 goto nfsmout;
1356                         break;
1357                 case NFCHR:
1358                 case NFBLK:
1359                         NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1360                         major = fxdr_unsigned(u_int32_t, *tl++);
1361                         minor = fxdr_unsigned(u_int32_t, *tl);
1362                         nva.na_rdev = NFSMAKEDEV(major, minor);
1363                         break;
1364                 case NFSOCK:
1365                 case NFFIFO:
1366                         break;
1367                 case NFDIR:
1368                         cnflags = LOCKPARENT;
1369                         break;
1370                 default:
1371                         nd->nd_repstat = NFSERR_BADTYPE;
1372                         vrele(dp);
1373 #ifdef NFS4_ACL_EXTATTR_NAME
1374                         acl_free(aclp);
1375 #endif
1376                         goto out;
1377                 }
1378         }
1379         NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, CREATE, cnflags | NOCACHE);
1380         nfsvno_setpathbuf(&named, &bufp, &hashp);
1381         error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
1382         if (error)
1383                 goto nfsmout;
1384         if (!nd->nd_repstat) {
1385                 if (nd->nd_flag & ND_NFSV3) {
1386                         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
1387                         vtyp = nfsv34tov_type(*tl);
1388                 }
1389                 error = nfsrv_sattr(nd, NULL, &nva, &attrbits, aclp, p);
1390                 if (error)
1391                         goto nfsmout;
1392                 nva.na_type = vtyp;
1393                 if (!nd->nd_repstat && (nd->nd_flag & ND_NFSV3) &&
1394                     (vtyp == VCHR || vtyp == VBLK)) {
1395                         NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
1396                         major = fxdr_unsigned(u_int32_t, *tl++);
1397                         minor = fxdr_unsigned(u_int32_t, *tl);
1398                         nva.na_rdev = NFSMAKEDEV(major, minor);
1399                 }
1400         }
1401
1402         dirfor_ret = nfsvno_getattr(dp, &dirfor, nd, p, 0, NULL);
1403         if (!nd->nd_repstat && (nd->nd_flag & ND_NFSV4)) {
1404                 if (!dirfor_ret && NFSVNO_ISSETGID(&nva) &&
1405                     dirfor.na_gid == nva.na_gid)
1406                         NFSVNO_UNSET(&nva, gid);
1407                 nd->nd_repstat = nfsrv_checkuidgid(nd, &nva);
1408         }
1409         if (nd->nd_repstat) {
1410                 vrele(dp);
1411 #ifdef NFS4_ACL_EXTATTR_NAME
1412                 acl_free(aclp);
1413 #endif
1414                 nfsvno_relpathbuf(&named);
1415                 if (pathcp)
1416                         free(pathcp, M_TEMP);
1417                 if (nd->nd_flag & ND_NFSV3)
1418                         nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret,
1419                             &diraft);
1420                 goto out;
1421         }
1422
1423         /*
1424          * Yuck! For V4, mkdir and link are here and some V4 clients don't fill
1425          * in va_mode, so we'll have to set a default here.
1426          */
1427         if (NFSVNO_NOTSETMODE(&nva)) {
1428                 if (vtyp == VLNK)
1429                         nva.na_mode = 0755;
1430                 else
1431                         nva.na_mode = 0400;
1432         }
1433
1434         if (vtyp == VDIR)
1435                 named.ni_cnd.cn_flags |= WILLBEDIR;
1436         nd->nd_repstat = nfsvno_namei(nd, &named, dp, 0, exp, &dirp);
1437         if (nd->nd_repstat) {
1438                 if (dirp) {
1439                         if (nd->nd_flag & ND_NFSV3)
1440                                 dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd,
1441                                     p, 0, NULL);
1442                         vrele(dirp);
1443                 }
1444 #ifdef NFS4_ACL_EXTATTR_NAME
1445                 acl_free(aclp);
1446 #endif
1447                 if (nd->nd_flag & ND_NFSV3)
1448                         nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret,
1449                             &diraft);
1450                 goto out;
1451         }
1452         if (dirp)
1453                 dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0, NULL);
1454
1455         if ((nd->nd_flag & ND_NFSV4) && (vtyp == VDIR || vtyp == VLNK)) {
1456                 if (vtyp == VDIR) {
1457                         nfsrvd_mkdirsub(nd, &named, &nva, fhp, vpp, dirp,
1458                             &dirfor, &diraft, &diraft_ret, &attrbits, aclp, p,
1459                             exp);
1460 #ifdef NFS4_ACL_EXTATTR_NAME
1461                         acl_free(aclp);
1462 #endif
1463                         goto out;
1464                 } else if (vtyp == VLNK) {
1465                         nfsrvd_symlinksub(nd, &named, &nva, fhp, vpp, dirp,
1466                             &dirfor, &diraft, &diraft_ret, &attrbits,
1467                             aclp, p, exp, pathcp, pathlen);
1468 #ifdef NFS4_ACL_EXTATTR_NAME
1469                         acl_free(aclp);
1470 #endif
1471                         free(pathcp, M_TEMP);
1472                         goto out;
1473                 }
1474         }
1475
1476         nd->nd_repstat = nfsvno_mknod(&named, &nva, nd->nd_cred, p);
1477         if (!nd->nd_repstat) {
1478                 vp = named.ni_vp;
1479                 nfsrv_fixattr(nd, vp, &nva, aclp, p, &attrbits, exp);
1480                 nd->nd_repstat = nfsvno_getfh(vp, fhp, p);
1481                 if ((nd->nd_flag & ND_NFSV3) && !nd->nd_repstat)
1482                         nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1,
1483                             NULL);
1484                 if (vpp != NULL && nd->nd_repstat == 0) {
1485                         NFSVOPUNLOCK(vp);
1486                         *vpp = vp;
1487                 } else
1488                         vput(vp);
1489         }
1490
1491         diraft_ret = nfsvno_getattr(dirp, &diraft, nd, p, 0, NULL);
1492         vrele(dirp);
1493         if (!nd->nd_repstat) {
1494                 if (nd->nd_flag & ND_NFSV3) {
1495                         (void)nfsm_fhtom(NULL, nd, (u_int8_t *)fhp, 0, 1);
1496                         nfsrv_postopattr(nd, 0, &nva);
1497                 } else {
1498                         NFSM_BUILD(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
1499                         *tl++ = newnfs_false;
1500                         txdr_hyper(dirfor.na_filerev, tl);
1501                         tl += 2;
1502                         txdr_hyper(diraft.na_filerev, tl);
1503                         (void) nfsrv_putattrbit(nd, &attrbits);
1504                 }
1505         }
1506         if (nd->nd_flag & ND_NFSV3)
1507                 nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1508 #ifdef NFS4_ACL_EXTATTR_NAME
1509         acl_free(aclp);
1510 #endif
1511
1512 out:
1513         NFSEXITCODE2(0, nd);
1514         return (0);
1515 nfsmout:
1516         vrele(dp);
1517 #ifdef NFS4_ACL_EXTATTR_NAME
1518         acl_free(aclp);
1519 #endif
1520         if (bufp)
1521                 nfsvno_relpathbuf(&named);
1522         if (pathcp)
1523                 free(pathcp, M_TEMP);
1524
1525         NFSEXITCODE2(error, nd);
1526         return (error);
1527 }
1528
1529 /*
1530  * nfs remove service
1531  */
1532 int
1533 nfsrvd_remove(struct nfsrv_descript *nd, __unused int isdgram,
1534     vnode_t dp, struct nfsexstuff *exp)
1535 {
1536         struct nameidata named;
1537         u_int32_t *tl;
1538         int error = 0, dirfor_ret = 1, diraft_ret = 1;
1539         vnode_t dirp = NULL;
1540         struct nfsvattr dirfor, diraft;
1541         char *bufp;
1542         u_long *hashp;
1543         struct thread *p = curthread;
1544
1545         if (nd->nd_repstat) {
1546                 nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1547                 goto out;
1548         }
1549         NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, DELETE,
1550             LOCKPARENT | LOCKLEAF);
1551         nfsvno_setpathbuf(&named, &bufp, &hashp);
1552         error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
1553         if (error) {
1554                 vput(dp);
1555                 nfsvno_relpathbuf(&named);
1556                 goto out;
1557         }
1558         if (!nd->nd_repstat) {
1559                 nd->nd_repstat = nfsvno_namei(nd, &named, dp, 1, exp, &dirp);
1560         } else {
1561                 vput(dp);
1562                 nfsvno_relpathbuf(&named);
1563         }
1564         if (dirp) {
1565                 if (!(nd->nd_flag & ND_NFSV2)) {
1566                         dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0,
1567                             NULL);
1568                 } else {
1569                         vrele(dirp);
1570                         dirp = NULL;
1571                 }
1572         }
1573         if (!nd->nd_repstat) {
1574                 if (nd->nd_flag & ND_NFSV4) {
1575                         if (named.ni_vp->v_type == VDIR)
1576                                 nd->nd_repstat = nfsvno_rmdirsub(&named, 1,
1577                                     nd->nd_cred, p, exp);
1578                         else
1579                                 nd->nd_repstat = nfsvno_removesub(&named, 1,
1580                                     nd->nd_cred, p, exp);
1581                 } else if (nd->nd_procnum == NFSPROC_RMDIR) {
1582                         nd->nd_repstat = nfsvno_rmdirsub(&named, 0,
1583                             nd->nd_cred, p, exp);
1584                 } else {
1585                         nd->nd_repstat = nfsvno_removesub(&named, 0,
1586                             nd->nd_cred, p, exp);
1587                 }
1588         }
1589         if (!(nd->nd_flag & ND_NFSV2)) {
1590                 if (dirp) {
1591                         diraft_ret = nfsvno_getattr(dirp, &diraft, nd, p, 0,
1592                             NULL);
1593                         vrele(dirp);
1594                 }
1595                 if (nd->nd_flag & ND_NFSV3) {
1596                         nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret,
1597                             &diraft);
1598                 } else if (!nd->nd_repstat) {
1599                         NFSM_BUILD(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
1600                         *tl++ = newnfs_false;
1601                         txdr_hyper(dirfor.na_filerev, tl);
1602                         tl += 2;
1603                         txdr_hyper(diraft.na_filerev, tl);
1604                 }
1605         }
1606
1607 out:
1608         NFSEXITCODE2(error, nd);
1609         return (error);
1610 }
1611
1612 /*
1613  * nfs rename service
1614  */
1615 int
1616 nfsrvd_rename(struct nfsrv_descript *nd, int isdgram,
1617     vnode_t dp, vnode_t todp, struct nfsexstuff *exp, struct nfsexstuff *toexp)
1618 {
1619         u_int32_t *tl;
1620         int error = 0, fdirfor_ret = 1, fdiraft_ret = 1;
1621         int tdirfor_ret = 1, tdiraft_ret = 1;
1622         struct nameidata fromnd, tond;
1623         vnode_t fdirp = NULL, tdirp = NULL, tdp = NULL;
1624         struct nfsvattr fdirfor, fdiraft, tdirfor, tdiraft;
1625         struct nfsexstuff tnes;
1626         struct nfsrvfh tfh;
1627         char *bufp, *tbufp = NULL;
1628         u_long *hashp;
1629         fhandle_t fh;
1630         struct thread *p = curthread;
1631
1632         if (nd->nd_repstat) {
1633                 nfsrv_wcc(nd, fdirfor_ret, &fdirfor, fdiraft_ret, &fdiraft);
1634                 nfsrv_wcc(nd, tdirfor_ret, &tdirfor, tdiraft_ret, &tdiraft);
1635                 goto out;
1636         }
1637         if (!(nd->nd_flag & ND_NFSV2))
1638                 fdirfor_ret = nfsvno_getattr(dp, &fdirfor, nd, p, 1, NULL);
1639         tond.ni_cnd.cn_nameiop = 0;
1640         tond.ni_startdir = NULL;
1641         NFSNAMEICNDSET(&fromnd.ni_cnd, nd->nd_cred, DELETE, WANTPARENT);
1642         nfsvno_setpathbuf(&fromnd, &bufp, &hashp);
1643         error = nfsrv_parsename(nd, bufp, hashp, &fromnd.ni_pathlen);
1644         if (error) {
1645                 vput(dp);
1646                 if (todp)
1647                         vrele(todp);
1648                 nfsvno_relpathbuf(&fromnd);
1649                 goto out;
1650         }
1651         /*
1652          * Unlock dp in this code section, so it is unlocked before
1653          * tdp gets locked. This avoids a potential LOR if tdp is the
1654          * parent directory of dp.
1655          */
1656         if (nd->nd_flag & ND_NFSV4) {
1657                 tdp = todp;
1658                 tnes = *toexp;
1659                 if (dp != tdp) {
1660                         NFSVOPUNLOCK(dp);
1661                         /* Might lock tdp. */
1662                         tdirfor_ret = nfsvno_getattr(tdp, &tdirfor, nd, p, 0,
1663                             NULL);
1664                 } else {
1665                         tdirfor_ret = nfsvno_getattr(tdp, &tdirfor, nd, p, 1,
1666                             NULL);
1667                         NFSVOPUNLOCK(dp);
1668                 }
1669         } else {
1670                 tfh.nfsrvfh_len = 0;
1671                 error = nfsrv_mtofh(nd, &tfh);
1672                 if (error == 0)
1673                         error = nfsvno_getfh(dp, &fh, p);
1674                 if (error) {
1675                         vput(dp);
1676                         /* todp is always NULL except NFSv4 */
1677                         nfsvno_relpathbuf(&fromnd);
1678                         goto out;
1679                 }
1680
1681                 /* If this is the same file handle, just VREF() the vnode. */
1682                 if (tfh.nfsrvfh_len == NFSX_MYFH &&
1683                     !NFSBCMP(tfh.nfsrvfh_data, &fh, NFSX_MYFH)) {
1684                         VREF(dp);
1685                         tdp = dp;
1686                         tnes = *exp;
1687                         tdirfor_ret = nfsvno_getattr(tdp, &tdirfor, nd, p, 1,
1688                             NULL);
1689                         NFSVOPUNLOCK(dp);
1690                 } else {
1691                         NFSVOPUNLOCK(dp);
1692                         nd->nd_cred->cr_uid = nd->nd_saveduid;
1693                         nfsd_fhtovp(nd, &tfh, LK_EXCLUSIVE, &tdp, &tnes, NULL,
1694                             0, -1);     /* Locks tdp. */
1695                         if (tdp) {
1696                                 tdirfor_ret = nfsvno_getattr(tdp, &tdirfor, nd,
1697                                     p, 1, NULL);
1698                                 NFSVOPUNLOCK(tdp);
1699                         }
1700                 }
1701         }
1702         NFSNAMEICNDSET(&tond.ni_cnd, nd->nd_cred, RENAME, LOCKPARENT | LOCKLEAF | NOCACHE);
1703         nfsvno_setpathbuf(&tond, &tbufp, &hashp);
1704         if (!nd->nd_repstat) {
1705                 error = nfsrv_parsename(nd, tbufp, hashp, &tond.ni_pathlen);
1706                 if (error) {
1707                         if (tdp)
1708                                 vrele(tdp);
1709                         vrele(dp);
1710                         nfsvno_relpathbuf(&fromnd);
1711                         nfsvno_relpathbuf(&tond);
1712                         goto out;
1713                 }
1714         }
1715         if (nd->nd_repstat) {
1716                 if (nd->nd_flag & ND_NFSV3) {
1717                         nfsrv_wcc(nd, fdirfor_ret, &fdirfor, fdiraft_ret,
1718                             &fdiraft);
1719                         nfsrv_wcc(nd, tdirfor_ret, &tdirfor, tdiraft_ret,
1720                             &tdiraft);
1721                 }
1722                 if (tdp)
1723                         vrele(tdp);
1724                 vrele(dp);
1725                 nfsvno_relpathbuf(&fromnd);
1726                 nfsvno_relpathbuf(&tond);
1727                 goto out;
1728         }
1729
1730         /*
1731          * Done parsing, now down to business.
1732          */
1733         nd->nd_repstat = nfsvno_namei(nd, &fromnd, dp, 0, exp, &fdirp);
1734         if (nd->nd_repstat) {
1735                 if (nd->nd_flag & ND_NFSV3) {
1736                         nfsrv_wcc(nd, fdirfor_ret, &fdirfor, fdiraft_ret,
1737                             &fdiraft);
1738                         nfsrv_wcc(nd, tdirfor_ret, &tdirfor, tdiraft_ret,
1739                             &tdiraft);
1740                 }
1741                 if (fdirp)
1742                         vrele(fdirp);
1743                 if (tdp)
1744                         vrele(tdp);
1745                 nfsvno_relpathbuf(&tond);
1746                 goto out;
1747         }
1748         if (fromnd.ni_vp->v_type == VDIR)
1749                 tond.ni_cnd.cn_flags |= WILLBEDIR;
1750         nd->nd_repstat = nfsvno_namei(nd, &tond, tdp, 0, &tnes, &tdirp);
1751         nd->nd_repstat = nfsvno_rename(&fromnd, &tond, nd->nd_repstat,
1752             nd->nd_flag, nd->nd_cred, p);
1753         if (fdirp)
1754                 fdiraft_ret = nfsvno_getattr(fdirp, &fdiraft, nd, p, 0, NULL);
1755         if (tdirp)
1756                 tdiraft_ret = nfsvno_getattr(tdirp, &tdiraft, nd, p, 0, NULL);
1757         if (fdirp)
1758                 vrele(fdirp);
1759         if (tdirp)
1760                 vrele(tdirp);
1761         if (nd->nd_flag & ND_NFSV3) {
1762                 nfsrv_wcc(nd, fdirfor_ret, &fdirfor, fdiraft_ret, &fdiraft);
1763                 nfsrv_wcc(nd, tdirfor_ret, &tdirfor, tdiraft_ret, &tdiraft);
1764         } else if ((nd->nd_flag & ND_NFSV4) && !nd->nd_repstat) {
1765                 NFSM_BUILD(tl, u_int32_t *, 10 * NFSX_UNSIGNED);
1766                 *tl++ = newnfs_false;
1767                 txdr_hyper(fdirfor.na_filerev, tl);
1768                 tl += 2;
1769                 txdr_hyper(fdiraft.na_filerev, tl);
1770                 tl += 2;
1771                 *tl++ = newnfs_false;
1772                 txdr_hyper(tdirfor.na_filerev, tl);
1773                 tl += 2;
1774                 txdr_hyper(tdiraft.na_filerev, tl);
1775         }
1776
1777 out:
1778         NFSEXITCODE2(error, nd);
1779         return (error);
1780 }
1781
1782 /*
1783  * nfs link service
1784  */
1785 int
1786 nfsrvd_link(struct nfsrv_descript *nd, int isdgram,
1787     vnode_t vp, vnode_t tovp, struct nfsexstuff *exp, struct nfsexstuff *toexp)
1788 {
1789         struct nameidata named;
1790         u_int32_t *tl;
1791         int error = 0, dirfor_ret = 1, diraft_ret = 1, getret = 1;
1792         vnode_t dirp = NULL, dp = NULL;
1793         struct nfsvattr dirfor, diraft, at;
1794         struct nfsexstuff tnes;
1795         struct nfsrvfh dfh;
1796         char *bufp;
1797         u_long *hashp;
1798         struct thread *p = curthread;
1799
1800         if (nd->nd_repstat) {
1801                 nfsrv_postopattr(nd, getret, &at);
1802                 nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1803                 goto out;
1804         }
1805         NFSVOPUNLOCK(vp);
1806         if (vp->v_type == VDIR) {
1807                 if (nd->nd_flag & ND_NFSV4)
1808                         nd->nd_repstat = NFSERR_ISDIR;
1809                 else
1810                         nd->nd_repstat = NFSERR_INVAL;
1811                 if (tovp)
1812                         vrele(tovp);
1813         }
1814         if (!nd->nd_repstat) {
1815                 if (nd->nd_flag & ND_NFSV4) {
1816                         dp = tovp;
1817                         tnes = *toexp;
1818                 } else {
1819                         error = nfsrv_mtofh(nd, &dfh);
1820                         if (error) {
1821                                 vrele(vp);
1822                                 /* tovp is always NULL unless NFSv4 */
1823                                 goto out;
1824                         }
1825                         nfsd_fhtovp(nd, &dfh, LK_EXCLUSIVE, &dp, &tnes, NULL,
1826                             0, -1);
1827                         if (dp)
1828                                 NFSVOPUNLOCK(dp);
1829                 }
1830         }
1831         NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, CREATE, LOCKPARENT | NOCACHE);
1832         if (!nd->nd_repstat) {
1833                 nfsvno_setpathbuf(&named, &bufp, &hashp);
1834                 error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
1835                 if (error) {
1836                         vrele(vp);
1837                         if (dp)
1838                                 vrele(dp);
1839                         nfsvno_relpathbuf(&named);
1840                         goto out;
1841                 }
1842                 if (!nd->nd_repstat) {
1843                         nd->nd_repstat = nfsvno_namei(nd, &named, dp, 0, &tnes,
1844                             &dirp);
1845                 } else {
1846                         if (dp)
1847                                 vrele(dp);
1848                         nfsvno_relpathbuf(&named);
1849                 }
1850         }
1851         if (dirp) {
1852                 if (nd->nd_flag & ND_NFSV2) {
1853                         vrele(dirp);
1854                         dirp = NULL;
1855                 } else {
1856                         dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0,
1857                             NULL);
1858                 }
1859         }
1860         if (!nd->nd_repstat)
1861                 nd->nd_repstat = nfsvno_link(&named, vp, nd->nd_cred, p, exp);
1862         if (nd->nd_flag & ND_NFSV3)
1863                 getret = nfsvno_getattr(vp, &at, nd, p, 0, NULL);
1864         if (dirp) {
1865                 diraft_ret = nfsvno_getattr(dirp, &diraft, nd, p, 0, NULL);
1866                 vrele(dirp);
1867         }
1868         vrele(vp);
1869         if (nd->nd_flag & ND_NFSV3) {
1870                 nfsrv_postopattr(nd, getret, &at);
1871                 nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1872         } else if ((nd->nd_flag & ND_NFSV4) && !nd->nd_repstat) {
1873                 NFSM_BUILD(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
1874                 *tl++ = newnfs_false;
1875                 txdr_hyper(dirfor.na_filerev, tl);
1876                 tl += 2;
1877                 txdr_hyper(diraft.na_filerev, tl);
1878         }
1879
1880 out:
1881         NFSEXITCODE2(error, nd);
1882         return (error);
1883 }
1884
1885 /*
1886  * nfs symbolic link service
1887  */
1888 int
1889 nfsrvd_symlink(struct nfsrv_descript *nd, __unused int isdgram,
1890     vnode_t dp, vnode_t *vpp, fhandle_t *fhp, struct nfsexstuff *exp)
1891 {
1892         struct nfsvattr nva, dirfor, diraft;
1893         struct nameidata named;
1894         int error = 0, dirfor_ret = 1, diraft_ret = 1, pathlen;
1895         vnode_t dirp = NULL;
1896         char *bufp, *pathcp = NULL;
1897         u_long *hashp;
1898         struct thread *p = curthread;
1899
1900         if (nd->nd_repstat) {
1901                 nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1902                 goto out;
1903         }
1904         if (vpp)
1905                 *vpp = NULL;
1906         NFSVNO_ATTRINIT(&nva);
1907         NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, CREATE,
1908             LOCKPARENT | NOCACHE);
1909         nfsvno_setpathbuf(&named, &bufp, &hashp);
1910         error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
1911         if (!error && !nd->nd_repstat)
1912                 error = nfsvno_getsymlink(nd, &nva, p, &pathcp, &pathlen);
1913         if (error) {
1914                 vrele(dp);
1915                 nfsvno_relpathbuf(&named);
1916                 goto out;
1917         }
1918         if (!nd->nd_repstat) {
1919                 nd->nd_repstat = nfsvno_namei(nd, &named, dp, 0, exp, &dirp);
1920         } else {
1921                 vrele(dp);
1922                 nfsvno_relpathbuf(&named);
1923         }
1924         if (dirp != NULL && !(nd->nd_flag & ND_NFSV3)) {
1925                 vrele(dirp);
1926                 dirp = NULL;
1927         }
1928
1929         /*
1930          * And call nfsrvd_symlinksub() to do the common code. It will
1931          * return EBADRPC upon a parsing error, 0 otherwise.
1932          */
1933         if (!nd->nd_repstat) {
1934                 if (dirp != NULL)
1935                         dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0,
1936                             NULL);
1937                 nfsrvd_symlinksub(nd, &named, &nva, fhp, vpp, dirp,
1938                     &dirfor, &diraft, &diraft_ret, NULL, NULL, p, exp,
1939                     pathcp, pathlen);
1940         } else if (dirp != NULL) {
1941                 dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0, NULL);
1942                 vrele(dirp);
1943         }
1944         if (pathcp)
1945                 free(pathcp, M_TEMP);
1946
1947         if (nd->nd_flag & ND_NFSV3) {
1948                 if (!nd->nd_repstat) {
1949                         (void)nfsm_fhtom(NULL, nd, (u_int8_t *)fhp, 0, 1);
1950                         nfsrv_postopattr(nd, 0, &nva);
1951                 }
1952                 nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
1953         }
1954
1955 out:
1956         NFSEXITCODE2(error, nd);
1957         return (error);
1958 }
1959
1960 /*
1961  * Common code for creating a symbolic link.
1962  */
1963 static void
1964 nfsrvd_symlinksub(struct nfsrv_descript *nd, struct nameidata *ndp,
1965     struct nfsvattr *nvap, fhandle_t *fhp, vnode_t *vpp,
1966     vnode_t dirp, struct nfsvattr *dirforp, struct nfsvattr *diraftp,
1967     int *diraft_retp, nfsattrbit_t *attrbitp,
1968     NFSACL_T *aclp, NFSPROC_T *p, struct nfsexstuff *exp, char *pathcp,
1969     int pathlen)
1970 {
1971         u_int32_t *tl;
1972
1973         nd->nd_repstat = nfsvno_symlink(ndp, nvap, pathcp, pathlen,
1974             !(nd->nd_flag & ND_NFSV2), nd->nd_saveduid, nd->nd_cred, p, exp);
1975         if (!nd->nd_repstat && !(nd->nd_flag & ND_NFSV2)) {
1976                 nfsrv_fixattr(nd, ndp->ni_vp, nvap, aclp, p, attrbitp, exp);
1977                 if (nd->nd_flag & ND_NFSV3) {
1978                         nd->nd_repstat = nfsvno_getfh(ndp->ni_vp, fhp, p);
1979                         if (!nd->nd_repstat)
1980                                 nd->nd_repstat = nfsvno_getattr(ndp->ni_vp,
1981                                     nvap, nd, p, 1, NULL);
1982                 }
1983                 if (vpp != NULL && nd->nd_repstat == 0) {
1984                         NFSVOPUNLOCK(ndp->ni_vp);
1985                         *vpp = ndp->ni_vp;
1986                 } else
1987                         vput(ndp->ni_vp);
1988         }
1989         if (dirp) {
1990                 *diraft_retp = nfsvno_getattr(dirp, diraftp, nd, p, 0, NULL);
1991                 vrele(dirp);
1992         }
1993         if ((nd->nd_flag & ND_NFSV4) && !nd->nd_repstat) {
1994                 NFSM_BUILD(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
1995                 *tl++ = newnfs_false;
1996                 txdr_hyper(dirforp->na_filerev, tl);
1997                 tl += 2;
1998                 txdr_hyper(diraftp->na_filerev, tl);
1999                 (void) nfsrv_putattrbit(nd, attrbitp);
2000         }
2001
2002         NFSEXITCODE2(0, nd);
2003 }
2004
2005 /*
2006  * nfs mkdir service
2007  */
2008 int
2009 nfsrvd_mkdir(struct nfsrv_descript *nd, __unused int isdgram,
2010     vnode_t dp, vnode_t *vpp, fhandle_t *fhp, struct nfsexstuff *exp)
2011 {
2012         struct nfsvattr nva, dirfor, diraft;
2013         struct nameidata named;
2014         u_int32_t *tl;
2015         int error = 0, dirfor_ret = 1, diraft_ret = 1;
2016         vnode_t dirp = NULL;
2017         char *bufp;
2018         u_long *hashp;
2019         struct thread *p = curthread;
2020
2021         if (nd->nd_repstat) {
2022                 nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
2023                 goto out;
2024         }
2025         NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, CREATE, LOCKPARENT | NOCACHE);
2026         nfsvno_setpathbuf(&named, &bufp, &hashp);
2027         error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
2028         if (error)
2029                 goto nfsmout;
2030         if (!nd->nd_repstat) {
2031                 NFSVNO_ATTRINIT(&nva);
2032                 if (nd->nd_flag & ND_NFSV3) {
2033                         error = nfsrv_sattr(nd, NULL, &nva, NULL, NULL, p);
2034                         if (error)
2035                                 goto nfsmout;
2036                 } else {
2037                         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2038                         nva.na_mode = nfstov_mode(*tl++);
2039                 }
2040         }
2041         if (!nd->nd_repstat) {
2042                 nd->nd_repstat = nfsvno_namei(nd, &named, dp, 0, exp, &dirp);
2043         } else {
2044                 vrele(dp);
2045                 nfsvno_relpathbuf(&named);
2046         }
2047         if (dirp != NULL && !(nd->nd_flag & ND_NFSV3)) {
2048                 vrele(dirp);
2049                 dirp = NULL;
2050         }
2051         if (nd->nd_repstat) {
2052                 if (dirp != NULL) {
2053                         dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0,
2054                             NULL);
2055                         vrele(dirp);
2056                 }
2057                 if (nd->nd_flag & ND_NFSV3)
2058                         nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret,
2059                             &diraft);
2060                 goto out;
2061         }
2062         if (dirp != NULL)
2063                 dirfor_ret = nfsvno_getattr(dirp, &dirfor, nd, p, 0, NULL);
2064
2065         /*
2066          * Call nfsrvd_mkdirsub() for the code common to V4 as well.
2067          */
2068         nfsrvd_mkdirsub(nd, &named, &nva, fhp, vpp, dirp, &dirfor, &diraft,
2069             &diraft_ret, NULL, NULL, p, exp);
2070
2071         if (nd->nd_flag & ND_NFSV3) {
2072                 if (!nd->nd_repstat) {
2073                         (void)nfsm_fhtom(NULL, nd, (u_int8_t *)fhp, 0, 1);
2074                         nfsrv_postopattr(nd, 0, &nva);
2075                 }
2076                 nfsrv_wcc(nd, dirfor_ret, &dirfor, diraft_ret, &diraft);
2077         } else if (!nd->nd_repstat) {
2078                 (void)nfsm_fhtom(NULL, nd, (u_int8_t *)fhp, 0, 0);
2079                 nfsrv_fillattr(nd, &nva);
2080         }
2081
2082 out:
2083         NFSEXITCODE2(0, nd);
2084         return (0);
2085 nfsmout:
2086         vrele(dp);
2087         nfsvno_relpathbuf(&named);
2088         NFSEXITCODE2(error, nd);
2089         return (error);
2090 }
2091
2092 /*
2093  * Code common to mkdir for V2,3 and 4.
2094  */
2095 static void
2096 nfsrvd_mkdirsub(struct nfsrv_descript *nd, struct nameidata *ndp,
2097     struct nfsvattr *nvap, fhandle_t *fhp, vnode_t *vpp,
2098     vnode_t dirp, struct nfsvattr *dirforp, struct nfsvattr *diraftp,
2099     int *diraft_retp, nfsattrbit_t *attrbitp, NFSACL_T *aclp,
2100     NFSPROC_T *p, struct nfsexstuff *exp)
2101 {
2102         vnode_t vp;
2103         u_int32_t *tl;
2104
2105         NFSVNO_SETATTRVAL(nvap, type, VDIR);
2106         nd->nd_repstat = nfsvno_mkdir(ndp, nvap, nd->nd_saveduid,
2107             nd->nd_cred, p, exp);
2108         if (!nd->nd_repstat) {
2109                 vp = ndp->ni_vp;
2110                 nfsrv_fixattr(nd, vp, nvap, aclp, p, attrbitp, exp);
2111                 nd->nd_repstat = nfsvno_getfh(vp, fhp, p);
2112                 if (!(nd->nd_flag & ND_NFSV4) && !nd->nd_repstat)
2113                         nd->nd_repstat = nfsvno_getattr(vp, nvap, nd, p, 1,
2114                             NULL);
2115                 if (vpp && !nd->nd_repstat) {
2116                         NFSVOPUNLOCK(vp);
2117                         *vpp = vp;
2118                 } else {
2119                         vput(vp);
2120                 }
2121         }
2122         if (dirp) {
2123                 *diraft_retp = nfsvno_getattr(dirp, diraftp, nd, p, 0, NULL);
2124                 vrele(dirp);
2125         }
2126         if ((nd->nd_flag & ND_NFSV4) && !nd->nd_repstat) {
2127                 NFSM_BUILD(tl, u_int32_t *, 5 * NFSX_UNSIGNED);
2128                 *tl++ = newnfs_false;
2129                 txdr_hyper(dirforp->na_filerev, tl);
2130                 tl += 2;
2131                 txdr_hyper(diraftp->na_filerev, tl);
2132                 (void) nfsrv_putattrbit(nd, attrbitp);
2133         }
2134
2135         NFSEXITCODE2(0, nd);
2136 }
2137
2138 /*
2139  * nfs commit service
2140  */
2141 int
2142 nfsrvd_commit(struct nfsrv_descript *nd, __unused int isdgram,
2143     vnode_t vp, __unused struct nfsexstuff *exp)
2144 {
2145         struct nfsvattr bfor, aft;
2146         u_int32_t *tl;
2147         int error = 0, for_ret = 1, aft_ret = 1, cnt;
2148         u_int64_t off;
2149         struct thread *p = curthread;
2150
2151        if (nd->nd_repstat) {
2152                 nfsrv_wcc(nd, for_ret, &bfor, aft_ret, &aft);
2153                 goto out;
2154         }
2155
2156         /* Return NFSERR_ISDIR in NFSv4 when commit on a directory. */
2157         if (vp->v_type != VREG) {
2158                 if (nd->nd_flag & ND_NFSV3)
2159                         error = NFSERR_NOTSUPP;
2160                 else
2161                         error = (vp->v_type == VDIR) ? NFSERR_ISDIR : NFSERR_INVAL;
2162                 goto nfsmout;
2163         }
2164         NFSM_DISSECT(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
2165
2166         /*
2167          * XXX At this time VOP_FSYNC() does not accept offset and byte
2168          * count parameters, so these arguments are useless (someday maybe).
2169          */
2170         off = fxdr_hyper(tl);
2171         tl += 2;
2172         cnt = fxdr_unsigned(int, *tl);
2173         if (nd->nd_flag & ND_NFSV3)
2174                 for_ret = nfsvno_getattr(vp, &bfor, nd, p, 1, NULL);
2175         nd->nd_repstat = nfsvno_fsync(vp, off, cnt, nd->nd_cred, p);
2176         if (nd->nd_flag & ND_NFSV3) {
2177                 aft_ret = nfsvno_getattr(vp, &aft, nd, p, 1, NULL);
2178                 nfsrv_wcc(nd, for_ret, &bfor, aft_ret, &aft);
2179         }
2180         vput(vp);
2181         if (!nd->nd_repstat) {
2182                 NFSM_BUILD(tl, u_int32_t *, NFSX_VERF);
2183                 *tl++ = txdr_unsigned(nfsboottime.tv_sec);
2184                 *tl = txdr_unsigned(nfsboottime.tv_usec);
2185         }
2186
2187 out:
2188         NFSEXITCODE2(0, nd);
2189         return (0);
2190 nfsmout:
2191         vput(vp);
2192         NFSEXITCODE2(error, nd);
2193         return (error);
2194 }
2195
2196 /*
2197  * nfs statfs service
2198  */
2199 int
2200 nfsrvd_statfs(struct nfsrv_descript *nd, __unused int isdgram,
2201     vnode_t vp, __unused struct nfsexstuff *exp)
2202 {
2203         struct statfs *sf;
2204         u_int32_t *tl;
2205         int getret = 1;
2206         struct nfsvattr at;
2207         u_quad_t tval;
2208         struct thread *p = curthread;
2209
2210         sf = NULL;
2211         if (nd->nd_repstat) {
2212                 nfsrv_postopattr(nd, getret, &at);
2213                 goto out;
2214         }
2215         sf = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
2216         nd->nd_repstat = nfsvno_statfs(vp, sf);
2217         getret = nfsvno_getattr(vp, &at, nd, p, 1, NULL);
2218         vput(vp);
2219         if (nd->nd_flag & ND_NFSV3)
2220                 nfsrv_postopattr(nd, getret, &at);
2221         if (nd->nd_repstat)
2222                 goto out;
2223         if (nd->nd_flag & ND_NFSV2) {
2224                 NFSM_BUILD(tl, u_int32_t *, NFSX_V2STATFS);
2225                 *tl++ = txdr_unsigned(NFS_V2MAXDATA);
2226                 *tl++ = txdr_unsigned(sf->f_bsize);
2227                 *tl++ = txdr_unsigned(sf->f_blocks);
2228                 *tl++ = txdr_unsigned(sf->f_bfree);
2229                 *tl = txdr_unsigned(sf->f_bavail);
2230         } else {
2231                 NFSM_BUILD(tl, u_int32_t *, NFSX_V3STATFS);
2232                 tval = (u_quad_t)sf->f_blocks;
2233                 tval *= (u_quad_t)sf->f_bsize;
2234                 txdr_hyper(tval, tl); tl += 2;
2235                 tval = (u_quad_t)sf->f_bfree;
2236                 tval *= (u_quad_t)sf->f_bsize;
2237                 txdr_hyper(tval, tl); tl += 2;
2238                 tval = (u_quad_t)sf->f_bavail;
2239                 tval *= (u_quad_t)sf->f_bsize;
2240                 txdr_hyper(tval, tl); tl += 2;
2241                 tval = (u_quad_t)sf->f_files;
2242                 txdr_hyper(tval, tl); tl += 2;
2243                 tval = (u_quad_t)sf->f_ffree;
2244                 txdr_hyper(tval, tl); tl += 2;
2245                 tval = (u_quad_t)sf->f_ffree;
2246                 txdr_hyper(tval, tl); tl += 2;
2247                 *tl = 0;
2248         }
2249
2250 out:
2251         free(sf, M_STATFS);
2252         NFSEXITCODE2(0, nd);
2253         return (0);
2254 }
2255
2256 /*
2257  * nfs fsinfo service
2258  */
2259 int
2260 nfsrvd_fsinfo(struct nfsrv_descript *nd, int isdgram,
2261     vnode_t vp, __unused struct nfsexstuff *exp)
2262 {
2263         u_int32_t *tl;
2264         struct nfsfsinfo fs;
2265         int getret = 1;
2266         struct nfsvattr at;
2267         struct thread *p = curthread;
2268
2269         if (nd->nd_repstat) {
2270                 nfsrv_postopattr(nd, getret, &at);
2271                 goto out;
2272         }
2273         getret = nfsvno_getattr(vp, &at, nd, p, 1, NULL);
2274         nfsvno_getfs(&fs, isdgram);
2275         vput(vp);
2276         nfsrv_postopattr(nd, getret, &at);
2277         NFSM_BUILD(tl, u_int32_t *, NFSX_V3FSINFO);
2278         *tl++ = txdr_unsigned(fs.fs_rtmax);
2279         *tl++ = txdr_unsigned(fs.fs_rtpref);
2280         *tl++ = txdr_unsigned(fs.fs_rtmult);
2281         *tl++ = txdr_unsigned(fs.fs_wtmax);
2282         *tl++ = txdr_unsigned(fs.fs_wtpref);
2283         *tl++ = txdr_unsigned(fs.fs_wtmult);
2284         *tl++ = txdr_unsigned(fs.fs_dtpref);
2285         txdr_hyper(fs.fs_maxfilesize, tl);
2286         tl += 2;
2287         txdr_nfsv3time(&fs.fs_timedelta, tl);
2288         tl += 2;
2289         *tl = txdr_unsigned(fs.fs_properties);
2290
2291 out:
2292         NFSEXITCODE2(0, nd);
2293         return (0);
2294 }
2295
2296 /*
2297  * nfs pathconf service
2298  */
2299 int
2300 nfsrvd_pathconf(struct nfsrv_descript *nd, __unused int isdgram,
2301     vnode_t vp, __unused struct nfsexstuff *exp)
2302 {
2303         struct nfsv3_pathconf *pc;
2304         int getret = 1;
2305         long linkmax, namemax, chownres, notrunc;
2306         struct nfsvattr at;
2307         struct thread *p = curthread;
2308
2309         if (nd->nd_repstat) {
2310                 nfsrv_postopattr(nd, getret, &at);
2311                 goto out;
2312         }
2313         nd->nd_repstat = nfsvno_pathconf(vp, _PC_LINK_MAX, &linkmax,
2314             nd->nd_cred, p);
2315         if (!nd->nd_repstat)
2316                 nd->nd_repstat = nfsvno_pathconf(vp, _PC_NAME_MAX, &namemax,
2317                     nd->nd_cred, p);
2318         if (!nd->nd_repstat)
2319                 nd->nd_repstat=nfsvno_pathconf(vp, _PC_CHOWN_RESTRICTED,
2320                     &chownres, nd->nd_cred, p);
2321         if (!nd->nd_repstat)
2322                 nd->nd_repstat = nfsvno_pathconf(vp, _PC_NO_TRUNC, &notrunc,
2323                     nd->nd_cred, p);
2324         getret = nfsvno_getattr(vp, &at, nd, p, 1, NULL);
2325         vput(vp);
2326         nfsrv_postopattr(nd, getret, &at);
2327         if (!nd->nd_repstat) {
2328                 NFSM_BUILD(pc, struct nfsv3_pathconf *, NFSX_V3PATHCONF);
2329                 pc->pc_linkmax = txdr_unsigned(linkmax);
2330                 pc->pc_namemax = txdr_unsigned(namemax);
2331                 pc->pc_notrunc = txdr_unsigned(notrunc);
2332                 pc->pc_chownrestricted = txdr_unsigned(chownres);
2333
2334                 /*
2335                  * These should probably be supported by VOP_PATHCONF(), but
2336                  * until msdosfs is exportable (why would you want to?), the
2337                  * Unix defaults should be ok.
2338                  */
2339                 pc->pc_caseinsensitive = newnfs_false;
2340                 pc->pc_casepreserving = newnfs_true;
2341         }
2342
2343 out:
2344         NFSEXITCODE2(0, nd);
2345         return (0);
2346 }
2347
2348 /*
2349  * nfsv4 lock service
2350  */
2351 int
2352 nfsrvd_lock(struct nfsrv_descript *nd, __unused int isdgram,
2353     vnode_t vp, struct nfsexstuff *exp)
2354 {
2355         u_int32_t *tl;
2356         int i;
2357         struct nfsstate *stp = NULL;
2358         struct nfslock *lop;
2359         struct nfslockconflict cf;
2360         int error = 0;
2361         u_short flags = NFSLCK_LOCK, lflags;
2362         u_int64_t offset, len;
2363         nfsv4stateid_t stateid;
2364         nfsquad_t clientid;
2365         struct thread *p = curthread;
2366
2367         NFSM_DISSECT(tl, u_int32_t *, 7 * NFSX_UNSIGNED);
2368         i = fxdr_unsigned(int, *tl++);
2369         switch (i) {
2370         case NFSV4LOCKT_READW:
2371                 flags |= NFSLCK_BLOCKING;
2372         case NFSV4LOCKT_READ:
2373                 lflags = NFSLCK_READ;
2374                 break;
2375         case NFSV4LOCKT_WRITEW:
2376                 flags |= NFSLCK_BLOCKING;
2377         case NFSV4LOCKT_WRITE:
2378                 lflags = NFSLCK_WRITE;
2379                 break;
2380         default:
2381                 nd->nd_repstat = NFSERR_BADXDR;
2382                 goto nfsmout;
2383         }
2384         if (*tl++ == newnfs_true)
2385                 flags |= NFSLCK_RECLAIM;
2386         offset = fxdr_hyper(tl);
2387         tl += 2;
2388         len = fxdr_hyper(tl);
2389         tl += 2;
2390         if (*tl == newnfs_true)
2391                 flags |= NFSLCK_OPENTOLOCK;
2392         if (flags & NFSLCK_OPENTOLOCK) {
2393                 NFSM_DISSECT(tl, u_int32_t *, 5 * NFSX_UNSIGNED + NFSX_STATEID);
2394                 i = fxdr_unsigned(int, *(tl+4+(NFSX_STATEID / NFSX_UNSIGNED)));
2395                 if (i <= 0 || i > NFSV4_OPAQUELIMIT) {
2396                         nd->nd_repstat = NFSERR_BADXDR;
2397                         goto nfsmout;
2398                 }
2399                 stp = malloc(sizeof (struct nfsstate) + i,
2400                         M_NFSDSTATE, M_WAITOK);
2401                 stp->ls_ownerlen = i;
2402                 stp->ls_op = nd->nd_rp;
2403                 stp->ls_seq = fxdr_unsigned(int, *tl++);
2404                 stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
2405                 NFSBCOPY((caddr_t)tl, (caddr_t)stp->ls_stateid.other,
2406                         NFSX_STATEIDOTHER);
2407                 tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
2408
2409                 /*
2410                  * For the special stateid of other all 0s and seqid == 1, set
2411                  * the stateid to the current stateid, if it is set.
2412                  */
2413                 if ((nd->nd_flag & ND_NFSV41) != 0 &&
2414                     stp->ls_stateid.seqid == 1 &&
2415                     stp->ls_stateid.other[0] == 0 &&
2416                     stp->ls_stateid.other[1] == 0 &&
2417                     stp->ls_stateid.other[2] == 0) {
2418                         if ((nd->nd_flag & ND_CURSTATEID) != 0) {
2419                                 stp->ls_stateid = nd->nd_curstateid;
2420                                 stp->ls_stateid.seqid = 0;
2421                         } else {
2422                                 nd->nd_repstat = NFSERR_BADSTATEID;
2423                                 goto nfsmout;
2424                         }
2425                 }
2426
2427                 stp->ls_opentolockseq = fxdr_unsigned(int, *tl++);
2428                 clientid.lval[0] = *tl++;
2429                 clientid.lval[1] = *tl++;
2430                 if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
2431                         if ((nd->nd_flag & ND_NFSV41) != 0)
2432                                 clientid.qval = nd->nd_clientid.qval;
2433                         else if (nd->nd_clientid.qval != clientid.qval)
2434                                 printf("EEK3 multiple clids\n");
2435                 } else {
2436                         if ((nd->nd_flag & ND_NFSV41) != 0)
2437                                 printf("EEK! no clientid from session\n");
2438                         nd->nd_flag |= ND_IMPLIEDCLID;
2439                         nd->nd_clientid.qval = clientid.qval;
2440                 }
2441                 error = nfsrv_mtostr(nd, stp->ls_owner, stp->ls_ownerlen);
2442                 if (error)
2443                         goto nfsmout;
2444         } else {
2445                 NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID + NFSX_UNSIGNED);
2446                 stp = malloc(sizeof (struct nfsstate),
2447                         M_NFSDSTATE, M_WAITOK);
2448                 stp->ls_ownerlen = 0;
2449                 stp->ls_op = nd->nd_rp;
2450                 stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
2451                 NFSBCOPY((caddr_t)tl, (caddr_t)stp->ls_stateid.other,
2452                         NFSX_STATEIDOTHER);
2453                 tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
2454
2455                 /*
2456                  * For the special stateid of other all 0s and seqid == 1, set
2457                  * the stateid to the current stateid, if it is set.
2458                  */
2459                 if ((nd->nd_flag & ND_NFSV41) != 0 &&
2460                     stp->ls_stateid.seqid == 1 &&
2461                     stp->ls_stateid.other[0] == 0 &&
2462                     stp->ls_stateid.other[1] == 0 &&
2463                     stp->ls_stateid.other[2] == 0) {
2464                         if ((nd->nd_flag & ND_CURSTATEID) != 0) {
2465                                 stp->ls_stateid = nd->nd_curstateid;
2466                                 stp->ls_stateid.seqid = 0;
2467                         } else {
2468                                 nd->nd_repstat = NFSERR_BADSTATEID;
2469                                 goto nfsmout;
2470                         }
2471                 }
2472
2473                 stp->ls_seq = fxdr_unsigned(int, *tl);
2474                 clientid.lval[0] = stp->ls_stateid.other[0];
2475                 clientid.lval[1] = stp->ls_stateid.other[1];
2476                 if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
2477                         if ((nd->nd_flag & ND_NFSV41) != 0)
2478                                 clientid.qval = nd->nd_clientid.qval;
2479                         else if (nd->nd_clientid.qval != clientid.qval)
2480                                 printf("EEK4 multiple clids\n");
2481                 } else {
2482                         if ((nd->nd_flag & ND_NFSV41) != 0)
2483                                 printf("EEK! no clientid from session\n");
2484                         nd->nd_flag |= ND_IMPLIEDCLID;
2485                         nd->nd_clientid.qval = clientid.qval;
2486                 }
2487         }
2488         lop = malloc(sizeof (struct nfslock),
2489                 M_NFSDLOCK, M_WAITOK);
2490         lop->lo_first = offset;
2491         if (len == NFS64BITSSET) {
2492                 lop->lo_end = NFS64BITSSET;
2493         } else {
2494                 lop->lo_end = offset + len;
2495                 if (lop->lo_end <= lop->lo_first)
2496                         nd->nd_repstat = NFSERR_INVAL;
2497         }
2498         lop->lo_flags = lflags;
2499         stp->ls_flags = flags;
2500         stp->ls_uid = nd->nd_cred->cr_uid;
2501
2502         /*
2503          * Do basic access checking.
2504          */
2505         if (!nd->nd_repstat && vp->v_type != VREG) {
2506             if (vp->v_type == VDIR)
2507                 nd->nd_repstat = NFSERR_ISDIR;
2508             else
2509                 nd->nd_repstat = NFSERR_INVAL;
2510         }
2511         if (!nd->nd_repstat) {
2512             if (lflags & NFSLCK_WRITE) {
2513                 nd->nd_repstat = nfsvno_accchk(vp, VWRITE,
2514                     nd->nd_cred, exp, p, NFSACCCHK_ALLOWOWNER,
2515                     NFSACCCHK_VPISLOCKED, NULL);
2516             } else {
2517                 nd->nd_repstat = nfsvno_accchk(vp, VREAD,
2518                     nd->nd_cred, exp, p, NFSACCCHK_ALLOWOWNER,
2519                     NFSACCCHK_VPISLOCKED, NULL);
2520                 if (nd->nd_repstat)
2521                     nd->nd_repstat = nfsvno_accchk(vp, VEXEC,
2522                         nd->nd_cred, exp, p, NFSACCCHK_ALLOWOWNER,
2523                         NFSACCCHK_VPISLOCKED, NULL);
2524             }
2525         }
2526
2527         /*
2528          * We call nfsrv_lockctrl() even if nd_repstat set, so that the
2529          * seqid# gets updated. nfsrv_lockctrl() will return the value
2530          * of nd_repstat, if it gets that far.
2531          */
2532         nd->nd_repstat = nfsrv_lockctrl(vp, &stp, &lop, &cf, clientid,
2533                 &stateid, exp, nd, p);
2534         if (lop)
2535                 free(lop, M_NFSDLOCK);
2536         if (stp)
2537                 free(stp, M_NFSDSTATE);
2538         if (!nd->nd_repstat) {
2539                 /* For NFSv4.1, set the Current StateID. */
2540                 if ((nd->nd_flag & ND_NFSV41) != 0) {
2541                         nd->nd_curstateid = stateid;
2542                         nd->nd_flag |= ND_CURSTATEID;
2543                 }
2544                 NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
2545                 *tl++ = txdr_unsigned(stateid.seqid);
2546                 NFSBCOPY((caddr_t)stateid.other,(caddr_t)tl,NFSX_STATEIDOTHER);
2547         } else if (nd->nd_repstat == NFSERR_DENIED) {
2548                 NFSM_BUILD(tl, u_int32_t *, 7 * NFSX_UNSIGNED);
2549                 txdr_hyper(cf.cl_first, tl);
2550                 tl += 2;
2551                 if (cf.cl_end == NFS64BITSSET)
2552                         len = NFS64BITSSET;
2553                 else
2554                         len = cf.cl_end - cf.cl_first;
2555                 txdr_hyper(len, tl);
2556                 tl += 2;
2557                 if (cf.cl_flags == NFSLCK_WRITE)
2558                         *tl++ = txdr_unsigned(NFSV4LOCKT_WRITE);
2559                 else
2560                         *tl++ = txdr_unsigned(NFSV4LOCKT_READ);
2561                 *tl++ = stateid.other[0];
2562                 *tl = stateid.other[1];
2563                 (void) nfsm_strtom(nd, cf.cl_owner, cf.cl_ownerlen);
2564         }
2565         vput(vp);
2566         NFSEXITCODE2(0, nd);
2567         return (0);
2568 nfsmout:
2569         vput(vp);
2570         if (stp)
2571                 free(stp, M_NFSDSTATE);
2572         NFSEXITCODE2(error, nd);
2573         return (error);
2574 }
2575
2576 /*
2577  * nfsv4 lock test service
2578  */
2579 int
2580 nfsrvd_lockt(struct nfsrv_descript *nd, __unused int isdgram,
2581     vnode_t vp, struct nfsexstuff *exp)
2582 {
2583         u_int32_t *tl;
2584         int i;
2585         struct nfsstate *stp = NULL;
2586         struct nfslock lo, *lop = &lo;
2587         struct nfslockconflict cf;
2588         int error = 0;
2589         nfsv4stateid_t stateid;
2590         nfsquad_t clientid;
2591         u_int64_t len;
2592         struct thread *p = curthread;
2593
2594         NFSM_DISSECT(tl, u_int32_t *, 8 * NFSX_UNSIGNED);
2595         i = fxdr_unsigned(int, *(tl + 7));
2596         if (i <= 0 || i > NFSV4_OPAQUELIMIT) {
2597                 nd->nd_repstat = NFSERR_BADXDR;
2598                 goto nfsmout;
2599         }
2600         stp = malloc(sizeof (struct nfsstate) + i,
2601             M_NFSDSTATE, M_WAITOK);
2602         stp->ls_ownerlen = i;
2603         stp->ls_op = NULL;
2604         stp->ls_flags = NFSLCK_TEST;
2605         stp->ls_uid = nd->nd_cred->cr_uid;
2606         i = fxdr_unsigned(int, *tl++);
2607         switch (i) {
2608         case NFSV4LOCKT_READW:
2609                 stp->ls_flags |= NFSLCK_BLOCKING;
2610         case NFSV4LOCKT_READ:
2611                 lo.lo_flags = NFSLCK_READ;
2612                 break;
2613         case NFSV4LOCKT_WRITEW:
2614                 stp->ls_flags |= NFSLCK_BLOCKING;
2615         case NFSV4LOCKT_WRITE:
2616                 lo.lo_flags = NFSLCK_WRITE;
2617                 break;
2618         default:
2619                 nd->nd_repstat = NFSERR_BADXDR;
2620                 goto nfsmout;
2621         }
2622         lo.lo_first = fxdr_hyper(tl);
2623         tl += 2;
2624         len = fxdr_hyper(tl);
2625         if (len == NFS64BITSSET) {
2626                 lo.lo_end = NFS64BITSSET;
2627         } else {
2628                 lo.lo_end = lo.lo_first + len;
2629                 if (lo.lo_end <= lo.lo_first)
2630                         nd->nd_repstat = NFSERR_INVAL;
2631         }
2632         tl += 2;
2633         clientid.lval[0] = *tl++;
2634         clientid.lval[1] = *tl;
2635         if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
2636                 if ((nd->nd_flag & ND_NFSV41) != 0)
2637                         clientid.qval = nd->nd_clientid.qval;
2638                 else if (nd->nd_clientid.qval != clientid.qval)
2639                         printf("EEK5 multiple clids\n");
2640         } else {
2641                 if ((nd->nd_flag & ND_NFSV41) != 0)
2642                         printf("EEK! no clientid from session\n");
2643                 nd->nd_flag |= ND_IMPLIEDCLID;
2644                 nd->nd_clientid.qval = clientid.qval;
2645         }
2646         error = nfsrv_mtostr(nd, stp->ls_owner, stp->ls_ownerlen);
2647         if (error)
2648                 goto nfsmout;
2649         if (!nd->nd_repstat && vp->v_type != VREG) {
2650             if (vp->v_type == VDIR)
2651                 nd->nd_repstat = NFSERR_ISDIR;
2652             else
2653                 nd->nd_repstat = NFSERR_INVAL;
2654         }
2655         if (!nd->nd_repstat)
2656           nd->nd_repstat = nfsrv_lockctrl(vp, &stp, &lop, &cf, clientid,
2657             &stateid, exp, nd, p);
2658         if (nd->nd_repstat) {
2659             if (nd->nd_repstat == NFSERR_DENIED) {
2660                 NFSM_BUILD(tl, u_int32_t *, 7 * NFSX_UNSIGNED);
2661                 txdr_hyper(cf.cl_first, tl);
2662                 tl += 2;
2663                 if (cf.cl_end == NFS64BITSSET)
2664                         len = NFS64BITSSET;
2665                 else
2666                         len = cf.cl_end - cf.cl_first;
2667                 txdr_hyper(len, tl);
2668                 tl += 2;
2669                 if (cf.cl_flags == NFSLCK_WRITE)
2670                         *tl++ = txdr_unsigned(NFSV4LOCKT_WRITE);
2671                 else
2672                         *tl++ = txdr_unsigned(NFSV4LOCKT_READ);
2673                 *tl++ = stp->ls_stateid.other[0];
2674                 *tl = stp->ls_stateid.other[1];
2675                 (void) nfsm_strtom(nd, cf.cl_owner, cf.cl_ownerlen);
2676             }
2677         }
2678         vput(vp);
2679         if (stp)
2680                 free(stp, M_NFSDSTATE);
2681         NFSEXITCODE2(0, nd);
2682         return (0);
2683 nfsmout:
2684         vput(vp);
2685         if (stp)
2686                 free(stp, M_NFSDSTATE);
2687         NFSEXITCODE2(error, nd);
2688         return (error);
2689 }
2690
2691 /*
2692  * nfsv4 unlock service
2693  */
2694 int
2695 nfsrvd_locku(struct nfsrv_descript *nd, __unused int isdgram,
2696     vnode_t vp, struct nfsexstuff *exp)
2697 {
2698         u_int32_t *tl;
2699         int i;
2700         struct nfsstate *stp;
2701         struct nfslock *lop;
2702         int error = 0;
2703         nfsv4stateid_t stateid;
2704         nfsquad_t clientid;
2705         u_int64_t len;
2706         struct thread *p = curthread;
2707
2708         NFSM_DISSECT(tl, u_int32_t *, 6 * NFSX_UNSIGNED + NFSX_STATEID);
2709         stp = malloc(sizeof (struct nfsstate),
2710             M_NFSDSTATE, M_WAITOK);
2711         lop = malloc(sizeof (struct nfslock),
2712             M_NFSDLOCK, M_WAITOK);
2713         stp->ls_flags = NFSLCK_UNLOCK;
2714         lop->lo_flags = NFSLCK_UNLOCK;
2715         stp->ls_op = nd->nd_rp;
2716         i = fxdr_unsigned(int, *tl++);
2717         switch (i) {
2718         case NFSV4LOCKT_READW:
2719                 stp->ls_flags |= NFSLCK_BLOCKING;
2720         case NFSV4LOCKT_READ:
2721                 break;
2722         case NFSV4LOCKT_WRITEW:
2723                 stp->ls_flags |= NFSLCK_BLOCKING;
2724         case NFSV4LOCKT_WRITE:
2725                 break;
2726         default:
2727                 nd->nd_repstat = NFSERR_BADXDR;
2728                 free(stp, M_NFSDSTATE);
2729                 free(lop, M_NFSDLOCK);
2730                 goto nfsmout;
2731         }
2732         stp->ls_ownerlen = 0;
2733         stp->ls_uid = nd->nd_cred->cr_uid;
2734         stp->ls_seq = fxdr_unsigned(int, *tl++);
2735         stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
2736         NFSBCOPY((caddr_t)tl, (caddr_t)stp->ls_stateid.other,
2737             NFSX_STATEIDOTHER);
2738         tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
2739
2740         /*
2741          * For the special stateid of other all 0s and seqid == 1, set the
2742          * stateid to the current stateid, if it is set.
2743          */
2744         if ((nd->nd_flag & ND_NFSV41) != 0 && stp->ls_stateid.seqid == 1 &&
2745             stp->ls_stateid.other[0] == 0 && stp->ls_stateid.other[1] == 0 &&
2746             stp->ls_stateid.other[2] == 0) {
2747                 if ((nd->nd_flag & ND_CURSTATEID) != 0) {
2748                         stp->ls_stateid = nd->nd_curstateid;
2749                         stp->ls_stateid.seqid = 0;
2750                 } else {
2751                         nd->nd_repstat = NFSERR_BADSTATEID;
2752                         free(stp, M_NFSDSTATE);
2753                         free(lop, M_NFSDLOCK);
2754                         goto nfsmout;
2755                 }
2756         }
2757
2758         lop->lo_first = fxdr_hyper(tl);
2759         tl += 2;
2760         len = fxdr_hyper(tl);
2761         if (len == NFS64BITSSET) {
2762                 lop->lo_end = NFS64BITSSET;
2763         } else {
2764                 lop->lo_end = lop->lo_first + len;
2765                 if (lop->lo_end <= lop->lo_first)
2766                         nd->nd_repstat = NFSERR_INVAL;
2767         }
2768         clientid.lval[0] = stp->ls_stateid.other[0];
2769         clientid.lval[1] = stp->ls_stateid.other[1];
2770         if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
2771                 if ((nd->nd_flag & ND_NFSV41) != 0)
2772                         clientid.qval = nd->nd_clientid.qval;
2773                 else if (nd->nd_clientid.qval != clientid.qval)
2774                         printf("EEK6 multiple clids\n");
2775         } else {
2776                 if ((nd->nd_flag & ND_NFSV41) != 0)
2777                         printf("EEK! no clientid from session\n");
2778                 nd->nd_flag |= ND_IMPLIEDCLID;
2779                 nd->nd_clientid.qval = clientid.qval;
2780         }
2781         if (!nd->nd_repstat && vp->v_type != VREG) {
2782             if (vp->v_type == VDIR)
2783                 nd->nd_repstat = NFSERR_ISDIR;
2784             else
2785                 nd->nd_repstat = NFSERR_INVAL;
2786         }
2787         /*
2788          * Call nfsrv_lockctrl() even if nd_repstat is set, so that the
2789          * seqid# gets incremented. nfsrv_lockctrl() will return the
2790          * value of nd_repstat, if it gets that far.
2791          */
2792         nd->nd_repstat = nfsrv_lockctrl(vp, &stp, &lop, NULL, clientid,
2793             &stateid, exp, nd, p);
2794         if (stp)
2795                 free(stp, M_NFSDSTATE);
2796         if (lop)
2797                 free(lop, M_NFSDLOCK);
2798         if (!nd->nd_repstat) {
2799                 NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
2800                 *tl++ = txdr_unsigned(stateid.seqid);
2801                 NFSBCOPY((caddr_t)stateid.other,(caddr_t)tl,NFSX_STATEIDOTHER);
2802         }
2803 nfsmout:
2804         vput(vp);
2805         NFSEXITCODE2(error, nd);
2806         return (error);
2807 }
2808
2809 /*
2810  * nfsv4 open service
2811  */
2812 int
2813 nfsrvd_open(struct nfsrv_descript *nd, __unused int isdgram,
2814     vnode_t dp, vnode_t *vpp, __unused fhandle_t *fhp, struct nfsexstuff *exp)
2815 {
2816         u_int32_t *tl;
2817         int i, retext;
2818         struct nfsstate *stp = NULL;
2819         int error = 0, create, claim, exclusive_flag = 0, override;
2820         u_int32_t rflags = NFSV4OPEN_LOCKTYPEPOSIX, acemask;
2821         int how = NFSCREATE_UNCHECKED;
2822         int32_t cverf[2], tverf[2] = { 0, 0 };
2823         vnode_t vp = NULL, dirp = NULL;
2824         struct nfsvattr nva, dirfor, diraft;
2825         struct nameidata named;
2826         nfsv4stateid_t stateid, delegstateid;
2827         nfsattrbit_t attrbits;
2828         nfsquad_t clientid;
2829         char *bufp = NULL;
2830         u_long *hashp;
2831         NFSACL_T *aclp = NULL;
2832         struct thread *p = curthread;
2833         bool done_namei;
2834
2835 #ifdef NFS4_ACL_EXTATTR_NAME
2836         aclp = acl_alloc(M_WAITOK);
2837         aclp->acl_cnt = 0;
2838 #endif
2839         NFSZERO_ATTRBIT(&attrbits);
2840         done_namei = false;
2841         named.ni_cnd.cn_nameiop = 0;
2842         NFSM_DISSECT(tl, u_int32_t *, 6 * NFSX_UNSIGNED);
2843         i = fxdr_unsigned(int, *(tl + 5));
2844         if (i <= 0 || i > NFSV4_OPAQUELIMIT) {
2845                 nd->nd_repstat = NFSERR_BADXDR;
2846                 goto nfsmout;
2847         }
2848         stp = malloc(sizeof (struct nfsstate) + i,
2849             M_NFSDSTATE, M_WAITOK);
2850         stp->ls_ownerlen = i;
2851         stp->ls_op = nd->nd_rp;
2852         stp->ls_flags = NFSLCK_OPEN;
2853         stp->ls_uid = nd->nd_cred->cr_uid;
2854         stp->ls_seq = fxdr_unsigned(u_int32_t, *tl++);
2855         i = fxdr_unsigned(int, *tl++);
2856         retext = 0;
2857         if ((i & (NFSV4OPEN_WANTDELEGMASK | NFSV4OPEN_WANTSIGNALDELEG |
2858             NFSV4OPEN_WANTPUSHDELEG)) != 0 && (nd->nd_flag & ND_NFSV41) != 0) {
2859                 retext = 1;
2860                 /* For now, ignore these. */
2861                 i &= ~(NFSV4OPEN_WANTPUSHDELEG | NFSV4OPEN_WANTSIGNALDELEG);
2862                 switch (i & NFSV4OPEN_WANTDELEGMASK) {
2863                 case NFSV4OPEN_WANTANYDELEG:
2864                         stp->ls_flags |= (NFSLCK_WANTRDELEG |
2865                             NFSLCK_WANTWDELEG);
2866                         i &= ~NFSV4OPEN_WANTDELEGMASK;
2867                         break;
2868                 case NFSV4OPEN_WANTREADDELEG:
2869                         stp->ls_flags |= NFSLCK_WANTRDELEG;
2870                         i &= ~NFSV4OPEN_WANTDELEGMASK;
2871                         break;
2872                 case NFSV4OPEN_WANTWRITEDELEG:
2873                         stp->ls_flags |= NFSLCK_WANTWDELEG;
2874                         i &= ~NFSV4OPEN_WANTDELEGMASK;
2875                         break;
2876                 case NFSV4OPEN_WANTNODELEG:
2877                         stp->ls_flags |= NFSLCK_WANTNODELEG;
2878                         i &= ~NFSV4OPEN_WANTDELEGMASK;
2879                         break;
2880                 case NFSV4OPEN_WANTCANCEL:
2881                         printf("NFSv4: ignore Open WantCancel\n");
2882                         i &= ~NFSV4OPEN_WANTDELEGMASK;
2883                         break;
2884                 default:
2885                         /* nd_repstat will be set to NFSERR_INVAL below. */
2886                         break;
2887                 }
2888         }
2889         switch (i) {
2890         case NFSV4OPEN_ACCESSREAD:
2891                 stp->ls_flags |= NFSLCK_READACCESS;
2892                 break;
2893         case NFSV4OPEN_ACCESSWRITE:
2894                 stp->ls_flags |= NFSLCK_WRITEACCESS;
2895                 break;
2896         case NFSV4OPEN_ACCESSBOTH:
2897                 stp->ls_flags |= (NFSLCK_READACCESS | NFSLCK_WRITEACCESS);
2898                 break;
2899         default:
2900                 nd->nd_repstat = NFSERR_INVAL;
2901         }
2902         i = fxdr_unsigned(int, *tl++);
2903         switch (i) {
2904         case NFSV4OPEN_DENYNONE:
2905                 break;
2906         case NFSV4OPEN_DENYREAD:
2907                 stp->ls_flags |= NFSLCK_READDENY;
2908                 break;
2909         case NFSV4OPEN_DENYWRITE:
2910                 stp->ls_flags |= NFSLCK_WRITEDENY;
2911                 break;
2912         case NFSV4OPEN_DENYBOTH:
2913                 stp->ls_flags |= (NFSLCK_READDENY | NFSLCK_WRITEDENY);
2914                 break;
2915         default:
2916                 nd->nd_repstat = NFSERR_INVAL;
2917         }
2918         clientid.lval[0] = *tl++;
2919         clientid.lval[1] = *tl;
2920         if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
2921                 if ((nd->nd_flag & ND_NFSV41) != 0)
2922                         clientid.qval = nd->nd_clientid.qval;
2923                 else if (nd->nd_clientid.qval != clientid.qval)
2924                         printf("EEK7 multiple clids\n");
2925         } else {
2926                 if ((nd->nd_flag & ND_NFSV41) != 0)
2927                         printf("EEK! no clientid from session\n");
2928                 nd->nd_flag |= ND_IMPLIEDCLID;
2929                 nd->nd_clientid.qval = clientid.qval;
2930         }
2931         error = nfsrv_mtostr(nd, stp->ls_owner, stp->ls_ownerlen);
2932         if (error)
2933                 goto nfsmout;
2934         NFSVNO_ATTRINIT(&nva);
2935         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2936         create = fxdr_unsigned(int, *tl);
2937         if (!nd->nd_repstat)
2938                 nd->nd_repstat = nfsvno_getattr(dp, &dirfor, nd, p, 0, NULL);
2939         if (create == NFSV4OPEN_CREATE) {
2940                 nva.na_type = VREG;
2941                 nva.na_mode = 0;
2942                 NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
2943                 how = fxdr_unsigned(int, *tl);
2944                 switch (how) {
2945                 case NFSCREATE_UNCHECKED:
2946                 case NFSCREATE_GUARDED:
2947                         error = nfsv4_sattr(nd, NULL, &nva, &attrbits, aclp, p);
2948                         if (error)
2949                                 goto nfsmout;
2950                         /*
2951                          * If the na_gid being set is the same as that of
2952                          * the directory it is going in, clear it, since
2953                          * that is what will be set by default. This allows
2954                          * a user that isn't in that group to do the create.
2955                          */
2956                         if (!nd->nd_repstat && NFSVNO_ISSETGID(&nva) &&
2957                             nva.na_gid == dirfor.na_gid)
2958                                 NFSVNO_UNSET(&nva, gid);
2959                         if (!nd->nd_repstat)
2960                                 nd->nd_repstat = nfsrv_checkuidgid(nd, &nva);
2961                         break;
2962                 case NFSCREATE_EXCLUSIVE:
2963                         NFSM_DISSECT(tl, u_int32_t *, NFSX_VERF);
2964                         cverf[0] = *tl++;
2965                         cverf[1] = *tl;
2966                         break;
2967                 case NFSCREATE_EXCLUSIVE41:
2968                         NFSM_DISSECT(tl, u_int32_t *, NFSX_VERF);
2969                         cverf[0] = *tl++;
2970                         cverf[1] = *tl;
2971                         error = nfsv4_sattr(nd, NULL, &nva, &attrbits, aclp, p);
2972                         if (error != 0)
2973                                 goto nfsmout;
2974                         if (NFSISSET_ATTRBIT(&attrbits,
2975                             NFSATTRBIT_TIMEACCESSSET))
2976                                 nd->nd_repstat = NFSERR_INVAL;
2977                         /*
2978                          * If the na_gid being set is the same as that of
2979                          * the directory it is going in, clear it, since
2980                          * that is what will be set by default. This allows
2981                          * a user that isn't in that group to do the create.
2982                          */
2983                         if (nd->nd_repstat == 0 && NFSVNO_ISSETGID(&nva) &&
2984                             nva.na_gid == dirfor.na_gid)
2985                                 NFSVNO_UNSET(&nva, gid);
2986                         if (nd->nd_repstat == 0)
2987                                 nd->nd_repstat = nfsrv_checkuidgid(nd, &nva);
2988                         break;
2989                 default:
2990                         nd->nd_repstat = NFSERR_BADXDR;
2991                         goto nfsmout;
2992                 }
2993         } else if (create != NFSV4OPEN_NOCREATE) {
2994                 nd->nd_repstat = NFSERR_BADXDR;
2995                 goto nfsmout;
2996         }
2997
2998         /*
2999          * Now, handle the claim, which usually includes looking up a
3000          * name in the directory referenced by dp. The exception is
3001          * NFSV4OPEN_CLAIMPREVIOUS.
3002          */
3003         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
3004         claim = fxdr_unsigned(int, *tl);
3005         if (claim == NFSV4OPEN_CLAIMDELEGATECUR || claim ==
3006             NFSV4OPEN_CLAIMDELEGATECURFH) {
3007                 NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID);
3008                 stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
3009                 NFSBCOPY((caddr_t)tl,(caddr_t)stateid.other,NFSX_STATEIDOTHER);
3010                 stp->ls_flags |= NFSLCK_DELEGCUR;
3011         } else if (claim == NFSV4OPEN_CLAIMDELEGATEPREV || claim ==
3012             NFSV4OPEN_CLAIMDELEGATEPREVFH) {
3013                 stp->ls_flags |= NFSLCK_DELEGPREV;
3014         }
3015         if (claim == NFSV4OPEN_CLAIMNULL || claim == NFSV4OPEN_CLAIMDELEGATECUR
3016             || claim == NFSV4OPEN_CLAIMDELEGATEPREV) {
3017                 if (!nd->nd_repstat && create == NFSV4OPEN_CREATE &&
3018                     claim != NFSV4OPEN_CLAIMNULL)
3019                         nd->nd_repstat = NFSERR_INVAL;
3020                 if (nd->nd_repstat) {
3021                         nd->nd_repstat = nfsrv_opencheck(clientid,
3022                             &stateid, stp, NULL, nd, p, nd->nd_repstat);
3023                         goto nfsmout;
3024                 }
3025                 if (create == NFSV4OPEN_CREATE)
3026                     NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, CREATE,
3027                         LOCKPARENT | LOCKLEAF | NOCACHE);
3028                 else
3029                     NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, LOOKUP,
3030                         LOCKLEAF);
3031                 nfsvno_setpathbuf(&named, &bufp, &hashp);
3032                 error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
3033                 if (error) {
3034                         vrele(dp);
3035 #ifdef NFS4_ACL_EXTATTR_NAME
3036                         acl_free(aclp);
3037 #endif
3038                         free(stp, M_NFSDSTATE);
3039                         nfsvno_relpathbuf(&named);
3040                         NFSEXITCODE2(error, nd);
3041                         return (error);
3042                 }
3043                 if (!nd->nd_repstat) {
3044                         nd->nd_repstat = nfsvno_namei(nd, &named, dp, 0, exp,
3045                             &dirp);
3046                 } else {
3047                         vrele(dp);
3048                         nfsvno_relpathbuf(&named);
3049                 }
3050                 if (create == NFSV4OPEN_CREATE) {
3051                     switch (how) {
3052                     case NFSCREATE_UNCHECKED:
3053                         if (nd->nd_repstat == 0 && named.ni_vp != NULL) {
3054                                 /*
3055                                  * Clear the setable attribute bits, except
3056                                  * for Size, if it is being truncated.
3057                                  */
3058                                 NFSZERO_ATTRBIT(&attrbits);
3059                                 if (NFSVNO_ISSETSIZE(&nva))
3060                                         NFSSETBIT_ATTRBIT(&attrbits,
3061                                             NFSATTRBIT_SIZE);
3062                         }
3063                         break;
3064                     case NFSCREATE_GUARDED:
3065                         if (nd->nd_repstat == 0 && named.ni_vp != NULL) {
3066                                 nd->nd_repstat = EEXIST;
3067                                 done_namei = true;
3068                         }
3069                         break;
3070                     case NFSCREATE_EXCLUSIVE:
3071                         exclusive_flag = 1;
3072                         if (nd->nd_repstat == 0 && named.ni_vp == NULL)
3073                                 nva.na_mode = 0;
3074                         break;
3075                     case NFSCREATE_EXCLUSIVE41:
3076                         exclusive_flag = 1;
3077                         break;
3078                     }
3079                 }
3080                 nfsvno_open(nd, &named, clientid, &stateid, stp,
3081                     &exclusive_flag, &nva, cverf, create, aclp, &attrbits,
3082                     nd->nd_cred, done_namei, exp, &vp);
3083         } else if (claim == NFSV4OPEN_CLAIMPREVIOUS || claim ==
3084             NFSV4OPEN_CLAIMFH || claim == NFSV4OPEN_CLAIMDELEGATECURFH ||
3085             claim == NFSV4OPEN_CLAIMDELEGATEPREVFH) {
3086                 if (claim == NFSV4OPEN_CLAIMPREVIOUS) {
3087                         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
3088                         i = fxdr_unsigned(int, *tl);
3089                         switch (i) {
3090                         case NFSV4OPEN_DELEGATEREAD:
3091                                 stp->ls_flags |= NFSLCK_DELEGREAD;
3092                                 break;
3093                         case NFSV4OPEN_DELEGATEWRITE:
3094                                 stp->ls_flags |= NFSLCK_DELEGWRITE;
3095                         case NFSV4OPEN_DELEGATENONE:
3096                                 break;
3097                         default:
3098                                 nd->nd_repstat = NFSERR_BADXDR;
3099                                 goto nfsmout;
3100                         }
3101                         stp->ls_flags |= NFSLCK_RECLAIM;
3102                 } else {
3103                         if (nd->nd_repstat == 0 && create == NFSV4OPEN_CREATE)
3104                                 nd->nd_repstat = NFSERR_INVAL;
3105                 }
3106                 vp = dp;
3107                 NFSVOPLOCK(vp, LK_EXCLUSIVE | LK_RETRY);
3108                 if (!VN_IS_DOOMED(vp))
3109                         nd->nd_repstat = nfsrv_opencheck(clientid, &stateid,
3110                             stp, vp, nd, p, nd->nd_repstat);
3111                 else
3112                         nd->nd_repstat = NFSERR_PERM;
3113         } else {
3114                 nd->nd_repstat = NFSERR_BADXDR;
3115                 goto nfsmout;
3116         }
3117
3118         /*
3119          * Do basic access checking.
3120          */
3121         if (!nd->nd_repstat && vp->v_type != VREG) {
3122                 /*
3123                  * The IETF working group decided that this is the correct
3124                  * error return for all non-regular files.
3125                  */
3126                 nd->nd_repstat = (vp->v_type == VDIR) ? NFSERR_ISDIR : NFSERR_SYMLINK;
3127         }
3128
3129         /*
3130          * If the Open is being done for a file that already exists, apply
3131          * normal permission checking including for the file owner, if
3132          * vfs.nfsd.v4openaccess is set.
3133          * Previously, the owner was always allowed to open the file to
3134          * be consistent with the NFS tradition of always allowing the
3135          * owner of the file to write to the file regardless of permissions.
3136          * It now appears that the Linux client expects the owner
3137          * permissions to be checked for opens that are not creating the
3138          * file.  I believe the correct approach is to use the Access
3139          * operation's results to be consistent with NFSv3, but that is
3140          * not what the current Linux client appears to be doing.
3141          * Since both the Linux and OpenSolaris NFSv4 servers do this check,
3142          * I have enabled it by default.  Since Linux does not apply this
3143          * check for claim_delegate_cur, this code does the same.
3144          * If this semantic change causes a problem, it can be disabled by
3145          * setting the sysctl vfs.nfsd.v4openaccess to 0 to re-enable the
3146          * previous semantics.
3147          */
3148         if (nfsrv_openaccess && create == NFSV4OPEN_NOCREATE &&
3149             (stp->ls_flags & NFSLCK_DELEGCUR) == 0)
3150                 override = NFSACCCHK_NOOVERRIDE;
3151         else
3152                 override = NFSACCCHK_ALLOWOWNER;
3153         if (!nd->nd_repstat && (stp->ls_flags & NFSLCK_WRITEACCESS))
3154             nd->nd_repstat = nfsvno_accchk(vp, VWRITE, nd->nd_cred,
3155                 exp, p, override, NFSACCCHK_VPISLOCKED, NULL);
3156         if (!nd->nd_repstat && (stp->ls_flags & NFSLCK_READACCESS)) {
3157             nd->nd_repstat = nfsvno_accchk(vp, VREAD, nd->nd_cred,
3158                 exp, p, override, NFSACCCHK_VPISLOCKED, NULL);
3159             if (nd->nd_repstat)
3160                 nd->nd_repstat = nfsvno_accchk(vp, VEXEC,
3161                     nd->nd_cred, exp, p, override,
3162                     NFSACCCHK_VPISLOCKED, NULL);
3163         }
3164
3165         if (!nd->nd_repstat) {
3166                 nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
3167                 if (!nd->nd_repstat) {
3168                         tverf[0] = nva.na_atime.tv_sec;
3169                         tverf[1] = nva.na_atime.tv_nsec;
3170                 }
3171         }
3172         if (!nd->nd_repstat && exclusive_flag && (cverf[0] != tverf[0] ||
3173             cverf[1] != tverf[1]))
3174                 nd->nd_repstat = EEXIST;
3175         /*
3176          * Do the open locking/delegation stuff.
3177          */
3178         if (!nd->nd_repstat)
3179             nd->nd_repstat = nfsrv_openctrl(nd, vp, &stp, clientid, &stateid,
3180                 &delegstateid, &rflags, exp, p, nva.na_filerev);
3181
3182         /*
3183          * vp must be unlocked before the call to nfsvno_getattr(dirp,...)
3184          * below, to avoid a deadlock with the lookup in nfsvno_namei() above.
3185          * (ie: Leave the NFSVOPUNLOCK() about here.)
3186          */
3187         if (vp)
3188                 NFSVOPUNLOCK(vp);
3189         if (stp)
3190                 free(stp, M_NFSDSTATE);
3191         if (!nd->nd_repstat && dirp)
3192                 nd->nd_repstat = nfsvno_getattr(dirp, &diraft, nd, p, 0, NULL);
3193         if (!nd->nd_repstat) {
3194                 /* For NFSv4.1, set the Current StateID. */
3195                 if ((nd->nd_flag & ND_NFSV41) != 0) {
3196                         nd->nd_curstateid = stateid;
3197                         nd->nd_flag |= ND_CURSTATEID;
3198                 }
3199                 NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID + 6 * NFSX_UNSIGNED);
3200                 *tl++ = txdr_unsigned(stateid.seqid);
3201                 NFSBCOPY((caddr_t)stateid.other,(caddr_t)tl,NFSX_STATEIDOTHER);
3202                 tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
3203                 if (claim == NFSV4OPEN_CLAIMPREVIOUS) {
3204                         *tl++ = newnfs_true;
3205                         *tl++ = 0;
3206                         *tl++ = 0;
3207                         *tl++ = 0;
3208                         *tl++ = 0;
3209                 } else {
3210                         *tl++ = newnfs_false;   /* Since dirp is not locked */
3211                         txdr_hyper(dirfor.na_filerev, tl);
3212                         tl += 2;
3213                         txdr_hyper(diraft.na_filerev, tl);
3214                         tl += 2;
3215                 }
3216                 *tl = txdr_unsigned(rflags & NFSV4OPEN_RFLAGS);
3217                 (void) nfsrv_putattrbit(nd, &attrbits);
3218                 NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3219                 if (rflags & NFSV4OPEN_READDELEGATE)
3220                         *tl = txdr_unsigned(NFSV4OPEN_DELEGATEREAD);
3221                 else if (rflags & NFSV4OPEN_WRITEDELEGATE)
3222                         *tl = txdr_unsigned(NFSV4OPEN_DELEGATEWRITE);
3223                 else if (retext != 0) {
3224                         *tl = txdr_unsigned(NFSV4OPEN_DELEGATENONEEXT);
3225                         if ((rflags & NFSV4OPEN_WDNOTWANTED) != 0) {
3226                                 NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3227                                 *tl = txdr_unsigned(NFSV4OPEN_NOTWANTED);
3228                         } else if ((rflags & NFSV4OPEN_WDSUPPFTYPE) != 0) {
3229                                 NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3230                                 *tl = txdr_unsigned(NFSV4OPEN_NOTSUPPFTYPE);
3231                         } else if ((rflags & NFSV4OPEN_WDCONTENTION) != 0) {
3232                                 NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3233                                 *tl++ = txdr_unsigned(NFSV4OPEN_CONTENTION);
3234                                 *tl = newnfs_false;
3235                         } else if ((rflags & NFSV4OPEN_WDRESOURCE) != 0) {
3236                                 NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3237                                 *tl++ = txdr_unsigned(NFSV4OPEN_RESOURCE);
3238                                 *tl = newnfs_false;
3239                         } else {
3240                                 NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3241                                 *tl = txdr_unsigned(NFSV4OPEN_NOTWANTED);
3242                         }
3243                 } else
3244                         *tl = txdr_unsigned(NFSV4OPEN_DELEGATENONE);
3245                 if (rflags & (NFSV4OPEN_READDELEGATE|NFSV4OPEN_WRITEDELEGATE)) {
3246                         NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID+NFSX_UNSIGNED);
3247                         *tl++ = txdr_unsigned(delegstateid.seqid);
3248                         NFSBCOPY((caddr_t)delegstateid.other, (caddr_t)tl,
3249                             NFSX_STATEIDOTHER);
3250                         tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
3251                         if (rflags & NFSV4OPEN_RECALL)
3252                                 *tl = newnfs_true;
3253                         else
3254                                 *tl = newnfs_false;
3255                         if (rflags & NFSV4OPEN_WRITEDELEGATE) {
3256                                 NFSM_BUILD(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
3257                                 *tl++ = txdr_unsigned(NFSV4OPEN_LIMITSIZE);
3258                                 txdr_hyper(nva.na_size, tl);
3259                         }
3260                         NFSM_BUILD(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
3261                         *tl++ = txdr_unsigned(NFSV4ACE_ALLOWEDTYPE);
3262                         *tl++ = txdr_unsigned(0x0);
3263                         acemask = NFSV4ACE_ALLFILESMASK;
3264                         if (nva.na_mode & S_IRUSR)
3265                             acemask |= NFSV4ACE_READMASK;
3266                         if (nva.na_mode & S_IWUSR)
3267                             acemask |= NFSV4ACE_WRITEMASK;
3268                         if (nva.na_mode & S_IXUSR)
3269                             acemask |= NFSV4ACE_EXECUTEMASK;
3270                         *tl = txdr_unsigned(acemask);
3271                         (void) nfsm_strtom(nd, "OWNER@", 6);
3272                 }
3273                 *vpp = vp;
3274         } else if (vp) {
3275                 vrele(vp);
3276         }
3277         if (dirp)
3278                 vrele(dirp);
3279 #ifdef NFS4_ACL_EXTATTR_NAME
3280         acl_free(aclp);
3281 #endif
3282         NFSEXITCODE2(0, nd);
3283         return (0);
3284 nfsmout:
3285         vrele(dp);
3286 #ifdef NFS4_ACL_EXTATTR_NAME
3287         acl_free(aclp);
3288 #endif
3289         if (stp)
3290                 free(stp, M_NFSDSTATE);
3291         NFSEXITCODE2(error, nd);
3292         return (error);
3293 }
3294
3295 /*
3296  * nfsv4 close service
3297  */
3298 int
3299 nfsrvd_close(struct nfsrv_descript *nd, __unused int isdgram,
3300     vnode_t vp, __unused struct nfsexstuff *exp)
3301 {
3302         u_int32_t *tl;
3303         struct nfsstate st, *stp = &st;
3304         int error = 0, writeacc;
3305         nfsv4stateid_t stateid;
3306         nfsquad_t clientid;
3307         struct nfsvattr na;
3308         struct thread *p = curthread;
3309
3310         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED + NFSX_STATEID);
3311         stp->ls_seq = fxdr_unsigned(u_int32_t, *tl++);
3312         stp->ls_ownerlen = 0;
3313         stp->ls_op = nd->nd_rp;
3314         stp->ls_uid = nd->nd_cred->cr_uid;
3315         stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
3316         NFSBCOPY((caddr_t)tl, (caddr_t)stp->ls_stateid.other,
3317             NFSX_STATEIDOTHER);
3318
3319         /*
3320          * For the special stateid of other all 0s and seqid == 1, set the
3321          * stateid to the current stateid, if it is set.
3322          */
3323         if ((nd->nd_flag & ND_NFSV41) != 0 && stp->ls_stateid.seqid == 1 &&
3324             stp->ls_stateid.other[0] == 0 && stp->ls_stateid.other[1] == 0 &&
3325             stp->ls_stateid.other[2] == 0) {
3326                 if ((nd->nd_flag & ND_CURSTATEID) != 0)
3327                         stp->ls_stateid = nd->nd_curstateid;
3328                 else {
3329                         nd->nd_repstat = NFSERR_BADSTATEID;
3330                         goto nfsmout;
3331                 }
3332         }
3333
3334         stp->ls_flags = NFSLCK_CLOSE;
3335         clientid.lval[0] = stp->ls_stateid.other[0];
3336         clientid.lval[1] = stp->ls_stateid.other[1];
3337         if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
3338                 if ((nd->nd_flag & ND_NFSV41) != 0)
3339                         clientid.qval = nd->nd_clientid.qval;
3340                 else if (nd->nd_clientid.qval != clientid.qval)
3341                         printf("EEK8 multiple clids\n");
3342         } else {
3343                 if ((nd->nd_flag & ND_NFSV41) != 0)
3344                         printf("EEK! no clientid from session\n");
3345                 nd->nd_flag |= ND_IMPLIEDCLID;
3346                 nd->nd_clientid.qval = clientid.qval;
3347         }
3348         nd->nd_repstat = nfsrv_openupdate(vp, stp, clientid, &stateid, nd, p,
3349             &writeacc);
3350         /* For pNFS, update the attributes. */
3351         if (writeacc != 0 || nfsrv_pnfsatime != 0)
3352                 nfsrv_updatemdsattr(vp, &na, p);
3353         vput(vp);
3354         if (!nd->nd_repstat) {
3355                 /*
3356                  * If the stateid that has been closed is the current stateid,
3357                  * unset it.
3358                  */
3359                 if ((nd->nd_flag & ND_CURSTATEID) != 0 &&
3360                     stateid.other[0] == nd->nd_curstateid.other[0] &&
3361                     stateid.other[1] == nd->nd_curstateid.other[1] &&
3362                     stateid.other[2] == nd->nd_curstateid.other[2])
3363                         nd->nd_flag &= ~ND_CURSTATEID;
3364                 NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
3365                 *tl++ = txdr_unsigned(stateid.seqid);
3366                 NFSBCOPY((caddr_t)stateid.other,(caddr_t)tl,NFSX_STATEIDOTHER);
3367         }
3368         NFSEXITCODE2(0, nd);
3369         return (0);
3370 nfsmout:
3371         vput(vp);
3372         NFSEXITCODE2(error, nd);
3373         return (error);
3374 }
3375
3376 /*
3377  * nfsv4 delegpurge service
3378  */
3379 int
3380 nfsrvd_delegpurge(struct nfsrv_descript *nd, __unused int isdgram,
3381     __unused vnode_t vp, __unused struct nfsexstuff *exp)
3382 {
3383         u_int32_t *tl;
3384         int error = 0;
3385         nfsquad_t clientid;
3386         struct thread *p = curthread;
3387
3388         if ((nd->nd_repstat = nfsd_checkrootexp(nd)) != 0)
3389                 goto nfsmout;
3390         NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3391         clientid.lval[0] = *tl++;
3392         clientid.lval[1] = *tl;
3393         if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
3394                 if ((nd->nd_flag & ND_NFSV41) != 0)
3395                         clientid.qval = nd->nd_clientid.qval;
3396                 else if (nd->nd_clientid.qval != clientid.qval)
3397                         printf("EEK9 multiple clids\n");
3398         } else {
3399                 if ((nd->nd_flag & ND_NFSV41) != 0)
3400                         printf("EEK! no clientid from session\n");
3401                 nd->nd_flag |= ND_IMPLIEDCLID;
3402                 nd->nd_clientid.qval = clientid.qval;
3403         }
3404         nd->nd_repstat = nfsrv_delegupdate(nd, clientid, NULL, NULL,
3405             NFSV4OP_DELEGPURGE, nd->nd_cred, p, NULL);
3406 nfsmout:
3407         NFSEXITCODE2(error, nd);
3408         return (error);
3409 }
3410
3411 /*
3412  * nfsv4 delegreturn service
3413  */
3414 int
3415 nfsrvd_delegreturn(struct nfsrv_descript *nd, __unused int isdgram,
3416     vnode_t vp, __unused struct nfsexstuff *exp)
3417 {
3418         u_int32_t *tl;
3419         int error = 0, writeacc;
3420         nfsv4stateid_t stateid;
3421         nfsquad_t clientid;
3422         struct nfsvattr na;
3423         struct thread *p = curthread;
3424
3425         NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID);
3426         stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
3427         NFSBCOPY((caddr_t)tl, (caddr_t)stateid.other, NFSX_STATEIDOTHER);
3428         clientid.lval[0] = stateid.other[0];
3429         clientid.lval[1] = stateid.other[1];
3430         if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
3431                 if ((nd->nd_flag & ND_NFSV41) != 0)
3432                         clientid.qval = nd->nd_clientid.qval;
3433                 else if (nd->nd_clientid.qval != clientid.qval)
3434                         printf("EEK10 multiple clids\n");
3435         } else {
3436                 if ((nd->nd_flag & ND_NFSV41) != 0)
3437                         printf("EEK! no clientid from session\n");
3438                 nd->nd_flag |= ND_IMPLIEDCLID;
3439                 nd->nd_clientid.qval = clientid.qval;
3440         }
3441         nd->nd_repstat = nfsrv_delegupdate(nd, clientid, &stateid, vp,
3442             NFSV4OP_DELEGRETURN, nd->nd_cred, p, &writeacc);
3443         /* For pNFS, update the attributes. */
3444         if (writeacc != 0 || nfsrv_pnfsatime != 0)
3445                 nfsrv_updatemdsattr(vp, &na, p);
3446 nfsmout:
3447         vput(vp);
3448         NFSEXITCODE2(error, nd);
3449         return (error);
3450 }
3451
3452 /*
3453  * nfsv4 get file handle service
3454  */
3455 int
3456 nfsrvd_getfh(struct nfsrv_descript *nd, __unused int isdgram,
3457     vnode_t vp, __unused struct nfsexstuff *exp)
3458 {
3459         fhandle_t fh;
3460         struct thread *p = curthread;
3461
3462         nd->nd_repstat = nfsvno_getfh(vp, &fh, p);
3463         vput(vp);
3464         if (!nd->nd_repstat)
3465                 (void)nfsm_fhtom(NULL, nd, (u_int8_t *)&fh, 0, 0);
3466         NFSEXITCODE2(0, nd);
3467         return (0);
3468 }
3469
3470 /*
3471  * nfsv4 open confirm service
3472  */
3473 int
3474 nfsrvd_openconfirm(struct nfsrv_descript *nd, __unused int isdgram,
3475     vnode_t vp, __unused struct nfsexstuff *exp)
3476 {
3477         u_int32_t *tl;
3478         struct nfsstate st, *stp = &st;
3479         int error = 0;
3480         nfsv4stateid_t stateid;
3481         nfsquad_t clientid;
3482         struct thread *p = curthread;
3483
3484         if ((nd->nd_flag & ND_NFSV41) != 0) {
3485                 nd->nd_repstat = NFSERR_NOTSUPP;
3486                 goto nfsmout;
3487         }
3488         NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID + NFSX_UNSIGNED);
3489         stp->ls_ownerlen = 0;
3490         stp->ls_op = nd->nd_rp;
3491         stp->ls_uid = nd->nd_cred->cr_uid;
3492         stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
3493         NFSBCOPY((caddr_t)tl, (caddr_t)stp->ls_stateid.other,
3494             NFSX_STATEIDOTHER);
3495         tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
3496         stp->ls_seq = fxdr_unsigned(u_int32_t, *tl);
3497         stp->ls_flags = NFSLCK_CONFIRM;
3498         clientid.lval[0] = stp->ls_stateid.other[0];
3499         clientid.lval[1] = stp->ls_stateid.other[1];
3500         if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
3501                 if ((nd->nd_flag & ND_NFSV41) != 0)
3502                         clientid.qval = nd->nd_clientid.qval;
3503                 else if (nd->nd_clientid.qval != clientid.qval)
3504                         printf("EEK11 multiple clids\n");
3505         } else {
3506                 if ((nd->nd_flag & ND_NFSV41) != 0)
3507                         printf("EEK! no clientid from session\n");
3508                 nd->nd_flag |= ND_IMPLIEDCLID;
3509                 nd->nd_clientid.qval = clientid.qval;
3510         }
3511         nd->nd_repstat = nfsrv_openupdate(vp, stp, clientid, &stateid, nd, p,
3512             NULL);
3513         if (!nd->nd_repstat) {
3514                 NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
3515                 *tl++ = txdr_unsigned(stateid.seqid);
3516                 NFSBCOPY((caddr_t)stateid.other,(caddr_t)tl,NFSX_STATEIDOTHER);
3517         }
3518 nfsmout:
3519         vput(vp);
3520         NFSEXITCODE2(error, nd);
3521         return (error);
3522 }
3523
3524 /*
3525  * nfsv4 open downgrade service
3526  */
3527 int
3528 nfsrvd_opendowngrade(struct nfsrv_descript *nd, __unused int isdgram,
3529     vnode_t vp, __unused struct nfsexstuff *exp)
3530 {
3531         u_int32_t *tl;
3532         int i;
3533         struct nfsstate st, *stp = &st;
3534         int error = 0;
3535         nfsv4stateid_t stateid;
3536         nfsquad_t clientid;
3537         struct thread *p = curthread;
3538
3539         /* opendowngrade can only work on a file object.*/
3540         if (vp->v_type != VREG) {
3541                 error = NFSERR_INVAL;
3542                 goto nfsmout;
3543         }
3544         NFSM_DISSECT(tl, u_int32_t *, NFSX_STATEID + 3 * NFSX_UNSIGNED);
3545         stp->ls_ownerlen = 0;
3546         stp->ls_op = nd->nd_rp;
3547         stp->ls_uid = nd->nd_cred->cr_uid;
3548         stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
3549         NFSBCOPY((caddr_t)tl, (caddr_t)stp->ls_stateid.other,
3550             NFSX_STATEIDOTHER);
3551         tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
3552
3553         /*
3554          * For the special stateid of other all 0s and seqid == 1, set the
3555          * stateid to the current stateid, if it is set.
3556          */
3557         if ((nd->nd_flag & ND_NFSV41) != 0 && stp->ls_stateid.seqid == 1 &&
3558             stp->ls_stateid.other[0] == 0 && stp->ls_stateid.other[1] == 0 &&
3559             stp->ls_stateid.other[2] == 0) {
3560                 if ((nd->nd_flag & ND_CURSTATEID) != 0)
3561                         stp->ls_stateid = nd->nd_curstateid;
3562                 else {
3563                         nd->nd_repstat = NFSERR_BADSTATEID;
3564                         goto nfsmout;
3565                 }
3566         }
3567
3568         stp->ls_seq = fxdr_unsigned(u_int32_t, *tl++);
3569         i = fxdr_unsigned(int, *tl++);
3570         if ((nd->nd_flag & ND_NFSV41) != 0)
3571                 i &= ~NFSV4OPEN_WANTDELEGMASK;
3572         switch (i) {
3573         case NFSV4OPEN_ACCESSREAD:
3574                 stp->ls_flags = (NFSLCK_READACCESS | NFSLCK_DOWNGRADE);
3575                 break;
3576         case NFSV4OPEN_ACCESSWRITE:
3577                 stp->ls_flags = (NFSLCK_WRITEACCESS | NFSLCK_DOWNGRADE);
3578                 break;
3579         case NFSV4OPEN_ACCESSBOTH:
3580                 stp->ls_flags = (NFSLCK_READACCESS | NFSLCK_WRITEACCESS |
3581                     NFSLCK_DOWNGRADE);
3582                 break;
3583         default:
3584                 nd->nd_repstat = NFSERR_INVAL;
3585         }
3586         i = fxdr_unsigned(int, *tl);
3587         switch (i) {
3588         case NFSV4OPEN_DENYNONE:
3589                 break;
3590         case NFSV4OPEN_DENYREAD:
3591                 stp->ls_flags |= NFSLCK_READDENY;
3592                 break;
3593         case NFSV4OPEN_DENYWRITE:
3594                 stp->ls_flags |= NFSLCK_WRITEDENY;
3595                 break;
3596         case NFSV4OPEN_DENYBOTH:
3597                 stp->ls_flags |= (NFSLCK_READDENY | NFSLCK_WRITEDENY);
3598                 break;
3599         default:
3600                 nd->nd_repstat = NFSERR_INVAL;
3601         }
3602
3603         clientid.lval[0] = stp->ls_stateid.other[0];
3604         clientid.lval[1] = stp->ls_stateid.other[1];
3605         if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
3606                 if ((nd->nd_flag & ND_NFSV41) != 0)
3607                         clientid.qval = nd->nd_clientid.qval;
3608                 else if (nd->nd_clientid.qval != clientid.qval)
3609                         printf("EEK12 multiple clids\n");
3610         } else {
3611                 if ((nd->nd_flag & ND_NFSV41) != 0)
3612                         printf("EEK! no clientid from session\n");
3613                 nd->nd_flag |= ND_IMPLIEDCLID;
3614                 nd->nd_clientid.qval = clientid.qval;
3615         }
3616         if (!nd->nd_repstat)
3617                 nd->nd_repstat = nfsrv_openupdate(vp, stp, clientid, &stateid,
3618                     nd, p, NULL);
3619         if (!nd->nd_repstat) {
3620                 /* For NFSv4.1, set the Current StateID. */
3621                 if ((nd->nd_flag & ND_NFSV41) != 0) {
3622                         nd->nd_curstateid = stateid;
3623                         nd->nd_flag |= ND_CURSTATEID;
3624                 }
3625                 NFSM_BUILD(tl, u_int32_t *, NFSX_STATEID);
3626                 *tl++ = txdr_unsigned(stateid.seqid);
3627                 NFSBCOPY((caddr_t)stateid.other,(caddr_t)tl,NFSX_STATEIDOTHER);
3628         }
3629 nfsmout:
3630         vput(vp);
3631         NFSEXITCODE2(error, nd);
3632         return (error);
3633 }
3634
3635 /*
3636  * nfsv4 renew lease service
3637  */
3638 int
3639 nfsrvd_renew(struct nfsrv_descript *nd, __unused int isdgram,
3640     __unused vnode_t vp, __unused struct nfsexstuff *exp)
3641 {
3642         u_int32_t *tl;
3643         int error = 0;
3644         nfsquad_t clientid;
3645         struct thread *p = curthread;
3646
3647         if ((nd->nd_flag & ND_NFSV41) != 0) {
3648                 nd->nd_repstat = NFSERR_NOTSUPP;
3649                 goto nfsmout;
3650         }
3651         if ((nd->nd_repstat = nfsd_checkrootexp(nd)) != 0)
3652                 goto nfsmout;
3653         NFSM_DISSECT(tl, u_int32_t *, NFSX_HYPER);
3654         clientid.lval[0] = *tl++;
3655         clientid.lval[1] = *tl;
3656         if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
3657                 if ((nd->nd_flag & ND_NFSV41) != 0)
3658                         clientid.qval = nd->nd_clientid.qval;
3659                 else if (nd->nd_clientid.qval != clientid.qval)
3660                         printf("EEK13 multiple clids\n");
3661         } else {
3662                 if ((nd->nd_flag & ND_NFSV41) != 0)
3663                         printf("EEK! no clientid from session\n");
3664                 nd->nd_flag |= ND_IMPLIEDCLID;
3665                 nd->nd_clientid.qval = clientid.qval;
3666         }
3667         nd->nd_repstat = nfsrv_getclient(clientid, (CLOPS_RENEWOP|CLOPS_RENEW),
3668             NULL, NULL, (nfsquad_t)((u_quad_t)0), 0, nd, p);
3669 nfsmout:
3670         NFSEXITCODE2(error, nd);
3671         return (error);
3672 }
3673
3674 /*
3675  * nfsv4 security info service
3676  */
3677 int
3678 nfsrvd_secinfo(struct nfsrv_descript *nd, int isdgram,
3679     vnode_t dp, struct nfsexstuff *exp)
3680 {
3681         u_int32_t *tl;
3682         int len;
3683         struct nameidata named;
3684         vnode_t dirp = NULL, vp;
3685         struct nfsrvfh fh;
3686         struct nfsexstuff retnes;
3687         u_int32_t *sizp;
3688         int error = 0, i;
3689         uint64_t savflag;
3690         char *bufp;
3691         u_long *hashp;
3692         struct thread *p = curthread;
3693
3694         /*
3695          * All this just to get the export flags for the name.
3696          */
3697         NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, LOOKUP,
3698             LOCKLEAF);
3699         nfsvno_setpathbuf(&named, &bufp, &hashp);
3700         error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
3701         if (error) {
3702                 vput(dp);
3703                 nfsvno_relpathbuf(&named);
3704                 goto out;
3705         }
3706         if (!nd->nd_repstat) {
3707                 nd->nd_repstat = nfsvno_namei(nd, &named, dp, 1, exp, &dirp);
3708         } else {
3709                 vput(dp);
3710                 nfsvno_relpathbuf(&named);
3711         }
3712         if (dirp)
3713                 vrele(dirp);
3714         if (nd->nd_repstat)
3715                 goto out;
3716         nfsvno_relpathbuf(&named);
3717         fh.nfsrvfh_len = NFSX_MYFH;
3718         vp = named.ni_vp;
3719         nd->nd_repstat = nfsvno_getfh(vp, (fhandle_t *)fh.nfsrvfh_data, p);
3720         vput(vp);
3721         savflag = nd->nd_flag;
3722         if (!nd->nd_repstat) {
3723                 /*
3724                  * Pretend the next op is Secinfo, so that no wrongsec
3725                  * test will be done.
3726                  */
3727                 nfsd_fhtovp(nd, &fh, LK_SHARED, &vp, &retnes, NULL, 0,
3728                     NFSV4OP_SECINFO);
3729                 if (vp)
3730                         vput(vp);
3731         }
3732         nd->nd_flag = savflag;
3733         if (nd->nd_repstat)
3734                 goto out;
3735
3736         /*
3737          * Finally have the export flags for name, so we can create
3738          * the security info.
3739          */
3740         len = 0;
3741         NFSM_BUILD(sizp, u_int32_t *, NFSX_UNSIGNED);
3742
3743         /* If nes_numsecflavor == 0, all are allowed. */
3744         if (retnes.nes_numsecflavor == 0) {
3745                 NFSM_BUILD(tl, uint32_t *, 2 * NFSX_UNSIGNED);
3746                 *tl++ = txdr_unsigned(RPCAUTH_UNIX);
3747                 *tl = txdr_unsigned(RPCAUTH_GSS);
3748                 nfsm_strtom(nd, nfsgss_mechlist[KERBV_MECH].str,
3749                     nfsgss_mechlist[KERBV_MECH].len);
3750                 NFSM_BUILD(tl, uint32_t *, 3 * NFSX_UNSIGNED);
3751                 *tl++ = txdr_unsigned(GSS_KERBV_QOP);
3752                 *tl++ = txdr_unsigned(RPCAUTHGSS_SVCNONE);
3753                 *tl = txdr_unsigned(RPCAUTH_GSS);
3754                 nfsm_strtom(nd, nfsgss_mechlist[KERBV_MECH].str,
3755                     nfsgss_mechlist[KERBV_MECH].len);
3756                 NFSM_BUILD(tl, uint32_t *, 3 * NFSX_UNSIGNED);
3757                 *tl++ = txdr_unsigned(GSS_KERBV_QOP);
3758                 *tl++ = txdr_unsigned(RPCAUTHGSS_SVCINTEGRITY);
3759                 *tl = txdr_unsigned(RPCAUTH_GSS);
3760                 nfsm_strtom(nd, nfsgss_mechlist[KERBV_MECH].str,
3761                     nfsgss_mechlist[KERBV_MECH].len);
3762                 NFSM_BUILD(tl, uint32_t *, 2 * NFSX_UNSIGNED);
3763                 *tl++ = txdr_unsigned(GSS_KERBV_QOP);
3764                 *tl = txdr_unsigned(RPCAUTHGSS_SVCPRIVACY);
3765                 len = 4;
3766         }
3767         for (i = 0; i < retnes.nes_numsecflavor; i++) {
3768                 if (retnes.nes_secflavors[i] == AUTH_SYS) {
3769                         NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3770                         *tl = txdr_unsigned(RPCAUTH_UNIX);
3771                         len++;
3772                 } else if (retnes.nes_secflavors[i] == RPCSEC_GSS_KRB5) {
3773                         NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3774                         *tl++ = txdr_unsigned(RPCAUTH_GSS);
3775                         (void) nfsm_strtom(nd, nfsgss_mechlist[KERBV_MECH].str,
3776                             nfsgss_mechlist[KERBV_MECH].len);
3777                         NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3778                         *tl++ = txdr_unsigned(GSS_KERBV_QOP);
3779                         *tl = txdr_unsigned(RPCAUTHGSS_SVCNONE);
3780                         len++;
3781                 } else if (retnes.nes_secflavors[i] == RPCSEC_GSS_KRB5I) {
3782                         NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3783                         *tl++ = txdr_unsigned(RPCAUTH_GSS);
3784                         (void) nfsm_strtom(nd, nfsgss_mechlist[KERBV_MECH].str,
3785                             nfsgss_mechlist[KERBV_MECH].len);
3786                         NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3787                         *tl++ = txdr_unsigned(GSS_KERBV_QOP);
3788                         *tl = txdr_unsigned(RPCAUTHGSS_SVCINTEGRITY);
3789                         len++;
3790                 } else if (retnes.nes_secflavors[i] == RPCSEC_GSS_KRB5P) {
3791                         NFSM_BUILD(tl, u_int32_t *, NFSX_UNSIGNED);
3792                         *tl++ = txdr_unsigned(RPCAUTH_GSS);
3793                         (void) nfsm_strtom(nd, nfsgss_mechlist[KERBV_MECH].str,
3794                             nfsgss_mechlist[KERBV_MECH].len);
3795                         NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
3796                         *tl++ = txdr_unsigned(GSS_KERBV_QOP);
3797                         *tl = txdr_unsigned(RPCAUTHGSS_SVCPRIVACY);
3798                         len++;
3799                 }
3800         }
3801         *sizp = txdr_unsigned(len);
3802
3803 out:
3804         NFSEXITCODE2(error, nd);
3805         return (error);
3806 }
3807
3808 /*
3809  * nfsv4 security info no name service
3810  */
3811 int
3812 nfsrvd_secinfononame(struct nfsrv_descript *nd, int isdgram,
3813     vnode_t dp, struct nfsexstuff *exp)
3814 {
3815         uint32_t *tl, *sizp;
3816         struct nameidata named;
3817         vnode_t dirp = NULL, vp;
3818         struct nfsrvfh fh;
3819         struct nfsexstuff retnes;
3820         int error = 0, fhstyle, i, len;
3821         uint64_t savflag;
3822         char *bufp;
3823         u_long *hashp;
3824         struct thread *p = curthread;
3825
3826         NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
3827         fhstyle = fxdr_unsigned(int, *tl);
3828         switch (fhstyle) {
3829         case NFSSECINFONONAME_PARENT:
3830                 if (dp->v_type != VDIR) {
3831                         vput(dp);
3832                         nd->nd_repstat = NFSERR_NOTDIR;
3833                         goto nfsmout;
3834                 }
3835                 NFSNAMEICNDSET(&named.ni_cnd, nd->nd_cred, LOOKUP,
3836                     LOCKLEAF);
3837                 nfsvno_setpathbuf(&named, &bufp, &hashp);
3838                 error = nfsrv_parsename(nd, bufp, hashp, &named.ni_pathlen);
3839                 if (error != 0) {
3840                         vput(dp);
3841                         nfsvno_relpathbuf(&named);
3842                         goto nfsmout;
3843                 }
3844                 if (nd->nd_repstat == 0)
3845                         nd->nd_repstat = nfsvno_namei(nd, &named, dp, 1, exp, &dirp);
3846                 else
3847                         vput(dp);
3848                 if (dirp != NULL)
3849                         vrele(dirp);
3850                 nfsvno_relpathbuf(&named);
3851                 vp = named.ni_vp;
3852                 break;
3853         case NFSSECINFONONAME_CURFH:
3854                 vp = dp;
3855                 break;
3856         default:
3857                 nd->nd_repstat = NFSERR_INVAL;
3858                 vput(dp);
3859         }
3860         if (nd->nd_repstat != 0)
3861                 goto nfsmout;
3862         fh.nfsrvfh_len = NFSX_MYFH;
3863         nd->nd_repstat = nfsvno_getfh(vp, (fhandle_t *)fh.nfsrvfh_data, p);
3864         vput(vp);
3865         savflag = nd->nd_flag;
3866         if (nd->nd_repstat == 0) {
3867                 /*
3868                  * Pretend the next op is Secinfo, so that no wrongsec
3869                  * test will be done.
3870                  */
3871                 nfsd_fhtovp(nd, &fh, LK_SHARED, &vp, &retnes, NULL, 0,
3872                     NFSV4OP_SECINFO);
3873                 if (vp != NULL)
3874                         vput(vp);
3875         }
3876         nd->nd_flag = savflag;
3877         if (nd->nd_repstat != 0)
3878                 goto nfsmout;
3879
3880         /*
3881          * Finally have the export flags for fh/parent, so we can create
3882          * the security info.
3883          */
3884         len = 0;
3885         NFSM_BUILD(sizp, uint32_t *, NFSX_UNSIGNED);
3886
3887         /* If nes_numsecflavor == 0, all are allowed. */
3888         if (retnes.nes_numsecflavor == 0) {
3889                 NFSM_BUILD(tl, uint32_t *, 2 * NFSX_UNSIGNED);
3890                 *tl++ = txdr_unsigned(RPCAUTH_UNIX);
3891                 *tl = txdr_unsigned(RPCAUTH_GSS);
3892                 nfsm_strtom(nd, nfsgss_mechlist[KERBV_MECH].str,
3893                     nfsgss_mechlist[KERBV_MECH].len);
3894                 NFSM_BUILD(tl, uint32_t *, 3 * NFSX_UNSIGNED);
3895                 *tl++ = txdr_unsigned(GSS_KERBV_QOP);
3896                 *tl++ = txdr_unsigned(RPCAUTHGSS_SVCNONE);
3897                 *tl = txdr_unsigned(RPCAUTH_GSS);
3898                 nfsm_strtom(nd, nfsgss_mechlist[KERBV_MECH].str,
3899                     nfsgss_mechlist[KERBV_MECH].len);
3900                 NFSM_BUILD(tl, uint32_t *, 3 * NFSX_UNSIGNED);
3901                 *tl++ = txdr_unsigned(GSS_KERBV_QOP);
3902                 *tl++ = txdr_unsigned(RPCAUTHGSS_SVCINTEGRITY);
3903                 *tl = txdr_unsigned(RPCAUTH_GSS);
3904                 nfsm_strtom(nd, nfsgss_mechlist[KERBV_MECH].str,
3905                     nfsgss_mechlist[KERBV_MECH].len);
3906                 NFSM_BUILD(tl, uint32_t *, 2 * NFSX_UNSIGNED);
3907                 *tl++ = txdr_unsigned(GSS_KERBV_QOP);
3908                 *tl = txdr_unsigned(RPCAUTHGSS_SVCPRIVACY);
3909                 len = 4;
3910         }
3911         for (i = 0; i < retnes.nes_numsecflavor; i++) {
3912                 if (retnes.nes_secflavors[i] == AUTH_SYS) {
3913                         NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
3914                         *tl = txdr_unsigned(RPCAUTH_UNIX);
3915                         len++;
3916                 } else if (retnes.nes_secflavors[i] == RPCSEC_GSS_KRB5) {
3917                         NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
3918                         *tl = txdr_unsigned(RPCAUTH_GSS);
3919                         nfsm_strtom(nd, nfsgss_mechlist[KERBV_MECH].str,
3920                             nfsgss_mechlist[KERBV_MECH].len);
3921                         NFSM_BUILD(tl, uint32_t *, 2 * NFSX_UNSIGNED);
3922                         *tl++ = txdr_unsigned(GSS_KERBV_QOP);
3923                         *tl = txdr_unsigned(RPCAUTHGSS_SVCNONE);
3924                         len++;
3925                 } else if (retnes.nes_secflavors[i] == RPCSEC_GSS_KRB5I) {
3926                         NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
3927                         *tl = txdr_unsigned(RPCAUTH_GSS);
3928                         nfsm_strtom(nd, nfsgss_mechlist[KERBV_MECH].str,
3929                             nfsgss_mechlist[KERBV_MECH].len);
3930                         NFSM_BUILD(tl, uint32_t *, 2 * NFSX_UNSIGNED);
3931                         *tl++ = txdr_unsigned(GSS_KERBV_QOP);
3932                         *tl = txdr_unsigned(RPCAUTHGSS_SVCINTEGRITY);
3933                         len++;
3934                 } else if (retnes.nes_secflavors[i] == RPCSEC_GSS_KRB5P) {
3935                         NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
3936                         *tl = txdr_unsigned(RPCAUTH_GSS);
3937                         nfsm_strtom(nd, nfsgss_mechlist[KERBV_MECH].str,
3938                             nfsgss_mechlist[KERBV_MECH].len);
3939                         NFSM_BUILD(tl, uint32_t *, 2 * NFSX_UNSIGNED);
3940                         *tl++ = txdr_unsigned(GSS_KERBV_QOP);
3941                         *tl = txdr_unsigned(RPCAUTHGSS_SVCPRIVACY);
3942                         len++;
3943                 }
3944         }
3945         *sizp = txdr_unsigned(len);
3946
3947 nfsmout:
3948         NFSEXITCODE2(error, nd);
3949         return (error);
3950 }
3951
3952 /*
3953  * nfsv4 set client id service
3954  */
3955 int
3956 nfsrvd_setclientid(struct nfsrv_descript *nd, __unused int isdgram,
3957     __unused vnode_t vp, __unused struct nfsexstuff *exp)
3958 {
3959         u_int32_t *tl;
3960         int i;
3961         int error = 0, idlen;
3962         struct nfsclient *clp = NULL;
3963 #ifdef INET
3964         struct sockaddr_in *rin;
3965 #endif
3966 #ifdef INET6
3967         struct sockaddr_in6 *rin6;
3968 #endif
3969 #if defined(INET) || defined(INET6)
3970         u_char *ucp, *ucp2;
3971 #endif
3972         u_char *verf, *addrbuf;
3973         nfsquad_t clientid, confirm;
3974         struct thread *p = curthread;
3975
3976         if ((nd->nd_flag & ND_NFSV41) != 0) {
3977                 nd->nd_repstat = NFSERR_NOTSUPP;
3978                 goto nfsmout;
3979         }
3980         if ((nd->nd_repstat = nfsd_checkrootexp(nd)) != 0)
3981                 goto out;
3982         NFSM_DISSECT(tl, u_int32_t *, NFSX_VERF + NFSX_UNSIGNED);
3983         verf = (u_char *)tl;
3984         tl += (NFSX_VERF / NFSX_UNSIGNED);
3985         i = fxdr_unsigned(int, *tl);
3986         if (i > NFSV4_OPAQUELIMIT || i <= 0) {
3987                 nd->nd_repstat = NFSERR_BADXDR;
3988                 goto nfsmout;
3989         }
3990         idlen = i;
3991         if (nd->nd_flag & ND_GSS)
3992                 i += nd->nd_princlen;
3993         clp = malloc(sizeof(struct nfsclient) + i, M_NFSDCLIENT, M_WAITOK |
3994             M_ZERO);
3995         clp->lc_stateid = malloc(sizeof(struct nfsstatehead) *
3996             nfsrv_statehashsize, M_NFSDCLIENT, M_WAITOK);
3997         NFSINITSOCKMUTEX(&clp->lc_req.nr_mtx);
3998         /* Allocated large enough for an AF_INET or AF_INET6 socket. */
3999         clp->lc_req.nr_nam = malloc(sizeof(struct sockaddr_in6), M_SONAME,
4000             M_WAITOK | M_ZERO);
4001         clp->lc_req.nr_cred = NULL;
4002         NFSBCOPY(verf, clp->lc_verf, NFSX_VERF);
4003         clp->lc_idlen = idlen;
4004         error = nfsrv_mtostr(nd, clp->lc_id, idlen);
4005         if (error)
4006                 goto nfsmout;
4007         if (nd->nd_flag & ND_GSS) {
4008                 clp->lc_flags = LCL_GSS;
4009                 if (nd->nd_flag & ND_GSSINTEGRITY)
4010                         clp->lc_flags |= LCL_GSSINTEGRITY;
4011                 else if (nd->nd_flag & ND_GSSPRIVACY)
4012                         clp->lc_flags |= LCL_GSSPRIVACY;
4013         } else {
4014                 clp->lc_flags = 0;
4015         }
4016         if ((nd->nd_flag & ND_GSS) && nd->nd_princlen > 0) {
4017                 clp->lc_flags |= LCL_NAME;
4018                 clp->lc_namelen = nd->nd_princlen;
4019                 clp->lc_name = &clp->lc_id[idlen];
4020                 NFSBCOPY(nd->nd_principal, clp->lc_name, clp->lc_namelen);
4021         } else {
4022                 clp->lc_uid = nd->nd_cred->cr_uid;
4023                 clp->lc_gid = nd->nd_cred->cr_gid;
4024         }
4025
4026         /* If the client is using TLS, do so for the callback connection. */
4027         if (nd->nd_flag & ND_TLS)
4028                 clp->lc_flags |= LCL_TLSCB;
4029
4030         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
4031         clp->lc_program = fxdr_unsigned(u_int32_t, *tl);
4032         error = nfsrv_getclientipaddr(nd, clp);
4033         if (error)
4034                 goto nfsmout;
4035         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
4036         clp->lc_callback = fxdr_unsigned(u_int32_t, *tl);
4037
4038         /*
4039          * nfsrv_setclient() does the actual work of adding it to the
4040          * client list. If there is no error, the structure has been
4041          * linked into the client list and clp should no longer be used
4042          * here. When an error is returned, it has not been linked in,
4043          * so it should be free'd.
4044          */
4045         nd->nd_repstat = nfsrv_setclient(nd, &clp, &clientid, &confirm, p);
4046         if (nd->nd_repstat == NFSERR_CLIDINUSE) {
4047                 /*
4048                  * 8 is the maximum length of the port# string.
4049                  */
4050                 addrbuf = malloc(INET6_ADDRSTRLEN + 8, M_TEMP, M_WAITOK);
4051                 switch (clp->lc_req.nr_nam->sa_family) {
4052 #ifdef INET
4053                 case AF_INET:
4054                         if (clp->lc_flags & LCL_TCPCALLBACK)
4055                                 (void) nfsm_strtom(nd, "tcp", 3);
4056                         else
4057                                 (void) nfsm_strtom(nd, "udp", 3);
4058                         rin = (struct sockaddr_in *)clp->lc_req.nr_nam;
4059                         ucp = (u_char *)&rin->sin_addr.s_addr;
4060                         ucp2 = (u_char *)&rin->sin_port;
4061                         sprintf(addrbuf, "%d.%d.%d.%d.%d.%d", ucp[0] & 0xff,
4062                             ucp[1] & 0xff, ucp[2] & 0xff, ucp[3] & 0xff,
4063                             ucp2[0] & 0xff, ucp2[1] & 0xff);
4064                         break;
4065 #endif
4066 #ifdef INET6
4067                 case AF_INET6:
4068                         if (clp->lc_flags & LCL_TCPCALLBACK)
4069                                 (void) nfsm_strtom(nd, "tcp6", 4);
4070                         else
4071                                 (void) nfsm_strtom(nd, "udp6", 4);
4072                         rin6 = (struct sockaddr_in6 *)clp->lc_req.nr_nam;
4073                         ucp = inet_ntop(AF_INET6, &rin6->sin6_addr, addrbuf,
4074                             INET6_ADDRSTRLEN);
4075                         if (ucp != NULL)
4076                                 i = strlen(ucp);
4077                         else
4078                                 i = 0;
4079                         ucp2 = (u_char *)&rin6->sin6_port;
4080                         sprintf(&addrbuf[i], ".%d.%d", ucp2[0] & 0xff,
4081                             ucp2[1] & 0xff);
4082                         break;
4083 #endif
4084                 }
4085                 (void) nfsm_strtom(nd, addrbuf, strlen(addrbuf));
4086                 free(addrbuf, M_TEMP);
4087         }
4088         if (clp) {
4089                 free(clp->lc_req.nr_nam, M_SONAME);
4090                 NFSFREEMUTEX(&clp->lc_req.nr_mtx);
4091                 free(clp->lc_stateid, M_NFSDCLIENT);
4092                 free(clp, M_NFSDCLIENT);
4093         }
4094         if (!nd->nd_repstat) {
4095                 NFSM_BUILD(tl, u_int32_t *, 2 * NFSX_HYPER);
4096                 *tl++ = clientid.lval[0];
4097                 *tl++ = clientid.lval[1];
4098                 *tl++ = confirm.lval[0];
4099                 *tl = confirm.lval[1];
4100         }
4101
4102 out:
4103         NFSEXITCODE2(0, nd);
4104         return (0);
4105 nfsmout:
4106         if (clp) {
4107                 free(clp->lc_req.nr_nam, M_SONAME);
4108                 NFSFREEMUTEX(&clp->lc_req.nr_mtx);
4109                 free(clp->lc_stateid, M_NFSDCLIENT);
4110                 free(clp, M_NFSDCLIENT);
4111         }
4112         NFSEXITCODE2(error, nd);
4113         return (error);
4114 }
4115
4116 /*
4117  * nfsv4 set client id confirm service
4118  */
4119 int
4120 nfsrvd_setclientidcfrm(struct nfsrv_descript *nd,
4121     __unused int isdgram, __unused vnode_t vp,
4122     __unused struct nfsexstuff *exp)
4123 {
4124         u_int32_t *tl;
4125         int error = 0;
4126         nfsquad_t clientid, confirm;
4127         struct thread *p = curthread;
4128
4129         if ((nd->nd_flag & ND_NFSV41) != 0) {
4130                 nd->nd_repstat = NFSERR_NOTSUPP;
4131                 goto nfsmout;
4132         }
4133         if ((nd->nd_repstat = nfsd_checkrootexp(nd)) != 0)
4134                 goto nfsmout;
4135         NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_HYPER);
4136         clientid.lval[0] = *tl++;
4137         clientid.lval[1] = *tl++;
4138         confirm.lval[0] = *tl++;
4139         confirm.lval[1] = *tl;
4140
4141         /*
4142          * nfsrv_getclient() searches the client list for a match and
4143          * returns the appropriate NFSERR status.
4144          */
4145         nd->nd_repstat = nfsrv_getclient(clientid, (CLOPS_CONFIRM|CLOPS_RENEW),
4146             NULL, NULL, confirm, 0, nd, p);
4147 nfsmout:
4148         NFSEXITCODE2(error, nd);
4149         return (error);
4150 }
4151
4152 /*
4153  * nfsv4 verify service
4154  */
4155 int
4156 nfsrvd_verify(struct nfsrv_descript *nd, int isdgram,
4157     vnode_t vp, __unused struct nfsexstuff *exp)
4158 {
4159         int error = 0, ret, fhsize = NFSX_MYFH;
4160         struct nfsvattr nva;
4161         struct statfs *sf;
4162         struct nfsfsinfo fs;
4163         fhandle_t fh;
4164         struct thread *p = curthread;
4165
4166         sf = malloc(sizeof(struct statfs), M_STATFS, M_WAITOK);
4167         nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1, NULL);
4168         if (!nd->nd_repstat)
4169                 nd->nd_repstat = nfsvno_statfs(vp, sf);
4170         if (!nd->nd_repstat)
4171                 nd->nd_repstat = nfsvno_getfh(vp, &fh, p);
4172         if (!nd->nd_repstat) {
4173                 nfsvno_getfs(&fs, isdgram);
4174                 error = nfsv4_loadattr(nd, vp, &nva, NULL, &fh, fhsize, NULL,
4175                     sf, NULL, &fs, NULL, 1, &ret, NULL, NULL, p, nd->nd_cred);
4176                 if (!error) {
4177                         if (nd->nd_procnum == NFSV4OP_NVERIFY) {
4178                                 if (ret == 0)
4179                                         nd->nd_repstat = NFSERR_SAME;
4180                                 else if (ret != NFSERR_NOTSAME)
4181                                         nd->nd_repstat = ret;
4182                         } else if (ret)
4183                                 nd->nd_repstat = ret;
4184                 }
4185         }
4186         vput(vp);
4187         free(sf, M_STATFS);
4188         NFSEXITCODE2(error, nd);
4189         return (error);
4190 }
4191
4192 /*
4193  * nfs openattr rpc
4194  */
4195 int
4196 nfsrvd_openattr(struct nfsrv_descript *nd, __unused int isdgram,
4197     vnode_t dp, __unused vnode_t *vpp, __unused fhandle_t *fhp,
4198     __unused struct nfsexstuff *exp)
4199 {
4200         u_int32_t *tl;
4201         int error = 0, createdir __unused;
4202
4203         NFSM_DISSECT(tl, u_int32_t *, NFSX_UNSIGNED);
4204         createdir = fxdr_unsigned(int, *tl);
4205         nd->nd_repstat = NFSERR_NOTSUPP;
4206 nfsmout:
4207         vrele(dp);
4208         NFSEXITCODE2(error, nd);
4209         return (error);
4210 }
4211
4212 /*
4213  * nfsv4 release lock owner service
4214  */
4215 int
4216 nfsrvd_releaselckown(struct nfsrv_descript *nd, __unused int isdgram,
4217     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4218 {
4219         u_int32_t *tl;
4220         struct nfsstate *stp = NULL;
4221         int error = 0, len;
4222         nfsquad_t clientid;
4223         struct thread *p = curthread;
4224
4225         if ((nd->nd_flag & ND_NFSV41) != 0) {
4226                 nd->nd_repstat = NFSERR_NOTSUPP;
4227                 goto nfsmout;
4228         }
4229         if ((nd->nd_repstat = nfsd_checkrootexp(nd)) != 0)
4230                 goto nfsmout;
4231         NFSM_DISSECT(tl, u_int32_t *, 3 * NFSX_UNSIGNED);
4232         len = fxdr_unsigned(int, *(tl + 2));
4233         if (len <= 0 || len > NFSV4_OPAQUELIMIT) {
4234                 nd->nd_repstat = NFSERR_BADXDR;
4235                 goto nfsmout;
4236         }
4237         stp = malloc(sizeof (struct nfsstate) + len,
4238             M_NFSDSTATE, M_WAITOK);
4239         stp->ls_ownerlen = len;
4240         stp->ls_op = NULL;
4241         stp->ls_flags = NFSLCK_RELEASE;
4242         stp->ls_uid = nd->nd_cred->cr_uid;
4243         clientid.lval[0] = *tl++;
4244         clientid.lval[1] = *tl;
4245         if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
4246                 if ((nd->nd_flag & ND_NFSV41) != 0)
4247                         clientid.qval = nd->nd_clientid.qval;
4248                 else if (nd->nd_clientid.qval != clientid.qval)
4249                         printf("EEK14 multiple clids\n");
4250         } else {
4251                 if ((nd->nd_flag & ND_NFSV41) != 0)
4252                         printf("EEK! no clientid from session\n");
4253                 nd->nd_flag |= ND_IMPLIEDCLID;
4254                 nd->nd_clientid.qval = clientid.qval;
4255         }
4256         error = nfsrv_mtostr(nd, stp->ls_owner, len);
4257         if (error)
4258                 goto nfsmout;
4259         nd->nd_repstat = nfsrv_releaselckown(stp, clientid, p);
4260         free(stp, M_NFSDSTATE);
4261
4262         NFSEXITCODE2(0, nd);
4263         return (0);
4264 nfsmout:
4265         if (stp)
4266                 free(stp, M_NFSDSTATE);
4267         NFSEXITCODE2(error, nd);
4268         return (error);
4269 }
4270
4271 /*
4272  * nfsv4 exchange_id service
4273  */
4274 int
4275 nfsrvd_exchangeid(struct nfsrv_descript *nd, __unused int isdgram,
4276     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4277 {
4278         uint32_t *tl;
4279         int error = 0, i, idlen;
4280         struct nfsclient *clp = NULL;
4281         nfsquad_t clientid, confirm;
4282         uint8_t *verf;
4283         uint32_t sp4type, v41flags;
4284         struct timespec verstime;
4285         nfsopbit_t mustops, allowops;
4286 #ifdef INET
4287         struct sockaddr_in *sin, *rin;
4288 #endif
4289 #ifdef INET6
4290         struct sockaddr_in6 *sin6, *rin6;
4291 #endif
4292         struct thread *p = curthread;
4293         char *s;
4294
4295         if ((nd->nd_repstat = nfsd_checkrootexp(nd)) != 0)
4296                 goto nfsmout;
4297         NFSM_DISSECT(tl, u_int32_t *, NFSX_VERF + NFSX_UNSIGNED);
4298         verf = (uint8_t *)tl;
4299         tl += (NFSX_VERF / NFSX_UNSIGNED);
4300         i = fxdr_unsigned(int, *tl);
4301         if (i > NFSV4_OPAQUELIMIT || i <= 0) {
4302                 nd->nd_repstat = NFSERR_BADXDR;
4303                 goto nfsmout;
4304         }
4305         idlen = i;
4306         if (nd->nd_flag & ND_GSS)
4307                 i += nd->nd_princlen;
4308         clp = malloc(sizeof(struct nfsclient) + i, M_NFSDCLIENT, M_WAITOK |
4309             M_ZERO);
4310         clp->lc_stateid = malloc(sizeof(struct nfsstatehead) *
4311             nfsrv_statehashsize, M_NFSDCLIENT, M_WAITOK);
4312         NFSINITSOCKMUTEX(&clp->lc_req.nr_mtx);
4313         /* Allocated large enough for an AF_INET or AF_INET6 socket. */
4314         clp->lc_req.nr_nam = malloc(sizeof(struct sockaddr_in6), M_SONAME,
4315             M_WAITOK | M_ZERO);
4316         switch (nd->nd_nam->sa_family) {
4317 #ifdef INET
4318         case AF_INET:
4319                 rin = (struct sockaddr_in *)clp->lc_req.nr_nam;
4320                 sin = (struct sockaddr_in *)nd->nd_nam;
4321                 rin->sin_family = AF_INET;
4322                 rin->sin_len = sizeof(struct sockaddr_in);
4323                 rin->sin_port = 0;
4324                 rin->sin_addr.s_addr = sin->sin_addr.s_addr;
4325                 break;
4326 #endif
4327 #ifdef INET6
4328         case AF_INET6:
4329                 rin6 = (struct sockaddr_in6 *)clp->lc_req.nr_nam;
4330                 sin6 = (struct sockaddr_in6 *)nd->nd_nam;
4331                 rin6->sin6_family = AF_INET6;
4332                 rin6->sin6_len = sizeof(struct sockaddr_in6);
4333                 rin6->sin6_port = 0;
4334                 rin6->sin6_addr = sin6->sin6_addr;
4335                 break;
4336 #endif
4337         }
4338         clp->lc_req.nr_cred = NULL;
4339         NFSBCOPY(verf, clp->lc_verf, NFSX_VERF);
4340         clp->lc_idlen = idlen;
4341         error = nfsrv_mtostr(nd, clp->lc_id, idlen);
4342         if (error != 0)
4343                 goto nfsmout;
4344         if ((nd->nd_flag & ND_GSS) != 0) {
4345                 clp->lc_flags = LCL_GSS | LCL_NFSV41;
4346                 if ((nd->nd_flag & ND_GSSINTEGRITY) != 0)
4347                         clp->lc_flags |= LCL_GSSINTEGRITY;
4348                 else if ((nd->nd_flag & ND_GSSPRIVACY) != 0)
4349                         clp->lc_flags |= LCL_GSSPRIVACY;
4350         } else
4351                 clp->lc_flags = LCL_NFSV41;
4352         if ((nd->nd_flag & ND_NFSV42) != 0)
4353                 clp->lc_flags |= LCL_NFSV42;
4354         if ((nd->nd_flag & ND_GSS) != 0 && nd->nd_princlen > 0) {
4355                 clp->lc_flags |= LCL_NAME;
4356                 clp->lc_namelen = nd->nd_princlen;
4357                 clp->lc_name = &clp->lc_id[idlen];
4358                 NFSBCOPY(nd->nd_principal, clp->lc_name, clp->lc_namelen);
4359         } else {
4360                 clp->lc_uid = nd->nd_cred->cr_uid;
4361                 clp->lc_gid = nd->nd_cred->cr_gid;
4362         }
4363         NFSM_DISSECT(tl, u_int32_t *, 2 * NFSX_UNSIGNED);
4364         v41flags = fxdr_unsigned(uint32_t, *tl++);
4365         if ((v41flags & ~(NFSV4EXCH_SUPPMOVEDREFER | NFSV4EXCH_SUPPMOVEDMIGR |
4366             NFSV4EXCH_BINDPRINCSTATEID | NFSV4EXCH_MASKPNFS |
4367             NFSV4EXCH_UPDCONFIRMEDRECA)) != 0) {
4368                 nd->nd_repstat = NFSERR_INVAL;
4369                 goto nfsmout;
4370         }
4371         if ((v41flags & NFSV4EXCH_UPDCONFIRMEDRECA) != 0)
4372                 confirm.lval[1] = 1;
4373         else
4374                 confirm.lval[1] = 0;
4375         if (nfsrv_devidcnt == 0)
4376                 v41flags = NFSV4EXCH_USENONPNFS | NFSV4EXCH_USEPNFSDS;
4377         else
4378                 v41flags = NFSV4EXCH_USEPNFSMDS;
4379         sp4type = fxdr_unsigned(uint32_t, *tl);
4380         if (sp4type == NFSV4EXCH_SP4MACHCRED) {
4381                 if ((nd->nd_flag & (ND_GSSINTEGRITY | ND_GSSPRIVACY)) == 0 ||
4382                     nd->nd_princlen == 0)
4383                         nd->nd_repstat = (NFSERR_AUTHERR | AUTH_TOOWEAK);
4384                 if (nd->nd_repstat == 0)
4385                         nd->nd_repstat = nfsrv_getopbits(nd, &mustops, NULL);
4386                 if (nd->nd_repstat == 0)
4387                         nd->nd_repstat = nfsrv_getopbits(nd, &allowops, NULL);
4388                 if (nd->nd_repstat != 0)
4389                         goto nfsmout;
4390                 NFSOPBIT_CLRNOTMUST(&mustops);
4391                 NFSSET_OPBIT(&clp->lc_mustops, &mustops);
4392                 NFSOPBIT_CLRNOTALLOWED(&allowops);
4393                 NFSSET_OPBIT(&clp->lc_allowops, &allowops);
4394                 clp->lc_flags |= LCL_MACHCRED;
4395         } else if (sp4type != NFSV4EXCH_SP4NONE) {
4396                 nd->nd_repstat = NFSERR_NOTSUPP;
4397                 goto nfsmout;
4398         }
4399
4400         /*
4401          * nfsrv_setclient() does the actual work of adding it to the
4402          * client list. If there is no error, the structure has been
4403          * linked into the client list and clp should no longer be used
4404          * here. When an error is returned, it has not been linked in,
4405          * so it should be free'd.
4406          */
4407         nd->nd_repstat = nfsrv_setclient(nd, &clp, &clientid, &confirm, p);
4408         if (clp != NULL) {
4409                 free(clp->lc_req.nr_nam, M_SONAME);
4410                 NFSFREEMUTEX(&clp->lc_req.nr_mtx);
4411                 free(clp->lc_stateid, M_NFSDCLIENT);
4412                 free(clp, M_NFSDCLIENT);
4413         }
4414         if (nd->nd_repstat == 0) {
4415                 if (confirm.lval[1] != 0)
4416                         v41flags |= NFSV4EXCH_CONFIRMEDR;
4417                 NFSM_BUILD(tl, uint32_t *, NFSX_HYPER + 3 * NFSX_UNSIGNED);
4418                 *tl++ = clientid.lval[0];                       /* ClientID */
4419                 *tl++ = clientid.lval[1];
4420                 *tl++ = txdr_unsigned(confirm.lval[0]);         /* SequenceID */
4421                 *tl++ = txdr_unsigned(v41flags);                /* Exch flags */
4422                 *tl = txdr_unsigned(sp4type);                   /* No SSV */
4423                 if (sp4type == NFSV4EXCH_SP4MACHCRED) {
4424                         nfsrv_putopbit(nd, &mustops);
4425                         nfsrv_putopbit(nd, &allowops);
4426                 }
4427                 NFSM_BUILD(tl, uint32_t *, NFSX_HYPER);
4428                 txdr_hyper(nfsrv_owner_minor, tl);      /* Owner Minor */
4429                 if (nfsrv_owner_major[0] != 0)
4430                         s = nfsrv_owner_major;
4431                 else
4432                         s = nd->nd_cred->cr_prison->pr_hostuuid;
4433                 nfsm_strtom(nd, s, strlen(s));          /* Owner Major */
4434                 if (nfsrv_scope[0] != 0)
4435                         s = nfsrv_scope;
4436                 else
4437                         s = nd->nd_cred->cr_prison->pr_hostuuid;
4438                 nfsm_strtom(nd, s, strlen(s)    );              /* Scope */
4439                 NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
4440                 *tl = txdr_unsigned(1);
4441                 (void)nfsm_strtom(nd, "freebsd.org", strlen("freebsd.org"));
4442                 (void)nfsm_strtom(nd, version, strlen(version));
4443                 NFSM_BUILD(tl, uint32_t *, NFSX_V4TIME);
4444                 verstime.tv_sec = 1293840000;           /* Jan 1, 2011 */
4445                 verstime.tv_nsec = 0;
4446                 txdr_nfsv4time(&verstime, tl);
4447         }
4448         NFSEXITCODE2(0, nd);
4449         return (0);
4450 nfsmout:
4451         if (clp != NULL) {
4452                 free(clp->lc_req.nr_nam, M_SONAME);
4453                 NFSFREEMUTEX(&clp->lc_req.nr_mtx);
4454                 free(clp->lc_stateid, M_NFSDCLIENT);
4455                 free(clp, M_NFSDCLIENT);
4456         }
4457         NFSEXITCODE2(error, nd);
4458         return (error);
4459 }
4460
4461 /*
4462  * nfsv4 create session service
4463  */
4464 int
4465 nfsrvd_createsession(struct nfsrv_descript *nd, __unused int isdgram,
4466     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4467 {
4468         uint32_t *tl;
4469         int error = 0;
4470         nfsquad_t clientid, confirm;
4471         struct nfsdsession *sep = NULL;
4472         uint32_t rdmacnt;
4473         struct thread *p = curthread;
4474         static bool do_printf = true;
4475
4476         if ((nd->nd_repstat = nfsd_checkrootexp(nd)) != 0)
4477                 goto nfsmout;
4478         sep = (struct nfsdsession *)malloc(sizeof(struct nfsdsession),
4479             M_NFSDSESSION, M_WAITOK | M_ZERO);
4480         sep->sess_refcnt = 1;
4481         mtx_init(&sep->sess_cbsess.nfsess_mtx, "nfscbsession", NULL, MTX_DEF);
4482         NFSM_DISSECT(tl, uint32_t *, NFSX_HYPER + 2 * NFSX_UNSIGNED);
4483         clientid.lval[0] = *tl++;
4484         clientid.lval[1] = *tl++;
4485         confirm.lval[0] = fxdr_unsigned(uint32_t, *tl++);
4486         sep->sess_crflags = fxdr_unsigned(uint32_t, *tl);
4487         /* Persistent sessions and RDMA are not supported. */
4488         sep->sess_crflags &= NFSV4CRSESS_CONNBACKCHAN;
4489
4490         /* Fore channel attributes. */
4491         NFSM_DISSECT(tl, uint32_t *, 7 * NFSX_UNSIGNED);
4492         tl++;                                   /* Header pad always 0. */
4493         sep->sess_maxreq = fxdr_unsigned(uint32_t, *tl++);
4494         if (sep->sess_maxreq > sb_max_adj - NFS_MAXXDR) {
4495                 sep->sess_maxreq = sb_max_adj - NFS_MAXXDR;
4496                 if (do_printf)
4497                         printf("Consider increasing kern.ipc.maxsockbuf\n");
4498                 do_printf = false;
4499         }
4500         sep->sess_maxresp = fxdr_unsigned(uint32_t, *tl++);
4501         if (sep->sess_maxresp > sb_max_adj - NFS_MAXXDR) {
4502                 sep->sess_maxresp = sb_max_adj - NFS_MAXXDR;
4503                 if (do_printf)
4504                         printf("Consider increasing kern.ipc.maxsockbuf\n");
4505                 do_printf = false;
4506         }
4507         sep->sess_maxrespcached = fxdr_unsigned(uint32_t, *tl++);
4508         sep->sess_maxops = fxdr_unsigned(uint32_t, *tl++);
4509         sep->sess_maxslots = fxdr_unsigned(uint32_t, *tl++);
4510         if (sep->sess_maxslots > NFSV4_SLOTS)
4511                 sep->sess_maxslots = NFSV4_SLOTS;
4512         rdmacnt = fxdr_unsigned(uint32_t, *tl);
4513         if (rdmacnt > 1) {
4514                 nd->nd_repstat = NFSERR_BADXDR;
4515                 goto nfsmout;
4516         } else if (rdmacnt == 1)
4517                 NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
4518
4519         /* Back channel attributes. */
4520         NFSM_DISSECT(tl, uint32_t *, 7 * NFSX_UNSIGNED);
4521         tl++;                                   /* Header pad always 0. */
4522         sep->sess_cbmaxreq = fxdr_unsigned(uint32_t, *tl++);
4523         sep->sess_cbmaxresp = fxdr_unsigned(uint32_t, *tl++);
4524         sep->sess_cbmaxrespcached = fxdr_unsigned(uint32_t, *tl++);
4525         sep->sess_cbmaxops = fxdr_unsigned(uint32_t, *tl++);
4526         sep->sess_cbsess.nfsess_foreslots = fxdr_unsigned(uint32_t, *tl++);
4527         rdmacnt = fxdr_unsigned(uint32_t, *tl);
4528         if (rdmacnt > 1) {
4529                 nd->nd_repstat = NFSERR_BADXDR;
4530                 goto nfsmout;
4531         } else if (rdmacnt == 1)
4532                 NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
4533
4534         NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
4535         sep->sess_cbprogram = fxdr_unsigned(uint32_t, *tl);
4536
4537         /*
4538          * nfsrv_getclient() searches the client list for a match and
4539          * returns the appropriate NFSERR status.
4540          */
4541         nd->nd_repstat = nfsrv_getclient(clientid, CLOPS_CONFIRM | CLOPS_RENEW,
4542             NULL, sep, confirm, sep->sess_cbprogram, nd, p);
4543         if (nd->nd_repstat == 0) {
4544                 NFSM_BUILD(tl, uint32_t *, NFSX_V4SESSIONID);
4545                 NFSBCOPY(sep->sess_sessionid, tl, NFSX_V4SESSIONID);
4546                 NFSM_BUILD(tl, uint32_t *, 18 * NFSX_UNSIGNED);
4547                 *tl++ = txdr_unsigned(confirm.lval[0]); /* sequenceid */
4548                 *tl++ = txdr_unsigned(sep->sess_crflags);
4549
4550                 /* Fore channel attributes. */
4551                 *tl++ = 0;
4552                 *tl++ = txdr_unsigned(sep->sess_maxreq);
4553                 *tl++ = txdr_unsigned(sep->sess_maxresp);
4554                 *tl++ = txdr_unsigned(sep->sess_maxrespcached);
4555                 *tl++ = txdr_unsigned(sep->sess_maxops);
4556                 *tl++ = txdr_unsigned(sep->sess_maxslots);
4557                 *tl++ = txdr_unsigned(1);
4558                 *tl++ = txdr_unsigned(0);                       /* No RDMA. */
4559
4560                 /* Back channel attributes. */
4561                 *tl++ = 0;
4562                 *tl++ = txdr_unsigned(sep->sess_cbmaxreq);
4563                 *tl++ = txdr_unsigned(sep->sess_cbmaxresp);
4564                 *tl++ = txdr_unsigned(sep->sess_cbmaxrespcached);
4565                 *tl++ = txdr_unsigned(sep->sess_cbmaxops);
4566                 *tl++ = txdr_unsigned(sep->sess_cbsess.nfsess_foreslots);
4567                 *tl++ = txdr_unsigned(1);
4568                 *tl = txdr_unsigned(0);                 /* No RDMA. */
4569         }
4570 nfsmout:
4571         if (nd->nd_repstat != 0 && sep != NULL)
4572                 free(sep, M_NFSDSESSION);
4573         NFSEXITCODE2(error, nd);
4574         return (error);
4575 }
4576
4577 /*
4578  * nfsv4 sequence service
4579  */
4580 int
4581 nfsrvd_sequence(struct nfsrv_descript *nd, __unused int isdgram,
4582     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4583 {
4584         uint32_t *tl;
4585         uint32_t highest_slotid, sequenceid, sflags, target_highest_slotid;
4586         int cache_this, error = 0;
4587         struct thread *p = curthread;
4588
4589         if ((nd->nd_repstat = nfsd_checkrootexp(nd)) != 0)
4590                 goto nfsmout;
4591         NFSM_DISSECT(tl, uint32_t *, NFSX_V4SESSIONID);
4592         NFSBCOPY(tl, nd->nd_sessionid, NFSX_V4SESSIONID);
4593         NFSM_DISSECT(tl, uint32_t *, 4 * NFSX_UNSIGNED);
4594         sequenceid = fxdr_unsigned(uint32_t, *tl++);
4595         nd->nd_slotid = fxdr_unsigned(uint32_t, *tl++);
4596         highest_slotid = fxdr_unsigned(uint32_t, *tl++);
4597         if (*tl == newnfs_true)
4598                 cache_this = 1;
4599         else
4600                 cache_this = 0;
4601         nd->nd_repstat = nfsrv_checksequence(nd, sequenceid, &highest_slotid,
4602             &target_highest_slotid, cache_this, &sflags, p);
4603         if (nd->nd_repstat != NFSERR_BADSLOT)
4604                 nd->nd_flag |= ND_HASSEQUENCE;
4605         if (nd->nd_repstat == 0) {
4606                 NFSM_BUILD(tl, uint32_t *, NFSX_V4SESSIONID);
4607                 NFSBCOPY(nd->nd_sessionid, tl, NFSX_V4SESSIONID);
4608                 NFSM_BUILD(tl, uint32_t *, 5 * NFSX_UNSIGNED);
4609                 *tl++ = txdr_unsigned(sequenceid);
4610                 *tl++ = txdr_unsigned(nd->nd_slotid);
4611                 *tl++ = txdr_unsigned(highest_slotid);
4612                 *tl++ = txdr_unsigned(target_highest_slotid);
4613                 *tl = txdr_unsigned(sflags);
4614         }
4615 nfsmout:
4616         NFSEXITCODE2(error, nd);
4617         return (error);
4618 }
4619
4620 /*
4621  * nfsv4 reclaim complete service
4622  */
4623 int
4624 nfsrvd_reclaimcomplete(struct nfsrv_descript *nd, __unused int isdgram,
4625     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4626 {
4627         uint32_t *tl;
4628         int error = 0, onefs;
4629
4630         NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
4631         /*
4632          * I believe that a ReclaimComplete with rca_one_fs == TRUE is only
4633          * to be used after a file system has been transferred to a different
4634          * file server.  However, RFC5661 is somewhat vague w.r.t. this and
4635          * the ESXi 6.7 client does both a ReclaimComplete with rca_one_fs
4636          * == TRUE and one with ReclaimComplete with rca_one_fs == FALSE.
4637          * Therefore, just ignore the rca_one_fs == TRUE operation and return
4638          * NFS_OK without doing anything.
4639          */
4640         onefs = 0;
4641         if (*tl == newnfs_true)
4642                 onefs = 1;
4643         nd->nd_repstat = nfsrv_checkreclaimcomplete(nd, onefs);
4644 nfsmout:
4645         NFSEXITCODE2(error, nd);
4646         return (error);
4647 }
4648
4649 /*
4650  * nfsv4 destroy clientid service
4651  */
4652 int
4653 nfsrvd_destroyclientid(struct nfsrv_descript *nd, __unused int isdgram,
4654     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4655 {
4656         uint32_t *tl;
4657         nfsquad_t clientid;
4658         int error = 0;
4659         struct thread *p = curthread;
4660
4661         if ((nd->nd_repstat = nfsd_checkrootexp(nd)) != 0)
4662                 goto nfsmout;
4663         NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_UNSIGNED);
4664         clientid.lval[0] = *tl++;
4665         clientid.lval[1] = *tl;
4666         nd->nd_repstat = nfsrv_destroyclient(nd, clientid, p);
4667 nfsmout:
4668         NFSEXITCODE2(error, nd);
4669         return (error);
4670 }
4671
4672 /*
4673  * nfsv4 bind connection to session service
4674  */
4675 int
4676 nfsrvd_bindconnsess(struct nfsrv_descript *nd, __unused int isdgram,
4677     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4678 {
4679         uint32_t *tl;
4680         uint8_t sessid[NFSX_V4SESSIONID];
4681         int error = 0, foreaft;
4682
4683         if ((nd->nd_repstat = nfsd_checkrootexp(nd)) != 0)
4684                 goto nfsmout;
4685         NFSM_DISSECT(tl, uint32_t *, NFSX_V4SESSIONID + 2 * NFSX_UNSIGNED);
4686         NFSBCOPY(tl, sessid, NFSX_V4SESSIONID);
4687         tl += (NFSX_V4SESSIONID / NFSX_UNSIGNED);
4688         foreaft = fxdr_unsigned(int, *tl++);
4689         if (*tl == newnfs_true) {
4690                 /* RDMA is not supported. */
4691                 nd->nd_repstat = NFSERR_NOTSUPP;
4692                 goto nfsmout;
4693         }
4694
4695         nd->nd_repstat = nfsrv_bindconnsess(nd, sessid, &foreaft);
4696         if (nd->nd_repstat == 0) {
4697                 NFSM_BUILD(tl, uint32_t *, NFSX_V4SESSIONID + 2 *
4698                     NFSX_UNSIGNED);
4699                 NFSBCOPY(sessid, tl, NFSX_V4SESSIONID);
4700                 tl += (NFSX_V4SESSIONID / NFSX_UNSIGNED);
4701                 *tl++ = txdr_unsigned(foreaft);
4702                 *tl = newnfs_false;
4703         }
4704 nfsmout:
4705         NFSEXITCODE2(error, nd);
4706         return (error);
4707 }
4708
4709 /*
4710  * nfsv4 destroy session service
4711  */
4712 int
4713 nfsrvd_destroysession(struct nfsrv_descript *nd, __unused int isdgram,
4714     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4715 {
4716         uint8_t *cp, sessid[NFSX_V4SESSIONID];
4717         int error = 0;
4718
4719         if ((nd->nd_repstat = nfsd_checkrootexp(nd)) != 0)
4720                 goto nfsmout;
4721         NFSM_DISSECT(cp, uint8_t *, NFSX_V4SESSIONID);
4722         NFSBCOPY(cp, sessid, NFSX_V4SESSIONID);
4723         nd->nd_repstat = nfsrv_destroysession(nd, sessid);
4724 nfsmout:
4725         NFSEXITCODE2(error, nd);
4726         return (error);
4727 }
4728
4729 /*
4730  * nfsv4 free stateid service
4731  */
4732 int
4733 nfsrvd_freestateid(struct nfsrv_descript *nd, __unused int isdgram,
4734     __unused vnode_t vp, __unused struct nfsexstuff *exp)
4735 {
4736         uint32_t *tl;
4737         nfsv4stateid_t stateid;
4738         int error = 0;
4739         struct thread *p = curthread;
4740
4741         NFSM_DISSECT(tl, uint32_t *, NFSX_STATEID);
4742         stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
4743         NFSBCOPY(tl, stateid.other, NFSX_STATEIDOTHER);
4744
4745         /*
4746          * For the special stateid of other all 0s and seqid == 1, set the
4747          * stateid to the current stateid, if it is set.
4748          */
4749         if (stateid.seqid == 1 && stateid.other[0] == 0 &&
4750             stateid.other[1] == 0 && stateid.other[2] == 0) {
4751                 if ((nd->nd_flag & ND_CURSTATEID) != 0) {
4752                         stateid = nd->nd_curstateid;
4753                         stateid.seqid = 0;
4754                 } else {
4755                         nd->nd_repstat = NFSERR_BADSTATEID;
4756                         goto nfsmout;
4757                 }
4758         }
4759
4760         nd->nd_repstat = nfsrv_freestateid(nd, &stateid, p);
4761
4762         /* If the current stateid has been free'd, unset it. */
4763         if (nd->nd_repstat == 0 && (nd->nd_flag & ND_CURSTATEID) != 0 &&
4764             stateid.other[0] == nd->nd_curstateid.other[0] &&
4765             stateid.other[1] == nd->nd_curstateid.other[1] &&
4766             stateid.other[2] == nd->nd_curstateid.other[2])
4767                 nd->nd_flag &= ~ND_CURSTATEID;
4768 nfsmout:
4769         NFSEXITCODE2(error, nd);
4770         return (error);
4771 }
4772
4773 /*
4774  * nfsv4 layoutget service
4775  */
4776 int
4777 nfsrvd_layoutget(struct nfsrv_descript *nd, __unused int isdgram,
4778     vnode_t vp, struct nfsexstuff *exp)
4779 {
4780         uint32_t *tl;
4781         nfsv4stateid_t stateid;
4782         int error = 0, layoutlen, layouttype, iomode, maxcnt, retonclose;
4783         uint64_t offset, len, minlen;
4784         char *layp;
4785         struct thread *p = curthread;
4786
4787         NFSM_DISSECT(tl, uint32_t *, 4 * NFSX_UNSIGNED + 3 * NFSX_HYPER +
4788             NFSX_STATEID);
4789         tl++;           /* Signal layout available. Ignore for now. */
4790         layouttype = fxdr_unsigned(int, *tl++);
4791         iomode = fxdr_unsigned(int, *tl++);
4792         offset = fxdr_hyper(tl); tl += 2;
4793         len = fxdr_hyper(tl); tl += 2;
4794         minlen = fxdr_hyper(tl); tl += 2;
4795         stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
4796         NFSBCOPY(tl, stateid.other, NFSX_STATEIDOTHER);
4797         tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
4798         maxcnt = fxdr_unsigned(int, *tl);
4799         NFSD_DEBUG(4, "layoutget ltyp=%d iom=%d off=%ju len=%ju mlen=%ju\n",
4800             layouttype, iomode, (uintmax_t)offset, (uintmax_t)len,
4801             (uintmax_t)minlen);
4802         if (len < minlen ||
4803             (minlen != UINT64_MAX && offset + minlen < offset) ||
4804             (len != UINT64_MAX && offset + len < offset)) {
4805                 nd->nd_repstat = NFSERR_INVAL;
4806                 goto nfsmout;
4807         }
4808
4809         /*
4810          * For the special stateid of other all 0s and seqid == 1, set the
4811          * stateid to the current stateid, if it is set.
4812          */
4813         if (stateid.seqid == 1 && stateid.other[0] == 0 &&
4814             stateid.other[1] == 0 && stateid.other[2] == 0) {
4815                 if ((nd->nd_flag & ND_CURSTATEID) != 0) {
4816                         stateid = nd->nd_curstateid;
4817                         stateid.seqid = 0;
4818                 } else {
4819                         nd->nd_repstat = NFSERR_BADSTATEID;
4820                         goto nfsmout;
4821                 }
4822         }
4823
4824         layp = NULL;
4825         if (layouttype == NFSLAYOUT_NFSV4_1_FILES && nfsrv_maxpnfsmirror == 1)
4826                 layp = malloc(NFSX_V4FILELAYOUT, M_TEMP, M_WAITOK);
4827         else if (layouttype == NFSLAYOUT_FLEXFILE)
4828                 layp = malloc(NFSX_V4FLEXLAYOUT(nfsrv_maxpnfsmirror), M_TEMP,
4829                     M_WAITOK);
4830         else
4831                 nd->nd_repstat = NFSERR_UNKNLAYOUTTYPE;
4832         if (layp != NULL)
4833                 nd->nd_repstat = nfsrv_layoutget(nd, vp, exp, layouttype,
4834                     &iomode, &offset, &len, minlen, &stateid, maxcnt,
4835                     &retonclose, &layoutlen, layp, nd->nd_cred, p);
4836         NFSD_DEBUG(4, "nfsrv_layoutget stat=%u layoutlen=%d\n", nd->nd_repstat,
4837             layoutlen);
4838         if (nd->nd_repstat == 0) {
4839                 /* For NFSv4.1, set the Current StateID. */
4840                 if ((nd->nd_flag & ND_NFSV41) != 0) {
4841                         nd->nd_curstateid = stateid;
4842                         nd->nd_flag |= ND_CURSTATEID;
4843                 }
4844                 NFSM_BUILD(tl, uint32_t *, 4 * NFSX_UNSIGNED + NFSX_STATEID +
4845                     2 * NFSX_HYPER);
4846                 *tl++ = txdr_unsigned(retonclose);
4847                 *tl++ = txdr_unsigned(stateid.seqid);
4848                 NFSBCOPY(stateid.other, tl, NFSX_STATEIDOTHER);
4849                 tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
4850                 *tl++ = txdr_unsigned(1);       /* Only returns one layout. */
4851                 txdr_hyper(offset, tl); tl += 2;
4852                 txdr_hyper(len, tl); tl += 2;
4853                 *tl++ = txdr_unsigned(iomode);
4854                 *tl = txdr_unsigned(layouttype);
4855                 nfsm_strtom(nd, layp, layoutlen);
4856         } else if (nd->nd_repstat == NFSERR_LAYOUTTRYLATER) {
4857                 NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
4858                 *tl = newnfs_false;
4859         }
4860         free(layp, M_TEMP);
4861 nfsmout:
4862         vput(vp);
4863         NFSEXITCODE2(error, nd);
4864         return (error);
4865 }
4866
4867 /*
4868  * nfsv4 layoutcommit service
4869  */
4870 int
4871 nfsrvd_layoutcommit(struct nfsrv_descript *nd, __unused int isdgram,
4872     vnode_t vp, struct nfsexstuff *exp)
4873 {
4874         uint32_t *tl;
4875         nfsv4stateid_t stateid;
4876         int error = 0, hasnewoff, hasnewmtime, layouttype, maxcnt, reclaim;
4877         int hasnewsize;
4878         uint64_t offset, len, newoff = 0, newsize;
4879         struct timespec newmtime;
4880         char *layp;
4881         struct thread *p = curthread;
4882
4883         layp = NULL;
4884         NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_UNSIGNED + 2 * NFSX_HYPER +
4885             NFSX_STATEID);
4886         offset = fxdr_hyper(tl); tl += 2;
4887         len = fxdr_hyper(tl); tl += 2;
4888         reclaim = fxdr_unsigned(int, *tl++);
4889         stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
4890         NFSBCOPY(tl, stateid.other, NFSX_STATEIDOTHER);
4891         tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
4892         /*
4893          * For the special stateid of other all 0s and seqid == 1, set the
4894          * stateid to the current stateid, if it is set.
4895          */
4896         if (stateid.seqid == 1 && stateid.other[0] == 0 &&
4897             stateid.other[1] == 0 && stateid.other[2] == 0) {
4898                 if ((nd->nd_flag & ND_CURSTATEID) != 0) {
4899                         stateid = nd->nd_curstateid;
4900                         stateid.seqid = 0;
4901                 } else {
4902                         nd->nd_repstat = NFSERR_BADSTATEID;
4903                         goto nfsmout;
4904                 }
4905         }
4906
4907         hasnewoff = fxdr_unsigned(int, *tl);
4908         if (hasnewoff != 0) {
4909                 NFSM_DISSECT(tl, uint32_t *, NFSX_HYPER + NFSX_UNSIGNED);
4910                 newoff = fxdr_hyper(tl); tl += 2;
4911         } else
4912                 NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
4913         hasnewmtime = fxdr_unsigned(int, *tl);
4914         if (hasnewmtime != 0) {
4915                 NFSM_DISSECT(tl, uint32_t *, NFSX_V4TIME + 2 * NFSX_UNSIGNED);
4916                 fxdr_nfsv4time(tl, &newmtime);
4917                 tl += (NFSX_V4TIME / NFSX_UNSIGNED);
4918         } else
4919                 NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_UNSIGNED);
4920         layouttype = fxdr_unsigned(int, *tl++);
4921         maxcnt = fxdr_unsigned(int, *tl);
4922         if (maxcnt > 0) {
4923                 layp = malloc(maxcnt + 1, M_TEMP, M_WAITOK);
4924                 error = nfsrv_mtostr(nd, layp, maxcnt);
4925                 if (error != 0)
4926                         goto nfsmout;
4927         }
4928         nd->nd_repstat = nfsrv_layoutcommit(nd, vp, layouttype, hasnewoff,
4929             newoff, offset, len, hasnewmtime, &newmtime, reclaim, &stateid,
4930             maxcnt, layp, &hasnewsize, &newsize, nd->nd_cred, p);
4931         NFSD_DEBUG(4, "nfsrv_layoutcommit stat=%u\n", nd->nd_repstat);
4932         if (nd->nd_repstat == 0) {
4933                 if (hasnewsize != 0) {
4934                         NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED + NFSX_HYPER);
4935                         *tl++ = newnfs_true;
4936                         txdr_hyper(newsize, tl);
4937                 } else {
4938                         NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
4939                         *tl = newnfs_false;
4940                 }
4941         }
4942 nfsmout:
4943         free(layp, M_TEMP);
4944         vput(vp);
4945         NFSEXITCODE2(error, nd);
4946         return (error);
4947 }
4948
4949 /*
4950  * nfsv4 layoutreturn service
4951  */
4952 int
4953 nfsrvd_layoutreturn(struct nfsrv_descript *nd, __unused int isdgram,
4954     vnode_t vp, struct nfsexstuff *exp)
4955 {
4956         uint32_t *tl, *layp;
4957         nfsv4stateid_t stateid;
4958         int error = 0, fnd, kind, layouttype, iomode, maxcnt, reclaim;
4959         uint64_t offset, len;
4960         struct thread *p = curthread;
4961
4962         layp = NULL;
4963         NFSM_DISSECT(tl, uint32_t *, 4 * NFSX_UNSIGNED);
4964         reclaim = *tl++;
4965         layouttype = fxdr_unsigned(int, *tl++);
4966         iomode = fxdr_unsigned(int, *tl++);
4967         kind = fxdr_unsigned(int, *tl);
4968         NFSD_DEBUG(4, "layoutreturn recl=%d ltyp=%d iom=%d kind=%d\n", reclaim,
4969             layouttype, iomode, kind);
4970         if (kind == NFSV4LAYOUTRET_FILE) {
4971                 NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_HYPER + NFSX_STATEID +
4972                     NFSX_UNSIGNED);
4973                 offset = fxdr_hyper(tl); tl += 2;
4974                 len = fxdr_hyper(tl); tl += 2;
4975                 stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
4976                 NFSBCOPY(tl, stateid.other, NFSX_STATEIDOTHER);
4977                 tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
4978
4979                 /*
4980                  * For the special stateid of other all 0s and seqid == 1, set
4981                  * the stateid to the current stateid, if it is set.
4982                  */
4983                 if (stateid.seqid == 1 && stateid.other[0] == 0 &&
4984                     stateid.other[1] == 0 && stateid.other[2] == 0) {
4985                         if ((nd->nd_flag & ND_CURSTATEID) != 0) {
4986                                 stateid = nd->nd_curstateid;
4987                                 stateid.seqid = 0;
4988                         } else {
4989                                 nd->nd_repstat = NFSERR_BADSTATEID;
4990                                 goto nfsmout;
4991                         }
4992                 }
4993
4994                 maxcnt = fxdr_unsigned(int, *tl);
4995                 /*
4996                  * There is no fixed upper bound defined in the RFCs,
4997                  * but 128Kbytes should be more than sufficient.
4998                  */
4999                 if (maxcnt < 0 || maxcnt > 131072)
5000                         maxcnt = 0;
5001                 if (maxcnt > 0) {
5002                         layp = malloc(maxcnt + 1, M_TEMP, M_WAITOK);
5003                         error = nfsrv_mtostr(nd, (char *)layp, maxcnt);
5004                         if (error != 0)
5005                                 goto nfsmout;
5006                 }
5007         } else {
5008                 if (reclaim == newnfs_true) {
5009                         nd->nd_repstat = NFSERR_INVAL;
5010                         goto nfsmout;
5011                 }
5012                 offset = len = 0;
5013                 maxcnt = 0;
5014         }
5015         nd->nd_repstat = nfsrv_layoutreturn(nd, vp, layouttype, iomode,
5016             offset, len, reclaim, kind, &stateid, maxcnt, layp, &fnd,
5017             nd->nd_cred, p);
5018         NFSD_DEBUG(4, "nfsrv_layoutreturn stat=%u fnd=%d\n", nd->nd_repstat,
5019             fnd);
5020         if (nd->nd_repstat == 0) {
5021                 NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
5022                 if (fnd != 0) {
5023                         *tl = newnfs_true;
5024                         NFSM_BUILD(tl, uint32_t *, NFSX_STATEID);
5025                         *tl++ = txdr_unsigned(stateid.seqid);
5026                         NFSBCOPY(stateid.other, tl, NFSX_STATEIDOTHER);
5027                 } else
5028                         *tl = newnfs_false;
5029         }
5030 nfsmout:
5031         free(layp, M_TEMP);
5032         vput(vp);
5033         NFSEXITCODE2(error, nd);
5034         return (error);
5035 }
5036
5037 /*
5038  * nfsv4 layout error service
5039  */
5040 int
5041 nfsrvd_layouterror(struct nfsrv_descript *nd, __unused int isdgram,
5042     vnode_t vp, struct nfsexstuff *exp)
5043 {
5044         uint32_t *tl;
5045         nfsv4stateid_t stateid;
5046         int cnt, error = 0, i, stat;
5047         int opnum __unused;
5048         char devid[NFSX_V4DEVICEID];
5049         uint64_t offset, len;
5050
5051         NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_HYPER + NFSX_STATEID +
5052             NFSX_UNSIGNED);
5053         offset = fxdr_hyper(tl); tl += 2;
5054         len = fxdr_hyper(tl); tl += 2;
5055         stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
5056         NFSBCOPY(tl, stateid.other, NFSX_STATEIDOTHER);
5057         tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
5058         cnt = fxdr_unsigned(int, *tl);
5059         NFSD_DEBUG(4, "layouterror off=%ju len=%ju cnt=%d\n", (uintmax_t)offset,
5060             (uintmax_t)len, cnt);
5061         /*
5062          * For the special stateid of other all 0s and seqid == 1, set
5063          * the stateid to the current stateid, if it is set.
5064          */
5065         if (stateid.seqid == 1 && stateid.other[0] == 0 &&
5066             stateid.other[1] == 0 && stateid.other[2] == 0) {
5067                 if ((nd->nd_flag & ND_CURSTATEID) != 0) {
5068                         stateid = nd->nd_curstateid;
5069                         stateid.seqid = 0;
5070                 } else {
5071                         nd->nd_repstat = NFSERR_BADSTATEID;
5072                         goto nfsmout;
5073                 }
5074         }
5075
5076         /*
5077          * Ignore offset, len and stateid for now.
5078          */
5079         for (i = 0; i < cnt; i++) {
5080                 NFSM_DISSECT(tl, uint32_t *, NFSX_V4DEVICEID + 2 *
5081                     NFSX_UNSIGNED);
5082                 NFSBCOPY(tl, devid, NFSX_V4DEVICEID);
5083                 tl += (NFSX_V4DEVICEID / NFSX_UNSIGNED);
5084                 stat = fxdr_unsigned(int, *tl++);
5085                 opnum = fxdr_unsigned(int, *tl);
5086                 NFSD_DEBUG(4, "nfsrvd_layouterr op=%d stat=%d\n", opnum, stat);
5087                 /*
5088                  * Except for NFSERR_ACCES, NFSERR_STALE and NFSERR_NOSPC
5089                  * errors, disable the mirror.
5090                  */
5091                 if (stat != NFSERR_ACCES && stat != NFSERR_STALE &&
5092                     stat != NFSERR_NOSPC)
5093                         nfsrv_delds(devid, curthread);
5094
5095                 /* For NFSERR_NOSPC, mark all deviceids and layouts. */
5096                 if (stat == NFSERR_NOSPC)
5097                         nfsrv_marknospc(devid, true);
5098         }
5099 nfsmout:
5100         vput(vp);
5101         NFSEXITCODE2(error, nd);
5102         return (error);
5103 }
5104
5105 /*
5106  * nfsv4 layout stats service
5107  */
5108 int
5109 nfsrvd_layoutstats(struct nfsrv_descript *nd, __unused int isdgram,
5110     vnode_t vp, struct nfsexstuff *exp)
5111 {
5112         uint32_t *tl;
5113         nfsv4stateid_t stateid;
5114         int cnt, error = 0;
5115         int layouttype __unused;
5116         char devid[NFSX_V4DEVICEID] __unused;
5117         uint64_t offset __unused, len __unused, readcount __unused;
5118         uint64_t readbytes __unused, writecount __unused, writebytes __unused;
5119
5120         NFSM_DISSECT(tl, uint32_t *, 6 * NFSX_HYPER + NFSX_STATEID +
5121             NFSX_V4DEVICEID + 2 * NFSX_UNSIGNED);
5122         offset = fxdr_hyper(tl); tl += 2;
5123         len = fxdr_hyper(tl); tl += 2;
5124         stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
5125         NFSBCOPY(tl, stateid.other, NFSX_STATEIDOTHER);
5126         tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
5127         readcount = fxdr_hyper(tl); tl += 2;
5128         readbytes = fxdr_hyper(tl); tl += 2;
5129         writecount = fxdr_hyper(tl); tl += 2;
5130         writebytes = fxdr_hyper(tl); tl += 2;
5131         NFSBCOPY(tl, devid, NFSX_V4DEVICEID);
5132         tl += (NFSX_V4DEVICEID / NFSX_UNSIGNED);
5133         layouttype = fxdr_unsigned(int, *tl++);
5134         cnt = fxdr_unsigned(int, *tl);
5135         error = nfsm_advance(nd, NFSM_RNDUP(cnt), -1);
5136         if (error != 0)
5137                 goto nfsmout;
5138         NFSD_DEBUG(4, "layoutstats cnt=%d\n", cnt);
5139         /*
5140          * For the special stateid of other all 0s and seqid == 1, set
5141          * the stateid to the current stateid, if it is set.
5142          */
5143         if (stateid.seqid == 1 && stateid.other[0] == 0 &&
5144             stateid.other[1] == 0 && stateid.other[2] == 0) {
5145                 if ((nd->nd_flag & ND_CURSTATEID) != 0) {
5146                         stateid = nd->nd_curstateid;
5147                         stateid.seqid = 0;
5148                 } else {
5149                         nd->nd_repstat = NFSERR_BADSTATEID;
5150                         goto nfsmout;
5151                 }
5152         }
5153
5154         /*
5155          * No use for the stats for now.
5156          */
5157 nfsmout:
5158         vput(vp);
5159         NFSEXITCODE2(error, nd);
5160         return (error);
5161 }
5162
5163 /*
5164  * nfsv4 io_advise service
5165  */
5166 int
5167 nfsrvd_ioadvise(struct nfsrv_descript *nd, __unused int isdgram,
5168     vnode_t vp, struct nfsexstuff *exp)
5169 {
5170         uint32_t *tl;
5171         nfsv4stateid_t stateid;
5172         nfsattrbit_t hints;
5173         int error = 0, ret;
5174         off_t offset, len;
5175
5176         NFSM_DISSECT(tl, uint32_t *, NFSX_STATEID + 2 * NFSX_HYPER);
5177         stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
5178         NFSBCOPY(tl, stateid.other, NFSX_STATEIDOTHER);
5179         tl += (NFSX_STATEIDOTHER / NFSX_UNSIGNED);
5180         offset = fxdr_hyper(tl); tl += 2;
5181         len = fxdr_hyper(tl);
5182         error = nfsrv_getattrbits(nd, &hints, NULL, NULL);
5183         if (error != 0)
5184                 goto nfsmout;
5185         /*
5186          * For the special stateid of other all 0s and seqid == 1, set
5187          * the stateid to the current stateid, if it is set.
5188          */
5189         if (stateid.seqid == 1 && stateid.other[0] == 0 &&
5190             stateid.other[1] == 0 && stateid.other[2] == 0) {
5191                 if ((nd->nd_flag & ND_CURSTATEID) != 0) {
5192                         stateid = nd->nd_curstateid;
5193                         stateid.seqid = 0;
5194                 } else {
5195                         nd->nd_repstat = NFSERR_BADSTATEID;
5196                         goto nfsmout;
5197                 }
5198         }
5199
5200         if (offset < 0) {
5201                 nd->nd_repstat = NFSERR_INVAL;
5202                 goto nfsmout;
5203         }
5204         if (len < 0)
5205                 len = 0;
5206         if (vp->v_type != VREG) {
5207                 if (vp->v_type == VDIR)
5208                         nd->nd_repstat = NFSERR_ISDIR;
5209                 else
5210                         nd->nd_repstat = NFSERR_WRONGTYPE;
5211                 goto nfsmout;
5212         }
5213
5214         /*
5215          * For now, we can only handle WILLNEED and DONTNEED and don't use
5216          * the stateid.
5217          */
5218         if ((NFSISSET_ATTRBIT(&hints, NFSV4IOHINT_WILLNEED) &&
5219             !NFSISSET_ATTRBIT(&hints, NFSV4IOHINT_DONTNEED)) ||
5220             (NFSISSET_ATTRBIT(&hints, NFSV4IOHINT_DONTNEED) &&
5221             !NFSISSET_ATTRBIT(&hints, NFSV4IOHINT_WILLNEED))) {
5222                 NFSVOPUNLOCK(vp);
5223                 if (NFSISSET_ATTRBIT(&hints, NFSV4IOHINT_WILLNEED)) {
5224                         ret = VOP_ADVISE(vp, offset, len, POSIX_FADV_WILLNEED);
5225                         NFSZERO_ATTRBIT(&hints);
5226                         if (ret == 0)
5227                                 NFSSETBIT_ATTRBIT(&hints, NFSV4IOHINT_WILLNEED);
5228                         else
5229                                 NFSSETBIT_ATTRBIT(&hints, NFSV4IOHINT_NORMAL);
5230                 } else {
5231                         ret = VOP_ADVISE(vp, offset, len, POSIX_FADV_DONTNEED);
5232                         NFSZERO_ATTRBIT(&hints);
5233                         if (ret == 0)
5234                                 NFSSETBIT_ATTRBIT(&hints, NFSV4IOHINT_DONTNEED);
5235                         else
5236                                 NFSSETBIT_ATTRBIT(&hints, NFSV4IOHINT_NORMAL);
5237                 }
5238                 vrele(vp);
5239         } else {
5240                 NFSZERO_ATTRBIT(&hints);
5241                 NFSSETBIT_ATTRBIT(&hints, NFSV4IOHINT_NORMAL);
5242                 vput(vp);
5243         }
5244         nfsrv_putattrbit(nd, &hints);
5245         NFSEXITCODE2(error, nd);
5246         return (error);
5247 nfsmout:
5248         vput(vp);
5249         NFSEXITCODE2(error, nd);
5250         return (error);
5251 }
5252
5253 /*
5254  * nfsv4 getdeviceinfo service
5255  */
5256 int
5257 nfsrvd_getdevinfo(struct nfsrv_descript *nd, __unused int isdgram,
5258     __unused vnode_t vp, __unused struct nfsexstuff *exp)
5259 {
5260         uint32_t *tl, maxcnt, notify[NFSV4_NOTIFYBITMAP];
5261         int cnt, devaddrlen, error = 0, i, layouttype;
5262         char devid[NFSX_V4DEVICEID], *devaddr;
5263         time_t dev_time;
5264
5265         NFSM_DISSECT(tl, uint32_t *, 3 * NFSX_UNSIGNED + NFSX_V4DEVICEID);
5266         NFSBCOPY(tl, devid, NFSX_V4DEVICEID);
5267         tl += (NFSX_V4DEVICEID / NFSX_UNSIGNED);
5268         layouttype = fxdr_unsigned(int, *tl++);
5269         maxcnt = fxdr_unsigned(uint32_t, *tl++);
5270         cnt = fxdr_unsigned(int, *tl);
5271         NFSD_DEBUG(4, "getdevinfo ltyp=%d maxcnt=%u bitcnt=%d\n", layouttype,
5272             maxcnt, cnt);
5273         if (cnt > NFSV4_NOTIFYBITMAP || cnt < 0) {
5274                 nd->nd_repstat = NFSERR_INVAL;
5275                 goto nfsmout;
5276         }
5277         if (cnt > 0) {
5278                 NFSM_DISSECT(tl, uint32_t *, cnt * NFSX_UNSIGNED);
5279                 for (i = 0; i < cnt; i++)
5280                         notify[i] = fxdr_unsigned(uint32_t, *tl++);
5281         }
5282         for (i = cnt; i < NFSV4_NOTIFYBITMAP; i++)
5283                 notify[i] = 0;
5284
5285         /*
5286          * Check that the device id is not stale.  Device ids are recreated
5287          * each time the nfsd threads are restarted.
5288          */
5289         NFSBCOPY(devid, &dev_time, sizeof(dev_time));
5290         if (dev_time != nfsdev_time) {
5291                 nd->nd_repstat = NFSERR_NOENT;
5292                 goto nfsmout;
5293         }
5294
5295         /* Look for the device id. */
5296         nd->nd_repstat = nfsrv_getdevinfo(devid, layouttype, &maxcnt,
5297             notify, &devaddrlen, &devaddr);
5298         NFSD_DEBUG(4, "nfsrv_getdevinfo stat=%u\n", nd->nd_repstat);
5299         if (nd->nd_repstat == 0) {
5300                 NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
5301                 *tl = txdr_unsigned(layouttype);
5302                 nfsm_strtom(nd, devaddr, devaddrlen);
5303                 cnt = 0;
5304                 for (i = 0; i < NFSV4_NOTIFYBITMAP; i++) {
5305                         if (notify[i] != 0)
5306                                 cnt = i + 1;
5307                 }
5308                 NFSM_BUILD(tl, uint32_t *, (cnt + 1) * NFSX_UNSIGNED);
5309                 *tl++ = txdr_unsigned(cnt);
5310                 for (i = 0; i < cnt; i++)
5311                         *tl++ = txdr_unsigned(notify[i]);
5312         } else if (nd->nd_repstat == NFSERR_TOOSMALL) {
5313                 NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
5314                 *tl = txdr_unsigned(maxcnt);
5315         }
5316 nfsmout:
5317         NFSEXITCODE2(error, nd);
5318         return (error);
5319 }
5320
5321 /*
5322  * nfsv4 test stateid service
5323  */
5324 int
5325 nfsrvd_teststateid(struct nfsrv_descript *nd, __unused int isdgram,
5326     __unused vnode_t vp, __unused struct nfsexstuff *exp)
5327 {
5328         uint32_t *tl;
5329         nfsv4stateid_t *stateidp = NULL, *tstateidp;
5330         int cnt, error = 0, i, ret;
5331         struct thread *p = curthread;
5332
5333         NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
5334         cnt = fxdr_unsigned(int, *tl);
5335         if (cnt <= 0 || cnt > 1024) {
5336                 nd->nd_repstat = NFSERR_BADXDR;
5337                 goto nfsmout;
5338         }
5339         stateidp = mallocarray(cnt, sizeof(nfsv4stateid_t), M_TEMP, M_WAITOK);
5340         tstateidp = stateidp;
5341         for (i = 0; i < cnt; i++) {
5342                 NFSM_DISSECT(tl, uint32_t *, NFSX_STATEID);
5343                 tstateidp->seqid = fxdr_unsigned(uint32_t, *tl++);
5344                 NFSBCOPY(tl, tstateidp->other, NFSX_STATEIDOTHER);
5345                 tstateidp++;
5346         }
5347         NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
5348         *tl = txdr_unsigned(cnt);
5349         tstateidp = stateidp;
5350         for (i = 0; i < cnt; i++) {
5351                 ret = nfsrv_teststateid(nd, tstateidp, p);
5352                 NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
5353                 *tl = txdr_unsigned(ret);
5354                 tstateidp++;
5355         }
5356 nfsmout:
5357         free(stateidp, M_TEMP);
5358         NFSEXITCODE2(error, nd);
5359         return (error);
5360 }
5361
5362 /*
5363  * nfs allocate service
5364  */
5365 int
5366 nfsrvd_allocate(struct nfsrv_descript *nd, __unused int isdgram,
5367     vnode_t vp, struct nfsexstuff *exp)
5368 {
5369         uint32_t *tl;
5370         struct nfsvattr forat;
5371         int error = 0, forat_ret = 1, gotproxystateid;
5372         off_t off, len;
5373         struct nfsstate st, *stp = &st;
5374         struct nfslock lo, *lop = &lo;
5375         nfsv4stateid_t stateid;
5376         nfsquad_t clientid;
5377         nfsattrbit_t attrbits;
5378
5379         if (!nfsrv_doallocate) {
5380                 /*
5381                  * If any exported file system, such as a ZFS one, cannot
5382                  * do VOP_ALLOCATE(), this operation cannot be supported
5383                  * for NFSv4.2.  This cannot be done 'per filesystem', but
5384                  * must be for the entire nfsd NFSv4.2 service.
5385                  */
5386                 nd->nd_repstat = NFSERR_NOTSUPP;
5387                 goto nfsmout;
5388         }
5389         gotproxystateid = 0;
5390         NFSM_DISSECT(tl, uint32_t *, NFSX_STATEID + 2 * NFSX_HYPER);
5391         stp->ls_flags = (NFSLCK_CHECK | NFSLCK_WRITEACCESS);
5392         lop->lo_flags = NFSLCK_WRITE;
5393         stp->ls_ownerlen = 0;
5394         stp->ls_op = NULL;
5395         stp->ls_uid = nd->nd_cred->cr_uid;
5396         stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
5397         clientid.lval[0] = stp->ls_stateid.other[0] = *tl++;
5398         clientid.lval[1] = stp->ls_stateid.other[1] = *tl++;
5399         if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
5400                 if ((nd->nd_flag & ND_NFSV41) != 0)
5401                         clientid.qval = nd->nd_clientid.qval;
5402                 else if (nd->nd_clientid.qval != clientid.qval)
5403                         printf("EEK2 multiple clids\n");
5404         } else {
5405                 if ((nd->nd_flag & ND_NFSV41) != 0)
5406                         printf("EEK! no clientid from session\n");
5407                 nd->nd_flag |= ND_IMPLIEDCLID;
5408                 nd->nd_clientid.qval = clientid.qval;
5409         }
5410         stp->ls_stateid.other[2] = *tl++;
5411         /*
5412          * Don't allow this to be done for a DS.
5413          */
5414         if ((nd->nd_flag & ND_DSSERVER) != 0)
5415                 nd->nd_repstat = NFSERR_NOTSUPP;
5416         /* However, allow the proxy stateid. */
5417         if (stp->ls_stateid.seqid == 0xffffffff &&
5418             stp->ls_stateid.other[0] == 0x55555555 &&
5419             stp->ls_stateid.other[1] == 0x55555555 &&
5420             stp->ls_stateid.other[2] == 0x55555555)
5421                 gotproxystateid = 1;
5422         off = fxdr_hyper(tl); tl += 2;
5423         lop->lo_first = off;
5424         len = fxdr_hyper(tl);
5425         lop->lo_end = lop->lo_first + len;
5426         /*
5427          * Sanity check the offset and length.
5428          * off and len are off_t (signed int64_t) whereas
5429          * lo_first and lo_end are uint64_t and, as such,
5430          * if off >= 0 && len > 0, lo_end cannot overflow
5431          * unless off_t is changed to something other than
5432          * int64_t.  Check lo_end < lo_first in case that
5433          * is someday the case.
5434          */
5435         if (nd->nd_repstat == 0 && (len <= 0 || off < 0 || lop->lo_end >
5436             OFF_MAX || lop->lo_end < lop->lo_first))
5437                 nd->nd_repstat = NFSERR_INVAL;
5438
5439         if (nd->nd_repstat == 0 && vp->v_type != VREG)
5440                 nd->nd_repstat = NFSERR_WRONGTYPE;
5441         NFSZERO_ATTRBIT(&attrbits);
5442         NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_OWNER);
5443         forat_ret = nfsvno_getattr(vp, &forat, nd, curthread, 1, &attrbits);
5444         if (nd->nd_repstat == 0)
5445                 nd->nd_repstat = forat_ret;
5446         if (nd->nd_repstat == 0 && (forat.na_uid != nd->nd_cred->cr_uid ||
5447              NFSVNO_EXSTRICTACCESS(exp)))
5448                 nd->nd_repstat = nfsvno_accchk(vp, VWRITE, nd->nd_cred, exp,
5449                     curthread, NFSACCCHK_ALLOWOWNER, NFSACCCHK_VPISLOCKED,
5450                     NULL);
5451         if (nd->nd_repstat == 0 && gotproxystateid == 0)
5452                 nd->nd_repstat = nfsrv_lockctrl(vp, &stp, &lop, NULL, clientid,
5453                     &stateid, exp, nd, curthread);
5454
5455         NFSD_DEBUG(4, "nfsrvd_allocate: off=%jd len=%jd stat=%d\n",
5456             (intmax_t)off, (intmax_t)len, nd->nd_repstat);
5457         if (nd->nd_repstat == 0)
5458                 nd->nd_repstat = nfsvno_allocate(vp, off, len, nd->nd_cred,
5459                     curthread);
5460         NFSD_DEBUG(4, "nfsrvd_allocate: aft nfsvno_allocate=%d\n",
5461             nd->nd_repstat);
5462         vput(vp);
5463         NFSEXITCODE2(0, nd);
5464         return (0);
5465 nfsmout:
5466         vput(vp);
5467         NFSEXITCODE2(error, nd);
5468         return (error);
5469 }
5470
5471 /*
5472  * nfs deallocate service
5473  */
5474 int
5475 nfsrvd_deallocate(struct nfsrv_descript *nd, __unused int isdgram,
5476     vnode_t vp, struct nfsexstuff *exp)
5477 {
5478         uint32_t *tl;
5479         struct nfsvattr forat;
5480         int error = 0, forat_ret = 1, gotproxystateid;
5481         off_t off, len;
5482         struct nfsstate st, *stp = &st;
5483         struct nfslock lo, *lop = &lo;
5484         nfsv4stateid_t stateid;
5485         nfsquad_t clientid;
5486         nfsattrbit_t attrbits;
5487
5488         gotproxystateid = 0;
5489         NFSM_DISSECT(tl, uint32_t *, NFSX_STATEID + 2 * NFSX_HYPER);
5490         stp->ls_flags = (NFSLCK_CHECK | NFSLCK_WRITEACCESS);
5491         lop->lo_flags = NFSLCK_WRITE;
5492         stp->ls_ownerlen = 0;
5493         stp->ls_op = NULL;
5494         stp->ls_uid = nd->nd_cred->cr_uid;
5495         stp->ls_stateid.seqid = fxdr_unsigned(u_int32_t, *tl++);
5496         clientid.lval[0] = stp->ls_stateid.other[0] = *tl++;
5497         clientid.lval[1] = stp->ls_stateid.other[1] = *tl++;
5498         if ((nd->nd_flag & ND_IMPLIEDCLID) != 0) {
5499                 if ((nd->nd_flag & ND_NFSV41) != 0)
5500                         clientid.qval = nd->nd_clientid.qval;
5501                 else if (nd->nd_clientid.qval != clientid.qval)
5502                         printf("EEK2 multiple clids\n");
5503         } else {
5504                 if ((nd->nd_flag & ND_NFSV41) != 0)
5505                         printf("EEK! no clientid from session\n");
5506                 nd->nd_flag |= ND_IMPLIEDCLID;
5507                 nd->nd_clientid.qval = clientid.qval;
5508         }
5509         stp->ls_stateid.other[2] = *tl++;
5510         /*
5511          * Don't allow this to be done for a DS.
5512          */
5513         if ((nd->nd_flag & ND_DSSERVER) != 0)
5514                 nd->nd_repstat = NFSERR_NOTSUPP;
5515         /* However, allow the proxy stateid. */
5516         if (stp->ls_stateid.seqid == 0xffffffff &&
5517             stp->ls_stateid.other[0] == 0x55555555 &&
5518             stp->ls_stateid.other[1] == 0x55555555 &&
5519             stp->ls_stateid.other[2] == 0x55555555)
5520                 gotproxystateid = 1;
5521         off = fxdr_hyper(tl); tl += 2;
5522         lop->lo_first = off;
5523         len = fxdr_hyper(tl);
5524         if (len < 0)
5525                 len = OFF_MAX;
5526         NFSD_DEBUG(4, "dealloc: off=%jd len=%jd\n", (intmax_t)off,
5527             (intmax_t)len);
5528         lop->lo_end = lop->lo_first + len;
5529         /*
5530          * Sanity check the offset and length.
5531          * off and len are off_t (signed int64_t) whereas
5532          * lo_first and lo_end are uint64_t and, as such,
5533          * if off >= 0 && len > 0, lo_end cannot overflow
5534          * unless off_t is changed to something other than
5535          * int64_t.  Check lo_end < lo_first in case that
5536          * is someday the case.
5537          * The error to return is not specified by RFC 7862 so I
5538          * made this compatible with the Linux knfsd.
5539          */
5540         if (nd->nd_repstat == 0) {
5541                 if (off < 0 || lop->lo_end > NFSRV_MAXFILESIZE)
5542                         nd->nd_repstat = NFSERR_FBIG;
5543                 else if (len == 0 || lop->lo_end < lop->lo_first)
5544                         nd->nd_repstat = NFSERR_INVAL;
5545         }
5546
5547         if (nd->nd_repstat == 0 && vp->v_type != VREG)
5548                 nd->nd_repstat = NFSERR_WRONGTYPE;
5549         NFSZERO_ATTRBIT(&attrbits);
5550         NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_OWNER);
5551         forat_ret = nfsvno_getattr(vp, &forat, nd, curthread, 1, &attrbits);
5552         if (nd->nd_repstat == 0)
5553                 nd->nd_repstat = forat_ret;
5554         if (nd->nd_repstat == 0 && (forat.na_uid != nd->nd_cred->cr_uid ||
5555              NFSVNO_EXSTRICTACCESS(exp)))
5556                 nd->nd_repstat = nfsvno_accchk(vp, VWRITE, nd->nd_cred, exp,
5557                     curthread, NFSACCCHK_ALLOWOWNER, NFSACCCHK_VPISLOCKED,
5558                     NULL);
5559         if (nd->nd_repstat == 0 && gotproxystateid == 0)
5560                 nd->nd_repstat = nfsrv_lockctrl(vp, &stp, &lop, NULL, clientid,
5561                     &stateid, exp, nd, curthread);
5562
5563         if (nd->nd_repstat == 0)
5564                 nd->nd_repstat = nfsvno_deallocate(vp, off, len, nd->nd_cred,
5565                     curthread);
5566         vput(vp);
5567         NFSD_DEBUG(4, "eo deallocate=%d\n", nd->nd_repstat);
5568         NFSEXITCODE2(0, nd);
5569         return (0);
5570 nfsmout:
5571         vput(vp);
5572         NFSEXITCODE2(error, nd);
5573         return (error);
5574 }
5575
5576 /*
5577  * nfs copy service
5578  */
5579 int
5580 nfsrvd_copy_file_range(struct nfsrv_descript *nd, __unused int isdgram,
5581     vnode_t vp, vnode_t tovp, struct nfsexstuff *exp, struct nfsexstuff *toexp)
5582 {
5583         uint32_t *tl;
5584         struct nfsvattr at;
5585         int cnt, error = 0, ret;
5586         off_t inoff, outoff;
5587         uint64_t len;
5588         size_t xfer;
5589         struct nfsstate inst, outst, *instp = &inst, *outstp = &outst;
5590         struct nfslock inlo, outlo, *inlop = &inlo, *outlop = &outlo;
5591         nfsquad_t clientid;
5592         nfsv4stateid_t stateid;
5593         nfsattrbit_t attrbits;
5594         void *rl_rcookie, *rl_wcookie;
5595
5596         rl_rcookie = rl_wcookie = NULL;
5597         if (nfsrv_devidcnt > 0) {
5598                 /*
5599                  * For a pNFS server, reply NFSERR_NOTSUPP so that the client
5600                  * will do the copy via I/O on the DS(s).
5601                  */
5602                 nd->nd_repstat = NFSERR_NOTSUPP;
5603                 goto nfsmout;
5604         }
5605         if (vp == tovp) {
5606                 /* Copying a byte range within the same file is not allowed. */
5607                 nd->nd_repstat = NFSERR_INVAL;
5608                 goto nfsmout;
5609         }
5610         NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_STATEID + 3 * NFSX_HYPER +
5611             3 * NFSX_UNSIGNED);
5612         instp->ls_flags = (NFSLCK_CHECK | NFSLCK_READACCESS);
5613         inlop->lo_flags = NFSLCK_READ;
5614         instp->ls_ownerlen = 0;
5615         instp->ls_op = NULL;
5616         instp->ls_uid = nd->nd_cred->cr_uid;
5617         instp->ls_stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
5618         clientid.lval[0] = instp->ls_stateid.other[0] = *tl++;
5619         clientid.lval[1] = instp->ls_stateid.other[1] = *tl++;
5620         if ((nd->nd_flag & ND_IMPLIEDCLID) != 0)
5621                 clientid.qval = nd->nd_clientid.qval;
5622         instp->ls_stateid.other[2] = *tl++;
5623         outstp->ls_flags = (NFSLCK_CHECK | NFSLCK_WRITEACCESS);
5624         outlop->lo_flags = NFSLCK_WRITE;
5625         outstp->ls_ownerlen = 0;
5626         outstp->ls_op = NULL;
5627         outstp->ls_uid = nd->nd_cred->cr_uid;
5628         outstp->ls_stateid.seqid = fxdr_unsigned(uint32_t, *tl++);
5629         outstp->ls_stateid.other[0] = *tl++;
5630         outstp->ls_stateid.other[1] = *tl++;
5631         outstp->ls_stateid.other[2] = *tl++;
5632         inoff = fxdr_hyper(tl); tl += 2;
5633         inlop->lo_first = inoff;
5634         outoff = fxdr_hyper(tl); tl += 2;
5635         outlop->lo_first = outoff;
5636         len = fxdr_hyper(tl); tl += 2;
5637         if (len == 0) {
5638                 /* len == 0 means to EOF. */
5639                 inlop->lo_end = OFF_MAX;
5640                 outlop->lo_end = OFF_MAX;
5641         } else {
5642                 inlop->lo_end = inlop->lo_first + len;
5643                 outlop->lo_end = outlop->lo_first + len;
5644         }
5645
5646         /*
5647          * At this time only consecutive, synchronous copy is supported,
5648          * so ca_consecutive and ca_synchronous can be ignored.
5649          */
5650         tl += 2;
5651
5652         cnt = fxdr_unsigned(int, *tl);
5653         if ((nd->nd_flag & ND_DSSERVER) != 0 || cnt != 0)
5654                 nd->nd_repstat = NFSERR_NOTSUPP;
5655         if (nd->nd_repstat == 0 && (inoff > OFF_MAX || outoff > OFF_MAX ||
5656             inlop->lo_end > OFF_MAX || outlop->lo_end > OFF_MAX ||
5657             inlop->lo_end < inlop->lo_first || outlop->lo_end <
5658             outlop->lo_first))
5659                 nd->nd_repstat = NFSERR_INVAL;
5660
5661         if (nd->nd_repstat == 0 && vp->v_type != VREG)
5662                 nd->nd_repstat = NFSERR_WRONGTYPE;
5663
5664         /* Check permissions for the input file. */
5665         NFSZERO_ATTRBIT(&attrbits);
5666         NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_OWNER);
5667         ret = nfsvno_getattr(vp, &at, nd, curthread, 1, &attrbits);
5668         if (nd->nd_repstat == 0)
5669                 nd->nd_repstat = ret;
5670         if (nd->nd_repstat == 0 && (at.na_uid != nd->nd_cred->cr_uid ||
5671              NFSVNO_EXSTRICTACCESS(exp)))
5672                 nd->nd_repstat = nfsvno_accchk(vp, VREAD, nd->nd_cred, exp,
5673                     curthread, NFSACCCHK_ALLOWOWNER, NFSACCCHK_VPISLOCKED,
5674                     NULL);
5675         if (nd->nd_repstat == 0)
5676                 nd->nd_repstat = nfsrv_lockctrl(vp, &instp, &inlop, NULL,
5677                     clientid, &stateid, exp, nd, curthread);
5678         NFSVOPUNLOCK(vp);
5679         if (nd->nd_repstat != 0)
5680                 goto out;
5681
5682         error = NFSVOPLOCK(tovp, LK_SHARED);
5683         if (error != 0)
5684                 goto out;
5685         if (tovp->v_type != VREG)
5686                 nd->nd_repstat = NFSERR_WRONGTYPE;
5687
5688         /* For the output file, we only need the Owner attribute. */
5689         ret = nfsvno_getattr(tovp, &at, nd, curthread, 1, &attrbits);
5690         if (nd->nd_repstat == 0)
5691                 nd->nd_repstat = ret;
5692         if (nd->nd_repstat == 0 && (at.na_uid != nd->nd_cred->cr_uid ||
5693              NFSVNO_EXSTRICTACCESS(exp)))
5694                 nd->nd_repstat = nfsvno_accchk(tovp, VWRITE, nd->nd_cred, toexp,
5695                     curthread, NFSACCCHK_ALLOWOWNER, NFSACCCHK_VPISLOCKED,
5696                     NULL);
5697         if (nd->nd_repstat == 0)
5698                 nd->nd_repstat = nfsrv_lockctrl(tovp, &outstp, &outlop, NULL,
5699                     clientid, &stateid, toexp, nd, curthread);
5700         NFSVOPUNLOCK(tovp);
5701
5702         /* Range lock the byte ranges for both invp and outvp. */
5703         if (nd->nd_repstat == 0) {
5704                 for (;;) {
5705                         if (len == 0) {
5706                                 rl_wcookie = vn_rangelock_wlock(tovp, outoff,
5707                                     OFF_MAX);
5708                                 rl_rcookie = vn_rangelock_tryrlock(vp, inoff,
5709                                     OFF_MAX);
5710                         } else {
5711                                 rl_wcookie = vn_rangelock_wlock(tovp, outoff,
5712                                     outoff + len);
5713                                 rl_rcookie = vn_rangelock_tryrlock(vp, inoff,
5714                                     inoff + len);
5715                         }
5716                         if (rl_rcookie != NULL)
5717                                 break;
5718                         vn_rangelock_unlock(tovp, rl_wcookie);
5719                         if (len == 0)
5720                                 rl_rcookie = vn_rangelock_rlock(vp, inoff,
5721                                     OFF_MAX);
5722                         else
5723                                 rl_rcookie = vn_rangelock_rlock(vp, inoff,
5724                                     inoff + len);
5725                         vn_rangelock_unlock(vp, rl_rcookie);
5726                 }
5727
5728                 error = NFSVOPLOCK(vp, LK_SHARED);
5729                 if (error == 0) {
5730                         ret = nfsvno_getattr(vp, &at, nd, curthread, 1, NULL);
5731                         if (ret == 0) {
5732                                 /*
5733                                  * Since invp is range locked, na_size should
5734                                  * not change.
5735                                  */
5736                                 if (len == 0 && at.na_size > inoff) {
5737                                         /*
5738                                          * If len == 0, set it based on invp's
5739                                          * size. If offset is past EOF, just
5740                                          * leave len == 0.
5741                                          */
5742                                         len = at.na_size - inoff;
5743                                 } else if (nfsrv_linux42server == 0 &&
5744                                     inoff + len > at.na_size) {
5745                                         /*
5746                                          * RFC-7862 says that NFSERR_INVAL must
5747                                          * be returned when inoff + len exceeds
5748                                          * the file size, however the NFSv4.2
5749                                          * Linux client likes to do this, so
5750                                          * only check if nfsrv_linux42server
5751                                          * is not set.
5752                                          */
5753                                         nd->nd_repstat = NFSERR_INVAL;
5754                                 }
5755                         }
5756                         NFSVOPUNLOCK(vp);
5757                         if (ret != 0 && nd->nd_repstat == 0)
5758                                 nd->nd_repstat = ret;
5759                 } else if (nd->nd_repstat == 0)
5760                         nd->nd_repstat = error;
5761         }
5762
5763         xfer = len;
5764         if (nd->nd_repstat == 0) {
5765                 nd->nd_repstat = vn_copy_file_range(vp, &inoff, tovp, &outoff,
5766                     &xfer, COPY_FILE_RANGE_TIMEO1SEC, nd->nd_cred, nd->nd_cred,
5767                     NULL);
5768                 if (nd->nd_repstat == 0)
5769                         len = xfer;
5770         }
5771
5772         /* Unlock the ranges. */
5773         if (rl_rcookie != NULL)
5774                 vn_rangelock_unlock(vp, rl_rcookie);
5775         if (rl_wcookie != NULL)
5776                 vn_rangelock_unlock(tovp, rl_wcookie);
5777
5778         if (nd->nd_repstat == 0) {
5779                 NFSM_BUILD(tl, uint32_t *, 4 * NFSX_UNSIGNED + NFSX_HYPER +
5780                     NFSX_VERF);
5781                 *tl++ = txdr_unsigned(0);       /* No callback ids. */
5782                 txdr_hyper(len, tl); tl += 2;
5783                 *tl++ = txdr_unsigned(NFSWRITE_UNSTABLE);
5784                 *tl++ = txdr_unsigned(nfsboottime.tv_sec);
5785                 *tl++ = txdr_unsigned(nfsboottime.tv_usec);
5786                 *tl++ = newnfs_true;
5787                 *tl = newnfs_true;
5788         }
5789 out:
5790         vrele(vp);
5791         vrele(tovp);
5792         NFSEXITCODE2(error, nd);
5793         return (error);
5794 nfsmout:
5795         vput(vp);
5796         vrele(tovp);
5797         NFSEXITCODE2(error, nd);
5798         return (error);
5799 }
5800
5801 /*
5802  * nfs seek service
5803  */
5804 int
5805 nfsrvd_seek(struct nfsrv_descript *nd, __unused int isdgram,
5806     vnode_t vp, struct nfsexstuff *exp)
5807 {
5808         uint32_t *tl;
5809         struct nfsvattr at;
5810         int content, error = 0;
5811         off_t off;
5812         u_long cmd;
5813         nfsattrbit_t attrbits;
5814         bool eof;
5815
5816         NFSM_DISSECT(tl, uint32_t *, NFSX_STATEID + NFSX_HYPER + NFSX_UNSIGNED);
5817         /* Ignore the stateid for now. */
5818         tl += (NFSX_STATEID / NFSX_UNSIGNED);
5819         off = fxdr_hyper(tl); tl += 2;
5820         content = fxdr_unsigned(int, *tl);
5821         if (content == NFSV4CONTENT_DATA)
5822                 cmd = FIOSEEKDATA;
5823         else if (content == NFSV4CONTENT_HOLE)
5824                 cmd = FIOSEEKHOLE;
5825         else
5826                 nd->nd_repstat = NFSERR_BADXDR;
5827         if (nd->nd_repstat == 0 && vp->v_type == VDIR)
5828                 nd->nd_repstat = NFSERR_ISDIR;
5829         if (nd->nd_repstat == 0 && vp->v_type != VREG)
5830                 nd->nd_repstat = NFSERR_WRONGTYPE;
5831         if (nd->nd_repstat == 0 && off < 0)
5832                 nd->nd_repstat = NFSERR_NXIO;
5833         if (nd->nd_repstat == 0) {
5834                 /* Check permissions for the input file. */
5835                 NFSZERO_ATTRBIT(&attrbits);
5836                 NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_OWNER);
5837                 nd->nd_repstat = nfsvno_getattr(vp, &at, nd, curthread, 1,
5838                     &attrbits);
5839         }
5840         if (nd->nd_repstat == 0 && (at.na_uid != nd->nd_cred->cr_uid ||
5841              NFSVNO_EXSTRICTACCESS(exp)))
5842                 nd->nd_repstat = nfsvno_accchk(vp, VREAD, nd->nd_cred, exp,
5843                     curthread, NFSACCCHK_ALLOWOWNER, NFSACCCHK_VPISLOCKED,
5844                     NULL);
5845         if (nd->nd_repstat != 0)
5846                 goto nfsmout;
5847
5848         /* nfsvno_seek() unlocks and vrele()s the vp. */
5849         nd->nd_repstat = nfsvno_seek(nd, vp, cmd, &off, content, &eof,
5850             nd->nd_cred, curthread);
5851         if (nd->nd_repstat == 0 && eof && content == NFSV4CONTENT_DATA &&
5852             nfsrv_linux42server != 0)
5853                 nd->nd_repstat = NFSERR_NXIO;
5854         if (nd->nd_repstat == 0) {
5855                 NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED + NFSX_HYPER);
5856                 if (eof)
5857                         *tl++ = newnfs_true;
5858                 else
5859                         *tl++ = newnfs_false;
5860                 txdr_hyper(off, tl);
5861         }
5862         NFSEXITCODE2(error, nd);
5863         return (error);
5864 nfsmout:
5865         vput(vp);
5866         NFSEXITCODE2(error, nd);
5867         return (error);
5868 }
5869
5870 /*
5871  * nfs get extended attribute service
5872  */
5873 int
5874 nfsrvd_getxattr(struct nfsrv_descript *nd, __unused int isdgram,
5875     vnode_t vp, __unused struct nfsexstuff *exp)
5876 {
5877         uint32_t *tl;
5878         struct mbuf *mp = NULL, *mpend = NULL;
5879         int error, len;
5880         char *name;
5881         struct thread *p = curthread;
5882         uint16_t off;
5883
5884         error = 0;
5885         NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
5886         len = fxdr_unsigned(int, *tl);
5887         if (len <= 0) {
5888                 nd->nd_repstat = NFSERR_BADXDR;
5889                 goto nfsmout;
5890         }
5891         if (len > EXTATTR_MAXNAMELEN) {
5892                 nd->nd_repstat = NFSERR_NOXATTR;
5893                 goto nfsmout;
5894         }
5895         name = malloc(len + 1, M_TEMP, M_WAITOK);
5896         nd->nd_repstat = nfsrv_mtostr(nd, name, len);
5897         if (nd->nd_repstat == 0)
5898                 nd->nd_repstat = nfsvno_getxattr(vp, name,
5899                     nd->nd_maxresp, nd->nd_cred, nd->nd_flag,
5900                     nd->nd_maxextsiz, p, &mp, &mpend, &len);
5901         if (nd->nd_repstat == ENOATTR)
5902                 nd->nd_repstat = NFSERR_NOXATTR;
5903         else if (nd->nd_repstat == EOPNOTSUPP)
5904                 nd->nd_repstat = NFSERR_NOTSUPP;
5905         if (nd->nd_repstat == 0) {
5906                 NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
5907                 *tl = txdr_unsigned(len);
5908                 if (len > 0) {
5909                         nd->nd_mb->m_next = mp;
5910                         nd->nd_mb = mpend;
5911                         if ((mpend->m_flags & M_EXTPG) != 0) {
5912                                 nd->nd_flag |= ND_EXTPG;
5913                                 nd->nd_bextpg = mpend->m_epg_npgs - 1;
5914                                 nd->nd_bpos = (char *)(void *)
5915                                    PHYS_TO_DMAP(mpend->m_epg_pa[nd->nd_bextpg]);
5916                                 off = (nd->nd_bextpg == 0) ?
5917                                     mpend->m_epg_1st_off : 0;
5918                                 nd->nd_bpos += off + mpend->m_epg_last_len;
5919                                 nd->nd_bextpgsiz = PAGE_SIZE -
5920                                     mpend->m_epg_last_len - off;
5921                         } else
5922                                 nd->nd_bpos = mtod(mpend, char *) +
5923                                     mpend->m_len;
5924                 }
5925         }
5926         free(name, M_TEMP);
5927
5928 nfsmout:
5929         if (nd->nd_repstat == 0)
5930                 nd->nd_repstat = error;
5931         vput(vp);
5932         NFSEXITCODE2(0, nd);
5933         return (0);
5934 }
5935
5936 /*
5937  * nfs set extended attribute service
5938  */
5939 int
5940 nfsrvd_setxattr(struct nfsrv_descript *nd, __unused int isdgram,
5941     vnode_t vp, __unused struct nfsexstuff *exp)
5942 {
5943         uint32_t *tl;
5944         struct nfsvattr ova, nva;
5945         nfsattrbit_t attrbits;
5946         int error, len, opt;
5947         char *name;
5948         size_t siz;
5949         struct thread *p = curthread;
5950
5951         error = 0;
5952         name = NULL;
5953         NFSM_DISSECT(tl, uint32_t *, 2 * NFSX_UNSIGNED);
5954         opt = fxdr_unsigned(int, *tl++);
5955         len = fxdr_unsigned(int, *tl);
5956         if (len <= 0) {
5957                 nd->nd_repstat = NFSERR_BADXDR;
5958                 goto nfsmout;
5959         }
5960         if (len > EXTATTR_MAXNAMELEN) {
5961                 nd->nd_repstat = NFSERR_NOXATTR;
5962                 goto nfsmout;
5963         }
5964         name = malloc(len + 1, M_TEMP, M_WAITOK);
5965         error = nfsrv_mtostr(nd, name, len);
5966         if (error != 0)
5967                 goto nfsmout;
5968         NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
5969         len = fxdr_unsigned(int, *tl);
5970         if (len < 0 || len > IOSIZE_MAX) {
5971                 nd->nd_repstat = NFSERR_XATTR2BIG;
5972                 goto nfsmout;
5973         }
5974         switch (opt) {
5975         case NFSV4SXATTR_CREATE:
5976                 error = VOP_GETEXTATTR(vp, EXTATTR_NAMESPACE_USER, name, NULL,
5977                     &siz, nd->nd_cred, p);
5978                 if (error != ENOATTR)
5979                         nd->nd_repstat = NFSERR_EXIST;
5980                 error = 0;
5981                 break;
5982         case NFSV4SXATTR_REPLACE:
5983                 error = VOP_GETEXTATTR(vp, EXTATTR_NAMESPACE_USER, name, NULL,
5984                     &siz, nd->nd_cred, p);
5985                 if (error != 0)
5986                         nd->nd_repstat = NFSERR_NOXATTR;
5987                 break;
5988         case NFSV4SXATTR_EITHER:
5989                 break;
5990         default:
5991                 nd->nd_repstat = NFSERR_BADXDR;
5992         }
5993         if (nd->nd_repstat != 0)
5994                 goto nfsmout;
5995
5996         /* Now, do the Set Extended attribute, with Change before and after. */
5997         NFSZERO_ATTRBIT(&attrbits);
5998         NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_CHANGE);
5999         nd->nd_repstat = nfsvno_getattr(vp, &ova, nd, p, 1, &attrbits);
6000         if (nd->nd_repstat == 0) {
6001                 nd->nd_repstat = nfsvno_setxattr(vp, name, len, nd->nd_md,
6002                     nd->nd_dpos, nd->nd_cred, p);
6003                 if (nd->nd_repstat == ENXIO)
6004                         nd->nd_repstat = NFSERR_XATTR2BIG;
6005         }
6006         if (nd->nd_repstat == 0 && len > 0)
6007                 nd->nd_repstat = nfsm_advance(nd, NFSM_RNDUP(len), -1);
6008         if (nd->nd_repstat == 0)
6009                 nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1, &attrbits);
6010         if (nd->nd_repstat == 0) {
6011                 NFSM_BUILD(tl, uint32_t *, 2 * NFSX_HYPER + NFSX_UNSIGNED);
6012                 *tl++ = newnfs_true;
6013                 txdr_hyper(ova.na_filerev, tl); tl += 2;
6014                 txdr_hyper(nva.na_filerev, tl);
6015         }
6016
6017 nfsmout:
6018         free(name, M_TEMP);
6019         if (nd->nd_repstat == 0)
6020                 nd->nd_repstat = error;
6021         vput(vp);
6022         NFSEXITCODE2(0, nd);
6023         return (0);
6024 }
6025
6026 /*
6027  * nfs remove extended attribute service
6028  */
6029 int
6030 nfsrvd_rmxattr(struct nfsrv_descript *nd, __unused int isdgram,
6031     vnode_t vp, __unused struct nfsexstuff *exp)
6032 {
6033         uint32_t *tl;
6034         struct nfsvattr ova, nva;
6035         nfsattrbit_t attrbits;
6036         int error, len;
6037         char *name;
6038         struct thread *p = curthread;
6039
6040         error = 0;
6041         name = NULL;
6042         NFSM_DISSECT(tl, uint32_t *, NFSX_UNSIGNED);
6043         len = fxdr_unsigned(int, *tl);
6044         if (len <= 0) {
6045                 nd->nd_repstat = NFSERR_BADXDR;
6046                 goto nfsmout;
6047         }
6048         if (len > EXTATTR_MAXNAMELEN) {
6049                 nd->nd_repstat = NFSERR_NOXATTR;
6050                 goto nfsmout;
6051         }
6052         name = malloc(len + 1, M_TEMP, M_WAITOK);
6053         error = nfsrv_mtostr(nd, name, len);
6054         if (error != 0)
6055                 goto nfsmout;
6056
6057         if ((nd->nd_flag & ND_IMPLIEDCLID) == 0) {
6058                 printf("EEK! nfsrvd_rmxattr: no implied clientid\n");
6059                 error = NFSERR_NOXATTR;
6060                 goto nfsmout;
6061         }
6062         /*
6063          * Now, do the Remove Extended attribute, with Change before and
6064          * after.
6065         */
6066         NFSZERO_ATTRBIT(&attrbits);
6067         NFSSETBIT_ATTRBIT(&attrbits, NFSATTRBIT_CHANGE);
6068         nd->nd_repstat = nfsvno_getattr(vp, &ova, nd, p, 1, &attrbits);
6069         if (nd->nd_repstat == 0) {
6070                 nd->nd_repstat = nfsvno_rmxattr(nd, vp, name, nd->nd_cred, p);
6071                 if (nd->nd_repstat == ENOATTR)
6072                         nd->nd_repstat = NFSERR_NOXATTR;
6073         }
6074         if (nd->nd_repstat == 0)
6075                 nd->nd_repstat = nfsvno_getattr(vp, &nva, nd, p, 1, &attrbits);
6076         if (nd->nd_repstat == 0) {
6077                 NFSM_BUILD(tl, uint32_t *, 2 * NFSX_HYPER + NFSX_UNSIGNED);
6078                 *tl++ = newnfs_true;
6079                 txdr_hyper(ova.na_filerev, tl); tl += 2;
6080                 txdr_hyper(nva.na_filerev, tl);
6081         }
6082
6083 nfsmout:
6084         free(name, M_TEMP);
6085         if (nd->nd_repstat == 0)
6086                 nd->nd_repstat = error;
6087         vput(vp);
6088         NFSEXITCODE2(0, nd);
6089         return (0);
6090 }
6091
6092 /*
6093  * nfs list extended attribute service
6094  */
6095 int
6096 nfsrvd_listxattr(struct nfsrv_descript *nd, __unused int isdgram,
6097     vnode_t vp, __unused struct nfsexstuff *exp)
6098 {
6099         uint32_t cnt, *tl, len, len2, i, pos, retlen;
6100         int error;
6101         uint64_t cookie, cookie2;
6102         u_char *buf;
6103         bool eof;
6104         struct thread *p = curthread;
6105
6106         error = 0;
6107         buf = NULL;
6108         NFSM_DISSECT(tl, uint32_t *, NFSX_HYPER + NFSX_UNSIGNED);
6109         /*
6110          * The cookie doesn't need to be in net byte order, but FreeBSD
6111          * does so to make it more readable in packet traces.
6112          */
6113         cookie = fxdr_hyper(tl); tl += 2;
6114         len = fxdr_unsigned(uint32_t, *tl);
6115         if (len == 0 || cookie >= IOSIZE_MAX) {
6116                 nd->nd_repstat = NFSERR_BADXDR;
6117                 goto nfsmout;
6118         }
6119         if (len > nd->nd_maxresp - NFS_MAXXDR)
6120                 len = nd->nd_maxresp - NFS_MAXXDR;
6121         len2 = len;
6122         nd->nd_repstat = nfsvno_listxattr(vp, cookie, nd->nd_cred, p, &buf,
6123             &len, &eof);
6124         if (nd->nd_repstat == EOPNOTSUPP)
6125                 nd->nd_repstat = NFSERR_NOTSUPP;
6126         if (nd->nd_repstat == 0) {
6127                 cookie2 = cookie + len;
6128                 if (cookie2 < cookie)
6129                         nd->nd_repstat = NFSERR_BADXDR;
6130         }
6131         retlen = NFSX_HYPER + 2 * NFSX_UNSIGNED;
6132         if (nd->nd_repstat == 0 && len2 < retlen)
6133                 nd->nd_repstat = NFSERR_TOOSMALL;
6134         if (nd->nd_repstat == 0) {
6135                 /* Now copy the entries out. */
6136                 if (len == 0) {
6137                         /* The cookie was at eof. */
6138                         NFSM_BUILD(tl, uint32_t *, NFSX_HYPER + 2 *
6139                             NFSX_UNSIGNED);
6140                         txdr_hyper(cookie2, tl); tl += 2;
6141                         *tl++ = txdr_unsigned(0);
6142                         *tl = newnfs_true;
6143                         goto nfsmout;
6144                 }
6145
6146                 /* Sanity check the cookie. */
6147                 for (pos = 0; pos < len; pos += (i + 1)) {
6148                         if (pos == cookie)
6149                                 break;
6150                         i = buf[pos];
6151                 }
6152                 if (pos != cookie) {
6153                         nd->nd_repstat = NFSERR_INVAL;
6154                         goto nfsmout;
6155                 }
6156
6157                 /* Loop around copying the entrie(s) out. */
6158                 cnt = 0;
6159                 len -= cookie;
6160                 i = buf[pos];
6161                 while (i < len && len2 >= retlen + NFSM_RNDUP(i) +
6162                     NFSX_UNSIGNED) {
6163                         if (cnt == 0) {
6164                                 NFSM_BUILD(tl, uint32_t *, NFSX_HYPER +
6165                                     NFSX_UNSIGNED);
6166                                 txdr_hyper(cookie2, tl); tl += 2;
6167                         }
6168                         retlen += nfsm_strtom(nd, &buf[pos + 1], i);
6169                         len -= (i + 1);
6170                         pos += (i + 1);
6171                         i = buf[pos];
6172                         cnt++;
6173                 }
6174                 /*
6175                  * eof is set true/false by nfsvno_listxattr(), but if we
6176                  * can't copy all entries returned by nfsvno_listxattr(),
6177                  * we are not at eof.
6178                  */
6179                 if (len > 0)
6180                         eof = false;
6181                 if (cnt > 0) {
6182                         /* *tl is set above. */
6183                         *tl = txdr_unsigned(cnt);
6184                         NFSM_BUILD(tl, uint32_t *, NFSX_UNSIGNED);
6185                         if (eof)
6186                                 *tl = newnfs_true;
6187                         else
6188                                 *tl = newnfs_false;
6189                 } else
6190                         nd->nd_repstat = NFSERR_TOOSMALL;
6191         }
6192
6193 nfsmout:
6194         free(buf, M_TEMP);
6195         if (nd->nd_repstat == 0)
6196                 nd->nd_repstat = error;
6197         vput(vp);
6198         NFSEXITCODE2(0, nd);
6199         return (0);
6200 }
6201
6202 /*
6203  * nfsv4 service not supported
6204  */
6205 int
6206 nfsrvd_notsupp(struct nfsrv_descript *nd, __unused int isdgram,
6207     __unused vnode_t vp, __unused struct nfsexstuff *exp)
6208 {
6209
6210         nd->nd_repstat = NFSERR_NOTSUPP;
6211         NFSEXITCODE2(0, nd);
6212         return (0);
6213 }