nfs-server revision 7ddce99911fbb5e44b38ac65e991a22e42267ee9
2N/A#!/sbin/sh
2N/A#
2N/A# CDDL HEADER START
2N/A#
2N/A# The contents of this file are subject to the terms of the
2N/A# Common Development and Distribution License (the "License").
2N/A# You may not use this file except in compliance with the License.
2N/A#
2N/A# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
2N/A# or http://www.opensolaris.org/os/licensing.
2N/A# See the License for the specific language governing permissions
2N/A# and limitations under the License.
2N/A#
2N/A# When distributing Covered Code, include this CDDL HEADER in each
2N/A# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
2N/A# If applicable, add the following below this CDDL HEADER, with the
2N/A# fields enclosed by brackets "[]" replaced with your own identifying
2N/A# information: Portions Copyright [yyyy] [name of copyright owner]
2N/A#
2N/A# CDDL HEADER END
2N/A#
2N/A
2N/A#
2N/A# Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
2N/A# Copyright 2015 Nexenta Systems, Inc. All rights reserved.
2N/A# Copyright 2016 Hans Rosenfeld <rosenfeld@grumpf.hope-2000.org>
2N/A#
2N/A
2N/A# Start/stop processes required for server NFS
2N/A
2N/A. /lib/svc/share/smf_include.sh
2N/A. /lib/svc/share/ipf_include.sh
2N/Azone=`smf_zonename`
2N/A
2N/A#
2N/A# Handling a corner case here. If we were in offline state due to an
2N/A# unsatisfied dependency, the ipf_method process wouldn't have generated
2N/A# the ipfilter configuration. When we transition to online because the
2N/A# dependency is satisfied, the start method will have to generate the
2N/A# ipfilter configuration. To avoid all possible deadlock scenarios,
2N/A# we restart ipfilter which will regenerate the ipfilter configuration
2N/A# for the entire system.
2N/A#
2N/A# The ipf_method process signals that it didn't generate ipf rules by
2N/A# removing the service's ipf file. Thus we only restart network/ipfilter
2N/A# when the file is missing.
2N/A#
2N/Aconfigure_ipfilter()
2N/A{
2N/A ipfile=`fmri_to_file $SMF_FMRI $IPF_SUFFIX`
2N/A ip6file=`fmri_to_file $SMF_FMRI $IPF6_SUFFIX`
2N/A [ -f "$ipfile" -a -f "$ip6file" ] && return 0
2N/A
2N/A #
2N/A # Nothing to do if:
2N/A # - ipfilter isn't online
2N/A # - global policy is 'custom'
2N/A # - service's policy is 'use_global'
2N/A #
2N/A service_check_state $IPF_FMRI $SMF_ONLINE || return 0
2N/A [ "`get_global_def_policy`" = "custom" ] && return 0
2N/A [ "`get_policy $SMF_FMRI`" = "use_global" ] && return 0
2N/A
2N/A svcadm restart $IPF_FMRI
2N/A}
2N/A
2N/Acase "$1" in
2N/A'start')
2N/A # The NFS server is not supported in a local zone
2N/A if smf_is_nonglobalzone; then
2N/A /usr/sbin/svcadm disable -t svc:/network/nfs/server
2N/A echo "The NFS server is not supported in a local zone"
2N/A sleep 5 &
2N/A exit $SMF_EXIT_OK
2N/A fi
2N/A
2N/A # Share all file systems enabled for sharing. sharemgr understands
# regular shares and ZFS shares and will handle both. Technically,
# the shares would have been started long before getting here since
# nfsd has a dependency on them.
# restart stopped shares from the repository
/usr/sbin/sharemgr start -P nfs -a
# Options for nfsd are now set in SMF
/usr/lib/nfs/mountd
rc=$?
if [ $rc != 0 ]; then
/usr/sbin/svcadm mark -t maintenance svc:/network/nfs/server
echo "$0: mountd failed with $rc"
sleep 5 &
exit $SMF_EXIT_ERR_FATAL
fi
/usr/lib/nfs/nfsd
rc=$?
if [ $rc != 0 ]; then
/usr/sbin/svcadm mark -t maintenance svc:/network/nfs/server
echo "$0: nfsd failed with $rc"
sleep 5 &
exit $SMF_EXIT_ERR_FATAL
fi
configure_ipfilter
;;
'refresh')
/usr/sbin/sharemgr start -P nfs -a
;;
'stop')
/usr/bin/pkill -x -u 0,1 -z $zone '(nfsd|mountd)'
# Unshare all shared file systems using NFS
/usr/sbin/sharemgr stop -P nfs -a
# Kill any processes left in service contract
smf_kill_contract $2 TERM 1
[ $? -ne 0 ] && exit 1
;;
'ipfilter')
#
# NFS related services are RPC. nfs/server has nfsd which has
# well-defined port number but mountd is an RPC daemon.
#
# Essentially, we generate rules for the following "services"
# - nfs/server which has nfsd and mountd
# - nfs/rquota
#
# The following services are enabled for both nfs client and
# server, if nfs/client is enabled we'll treat them as client
# services and simply allow incoming traffic.
# - nfs/status
# - nfs/nlockmgr
# - nfs/cbd
#
NFS_FMRI="svc:/network/nfs/server:default"
NFSCLI_FMRI="svc:/network/nfs/client:default"
RQUOTA_FMRI="svc:/network/nfs/rquota:default"
FMRI=$2
file=`fmri_to_file $FMRI $IPF_SUFFIX`
file6=`fmri_to_file $FMRI $IPF6_SUFFIX`
echo "# $FMRI" >$file
echo "# $FMRI" >$file6
policy=`get_policy $NFS_FMRI`
#
# nfs/server configuration is processed in the start method.
#
if [ "$FMRI" = "$NFS_FMRI" ]; then
service_check_state $FMRI $SMF_ONLINE
if [ $? -ne 0 ]; then
rm $file
exit $SMF_EXIT_OK
fi
nfs_name=`svcprop -p $FW_CONTEXT_PG/name $FMRI 2>/dev/null`
tport=`$SERVINFO -p -t -s $nfs_name 2>/dev/null`
if [ -n "$tport" ]; then
generate_rules $FMRI $policy "tcp" $tport $file
fi
tport6=`$SERVINFO -p -t6 -s $nfs_name 2>/dev/null`
if [ -n "$tport6" ]; then
generate_rules $FMRI $policy "tcp" $tport6 $file6 _6
fi
uport=`$SERVINFO -p -u -s $nfs_name 2>/dev/null`
if [ -n "$uport" ]; then
generate_rules $FMRI $policy "udp" $uport $file
fi
uport6=`$SERVINFO -p -u6 -s $nfs_name 2>/dev/null`
if [ -n "$uport6" ]; then
generate_rules $FMRI $policy "udp" $uport6 $file6 _6
fi
# mountd IPv6 ports are also reachable through IPv4, so include
# them when generating IPv4 rules.
tports=`$SERVINFO -R -p -t -s "mountd" 2>/dev/null`
tports6=`$SERVINFO -R -p -t6 -s "mountd" 2>/dev/null`
if [ -n "$tports" -o -n "$tports6" ]; then
tports=`unique_ports $tports $tports6`
for tport in $tports; do
generate_rules $FMRI $policy "tcp" \
$tport $file
done
fi
if [ -n "$tports6" ]; then
for tport6 in $tports6; do
generate_rules $FMRI $policy "tcp" \
$tport6 $file6 _6
done
fi
uports=`$SERVINFO -R -p -u -s "mountd" 2>/dev/null`
uports6=`$SERVINFO -R -p -u6 -s "mountd" 2>/dev/null`
if [ -n "$uports" -o -n "$uports6" ]; then
uports=`unique_ports $uports $uports6`
for uport in $uports; do
generate_rules $FMRI $policy "udp" \
$uport $file
done
fi
if [ -n "$uports6" ]; then
for uport6 in $uports6; do
generate_rules $FMRI $policy "udp" \
$uport6 $file6 _6
done
fi
elif [ "$FMRI" = "$RQUOTA_FMRI" ]; then
iana_name=`svcprop -p inetd/name $FMRI`
# rquota IPv6 ports are also reachable through IPv4, so include
# them when generating IPv4 rules.
tports=`$SERVINFO -R -p -t -s $iana_name 2>/dev/null`
tports6=`$SERVINFO -R -p -t6 -s $iana_name 2>/dev/null`
if [ -n "$tports" -o -n "$tports6" ]; then
tports=`unique_ports $tports $tports6`
for tport in $tports; do
generate_rules $NFS_FMRI $policy "tcp" \
$tport $file
done
fi
if [ -n "$tports6" ]; then
for tport6 in $tports6; do
generate_rules $NFS_FMRI $policy "tcp" \
$tport6 $file6 _6
done
fi
uports=`$SERVINFO -R -p -u -s $iana_name 2>/dev/null`
uports6=`$SERVINFO -R -p -u6 -s $iana_name 2>/dev/null`
if [ -n "$uports" -o -n "$uports6" ]; then
uports=`unique_ports $uports $uports6`
for uport in $uports; do
generate_rules $NFS_FMRI $policy "udp" \
$uport $file
done
fi
if [ -n "$uports6" ]; then
for uport6 in $uports6; do
generate_rules $NFS_FMRI $policy "udp" \
$uport6 $file6 _6
done
fi
else
#
# Handle the client services here
#
if service_check_state $NFSCLI_FMRI $SMF_ONLINE; then
policy=none
ip=any
fi
restarter=`svcprop -p general/restarter $FMRI 2>/dev/null`
if [ "$restarter" = "$INETDFMRI" ]; then
iana_name=`svcprop -p inetd/name $FMRI`
isrpc=`svcprop -p inetd/isrpc $FMRI`
else
iana_name=`svcprop -p $FW_CONTEXT_PG/name $FMRI`
isrpc=`svcprop -p $FW_CONTEXT_PG/isrpc $FMRI`
fi
if [ "$isrpc" = "true" ]; then
tports=`$SERVINFO -R -p -t -s $iana_name 2>/dev/null`
tports6=`$SERVINFO -R -p -t6 -s $iana_name 2>/dev/null`
uports=`$SERVINFO -R -p -u -s $iana_name 2>/dev/null`
uports6=`$SERVINFO -R -p -u6 -s $iana_name 2>/dev/null`
else
tports=`$SERVINFO -p -t -s $iana_name 2>/dev/null`
tports6=`$SERVINFO -p -t6 -s $iana_name 2>/dev/null`
uports=`$SERVINFO -p -u -s $iana_name 2>/dev/null`
uports6=`$SERVINFO -p -u6 -s $iana_name 2>/dev/null`
fi
# IPv6 ports are also reachable through IPv4, so include
# them when generating IPv4 rules.
if [ -n "$tports" -o -n "$tports6" ]; then
tports=`unique_ports $tports $tports6`
for tport in $tports; do
generate_rules $FMRI $policy "tcp" $tport $file
done
fi
if [ -n "$tports6" ]; then
for tport6 in $tports6; do
generate_rules $FMRI $policy "tcp" $tport6 $file6 _6
done
fi
if [ -n "$uports" -o -n "$uports6" ]; then
uports=`unique_ports $uports $uports6`
for uport in $uports; do
generate_rules $FMRI $policy "udp" $uport $file
done
fi
if [ -n "$uports6" ]; then
for uport6 in $uports6; do
generate_rules $FMRI $policy "udp" $uport6 $file6 _6
done
fi
fi
;;
*)
echo "Usage: $0 { start | stop | refresh }"
exit 1
;;
esac
exit $SMF_EXIT_OK