glusterfs.git/xlators/nfs/server/src/acl3.c, branch v3.6.0alpha1

rpcsvc: Validate RPC procedure number before fetch

2014-05-17T18:56:01+00:00

While accessing the procedures of given RPC program in,
rpcsvc_get_program_vector_sizer(), It was not checking boundary
conditions which would cause buffer overflow and subsequently SEGV.

Make sure rpcsvc_actor_t arrays have numactors number of actors.

FIX:
Validate the RPC procedure number before fetching the actor.

Special Thanks to: Murray Ketchion, Grant Byers

Change-Id: I8b5abd406d47fab8fca65b3beb73cdfe8cd85b72
BUG: 1096020
Signed-off-by: Santosh Kumar Pradhan 
Reviewed-on: http://review.gluster.org/7726
Tested-by: Gluster Build System 
Reviewed-by: Rajesh Joseph 
Reviewed-by: Anand Avati

gNFS: Possible NULL pointer dereference

2014-02-07T16:43:59+00:00

In NFS-ACL code (acl3.c) i.e. acl3svc_setacl(), contol can
go to "acl3err" block from setaclargs.mask validation or
acl3_validate_gluster_fh() and acl3_map_fh_to_volume() macros.
But at this point of time "cs" is yet to be init'd (the macro
acl3_handle_call_state_init() is not yet invoked) which can
cause a NULL ptr deref.

FIX:
Refactor the acl3 code.

Coverity ID (CID): 1124491

Change-Id: I3aca38770e03ce59d1705653b6d8349e6cc153b2
BUG: 789278
Signed-off-by: Santosh Kumar Pradhan 
Reviewed-on: http://review.gluster.org/6890
Reviewed-by: Rajesh Joseph 
Reviewed-by: Niels de Vos 
Tested-by: Gluster Build System 
Reviewed-by: Vijay Bellur

gNFS: Server sets ACL mask wrongly in GETACL reply

2014-01-13T07:48:15+00:00

FIX:
1. Set the ACL mask what was requested by client
2. Validate the ACL mask in SETACL routine

Change-Id: Icb8576a8fe2684e0beaf94e8db6a92bc70bbfe7f
BUG: 1051865
Signed-off-by: Santosh Kumar Pradhan 
Reviewed-on: http://review.gluster.org/6683
Tested-by: Gluster Build System 
Reviewed-by: Vijay Bellur

gNFS: Client cache invalidation with bad fsid

2013-12-17T11:24:15+00:00

1. Problem:
Couple of issues are seen when NFS-ACL is turned ON. i.e.
i) NFS directory access is too slow, impacting customer workflows
   with ACL
ii)dbench fails with 100 directories.

2. Root cause: Frequent cache invalidation in the client side when ACL
is turned ON with NFS because NFS server getacl() code returns the
wrong fsid to the client.

3. This attr-cache invlaidation triggers the frequent LOOKUP ops for
each file instead of relying on the readdir or readdirp data. As
a result performance gets impacted.

4. In case of dbench workload, the problem is more severe. e.g.

Client side rpcdebug output:
===========================

Dec 16 10:16:53 santosh-3 kernel: NFS:
         nfs_update_inode(0:1b/12061953567282551806 ct=2 info=0x7e7f)
Dec 16 10:16:53 santosh-3 kernel: NFS:
         nfs_fhget(0:1b/12061953567282551806 ct=2)
Dec 16 10:16:53 santosh-3 kernel: <-- nfs_xdev_get_sb() = -116 [splat]
Dec 16 10:16:53 santosh-3 kernel: nfs_do_submount: done
Dec 16 10:16:53 santosh-3 kernel: <-- nfs_do_submount() = ffffffffffffff8c
Dec 16 10:16:53 santosh-3 kernel: <-- nfs_follow_mountpoint() = ffffffffffffff8c
Dec 16 10:16:53 santosh-3 kernel: NFS: dentry_delete(clients/client77, 20008)

As per Jeff Layton, This occurs when the client detects that the fsid on
a filehandle is different from its parent. At that point, it tries to
do a new submount of the new filesystem onto the correct point. It means
client got a superblock reference for the new fs and is now looking to set
up the root of the mount. It calls nfs_get_root to do that, which basically
takes the superblock and a filehandle and returns a dentry.  The problem
here is that the dentry->d_inode you're getting back looks wrong. It's not
a directory as expected -- it's something else. So the client gives up and
tosses back an ESTALE.

Which clearly says that, In getacl() code while it does the stat() call
to get the attrs, it forgets to populate the deviceid or fsid before
going ahead and does getxattr().

FIX:
1. Fill the deviceid in iatt.
2. Do bit more clean up for the confusing part of the code.

NB: Many many thanks to Niels de Vos and Jeff Layton for their
help to debug the issue.

Change-Id: I8d3c2a844c9d1761051a883b5ebaeb84062a11c8
BUG: 1043737
Signed-off-by: Santosh Kumar Pradhan 
Reviewed-on: http://review.gluster.org/6523
Reviewed-by: Rajesh Joseph 
Reviewed-by: Niels de Vos 
Tested-by: Gluster Build System 
Reviewed-by: Vijay Bellur

gNFS: Inconsistent behaviour of setfacl/getfacl

2013-12-03T23:22:03+00:00

The permissions returned by NFS ACL are wrong, which are rejected
by NFS client as "Invalid argument". Refactor the NFS ACL code
to return the proper permissions which would match with the
requested permissions.

Change-Id: I409a6600538a90f2c5c2e8d84657c3b508468fe6
BUG: 1035218
Signed-off-by: Santosh Kumar Pradhan 
Reviewed-on: http://review.gluster.org/6368
Tested-by: Gluster Build System 
Reviewed-by: Anand Avati

gNFS: More clean up for Gluster NFS

2013-11-25T13:40:57+00:00

1) Fix the typo in NFS default ACL
   The typo was introduced as part of the Fix to BZ 1009210 i.e.
   http://review.gluster.org/5980. The user ACL xattr structure
   was passed to default ACL xattr.

2) Clean up NFS code to avoid unnecessary SEGV in
   rpcsvc_drc_reconfigure() which was not validating the
   svc->drc. Add a routine rpcsvc_drc_deinit() to handle
   the clean up of DRC specific data structures. For init(),
   use rpcsvc_drc_init().

3) nfs_init_state() was returning wrong value even if the
   registration with portmapper failed, causing the NFS
   server process to hang around. As a result it used to
   get SEGV during rpcsvc_drc_reconfigure().

4) Clean up memfactor usage across nfs.c nfs3.c.

Change-Id: I5cea26cb68dd8a822ec0ae104952f67fe63fa703
BUG: 1009210
Signed-off-by: Santosh Kumar Pradhan 
Reviewed-on: http://review.gluster.org/6329
Reviewed-by: Rajesh Joseph 
Tested-by: Gluster Build System 
Reviewed-by: Vijay Bellur

gNFS: RFE for NFS connection behavior

2013-11-15T00:07:02+00:00

Implement reconfigure() for NFS xlator so that volume set/reset wont
restart the NFS server process. But few options can not be reconfigured
dynamically e.g. nfs.mem-factor, nfs.port etc which needs NFS to be
restarted.

Change-Id: Ic586fd55b7933c0a3175708d8c41ed0475d74a1c
BUG: 1027409
Signed-off-by: Santosh Kumar Pradhan 
Reviewed-on: http://review.gluster.org/6236
Tested-by: Gluster Build System 
Reviewed-by: Rajesh Joseph 
Reviewed-by: Anand Avati

NFS: showmount timesout on fetching export list

2013-10-05T03:15:41+00:00

Bug: 1015184

Issue:  showmount timesout on fetching export list. Socket writev
        function is failing.
Cause:  XDR encoding of export list is failing. The calling function
        without checking the error returned by xdr_serialize_exports
        function is going ahead and writting into the socket causing
        the NFS process to hang. xdr_serialize_exports function returns
        -1 on error and message length on success.
Fix:    Caller should check if the function is returning -1 (error) or
        not before proceeding.

Change-Id: Ic3a5a9356e47b2ac938dd3e429cf2b71c0a0c715
Signed-off-by: Rajesh Joseph 
Reviewed-on: http://review.gluster.org/6030
Reviewed-by: Santosh Pradhan 
Reviewed-by: Niels de Vos 
Tested-by: Gluster Build System 
Reviewed-by: Anand Avati

gNFS: Incorrect NFS ACL encoding for XFS

2013-09-29T23:54:37+00:00

Problem:
Incorrect NFS ACL encoding causes "system.posix_acl_default"
setxattr failure on bricks on XFS file system. XFS (potentially
others?) doesn't understand when the 0x10 prefix is added to the
ACL type field for default ACLs (which the Linux NFS client adds)
which causes setfacl()->setxattr() to fail silently. NFS client
adds NFS_ACL_DEFAULT(0x1000) for default ACL.

FIX:
Mask the prefix (added by NFS client) OFF, so the setfacl is not
rejected when it hits the FS.

Original patch by: "Richard Wareing"

Change-Id: I17ad27d84f030cdea8396eb667ee031f0d41b396
BUG: 1009210
Signed-off-by: Santosh Kumar Pradhan 
Reviewed-on: http://review.gluster.org/5980
Reviewed-by: Amar Tumballi 
Tested-by: Gluster Build System 
Reviewed-by: Anand Avati

NFS : Coverity Fix.

2013-09-19T16:24:15+00:00

NFS defects reported by  Coverity run are fixed.

Change-Id: Ib66847e8e66fb4a06b312c80814f9eafb032eba2
BUG: 996390
Signed-off-by: meghana 
Reviewed-on: http://review.gluster.org/5660
Tested-by: Gluster Build System 
Reviewed-by: Varun Shastry 
Reviewed-by: Kaleb KEITHLEY