xref: /openbsd/usr.sbin/ypbind/ypbind.c (revision 55fc3639)
1 /*	$OpenBSD: ypbind.c,v 1.80 2024/01/23 14:13:55 deraadt Exp $ */
2 
3 /*
4  * Copyright (c) 1992, 1993, 1996, 1997, 1998 Theo de Raadt <deraadt@openbsd.org>
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS
17  * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
18  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
20  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26  * SUCH DAMAGE.
27  */
28 
29 #include <sys/types.h>
30 #include <sys/socket.h>
31 #include <sys/stat.h>
32 #include <sys/uio.h>
33 #include <sys/syslog.h>
34 
35 #include <arpa/inet.h>
36 #include <net/if.h>
37 #include <rpc/rpc.h>
38 #include <rpc/xdr.h>
39 #include <rpc/pmap_clnt.h>
40 #include <rpc/pmap_prot.h>
41 #include <rpc/pmap_rmt.h>
42 #include <rpcsvc/yp.h>
43 #include <rpcsvc/ypclnt.h>
44 
45 #include <ctype.h>
46 #include <dirent.h>
47 #include <err.h>
48 #include <errno.h>
49 #include <fcntl.h>
50 #include <ifaddrs.h>
51 #include <limits.h>
52 #include <netdb.h>
53 #include <poll.h>
54 #include <stdio.h>
55 #include <stdlib.h>
56 #include <string.h>
57 #include <unistd.h>
58 
59 #define SERVERSDIR	"/etc/yp"
60 #define BINDINGDIR	"/var/yp/binding"
61 
62 struct _dom_binding {
63 	struct _dom_binding *dom_pnext;
64 	char dom_domain[YPMAXDOMAIN + 1];
65 	struct sockaddr_in dom_server_addr;
66 	unsigned short int dom_server_port;
67 	int dom_socket;
68 	CLIENT *dom_client;
69 	long dom_vers;
70 	time_t dom_check_t;
71 	time_t dom_ask_t;
72 	int dom_lockfd;
73 	int dom_alive;
74 	u_int32_t dom_xid;
75 	char dom_servlist[PATH_MAX];
76 	FILE *dom_servlistfp;
77 };
78 
79 void rpc_received(char *dom, struct sockaddr_in *raddrp, int force);
80 void checkwork(void);
81 enum clnt_stat handle_replies(void);
82 enum clnt_stat handle_ping(void);
83 int broadcast(struct _dom_binding *ypdb, char *, int);
84 int direct(struct _dom_binding *ypdb, char *, int);
85 int ping(struct _dom_binding *ypdb);
86 int pings(struct _dom_binding *ypdb);
87 
88 char *domain;
89 
90 struct _dom_binding *ypbindlist;
91 int check;
92 
93 #define YPSET_NO	0
94 #define YPSET_LOCAL	1
95 #define YPSET_ALL	2
96 int ypsetmode = YPSET_NO;
97 int insecure = 0;
98 
99 int rpcsock, pingsock;
100 struct rmtcallargs rmtca;
101 struct rmtcallres rmtcr;
102 bool_t rmtcr_outval;
103 u_long rmtcr_port;
104 SVCXPRT *udptransp, *tcptransp;
105 SVCXPRT *ludptransp, *ltcptransp;
106 
107 struct _dom_binding *xid2ypdb(u_int32_t xid);
108 u_int32_t unique_xid(struct _dom_binding *ypdb);
109 
110 /*
111  * We name the local RPC functions ypbindproc_XXX_2x() instead
112  * of ypbindproc_XXX_2() because we need to pass an additional
113  * parameter. ypbindproc_setdom_2x() does a security check, and
114  * hence needs the CLIENT *
115  *
116  * We are faced with either making ypbindprog_2() do the security
117  * check before calling ypbindproc_setdom_2().. or we can simply
118  * declare sun's interface insufficient and roll our own.
119  */
120 
121 static void *
ypbindproc_null_2x(SVCXPRT * transp,void * argp,CLIENT * clnt)122 ypbindproc_null_2x(SVCXPRT *transp, void *argp, CLIENT *clnt)
123 {
124 	static char res;
125 
126 	memset(&res, 0, sizeof(res));
127 	return (void *)&res;
128 }
129 
130 static struct ypbind_resp *
ypbindproc_domain_2x(SVCXPRT * transp,domainname * argp,CLIENT * clnt)131 ypbindproc_domain_2x(SVCXPRT *transp, domainname *argp, CLIENT *clnt)
132 {
133 	static struct ypbind_resp res;
134 	struct _dom_binding *ypdb;
135 	char path[PATH_MAX];
136 	time_t now;
137 	int count = 0;
138 
139 	if (strchr((char *)argp, '/'))
140 		return NULL;
141 
142 	memset(&res, 0, sizeof(res));
143 	res.ypbind_status = YPBIND_FAIL_VAL;
144 
145 	for (ypdb = ypbindlist; ypdb && count < 100; ypdb = ypdb->dom_pnext)
146 		count++;
147 	if (count >= 100)
148 		return NULL;	/* prevent DOS: sorry, you lose */
149 
150 	for (ypdb = ypbindlist; ypdb; ypdb = ypdb->dom_pnext)
151 		if (!strcmp(ypdb->dom_domain, *argp))
152 			break;
153 
154 	if (ypdb == NULL) {
155 		ypdb = malloc(sizeof *ypdb);
156 		if (ypdb == NULL)
157 			return NULL;
158 		memset(ypdb, 0, sizeof *ypdb);
159 		strlcpy(ypdb->dom_domain, *argp, sizeof ypdb->dom_domain);
160 		ypdb->dom_vers = YPVERS;
161 		ypdb->dom_alive = 0;
162 		ypdb->dom_lockfd = -1;
163 		snprintf(path, sizeof path, "%s/%s.%d", BINDINGDIR,
164 		    ypdb->dom_domain, (int)ypdb->dom_vers);
165 		unlink(path);
166 		snprintf(ypdb->dom_servlist, sizeof ypdb->dom_servlist,
167 		    "%s/%s", SERVERSDIR, ypdb->dom_domain);
168 		ypdb->dom_servlistfp = fopen(ypdb->dom_servlist, "r");
169 		ypdb->dom_xid = unique_xid(ypdb);
170 		ypdb->dom_pnext = ypbindlist;
171 		ypbindlist = ypdb;
172 		check++;
173 		return NULL;
174 	}
175 
176 	if (ypdb->dom_alive == 0)
177 		return NULL;
178 
179 #ifdef HEURISTIC
180 	time(&now);
181 	if (now < ypdb->dom_ask_t + 5) {
182 		/*
183 		 * Hmm. More than 2 requests in 5 seconds have indicated
184 		 * that my binding is possibly incorrect.
185 		 * Ok, do an immediate poll of the server.
186 		 */
187 		if (ypdb->dom_check_t >= now) {
188 			/* don't flood it */
189 			ypdb->dom_check_t = 0;
190 			check++;
191 		}
192 	}
193 	ypdb->dom_ask_t = now;
194 #endif
195 
196 	res.ypbind_status = YPBIND_SUCC_VAL;
197 	memmove(&res.ypbind_resp_u.ypbind_bindinfo.ypbind_binding_addr,
198 	    &ypdb->dom_server_addr.sin_addr,
199 	    sizeof(res.ypbind_resp_u.ypbind_bindinfo.ypbind_binding_addr));
200 	memmove(&res.ypbind_resp_u.ypbind_bindinfo.ypbind_binding_port,
201 	    &ypdb->dom_server_port,
202 	    sizeof(res.ypbind_resp_u.ypbind_bindinfo.ypbind_binding_port));
203 #ifdef DEBUG
204 	printf("domain %s at %s/%d\n", ypdb->dom_domain,
205 	    inet_ntoa(ypdb->dom_server_addr.sin_addr),
206 	    ntohs(ypdb->dom_server_addr.sin_port));
207 #endif
208 	return &res;
209 }
210 
211 static bool_t *
ypbindproc_setdom_2x(SVCXPRT * transp,struct ypbind_setdom * argp,CLIENT * clnt)212 ypbindproc_setdom_2x(SVCXPRT *transp, struct ypbind_setdom *argp, CLIENT *clnt)
213 {
214 	struct sockaddr_in *fromsin, bindsin;
215 	static bool_t res = 1;
216 
217 	fromsin = svc_getcaller(transp);
218 
219 	switch (ypsetmode) {
220 	case YPSET_LOCAL:
221 		if (transp != ludptransp && transp != ltcptransp) {
222 			syslog(LOG_WARNING, "attempted spoof of ypsetme");
223 			svcerr_weakauth(transp);
224 			return NULL;
225 		}
226 		if (fromsin->sin_addr.s_addr != htonl(INADDR_LOOPBACK)) {
227 			svcerr_weakauth(transp);
228 			return NULL;
229 		}
230 		break;
231 	case YPSET_ALL:
232 		break;
233 	case YPSET_NO:
234 	default:
235 		svcerr_weakauth(transp);
236 		return NULL;
237 	}
238 
239 	if (ntohs(fromsin->sin_port) >= IPPORT_RESERVED) {
240 		svcerr_weakauth(transp);
241 		return NULL;
242 	}
243 
244 	if (argp->ypsetdom_vers != YPVERS) {
245 		svcerr_noprog(transp);
246 		return NULL;
247 	}
248 
249 	memset(&bindsin, 0, sizeof bindsin);
250 	bindsin.sin_family = AF_INET;
251 	bindsin.sin_len = sizeof(bindsin);
252 	memcpy(&bindsin.sin_addr, &argp->ypsetdom_binding.ypbind_binding_addr,
253 	    sizeof(argp->ypsetdom_binding.ypbind_binding_addr));
254 	memcpy(&bindsin.sin_port, &argp->ypsetdom_binding.ypbind_binding_port,
255 	    sizeof(argp->ypsetdom_binding.ypbind_binding_port));
256 	rpc_received(argp->ypsetdom_domain, &bindsin, 1);
257 
258 	return &res;
259 }
260 
261 static void
ypbindprog_2(struct svc_req * rqstp,SVCXPRT * transp)262 ypbindprog_2(struct svc_req *rqstp, SVCXPRT *transp)
263 {
264 	union argument {
265 		domainname ypbindproc_domain_2_arg;
266 		struct ypbind_setdom ypbindproc_setdom_2_arg;
267 	} argument;
268 	struct authunix_parms *creds;
269 	char *result;
270 	xdrproc_t xdr_argument, xdr_result;
271 	char *(*local)(SVCXPRT *, union argument *, struct svc_req *);
272 
273 	switch (rqstp->rq_proc) {
274 	case YPBINDPROC_NULL:
275 		xdr_argument = xdr_void;
276 		xdr_result = xdr_void;
277 		local = (char *(*)(SVCXPRT *, union argument *, struct svc_req *))
278 		    ypbindproc_null_2x;
279 		break;
280 
281 	case YPBINDPROC_DOMAIN:
282 		xdr_argument = xdr_domainname;
283 		xdr_result = xdr_ypbind_resp;
284 		local = (char *(*)(SVCXPRT *, union argument *, struct svc_req *))
285 		    ypbindproc_domain_2x;
286 		break;
287 
288 	case YPBINDPROC_SETDOM:
289 		switch (rqstp->rq_cred.oa_flavor) {
290 		case AUTH_UNIX:
291 			creds = (struct authunix_parms *)rqstp->rq_clntcred;
292 			if (creds->aup_uid != 0) {
293 				svcerr_auth(transp, AUTH_BADCRED);
294 				return;
295 			}
296 			break;
297 		default:
298 			svcerr_auth(transp, AUTH_TOOWEAK);
299 			return;
300 		}
301 
302 		xdr_argument = xdr_ypbind_setdom;
303 		xdr_result = xdr_void;
304 		local = (char *(*)(SVCXPRT *, union argument *, struct svc_req *))
305 		    ypbindproc_setdom_2x;
306 		break;
307 
308 	default:
309 		svcerr_noproc(transp);
310 		return;
311 	}
312 	memset(&argument, 0, sizeof(argument));
313 	if (!svc_getargs(transp, xdr_argument, (caddr_t)&argument)) {
314 		svcerr_decode(transp);
315 		return;
316 	}
317 	result = (*local)(transp, &argument, rqstp);
318 	if (result != NULL && !svc_sendreply(transp, xdr_result, result)) {
319 		svcerr_systemerr(transp);
320 	}
321 	return;
322 }
323 
324 static void
usage(void)325 usage(void)
326 {
327 	fprintf(stderr, "usage: ypbind [-insecure] [-ypset] [-ypsetme]\n");
328 	exit(1);
329 }
330 
331 int
main(int argc,char * argv[])332 main(int argc, char *argv[])
333 {
334 	char path[PATH_MAX];
335 	struct sockaddr_in sin;
336 	struct pollfd *pfd = NULL;
337 	int width = 0, nready, lsock;
338 	socklen_t len;
339 	int evil = 0, one = 1;
340 	DIR *dirp;
341 	struct dirent *dent;
342 
343 	if (yp_get_default_domain(&domain) != 0 || domain[0] == '\0') {
344 		fprintf(stderr, "domainname not set. Aborting.\n");
345 		exit(1);
346 	}
347 
348 	while (--argc) {
349 		++argv;
350 		if (!strcmp("-insecure", *argv))
351 			insecure = 1;
352 		else if (!strcmp("-ypset", *argv))
353 			ypsetmode = YPSET_ALL;
354 		else if (!strcmp("-ypsetme", *argv))
355 			ypsetmode = YPSET_LOCAL;
356 		else
357 			usage();
358 	}
359 
360 	/* blow away everything in BINDINGDIR */
361 	dirp = opendir(BINDINGDIR);
362 	if (dirp) {
363 		while ((dent = readdir(dirp))) {
364 			if (!strcmp(dent->d_name, ".") ||
365 			    !strcmp(dent->d_name, ".."))
366 				continue;
367 			(void)unlinkat(dirfd(dirp), dent->d_name, 0);
368 		}
369 		closedir(dirp);
370 	} else {
371 		(void)mkdir(BINDINGDIR, 0755);
372 	}
373 
374 	(void)pmap_unset(YPBINDPROG, YPBINDVERS);
375 
376 	udptransp = svcudp_create(RPC_ANYSOCK);
377 	if (udptransp == NULL) {
378 		fprintf(stderr, "cannot create udp service.\n");
379 		exit(1);
380 	}
381 	if (!svc_register(udptransp, YPBINDPROG, YPBINDVERS, ypbindprog_2,
382 	    IPPROTO_UDP)) {
383 		fprintf(stderr,
384 		    "unable to register (YPBINDPROG, YPBINDVERS, udp).\n");
385 		exit(1);
386 	}
387 
388 	tcptransp = svctcp_create(RPC_ANYSOCK, 0, 0);
389 	if (tcptransp == NULL) {
390 		fprintf(stderr, "cannot create tcp service.\n");
391 		exit(1);
392 	}
393 	if (!svc_register(tcptransp, YPBINDPROG, YPBINDVERS, ypbindprog_2,
394 	    IPPROTO_TCP)) {
395 		fprintf(stderr,
396 		    "unable to register (YPBINDPROG, YPBINDVERS, tcp).\n");
397 		exit(1);
398 	}
399 
400 	if (ypsetmode == YPSET_LOCAL) {
401 		/* build UDP local port */
402 		if ((lsock = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
403 			syslog(LOG_ERR, "cannot create local udp socket: %m");
404 			exit(1);
405 		}
406 		(void)setsockopt(lsock, SOL_SOCKET, SO_REUSEADDR, &one,
407 		    (socklen_t)sizeof one);
408 		len = sizeof(sin);
409 		if (getsockname(udptransp->xp_sock, (struct sockaddr *)&sin,
410 		    &len) == -1) {
411 			syslog(LOG_ERR, "cannot getsockname local udp: %m");
412 			exit(1);
413 		}
414 		sin.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
415 		sin.sin_port = htons(udptransp->xp_port);
416 		if (bind(lsock, (struct sockaddr *)&sin, len) != 0) {
417 			syslog(LOG_ERR, "cannot bind local udp: %m");
418 			exit(1);
419 		}
420 		if ((ludptransp = svcudp_create(lsock)) == NULL) {
421 			fprintf(stderr, "cannot create udp service.\n");
422 			exit(1);
423 		}
424 
425 		/* build TCP local port */
426 		if ((lsock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) == -1) {
427 			syslog(LOG_ERR, "cannot create udp socket: %m");
428 			exit(1);
429 		}
430 		(void)setsockopt(lsock, SOL_SOCKET, SO_REUSEADDR, &one,
431 		    (socklen_t)sizeof one);
432 		len = sizeof(sin);
433 		if (getsockname(tcptransp->xp_sock, (struct sockaddr *)&sin,
434 		    &len) == -1) {
435 			syslog(LOG_ERR, "cannot getsockname udp: %m");
436 			exit(1);
437 		}
438 		sin.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
439 		sin.sin_port = htons(tcptransp->xp_port);
440 		if (bind(lsock, (struct sockaddr *)&sin, len) == -1) {
441 			syslog(LOG_ERR, "cannot bind local tcp: %m");
442 			exit(1);
443 		}
444 		if ((ltcptransp = svctcp_create(lsock, 0, 0)) == NULL) {
445 			fprintf(stderr, "cannot create tcp service.\n");
446 			exit(1);
447 		}
448 	}
449 
450 	if ((rpcsock = socket(AF_INET, SOCK_DGRAM | SOCK_NONBLOCK, 0)) == -1) {
451 		perror("socket");
452 		return -1;
453 	}
454 	memset(&sin, 0, sizeof sin);
455 	sin.sin_family = AF_INET;
456 	sin.sin_addr.s_addr = htonl(INADDR_ANY);
457 	sin.sin_port = 0;
458 	bindresvport(rpcsock, &sin);
459 
460 	if ((pingsock = socket(AF_INET, SOCK_DGRAM | SOCK_NONBLOCK, 0)) == -1) {
461 		perror("socket");
462 		return -1;
463 	}
464 	memset(&sin, 0, sizeof sin);
465 	sin.sin_family = AF_INET;
466 	sin.sin_addr.s_addr = htonl(INADDR_ANY);
467 	sin.sin_port = 0;
468 	bindresvport(pingsock, &sin);
469 
470 	setsockopt(rpcsock, SOL_SOCKET, SO_BROADCAST, &one,
471 	    (socklen_t)sizeof(one));
472 	rmtca.prog = YPPROG;
473 	rmtca.vers = YPVERS;
474 	rmtca.proc = YPPROC_DOMAIN_NONACK;
475 	rmtca.xdr_args = NULL;		/* set at call time */
476 	rmtca.args_ptr = NULL;		/* set at call time */
477 	rmtcr.port_ptr = &rmtcr_port;
478 	rmtcr.xdr_results = xdr_bool;
479 	rmtcr.results_ptr = (caddr_t)&rmtcr_outval;
480 
481 	if (strchr(domain, '/'))
482 		errx(1, "bad domainname %s", domain);
483 
484 	/* build initial domain binding, make it "unsuccessful" */
485 	ypbindlist = malloc(sizeof *ypbindlist);
486 	if (ypbindlist == NULL)
487 		errx(1, "no memory");
488 	memset(ypbindlist, 0, sizeof *ypbindlist);
489 	strlcpy(ypbindlist->dom_domain, domain, sizeof ypbindlist->dom_domain);
490 	ypbindlist->dom_vers = YPVERS;
491 	snprintf(ypbindlist->dom_servlist, sizeof ypbindlist->dom_servlist,
492 	    "%s/%s", SERVERSDIR, ypbindlist->dom_domain);
493 	ypbindlist->dom_servlistfp = fopen(ypbindlist->dom_servlist, "r");
494 	ypbindlist->dom_alive = 0;
495 	ypbindlist->dom_lockfd = -1;
496 	ypbindlist->dom_xid = unique_xid(ypbindlist);
497 	snprintf(path, sizeof path, "%s/%s.%d", BINDINGDIR,
498 	    ypbindlist->dom_domain, (int)ypbindlist->dom_vers);
499 	(void)unlink(path);
500 
501 	checkwork();
502 
503 	while (1) {
504 		if (pfd == NULL || width != svc_max_pollfd + 2) {
505 			width = svc_max_pollfd + 2;
506 			pfd = reallocarray(pfd, width, sizeof *pfd);
507 			if (pfd == NULL)
508 				err(1, NULL);
509 		}
510 
511 		pfd[0].fd = rpcsock;
512 		pfd[0].events = POLLIN;
513 		pfd[1].fd = pingsock;
514 		pfd[1].events = POLLIN;
515 		memcpy(pfd + 2, svc_pollfd, sizeof(*pfd) * svc_max_pollfd);
516 
517 		nready = poll(pfd, width, 1000);
518 		switch (nready) {
519 		case 0:
520 			checkwork();
521 			break;
522 		case -1:
523 			if (errno != EINTR)
524 				perror("poll");
525 			break;
526 		default:
527 			/* No need to check for POLLHUP on UDP sockets. */
528 			if (pfd[0].revents & POLLIN) {
529 				handle_replies();
530 				nready--;
531 			}
532 			if (pfd[1].revents & POLLIN) {
533 				handle_ping();
534 				nready--;
535 			}
536 			svc_getreq_poll(pfd + 2, nready);
537 			if (check)
538 				checkwork();
539 			break;
540 		}
541 
542 #ifdef DAEMON
543 		if (!evil && ypbindlist->dom_alive) {
544 			evil = 1;
545 			daemon(0, 0);
546 		}
547 #endif
548 	}
549 }
550 
551 /*
552  * State transition is done like this:
553  *
554  * STATE	EVENT		ACTION			NEWSTATE	TIMEOUT
555  * no binding	timeout		broadcast		no binding	5 sec
556  * no binding	answer		--			binding		60 sec
557  * binding	timeout		ping server		checking	5 sec
558  * checking	timeout		ping server + broadcast	checking	5 sec
559  * checking	answer		--			binding		60 sec
560  */
561 void
checkwork(void)562 checkwork(void)
563 {
564 	struct _dom_binding *ypdb;
565 	time_t t;
566 
567 	time(&t);
568 	for (ypdb = ypbindlist; ypdb; ypdb = ypdb->dom_pnext) {
569 		if (ypdb->dom_check_t < t) {
570 			if (ypdb->dom_alive == 1)
571 				ping(ypdb);
572 			else
573 				pings(ypdb);
574 			time(&t);
575 			ypdb->dom_check_t = t + 5;
576 		}
577 	}
578 	check = 0;
579 }
580 
581 int
ping(struct _dom_binding * ypdb)582 ping(struct _dom_binding *ypdb)
583 {
584 	domainname dom = ypdb->dom_domain;
585 	struct rpc_msg msg;
586 	char buf[1400];
587 	enum clnt_stat st;
588 	int outlen;
589 	AUTH *rpcua;
590 	XDR xdr;
591 
592 	memset(&xdr, 0, sizeof xdr);
593 	memset(&msg, 0, sizeof msg);
594 
595 	rpcua = authunix_create_default();
596 	if (rpcua == (AUTH *)NULL) {
597 		/*printf("cannot get unix auth\n");*/
598 		return RPC_SYSTEMERROR;
599 	}
600 	msg.rm_direction = CALL;
601 	msg.rm_call.cb_rpcvers = RPC_MSG_VERSION;
602 	msg.rm_call.cb_prog = YPPROG;
603 	msg.rm_call.cb_vers = YPVERS;
604 	msg.rm_call.cb_proc = YPPROC_DOMAIN_NONACK;
605 	msg.rm_call.cb_cred = rpcua->ah_cred;
606 	msg.rm_call.cb_verf = rpcua->ah_verf;
607 
608 	msg.rm_xid = ypdb->dom_xid;
609 	xdrmem_create(&xdr, buf, sizeof buf, XDR_ENCODE);
610 	if (!xdr_callmsg(&xdr, &msg)) {
611 		st = RPC_CANTENCODEARGS;
612 		AUTH_DESTROY(rpcua);
613 		return st;
614 	}
615 	if (!xdr_domainname(&xdr, &dom)) {
616 		st = RPC_CANTENCODEARGS;
617 		AUTH_DESTROY(rpcua);
618 		return st;
619 	}
620 	outlen = (int)xdr_getpos(&xdr);
621 	xdr_destroy(&xdr);
622 	if (outlen < 1) {
623 		st = RPC_CANTENCODEARGS;
624 		AUTH_DESTROY(rpcua);
625 		return st;
626 	}
627 	AUTH_DESTROY(rpcua);
628 
629 	ypdb->dom_alive = 2;
630 	if (sendto(pingsock, buf, outlen, 0,
631 	    (struct sockaddr *)&ypdb->dom_server_addr,
632 	    (socklen_t)sizeof ypdb->dom_server_addr) == -1)
633 		perror("sendto");
634 	return 0;
635 
636 }
637 
638 int
pings(struct _dom_binding * ypdb)639 pings(struct _dom_binding *ypdb)
640 {
641 	domainname dom = ypdb->dom_domain;
642 	struct rpc_msg msg;
643 	struct sockaddr_in bindsin;
644 	char buf[1400];
645 	char path[PATH_MAX];
646 	enum clnt_stat st;
647 	int outlen;
648 	AUTH *rpcua;
649 	XDR xdr;
650 
651 	rmtca.xdr_args = xdr_domainname;
652 	rmtca.args_ptr = (char *)&dom;
653 
654 	memset(&xdr, 0, sizeof xdr);
655 	memset(&msg, 0, sizeof msg);
656 
657 	rpcua = authunix_create_default();
658 	if (rpcua == (AUTH *)NULL) {
659 		/*printf("cannot get unix auth\n");*/
660 		return RPC_SYSTEMERROR;
661 	}
662 	msg.rm_direction = CALL;
663 	msg.rm_call.cb_rpcvers = RPC_MSG_VERSION;
664 	msg.rm_call.cb_prog = PMAPPROG;
665 	msg.rm_call.cb_vers = PMAPVERS;
666 	msg.rm_call.cb_proc = PMAPPROC_CALLIT;
667 	msg.rm_call.cb_cred = rpcua->ah_cred;
668 	msg.rm_call.cb_verf = rpcua->ah_verf;
669 
670 	msg.rm_xid = ypdb->dom_xid;
671 	xdrmem_create(&xdr, buf, sizeof buf, XDR_ENCODE);
672 	if (!xdr_callmsg(&xdr, &msg)) {
673 		st = RPC_CANTENCODEARGS;
674 		AUTH_DESTROY(rpcua);
675 		return st;
676 	}
677 	if (!xdr_rmtcall_args(&xdr, &rmtca)) {
678 		st = RPC_CANTENCODEARGS;
679 		AUTH_DESTROY(rpcua);
680 		return st;
681 	}
682 	outlen = (int)xdr_getpos(&xdr);
683 	xdr_destroy(&xdr);
684 	if (outlen < 1) {
685 		st = RPC_CANTENCODEARGS;
686 		AUTH_DESTROY(rpcua);
687 		return st;
688 	}
689 	AUTH_DESTROY(rpcua);
690 
691 	if (ypdb->dom_lockfd != -1) {
692 		close(ypdb->dom_lockfd);
693 		ypdb->dom_lockfd = -1;
694 		snprintf(path, sizeof path, "%s/%s.%d", BINDINGDIR,
695 		    ypdb->dom_domain, (int)ypdb->dom_vers);
696 		unlink(path);
697 	}
698 
699 	if (ypdb->dom_alive == 2) {
700 		/*
701 		 * This resolves the following situation:
702 		 * ypserver on other subnet was once bound,
703 		 * but rebooted and is now using a different port
704 		 */
705 		memset(&bindsin, 0, sizeof bindsin);
706 		bindsin.sin_family = AF_INET;
707 		bindsin.sin_len = sizeof(bindsin);
708 		bindsin.sin_port = htons(PMAPPORT);
709 		bindsin.sin_addr = ypdb->dom_server_addr.sin_addr;
710 		if (sendto(rpcsock, buf, outlen, 0, (struct sockaddr *)&bindsin,
711 		    (socklen_t)sizeof bindsin) == -1)
712 			perror("sendto");
713 	}
714 	if (ypdb->dom_servlistfp)
715 		return direct(ypdb, buf, outlen);
716 	return broadcast(ypdb, buf, outlen);
717 }
718 
719 int
broadcast(struct _dom_binding * ypdb,char * buf,int outlen)720 broadcast(struct _dom_binding *ypdb, char *buf, int outlen)
721 {
722 	struct ifaddrs *ifap, *ifa;
723 	struct sockaddr_in bindsin;
724 	struct in_addr in;
725 
726 	memset(&bindsin, 0, sizeof bindsin);
727 	bindsin.sin_family = AF_INET;
728 	bindsin.sin_len = sizeof(bindsin);
729 	bindsin.sin_port = htons(PMAPPORT);
730 
731 	if (getifaddrs(&ifap) != 0) {
732 		perror("getifaddrs");
733 		return -1;
734 	}
735 	for (ifa = ifap; ifa; ifa = ifa->ifa_next) {
736 		if (ifa->ifa_addr == NULL ||
737 		    ifa->ifa_addr->sa_family != AF_INET)
738 			continue;
739 		if ((ifa->ifa_flags & IFF_UP) == 0)
740 			continue;
741 
742 		switch (ifa->ifa_flags & (IFF_LOOPBACK | IFF_BROADCAST)) {
743 		case IFF_BROADCAST:
744 			if (!ifa->ifa_broadaddr)
745 				continue;
746 			if (ifa->ifa_broadaddr->sa_family != AF_INET)
747 				continue;
748 			in = ((struct sockaddr_in *)ifa->ifa_broadaddr)->sin_addr;
749 			break;
750 		case IFF_LOOPBACK:
751 			in = ((struct sockaddr_in *)ifa->ifa_addr)->sin_addr;
752 			break;
753 		default:
754 			continue;
755 		}
756 
757 		bindsin.sin_addr = in;
758 		if (sendto(rpcsock, buf, outlen, 0, (struct sockaddr *)&bindsin,
759 		    (socklen_t)bindsin.sin_len) == -1)
760 			perror("sendto");
761 	}
762 	freeifaddrs(ifap);
763 	return 0;
764 }
765 
766 int
direct(struct _dom_binding * ypdb,char * buf,int outlen)767 direct(struct _dom_binding *ypdb, char *buf, int outlen)
768 {
769 	char line[1024], *p;
770 	struct hostent *hp;
771 	struct sockaddr_in bindsin;
772 	int i, c;
773 	struct stat fst, st;
774 
775 	if (fstat(fileno(ypdb->dom_servlistfp), &fst) != -1 &&
776 	    stat(ypdb->dom_servlist, &st) != -1 &&
777 	    (st.st_dev != fst.st_dev || st.st_ino != fst.st_ino)) {
778 		FILE *fp;
779 
780 		fp = fopen(ypdb->dom_servlist, "r");
781 		if (fp) {
782 			fclose(ypdb->dom_servlistfp);
783 			ypdb->dom_servlistfp = fp;
784 		}
785 	}
786 	(void) rewind(ypdb->dom_servlistfp);
787 
788 	memset(&bindsin, 0, sizeof bindsin);
789 	bindsin.sin_family = AF_INET;
790 	bindsin.sin_len = sizeof(bindsin);
791 	bindsin.sin_port = htons(PMAPPORT);
792 
793 	while (fgets(line, sizeof(line), ypdb->dom_servlistfp) != NULL) {
794 		/* skip lines that are too big */
795 		p = strchr(line, '\n');
796 		if (p == NULL) {
797 			while ((c = getc(ypdb->dom_servlistfp)) != '\n' && c != EOF)
798 				;
799 			continue;
800 		}
801 		*p = '\0';
802 		p = line;
803 		while (isspace((unsigned char)*p))
804 			p++;
805 		if (*p == '#')
806 			continue;
807 		hp = gethostbyname(p);
808 		if (!hp)
809 			continue;
810 		/* step through all addresses in case first is unavailable */
811 		for (i = 0; hp->h_addr_list[i]; i++) {
812 			memmove(&bindsin.sin_addr, hp->h_addr_list[0],
813 			    hp->h_length);
814 			if (sendto(rpcsock, buf, outlen, 0,
815 			    (struct sockaddr *)&bindsin,
816 			    (socklen_t)sizeof bindsin) == -1) {
817 				perror("sendto");
818 				continue;
819 			}
820 		}
821 	}
822 	return 0;
823 }
824 
825 enum clnt_stat
handle_replies(void)826 handle_replies(void)
827 {
828 	char buf[1400];
829 	int inlen;
830 	socklen_t fromlen;
831 	struct _dom_binding *ypdb;
832 	struct sockaddr_in raddr;
833 	struct rpc_msg msg;
834 	XDR xdr;
835 
836 recv_again:
837 	memset(&xdr, 0, sizeof(xdr));
838 	memset(&msg, 0, sizeof(msg));
839 	msg.acpted_rply.ar_verf = _null_auth;
840 	msg.acpted_rply.ar_results.where = (caddr_t)&rmtcr;
841 	msg.acpted_rply.ar_results.proc = xdr_rmtcallres;
842 
843 try_again:
844 	fromlen = sizeof (struct sockaddr);
845 	inlen = recvfrom(rpcsock, buf, sizeof buf, 0,
846 	    (struct sockaddr *)&raddr, &fromlen);
847 	if (inlen == -1) {
848 		if (errno == EINTR)
849 			goto try_again;
850 		return RPC_CANTRECV;
851 	}
852 	if (inlen < sizeof(u_int32_t))
853 		goto recv_again;
854 
855 	/*
856 	 * see if reply transaction id matches sent id.
857 	 * If so, decode the results.
858 	 */
859 	xdrmem_create(&xdr, buf, (u_int)inlen, XDR_DECODE);
860 	if (xdr_replymsg(&xdr, &msg)) {
861 		if ((msg.rm_reply.rp_stat == MSG_ACCEPTED) &&
862 		    (msg.acpted_rply.ar_stat == SUCCESS)) {
863 			raddr.sin_port = htons((u_short)rmtcr_port);
864 			ypdb = xid2ypdb(msg.rm_xid);
865 			if (ypdb)
866 				rpc_received(ypdb->dom_domain, &raddr, 0);
867 		}
868 	}
869 	xdr.x_op = XDR_FREE;
870 	msg.acpted_rply.ar_results.proc = xdr_void;
871 	xdr_destroy(&xdr);
872 
873 	return RPC_SUCCESS;
874 }
875 
876 enum clnt_stat
handle_ping(void)877 handle_ping(void)
878 {
879 	char buf[1400];
880 	int inlen;
881 	socklen_t fromlen;
882 	struct _dom_binding *ypdb;
883 	struct sockaddr_in raddr;
884 	struct rpc_msg msg;
885 	XDR xdr;
886 	bool_t res;
887 
888 recv_again:
889 	memset(&xdr, 0, sizeof(xdr));
890 	memset(&msg, 0, sizeof(msg));
891 	msg.acpted_rply.ar_verf = _null_auth;
892 	msg.acpted_rply.ar_results.where = (caddr_t)&res;
893 	msg.acpted_rply.ar_results.proc = xdr_bool;
894 
895 try_again:
896 	fromlen = sizeof (struct sockaddr);
897 	inlen = recvfrom(pingsock, buf, sizeof buf, 0,
898 	    (struct sockaddr *)&raddr, &fromlen);
899 	if (inlen == -1) {
900 		if (errno == EINTR)
901 			goto try_again;
902 		return RPC_CANTRECV;
903 	}
904 	if (inlen < sizeof(u_int32_t))
905 		goto recv_again;
906 
907 	/*
908 	 * see if reply transaction id matches sent id.
909 	 * If so, decode the results.
910 	 */
911 	xdrmem_create(&xdr, buf, (u_int)inlen, XDR_DECODE);
912 	if (xdr_replymsg(&xdr, &msg)) {
913 		if ((msg.rm_reply.rp_stat == MSG_ACCEPTED) &&
914 		    (msg.acpted_rply.ar_stat == SUCCESS)) {
915 			ypdb = xid2ypdb(msg.rm_xid);
916 			if (ypdb)
917 				rpc_received(ypdb->dom_domain, &raddr, 0);
918 		}
919 	}
920 	xdr.x_op = XDR_FREE;
921 	msg.acpted_rply.ar_results.proc = xdr_void;
922 	xdr_destroy(&xdr);
923 
924 	return RPC_SUCCESS;
925 }
926 
927 /*
928  * We prefer loopback connections.
929  */
930 void
rpc_received(char * dom,struct sockaddr_in * raddrp,int force)931 rpc_received(char *dom, struct sockaddr_in *raddrp, int force)
932 {
933 	struct _dom_binding *ypdb;
934 	struct iovec iov[3];
935 	struct ypbind_resp ybr;
936 	char path[PATH_MAX];
937 	u_short ypserv_tcp, ypserv_udp;
938 	int fd;
939 
940 	if (strchr(dom, '/'))
941 		return;
942 
943 #ifdef DEBUG
944 	printf("returned from %s about %s\n", inet_ntoa(raddrp->sin_addr), dom);
945 #endif
946 
947 	if (dom == NULL)
948 		return;
949 
950 	for (ypdb = ypbindlist; ypdb; ypdb = ypdb->dom_pnext)
951 		if (!strcmp(ypdb->dom_domain, dom))
952 			break;
953 
954 	if (ypdb == NULL) {
955 		if (force == 0)
956 			return;
957 		ypdb = malloc(sizeof *ypdb);
958 		if (ypdb == NULL)
959 			return;
960 		memset(ypdb, 0, sizeof *ypdb);
961 		strlcpy(ypdb->dom_domain, dom, sizeof ypdb->dom_domain);
962 		ypdb->dom_lockfd = -1;
963 		ypdb->dom_xid = unique_xid(ypdb);
964 		ypdb->dom_pnext = ypbindlist;
965 		ypbindlist = ypdb;
966 	}
967 
968 	/* we do not support sunos 3.0 insecure servers */
969 	if (insecure == 0 && ntohs(raddrp->sin_port) >= IPPORT_RESERVED)
970 		return;
971 
972 	/* soft update, alive */
973 	if (ypdb->dom_alive == 1 && force == 0) {
974 		if (!memcmp(&ypdb->dom_server_addr, raddrp,
975 		    sizeof ypdb->dom_server_addr)) {
976 			ypdb->dom_alive = 1;
977 			/* recheck binding in 60 sec */
978 			ypdb->dom_check_t = time(NULL) + 60;
979 		}
980 		if (raddrp->sin_addr.s_addr == htonl(INADDR_LOOPBACK)) {
981 			/*
982 			 * we are alive and already have a binding, but
983 			 * after a broadcast we prefer the localhost
984 			 */
985 			memcpy(&ypdb->dom_server_addr, raddrp,
986 			    sizeof ypdb->dom_server_addr);
987 		}
988 		return;
989 	}
990 
991 	/* synchronously ask for the matching ypserv TCP port number */
992 	ypserv_udp = raddrp->sin_port;
993 	ypserv_tcp = pmap_getport(raddrp, YPPROG,
994 	    YPVERS, IPPROTO_TCP);
995 	if (ypserv_tcp == 0) {
996 		clnt_pcreateerror("pmap_getport");
997 		return;
998 	}
999 	if (ypserv_tcp >= IPPORT_RESERVED || ypserv_tcp == 20)
1000 		return;
1001 	ypserv_tcp = htons(ypserv_tcp);
1002 
1003 	memcpy(&ypdb->dom_server_addr, raddrp, sizeof ypdb->dom_server_addr);
1004 	/* recheck binding in 60 seconds */
1005 	ypdb->dom_check_t = time(NULL) + 60;
1006 	ypdb->dom_vers = YPVERS;
1007 	ypdb->dom_alive = 1;
1008 
1009 	if (ypdb->dom_lockfd != -1)
1010 		close(ypdb->dom_lockfd);
1011 
1012 	snprintf(path, sizeof path, "%s/%s.%d", BINDINGDIR,
1013 	    ypdb->dom_domain, (int)ypdb->dom_vers);
1014 	if ((fd = open(path, O_CREAT|O_SHLOCK|O_RDWR|O_TRUNC, 0644)) == -1) {
1015 		(void)mkdir(BINDINGDIR, 0755);
1016 		if ((fd = open(path, O_CREAT|O_SHLOCK|O_RDWR|O_TRUNC,
1017 		    0644)) == -1)
1018 			return;
1019 	}
1020 
1021 	/*
1022 	 * ok, if BINDINGDIR exists, and we can create the binding file,
1023 	 * then write to it..
1024 	 */
1025 	ypdb->dom_lockfd = fd;
1026 
1027 	iov[0].iov_base = (caddr_t)&(udptransp->xp_port);
1028 	iov[0].iov_len = sizeof udptransp->xp_port;
1029 	iov[1].iov_base = (caddr_t)&ybr;
1030 	iov[1].iov_len = sizeof ybr;
1031 	iov[2].iov_base = (caddr_t)&ypserv_tcp;
1032 	iov[2].iov_len = sizeof ypserv_tcp;
1033 
1034 	memset(&ybr, 0, sizeof ybr);
1035 	ybr.ypbind_status = YPBIND_SUCC_VAL;
1036 	memmove(&ybr.ypbind_resp_u.ypbind_bindinfo.ypbind_binding_addr,
1037 	    &raddrp->sin_addr,
1038 	    sizeof(ybr.ypbind_resp_u.ypbind_bindinfo.ypbind_binding_addr));
1039 	memmove(&ybr.ypbind_resp_u.ypbind_bindinfo.ypbind_binding_port,
1040 	    &ypserv_udp,
1041 	    sizeof(ybr.ypbind_resp_u.ypbind_bindinfo.ypbind_binding_port));
1042 
1043 	if (writev(ypdb->dom_lockfd, iov, sizeof(iov)/sizeof(iov[0])) !=
1044 	    iov[0].iov_len + iov[1].iov_len + iov[2].iov_len) {
1045 		perror("write");
1046 		close(ypdb->dom_lockfd);
1047 		unlink(path);
1048 		ypdb->dom_lockfd = -1;
1049 		return;
1050 	}
1051 }
1052 
1053 struct _dom_binding *
xid2ypdb(u_int32_t xid)1054 xid2ypdb(u_int32_t xid)
1055 {
1056 	struct _dom_binding *ypdb;
1057 
1058 	for (ypdb = ypbindlist; ypdb; ypdb = ypdb->dom_pnext)
1059 		if (ypdb->dom_xid == xid)
1060 			break;
1061 	return (ypdb);
1062 }
1063 
1064 u_int32_t
unique_xid(struct _dom_binding * ypdb)1065 unique_xid(struct _dom_binding *ypdb)
1066 {
1067 	u_int32_t xid;
1068 
1069 	xid = arc4random();
1070 	while (xid2ypdb(xid) != NULL)
1071 		xid++;
1072 
1073 	return (xid);
1074 }
1075