msnfs41client: Patches for |nfs41_SetZeroData()| access checks, docs updates+misc, 2025-02-18
Posted by Anonymous on Tue 18th Feb 2025 17:09
raw | new post

From b913f165fb8aacb7298e26f93d8b75e4f62811dd Mon Sep 17 00:00:00 2001
From: Roland Mainz <roland.mainz@nrubsig.org>
Date: Tue, 18 Feb 2025 10:10:38 +0100
Subject: [PATCH 1/3] cygwin: Add "Windows Server 2022" to the list of
 supported platforms

Add "Windows Server 2022" to the list of supported platforms

Signed-off-by: Cedric Blancher <cedric.blancher@gmail.com>
---
 cygwin/README.bintarball.txt | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/cygwin/README.bintarball.txt b/cygwin/README.bintarball.txt
index 1958023..c5bc86e 100644
--- a/cygwin/README.bintarball.txt
+++ b/cygwin/README.bintarball.txt
@@ -10,7 +10,7 @@
 #
 # 1. What is this ?
 #
-NFSv4.2/NFSv4.1 filesystem driver for Windows 10/11&Windows Server 2019
+NFSv4.2/NFSv4.1 filesystem driver for Windows 10/11&Windows Server 2019+2022


 #
@@ -131,7 +131,7 @@ NFSv4.2/NFSv4.1 filesystem driver for Windows 10/11&Windows Server 2019
 #
 # 3. Requirements:
 #
-- Windows 10 (32bit or 64bit), Windows 11 or Windows Server 2019
+- Windows 10 (32bit or 64bit), Windows 11 or Windows Server 2019+2022
 - Cygwin:
     - Cygwin versions:
         - 64bit: >= 3.5.7 (or 3.6.x-devel)
--
2.45.1

From 39577584e8c2f99390f19eb7f87e93562a9fae3f Mon Sep 17 00:00:00 2001
From: Roland Mainz <roland.mainz@nrubsig.org>
Date: Tue, 18 Feb 2025 10:58:49 +0100
Subject: [PATCH 2/3] cygwin: README.bintarball.txt: Rewording+spelling fixes

README.bintarball.txt: Rewording+spelling fixes

Signed-off-by: Cedric Blancher <cedric.blancher@gmail.com>
---
 cygwin/README.bintarball.txt | 44 ++++++++++++++++++++----------------
 1 file changed, 24 insertions(+), 20 deletions(-)

diff --git a/cygwin/README.bintarball.txt b/cygwin/README.bintarball.txt
index c5bc86e..76ec183 100644
--- a/cygwin/README.bintarball.txt
+++ b/cygwin/README.bintarball.txt
@@ -25,8 +25,9 @@ NFSv4.2/NFSv4.1 filesystem driver for Windows 10/11&Windows Server 2019+2022
     client can use different ports per mount)

 - Support for nfs://-URLs
-    * Why ? nfs://-URLs are crossplatform, portable and Character-Encoding
-      independent descriptions of NFSv4 server resources (exports).
+    * Why ? nfs://-URLs are cross-platform, portable and
+      Character-Encoding independent descriptions of NFSv4 server
+      resources (exports).
     - including custom ports and raw IPv6 addresses
     - nfs://-URL conversion utility (/usr/bin/nfsurlconv) to convert
         URLs, including non-ASCII/Unicode characters in mount path
@@ -68,23 +69,26 @@ NFSv4.2/NFSv4.1 filesystem driver for Windows 10/11&Windows Server 2019+2022
     - Windows Explorer ACL dialog

 - Sparse file support
-    - Requires Cygwin 3.6 and a MFSv4.2 server
-    - Full sparse file support, including creation, punching holes
-      (via NFSv4.2 DEALLOCATE), enumeration of hole&data ranges etc.
+    - Requires NFSv4.2 server which supports the NFSv4.2
+      operations "ALLOCATE", "DEALLOCATE", "SEEK", and the
+      |FATTR4_WORD1_SPACE_USED| attribute.
+    - Full Win32 sparse file API support, including creation,
+      punching holes, enumeration of hole&data ranges etc.
     - Supports Win32 APIs |FSCTL_QUERY_ALLOCATED_RANGES|,
-      |FSCTL_SET_SPARSE|, |FSCTL_SET_ZERO_DATA|; NFSv4.1
-      |FATTR4_WORD1_SPACE_USED| is mapped to Win32
-      |FILE_STANDARD_INFORMATION.AllocationSize| and
-      |NfsV3Attributes.used| EA for sparse file support.
-    - Cygwin >= 3.6 support POSIX-1.2024 |lseek(...,SEEK_HOLE,...)|
-      and |lseek(...,SEEK_DATA,...)|, coreutils /usr/bin/fallocate
-      and $ /usr/bin/cp --sparse=auto src dest #
+      |FSCTL_SET_SPARSE|, |FSCTL_SET_ZERO_DATA|; and
+      |NfsV3Attributes.used| EA
+    - Cygwin sparse file support requires >= Cygwin 3.6 to support
+      POSIX-1.2024 |lseek(...,SEEK_HOLE/SEEK_DATA,...)|, which is
+      needed for coreutils /usr/bin/fallocate and
+      $ /usr/bin/cp --sparse=auto src dest #
     - /cygdrive/c/Windows/system32/fsutil sparse queryrange myfile.dat
       can be used to enumerate ranges where data are allocated
       (BUG: Win10+Win11 fsutil only support 64 data ranges, the
       filesystem itself supports an unlimited number of data ranges)
-    - /cygdrive/c/Windows/system32/xcopy /sparse (on Win11) can be
-      used to copy sparse files
+    - /cygdrive/c/Windows/system32/xcopy /sparse can be
+      used to copy sparse files.
+      Requires on Win11 >= 22H2 because it relies on |CopyFile2()|
+      flag |COPY_FILE_ENABLE_SPARSE_COPY|.

 - Symlink reparse and translation support
     - Translates Win32/NT symlink syntax (e.g.
@@ -304,12 +308,12 @@ $ (set -o xtrace ; cd / && tar -tf ~/download/${bintarball.base_filename}.tar.bz

 # Option a)
 # * Start NFSv4 client daemon as Windows service (requires
-# "Adminstrator" account):
+# "Administrator" account):

 $ sc start ms-nfs41-client-service

 # * Notes:
-# - requires "Adminstrator" account, and one nfsd client daemon is
+# - requires "Administrator" account, and one nfsd client daemon is
 #   used for all users on a machine.
 # - The "ms-nfs41-client-service" service is installed by default as
 #   "disabled" and therefore always requires a "manual" start (e.g.
@@ -472,7 +476,7 @@ $ mount -t drvfs '\0.49.202.230@2049\nfs4\bigdisk' /mnt/bigdisk

 - Cygwin/MSYS2 symlinks are supported, but might require
   $ fsutil behavior set SymlinkEvaluation L2L:1 R2R:1 L2R:1 R2L:1 #.
-  This includes symlinks to UNC paths, e.g. as Admin
+  This includes symlinks to UNC paths, e.g. as Administrator
   $ cmd /c 'mklink /d c:\home\rmainz \\derfwpc5131_ipv6@2049\nfs4\export\home2\rmainz' #
   and then $ cd /cygdrive/c/home/rmainz/ # should work

@@ -482,7 +486,7 @@ $ mount -t drvfs '\0.49.202.230@2049\nfs4\bigdisk' /mnt/bigdisk
 - bad performance due to Windows Defender AntiVirus:
   Option 1:
   # disable Windows defender realtime monitoring
-  # (requires Admin shell)
+  # (requires Administrator shell)
   powershell -Command 'Set-MpPreference -DisableRealtimeMonitoring 1'
   Option 2:
   Add "nfsd.exe", "nfsd_debug.exe", "ksh93.exe", "bash.exe",
@@ -563,7 +567,7 @@ $ mount -t drvfs '\0.49.202.230@2049\nfs4\bigdisk' /mnt/bigdisk
   Working theory is that this is related to FCB caching, see
   |FCB_STATE_FILESIZECACHEING_ENABLED|, as the nfs41_driver.sys
   kernel module does not see the |stat()| syscalls. But $ tail -f ... #
-  always works for a momemnt if something else opens the same file.
+  always works for a moment if something else opens the same file.

 - Unmounting and then mounting the same filesystem causes issues
   as the name cache in nfsd*.exe is not flushed on umount, including
@@ -669,7 +673,7 @@ $ mount -t drvfs '\0.49.202.230@2049\nfs4\bigdisk' /mnt/bigdisk
 - The "msnfs41client" script has the option "watch_kernel_debuglog"
   to get the debug output of the kernel module.

-  Run as Admin: $ /sbin/msnfs41client watch_kernel_debuglog #
+  Run as Administrator: $ /sbin/msnfs41client watch_kernel_debuglog #

   Currently requires DebugView
   (https://learn.microsoft.com/en-gb/sysinternals/downloads/debugview)
--
2.45.1

From 9c23d89b9c7f7b334fcc4e652aeaadfe19c8c5ba Mon Sep 17 00:00:00 2001
From: Roland Mainz <roland.mainz@nrubsig.org>
Date: Tue, 18 Feb 2025 11:27:19 +0100
Subject: [PATCH 3/3] sys: Add access checks to |nfs41_SetZeroData()|

Add access checks to |nfs41_SetZeroData()| (e.g. for read-only
mounts).

Reported-by: Lionel Cons <lionelcons1972@gmail.com>
Signed-off-by: Cedric Blancher <cedric.blancher@gmail.com>
---
 sys/nfs41sys_fsctl.c | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/sys/nfs41sys_fsctl.c b/sys/nfs41sys_fsctl.c
index acacf7e..3157b54 100644
--- a/sys/nfs41sys_fsctl.c
+++ b/sys/nfs41sys_fsctl.c
@@ -319,6 +319,14 @@ NTSTATUS nfs41_SetSparse(

     DbgEn();

+    /*
+     * We do not do any access checks here because ms-nfs41-client
+     * files always have the |FILE_ATTRIBUTE_SPARSE_FILE| set.
+     * This function is basically only a dummy which returns
+     * |STATUS_SUCCESS| (if the correct are provided) to conform
+     * sto the Win32 sparse file API.
+     */
+
     /*
      * Special case: No input buffer, so we treat this as if we got
      * |set_parse_buffer->SetSparse == TRUE|
@@ -368,6 +376,29 @@ out:
     return status;
 }

+static
+NTSTATUS check_nfs41_setzerodata_args(
+    PRX_CONTEXT RxContext)
+{
+    NTSTATUS status = STATUS_SUCCESS;
+    __notnull PMRX_SRV_OPEN SrvOpen = RxContext->pRelevantSrvOpen;
+    __notnull PNFS41_V_NET_ROOT_EXTENSION VNetRootContext =
+        NFS41GetVNetRootExtension(SrvOpen->pVNetRoot);
+
+    /* access checks */
+    if (VNetRootContext->read_only) {
+        status = STATUS_MEDIA_WRITE_PROTECTED;
+        goto out;
+    }
+    if (!(SrvOpen->DesiredAccess &
+        (FILE_WRITE_DATA|FILE_WRITE_ATTRIBUTES))) {
+        status = STATUS_ACCESS_DENIED;
+        goto out;
+    }
+out:
+    return status;
+}
+
 static
 NTSTATUS nfs41_SetZeroData(
     IN OUT PRX_CONTEXT RxContext)
@@ -389,6 +420,10 @@ NTSTATUS nfs41_SetZeroData(

     RxContext->IoStatusBlock.Information = 0;

+    status = check_nfs41_setzerodata_args(RxContext);
+    if (status)
+        goto out;
+
     if (FsCtl->InputBufferLength <
         sizeof(FILE_ZERO_DATA_INFORMATION)) {
         DbgP("nfs41_SetZeroData: "
--
2.45.1