xref: /titanic_50/usr/src/uts/common/fs/nfs/nfs_auth.c (revision a17a5e65058ed50cff40dd709c1660abe3664f5d)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2015 Nexenta Systems, Inc.  All rights reserved.
24  * Copyright (c) 1995, 2010, Oracle and/or its affiliates. All rights reserved.
25  */
26 
27 #include <sys/param.h>
28 #include <sys/errno.h>
29 #include <sys/vfs.h>
30 #include <sys/vnode.h>
31 #include <sys/cred.h>
32 #include <sys/cmn_err.h>
33 #include <sys/systm.h>
34 #include <sys/kmem.h>
35 #include <sys/pathname.h>
36 #include <sys/utsname.h>
37 #include <sys/debug.h>
38 #include <sys/door.h>
39 #include <sys/sdt.h>
40 #include <sys/thread.h>
41 #include <sys/avl.h>
42 
43 #include <rpc/types.h>
44 #include <rpc/auth.h>
45 #include <rpc/clnt.h>
46 
47 #include <nfs/nfs.h>
48 #include <nfs/export.h>
49 #include <nfs/nfs_clnt.h>
50 #include <nfs/auth.h>
51 
52 static struct kmem_cache *exi_cache_handle;
53 static void exi_cache_reclaim(void *);
54 static void exi_cache_trim(struct exportinfo *exi);
55 
56 extern pri_t minclsyspri;
57 
58 volatile uint_t nfsauth_cache_hit;
59 volatile uint_t nfsauth_cache_miss;
60 volatile uint_t nfsauth_cache_refresh;
61 volatile uint_t nfsauth_cache_reclaim;
62 
63 /*
64  * The lifetime of an auth cache entry:
65  * ------------------------------------
66  *
67  * An auth cache entry is created with both the auth_time
68  * and auth_freshness times set to the current time.
69  *
70  * Upon every client access which results in a hit, the
71  * auth_time will be updated.
72  *
73  * If a client access determines that the auth_freshness
74  * indicates that the entry is STALE, then it will be
75  * refreshed. Note that this will explicitly reset
76  * auth_time.
77  *
78  * When the REFRESH successfully occurs, then the
79  * auth_freshness is updated.
80  *
81  * There are two ways for an entry to leave the cache:
82  *
83  * 1) Purged by an action on the export (remove or changed)
84  * 2) Memory backpressure from the kernel (check against NFSAUTH_CACHE_TRIM)
85  *
86  * For 2) we check the timeout value against auth_time.
87  */
88 
89 /*
90  * Number of seconds until we mark for refresh an auth cache entry.
91  */
92 #define	NFSAUTH_CACHE_REFRESH 600
93 
94 /*
95  * Number of idle seconds until we yield to backpressure
96  * to trim a cache entry.
97  */
98 #define	NFSAUTH_CACHE_TRIM 3600
99 
100 /*
101  * While we could encapuslate the exi_list inside the
102  * exi structure, we can't do that for the auth_list.
103  * So, to keep things looking clean, we keep them both
104  * in these external lists.
105  */
106 typedef struct refreshq_exi_node {
107 	struct exportinfo	*ren_exi;
108 	list_t			ren_authlist;
109 	list_node_t		ren_node;
110 } refreshq_exi_node_t;
111 
112 typedef struct refreshq_auth_node {
113 	struct auth_cache	*ran_auth;
114 	char			*ran_netid;
115 	list_node_t		ran_node;
116 } refreshq_auth_node_t;
117 
118 /*
119  * Used to manipulate things on the refreshq_queue.
120  * Note that the refresh thread will effectively
121  * pop a node off of the queue, at which point it
122  * will no longer need to hold the mutex.
123  */
124 static kmutex_t refreshq_lock;
125 static list_t refreshq_queue;
126 static kcondvar_t refreshq_cv;
127 
128 /*
129  * If there is ever a problem with loading the
130  * module, then nfsauth_fini() needs to be called
131  * to remove state. In that event, since the
132  * refreshq thread has been started, they need to
133  * work together to get rid of state.
134  */
135 typedef enum nfsauth_refreshq_thread_state {
136 	REFRESHQ_THREAD_RUNNING,
137 	REFRESHQ_THREAD_FINI_REQ,
138 	REFRESHQ_THREAD_HALTED
139 } nfsauth_refreshq_thread_state_t;
140 
141 nfsauth_refreshq_thread_state_t
142 refreshq_thread_state = REFRESHQ_THREAD_HALTED;
143 
144 static void nfsauth_free_node(struct auth_cache *);
145 static void nfsauth_refresh_thread(void);
146 
147 static int nfsauth_cache_compar(const void *, const void *);
148 
149 /*
150  * mountd is a server-side only daemon. This will need to be
151  * revisited if the NFS server is ever made zones-aware.
152  */
153 kmutex_t	mountd_lock;
154 door_handle_t   mountd_dh;
155 
156 void
157 mountd_args(uint_t did)
158 {
159 	mutex_enter(&mountd_lock);
160 	if (mountd_dh != NULL)
161 		door_ki_rele(mountd_dh);
162 	mountd_dh = door_ki_lookup(did);
163 	mutex_exit(&mountd_lock);
164 }
165 
166 void
167 nfsauth_init(void)
168 {
169 	/*
170 	 * mountd can be restarted by smf(5). We need to make sure
171 	 * the updated door handle will safely make it to mountd_dh
172 	 */
173 	mutex_init(&mountd_lock, NULL, MUTEX_DEFAULT, NULL);
174 
175 	mutex_init(&refreshq_lock, NULL, MUTEX_DEFAULT, NULL);
176 	list_create(&refreshq_queue, sizeof (refreshq_exi_node_t),
177 	    offsetof(refreshq_exi_node_t, ren_node));
178 
179 	cv_init(&refreshq_cv, NULL, CV_DEFAULT, NULL);
180 
181 	/*
182 	 * Allocate nfsauth cache handle
183 	 */
184 	exi_cache_handle = kmem_cache_create("exi_cache_handle",
185 	    sizeof (struct auth_cache), 0, NULL, NULL,
186 	    exi_cache_reclaim, NULL, NULL, 0);
187 
188 	refreshq_thread_state = REFRESHQ_THREAD_RUNNING;
189 	(void) zthread_create(NULL, 0, nfsauth_refresh_thread,
190 	    NULL, 0, minclsyspri);
191 }
192 
193 /*
194  * Finalization routine for nfsauth. It is important to call this routine
195  * before destroying the exported_lock.
196  */
197 void
198 nfsauth_fini(void)
199 {
200 	refreshq_exi_node_t	*ren;
201 
202 	/*
203 	 * Prevent the nfsauth_refresh_thread from getting new
204 	 * work.
205 	 */
206 	mutex_enter(&refreshq_lock);
207 	if (refreshq_thread_state != REFRESHQ_THREAD_HALTED) {
208 		refreshq_thread_state = REFRESHQ_THREAD_FINI_REQ;
209 		cv_broadcast(&refreshq_cv);
210 
211 		/*
212 		 * Also, wait for nfsauth_refresh_thread() to exit.
213 		 */
214 		while (refreshq_thread_state != REFRESHQ_THREAD_HALTED) {
215 			cv_wait(&refreshq_cv, &refreshq_lock);
216 		}
217 	}
218 	mutex_exit(&refreshq_lock);
219 
220 	/*
221 	 * Walk the exi_list and in turn, walk the auth_lists and free all
222 	 * lists.  In addition, free INVALID auth_cache entries.
223 	 */
224 	while ((ren = list_remove_head(&refreshq_queue))) {
225 		refreshq_auth_node_t *ran;
226 
227 		while ((ran = list_remove_head(&ren->ren_authlist)) != NULL) {
228 			struct auth_cache *p = ran->ran_auth;
229 			if (p->auth_state == NFS_AUTH_INVALID)
230 				nfsauth_free_node(p);
231 			strfree(ran->ran_netid);
232 			kmem_free(ran, sizeof (refreshq_auth_node_t));
233 		}
234 
235 		list_destroy(&ren->ren_authlist);
236 		exi_rele(ren->ren_exi);
237 		kmem_free(ren, sizeof (refreshq_exi_node_t));
238 	}
239 	list_destroy(&refreshq_queue);
240 
241 	cv_destroy(&refreshq_cv);
242 	mutex_destroy(&refreshq_lock);
243 
244 	mutex_destroy(&mountd_lock);
245 
246 	/*
247 	 * Deallocate nfsauth cache handle
248 	 */
249 	kmem_cache_destroy(exi_cache_handle);
250 }
251 
252 /*
253  * Convert the address in a netbuf to
254  * a hash index for the auth_cache table.
255  */
256 static int
257 hash(struct netbuf *a)
258 {
259 	int i, h = 0;
260 
261 	for (i = 0; i < a->len; i++)
262 		h ^= a->buf[i];
263 
264 	return (h & (AUTH_TABLESIZE - 1));
265 }
266 
267 /*
268  * Mask out the components of an
269  * address that do not identify
270  * a host. For socket addresses the
271  * masking gets rid of the port number.
272  */
273 static void
274 addrmask(struct netbuf *addr, struct netbuf *mask)
275 {
276 	int i;
277 
278 	for (i = 0; i < addr->len; i++)
279 		addr->buf[i] &= mask->buf[i];
280 }
281 
282 /*
283  * nfsauth4_access is used for NFS V4 auth checking. Besides doing
284  * the common nfsauth_access(), it will check if the client can
285  * have a limited access to this vnode even if the security flavor
286  * used does not meet the policy.
287  */
288 int
289 nfsauth4_access(struct exportinfo *exi, vnode_t *vp, struct svc_req *req,
290     cred_t *cr, uid_t *uid, gid_t *gid, uint_t *ngids, gid_t **gids)
291 {
292 	int access;
293 
294 	rw_enter(&exported_lock, RW_READER);
295 	access = nfsauth_access(exi, req, cr, uid, gid, ngids, gids);
296 	rw_exit(&exported_lock);
297 
298 	/*
299 	 * There are cases that the server needs to allow the client
300 	 * to have a limited view.
301 	 *
302 	 * e.g.
303 	 * /export is shared as "sec=sys,rw=dfs-test-4,sec=krb5,rw"
304 	 * /export/home is shared as "sec=sys,rw"
305 	 *
306 	 * When the client mounts /export with sec=sys, the client
307 	 * would get a limited view with RO access on /export to see
308 	 * "home" only because the client is allowed to access
309 	 * /export/home with auth_sys.
310 	 */
311 	if (access & NFSAUTH_DENIED || access & NFSAUTH_WRONGSEC) {
312 		/*
313 		 * Allow ro permission with LIMITED view if there is a
314 		 * sub-dir exported under vp.
315 		 */
316 		if (has_visible(exi, vp))
317 			return (NFSAUTH_LIMITED);
318 	}
319 
320 	return (access);
321 }
322 
323 static void
324 sys_log(const char *msg)
325 {
326 	static time_t	tstamp = 0;
327 	time_t		now;
328 
329 	/*
330 	 * msg is shown (at most) once per minute
331 	 */
332 	now = gethrestime_sec();
333 	if ((tstamp + 60) < now) {
334 		tstamp = now;
335 		cmn_err(CE_WARN, msg);
336 	}
337 }
338 
339 /*
340  * Callup to the mountd to get access information in the kernel.
341  */
342 static bool_t
343 nfsauth_retrieve(struct exportinfo *exi, char *req_netid, int flavor,
344     struct netbuf *addr, int *access, uid_t clnt_uid, gid_t clnt_gid,
345     uint_t clnt_gids_cnt, const gid_t *clnt_gids, uid_t *srv_uid,
346     gid_t *srv_gid, uint_t *srv_gids_cnt, gid_t **srv_gids)
347 {
348 	varg_t			  varg = {0};
349 	nfsauth_res_t		  res = {0};
350 	XDR			  xdrs;
351 	size_t			  absz;
352 	caddr_t			  abuf;
353 	int			  last = 0;
354 	door_arg_t		  da;
355 	door_info_t		  di;
356 	door_handle_t		  dh;
357 	uint_t			  ntries = 0;
358 
359 	/*
360 	 * No entry in the cache for this client/flavor
361 	 * so we need to call the nfsauth service in the
362 	 * mount daemon.
363 	 */
364 
365 	varg.vers = V_PROTO;
366 	varg.arg_u.arg.cmd = NFSAUTH_ACCESS;
367 	varg.arg_u.arg.areq.req_client.n_len = addr->len;
368 	varg.arg_u.arg.areq.req_client.n_bytes = addr->buf;
369 	varg.arg_u.arg.areq.req_netid = req_netid;
370 	varg.arg_u.arg.areq.req_path = exi->exi_export.ex_path;
371 	varg.arg_u.arg.areq.req_flavor = flavor;
372 	varg.arg_u.arg.areq.req_clnt_uid = clnt_uid;
373 	varg.arg_u.arg.areq.req_clnt_gid = clnt_gid;
374 	varg.arg_u.arg.areq.req_clnt_gids.len = clnt_gids_cnt;
375 	varg.arg_u.arg.areq.req_clnt_gids.val = (gid_t *)clnt_gids;
376 
377 	DTRACE_PROBE1(nfsserv__func__nfsauth__varg, varg_t *, &varg);
378 
379 	/*
380 	 * Setup the XDR stream for encoding the arguments. Notice that
381 	 * in addition to the args having variable fields (req_netid and
382 	 * req_path), the argument data structure is itself versioned,
383 	 * so we need to make sure we can size the arguments buffer
384 	 * appropriately to encode all the args. If we can't get sizing
385 	 * info _or_ properly encode the arguments, there's really no
386 	 * point in continuting, so we fail the request.
387 	 */
388 	if ((absz = xdr_sizeof(xdr_varg, &varg)) == 0) {
389 		*access = NFSAUTH_DENIED;
390 		return (FALSE);
391 	}
392 
393 	abuf = (caddr_t)kmem_alloc(absz, KM_SLEEP);
394 	xdrmem_create(&xdrs, abuf, absz, XDR_ENCODE);
395 	if (!xdr_varg(&xdrs, &varg)) {
396 		XDR_DESTROY(&xdrs);
397 		goto fail;
398 	}
399 	XDR_DESTROY(&xdrs);
400 
401 	/*
402 	 * Prepare the door arguments
403 	 *
404 	 * We don't know the size of the message the daemon
405 	 * will pass back to us.  By setting rbuf to NULL,
406 	 * we force the door code to allocate a buf of the
407 	 * appropriate size.  We must set rsize > 0, however,
408 	 * else the door code acts as if no response was
409 	 * expected and doesn't pass the data to us.
410 	 */
411 	da.data_ptr = (char *)abuf;
412 	da.data_size = absz;
413 	da.desc_ptr = NULL;
414 	da.desc_num = 0;
415 	da.rbuf = NULL;
416 	da.rsize = 1;
417 
418 retry:
419 	mutex_enter(&mountd_lock);
420 	dh = mountd_dh;
421 	if (dh != NULL)
422 		door_ki_hold(dh);
423 	mutex_exit(&mountd_lock);
424 
425 	if (dh == NULL) {
426 		/*
427 		 * The rendezvous point has not been established yet!
428 		 * This could mean that either mountd(1m) has not yet
429 		 * been started or that _this_ routine nuked the door
430 		 * handle after receiving an EINTR for a REVOKED door.
431 		 *
432 		 * Returning NFSAUTH_DROP will cause the NFS client
433 		 * to retransmit the request, so let's try to be more
434 		 * rescillient and attempt for ntries before we bail.
435 		 */
436 		if (++ntries % NFSAUTH_DR_TRYCNT) {
437 			delay(hz);
438 			goto retry;
439 		}
440 
441 		kmem_free(abuf, absz);
442 
443 		sys_log("nfsauth: mountd has not established door");
444 		*access = NFSAUTH_DROP;
445 		return (FALSE);
446 	}
447 
448 	ntries = 0;
449 
450 	/*
451 	 * Now that we've got what we need, place the call.
452 	 */
453 	switch (door_ki_upcall_limited(dh, &da, NULL, SIZE_MAX, 0)) {
454 	case 0:				/* Success */
455 		door_ki_rele(dh);
456 
457 		if (da.data_ptr == NULL && da.data_size == 0) {
458 			/*
459 			 * The door_return that contained the data
460 			 * failed! We're here because of the 2nd
461 			 * door_return (w/o data) such that we can
462 			 * get control of the thread (and exit
463 			 * gracefully).
464 			 */
465 			DTRACE_PROBE1(nfsserv__func__nfsauth__door__nil,
466 			    door_arg_t *, &da);
467 			goto fail;
468 		}
469 
470 		break;
471 
472 	case EAGAIN:
473 		/*
474 		 * Server out of resources; back off for a bit
475 		 */
476 		door_ki_rele(dh);
477 		delay(hz);
478 		goto retry;
479 		/* NOTREACHED */
480 
481 	case EINTR:
482 		if (!door_ki_info(dh, &di)) {
483 			door_ki_rele(dh);
484 
485 			if (di.di_attributes & DOOR_REVOKED) {
486 				/*
487 				 * The server barfed and revoked
488 				 * the (existing) door on us; we
489 				 * want to wait to give smf(5) a
490 				 * chance to restart mountd(1m)
491 				 * and establish a new door handle.
492 				 */
493 				mutex_enter(&mountd_lock);
494 				if (dh == mountd_dh) {
495 					door_ki_rele(mountd_dh);
496 					mountd_dh = NULL;
497 				}
498 				mutex_exit(&mountd_lock);
499 				delay(hz);
500 				goto retry;
501 			}
502 			/*
503 			 * If the door was _not_ revoked on us,
504 			 * then more than likely we took an INTR,
505 			 * so we need to fail the operation.
506 			 */
507 			goto fail;
508 		}
509 		/*
510 		 * The only failure that can occur from getting
511 		 * the door info is EINVAL, so we let the code
512 		 * below handle it.
513 		 */
514 		/* FALLTHROUGH */
515 
516 	case EBADF:
517 	case EINVAL:
518 	default:
519 		/*
520 		 * If we have a stale door handle, give smf a last
521 		 * chance to start it by sleeping for a little bit.
522 		 * If we're still hosed, we'll fail the call.
523 		 *
524 		 * Since we're going to reacquire the door handle
525 		 * upon the retry, we opt to sleep for a bit and
526 		 * _not_ to clear mountd_dh. If mountd restarted
527 		 * and was able to set mountd_dh, we should see
528 		 * the new instance; if not, we won't get caught
529 		 * up in the retry/DELAY loop.
530 		 */
531 		door_ki_rele(dh);
532 		if (!last) {
533 			delay(hz);
534 			last++;
535 			goto retry;
536 		}
537 		sys_log("nfsauth: stale mountd door handle");
538 		goto fail;
539 	}
540 
541 	ASSERT(da.rbuf != NULL);
542 
543 	/*
544 	 * No door errors encountered; setup the XDR stream for decoding
545 	 * the results. If we fail to decode the results, we've got no
546 	 * other recourse than to fail the request.
547 	 */
548 	xdrmem_create(&xdrs, da.rbuf, da.rsize, XDR_DECODE);
549 	if (!xdr_nfsauth_res(&xdrs, &res)) {
550 		xdr_free(xdr_nfsauth_res, (char *)&res);
551 		XDR_DESTROY(&xdrs);
552 		kmem_free(da.rbuf, da.rsize);
553 		goto fail;
554 	}
555 	XDR_DESTROY(&xdrs);
556 	kmem_free(da.rbuf, da.rsize);
557 
558 	DTRACE_PROBE1(nfsserv__func__nfsauth__results, nfsauth_res_t *, &res);
559 	switch (res.stat) {
560 		case NFSAUTH_DR_OKAY:
561 			*access = res.ares.auth_perm;
562 			*srv_uid = res.ares.auth_srv_uid;
563 			*srv_gid = res.ares.auth_srv_gid;
564 			*srv_gids_cnt = res.ares.auth_srv_gids.len;
565 			*srv_gids = kmem_alloc(*srv_gids_cnt * sizeof (gid_t),
566 			    KM_SLEEP);
567 			bcopy(res.ares.auth_srv_gids.val, *srv_gids,
568 			    *srv_gids_cnt * sizeof (gid_t));
569 			break;
570 
571 		case NFSAUTH_DR_EFAIL:
572 		case NFSAUTH_DR_DECERR:
573 		case NFSAUTH_DR_BADCMD:
574 		default:
575 			xdr_free(xdr_nfsauth_res, (char *)&res);
576 fail:
577 			*access = NFSAUTH_DENIED;
578 			kmem_free(abuf, absz);
579 			return (FALSE);
580 			/* NOTREACHED */
581 	}
582 
583 	xdr_free(xdr_nfsauth_res, (char *)&res);
584 	kmem_free(abuf, absz);
585 
586 	return (TRUE);
587 }
588 
589 static void
590 nfsauth_refresh_thread(void)
591 {
592 	refreshq_exi_node_t	*ren;
593 	refreshq_auth_node_t	*ran;
594 
595 	struct exportinfo	*exi;
596 
597 	int			access;
598 	bool_t			retrieval;
599 
600 	callb_cpr_t		cprinfo;
601 
602 	CALLB_CPR_INIT(&cprinfo, &refreshq_lock, callb_generic_cpr,
603 	    "nfsauth_refresh");
604 
605 	for (;;) {
606 		mutex_enter(&refreshq_lock);
607 		if (refreshq_thread_state != REFRESHQ_THREAD_RUNNING) {
608 			/* Keep the hold on the lock! */
609 			break;
610 		}
611 
612 		ren = list_remove_head(&refreshq_queue);
613 		if (ren == NULL) {
614 			CALLB_CPR_SAFE_BEGIN(&cprinfo);
615 			cv_wait(&refreshq_cv, &refreshq_lock);
616 			CALLB_CPR_SAFE_END(&cprinfo, &refreshq_lock);
617 			mutex_exit(&refreshq_lock);
618 			continue;
619 		}
620 		mutex_exit(&refreshq_lock);
621 
622 		exi = ren->ren_exi;
623 		ASSERT(exi != NULL);
624 
625 		/*
626 		 * Since the ren was removed from the refreshq_queue above,
627 		 * this is the only thread aware about the ren existence, so we
628 		 * have the exclusive ownership of it and we do not need to
629 		 * protect it by any lock.
630 		 */
631 		while ((ran = list_remove_head(&ren->ren_authlist))) {
632 			uid_t uid;
633 			gid_t gid;
634 			uint_t ngids;
635 			gid_t *gids;
636 			struct auth_cache *p = ran->ran_auth;
637 			char *netid = ran->ran_netid;
638 
639 			ASSERT(p != NULL);
640 			ASSERT(netid != NULL);
641 
642 			kmem_free(ran, sizeof (refreshq_auth_node_t));
643 
644 			mutex_enter(&p->auth_lock);
645 
646 			/*
647 			 * Once the entry goes INVALID, it can not change
648 			 * state.
649 			 *
650 			 * No need to refresh entries also in a case we are
651 			 * just shutting down.
652 			 *
653 			 * In general, there is no need to hold the
654 			 * refreshq_lock to test the refreshq_thread_state.  We
655 			 * do hold it at other places because there is some
656 			 * related thread synchronization (or some other tasks)
657 			 * close to the refreshq_thread_state check.
658 			 *
659 			 * The check for the refreshq_thread_state value here
660 			 * is purely advisory to allow the faster
661 			 * nfsauth_refresh_thread() shutdown.  In a case we
662 			 * will miss such advisory, nothing catastrophic
663 			 * happens: we will just spin longer here before the
664 			 * shutdown.
665 			 */
666 			if (p->auth_state == NFS_AUTH_INVALID ||
667 			    refreshq_thread_state != REFRESHQ_THREAD_RUNNING) {
668 				mutex_exit(&p->auth_lock);
669 
670 				if (p->auth_state == NFS_AUTH_INVALID)
671 					nfsauth_free_node(p);
672 
673 				strfree(netid);
674 
675 				continue;
676 			}
677 
678 			/*
679 			 * Make sure the state is valid.  Note that once we
680 			 * change the state to NFS_AUTH_REFRESHING, no other
681 			 * thread will be able to work on this entry.
682 			 */
683 			ASSERT(p->auth_state == NFS_AUTH_STALE);
684 
685 			p->auth_state = NFS_AUTH_REFRESHING;
686 			mutex_exit(&p->auth_lock);
687 
688 			DTRACE_PROBE2(nfsauth__debug__cache__refresh,
689 			    struct exportinfo *, exi,
690 			    struct auth_cache *, p);
691 
692 			/*
693 			 * The first caching of the access rights
694 			 * is done with the netid pulled out of the
695 			 * request from the client. All subsequent
696 			 * users of the cache may or may not have
697 			 * the same netid. It doesn't matter. So
698 			 * when we refresh, we simply use the netid
699 			 * of the request which triggered the
700 			 * refresh attempt.
701 			 */
702 			retrieval = nfsauth_retrieve(exi, netid,
703 			    p->auth_flavor, &p->auth_clnt->authc_addr, &access,
704 			    p->auth_clnt_uid, p->auth_clnt_gid,
705 			    p->auth_clnt_ngids, p->auth_clnt_gids, &uid, &gid,
706 			    &ngids, &gids);
707 
708 			/*
709 			 * This can only be set in one other place
710 			 * and the state has to be NFS_AUTH_FRESH.
711 			 */
712 			strfree(netid);
713 
714 			mutex_enter(&p->auth_lock);
715 			if (p->auth_state == NFS_AUTH_INVALID) {
716 				mutex_exit(&p->auth_lock);
717 				nfsauth_free_node(p);
718 				if (retrieval == TRUE)
719 					kmem_free(gids, ngids * sizeof (gid_t));
720 			} else {
721 				/*
722 				 * If we got an error, do not reset the
723 				 * time. This will cause the next access
724 				 * check for the client to reschedule this
725 				 * node.
726 				 */
727 				if (retrieval == TRUE) {
728 					p->auth_access = access;
729 
730 					p->auth_srv_uid = uid;
731 					p->auth_srv_gid = gid;
732 					kmem_free(p->auth_srv_gids,
733 					    p->auth_srv_ngids * sizeof (gid_t));
734 					p->auth_srv_ngids = ngids;
735 					p->auth_srv_gids = gids;
736 
737 					p->auth_freshness = gethrestime_sec();
738 				}
739 				p->auth_state = NFS_AUTH_FRESH;
740 
741 				cv_broadcast(&p->auth_cv);
742 				mutex_exit(&p->auth_lock);
743 			}
744 		}
745 
746 		list_destroy(&ren->ren_authlist);
747 		exi_rele(ren->ren_exi);
748 		kmem_free(ren, sizeof (refreshq_exi_node_t));
749 	}
750 
751 	refreshq_thread_state = REFRESHQ_THREAD_HALTED;
752 	cv_broadcast(&refreshq_cv);
753 	CALLB_CPR_EXIT(&cprinfo);
754 	zthread_exit();
755 }
756 
757 int
758 nfsauth_cache_clnt_compar(const void *v1, const void *v2)
759 {
760 	int c;
761 
762 	const struct auth_cache_clnt *a1 = (const struct auth_cache_clnt *)v1;
763 	const struct auth_cache_clnt *a2 = (const struct auth_cache_clnt *)v2;
764 
765 	if (a1->authc_addr.len < a2->authc_addr.len)
766 		return (-1);
767 	if (a1->authc_addr.len > a2->authc_addr.len)
768 		return (1);
769 
770 	c = memcmp(a1->authc_addr.buf, a2->authc_addr.buf, a1->authc_addr.len);
771 	if (c < 0)
772 		return (-1);
773 	if (c > 0)
774 		return (1);
775 
776 	return (0);
777 }
778 
779 static int
780 nfsauth_cache_compar(const void *v1, const void *v2)
781 {
782 	const struct auth_cache *a1 = (const struct auth_cache *)v1;
783 	const struct auth_cache *a2 = (const struct auth_cache *)v2;
784 
785 	if (a1->auth_flavor < a2->auth_flavor)
786 		return (-1);
787 	if (a1->auth_flavor > a2->auth_flavor)
788 		return (1);
789 
790 	if (a1->auth_clnt_uid < a2->auth_clnt_uid)
791 		return (-1);
792 	if (a1->auth_clnt_uid > a2->auth_clnt_uid)
793 		return (1);
794 
795 	if (a1->auth_clnt_gid < a2->auth_clnt_gid)
796 		return (-1);
797 	if (a1->auth_clnt_gid > a2->auth_clnt_gid)
798 		return (1);
799 
800 	return (0);
801 }
802 
803 /*
804  * Get the access information from the cache or callup to the mountd
805  * to get and cache the access information in the kernel.
806  */
807 static int
808 nfsauth_cache_get(struct exportinfo *exi, struct svc_req *req, int flavor,
809     cred_t *cr, uid_t *uid, gid_t *gid, uint_t *ngids, gid_t **gids)
810 {
811 	struct netbuf		*taddrmask;
812 	struct netbuf		addr;	/* temporary copy of client's address */
813 	const struct netbuf	*claddr;
814 	avl_tree_t		*tree;
815 	struct auth_cache	ac;	/* used as a template for avl_find() */
816 	struct auth_cache_clnt	*c;
817 	struct auth_cache_clnt	acc;	/* used as a template for avl_find() */
818 	struct auth_cache	*p = NULL;
819 	int			access;
820 
821 	uid_t			tmpuid;
822 	gid_t			tmpgid;
823 	uint_t			tmpngids;
824 	gid_t			*tmpgids;
825 
826 	avl_index_t		where;	/* used for avl_find()/avl_insert() */
827 
828 	ASSERT(cr != NULL);
829 
830 	/*
831 	 * Now check whether this client already
832 	 * has an entry for this flavor in the cache
833 	 * for this export.
834 	 * Get the caller's address, mask off the
835 	 * parts of the address that do not identify
836 	 * the host (port number, etc), and then hash
837 	 * it to find the chain of cache entries.
838 	 */
839 
840 	claddr = svc_getrpccaller(req->rq_xprt);
841 	addr = *claddr;
842 	addr.buf = kmem_alloc(addr.maxlen, KM_SLEEP);
843 	bcopy(claddr->buf, addr.buf, claddr->len);
844 
845 	SVC_GETADDRMASK(req->rq_xprt, SVC_TATTR_ADDRMASK, (void **)&taddrmask);
846 	ASSERT(taddrmask != NULL);
847 	addrmask(&addr, taddrmask);
848 
849 	ac.auth_flavor = flavor;
850 	ac.auth_clnt_uid = crgetuid(cr);
851 	ac.auth_clnt_gid = crgetgid(cr);
852 
853 	acc.authc_addr = addr;
854 
855 	tree = exi->exi_cache[hash(&addr)];
856 
857 	rw_enter(&exi->exi_cache_lock, RW_READER);
858 	c = (struct auth_cache_clnt *)avl_find(tree, &acc, NULL);
859 
860 	if (c == NULL) {
861 		struct auth_cache_clnt *nc;
862 
863 		rw_exit(&exi->exi_cache_lock);
864 
865 		nc = kmem_alloc(sizeof (*nc), KM_NOSLEEP | KM_NORMALPRI);
866 		if (nc == NULL)
867 			goto retrieve;
868 
869 		/*
870 		 * Initialize the new auth_cache_clnt
871 		 */
872 		nc->authc_addr = addr;
873 		nc->authc_addr.buf = kmem_alloc(addr.maxlen,
874 		    KM_NOSLEEP | KM_NORMALPRI);
875 		if (addr.maxlen != 0 && nc->authc_addr.buf == NULL) {
876 			kmem_free(nc, sizeof (*nc));
877 			goto retrieve;
878 		}
879 		bcopy(addr.buf, nc->authc_addr.buf, addr.len);
880 		rw_init(&nc->authc_lock, NULL, RW_DEFAULT, NULL);
881 		avl_create(&nc->authc_tree, nfsauth_cache_compar,
882 		    sizeof (struct auth_cache),
883 		    offsetof(struct auth_cache, auth_link));
884 
885 		rw_enter(&exi->exi_cache_lock, RW_WRITER);
886 		c = (struct auth_cache_clnt *)avl_find(tree, &acc, &where);
887 		if (c == NULL) {
888 			avl_insert(tree, nc, where);
889 			rw_downgrade(&exi->exi_cache_lock);
890 			c = nc;
891 		} else {
892 			rw_downgrade(&exi->exi_cache_lock);
893 
894 			avl_destroy(&nc->authc_tree);
895 			rw_destroy(&nc->authc_lock);
896 			kmem_free(nc->authc_addr.buf, nc->authc_addr.maxlen);
897 			kmem_free(nc, sizeof (*nc));
898 		}
899 	}
900 
901 	ASSERT(c != NULL);
902 
903 	rw_enter(&c->authc_lock, RW_READER);
904 	p = (struct auth_cache *)avl_find(&c->authc_tree, &ac, NULL);
905 
906 	if (p == NULL) {
907 		struct auth_cache *np;
908 
909 		rw_exit(&c->authc_lock);
910 
911 		np = kmem_cache_alloc(exi_cache_handle,
912 		    KM_NOSLEEP | KM_NORMALPRI);
913 		if (np == NULL) {
914 			rw_exit(&exi->exi_cache_lock);
915 			goto retrieve;
916 		}
917 
918 		/*
919 		 * Initialize the new auth_cache
920 		 */
921 		np->auth_clnt = c;
922 		np->auth_flavor = flavor;
923 		np->auth_clnt_uid = crgetuid(cr);
924 		np->auth_clnt_gid = crgetgid(cr);
925 		np->auth_clnt_ngids = 0;
926 		np->auth_clnt_gids = NULL;
927 		np->auth_srv_ngids = 0;
928 		np->auth_srv_gids = NULL;
929 		np->auth_time = np->auth_freshness = gethrestime_sec();
930 		np->auth_state = NFS_AUTH_NEW;
931 		mutex_init(&np->auth_lock, NULL, MUTEX_DEFAULT, NULL);
932 		cv_init(&np->auth_cv, NULL, CV_DEFAULT, NULL);
933 
934 		rw_enter(&c->authc_lock, RW_WRITER);
935 		rw_exit(&exi->exi_cache_lock);
936 
937 		p = (struct auth_cache *)avl_find(&c->authc_tree, &ac, &where);
938 		if (p == NULL) {
939 			avl_insert(&c->authc_tree, np, where);
940 			rw_downgrade(&c->authc_lock);
941 			p = np;
942 		} else {
943 			rw_downgrade(&c->authc_lock);
944 
945 			cv_destroy(&np->auth_cv);
946 			mutex_destroy(&np->auth_lock);
947 			kmem_cache_free(exi_cache_handle, np);
948 		}
949 	} else {
950 		rw_exit(&exi->exi_cache_lock);
951 	}
952 
953 	mutex_enter(&p->auth_lock);
954 	rw_exit(&c->authc_lock);
955 
956 wait:
957 	/*
958 	 * If the entry is in the WAITING state then some other thread is just
959 	 * retrieving the required info.  The entry was either NEW, or the list
960 	 * of client's supplemental groups is going to be changed (either by
961 	 * this thread, or by some other thread).  We need to wait until the
962 	 * nfsauth_retrieve() is done.
963 	 */
964 	while (p->auth_state == NFS_AUTH_WAITING)
965 		cv_wait(&p->auth_cv, &p->auth_lock);
966 
967 	/*
968 	 * Here the entry cannot be in WAITING or INVALID state.
969 	 */
970 	ASSERT(p->auth_state != NFS_AUTH_WAITING);
971 	ASSERT(p->auth_state != NFS_AUTH_INVALID);
972 
973 	/*
974 	 * In a case the client's list of supplemental groups changed (or, the
975 	 * list is not initialized yet) we need to (re)allocate it and make
976 	 * sure the auth_cache entry is (re)retrieved.
977 	 */
978 	if (p->auth_clnt_ngids != crgetngroups(cr) ||
979 	    bcmp(p->auth_clnt_gids, crgetgroups(cr),
980 	    p->auth_clnt_ngids * sizeof (gid_t)) != 0) {
981 
982 		/*
983 		 * If the refresh thread is just working on this entry then
984 		 * wait for it so we do not modify the list of supplemental
985 		 * groups in the middle of its processing.
986 		 */
987 		if (p->auth_state == NFS_AUTH_REFRESHING) {
988 			p->auth_state = NFS_AUTH_WAITING;
989 			goto wait;
990 		}
991 
992 		/*
993 		 * We won't modify (and use) the STALE entries here since they
994 		 * are already in the refreshq_queue list.  Such entries will
995 		 * be updated later.
996 		 */
997 		if (p->auth_state == NFS_AUTH_STALE) {
998 			mutex_exit(&p->auth_lock);
999 
1000 			p = NULL;
1001 
1002 			goto retrieve;
1003 		}
1004 
1005 		p->auth_state = NFS_AUTH_NEW;
1006 
1007 		/*
1008 		 * If the number of supplemental groups differ, we need to
1009 		 * reallocate first.
1010 		 */
1011 		if (p->auth_clnt_ngids != crgetngroups(cr)) {
1012 			kmem_free(p->auth_clnt_gids,
1013 			    p->auth_clnt_ngids * sizeof (gid_t));
1014 
1015 			p->auth_clnt_ngids = crgetngroups(cr);
1016 			p->auth_clnt_gids = kmem_alloc(
1017 			    p->auth_clnt_ngids * sizeof (gid_t),
1018 			    KM_NOSLEEP | KM_NORMALPRI);
1019 
1020 			/*
1021 			 * If we failed to preallocate the memory for
1022 			 * supplemental groups, we won't cache the retrieved
1023 			 * data.
1024 			 */
1025 			if (p->auth_clnt_ngids != 0 &&
1026 			    p->auth_clnt_gids == NULL) {
1027 				p->auth_clnt_ngids = 0;
1028 				mutex_exit(&p->auth_lock);
1029 
1030 				p = NULL;
1031 
1032 				goto retrieve;
1033 			}
1034 		}
1035 
1036 		/*
1037 		 * Fill the client's supplemental groups.
1038 		 */
1039 		bcopy(crgetgroups(cr), p->auth_clnt_gids,
1040 		    p->auth_clnt_ngids * sizeof (gid_t));
1041 	}
1042 
1043 	/*
1044 	 * If the cache entry is not valid yet, we need to retrieve the
1045 	 * info ourselves.
1046 	 */
1047 	if (p->auth_state == NFS_AUTH_NEW) {
1048 		bool_t res;
1049 		/*
1050 		 * NFS_AUTH_NEW is the default output auth_state value in a
1051 		 * case we failed somewhere below.
1052 		 */
1053 		auth_state_t state = NFS_AUTH_NEW;
1054 
1055 		p->auth_state = NFS_AUTH_WAITING;
1056 		mutex_exit(&p->auth_lock);
1057 		kmem_free(addr.buf, addr.maxlen);
1058 		addr = p->auth_clnt->authc_addr;
1059 
1060 		atomic_inc_uint(&nfsauth_cache_miss);
1061 
1062 		res = nfsauth_retrieve(exi, svc_getnetid(req->rq_xprt), flavor,
1063 		    &addr, &access, crgetuid(cr), crgetgid(cr),
1064 		    crgetngroups(cr), crgetgroups(cr), &tmpuid, &tmpgid,
1065 		    &tmpngids, &tmpgids);
1066 
1067 		p->auth_access = access;
1068 		p->auth_time = p->auth_freshness = gethrestime_sec();
1069 
1070 		if (res == TRUE) {
1071 			if (uid != NULL)
1072 				*uid = tmpuid;
1073 			if (gid != NULL)
1074 				*gid = tmpgid;
1075 			if (ngids != NULL && gids != NULL) {
1076 				*ngids = tmpngids;
1077 				*gids = tmpgids;
1078 
1079 				/*
1080 				 * We need a copy of gids for the
1081 				 * auth_cache entry
1082 				 */
1083 				tmpgids = kmem_alloc(tmpngids * sizeof (gid_t),
1084 				    KM_NOSLEEP | KM_NORMALPRI);
1085 				if (tmpgids != NULL)
1086 					bcopy(*gids, tmpgids,
1087 					    tmpngids * sizeof (gid_t));
1088 			}
1089 
1090 			if (tmpgids != NULL || tmpngids == 0) {
1091 				p->auth_srv_uid = tmpuid;
1092 				p->auth_srv_gid = tmpgid;
1093 				p->auth_srv_ngids = tmpngids;
1094 				p->auth_srv_gids = tmpgids;
1095 
1096 				state = NFS_AUTH_FRESH;
1097 			}
1098 		}
1099 
1100 		/*
1101 		 * Set the auth_state and notify waiters.
1102 		 */
1103 		mutex_enter(&p->auth_lock);
1104 		p->auth_state = state;
1105 		cv_broadcast(&p->auth_cv);
1106 		mutex_exit(&p->auth_lock);
1107 	} else {
1108 		uint_t nach;
1109 		time_t refresh;
1110 
1111 		refresh = gethrestime_sec() - p->auth_freshness;
1112 
1113 		p->auth_time = gethrestime_sec();
1114 
1115 		if (uid != NULL)
1116 			*uid = p->auth_srv_uid;
1117 		if (gid != NULL)
1118 			*gid = p->auth_srv_gid;
1119 		if (ngids != NULL && gids != NULL) {
1120 			*ngids = p->auth_srv_ngids;
1121 			*gids = kmem_alloc(*ngids * sizeof (gid_t), KM_SLEEP);
1122 			bcopy(p->auth_srv_gids, *gids, *ngids * sizeof (gid_t));
1123 		}
1124 
1125 		access = p->auth_access;
1126 
1127 		if ((refresh > NFSAUTH_CACHE_REFRESH) &&
1128 		    p->auth_state == NFS_AUTH_FRESH) {
1129 			refreshq_auth_node_t *ran;
1130 			uint_t nacr;
1131 
1132 			p->auth_state = NFS_AUTH_STALE;
1133 			mutex_exit(&p->auth_lock);
1134 
1135 			nacr = atomic_inc_uint_nv(&nfsauth_cache_refresh);
1136 			DTRACE_PROBE3(nfsauth__debug__cache__stale,
1137 			    struct exportinfo *, exi,
1138 			    struct auth_cache *, p,
1139 			    uint_t, nacr);
1140 
1141 			ran = kmem_alloc(sizeof (refreshq_auth_node_t),
1142 			    KM_SLEEP);
1143 			ran->ran_auth = p;
1144 			ran->ran_netid = strdup(svc_getnetid(req->rq_xprt));
1145 
1146 			mutex_enter(&refreshq_lock);
1147 			/*
1148 			 * We should not add a work queue
1149 			 * item if the thread is not
1150 			 * accepting them.
1151 			 */
1152 			if (refreshq_thread_state == REFRESHQ_THREAD_RUNNING) {
1153 				refreshq_exi_node_t *ren;
1154 
1155 				/*
1156 				 * Is there an existing exi_list?
1157 				 */
1158 				for (ren = list_head(&refreshq_queue);
1159 				    ren != NULL;
1160 				    ren = list_next(&refreshq_queue, ren)) {
1161 					if (ren->ren_exi == exi) {
1162 						list_insert_tail(
1163 						    &ren->ren_authlist, ran);
1164 						break;
1165 					}
1166 				}
1167 
1168 				if (ren == NULL) {
1169 					ren = kmem_alloc(
1170 					    sizeof (refreshq_exi_node_t),
1171 					    KM_SLEEP);
1172 
1173 					exi_hold(exi);
1174 					ren->ren_exi = exi;
1175 
1176 					list_create(&ren->ren_authlist,
1177 					    sizeof (refreshq_auth_node_t),
1178 					    offsetof(refreshq_auth_node_t,
1179 					    ran_node));
1180 
1181 					list_insert_tail(&ren->ren_authlist,
1182 					    ran);
1183 					list_insert_tail(&refreshq_queue, ren);
1184 				}
1185 
1186 				cv_broadcast(&refreshq_cv);
1187 			} else {
1188 				strfree(ran->ran_netid);
1189 				kmem_free(ran, sizeof (refreshq_auth_node_t));
1190 			}
1191 
1192 			mutex_exit(&refreshq_lock);
1193 		} else {
1194 			mutex_exit(&p->auth_lock);
1195 		}
1196 
1197 		nach = atomic_inc_uint_nv(&nfsauth_cache_hit);
1198 		DTRACE_PROBE2(nfsauth__debug__cache__hit,
1199 		    uint_t, nach,
1200 		    time_t, refresh);
1201 
1202 		kmem_free(addr.buf, addr.maxlen);
1203 	}
1204 
1205 	return (access);
1206 
1207 retrieve:
1208 	/*
1209 	 * Retrieve the required data without caching.
1210 	 */
1211 
1212 	ASSERT(p == NULL);
1213 
1214 	atomic_inc_uint(&nfsauth_cache_miss);
1215 
1216 	if (nfsauth_retrieve(exi, svc_getnetid(req->rq_xprt), flavor, &addr,
1217 	    &access, crgetuid(cr), crgetgid(cr), crgetngroups(cr),
1218 	    crgetgroups(cr), &tmpuid, &tmpgid, &tmpngids, &tmpgids)) {
1219 		if (uid != NULL)
1220 			*uid = tmpuid;
1221 		if (gid != NULL)
1222 			*gid = tmpgid;
1223 		if (ngids != NULL && gids != NULL) {
1224 			*ngids = tmpngids;
1225 			*gids = tmpgids;
1226 		} else {
1227 			kmem_free(tmpgids, tmpngids * sizeof (gid_t));
1228 		}
1229 	}
1230 
1231 	kmem_free(addr.buf, addr.maxlen);
1232 
1233 	return (access);
1234 }
1235 
1236 /*
1237  * Check if the requesting client has access to the filesystem with
1238  * a given nfs flavor number which is an explicitly shared flavor.
1239  */
1240 int
1241 nfsauth4_secinfo_access(struct exportinfo *exi, struct svc_req *req,
1242 			int flavor, int perm, cred_t *cr)
1243 {
1244 	int access;
1245 
1246 	if (! (perm & M_4SEC_EXPORTED)) {
1247 		return (NFSAUTH_DENIED);
1248 	}
1249 
1250 	/*
1251 	 * Optimize if there are no lists
1252 	 */
1253 	if ((perm & (M_ROOT | M_NONE | M_MAP)) == 0) {
1254 		perm &= ~M_4SEC_EXPORTED;
1255 		if (perm == M_RO)
1256 			return (NFSAUTH_RO);
1257 		if (perm == M_RW)
1258 			return (NFSAUTH_RW);
1259 	}
1260 
1261 	access = nfsauth_cache_get(exi, req, flavor, cr, NULL, NULL, NULL,
1262 	    NULL);
1263 
1264 	return (access);
1265 }
1266 
1267 int
1268 nfsauth_access(struct exportinfo *exi, struct svc_req *req, cred_t *cr,
1269     uid_t *uid, gid_t *gid, uint_t *ngids, gid_t **gids)
1270 {
1271 	int access, mapaccess;
1272 	struct secinfo *sp;
1273 	int i, flavor, perm;
1274 	int authnone_entry = -1;
1275 
1276 	/*
1277 	 * By default root is mapped to anonymous user.
1278 	 * This might get overriden later in nfsauth_cache_get().
1279 	 */
1280 	if (crgetuid(cr) == 0) {
1281 		if (uid != NULL)
1282 			*uid = exi->exi_export.ex_anon;
1283 		if (gid != NULL)
1284 			*gid = exi->exi_export.ex_anon;
1285 	} else {
1286 		if (uid != NULL)
1287 			*uid = crgetuid(cr);
1288 		if (gid != NULL)
1289 			*gid = crgetgid(cr);
1290 	}
1291 
1292 	if (ngids != NULL)
1293 		*ngids = 0;
1294 	if (gids != NULL)
1295 		*gids = NULL;
1296 
1297 	/*
1298 	 *  Get the nfs flavor number from xprt.
1299 	 */
1300 	flavor = (int)(uintptr_t)req->rq_xprt->xp_cookie;
1301 
1302 	/*
1303 	 * First check the access restrictions on the filesystem.  If
1304 	 * there are no lists associated with this flavor then there's no
1305 	 * need to make an expensive call to the nfsauth service or to
1306 	 * cache anything.
1307 	 */
1308 
1309 	sp = exi->exi_export.ex_secinfo;
1310 	for (i = 0; i < exi->exi_export.ex_seccnt; i++) {
1311 		if (flavor != sp[i].s_secinfo.sc_nfsnum) {
1312 			if (sp[i].s_secinfo.sc_nfsnum == AUTH_NONE)
1313 				authnone_entry = i;
1314 			continue;
1315 		}
1316 		break;
1317 	}
1318 
1319 	mapaccess = 0;
1320 
1321 	if (i >= exi->exi_export.ex_seccnt) {
1322 		/*
1323 		 * Flavor not found, but use AUTH_NONE if it exists
1324 		 */
1325 		if (authnone_entry == -1)
1326 			return (NFSAUTH_DENIED);
1327 		flavor = AUTH_NONE;
1328 		mapaccess = NFSAUTH_MAPNONE;
1329 		i = authnone_entry;
1330 	}
1331 
1332 	/*
1333 	 * If the flavor is in the ex_secinfo list, but not an explicitly
1334 	 * shared flavor by the user, it is a result of the nfsv4 server
1335 	 * namespace setup. We will grant an RO permission similar for
1336 	 * a pseudo node except that this node is a shared one.
1337 	 *
1338 	 * e.g. flavor in (flavor) indicates that it is not explictly
1339 	 *	shared by the user:
1340 	 *
1341 	 *		/	(sys, krb5)
1342 	 *		|
1343 	 *		export  #share -o sec=sys (krb5)
1344 	 *		|
1345 	 *		secure  #share -o sec=krb5
1346 	 *
1347 	 *	In this case, when a krb5 request coming in to access
1348 	 *	/export, RO permission is granted.
1349 	 */
1350 	if (!(sp[i].s_flags & M_4SEC_EXPORTED))
1351 		return (mapaccess | NFSAUTH_RO);
1352 
1353 	/*
1354 	 * Optimize if there are no lists.
1355 	 * We cannot optimize for AUTH_SYS with NGRPS (16) supplemental groups.
1356 	 */
1357 	perm = sp[i].s_flags;
1358 	if ((perm & (M_ROOT | M_NONE | M_MAP)) == 0 && (ngroups_max <= NGRPS ||
1359 	    flavor != AUTH_SYS || crgetngroups(cr) < NGRPS)) {
1360 		perm &= ~M_4SEC_EXPORTED;
1361 		if (perm == M_RO)
1362 			return (mapaccess | NFSAUTH_RO);
1363 		if (perm == M_RW)
1364 			return (mapaccess | NFSAUTH_RW);
1365 	}
1366 
1367 	access = nfsauth_cache_get(exi, req, flavor, cr, uid, gid, ngids, gids);
1368 
1369 	/*
1370 	 * For both NFSAUTH_DENIED and NFSAUTH_WRONGSEC we do not care about
1371 	 * the supplemental groups.
1372 	 */
1373 	if (access & NFSAUTH_DENIED || access & NFSAUTH_WRONGSEC) {
1374 		if (ngids != NULL && gids != NULL) {
1375 			kmem_free(*gids, *ngids * sizeof (gid_t));
1376 			*ngids = 0;
1377 			*gids = NULL;
1378 		}
1379 	}
1380 
1381 	/*
1382 	 * Client's security flavor doesn't match with "ro" or
1383 	 * "rw" list. Try again using AUTH_NONE if present.
1384 	 */
1385 	if ((access & NFSAUTH_WRONGSEC) && (flavor != AUTH_NONE)) {
1386 		/*
1387 		 * Have we already encountered AUTH_NONE ?
1388 		 */
1389 		if (authnone_entry != -1) {
1390 			mapaccess = NFSAUTH_MAPNONE;
1391 			access = nfsauth_cache_get(exi, req, AUTH_NONE, cr,
1392 			    NULL, NULL, NULL, NULL);
1393 		} else {
1394 			/*
1395 			 * Check for AUTH_NONE presence.
1396 			 */
1397 			for (; i < exi->exi_export.ex_seccnt; i++) {
1398 				if (sp[i].s_secinfo.sc_nfsnum == AUTH_NONE) {
1399 					mapaccess = NFSAUTH_MAPNONE;
1400 					access = nfsauth_cache_get(exi, req,
1401 					    AUTH_NONE, cr, NULL, NULL, NULL,
1402 					    NULL);
1403 					break;
1404 				}
1405 			}
1406 		}
1407 	}
1408 
1409 	if (access & NFSAUTH_DENIED)
1410 		access = NFSAUTH_DENIED;
1411 
1412 	return (access | mapaccess);
1413 }
1414 
1415 static void
1416 nfsauth_free_clnt_node(struct auth_cache_clnt *p)
1417 {
1418 	void *cookie = NULL;
1419 	struct auth_cache *node;
1420 
1421 	while ((node = avl_destroy_nodes(&p->authc_tree, &cookie)) != NULL)
1422 		nfsauth_free_node(node);
1423 	avl_destroy(&p->authc_tree);
1424 
1425 	kmem_free(p->authc_addr.buf, p->authc_addr.maxlen);
1426 	rw_destroy(&p->authc_lock);
1427 
1428 	kmem_free(p, sizeof (*p));
1429 }
1430 
1431 static void
1432 nfsauth_free_node(struct auth_cache *p)
1433 {
1434 	kmem_free(p->auth_clnt_gids, p->auth_clnt_ngids * sizeof (gid_t));
1435 	kmem_free(p->auth_srv_gids, p->auth_srv_ngids * sizeof (gid_t));
1436 	mutex_destroy(&p->auth_lock);
1437 	cv_destroy(&p->auth_cv);
1438 	kmem_cache_free(exi_cache_handle, p);
1439 }
1440 
1441 /*
1442  * Free the nfsauth cache for a given export
1443  */
1444 void
1445 nfsauth_cache_free(struct exportinfo *exi)
1446 {
1447 	int i;
1448 
1449 	/*
1450 	 * The only way we got here was with an exi_rele, which means that no
1451 	 * auth cache entry is being refreshed.
1452 	 */
1453 
1454 	for (i = 0; i < AUTH_TABLESIZE; i++) {
1455 		avl_tree_t *tree = exi->exi_cache[i];
1456 		void *cookie = NULL;
1457 		struct auth_cache_clnt *node;
1458 
1459 		while ((node = avl_destroy_nodes(tree, &cookie)) != NULL)
1460 			nfsauth_free_clnt_node(node);
1461 	}
1462 }
1463 
1464 /*
1465  * Called by the kernel memory allocator when
1466  * memory is low. Free unused cache entries.
1467  * If that's not enough, the VM system will
1468  * call again for some more.
1469  */
1470 /*ARGSUSED*/
1471 void
1472 exi_cache_reclaim(void *cdrarg)
1473 {
1474 	int i;
1475 	struct exportinfo *exi;
1476 
1477 	rw_enter(&exported_lock, RW_READER);
1478 
1479 	for (i = 0; i < EXPTABLESIZE; i++) {
1480 		for (exi = exptable[i]; exi; exi = exi->fid_hash.next) {
1481 			exi_cache_trim(exi);
1482 		}
1483 	}
1484 
1485 	rw_exit(&exported_lock);
1486 
1487 	atomic_inc_uint(&nfsauth_cache_reclaim);
1488 }
1489 
1490 void
1491 exi_cache_trim(struct exportinfo *exi)
1492 {
1493 	struct auth_cache_clnt *c;
1494 	struct auth_cache_clnt *nextc;
1495 	struct auth_cache *p;
1496 	struct auth_cache *next;
1497 	int i;
1498 	time_t stale_time;
1499 	avl_tree_t *tree;
1500 
1501 	for (i = 0; i < AUTH_TABLESIZE; i++) {
1502 
1503 		tree = exi->exi_cache[i];
1504 		stale_time = gethrestime_sec() - NFSAUTH_CACHE_TRIM;
1505 
1506 		rw_enter(&exi->exi_cache_lock, RW_READER);
1507 
1508 		/*
1509 		 * Free entries that have not been
1510 		 * used for NFSAUTH_CACHE_TRIM seconds.
1511 		 */
1512 		for (c = avl_first(tree); c != NULL; c = AVL_NEXT(tree, c)) {
1513 			rw_enter(&c->authc_lock, RW_WRITER);
1514 			for (p = avl_first(&c->authc_tree); p != NULL;
1515 			    p = next) {
1516 				next = AVL_NEXT(&c->authc_tree, p);
1517 
1518 				ASSERT(p->auth_state != NFS_AUTH_INVALID);
1519 
1520 				mutex_enter(&p->auth_lock);
1521 
1522 				/*
1523 				 * We won't trim recently used and/or WAITING
1524 				 * entries.
1525 				 */
1526 				if (p->auth_time > stale_time ||
1527 				    p->auth_state == NFS_AUTH_WAITING) {
1528 					mutex_exit(&p->auth_lock);
1529 					continue;
1530 				}
1531 
1532 				DTRACE_PROBE1(nfsauth__debug__trim__state,
1533 				    auth_state_t, p->auth_state);
1534 
1535 				/*
1536 				 * STALE and REFRESHING entries needs to be
1537 				 * marked INVALID only because they are
1538 				 * referenced by some other structures or
1539 				 * threads.  They will be freed later.
1540 				 */
1541 				if (p->auth_state == NFS_AUTH_STALE ||
1542 				    p->auth_state == NFS_AUTH_REFRESHING) {
1543 					p->auth_state = NFS_AUTH_INVALID;
1544 					mutex_exit(&p->auth_lock);
1545 
1546 					avl_remove(&c->authc_tree, p);
1547 				} else {
1548 					mutex_exit(&p->auth_lock);
1549 
1550 					avl_remove(&c->authc_tree, p);
1551 					nfsauth_free_node(p);
1552 				}
1553 			}
1554 			rw_exit(&c->authc_lock);
1555 		}
1556 
1557 		if (rw_tryupgrade(&exi->exi_cache_lock) == 0) {
1558 			rw_exit(&exi->exi_cache_lock);
1559 			rw_enter(&exi->exi_cache_lock, RW_WRITER);
1560 		}
1561 
1562 		for (c = avl_first(tree); c != NULL; c = nextc) {
1563 			nextc = AVL_NEXT(tree, c);
1564 
1565 			if (avl_is_empty(&c->authc_tree) == B_FALSE)
1566 				continue;
1567 
1568 			avl_remove(tree, c);
1569 
1570 			nfsauth_free_clnt_node(c);
1571 		}
1572 
1573 		rw_exit(&exi->exi_cache_lock);
1574 	}
1575 }
1576