Commit Graph

12484 Commits

Author SHA1 Message Date
Michael Meffie
4b698db319 util: fix file descriptor leak in mrafs-style logging
When MR-AFS style logging is in effect, the SIGHUP signal handler will rename
then create a new, empty server log file to support log rotation.

Unfortunately, the old log file descriptor is not closed, so each SIGHUP
signal will leak one file descriptor.

Be sure to close the current log file descriptor before opening the log again.
The OpenLog() routine will move the current log file to a new file, with a
timestamp string appended to the log file, then open the server log file with
truncate flag to start a new log file.

Change-Id: Ic3f29607fa50ed868b9245865e375dedde438471
Reviewed-on: https://gerrit.openafs.org/11722
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
2016-04-25 00:05:35 -04:00
Michael Meffie
db74758924 util: fix log file renaming of mrafs-style logs
Do not make timestamped log files with an invalid number of seconds when
renaming old mrsafs-style log files, i.e., more than 59 seconds in the
seconds field.

Replace the goto used in the mrafs-style make file name retries with a
regular, bounded loop.

Change-Id: I16d032197e4b1e227b1f005fbc395a013e099561
Reviewed-on: https://gerrit.openafs.org/12220
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
2016-04-25 00:05:06 -04:00
Michael Meffie
721c3737c7 util: remove unused printLocks variable from mrafs-style logs
Remove the unused printLocks variable, which was added in commit,
86f1dc2117 "mrafs-server-log-handling-20010212"
but never used.

Change-Id: I64459cf93e86352ef16d9526e46847cbb4997f10
Reviewed-on: https://gerrit.openafs.org/11719
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
2016-04-25 00:04:37 -04:00
Michael Meffie
340ec2f792 util: allocate log filename buffers
Allocate the ourName buffer to save the log filename during OpenLog(),
instead of trying to copy the log filename to a fixed size buffer.
Deallocate this buffer when the log is closed with CloseLog().  Save the
log file name even when MR-AFS style logging is not effect to allow
ReOpenLog() to use the saved filename in a later commit.

Dynamically allocate a buffer when formatting a file name for log
rotation instead of using a fixed size buffer on the stack.  Allocate
the buffer for both traditional Transarc-style log file renaming
(appending ".old" to the log filename) and the MR-AFS style logging
(appending a timestamp to the log filename).

Change-Id: Ie217a93b271b48ccfc7b5244ad3a8c949d55ef54
Reviewed-on: https://gerrit.openafs.org/12219
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
2016-04-25 00:04:15 -04:00
Michael Meffie
1a72f4a917 util: open mrafs-style logs with O_APPEND too
Commit b71a041364 added the O_APPEND flag when
opening the log file to allow sites to use logrotate's "copy and truncate"
feature.

Add the O_APPEND to MR-AFS style logs as well so MR-AFS style logs can also be
handled correctly with logrotate, we have consistent open flags, and can remove
a duplicate call to open the log file descriptor.

Change-Id: I8370838e1e2c7ddaa042508d6b9cbe1299339f68
Reviewed-on: https://gerrit.openafs.org/12218
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
2016-04-25 00:03:45 -04:00
Michael Meffie
22da8ad7af util: remove obsolete SETVBUF_REVERSED
Commit 8af5762909 "Clean up some
obsolete Autoconf code" removed the obsolete autoconf check
AC_FUNC_SETVBUF_REVERSED and one use of the results, but
overlooked another instance; remove it.

Change-Id: Id62a2a96b911c0d16d51d8cce0966ae3736bde87
Reviewed-on: https://gerrit.openafs.org/11718
Reviewed-by: Chas Williams <3chas3@gmail.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Reviewed-by: Perry Ruiter <pruiter@sinenomine.net>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
2016-04-25 00:03:25 -04:00
Michael Meffie
5e49cb98ac util: always initialize the server log mutex
Be sure to always initialize the server log mutex. Use pthread_once to
ensure the mutex is initialized only once.

Before this change the server log mutex was not properly initialized
with pthread_mutex_init when logging to the syslog.

Change-Id: Ief2ee6b373f7309bc05061f7413b6ff623b86e31
Reviewed-on: https://gerrit.openafs.org/11717
Reviewed-by: Chas Williams <3chas3@gmail.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
2016-04-25 00:02:55 -04:00
Michael Meffie
661f73beeb util: fix server log fd validity checks
Do not assume the server log file descriptor cannot be zero.

Thanks to Chas Williams for spotting this bug.

Change-Id: I0d264828926bf8cd765b45db4e529233b8686404
Reviewed-on: https://gerrit.openafs.org/11797
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
2016-04-25 00:02:33 -04:00
Michael Meffie
ee1e344cef util: remove util/softsig
Remove the old util/softsig implementation, which has been replaced by
opr/softsig.

Change-Id: Ie32f04129dd0b09a8baf9f6739abf53fbf1b98eb
Reviewed-on: https://gerrit.openafs.org/11998
Reviewed-by: Perry Ruiter <pruiter@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
2016-04-25 00:02:14 -04:00
Michael Meffie
83fcf5d698 ptserver: convert the ptserver to opr softsig
Convert the ptserver from regular signal handling to the opr soft
signal handling when built with pthreads. This makes it safe to call
pthread functions within signal handlers.

Change-Id: I43d345517c75e275d6896154a979a908181a1f39
Reviewed-on: https://gerrit.openafs.org/11997
Reviewed-by: Perry Ruiter <pruiter@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
2016-04-25 00:00:39 -04:00
Michael Meffie
803d15b6aa vlserver: convert the vlserver to opr softsig
Convert the vlserver from regular signal handling to the opr soft
signal handling when built with pthreads. This makes it safe to call
pthread functions within signal handlers.

Change-Id: Ic9bd841c4796bd64b603505541da7e767afda83e
Reviewed-on: https://gerrit.openafs.org/11996
Reviewed-by: Perry Ruiter <pruiter@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
2016-04-25 00:00:19 -04:00
Michael Meffie
e0d7f9b591 volser: convert the volume server to opr softsig
Convert the volume server from regular signal handling to the opr soft
signal handling when built with pthreads. This makes it safe to call
pthread functions within signal handlers.

Change-Id: I25b9a9184c526f4ce9b6e2abb25ae9135cc97ec6
Reviewed-on: https://gerrit.openafs.org/11995
Reviewed-by: Perry Ruiter <pruiter@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
2016-04-24 23:59:58 -04:00
Michael Meffie
093fdd6c4c viced: convert the fileserver to opr softsig
Convert the fileserver from the obsolete softsig routines to the modern opr
softsig routines for pthreaded programs.

Change-Id: I9e98e402f73ebca05fcaf0f852055b9a5ad93632
Reviewed-on: https://gerrit.openafs.org/11994
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
2016-04-24 23:59:39 -04:00
Michael Meffie
97d02926d3 viced: remove old signal handler wrappers
Remove remnants of old lwp thread signal handler wrapper functions from
the fileserver. The lwp softsig handlers required a function which was
passed a void pointer argument and returned a void pointer.  Tidy the
code by removing the unneeded wrappers and use the signal handler
functions directly.

Change-Id: I3d52efe659b03ee9a9484ec7a9d74404f1970278
Reviewed-on: https://gerrit.openafs.org/11921
Reviewed-by: Chas Williams <3chas3@gmail.com>
Reviewed-by: Mark Vitale <mvitale@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
2016-04-24 23:57:00 -04:00
Michael Meffie
b5c2d7d3d5 util: softsig version of function to setup logging signal handlers
Provide a new routine to setup the server log signals which registers
soft signal handlers for the common log management signals (SIGTSTP and
SIGHUP). Keep the old SetupLogSignals() routine around while lwp still
exists.

Change-Id: Ic9151c7ad25528e8e4008a4567836e4196cbe8c3
Reviewed-on: https://gerrit.openafs.org/12238
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
2016-04-24 23:56:29 -04:00
Michael Meffie
524d92b497 Windows: opr_softsig.h
Make the opr softsig header file available in the windows builds
so it can be included unconditionally in the code base.

Change-Id: I19a75ce060e20b525d83ec5bed42d3168362d852
Reviewed-on: https://gerrit.openafs.org/12237
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
2016-04-24 23:56:14 -04:00
Michael Meffie
22030429fc procmgmt: wrappers for softsig handlers
Provide procmgmt wrappers for Windows environments which match the opr_softsig
functions. This allows builds of the windows servers continue to use the
existing process management signal handling functions, without introducing
additional conditional compilation in the server code.

Change-Id: I0ac287bde294996fb7f32c19370f2992a0af2a58
Reviewed-on: https://gerrit.openafs.org/12236
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
2016-04-24 23:55:56 -04:00
Michael Meffie
24fed351fd salvager: convert salvager and salvagerserver to libutil logging
Use the libutil logging facility in the salvager and DAFS salvageserver
in order to have consistent logging features and time stamp formats with
the other OpenAFS servers.

Change-Id: I8352d7e16b4a9f96b814a3b5c0b3b79a7c48e4bc
Reviewed-on: https://gerrit.openafs.org/12003
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
2016-04-24 23:55:35 -04:00
Jonathon Weiss
9c6e6d4c34 Find Tivoli TSM headers in 64 bit location
When building with --enable-tivoli-tsm locate the Tivoli TSM headers
if they are installed in the path used by the 64 bit Tivoli TSM
installation.

Change-Id: I4f114a4ada1babcbe1e52f451f10e78d861b7fd0
Reviewed-on: https://gerrit.openafs.org/12258
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Mark Vitale <mvitale@sinenomine.net>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
2016-04-18 12:01:00 -04:00
Michael Meffie
5c136c7d93 afs: shake harder in shake-loose-vcaches
Linux based cache managers will allocate vcaches on demand and
deallocate batches of vcaches in the background. This feature is called
dynamic vcaches.

Vcaches to be deallocated are found by traversing the vcache LRU list
(VLRU) from the oldest vcache to the newest. Up to a target number of
vcaches are attempted to be evicted.  The afs_xvcache lock protecting
the VLRU may be dropped and re-acquired while attempting to evict a
vcache. When this happens, it is possible the VLRU may have changed, so
the traversal of the VLRU is restarted.  This restarting of the VLRU
transversal is limited to 100 iterations to avoid looping indefinitely.

Vcaches which are busy cannot be evicted and remain in the VLRU. When a
busy cache was not evicted and the afs_xvache lock was dropped, the VLRU
traversal is restarted from the end of the VLRU. When the busy vcache is
encountered on the retry, it will trigger additional retries until the
loop limit is reached, at which point the target number of vcaches will
not be deallocated.

This can leave a very large number of unbusy vcaches which are never
deallocated.  On a busy machine, tens of millions of unused vcaches can
remain in memory. When the busy vcache at the end of the VLRU is finally
evicted, the log jam is broken, and the background deamon will hold the
afs_xvcache lock for an excessively long time, hanging the system.

Fix this by moving busy vcaches to the head of the VLRU before
restarting the VLRU traversal. These busy vcaches will be skipped when
retrying the VLRU traversal, allowing the cache manager to make progress
deallocating vcaches down to the target level.

This was already done on the mac osx platform while attempting to evict
vcaches. Move the code to move busy vcaches to the head of the VLRU up
the the platform agnostic caller.

Thanks to Andrew Deason for the initial version of this patch.

Change-Id: I7768d00604e56d8d5369ac5215f7c2ab7996c4eb
Reviewed-on: https://gerrit.openafs.org/11654
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Andrew Deason <adeason@dson.org>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
2016-04-12 22:16:59 -04:00
Michael Meffie
961875cbed LINUX: hold vcache while dropping dcache refs
Hold a reference on a vcache while attempting to evict the inode from
the dcache. Since the afs_xvcache lock is dropped, it could be possible
for the vcache to be flushed during this time, making it unsafe to use
the vcache after the eviction attempt.

Change-Id: I9d91db98387b7aaa986ed915420c6cafb4f12438
Reviewed-on: https://gerrit.openafs.org/12206
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Andrew Deason <adeason@dson.org>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
2016-04-12 22:16:51 -04:00
Stephan Wiesand
3609ebcfa3 Linux: Fix misleading indentation and other whitespace
Commit 7edc6694e7 introduced a
misleading indentation of a line in afs_linux_prefetch. Correct
it, and once here remove trailing whitespace throughout the file.

Change-Id: Idab888bb72c782bfd25c7fc81316eb1b65c0d128
Reviewed-on: https://gerrit.openafs.org/12253
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
2016-04-07 13:47:44 -04:00
Benjamin Kaduk
808b156bd8 Fix typo in cm_dcache.c
Commit b85c5f9339 introduced a new
memset() but left out a prenthesis.

In the absence of a windows build machine, this error went unnoticed.

Reported by Mark Vitale.

Change-Id: Ie250163029132896cd70dc822c6170913e83dafe
Reviewed-on: https://gerrit.openafs.org/12241
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Tested-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Stephan Wiesand <stephan.wiesand@desy.de>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
2016-04-06 10:04:41 -04:00
Marcio Barbosa
a3fa6dabf4 doc: add missing angle bracket
The options -logfile and -config should be enclosed
by angle brackets.

Change-Id: I9e5767b7e43753b37dbc8d86c5346c778f8bab8d
Reviewed-on: https://gerrit.openafs.org/12233
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
2016-03-28 21:07:56 -04:00
Stephan Wiesand
ae5f411c3b Linux 4.4: Do not use splice()
splice() may return -ERESTARTSYS if there are pending signals, and
it's not even clear how this should be dealt with. This potential
problem has been present for a long time, but as of Linux 4.4
(commit c725bfce7968009756ed2836a8cd7ba4dc163011) seems much more
likely to happen.

Until resources are available to fix the code to handle such errors,
avoid the riskier uses of splice().

If there is a default implementation of file_splice_{write,read},
use that; on somewhat older kernels where it is not available,
use the generic version instead.

[kaduk@mit.edu: add test for default_file_splice_write]

Change-Id: Ib4477cdfb2cd0f49f516da75edc3cb9d1a8817dc
Reviewed-on: https://gerrit.openafs.org/12217
Reviewed-by: Chas Williams <3chas3@gmail.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
2016-03-21 13:33:08 -04:00
Michael Laß
58d82226a5 Linux 4.4: Use locks_lock_file_wait
The locks API was changed in Linux 4.4, introducing locks_lock_file_wait
(e55c34a66f87e78fb1fc6b623b78c5ad74b475af) and removing
flock_lock_file_wait (616fb38fa7a9599293e05ae1fa9acfaf73922434).

locks_lock_file_wait can be used as a drop-in replacement so define
flock_lock_file_wait as an alias for it.

Change-Id: Iba89a43c651737c86cbf519a933289d97c25a467
Reviewed-on: https://gerrit.openafs.org/12170
Reviewed-by: Mark Vitale <mvitale@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
2016-03-21 13:00:16 -04:00
Michael Laß
5067ee3ae1 Linux 4.4: key_payload has no member 'value'
In Linux 4.4 (146aa8b1453bd8f1ff2304ffb71b4ee0eb9acdcc) type-specific and
payload data have been merged. The payload is now accessed directly and has
no 'value' member anymore.

FIXES 132677

Change-Id: Id26c40c80314a0087ecc0735029412787058ef07
Reviewed-on: https://gerrit.openafs.org/12169
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Mark Vitale <mvitale@sinenomine.net>
Tested-by: Mark Vitale <mvitale@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
2016-03-21 12:19:04 -04:00
Chas Williams
279f9c54b4 Remove automated casting in rxgen
We should let the compiler warn us when we attempt to convert types that
should not be converted.

Change-Id: Ie9f5f6ab5d5978bbe5e741b1a20bfb4d36fb314c
Reviewed-on: https://gerrit.openafs.org/12116
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
2016-03-20 23:51:57 -04:00
Chas Williams
9823c57622 rxgen: Don't use size_t in struct rx_opaque with XDR
OpenAFS's XDR doesn't support size_t at this time.  For now, use a
temporary stack variable to avoid 32/64-bit issues and copy back the
returned value upon success.

Change-Id: Ia3dd8abd665a19e04aa611f940728d088a8f87b7
Reviewed-on: https://gerrit.openafs.org/12115
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
2016-03-20 23:14:00 -04:00
Chas Williams
5aa6d4a26a Refactor printing arguments to the xdr routines
This makes some future changes a bit easier to read and implement.

Change-Id: I48eafa67659739865f43a0bcfe1f8a897a7a8940
Reviewed-on: https://gerrit.openafs.org/12114
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
2016-03-20 23:13:54 -04:00
Michael Meffie
f99c1ec32b doc: fs examine no longer requires read rights on the volume root vnode
Update the man page to reflect the current access rights required for fs
examine.  Historically, fs examine required read access on the root
vnode of the volume housing the directory or file being examined.  This
access check was relaxed in commit d2d591caf2,
since the information returned by the file server is already available
anonymously by other means.

Change-Id: If62b625bce8a260b98fb56a6feec49c674f2de53
Reviewed-on: https://gerrit.openafs.org/12223
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: Benjamin Kaduk <kaduk@mit.edu>
2016-03-19 15:53:03 -04:00
Benjamin Kaduk
02a393de6b Add param files for FreeBSD 10.2, 10.3
FreeBSD 10.3 is in the beta stage now; better get ready for it.

Change-Id: I2a6b6144916f13768bfad27af5eb5340e039939b
Reviewed-on: https://gerrit.openafs.org/12222
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
2016-03-19 15:50:41 -04:00
Benjamin Kaduk
e63c2570f9 OPENAFS-SA-2016-002 ListAddrByAttributes information leak
The ListAddrByAttributes structure is used as an input to the GetAddrsU
RPC; it contains a Mask field that controls which of the other fields
will actually be read by the server during the RPC processing.
Unfortunately, the client only wrote to the fields indicated by the
mask, leaving the other fields uninitialized for transmission on the
wire, leaking some contents of client memory.

Plug the information leak by zeroing the entire structure before use.

FIXES 132847

Change-Id: I9ccf814ceff206ddb3a74da97dc50b7e1e3c2014
2016-03-16 00:04:00 -04:00
Benjamin Kaduk
c12b3fee2f OPENAFS-SA-2016-002 VldbListByAttributes information leak
The VldbListByAttributes structure is used as an input to several
RPCs; it contains a Mask field that controls
which of the other fields will actually be read by the server
during the RPC processing.  Unfortunately, the client only
wrote to the fields indicated by the mask, leaving the other
fields uninitialized for transmission on the wire, leaking
some contents of client memory.

Plug the information leak by zeroing the entire structure before use.

FIXES 132847

Change-Id: I14964e98a57ba6ef060c6e392497f1ebd3afe042
2016-03-16 00:04:00 -04:00
Benjamin Kaduk
67646c7c90 OPENAFS-SA-2016-002 AFSStoreVolumeStatus information leak
The AFSStoreVolumeStatus structure is used as an input to the
RXAFS_SetVolumeStatus RPC; it contains a Mask field that controls
which of the other fields will actually be read by the server
during the RPC processing.  Unfortunately, the client only
wrote to the fields indicated by the mask, leaving the other
fields uninitialized for transmission on the wire, leaking
some contents of kernel memory.

Plug the information leak by zeroing the entire structure before use.

FIXES 132847

Change-Id: Ib309e6b00b95bc4178740352899d7f940f2eb1ea
2016-03-16 00:04:00 -04:00
Benjamin Kaduk
b85c5f9339 OPENAFS-SA-2016-002 AFSStoreStatus information leak
Marc Dionne reported that portions of the AFSStoreStatus structure
were not written to before being sent over the network for
operations such as create, symlink, etc., leaking the contents
of the kernel stack to observers.  Which fields in the request
are used are controlled by a flags field, and so if a field was
not going to be used by the server, it was sometimes left
uninitialized.

Fix the information leak by zeroing out the structure before use.

FIXES 132847

Change-Id: I84a5a10442732ebbcb5d5067ca22030fb795168b
2016-03-16 00:04:00 -04:00
Jeffrey Altman
d853866c56 OPENAFS-SA-2016-001 group creation by foreign users
CVE-2016-2860:

In AFS 3.3 as part of the addition of the cross-cell support for foreign
user auto-registration a bug was introduced that permits foreign users
to create arbitrary groups as if they were system administrators.  This
permits the groups to be created without any group quota checks, and
using group names that non-administrators would not normally be able to
create, such as groups with the "system:" prefix or groups with no colon
(that is, in the namespace for users).

Additionally, all entries created using the auto-registration service
were marked as being created by system:administrators.  This behavior
should not be changed on the stable release branch, but for the next
release the behavior will change to show these entries as being
self-created, to better reflect reality.

FIXES 132822

[kaduk@mit.edu: reword commit message, minor style adjustments]

Change-Id: I54ddca3e4e1339f76ed320f0d6c53d8820aed89c
2016-03-16 00:04:00 -04:00
Jeffrey Altman
e3bb92c2a0 ptserver: fix pt_util creation of groups
In commit 53ac98931a the adjustment of
owner id was moved from CreateEntry() into CreateGroupName().  This was
done for two reasons:

 1. to reuse the computation of "is administrator" within
    CreateGroupName() in order to permit the owner id to be set
    to the invalid values 0 and ANONYMOUSID.

 2. to allow the owner id to be altered in ChangeEntry().

Unfortunately, CreateEntry() needs to be able to alter the owner id
when creating users not only groups.

This change moves the computation of "is administrator" and the
owner id assignment to CreateEntry() and ChangeEntry().

Change-Id: I0d37f5a43ea5919d1bbc3ba6d82b2924ab38befc
2016-03-16 00:04:00 -04:00
Michael Meffie
b702ab5da2 LINUX: ifconfig is deprecated
ifconfig is deprecated and is no longer installed by default on RHEL 7 and
Centos 7. Use the replacement ip command in the init script for linux.
Fallback to ifconfig in the event the ip command is not available.

Thanks to Ben Kaduk for pointing out the hash built-in command.

Change-Id: I7ffe272eb712cd83a70a7d880d239f72b40cb5df
Reviewed-on: http://gerrit.openafs.org/12192
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Chas Williams <3chas3@gmail.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
2016-02-28 15:36:56 -05:00
Mark Vitale
d833ba7680 DAFS: large volume support - fileserver crash after "addled bitmap"
Any DAFS fileserver operation that allocates a new vnode but fails
to update the vnode index will crash:

"Fatal Rx error: assertion failed: --vp->nWaiters >= 0,
				file: ../vol/volume.c, line: nnnn"

Note: This crash was exposed by other bugs (to be addressed in future
commits) in OpenAFS large volume support.  However, there may
be other failure paths (unrelated to large volumes) that expose
this error as well.

When VAllocVnode() must allocate a new vnode but fails while
updating the vnode index file (e.g. an "addled bitmap" due to other
bugs in working with a vnode index larger than 2^31 bytes), it branches
to common recovery logic at label error_encountered:.

Part of this recovery is to call VFreeBitmapEntry_r().  Commit
08ffe3e81d added a VOL_FREE_BITMAP_WAIT
flag to VFreeBitmapEntry() in order to prevent races with VAllocBitmapEntry().
If the caller specifies VOL_FREE_BITMAP_WAIT, VFreeBitmapEntry_r will
call VCreateReservation_r() and VWaitExclusiveState_r().  However, the
exit from VFreeBitmapEntry_r() calls VCancelReservation_r() unconditionally.
This works correctly with the majority of callers to VFreeBitmapEntry_r,
which do specify the VOL_FREE_BITMAP_WAIT flag.

However, the VAllocVnode() error_encountered logic must specify 0 for
this flag because the thread is already in an exclusive state
(VOL_STATE_VNODE_ALLOC).  This correctly causes VFreeBitmapEntry_r() to
forgo both the reservation and wait-for-exclusive-state.  However, before
exit it erroneously calls VCancelReservation_r().  We now have unbalanced
reservations (nWaiters); this causes an assert when the VAllocVnode()
error_encountered recovery code later calls VCancelReservation_r()
for what it believes is its own prior reservation.

Modify VFreeBitmapEntry_r() to make its final VCancelReservation_r()
conditional on flag VOL_FREE_BITMAP_WAIT.

Change-Id: Id6cf6b1279b11e6dfc4704bba5739912f663beca
Reviewed-on: http://gerrit.openafs.org/11983
Reviewed-by: Perry Ruiter <pruiter@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
2016-02-22 23:54:25 -05:00
Mark Vitale
cc79ca882d bozo: allow start of fs and dafs bnodes with options
fs_create() and dafs_create() issue stat() to verify
the existence of each executable specified in the bnode.
However, commit fda2bc8747
inadvertently removed the code that stripped any command
arguments before the stat().  Therefore, any bnode that
specifies arguments (e.g. /usr/afs/bin/dafileserver -d 5),
causes the stat() to fail and the bnode will not start.

Rename function AppendExecutableExtension() to a less
"window-ish" name: PathToExecutable().

Modify the Windows version of PathToExecutable()
to properly strip arguments.

Reimplement the Unix macro as function PathToExecutable()
that properly strips arguments.

Change-Id: I04f7ce2afb8211bd12b9063db1335738bff1cc1e
Reviewed-on: http://gerrit.openafs.org/11934
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Mark Vitale <mvitale@sinenomine.net>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Tested-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
2016-02-22 23:23:38 -05:00
Mark Vitale
44349d0694 viced: incorrect FID audit of BulkStatus and InlineBulkStatus
The audit code for object AUD_FIDS is off by one - we list the
first FID twice and skip the last FID.

Repair so all FIDs are properly audited.

Change-Id: I99f4687e25031eb26ccd7e07b732217b098005de
Reviewed-on: http://gerrit.openafs.org/12191
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Chas Williams <3chas3@gmail.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
2016-02-17 14:06:42 -05:00
Michael Meffie
c0876aa6b5 test: skip buserror test when SIGBUS is not defined in perl POSIX module
Older versions of the perl POSIX module do not define the SIGBUS symbol, which
causes the opr/softsig-t perl test to fail to compile.  Instead of trying to
defined SIGBUS, which may be platform dependent, skip the buserror unit test on
these older platforms.

Change-Id: Ib8cfd77215ea43566e9d47b501d4989556b83734
Reviewed-on: http://gerrit.openafs.org/12186
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
2016-02-10 23:47:52 -05:00
Michael Meffie
378eae1d53 CellServDB update 01 Jan 2016
Update all remaining copies of CellServDB in the tree, and make the
Red Hat packaging use it by default too.

Change-Id: Idf9d97151b8e9075fefa7aece58fd023bfd857ff
Reviewed-on: http://gerrit.openafs.org/12187
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
2016-02-10 23:46:26 -05:00
Michael Meffie
ed52d65fe9 volser: detect eof in dump stream while reading acl
Detect an EOF condition while reading the ACL in a dump stream
and return a restore error, instead of filling the ACL with
0xFF and then failing the restore due to an invalid tag.

Change-Id: If7a71946c81f47ac68ed2f7afdfca1023bad3baf
Reviewed-on: http://gerrit.openafs.org/11703
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
2016-02-03 23:32:05 -05:00
Benjamin Kaduk
97150150e6 cellconfig: check for invalid dotted quads
IP addresses entered into the CellServDB with components larger
than 255 would silently be trucated down to 8-bit unsigned integer
representations.  This could cause confusing behavior with
occasional hangs.

FIXES 131794

Change-Id: I44834cb4662e178fdb4be2eeb03ad58d2fa7c556
Reviewed-on: http://gerrit.openafs.org/12109
Reviewed-by: Chas Williams <3chas3@gmail.com>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
2016-01-26 12:06:30 -05:00
Andrew Deason
11845765c7 afs: Log abnormally large chunk files
Any chunk in our cache for a regular file should be smaller than or
equal to our configured chunksize. If someone sets a chunk to be
larger than that, it is very strange and may cause other confusing
issues. Specifically, afs_DoPartialWrite determines if our cache is
"too full" by counting the number of dirty chunks. If we have a dirty
chunk that is much larger than the chunksize, it can throw off the
afs_DoPartialWrite calculation.

This is only true for dcaches backing regular files, though. For
directories, we fetch the entire directory into a single chunk file,
and the size of a directory blob can easily exceed the chunksize
without issues. The aforementioned issue with afs_DoPartialWrite does
not apply, since directory chunks cannot be dirty (we only locally
modify the chunk if we modify the dir on the server, and the DVs
match).

Anyway, it should not be possible to get a chunk for a regular file
larger than the chunksize. Log a message if it does occur, to help
assist anyone in tracking down issues when this does occur.

[mmeffie@sinenomine.net remove unnecessary casts in afs_warn args.]

Change-Id: I5cf58e3659dc04255c62fa56b044d5bc1c7ce877
Reviewed-on: http://gerrit.openafs.org/11831
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Chas Williams <3chas3@gmail.com>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
2016-01-24 22:47:25 -05:00
Chas Williams
775b8873f4 opr: Use opr_Assert() instead of silently failing
These routines should never be passed a NULL.  If this happens it
is a serious issue that needs to be addressed.

Change-Id: I9728dcd67bc9f8e9927bed1674fc0ee83567df1a
Reviewed-on: http://gerrit.openafs.org/11853
Tested-by: BuildBot <buildbot@rampaginggeek.com>
Tested-by: Benjamin Kaduk <kaduk@mit.edu>
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
2016-01-24 22:47:02 -05:00
Chas Williams
04661c4139 opr: Disable some warnings during opr assertions
Detect _Pragma(), a C99 extension for inline #pragma's, and use it to
disable to certain warnings during the use of opr_Verify() and
opr_Assert().

Because some versions of clang support _Pragma, do not have support
for -Wtautological-pointer-compare, and do set -Werror and -Wunknown-pragmas,
we must explicitly check for pragma support for -Wtautological-pointer-compare
as well.

Change-Id: Id3d5ee347f320a366a0571572b58414aa7044bf7
Reviewed-on: http://gerrit.openafs.org/11852
Reviewed-by: Michael Meffie <mmeffie@sinenomine.net>
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
2016-01-24 22:46:56 -05:00
Andrew Deason
5fbf45b562 afs: Log weird 'size' fetchdata errors
There are a couple of situations that should never happen when issuing
a fetchdata, but cause errors when they do:

 - The fileserver responds with more than 2^32 bytes of data
 - The fileserver responds with more data than requested (but still
   smaller than 2^32)

While these should normally never be encountered, it can be very
confusing when they do, since they cause file fetches to fail. To give
the user or investigating developer some hope of figuring out what is
going on, at least log a warning in these situations, to at least
indicate this is the area in which something is breaking.

Only log these once, in case something causes these conditions to be
hit, e.g., every fetch. Once is at least enough to say this is
happening.

[mmeffie@sinenomine.net remove unneeded casts in afs_warn args and
explicit static initializers.]

Change-Id: I7561a9ecc225386f9b140e633912b900c591a9bb
Reviewed-on: http://gerrit.openafs.org/11830
Reviewed-by: Benjamin Kaduk <kaduk@mit.edu>
Tested-by: BuildBot <buildbot@rampaginggeek.com>
2016-01-24 21:58:53 -05:00