1 /* $OpenBSD: ypbind.c,v 1.80 2024/01/23 14:13:55 deraadt Exp $ */
2
3 /*
4 * Copyright (c) 1992, 1993, 1996, 1997, 1998 Theo de Raadt <deraadt@openbsd.org>
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 *
16 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS
17 * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
18 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
20 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29 #include <sys/types.h>
30 #include <sys/socket.h>
31 #include <sys/stat.h>
32 #include <sys/uio.h>
33 #include <sys/syslog.h>
34
35 #include <arpa/inet.h>
36 #include <net/if.h>
37 #include <rpc/rpc.h>
38 #include <rpc/xdr.h>
39 #include <rpc/pmap_clnt.h>
40 #include <rpc/pmap_prot.h>
41 #include <rpc/pmap_rmt.h>
42 #include <rpcsvc/yp.h>
43 #include <rpcsvc/ypclnt.h>
44
45 #include <ctype.h>
46 #include <dirent.h>
47 #include <err.h>
48 #include <errno.h>
49 #include <fcntl.h>
50 #include <ifaddrs.h>
51 #include <limits.h>
52 #include <netdb.h>
53 #include <poll.h>
54 #include <stdio.h>
55 #include <stdlib.h>
56 #include <string.h>
57 #include <unistd.h>
58
59 #define SERVERSDIR "/etc/yp"
60 #define BINDINGDIR "/var/yp/binding"
61
62 struct _dom_binding {
63 struct _dom_binding *dom_pnext;
64 char dom_domain[YPMAXDOMAIN + 1];
65 struct sockaddr_in dom_server_addr;
66 unsigned short int dom_server_port;
67 int dom_socket;
68 CLIENT *dom_client;
69 long dom_vers;
70 time_t dom_check_t;
71 time_t dom_ask_t;
72 int dom_lockfd;
73 int dom_alive;
74 u_int32_t dom_xid;
75 char dom_servlist[PATH_MAX];
76 FILE *dom_servlistfp;
77 };
78
79 void rpc_received(char *dom, struct sockaddr_in *raddrp, int force);
80 void checkwork(void);
81 enum clnt_stat handle_replies(void);
82 enum clnt_stat handle_ping(void);
83 int broadcast(struct _dom_binding *ypdb, char *, int);
84 int direct(struct _dom_binding *ypdb, char *, int);
85 int ping(struct _dom_binding *ypdb);
86 int pings(struct _dom_binding *ypdb);
87
88 char *domain;
89
90 struct _dom_binding *ypbindlist;
91 int check;
92
93 #define YPSET_NO 0
94 #define YPSET_LOCAL 1
95 #define YPSET_ALL 2
96 int ypsetmode = YPSET_NO;
97 int insecure = 0;
98
99 int rpcsock, pingsock;
100 struct rmtcallargs rmtca;
101 struct rmtcallres rmtcr;
102 bool_t rmtcr_outval;
103 u_long rmtcr_port;
104 SVCXPRT *udptransp, *tcptransp;
105 SVCXPRT *ludptransp, *ltcptransp;
106
107 struct _dom_binding *xid2ypdb(u_int32_t xid);
108 u_int32_t unique_xid(struct _dom_binding *ypdb);
109
110 /*
111 * We name the local RPC functions ypbindproc_XXX_2x() instead
112 * of ypbindproc_XXX_2() because we need to pass an additional
113 * parameter. ypbindproc_setdom_2x() does a security check, and
114 * hence needs the CLIENT *
115 *
116 * We are faced with either making ypbindprog_2() do the security
117 * check before calling ypbindproc_setdom_2().. or we can simply
118 * declare sun's interface insufficient and roll our own.
119 */
120
121 static void *
ypbindproc_null_2x(SVCXPRT * transp,void * argp,CLIENT * clnt)122 ypbindproc_null_2x(SVCXPRT *transp, void *argp, CLIENT *clnt)
123 {
124 static char res;
125
126 memset(&res, 0, sizeof(res));
127 return (void *)&res;
128 }
129
130 static struct ypbind_resp *
ypbindproc_domain_2x(SVCXPRT * transp,domainname * argp,CLIENT * clnt)131 ypbindproc_domain_2x(SVCXPRT *transp, domainname *argp, CLIENT *clnt)
132 {
133 static struct ypbind_resp res;
134 struct _dom_binding *ypdb;
135 char path[PATH_MAX];
136 time_t now;
137 int count = 0;
138
139 if (strchr((char *)argp, '/'))
140 return NULL;
141
142 memset(&res, 0, sizeof(res));
143 res.ypbind_status = YPBIND_FAIL_VAL;
144
145 for (ypdb = ypbindlist; ypdb && count < 100; ypdb = ypdb->dom_pnext)
146 count++;
147 if (count >= 100)
148 return NULL; /* prevent DOS: sorry, you lose */
149
150 for (ypdb = ypbindlist; ypdb; ypdb = ypdb->dom_pnext)
151 if (!strcmp(ypdb->dom_domain, *argp))
152 break;
153
154 if (ypdb == NULL) {
155 ypdb = malloc(sizeof *ypdb);
156 if (ypdb == NULL)
157 return NULL;
158 memset(ypdb, 0, sizeof *ypdb);
159 strlcpy(ypdb->dom_domain, *argp, sizeof ypdb->dom_domain);
160 ypdb->dom_vers = YPVERS;
161 ypdb->dom_alive = 0;
162 ypdb->dom_lockfd = -1;
163 snprintf(path, sizeof path, "%s/%s.%d", BINDINGDIR,
164 ypdb->dom_domain, (int)ypdb->dom_vers);
165 unlink(path);
166 snprintf(ypdb->dom_servlist, sizeof ypdb->dom_servlist,
167 "%s/%s", SERVERSDIR, ypdb->dom_domain);
168 ypdb->dom_servlistfp = fopen(ypdb->dom_servlist, "r");
169 ypdb->dom_xid = unique_xid(ypdb);
170 ypdb->dom_pnext = ypbindlist;
171 ypbindlist = ypdb;
172 check++;
173 return NULL;
174 }
175
176 if (ypdb->dom_alive == 0)
177 return NULL;
178
179 #ifdef HEURISTIC
180 time(&now);
181 if (now < ypdb->dom_ask_t + 5) {
182 /*
183 * Hmm. More than 2 requests in 5 seconds have indicated
184 * that my binding is possibly incorrect.
185 * Ok, do an immediate poll of the server.
186 */
187 if (ypdb->dom_check_t >= now) {
188 /* don't flood it */
189 ypdb->dom_check_t = 0;
190 check++;
191 }
192 }
193 ypdb->dom_ask_t = now;
194 #endif
195
196 res.ypbind_status = YPBIND_SUCC_VAL;
197 memmove(&res.ypbind_resp_u.ypbind_bindinfo.ypbind_binding_addr,
198 &ypdb->dom_server_addr.sin_addr,
199 sizeof(res.ypbind_resp_u.ypbind_bindinfo.ypbind_binding_addr));
200 memmove(&res.ypbind_resp_u.ypbind_bindinfo.ypbind_binding_port,
201 &ypdb->dom_server_port,
202 sizeof(res.ypbind_resp_u.ypbind_bindinfo.ypbind_binding_port));
203 #ifdef DEBUG
204 printf("domain %s at %s/%d\n", ypdb->dom_domain,
205 inet_ntoa(ypdb->dom_server_addr.sin_addr),
206 ntohs(ypdb->dom_server_addr.sin_port));
207 #endif
208 return &res;
209 }
210
211 static bool_t *
ypbindproc_setdom_2x(SVCXPRT * transp,struct ypbind_setdom * argp,CLIENT * clnt)212 ypbindproc_setdom_2x(SVCXPRT *transp, struct ypbind_setdom *argp, CLIENT *clnt)
213 {
214 struct sockaddr_in *fromsin, bindsin;
215 static bool_t res = 1;
216
217 fromsin = svc_getcaller(transp);
218
219 switch (ypsetmode) {
220 case YPSET_LOCAL:
221 if (transp != ludptransp && transp != ltcptransp) {
222 syslog(LOG_WARNING, "attempted spoof of ypsetme");
223 svcerr_weakauth(transp);
224 return NULL;
225 }
226 if (fromsin->sin_addr.s_addr != htonl(INADDR_LOOPBACK)) {
227 svcerr_weakauth(transp);
228 return NULL;
229 }
230 break;
231 case YPSET_ALL:
232 break;
233 case YPSET_NO:
234 default:
235 svcerr_weakauth(transp);
236 return NULL;
237 }
238
239 if (ntohs(fromsin->sin_port) >= IPPORT_RESERVED) {
240 svcerr_weakauth(transp);
241 return NULL;
242 }
243
244 if (argp->ypsetdom_vers != YPVERS) {
245 svcerr_noprog(transp);
246 return NULL;
247 }
248
249 memset(&bindsin, 0, sizeof bindsin);
250 bindsin.sin_family = AF_INET;
251 bindsin.sin_len = sizeof(bindsin);
252 memcpy(&bindsin.sin_addr, &argp->ypsetdom_binding.ypbind_binding_addr,
253 sizeof(argp->ypsetdom_binding.ypbind_binding_addr));
254 memcpy(&bindsin.sin_port, &argp->ypsetdom_binding.ypbind_binding_port,
255 sizeof(argp->ypsetdom_binding.ypbind_binding_port));
256 rpc_received(argp->ypsetdom_domain, &bindsin, 1);
257
258 return &res;
259 }
260
261 static void
ypbindprog_2(struct svc_req * rqstp,SVCXPRT * transp)262 ypbindprog_2(struct svc_req *rqstp, SVCXPRT *transp)
263 {
264 union argument {
265 domainname ypbindproc_domain_2_arg;
266 struct ypbind_setdom ypbindproc_setdom_2_arg;
267 } argument;
268 struct authunix_parms *creds;
269 char *result;
270 xdrproc_t xdr_argument, xdr_result;
271 char *(*local)(SVCXPRT *, union argument *, struct svc_req *);
272
273 switch (rqstp->rq_proc) {
274 case YPBINDPROC_NULL:
275 xdr_argument = xdr_void;
276 xdr_result = xdr_void;
277 local = (char *(*)(SVCXPRT *, union argument *, struct svc_req *))
278 ypbindproc_null_2x;
279 break;
280
281 case YPBINDPROC_DOMAIN:
282 xdr_argument = xdr_domainname;
283 xdr_result = xdr_ypbind_resp;
284 local = (char *(*)(SVCXPRT *, union argument *, struct svc_req *))
285 ypbindproc_domain_2x;
286 break;
287
288 case YPBINDPROC_SETDOM:
289 switch (rqstp->rq_cred.oa_flavor) {
290 case AUTH_UNIX:
291 creds = (struct authunix_parms *)rqstp->rq_clntcred;
292 if (creds->aup_uid != 0) {
293 svcerr_auth(transp, AUTH_BADCRED);
294 return;
295 }
296 break;
297 default:
298 svcerr_auth(transp, AUTH_TOOWEAK);
299 return;
300 }
301
302 xdr_argument = xdr_ypbind_setdom;
303 xdr_result = xdr_void;
304 local = (char *(*)(SVCXPRT *, union argument *, struct svc_req *))
305 ypbindproc_setdom_2x;
306 break;
307
308 default:
309 svcerr_noproc(transp);
310 return;
311 }
312 memset(&argument, 0, sizeof(argument));
313 if (!svc_getargs(transp, xdr_argument, (caddr_t)&argument)) {
314 svcerr_decode(transp);
315 return;
316 }
317 result = (*local)(transp, &argument, rqstp);
318 if (result != NULL && !svc_sendreply(transp, xdr_result, result)) {
319 svcerr_systemerr(transp);
320 }
321 return;
322 }
323
324 static void
usage(void)325 usage(void)
326 {
327 fprintf(stderr, "usage: ypbind [-insecure] [-ypset] [-ypsetme]\n");
328 exit(1);
329 }
330
331 int
main(int argc,char * argv[])332 main(int argc, char *argv[])
333 {
334 char path[PATH_MAX];
335 struct sockaddr_in sin;
336 struct pollfd *pfd = NULL;
337 int width = 0, nready, lsock;
338 socklen_t len;
339 int evil = 0, one = 1;
340 DIR *dirp;
341 struct dirent *dent;
342
343 if (yp_get_default_domain(&domain) != 0 || domain[0] == '\0') {
344 fprintf(stderr, "domainname not set. Aborting.\n");
345 exit(1);
346 }
347
348 while (--argc) {
349 ++argv;
350 if (!strcmp("-insecure", *argv))
351 insecure = 1;
352 else if (!strcmp("-ypset", *argv))
353 ypsetmode = YPSET_ALL;
354 else if (!strcmp("-ypsetme", *argv))
355 ypsetmode = YPSET_LOCAL;
356 else
357 usage();
358 }
359
360 /* blow away everything in BINDINGDIR */
361 dirp = opendir(BINDINGDIR);
362 if (dirp) {
363 while ((dent = readdir(dirp))) {
364 if (!strcmp(dent->d_name, ".") ||
365 !strcmp(dent->d_name, ".."))
366 continue;
367 (void)unlinkat(dirfd(dirp), dent->d_name, 0);
368 }
369 closedir(dirp);
370 } else {
371 (void)mkdir(BINDINGDIR, 0755);
372 }
373
374 (void)pmap_unset(YPBINDPROG, YPBINDVERS);
375
376 udptransp = svcudp_create(RPC_ANYSOCK);
377 if (udptransp == NULL) {
378 fprintf(stderr, "cannot create udp service.\n");
379 exit(1);
380 }
381 if (!svc_register(udptransp, YPBINDPROG, YPBINDVERS, ypbindprog_2,
382 IPPROTO_UDP)) {
383 fprintf(stderr,
384 "unable to register (YPBINDPROG, YPBINDVERS, udp).\n");
385 exit(1);
386 }
387
388 tcptransp = svctcp_create(RPC_ANYSOCK, 0, 0);
389 if (tcptransp == NULL) {
390 fprintf(stderr, "cannot create tcp service.\n");
391 exit(1);
392 }
393 if (!svc_register(tcptransp, YPBINDPROG, YPBINDVERS, ypbindprog_2,
394 IPPROTO_TCP)) {
395 fprintf(stderr,
396 "unable to register (YPBINDPROG, YPBINDVERS, tcp).\n");
397 exit(1);
398 }
399
400 if (ypsetmode == YPSET_LOCAL) {
401 /* build UDP local port */
402 if ((lsock = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
403 syslog(LOG_ERR, "cannot create local udp socket: %m");
404 exit(1);
405 }
406 (void)setsockopt(lsock, SOL_SOCKET, SO_REUSEADDR, &one,
407 (socklen_t)sizeof one);
408 len = sizeof(sin);
409 if (getsockname(udptransp->xp_sock, (struct sockaddr *)&sin,
410 &len) == -1) {
411 syslog(LOG_ERR, "cannot getsockname local udp: %m");
412 exit(1);
413 }
414 sin.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
415 sin.sin_port = htons(udptransp->xp_port);
416 if (bind(lsock, (struct sockaddr *)&sin, len) != 0) {
417 syslog(LOG_ERR, "cannot bind local udp: %m");
418 exit(1);
419 }
420 if ((ludptransp = svcudp_create(lsock)) == NULL) {
421 fprintf(stderr, "cannot create udp service.\n");
422 exit(1);
423 }
424
425 /* build TCP local port */
426 if ((lsock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) == -1) {
427 syslog(LOG_ERR, "cannot create udp socket: %m");
428 exit(1);
429 }
430 (void)setsockopt(lsock, SOL_SOCKET, SO_REUSEADDR, &one,
431 (socklen_t)sizeof one);
432 len = sizeof(sin);
433 if (getsockname(tcptransp->xp_sock, (struct sockaddr *)&sin,
434 &len) == -1) {
435 syslog(LOG_ERR, "cannot getsockname udp: %m");
436 exit(1);
437 }
438 sin.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
439 sin.sin_port = htons(tcptransp->xp_port);
440 if (bind(lsock, (struct sockaddr *)&sin, len) == -1) {
441 syslog(LOG_ERR, "cannot bind local tcp: %m");
442 exit(1);
443 }
444 if ((ltcptransp = svctcp_create(lsock, 0, 0)) == NULL) {
445 fprintf(stderr, "cannot create tcp service.\n");
446 exit(1);
447 }
448 }
449
450 if ((rpcsock = socket(AF_INET, SOCK_DGRAM | SOCK_NONBLOCK, 0)) == -1) {
451 perror("socket");
452 return -1;
453 }
454 memset(&sin, 0, sizeof sin);
455 sin.sin_family = AF_INET;
456 sin.sin_addr.s_addr = htonl(INADDR_ANY);
457 sin.sin_port = 0;
458 bindresvport(rpcsock, &sin);
459
460 if ((pingsock = socket(AF_INET, SOCK_DGRAM | SOCK_NONBLOCK, 0)) == -1) {
461 perror("socket");
462 return -1;
463 }
464 memset(&sin, 0, sizeof sin);
465 sin.sin_family = AF_INET;
466 sin.sin_addr.s_addr = htonl(INADDR_ANY);
467 sin.sin_port = 0;
468 bindresvport(pingsock, &sin);
469
470 setsockopt(rpcsock, SOL_SOCKET, SO_BROADCAST, &one,
471 (socklen_t)sizeof(one));
472 rmtca.prog = YPPROG;
473 rmtca.vers = YPVERS;
474 rmtca.proc = YPPROC_DOMAIN_NONACK;
475 rmtca.xdr_args = NULL; /* set at call time */
476 rmtca.args_ptr = NULL; /* set at call time */
477 rmtcr.port_ptr = &rmtcr_port;
478 rmtcr.xdr_results = xdr_bool;
479 rmtcr.results_ptr = (caddr_t)&rmtcr_outval;
480
481 if (strchr(domain, '/'))
482 errx(1, "bad domainname %s", domain);
483
484 /* build initial domain binding, make it "unsuccessful" */
485 ypbindlist = malloc(sizeof *ypbindlist);
486 if (ypbindlist == NULL)
487 errx(1, "no memory");
488 memset(ypbindlist, 0, sizeof *ypbindlist);
489 strlcpy(ypbindlist->dom_domain, domain, sizeof ypbindlist->dom_domain);
490 ypbindlist->dom_vers = YPVERS;
491 snprintf(ypbindlist->dom_servlist, sizeof ypbindlist->dom_servlist,
492 "%s/%s", SERVERSDIR, ypbindlist->dom_domain);
493 ypbindlist->dom_servlistfp = fopen(ypbindlist->dom_servlist, "r");
494 ypbindlist->dom_alive = 0;
495 ypbindlist->dom_lockfd = -1;
496 ypbindlist->dom_xid = unique_xid(ypbindlist);
497 snprintf(path, sizeof path, "%s/%s.%d", BINDINGDIR,
498 ypbindlist->dom_domain, (int)ypbindlist->dom_vers);
499 (void)unlink(path);
500
501 checkwork();
502
503 while (1) {
504 if (pfd == NULL || width != svc_max_pollfd + 2) {
505 width = svc_max_pollfd + 2;
506 pfd = reallocarray(pfd, width, sizeof *pfd);
507 if (pfd == NULL)
508 err(1, NULL);
509 }
510
511 pfd[0].fd = rpcsock;
512 pfd[0].events = POLLIN;
513 pfd[1].fd = pingsock;
514 pfd[1].events = POLLIN;
515 memcpy(pfd + 2, svc_pollfd, sizeof(*pfd) * svc_max_pollfd);
516
517 nready = poll(pfd, width, 1000);
518 switch (nready) {
519 case 0:
520 checkwork();
521 break;
522 case -1:
523 if (errno != EINTR)
524 perror("poll");
525 break;
526 default:
527 /* No need to check for POLLHUP on UDP sockets. */
528 if (pfd[0].revents & POLLIN) {
529 handle_replies();
530 nready--;
531 }
532 if (pfd[1].revents & POLLIN) {
533 handle_ping();
534 nready--;
535 }
536 svc_getreq_poll(pfd + 2, nready);
537 if (check)
538 checkwork();
539 break;
540 }
541
542 #ifdef DAEMON
543 if (!evil && ypbindlist->dom_alive) {
544 evil = 1;
545 daemon(0, 0);
546 }
547 #endif
548 }
549 }
550
551 /*
552 * State transition is done like this:
553 *
554 * STATE EVENT ACTION NEWSTATE TIMEOUT
555 * no binding timeout broadcast no binding 5 sec
556 * no binding answer -- binding 60 sec
557 * binding timeout ping server checking 5 sec
558 * checking timeout ping server + broadcast checking 5 sec
559 * checking answer -- binding 60 sec
560 */
561 void
checkwork(void)562 checkwork(void)
563 {
564 struct _dom_binding *ypdb;
565 time_t t;
566
567 time(&t);
568 for (ypdb = ypbindlist; ypdb; ypdb = ypdb->dom_pnext) {
569 if (ypdb->dom_check_t < t) {
570 if (ypdb->dom_alive == 1)
571 ping(ypdb);
572 else
573 pings(ypdb);
574 time(&t);
575 ypdb->dom_check_t = t + 5;
576 }
577 }
578 check = 0;
579 }
580
581 int
ping(struct _dom_binding * ypdb)582 ping(struct _dom_binding *ypdb)
583 {
584 domainname dom = ypdb->dom_domain;
585 struct rpc_msg msg;
586 char buf[1400];
587 enum clnt_stat st;
588 int outlen;
589 AUTH *rpcua;
590 XDR xdr;
591
592 memset(&xdr, 0, sizeof xdr);
593 memset(&msg, 0, sizeof msg);
594
595 rpcua = authunix_create_default();
596 if (rpcua == (AUTH *)NULL) {
597 /*printf("cannot get unix auth\n");*/
598 return RPC_SYSTEMERROR;
599 }
600 msg.rm_direction = CALL;
601 msg.rm_call.cb_rpcvers = RPC_MSG_VERSION;
602 msg.rm_call.cb_prog = YPPROG;
603 msg.rm_call.cb_vers = YPVERS;
604 msg.rm_call.cb_proc = YPPROC_DOMAIN_NONACK;
605 msg.rm_call.cb_cred = rpcua->ah_cred;
606 msg.rm_call.cb_verf = rpcua->ah_verf;
607
608 msg.rm_xid = ypdb->dom_xid;
609 xdrmem_create(&xdr, buf, sizeof buf, XDR_ENCODE);
610 if (!xdr_callmsg(&xdr, &msg)) {
611 st = RPC_CANTENCODEARGS;
612 AUTH_DESTROY(rpcua);
613 return st;
614 }
615 if (!xdr_domainname(&xdr, &dom)) {
616 st = RPC_CANTENCODEARGS;
617 AUTH_DESTROY(rpcua);
618 return st;
619 }
620 outlen = (int)xdr_getpos(&xdr);
621 xdr_destroy(&xdr);
622 if (outlen < 1) {
623 st = RPC_CANTENCODEARGS;
624 AUTH_DESTROY(rpcua);
625 return st;
626 }
627 AUTH_DESTROY(rpcua);
628
629 ypdb->dom_alive = 2;
630 if (sendto(pingsock, buf, outlen, 0,
631 (struct sockaddr *)&ypdb->dom_server_addr,
632 (socklen_t)sizeof ypdb->dom_server_addr) == -1)
633 perror("sendto");
634 return 0;
635
636 }
637
638 int
pings(struct _dom_binding * ypdb)639 pings(struct _dom_binding *ypdb)
640 {
641 domainname dom = ypdb->dom_domain;
642 struct rpc_msg msg;
643 struct sockaddr_in bindsin;
644 char buf[1400];
645 char path[PATH_MAX];
646 enum clnt_stat st;
647 int outlen;
648 AUTH *rpcua;
649 XDR xdr;
650
651 rmtca.xdr_args = xdr_domainname;
652 rmtca.args_ptr = (char *)&dom;
653
654 memset(&xdr, 0, sizeof xdr);
655 memset(&msg, 0, sizeof msg);
656
657 rpcua = authunix_create_default();
658 if (rpcua == (AUTH *)NULL) {
659 /*printf("cannot get unix auth\n");*/
660 return RPC_SYSTEMERROR;
661 }
662 msg.rm_direction = CALL;
663 msg.rm_call.cb_rpcvers = RPC_MSG_VERSION;
664 msg.rm_call.cb_prog = PMAPPROG;
665 msg.rm_call.cb_vers = PMAPVERS;
666 msg.rm_call.cb_proc = PMAPPROC_CALLIT;
667 msg.rm_call.cb_cred = rpcua->ah_cred;
668 msg.rm_call.cb_verf = rpcua->ah_verf;
669
670 msg.rm_xid = ypdb->dom_xid;
671 xdrmem_create(&xdr, buf, sizeof buf, XDR_ENCODE);
672 if (!xdr_callmsg(&xdr, &msg)) {
673 st = RPC_CANTENCODEARGS;
674 AUTH_DESTROY(rpcua);
675 return st;
676 }
677 if (!xdr_rmtcall_args(&xdr, &rmtca)) {
678 st = RPC_CANTENCODEARGS;
679 AUTH_DESTROY(rpcua);
680 return st;
681 }
682 outlen = (int)xdr_getpos(&xdr);
683 xdr_destroy(&xdr);
684 if (outlen < 1) {
685 st = RPC_CANTENCODEARGS;
686 AUTH_DESTROY(rpcua);
687 return st;
688 }
689 AUTH_DESTROY(rpcua);
690
691 if (ypdb->dom_lockfd != -1) {
692 close(ypdb->dom_lockfd);
693 ypdb->dom_lockfd = -1;
694 snprintf(path, sizeof path, "%s/%s.%d", BINDINGDIR,
695 ypdb->dom_domain, (int)ypdb->dom_vers);
696 unlink(path);
697 }
698
699 if (ypdb->dom_alive == 2) {
700 /*
701 * This resolves the following situation:
702 * ypserver on other subnet was once bound,
703 * but rebooted and is now using a different port
704 */
705 memset(&bindsin, 0, sizeof bindsin);
706 bindsin.sin_family = AF_INET;
707 bindsin.sin_len = sizeof(bindsin);
708 bindsin.sin_port = htons(PMAPPORT);
709 bindsin.sin_addr = ypdb->dom_server_addr.sin_addr;
710 if (sendto(rpcsock, buf, outlen, 0, (struct sockaddr *)&bindsin,
711 (socklen_t)sizeof bindsin) == -1)
712 perror("sendto");
713 }
714 if (ypdb->dom_servlistfp)
715 return direct(ypdb, buf, outlen);
716 return broadcast(ypdb, buf, outlen);
717 }
718
719 int
broadcast(struct _dom_binding * ypdb,char * buf,int outlen)720 broadcast(struct _dom_binding *ypdb, char *buf, int outlen)
721 {
722 struct ifaddrs *ifap, *ifa;
723 struct sockaddr_in bindsin;
724 struct in_addr in;
725
726 memset(&bindsin, 0, sizeof bindsin);
727 bindsin.sin_family = AF_INET;
728 bindsin.sin_len = sizeof(bindsin);
729 bindsin.sin_port = htons(PMAPPORT);
730
731 if (getifaddrs(&ifap) != 0) {
732 perror("getifaddrs");
733 return -1;
734 }
735 for (ifa = ifap; ifa; ifa = ifa->ifa_next) {
736 if (ifa->ifa_addr == NULL ||
737 ifa->ifa_addr->sa_family != AF_INET)
738 continue;
739 if ((ifa->ifa_flags & IFF_UP) == 0)
740 continue;
741
742 switch (ifa->ifa_flags & (IFF_LOOPBACK | IFF_BROADCAST)) {
743 case IFF_BROADCAST:
744 if (!ifa->ifa_broadaddr)
745 continue;
746 if (ifa->ifa_broadaddr->sa_family != AF_INET)
747 continue;
748 in = ((struct sockaddr_in *)ifa->ifa_broadaddr)->sin_addr;
749 break;
750 case IFF_LOOPBACK:
751 in = ((struct sockaddr_in *)ifa->ifa_addr)->sin_addr;
752 break;
753 default:
754 continue;
755 }
756
757 bindsin.sin_addr = in;
758 if (sendto(rpcsock, buf, outlen, 0, (struct sockaddr *)&bindsin,
759 (socklen_t)bindsin.sin_len) == -1)
760 perror("sendto");
761 }
762 freeifaddrs(ifap);
763 return 0;
764 }
765
766 int
direct(struct _dom_binding * ypdb,char * buf,int outlen)767 direct(struct _dom_binding *ypdb, char *buf, int outlen)
768 {
769 char line[1024], *p;
770 struct hostent *hp;
771 struct sockaddr_in bindsin;
772 int i, c;
773 struct stat fst, st;
774
775 if (fstat(fileno(ypdb->dom_servlistfp), &fst) != -1 &&
776 stat(ypdb->dom_servlist, &st) != -1 &&
777 (st.st_dev != fst.st_dev || st.st_ino != fst.st_ino)) {
778 FILE *fp;
779
780 fp = fopen(ypdb->dom_servlist, "r");
781 if (fp) {
782 fclose(ypdb->dom_servlistfp);
783 ypdb->dom_servlistfp = fp;
784 }
785 }
786 (void) rewind(ypdb->dom_servlistfp);
787
788 memset(&bindsin, 0, sizeof bindsin);
789 bindsin.sin_family = AF_INET;
790 bindsin.sin_len = sizeof(bindsin);
791 bindsin.sin_port = htons(PMAPPORT);
792
793 while (fgets(line, sizeof(line), ypdb->dom_servlistfp) != NULL) {
794 /* skip lines that are too big */
795 p = strchr(line, '\n');
796 if (p == NULL) {
797 while ((c = getc(ypdb->dom_servlistfp)) != '\n' && c != EOF)
798 ;
799 continue;
800 }
801 *p = '\0';
802 p = line;
803 while (isspace((unsigned char)*p))
804 p++;
805 if (*p == '#')
806 continue;
807 hp = gethostbyname(p);
808 if (!hp)
809 continue;
810 /* step through all addresses in case first is unavailable */
811 for (i = 0; hp->h_addr_list[i]; i++) {
812 memmove(&bindsin.sin_addr, hp->h_addr_list[0],
813 hp->h_length);
814 if (sendto(rpcsock, buf, outlen, 0,
815 (struct sockaddr *)&bindsin,
816 (socklen_t)sizeof bindsin) == -1) {
817 perror("sendto");
818 continue;
819 }
820 }
821 }
822 return 0;
823 }
824
825 enum clnt_stat
handle_replies(void)826 handle_replies(void)
827 {
828 char buf[1400];
829 int inlen;
830 socklen_t fromlen;
831 struct _dom_binding *ypdb;
832 struct sockaddr_in raddr;
833 struct rpc_msg msg;
834 XDR xdr;
835
836 recv_again:
837 memset(&xdr, 0, sizeof(xdr));
838 memset(&msg, 0, sizeof(msg));
839 msg.acpted_rply.ar_verf = _null_auth;
840 msg.acpted_rply.ar_results.where = (caddr_t)&rmtcr;
841 msg.acpted_rply.ar_results.proc = xdr_rmtcallres;
842
843 try_again:
844 fromlen = sizeof (struct sockaddr);
845 inlen = recvfrom(rpcsock, buf, sizeof buf, 0,
846 (struct sockaddr *)&raddr, &fromlen);
847 if (inlen == -1) {
848 if (errno == EINTR)
849 goto try_again;
850 return RPC_CANTRECV;
851 }
852 if (inlen < sizeof(u_int32_t))
853 goto recv_again;
854
855 /*
856 * see if reply transaction id matches sent id.
857 * If so, decode the results.
858 */
859 xdrmem_create(&xdr, buf, (u_int)inlen, XDR_DECODE);
860 if (xdr_replymsg(&xdr, &msg)) {
861 if ((msg.rm_reply.rp_stat == MSG_ACCEPTED) &&
862 (msg.acpted_rply.ar_stat == SUCCESS)) {
863 raddr.sin_port = htons((u_short)rmtcr_port);
864 ypdb = xid2ypdb(msg.rm_xid);
865 if (ypdb)
866 rpc_received(ypdb->dom_domain, &raddr, 0);
867 }
868 }
869 xdr.x_op = XDR_FREE;
870 msg.acpted_rply.ar_results.proc = xdr_void;
871 xdr_destroy(&xdr);
872
873 return RPC_SUCCESS;
874 }
875
876 enum clnt_stat
handle_ping(void)877 handle_ping(void)
878 {
879 char buf[1400];
880 int inlen;
881 socklen_t fromlen;
882 struct _dom_binding *ypdb;
883 struct sockaddr_in raddr;
884 struct rpc_msg msg;
885 XDR xdr;
886 bool_t res;
887
888 recv_again:
889 memset(&xdr, 0, sizeof(xdr));
890 memset(&msg, 0, sizeof(msg));
891 msg.acpted_rply.ar_verf = _null_auth;
892 msg.acpted_rply.ar_results.where = (caddr_t)&res;
893 msg.acpted_rply.ar_results.proc = xdr_bool;
894
895 try_again:
896 fromlen = sizeof (struct sockaddr);
897 inlen = recvfrom(pingsock, buf, sizeof buf, 0,
898 (struct sockaddr *)&raddr, &fromlen);
899 if (inlen == -1) {
900 if (errno == EINTR)
901 goto try_again;
902 return RPC_CANTRECV;
903 }
904 if (inlen < sizeof(u_int32_t))
905 goto recv_again;
906
907 /*
908 * see if reply transaction id matches sent id.
909 * If so, decode the results.
910 */
911 xdrmem_create(&xdr, buf, (u_int)inlen, XDR_DECODE);
912 if (xdr_replymsg(&xdr, &msg)) {
913 if ((msg.rm_reply.rp_stat == MSG_ACCEPTED) &&
914 (msg.acpted_rply.ar_stat == SUCCESS)) {
915 ypdb = xid2ypdb(msg.rm_xid);
916 if (ypdb)
917 rpc_received(ypdb->dom_domain, &raddr, 0);
918 }
919 }
920 xdr.x_op = XDR_FREE;
921 msg.acpted_rply.ar_results.proc = xdr_void;
922 xdr_destroy(&xdr);
923
924 return RPC_SUCCESS;
925 }
926
927 /*
928 * We prefer loopback connections.
929 */
930 void
rpc_received(char * dom,struct sockaddr_in * raddrp,int force)931 rpc_received(char *dom, struct sockaddr_in *raddrp, int force)
932 {
933 struct _dom_binding *ypdb;
934 struct iovec iov[3];
935 struct ypbind_resp ybr;
936 char path[PATH_MAX];
937 u_short ypserv_tcp, ypserv_udp;
938 int fd;
939
940 if (strchr(dom, '/'))
941 return;
942
943 #ifdef DEBUG
944 printf("returned from %s about %s\n", inet_ntoa(raddrp->sin_addr), dom);
945 #endif
946
947 if (dom == NULL)
948 return;
949
950 for (ypdb = ypbindlist; ypdb; ypdb = ypdb->dom_pnext)
951 if (!strcmp(ypdb->dom_domain, dom))
952 break;
953
954 if (ypdb == NULL) {
955 if (force == 0)
956 return;
957 ypdb = malloc(sizeof *ypdb);
958 if (ypdb == NULL)
959 return;
960 memset(ypdb, 0, sizeof *ypdb);
961 strlcpy(ypdb->dom_domain, dom, sizeof ypdb->dom_domain);
962 ypdb->dom_lockfd = -1;
963 ypdb->dom_xid = unique_xid(ypdb);
964 ypdb->dom_pnext = ypbindlist;
965 ypbindlist = ypdb;
966 }
967
968 /* we do not support sunos 3.0 insecure servers */
969 if (insecure == 0 && ntohs(raddrp->sin_port) >= IPPORT_RESERVED)
970 return;
971
972 /* soft update, alive */
973 if (ypdb->dom_alive == 1 && force == 0) {
974 if (!memcmp(&ypdb->dom_server_addr, raddrp,
975 sizeof ypdb->dom_server_addr)) {
976 ypdb->dom_alive = 1;
977 /* recheck binding in 60 sec */
978 ypdb->dom_check_t = time(NULL) + 60;
979 }
980 if (raddrp->sin_addr.s_addr == htonl(INADDR_LOOPBACK)) {
981 /*
982 * we are alive and already have a binding, but
983 * after a broadcast we prefer the localhost
984 */
985 memcpy(&ypdb->dom_server_addr, raddrp,
986 sizeof ypdb->dom_server_addr);
987 }
988 return;
989 }
990
991 /* synchronously ask for the matching ypserv TCP port number */
992 ypserv_udp = raddrp->sin_port;
993 ypserv_tcp = pmap_getport(raddrp, YPPROG,
994 YPVERS, IPPROTO_TCP);
995 if (ypserv_tcp == 0) {
996 clnt_pcreateerror("pmap_getport");
997 return;
998 }
999 if (ypserv_tcp >= IPPORT_RESERVED || ypserv_tcp == 20)
1000 return;
1001 ypserv_tcp = htons(ypserv_tcp);
1002
1003 memcpy(&ypdb->dom_server_addr, raddrp, sizeof ypdb->dom_server_addr);
1004 /* recheck binding in 60 seconds */
1005 ypdb->dom_check_t = time(NULL) + 60;
1006 ypdb->dom_vers = YPVERS;
1007 ypdb->dom_alive = 1;
1008
1009 if (ypdb->dom_lockfd != -1)
1010 close(ypdb->dom_lockfd);
1011
1012 snprintf(path, sizeof path, "%s/%s.%d", BINDINGDIR,
1013 ypdb->dom_domain, (int)ypdb->dom_vers);
1014 if ((fd = open(path, O_CREAT|O_SHLOCK|O_RDWR|O_TRUNC, 0644)) == -1) {
1015 (void)mkdir(BINDINGDIR, 0755);
1016 if ((fd = open(path, O_CREAT|O_SHLOCK|O_RDWR|O_TRUNC,
1017 0644)) == -1)
1018 return;
1019 }
1020
1021 /*
1022 * ok, if BINDINGDIR exists, and we can create the binding file,
1023 * then write to it..
1024 */
1025 ypdb->dom_lockfd = fd;
1026
1027 iov[0].iov_base = (caddr_t)&(udptransp->xp_port);
1028 iov[0].iov_len = sizeof udptransp->xp_port;
1029 iov[1].iov_base = (caddr_t)&ybr;
1030 iov[1].iov_len = sizeof ybr;
1031 iov[2].iov_base = (caddr_t)&ypserv_tcp;
1032 iov[2].iov_len = sizeof ypserv_tcp;
1033
1034 memset(&ybr, 0, sizeof ybr);
1035 ybr.ypbind_status = YPBIND_SUCC_VAL;
1036 memmove(&ybr.ypbind_resp_u.ypbind_bindinfo.ypbind_binding_addr,
1037 &raddrp->sin_addr,
1038 sizeof(ybr.ypbind_resp_u.ypbind_bindinfo.ypbind_binding_addr));
1039 memmove(&ybr.ypbind_resp_u.ypbind_bindinfo.ypbind_binding_port,
1040 &ypserv_udp,
1041 sizeof(ybr.ypbind_resp_u.ypbind_bindinfo.ypbind_binding_port));
1042
1043 if (writev(ypdb->dom_lockfd, iov, sizeof(iov)/sizeof(iov[0])) !=
1044 iov[0].iov_len + iov[1].iov_len + iov[2].iov_len) {
1045 perror("write");
1046 close(ypdb->dom_lockfd);
1047 unlink(path);
1048 ypdb->dom_lockfd = -1;
1049 return;
1050 }
1051 }
1052
1053 struct _dom_binding *
xid2ypdb(u_int32_t xid)1054 xid2ypdb(u_int32_t xid)
1055 {
1056 struct _dom_binding *ypdb;
1057
1058 for (ypdb = ypbindlist; ypdb; ypdb = ypdb->dom_pnext)
1059 if (ypdb->dom_xid == xid)
1060 break;
1061 return (ypdb);
1062 }
1063
1064 u_int32_t
unique_xid(struct _dom_binding * ypdb)1065 unique_xid(struct _dom_binding *ypdb)
1066 {
1067 u_int32_t xid;
1068
1069 xid = arc4random();
1070 while (xid2ypdb(xid) != NULL)
1071 xid++;
1072
1073 return (xid);
1074 }
1075