Attachment 229961 Details for Bug 260266 – Crash an NFS client with a callback with a bad taglen.

Crash an NFS client with a callback with a bad taglen.

fnfs_6.c (text/plain), 30.19 KB, created by Robert Morris on 2021-12-07 18:52:37 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Robert Morris

Created: 2021-12-07 18:52:37 UTC

Size: 30.19 KB

patch

obsolete

>#include <stdio.h>
>#include <string.h>
>#include <stdlib.h>
>#include <unistd.h>
>#include <sys/socket.h>
>#include <sys/ioctl.h>
>#include <netinet/in.h>
>#include <sys/wait.h>
>#include <sys/resource.h>
>#include <sys/param.h>
>#include <sys/mount.h>
>#include <sys/types.h>
>#include <sys/stat.h>
>#include <dirent.h>
>#include <assert.h>
>#include <fcntl.h>
>#include <errno.h>
>
>#ifndef SYM
>#define SYM 0
>#endif
>
>int sym_op = -1;
>int sym_skip = 0;
>int sym_type = 0; // all fattr4 file types
>int sym_fh = 0; // all file handles
>int sym_bitmaps = 0;
>
>int opcounts[256];
>long long next_cookie = 3;
>int current_fh = 0;
>int compound_status;
>int send_back;
>
>// map file/dir names to file handle
>char *fhnames[100] = {
>               "",
>               "tmp",
>               "x",
>               "y",
>               "z",
>               "zzz",
>               0
>};
>
>int
>name2fh(char *name, int create)
>{
>  for(int i = 0; fhnames[i]; i++){
>    if(strcmp(name, fhnames[i]) == 0)
>      return i;
>  }
>  if(create){
>    for(int i = 0; ; i++){
>      if(fhnames[i] == 0){
>        fhnames[i] = malloc(100);
>        strcpy(fhnames[i], name);
>        return i;
>      }
>    }
>  }
>  return -1;
>}
>
>static inline unsigned long symx() {
>#if SYM
>  unsigned long x;
>  asm volatile("csrr %0, 0x004" : "=r" (x) );
>  return x;
>#else
>  return 0;
>#endif
> }
>
>#define NAA 128
>unsigned long long aa[NAA] = {
>0xa386014000000000ull,
>0x5000000ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x80ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>0x0ull,
>};
>int aai = 0;
>
>char ibuf[16*1024];
>int ilen = 0;
>int ii = 0;
>char obuf[16*1024];
>int oi = 0;
>int symstart = -1;
>
>int readn(int fd, void *xbuf, int n) {
>  char *buf = (char *) xbuf;
>  int orig = n;
>  while(n > 0){
>    int cc = read(fd, buf, n);
>    if(cc <= 0) { perror("read"); return -1; }
>    n -= cc;
>    buf += cc;
>  }
>  return orig;
>}
>
>unsigned int
>parse32()
>{
>  if(ii >= ilen){
>    printf("parsed beyond the end of the input\n");
>    return 0;
>  }
>  unsigned int x = *(int*)(ibuf+ii);
>  ii += 4;
>  return ntohl(x);
>}
>
>unsigned long long
>parse64()
>{
>  unsigned long long hi = parse32();
>  unsigned long long lo = parse32();
>  return (hi << 32) | lo;
>}
>
>// sessionid4 -- 16 bytes
>void
>parse_sid(char *sid)
>{
>  for(int i = 0; i < 16; i++){
>    if(sid)
>      sid[i] = ibuf[ii];
>    ii++;
>  }
>}
>
>unsigned int
>parse_opaque(char *buf)
>{
>  if(buf)
>    buf[0] = 0;
>  int nominal_n = parse32();
>  if(nominal_n > 4096){
>    printf("crazy opaque length %d\n", nominal_n);
>    return 0;
>  }
>  int real_n = nominal_n;
>  while((real_n%4) != 0) real_n += 1;
>  for(int i = 0; i < real_n; i++){
>    if(buf && i < real_n)
>      buf[i] = ibuf[ii];
>    ii++;
>  }
>  return nominal_n;
>}
>
>void
>put32(unsigned int x)
>{
>  assert((oi % 4) == 0);
>  *(int*)(obuf+oi) = htonl(x);
>  oi += 4;
>}
>
>void
>put64(unsigned long long x)
>{
>  put32(x >> 32);
>  put32(x);
>}
>
>void
>put_opaque(int n, char *buf)
>{
>  put32(n);
>  for(int i = 0; i < n; i++)
>    obuf[oi++] = (buf ? buf[i] : 0);
>  while((n%4)!=0){
>    obuf[oi++] = 0;
>    n++;
>  }
>}
>
>void
>put_sid(char *sid)
>{
>  for(int i = 0; i < 16; i++){
>    obuf[oi++] = (sid ? sid[i] : 0);
>  }
>}
>
>void
>parse_nop()
>{
>}
>
>void
>parse_op_exchange_id()
>{
>  parse32(); // verifier4, first half
>  parse32(); // verifier4, second half
>  parse_opaque(0); // eia_clientowner
>  int cflags = parse32(); // eia_flags
>  parse32(); // state_protect4_a.spa_how, assume SP4_NONE
>  int nimpl = parse32(); // length of client_impl_id
>  for(int impli = 0; impli < nimpl; impli++){
>    char junk[512];
>    parse_opaque(junk); // nii_domain
>    // printf("nii_domain: %s\n", junk);
>    parse_opaque(junk); // nii_name
>    // printf("nii_name: %s\n", junk);
>    parse64(); // 1/2 of nfstime4
>    parse32(); // 1/2 of nfstime4
>  }
>
>  // finish EXCHANGE_ID4res
>  put32(0); // eir_status = NFS4_OK
>  put64(1); // clientid4
>  put32(1); // sequenceid4
>  int sflags = 0x103 | 0x10000; // EXCHGID4_FLAG_USE_NON_PNFS
>  put32(sflags); // eir_flags
>  put32(0); // state_protect4_r.spr_how = SP4_NONE
>  put64(1); // server_owner4.so_minor_id
>  put32(4); // length of so_major_id<>
>  put32(0x11223344); // so_major_id<>
>  put32(4); // length of eir_server_scope
>  put32(0x11223344);
>  put32(1); // length of eir_server_impl_id<1>
>  put32(4); // nfs_impl_id4.nii_domain
>  put32(0x11223344);
>  put32(4); // nfs_impl_id4.nii_name
>  put32(0x11223344);
>  put64(0); // nii_date 1/2
>  put32(0); // nii_date 2/2
>}
>
>void
>parse_op_create_session()
>{
>  parse64(); // csa_clientid
>  int seq = parse32(); // csa_sequence
>  parse32(); // csa_flags
>  // csa_fore_chan_attrs, csa_back_chan_attrs
>  int attrs[2][6];
>  for(int i = 0; i < 2; i++){
>    for(int j = 0; j < 6; j++){
>      attrs[i][j] = parse32();
>    }
>    parse_opaque(0); // ca_rdma_ird<1>
>  }
>  // XXX
>  ii = ilen;
>
>  put32(0); // OK
>  for(int i = 0; i < 4; i++)
>    put32(1); // csr_sessionid i/4
>  put32(seq); // csr_sequence
>  put32(0x3); // csr_flags
>
>  for(int i = 0; i < 2; i++){
>    for(int j = 0; j < 6; j++)
>      put32(attrs[i][j]);
>    put32(0); // ca_rdma_ird
>  }
>}
>
>void
>parse_op_sequence()
>{
>  char sid[16];
>
>  parse_sid(sid); // sa_sessionid
>  int seq = parse32(); // sa_sequenceid
>  int slot = parse32(); // sa_slotid
>  int hislot = parse32(); // sa_highest_slotid
>  parse32(); // sa_cachethis
>
>  put32(0); // OK
>  put_sid(sid); // sr_sessionid
>  put32(seq); // sr_sequenceid
>  put32(slot); // sr_slotid
>  put32(hislot); // sr_highest_slotid
>  put32(hislot); // sr_target_highest_slotid
>  put32(0); // sr_status_flags
>}
>
>void
>parse_op_reclaim_complete()
>{
>  parse32(); // rca_one_fs
>  put32(0); // rcr_status
>}
>
>void
>parse_op_putrootfh()
>{
>  // no arguments
>  put32(0); // OK
>  current_fh = 0;
>}
>
>void
>parse_op_secinfo_no_name()
>{
>  parse32(); // secinfo_style4
>  put32(0); // OK
>  put32(1); // # of secinfo4
>#if 1
>  put32(0); // flavor = AUTH_NULL
>#else
>  put32(6); // flavor = RPCSEC_GSS
>  put32(4); // size of sec_oid4
>  put32(0xffffffff);
>  put32(0); // qop4
>  put32(1); // rpc_gss_svc_t
>#endif
>}
>
>void
>parse_op_destroy_session()
>{
>  parse_sid(0);
>  put32(0); // OK
>}
>
>void
>parse_op_destroy_clientid()
>{
>  parse64(); // clientid
>  put32(0); // OK
>}
>
>void
>parse_op_getfh()
>{
>  // no arguments
>  put32(0); // OK
>  int xfh = current_fh;
>  if(sym_fh) xfh ^= aa[aai++];
>  put_opaque(4, (char*)&xfh); // fh
>}
>
>//
>// called by getattr and readdir.
>// generates a fattr4 (bitmap4 then attrlist4).
>//
>void
>put_fattr4(int xwords[], int fh)
>{
>  int words[3];
>  for(int i = 0; i < 3; i++){
>    words[i] = xwords[i];
>    if(sym_bitmaps){
>      words[i] ^= aa[aai++];
>    }
>  }
>  int bitwords = 3;
>  put32(bitwords);
>  int word0i = oi;
>  for(int i = 0; i < bitwords; i++)
>    put32(words[i]);
>  int leni = oi;
>  put32(0); // placeholder for total length of attrs
>  for(int a = 0; a < bitwords*32; a++){
>    if(words[a/32] & (1 << (a % 32))){
>      if(a == 0){
>        put32(3); // # bitmap words of supported attrs
>        put32(0xffffffff);
>        put32(0xffffffff);
>        put32(0xffffffff);
>      } else if(a == 1){
>        int type = 1;
>        if(fh == 0 || fh == 1)
>          type = 2;
>        if(sym_type) type ^= aa[aai++];
>        put32(type); // NF4DIR=2 or NF4REG=1
>      } else if(a == 2){
>        put32(0); // fh_expire_type
>      } else if(a == 3){
>        put64(0); // change
>      } else if(a == 4){
>        put64(4096*10); // size
>      } else if(a == 5){
>        put32(1); // link support
>      } else if(a == 6){
>        put32(1); // symlink support
>      } else if(a == 8){
>        put64(1); // fsid major
>        put64(1); // fsid minor
>      } else if(a == 10){
>        put32(10); // lease time
>      } else if(a == 11){
>        put32(0); // rdattr_error
>      } else if(a == 12){
>        // ACL
>        int n = 2;
>        put32(n);
>        for(int i = 0; i < n; i++){
>          put32(0); // type
>          put32(0); // flag
>          put32(0); // mask
>          char who[9];
>          memset(who, 0, sizeof(who));
>          strcpy(who, "nobody");
>          put_opaque(strlen(who), who);
>        }
>      } else if(a == 13){
>        put32(0xf); // aclsupport
>      } else if(a == 15){
>        put32(1); // cansettime
>      } else if(a == 16){
>        put32(0); // case insensitive
>      } else if(a == 17){
>        put32(1); // case preserving
>      } else if(a == 18){
>        put32(0); // chown_restricted
>      } else if(a == 19){
>        // filehandle
>        int xfh = fh;
>        if(sym_fh) xfh ^= aa[aai++];
>        put_opaque(4, (char*)&xfh); // fh
>      } else if(a == 20){
>        put64(fh); // fileid
>      } else if(a == 22){
>        put64(9999); // files_free
>      } else if(a == 23){
>        put64(99999); // files_total
>      } else if(a == 24){
>        // fs_locations
>        put32(1);
>        put_opaque(10, "abcde12345"); // pathname4
>        put32(1); // locations<>
>        put_opaque(10, "abcde12345"); // server
>        put32(1);
>        put_opaque(10, "abcde12345"); // rootpath
>      } else if(a == 26){
>        put32(1); // homogeneous
>      } else if(a == 27){
>        put64(0xffffffffffff); // max file size
>      } else if(a == 28){
>        put32(0xffff); // max link
>      } else if(a == 29){
>        put32(256); // max name
>      } else if(a == 30){
>        put64(10*4096); // max read
>      } else if(a == 31){
>        put64(10*4096); // max write
>      } else if(a == 33){
>        put32(0777); // mode
>      } else if(a == 34){
>        put32(1); // no_trunc
>      } else if(a == 35){
>        put32(3); // numlinks
>      } else if(a == 36){
>        // put_opaque(6, "other"); // owner
>        put_opaque(6, "nobody"); // owner
>        // put_opaque(5, "65534"); // owner
>      } else if(a == 37){
>        // put_opaque(6, "other"); // owner_group
>        put_opaque(6, "nobody"); // owner_group
>        // put_opaque(5, "65534"); // owner_group
>      } else if(a == 41){
>        put32(0); // rawdev major
>        put32(0); // rawdev minor
>      } else if(a == 42){
>        put64(10*1024*1024); // space_avail
>      } else if(a == 43){
>        put64(10*1024*1024); // space_free
>      } else if(a == 44){
>        put64(20*1024*1024); // space_total
>      } else if(a == 45){
>        put64(4096*10); // space used
>      } else if(a == 47){
>        put64(0); // time access seconds
>        put32(0); // nseconds
>      } else if(a == 50){
>        put64(0); // time create seconds
>        put32(0); // nseconds
>      } else if(a == 51){
>        put64(0); // time delta seconds
>        put32(0); // nseconds
>      } else if(a == 52){
>        put64(0); // time metadata seconds
>        put32(0); // nseconds
>      } else if(a == 53){
>        put64(0); // time modify seconds
>        put32(0); // nseconds
>      } else if(a == 55){
>        put64(0); // mounted_on_fileid ???
>      } else if(a == 62){
>        // fs_layout_types
>        put32(1);
>        put32(1); // LAYOUT4_NFSV4_1_FILES
>      } else if(a == 75){
>        // FATTR4_SUPPATTR_EXCLCREAT
>        put32(2); // bitmap length
>        put32(0xffffffff);
>        put32(0xffffffff);
>      } else {
>        if(sym_bitmaps){
>          words[a/32] &= ~(1 << (a % 32));
>          *(int*)(obuf + word0i + 4*(a/32)) = htonl(words[a/32]);
>        } else {
>          printf("unknown requested attr %d\n", a);
>          put64(0); // XXX
>        }
>      }
>    }
>  }
>#if 1
>  for(int i = 0; i < 16; i++)
>    put32(0xffffffff);
>#endif
>  *(int*)(obuf+leni) = htonl(oi - leni - 4);
>}
>
>void
>parse_op_getattr()
>{
>  int bitwords = parse32();
>  int words[4];
>  memset(words, 0, sizeof(words));
>  if(bitwords < 1 || bitwords > 3)
>    printf("parse_op_getattr: crazy bitwords %d\n", bitwords);
>  for(int i = 0; i < bitwords && i < 4; i++)
>    words[i] = parse32();
>  put32(0); // OK
>  put_fattr4(words, current_fh);
>}
>
>void
>parse_op_putfh()
>{
>  char buf[64];
>  int n = parse_opaque(buf); // fh
>  if(n != 4){
>    printf("op_putfh fh size %d, not 4\n", n);
>    exit(1);
>  }
>  int fh = *(int*)buf;
>  current_fh = fh;
>  put32(0); // OK
>}
>
>void
>parse_op_access()
>{
>  int mask = parse32(); // mask of rights to query
>  put32(0); // OK
>  put32(mask); // supported = all rights
>  put32(mask); // access = all rights
>}
>
>void
>parse_op_lookup()
>{
>  char name[256];
>  int n = parse_opaque(name);
>  name[n>=0?n:0] = '\0';
>  int xfh = name2fh(name, 0);
>  if(xfh < 0){
>    printf("lookup %s -> ENOENT\n", name);
>    put32(2); // NFS4ERR_NOENT
>    if(compound_status == 0)
>      compound_status = 2;
>  } else {
>    put32(0); // OK
>    current_fh = xfh;
>    printf("lookup %s -> fh %d\n", name, current_fh);
>  }
>}
>
>void
>parse_op_lookupp()
>{
>  current_fh = 1; // /tmp
>  put32(0); // OK
>}
>
>void
>parse_op_readdir()
>{
>  long long cookie = parse64();
>  long long verf = parse64(); // cookie verifier
>  parse32(); // dircount
>  parse32(); // maxcount
>  // attr_request
>  int bitwords = parse32();
>  int words[4];
>  memset(words, 0, sizeof(words));
>  for(int i = 0; i < bitwords && i < 4; i++)
>    words[i] = parse32();
>
>  put32(0); // OK
>  put64(verf); // cookieverf
>  char *names[] = { "z", "zzz" };
>  for(int i = 0; i < 2; i++){
>    put32(1); // *nextentry
>    put64(next_cookie++); // cookie
>    put_opaque(3, names[i]); // name
>    put_fattr4(words, name2fh(names[i], 1));
>  }
>
>  put32(0); // *nextentry
>
>  put32(1); // eof
>}
>
>void
>parse_op_open()
>{
>  char name[256];
>  name[0] = 0;
>  parse32(); // seqid
>  parse32(); // share_access
>  parse32(); // share_deny
>  parse64(); // owner client id
>  parse_opaque(0); // owner owner
>  // openflag4
>  int opentype = parse32();
>  if(opentype == 1){
>    // OPEN4_CREATE
>    int mode = parse32(); // createhow4
>    if(mode == 0){
>      // UNCHECKED4
>      // fattr4 createattrs
>      int bitwords = parse32();
>      int words[32];
>      for(int i = 0; i < bitwords; i++)
>        words[i] = parse32();
>      parse_opaque(0); // attrlist4
>    } else {
>      printf("OPEN4_CREATE unknown mode %d\n", mode);
>      exit(1);
>    }
>  } else if(opentype == 0){
>    // OPEN4_NOCREATE
>  } else {
>    printf("unknown opentype %d\n", opentype);
>    exit(1);
>  }
>  int open_claim_type = parse32();
>  if(open_claim_type == 0){
>    // CLAIM_NULL
>    parse_opaque(name); // file name
>  } else if(open_claim_type == 2){
>    // CLAIM_DELEGATE_CUR
>    // open_claim_delegate_cur4
>    // stateid4
>    parse32(); // seqid
>    parse32();
>    parse32();
>    parse32();
>    parse_opaque(name); // file name
>  } else if(open_claim_type == 4){
>    // CLAIM_FH
>  } else {
>    printf("oy, open_claim_type %d\n", open_claim_type);
>    exit(1);
>  }
>
>  int xfh = name2fh(name, opentype);
>  if(xfh < 0){
>    printf("open(%s) ENOENT\n", name);
>    put32(2); // NFS4ERR_NOENT
>  } else {
>    put32(0); // OK
>    // stateid4
>    put32(1); // seqid
>    put32(1); // other
>    put32(1);
>    put32(1);
>    // change_info4
>    put32(1);
>    put64(0); // before
>    put64(0); // after
>    put32(0); // rflags
>    put32(0); // attrset bitmap length
>    // open_delegation4
>    put32(0); // OPEN_DELEGATE_NONE
>    printf("  name=%s\n", name);
>    if(name[0]){
>      current_fh = xfh;
>    } else {
>      printf("op_open: no name with which to set fh\n");
>    }
>  }
>}
>
>void
>parse_op_setattr()
>{
>  // stateid4
>  parse32(); // seqid
>  parse32(); // other
>  parse32(); // other
>  parse32(); // other
>  // fattr4
>  int bitwords = parse32();
>  int words[64];
>  for(int i = 0; i < bitwords; i++)
>    words[i] = parse32();
>  parse_opaque(0); // attrlist4
>
>  put32(0); // OK
>  put32(bitwords);
>  for(int i = 0; i < bitwords; i++)
>    put32(words[i]);
>}
>
>void
>parse_op_layoutget()
>{
>  parse32(); // loga_signal_layout_avail
>  parse32(); // layouttype4
>  parse32(); // layoutiomode4
>  parse64(); // offset
>  parse64(); // length
>  parse64(); // minlength
>  parse32(); // stateid4 seqid
>  parse32(); // stateid4 other
>  parse32(); // stateid4 other
>  parse32(); // stateid4 other
>  parse32(); // count32
>  
>  put32(0); // OK
>  put32(0); // return_on_close
>  put32(0); // stateid4 seqid
>  put32(0); // stateid4 other
>  put32(0); // stateid4 other
>  put32(0); // stateid4 other
>  put32(1); // # of layout4
>  put64(0); // offset
>  put64(1000000); // length
>  put32(3); // layoutiomode4
>  put32(1); // layouttype4
>  put_opaque(8, "xxxxxxxx"); // loc_body
>}
>
>void
>parse_op_write()
>{
>  parse32(); // stateid4
>  parse32(); // stateid4
>  parse32(); // stateid4
>  parse32(); // stateid4
>  parse64(); // offset
>  parse32(); // stable_how4
>  int n = parse_opaque(0); // data
>
>  put32(0); // OK
>  put32(n); // count
>  put32(0); // UNSTABLE4
>  put64(1); // verifier
>}
>
>void
>parse_op_read()
>{
>  parse32(); // stateid4
>  parse32(); // stateid4
>  parse32(); // stateid4
>  parse32(); // stateid4
>  parse64(); // offset
>  parse32(); // count
>
>  put32(0); // OK
>  put32(1); // eof
>  put_opaque(4, "abcd");
>}
>
>void
>parse_op_commit()
>{
>  parse64(); // offset
>  parse32(); // count
>  put32(0); // OK
>  put64(1); // verifier4
>}
>
>void
>parse_op_close()
>{
>  parse32(); // seqid
>  parse32(); // stateid4.seqid
>  parse32(); // stateid4.other
>  parse32(); // stateid4.other
>  parse32(); // stateid4.other
>  put32(0); // OK
>  put32(2); // seqid
>  put32(1); // other
>  put32(1);
>  put32(1);
>}
>
>void
>parse_op_create()
>{
>  int type = parse32(); // type
>  char name[128];
>  memset(name, 0, sizeof(name));
>  int namelen = parse_opaque(name);
>  // fattr4
>  int bitwords = parse32();
>  int words[64];
>  for(int i = 0; i < bitwords; i++)
>    words[i] = parse32();
>  parse_opaque(0); // attrlist4
>  printf("create type=%d name=%s\n", type, name);
>
>  current_fh = name2fh(name, 1);
>  put32(0); // OK
>  put32(1); // change_info4.atomic
>  put64(1); // before
>  put64(2); // after
>  put32(bitwords);
>  for(int i = 0; i < bitwords; i++)
>    put32(words[i]);
>}
>
>void
>parse_op_remove()
>{
>  char name[256];
>  memset(name, 0, sizeof(name));
>  int namelen = parse_opaque(name);
>  put32(0); // OK
>  put32(1); // change_info4.atomic
>  put64(1); // before
>  put64(2); // after
>}
>
>int saved_fh;
>
>void
>parse_op_savefh()
>{
>  saved_fh = current_fh;
>  put32(0); // OK
>}
>
>void
>parse_op_restorefh()
>{
>  current_fh = saved_fh;
>  put32(0); // OK
>}
>
>void
>parse_op_rename()
>{
>  char name1[256], name2[256];
>  memset(name1, 0, sizeof(name1));
>  memset(name2, 0, sizeof(name2));
>  parse_opaque(name1);
>  parse_opaque(name2);
>  printf("rename %s %s\n", name1, name2);
>
>  put32(0); // OK
>  // change_info4
>  put32(1);
>  put64(1); // before
>  put64(2); // after
>  // change_info4
>  put32(1);
>  put64(3); // before
>  put64(4); // after
>}
>
>void
>parse_op_seek()
>{
>  // stateid4
>  parse32(); // seqid
>  parse32();
>  parse32();
>  parse32();
>  long offset = parse64(); // offset
>  int what = parse32();
>  printf("seek offset=%ld what=%d\n", offset, what);
>  put32(0); // OK
>  if(what == 0){
>    // next data?
>    if(offset >= 32){
>      put32(1);
>      put64(offset);
>    } else {
>      put32(0);
>      put64(offset + 1);
>    }
>  } else {
>    // next hole?
>    if(offset >= 32){
>      put32(1);
>      put64(offset);
>    } else {
>      put32(0);
>      put64(32);
>    }
>  }
>}
>
>void
>parse_op_copy()
>{
>  // stateid4
>  parse32(); // seqid
>  parse32();
>  parse32();
>  parse32();
>  // stateid4
>  parse32(); // seqid
>  parse32();
>  parse32();
>  parse32();
>  parse64(); // offset
>  parse64(); // offset
>  long long count = parse64(); // count
>  parse32(); // consecutive
>  parse32(); // synchronous
>  int nloc = parse32();
>  for(int i = 0; i < nloc; i++){
>    int type = parse32();
>    if(type == 1 || type == 2){
>      parse_opaque(0); // name of url
>    } else {
>      parse_opaque(0); // network id
>      parse_opaque(0); // universal address
>    }
>  }
>
>  put32(0); // OK
>  // stateid4 callback_id<1>
>  if(1){
>    put32(0); // n
>  } else {
>    put32(1); // n
>    put32(1); // seqid
>    put32(1); // other
>    put32(1);
>    put32(1);
>  }
>  put64(count); // count
>  put32(0); // stable_how UNSTABLE
>  put64(0); // verifier
>  put32(1); // consecutive
>  put32(1); // synchronous
>}
>
>void
>parse_op_lock()
>{
>  parse32(); // lock type
>  parse32(); // reclaim
>  parse64(); // offset
>  parse64(); // length
>  int owner = parse32(); // lock4 new_lock_owner
>  if(owner){
>    parse32(); // open_seqid
>    // stateid4
>    parse32(); // seqid
>    parse32();
>    parse32();
>    parse32();
>    parse32(); // lock_seqid
>    parse64(); // clientid
>    parse_opaque(0); // owner
>  } else {
>    // stateid4
>    parse32(); // seqid
>    parse32();
>    parse32();
>    parse32();
>    parse32(); // seqid
>  }
>
>  put32(0); // OK
>  // stateid4
>  put32(1); // seqid
>  put32(1); // other
>  put32(1);
>  put32(1);
>
>  send_back = 1;
>}
>
>void
>parse_op_locku()
>{
>  parse32(); // lock type
>  parse32(); // seqid
>  // stateid4
>  parse32(); // seqid
>  parse32();
>  parse32();
>  parse32();
>  parse64(); // offset
>  parse64(); // length
>
>  put32(0); // OK
>  // stateid4
>  put32(1); // seqid
>  put32(1); // other
>  put32(1);
>  put32(1);
>}
>
>void
>parse_op_free_stateid()
>{
>  // stateid4
>  parse32(); // seqid
>  parse32();
>  parse32();
>  parse32();
>
>  put32(0); // OK
>}
>
>void
>parse_compound()
>{
>  char tag[512];
>  int taglen = parse_opaque(tag); // tag
>  parse32(); // client minor version
>  int nops = parse32();
>
>  // start a COMPOUND4res
>  int status_oi = oi;
>  compound_status = 0;
>  put32(compound_status); // place-holder
>  put_opaque(taglen, tag);
>  put32(nops); // length of resarray<>
>  
>  int opindex = 0;
>  for(opindex = 0; opindex < nops && ii < ilen; opindex++){
>    int op = parse32();
>    printf("op %d #%d\n", op, opcounts[op&0xff]);
>    put32(op); // resop in nfs_resop4
>    if(sym_op == op){
>      if(sym_skip <= 0){
>        symstart = oi;
>      }
>      sym_skip -= 1;
>    }
>    if(op == 42){
>      parse_op_exchange_id();
>    } else if(op == 43){
>      parse_op_create_session();
>    } else if(op == 53){
>      parse_op_sequence();
>    } else if(op == 58){
>      parse_op_reclaim_complete();
>    } else if(op == 24){
>      parse_op_putrootfh();
>    } else if(op == 52){
>      parse_op_secinfo_no_name();
>    } else if(op == 44){
>      parse_op_destroy_session();
>    } else if(op == 57){
>      parse_op_destroy_clientid();
>    } else if(op == 10){
>      parse_op_getfh();
>    } else if(op == 9){
>      parse_op_getattr();
>    } else if(op == 22){
>      parse_op_putfh();
>    } else if(op == 3){
>      parse_op_access();
>    } else if(op == 15){
>      parse_op_lookup();
>    } else if(op == 16){
>      parse_op_lookupp();
>    } else if(op == 26){
>      parse_op_readdir();
>    } else if(op == 18){
>      parse_op_open();
>    } else if(op == 45){
>      parse_op_free_stateid();
>    } else if(op == 12){
>      parse_op_lock();
>    } else if(op == 14){
>      parse_op_locku();
>    } else if(op == 6){
>      parse_op_create();
>    } else if(op == 28){
>      parse_op_remove();
>    } else if(op == 4){
>      parse_op_close();
>    } else if(op == 34){
>      parse_op_setattr();
>    } else if(op == 50){
>      parse_op_layoutget();
>    } else if(op == 38){
>      parse_op_write();
>    } else if(op == 25){
>      parse_op_read();
>    } else if(op == 5){
>      parse_op_commit();
>    } else if(op == 32){
>      parse_op_savefh();
>    } else if(op == 31){
>      parse_op_restorefh();
>    } else if(op == 29){
>      parse_op_rename();
>    } else if(op == 69){
>      parse_op_seek();
>    } else if(op == 60){
>      parse_op_copy();
>    } else {
>      printf("unknown op %d\n", op);
>      // cannot continue to the next op since
>      // we don't know how long this one is.
>      break;
>    }
>    opcounts[op&0xff] += 1;
>  }
>  *(int*)(obuf+status_oi) = htonl(compound_status);
>  if(opindex != nops)
>    printf("compound with %d nops but only enough bytes for %d\n", nops, opindex);
>  if(ii != ilen)
>    printf("compound consumed only %d of %d bytes\n", ii, ilen);
>}
>
>void
>parse_rpc()
>{
>  // SUN RPC
>  int xid = parse32();
>  int mtype = parse32(); // mtype=CALL
>  if(mtype == 1){
>    printf("parse_rpc() got a backchannel reply to xid %d\n", xid);
>    return;
>  }
>  parse32(); // rpc version
>  parse32(); // prog#
>  parse32(); // prog vers
>  int proc = parse32();
>  parse32(); // cred type
>  parse_opaque(0); // cred
>  parse32(); // verf type
>  parse_opaque(0); // verf
>
>  put32(xid);
>  put32(1); // REPLY
>  put32(0); // MSG_ACCEPTED
>  put32(0); // opaque_auth flavor = AUTH_NULL
>  put32(0); // opaque_auth length
>  put32(0); // SUCCESS
>
>  if(proc == 0){
>    parse_nop();
>  } else if(proc == 1){
>    parse_compound();
>  } else {
>    printf("unknown rpc proc %d\n", proc);
>  }
>}
>
>void
>put_rpc_header(int proc)
>{
>  int xid = 1;
>  put32(xid++);
>  put32(0); // mtype=CALL
>  put32(2); // rpc version
>  put32(100003); // prog #
>  put32(4); // prog vers
>  put32(proc); // proc
>  if(proc == 0){
>    put32(0); // cred type
>    put32(0); // cred len
>  } else {
>    put32(1); // cred type AUTH_SYS / AUTH_UNIX
>    put32(32); // cred length
>    put32(0); // stamp
>    put_opaque(9, "localhost");
>    put32(65534); // uid
>    put32(65534); // gid
>    put32(0); // # gids
>  }
>  put32(0); // verf type
>  put32(0); // verf len
>}
>
>int
>main(){
>  setlinebuf(stdout);
>  struct rlimit r;
>  r.rlim_cur = r.rlim_max = 0;
>  setrlimit(RLIMIT_CORE, &r);
>
>  system("hostname junk.doesnotexist.org");
>  system("/etc/rc.d/nfscbd onestart");
>
>  int s = socket(AF_INET, SOCK_STREAM, 0);
>  struct sockaddr_in sin;
>  memset(&sin, 0, sizeof(sin));
>  sin.sin_family = AF_INET;
>  sin.sin_port = htons(2049);
>  int yes = 1;
>  setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &yes, sizeof(yes));
>  if(bind(s, (struct sockaddr *)&sin, sizeof(sin)) < 0){
>    perror("bind"); exit(1);
>  }
>  listen(s, 10);
>
>#if SYM
>  sync(); sleep(1); sleep(1); sleep(1);
>  asm volatile("addi x0, x0, 0x379");
>#endif
>
>  int pid1 = fork();
>  if(pid1 == 0){
>    close(s);
>    sleep(1);
>    if(system("echo -n mount: ; mount_nfs -o nfsv4,minorversion=2,pnfs 127.0.0.1:/tmp /mnt") == 0){
>      if(0){
>        printf("statfs: "); fflush(stdout);
>        struct statfs sb;
>        int ret = statfs("/mnt/.", &sb);
>        printf("statfs -> %d\n", ret);
>      }
>      if(0){
>        int fd = open("/mnt", 0);
>        if(fd < 0) { perror("/mnt"); exit(1); }
>        off_t base = 0;
>        char buf[4096];
>        ssize_t ret = getdirentries(fd, buf, sizeof(buf), &base);
>        printf("getdirentries ret %ld errno %d\n", ret, errno);
>        if(ret < 0) perror("getdirentries");
>        close(fd);
>      }
>      if(0){
>        int fd = open("/mnt/x", 0);
>        printf("open /mnt/x -> %d errno %d\n", fd, errno);
>        if(fd < 0) perror("/mnt/x");
>        close(fd);
>      }
>      if(1){
>        int fd = open("/mnt/new", O_RDWR|O_CREAT, 0666);
>        printf("creat /mnt/new -> %d errno %d\n", fd, errno);
>        if(fd < 0) perror("/mnt/new");
>        if(write(fd, "x", 1) < 0) perror("write");
>        lseek(fd, 0L, 0);
>        char buf[512];
>        read(fd, buf, sizeof(buf));
>        //mkdir("/mnt/new/newnew", 0777);
>        //if(unlink("/mnt/new") < 0) perror("unlink");
>        //close(fd);
>        if(flock(fd, LOCK_EX) < 0) perror("flock");
>        sleep(1);
>      }
>      if(0){
>        int ret = mkdir("/mnt/d", 0777);
>        printf("mkdir /mnt/d -> %d errno %d\n", ret, errno);
>        if(ret < 0) perror("mkdir /mnt/d");
>        if(chdir("/mnt/d") == 0){
>          printf("chdir succeeded\n");
>          if(creat("newnewnew", 0666) < 0) perror("create newnewnew");
>          unlink("newnewnew");
>        } else {
>          perror("chdir /mnt/d");
>        }
>        creat("/mnt/d/newnew", 0666);
>        rmdir("/mnt/d");
>      }
>      if(0){
>        system("setfacl -m owner@:rwxp::allow /mnt/x");
>        system("getfacl /mnt/x");
>      }
>      if(0){
>        int fd = open("/mnt/new", O_RDWR|O_CREAT, 0666);
>        if(fd < 0) perror("open /mnt/new");
>        char buf[32];
>        memset(buf, 1, sizeof(buf));
>        if(write(fd, buf, sizeof(buf)) < 0) perror("write");
>        lseek(fd, (off_t)0, 0);
>        int fd2 = creat("/mnt/newnew", 0666);
>        if(fd2 < 0) perror("creat /mnt/newnew");
>        off_t o1 = 0;
>        off_t o2 = 0;
>        if(copy_file_range(fd, &o1, fd2, &o2, 16, 0) < 0) perror("copy_file_range");
>      }
>      //system("echo -n ls: ; ls -l /mnt");
>      //system("echo -n ls: ; ls -l /mnt/. /mnt/z");
>      //system("echo -n echo: ; echo hi > /mnt/x");
>      //system("echo -n dd: ; dd if=/mnt/y of=/dev/null bs=512 count=1");
>      //system("echo -n umount: ; umount /mnt");
>    }
>    exit(0);
>  }
>
>  int pid2 = fork();
>  if(pid2 == 0){
>#if SYM
>    for(int i = 0; i < NAA; i++) aa[i] = symx();
>#endif
>
>    while(1){
>      socklen_t sinlen = sizeof(sin);
>      printf("calling accept\n");
>      int s1 = accept(s, (struct sockaddr *) &sin, &sinlen);
>      printf("accept returned %d\n", s1);
>      if(s1 < 0) { perror("accept"); exit(1); }
>      
>      while(1){
>        if(readn(s1, &ilen, 4) < 0) break;
>        ilen = ntohl(ilen);
>        ilen &= 0x7fffffff;
>        if(readn(s1, ibuf, ilen) < 0) break;
>        oi = ii = 0;
>        put32(0); // place-holder for length
>        parse_rpc();
>#if 1
>        if(symstart != -1){
>          for(int i = 0; i < 16; i++)
>            put32(0xffffffff);
>        }
>#endif
>        *(int*)(obuf+0) = htonl((oi - 4) | 0x80000000);
>        if(aai > NAA){
>          printf("oops aai %d NAA %d\n", aai, NAA);
>          exit(1);
>        }
>        if(symstart != -1){
>          for(int i = symstart; i < oi && aai < NAA; i += 8)
>            *(unsigned long long *)(obuf + i) ^= aa[aai++];
>          symstart = -1;
>        }
>        if(oi > 0){
>          if(write(s1, obuf, oi)<=0) perror("write");
>        }
>
>        if(send_back){
>          send_back = 0;
>          oi = 0;
>          put32(0); // dummy length
>          put_rpc_header(1);
>          put_opaque(0, ""); // compound tag
>          put32(2); // minor version
>          put32(1); // operations in the compound
>          for(int i = 0; i < 32; i++)
>            put32(0xffffffff);
>          int xoi = 3*4;
>          for(int i = xoi; i < oi && aai < NAA; i += 8)
>            *(unsigned long long *)(obuf + i) ^= aa[aai++];
>          *(int*)(obuf+0) = htonl((oi - 4) | 0x80000000);
>          if(write(s1, obuf, oi)<=0) perror("write");
>        }
>      }
>      close(s1);
>    }
>    exit(1);
>  }
>  close(s);
>  sleep(20);
>  if(system("dmesg | grep 'unhandled sig'") == 0){
>   printf("unhandled signal\n"); while(1){}
>  }
>#if SYM
>  asm volatile("addi x0, x0, 0x380");
>#endif
>}

Actions: View

Attachments on bug 260266: 229961 | 229981