xref: /netbsd/usr.sbin/rpcbind/rpcb_svc_com.c (revision bf9ec67e)
1 /*	$NetBSD: rpcb_svc_com.c,v 1.6 2000/08/03 00:07:22 fvdl Exp $	*/
2 
3 /*
4  * Sun RPC is a product of Sun Microsystems, Inc. and is provided for
5  * unrestricted use provided that this legend is included on all tape
6  * media and as a part of the software program in whole or part.  Users
7  * may copy or modify Sun RPC without charge, but are not authorized
8  * to license or distribute it to anyone else except as part of a product or
9  * program developed by the user.
10  *
11  * SUN RPC IS PROVIDED AS IS WITH NO WARRANTIES OF ANY KIND INCLUDING THE
12  * WARRANTIES OF DESIGN, MERCHANTIBILITY AND FITNESS FOR A PARTICULAR
13  * PURPOSE, OR ARISING FROM A COURSE OF DEALING, USAGE OR TRADE PRACTICE.
14  *
15  * Sun RPC is provided with no support and without any obligation on the
16  * part of Sun Microsystems, Inc. to assist in its use, correction,
17  * modification or enhancement.
18  *
19  * SUN MICROSYSTEMS, INC. SHALL HAVE NO LIABILITY WITH RESPECT TO THE
20  * INFRINGEMENT OF COPYRIGHTS, TRADE SECRETS OR ANY PATENTS BY SUN RPC
21  * OR ANY PART THEREOF.
22  *
23  * In no event will Sun Microsystems, Inc. be liable for any lost revenue
24  * or profits or other special, indirect and consequential damages, even if
25  * Sun has been advised of the possibility of such damages.
26  *
27  * Sun Microsystems, Inc.
28  * 2550 Garcia Avenue
29  * Mountain View, California  94043
30  */
31 /*
32  * Copyright (c) 1986 - 1991 by Sun Microsystems, Inc.
33  */
34 
35 /* #ident	"@(#)rpcb_svc_com.c	1.18	94/05/02 SMI" */
36 
37 /*
38  * rpcb_svc_com.c
39  * The commom server procedure for the rpcbind.
40  */
41 
42 #include <sys/types.h>
43 #include <sys/stat.h>
44 #include <sys/param.h>
45 #include <sys/poll.h>
46 #include <sys/socket.h>
47 #include <rpc/rpc.h>
48 #include <rpc/rpcb_prot.h>
49 #include <netconfig.h>
50 #include <errno.h>
51 #include <syslog.h>
52 #include <unistd.h>
53 #include <stdio.h>
54 #ifdef PORTMAP
55 #include <netinet/in.h>
56 #include <rpc/pmap_prot.h>
57 #endif /* PORTMAP */
58 #include <string.h>
59 #include <stdlib.h>
60 
61 #include "rpcbind.h"
62 #include "svc_dg.h"
63 
64 #define RPC_BUF_MAX	65536	/* can be raised if required */
65 
66 static char *nullstring = "";
67 static int rpcb_rmtcalls;
68 
69 struct rmtcallfd_list {
70 	int fd;
71 	SVCXPRT *xprt;
72 	char *netid;
73 	struct rmtcallfd_list *next;
74 };
75 
76 #define NFORWARD        64
77 #define MAXTIME_OFF     300     /* 5 minutes */
78 
79 struct finfo {
80 	int             flag;
81 #define FINFO_ACTIVE    0x1
82 	u_int32_t       caller_xid;
83         struct netbuf   *caller_addr;
84 	u_int32_t       forward_xid;
85 	int             forward_fd;
86 	char            *uaddr;
87 	rpcproc_t       reply_type;
88 	rpcvers_t       versnum;
89 	time_t          time;
90 };
91 static struct finfo     FINFO[NFORWARD];
92 
93 
94 static bool_t xdr_encap_parms __P((XDR *, struct encap_parms *));
95 static bool_t xdr_rmtcall_args __P((XDR *, struct r_rmtcall_args *));
96 static bool_t xdr_rmtcall_result __P((XDR *, struct r_rmtcall_args *));
97 static bool_t xdr_opaque_parms __P((XDR *, struct r_rmtcall_args *));
98 static int find_rmtcallfd_by_netid __P((char *));
99 static SVCXPRT *find_rmtcallxprt_by_fd __P((int));
100 static u_int32_t forward_register __P((u_int32_t, struct netbuf *, int, char *,
101 				    rpcproc_t, rpcvers_t));
102 static struct finfo *forward_find __P((u_int32_t));
103 static int free_slot_by_xid __P((u_int32_t));
104 static int free_slot_by_index __P((int));
105 static int netbufcmp __P((struct netbuf *, struct netbuf *));
106 static struct netbuf *netbufdup __P((struct netbuf *));
107 static void netbuffree __P((struct netbuf *));
108 static int check_rmtcalls __P((struct pollfd *, int));
109 static void xprt_set_caller __P((SVCXPRT *, struct finfo *));
110 static void send_svcsyserr __P((SVCXPRT *, struct finfo *));
111 static void handle_reply __P((int, SVCXPRT *));
112 static void find_versions __P((rpcprog_t, char *, rpcvers_t *, rpcvers_t *));
113 static rpcblist_ptr find_service __P((rpcprog_t, rpcvers_t, char *));
114 static char *getowner __P((SVCXPRT *, char *, size_t));
115 static int add_pmaplist __P((RPCB *));
116 static int del_pmaplist __P((RPCB *));
117 
118 /*
119  * Set a mapping of program, version, netid
120  */
121 /* ARGSUSED */
122 void *
123 rpcbproc_set_com(void *arg, struct svc_req *rqstp, SVCXPRT *transp,
124 		 rpcvers_t rpcbversnum)
125 {
126 	RPCB *regp = (RPCB *)arg;
127 	static bool_t ans;
128 	char owner[64];
129 
130 #ifdef RPCBIND_DEBUG
131 	if (debugging)
132 		fprintf(stderr, "RPCB_SET request for (%lu, %lu, %s, %s) : ",
133 		    (unsigned long)regp->r_prog, (unsigned long)regp->r_vers,
134 		    regp->r_netid, regp->r_addr);
135 #endif
136 	ans = map_set(regp, getowner(transp, owner, sizeof owner));
137 #ifdef RPCBIND_DEBUG
138 	if (debugging)
139 		fprintf(stderr, "%s\n", ans == TRUE ? "succeeded" : "failed");
140 #endif
141 	/* XXX: should have used some defined constant here */
142 	rpcbs_set(rpcbversnum - 2, ans);
143 	return (void *)&ans;
144 }
145 
146 bool_t
147 map_set(RPCB *regp, char *owner)
148 {
149 	RPCB reg, *a;
150 	rpcblist_ptr rbl, fnd;
151 
152 	reg = *regp;
153 	/*
154 	 * check to see if already used
155 	 * find_service returns a hit even if
156 	 * the versions don't match, so check for it
157 	 */
158 	fnd = find_service(reg.r_prog, reg.r_vers, reg.r_netid);
159 	if (fnd && (fnd->rpcb_map.r_vers == reg.r_vers)) {
160 		if (!strcmp(fnd->rpcb_map.r_addr, reg.r_addr))
161 			/*
162 			 * if these match then it is already
163 			 * registered so just say "OK".
164 			 */
165 			return (TRUE);
166 		else
167 			return (FALSE);
168 	}
169 	/*
170 	 * add to the end of the list
171 	 */
172 	rbl = (rpcblist_ptr) malloc((u_int)sizeof (RPCBLIST));
173 	if (rbl == (rpcblist_ptr)NULL) {
174 		return (FALSE);
175 	}
176 	a = &(rbl->rpcb_map);
177 	a->r_prog = reg.r_prog;
178 	a->r_vers = reg.r_vers;
179 	a->r_netid = strdup(reg.r_netid);
180 	a->r_addr = strdup(reg.r_addr);
181 	a->r_owner = strdup(owner);
182 	if (!a->r_addr || !a->r_netid || !a->r_owner) {
183 		if (a->r_netid)
184 			free((void *) a->r_netid);
185 		if (a->r_addr)
186 			free((void *) a->r_addr);
187 		if (a->r_owner)
188 			free((void *) a->r_owner);
189 		free((void *)rbl);
190 		return (FALSE);
191 	}
192 	rbl->rpcb_next = (rpcblist_ptr)NULL;
193 	if (list_rbl == NULL) {
194 		list_rbl = rbl;
195 	} else {
196 		for (fnd = list_rbl; fnd->rpcb_next;
197 			fnd = fnd->rpcb_next)
198 			;
199 		fnd->rpcb_next = rbl;
200 	}
201 #ifdef PORTMAP
202 	(void) add_pmaplist(regp);
203 #endif
204 	return (TRUE);
205 }
206 
207 /*
208  * Unset a mapping of program, version, netid
209  */
210 /* ARGSUSED */
211 void *
212 rpcbproc_unset_com(void *arg, struct svc_req *rqstp, SVCXPRT *transp,
213 		   rpcvers_t rpcbversnum)
214 {
215 	RPCB *regp = (RPCB *)arg;
216 	static bool_t ans;
217 	char owner[64];
218 
219 #ifdef RPCBIND_DEBUG
220 	if (debugging)
221 		fprintf(stderr, "RPCB_UNSET request for (%lu, %lu, %s) : ",
222 		    (unsigned long)regp->r_prog, (unsigned long)regp->r_vers,
223 		    regp->r_netid);
224 #endif
225 	ans = map_unset(regp, getowner(transp, owner, sizeof owner));
226 #ifdef RPCBIND_DEBUG
227 	if (debugging)
228 		fprintf(stderr, "%s\n", ans == TRUE ? "succeeded" : "failed");
229 #endif
230 	/* XXX: should have used some defined constant here */
231 	rpcbs_unset(rpcbversnum - 2, ans);
232 	return (void *)&ans;
233 }
234 
235 bool_t
236 map_unset(RPCB *regp, char *owner)
237 {
238 	int ans = 0;
239 	rpcblist_ptr rbl, prev, tmp;
240 
241 	if (owner == NULL)
242 		return (0);
243 
244 	for (prev = NULL, rbl = list_rbl; rbl; /* cstyle */) {
245 		if ((rbl->rpcb_map.r_prog != regp->r_prog) ||
246 			(rbl->rpcb_map.r_vers != regp->r_vers) ||
247 			(regp->r_netid[0] && strcasecmp(regp->r_netid,
248 				rbl->rpcb_map.r_netid))) {
249 			/* both rbl & prev move forwards */
250 			prev = rbl;
251 			rbl = rbl->rpcb_next;
252 			continue;
253 		}
254 		/*
255 		 * Check whether appropriate uid. Unset only
256 		 * if superuser or the owner itself.
257 		 */
258 		if (strcmp(owner, "superuser") &&
259 			strcmp(rbl->rpcb_map.r_owner, owner))
260 			return (0);
261 		/* found it; rbl moves forward, prev stays */
262 		ans = 1;
263 		tmp = rbl;
264 		rbl = rbl->rpcb_next;
265 		if (prev == NULL)
266 			list_rbl = rbl;
267 		else
268 			prev->rpcb_next = rbl;
269 		free((void *) tmp->rpcb_map.r_addr);
270 		free((void *) tmp->rpcb_map.r_netid);
271 		free((void *) tmp->rpcb_map.r_owner);
272 		free((void *) tmp);
273 	}
274 #ifdef PORTMAP
275 	if (ans)
276 		(void) del_pmaplist(regp);
277 #endif
278 	/*
279 	 * We return 1 either when the entry was not there or it
280 	 * was able to unset it.  It can come to this point only if
281 	 * atleast one of the conditions is true.
282 	 */
283 	return (1);
284 }
285 
286 void
287 delete_prog(int prog)
288 {
289 	RPCB reg;
290 	register rpcblist_ptr rbl;
291 
292 	for (rbl = list_rbl; rbl != NULL; rbl = rbl->rpcb_next) {
293 		if ((rbl->rpcb_map.r_prog != prog))
294 			continue;
295 		if (is_bound(rbl->rpcb_map.r_netid, rbl->rpcb_map.r_addr))
296 			continue;
297 		reg.r_prog = rbl->rpcb_map.r_prog;
298 		reg.r_vers = rbl->rpcb_map.r_vers;
299 		reg.r_netid = strdup(rbl->rpcb_map.r_netid);
300 		(void) map_unset(&reg, "superuser");
301 		free(reg.r_netid);
302 	}
303 }
304 
305 void *
306 rpcbproc_getaddr_com(RPCB *regp, struct svc_req *rqstp, SVCXPRT *transp,
307 		     rpcvers_t rpcbversnum, rpcvers_t verstype)
308 {
309 	static char *uaddr;
310 	char *saddr = NULL;
311 	rpcblist_ptr fnd;
312 
313 	if (uaddr && uaddr[0])
314 		free((void *) uaddr);
315 	fnd = find_service(regp->r_prog, regp->r_vers, transp->xp_netid);
316 	if (fnd && ((verstype == RPCB_ALLVERS) ||
317 		    (regp->r_vers == fnd->rpcb_map.r_vers))) {
318 		if (*(regp->r_addr) != '\0') {  /* may contain a hint about */
319 			saddr = regp->r_addr;   /* the interface that we    */
320 		}				/* should use */
321 		if (!(uaddr = mergeaddr(transp, transp->xp_netid,
322 				fnd->rpcb_map.r_addr, saddr))) {
323 			/* Try whatever we have */
324 			uaddr = strdup(fnd->rpcb_map.r_addr);
325 		} else if (!uaddr[0]) {
326 			/*
327 			 * The server died.  Unset all versions of this prog.
328 			 */
329 			delete_prog(regp->r_prog);
330 			uaddr = nullstring;
331 		}
332 	} else {
333 		uaddr = nullstring;
334 	}
335 #ifdef RPCBIND_DEBUG
336 	if (debugging)
337 		fprintf(stderr, "getaddr: %s\n", uaddr);
338 #endif
339 	/* XXX: should have used some defined constant here */
340 	rpcbs_getaddr(rpcbversnum - 2, regp->r_prog, regp->r_vers,
341 		transp->xp_netid, uaddr);
342 	return (void *)&uaddr;
343 }
344 
345 /* ARGSUSED */
346 void *
347 rpcbproc_gettime_com(void *arg, struct svc_req *rqstp, SVCXPRT *transp,
348 		     rpcvers_t rpcbversnum)
349 {
350 	static time_t curtime;
351 
352 	(void) time(&curtime);
353 	return (void *)&curtime;
354 }
355 
356 /*
357  * Convert uaddr to taddr. Should be used only by
358  * local servers/clients. (kernel level stuff only)
359  */
360 /* ARGSUSED */
361 void *
362 rpcbproc_uaddr2taddr_com(void *arg, struct svc_req *rqstp, SVCXPRT *transp,
363 			 rpcvers_t rpcbversnum)
364 {
365 	char **uaddrp = (char **)arg;
366 	struct netconfig *nconf;
367 	static struct netbuf nbuf;
368 	static struct netbuf *taddr;
369 
370 	if (taddr) {
371 		free((void *) taddr->buf);
372 		free((void *) taddr);
373 	}
374 	if (((nconf = rpcbind_get_conf(transp->xp_netid)) == NULL) ||
375 	    ((taddr = uaddr2taddr(nconf, *uaddrp)) == NULL)) {
376 		(void) memset((char *)&nbuf, 0, sizeof (struct netbuf));
377 		return (void *)&nbuf;
378 	}
379 	return (void *)taddr;
380 }
381 
382 /*
383  * Convert taddr to uaddr. Should be used only by
384  * local servers/clients. (kernel level stuff only)
385  */
386 /* ARGSUSED */
387 void *
388 rpcbproc_taddr2uaddr_com(void *arg, struct svc_req *rqstp, SVCXPRT *transp,
389 			 rpcvers_t rpcbversnum)
390 {
391 	struct netbuf *taddr = (struct netbuf *)arg;
392 	static char *uaddr;
393 	struct netconfig *nconf;
394 
395 #ifdef CHEW_FDS
396 	int fd;
397 
398 	if ((fd = open("/dev/null", O_RDONLY)) == -1) {
399 		uaddr = (char *)strerror(errno);
400 		return (&uaddr);
401 	}
402 #endif /* CHEW_FDS */
403 	if (uaddr && !uaddr[0])
404 		free((void *) uaddr);
405 	if (((nconf = rpcbind_get_conf(transp->xp_netid)) == NULL) ||
406 		((uaddr = taddr2uaddr(nconf, taddr)) == NULL)) {
407 		uaddr = nullstring;
408 	}
409 	return (void *)&uaddr;
410 }
411 
412 
413 static bool_t
414 xdr_encap_parms(XDR *xdrs, struct encap_parms *epp)
415 {
416 	return (xdr_bytes(xdrs, &(epp->args), (u_int *) &(epp->arglen), ~0));
417 }
418 
419 /*
420  * XDR remote call arguments.  It ignores the address part.
421  * written for XDR_DECODE direction only
422  */
423 static bool_t
424 xdr_rmtcall_args(XDR *xdrs, struct r_rmtcall_args *cap)
425 {
426 	/* does not get the address or the arguments */
427 	if (xdr_u_int32_t(xdrs, &(cap->rmt_prog)) &&
428 	    xdr_u_int32_t(xdrs, &(cap->rmt_vers)) &&
429 	    xdr_u_int32_t(xdrs, &(cap->rmt_proc))) {
430 		return (xdr_encap_parms(xdrs, &(cap->rmt_args)));
431 	}
432 	return (FALSE);
433 }
434 
435 /*
436  * XDR remote call results along with the address.  Ignore
437  * program number, version  number and proc number.
438  * Written for XDR_ENCODE direction only.
439  */
440 static bool_t
441 xdr_rmtcall_result(XDR *xdrs, struct r_rmtcall_args *cap)
442 {
443 	bool_t result;
444 
445 #ifdef PORTMAP
446 	if (cap->rmt_localvers == PMAPVERS) {
447 		int h1, h2, h3, h4, p1, p2;
448 		u_long port;
449 
450 		/* interpret the universal address for TCP/IP */
451 		if (sscanf(cap->rmt_uaddr, "%d.%d.%d.%d.%d.%d",
452 			&h1, &h2, &h3, &h4, &p1, &p2) != 6)
453 			return (FALSE);
454 		port = ((p1 & 0xff) << 8) + (p2 & 0xff);
455 		result = xdr_u_long(xdrs, &port);
456 	} else
457 #endif
458 		if ((cap->rmt_localvers == RPCBVERS) ||
459 		    (cap->rmt_localvers == RPCBVERS4)) {
460 		result = xdr_wrapstring(xdrs, &(cap->rmt_uaddr));
461 	} else {
462 		return (FALSE);
463 	}
464 	if (result == TRUE)
465 		return (xdr_encap_parms(xdrs, &(cap->rmt_args)));
466 	return (FALSE);
467 }
468 
469 /*
470  * only worries about the struct encap_parms part of struct r_rmtcall_args.
471  * The arglen must already be set!!
472  */
473 static bool_t
474 xdr_opaque_parms(XDR *xdrs, struct r_rmtcall_args *cap)
475 {
476 	return (xdr_opaque(xdrs, cap->rmt_args.args, cap->rmt_args.arglen));
477 }
478 
479 static struct rmtcallfd_list *rmthead;
480 static struct rmtcallfd_list *rmttail;
481 
482 int
483 create_rmtcall_fd(struct netconfig *nconf)
484 {
485 	int fd;
486 	struct rmtcallfd_list *rmt;
487 	SVCXPRT *xprt;
488 
489 	if ((fd = __rpc_nconf2fd(nconf)) == -1) {
490 		if (debugging)
491 			fprintf(stderr,
492 	"create_rmtcall_fd: couldn't open \"%s\" (errno %d)\n",
493 			nconf->nc_device, errno);
494 		return (-1);
495 	}
496 	xprt = svc_tli_create(fd, 0, (struct t_bind *) 0, 0, 0);
497 	if (xprt == NULL) {
498 		if (debugging)
499 			fprintf(stderr,
500 				"create_rmtcall_fd: svc_tli_create failed\n");
501 		return (-1);
502 	}
503 	rmt = (struct rmtcallfd_list *)malloc((u_int)
504 		sizeof (struct rmtcallfd_list));
505 	if (rmt == NULL) {
506 		syslog(LOG_ERR, "create_rmtcall_fd: no memory!");
507 		return (-1);
508 	}
509 	rmt->xprt = xprt;
510 	rmt->netid = strdup(nconf->nc_netid);
511 	xprt->xp_netid = rmt->netid;
512 	rmt->fd = fd;
513 	rmt->next = NULL;
514 	if (rmthead == NULL) {
515 		rmthead = rmt;
516 		rmttail = rmt;
517 	} else {
518 		rmttail->next = rmt;
519 		rmttail = rmt;
520 	}
521 	/* XXX not threadsafe */
522 	if (fd > svc_maxfd)
523 		svc_maxfd = fd;
524 	FD_SET(fd, &svc_fdset);
525 	return (fd);
526 }
527 
528 static int
529 find_rmtcallfd_by_netid(char *netid)
530 {
531 	struct rmtcallfd_list *rmt;
532 
533 	for (rmt = rmthead; rmt != NULL; rmt = rmt->next) {
534 		if (strcmp(netid, rmt->netid) == 0) {
535 			return (rmt->fd);
536 		}
537 	}
538 	return (-1);
539 }
540 
541 static SVCXPRT *
542 find_rmtcallxprt_by_fd(int fd)
543 {
544 	struct rmtcallfd_list *rmt;
545 
546 	for (rmt = rmthead; rmt != NULL; rmt = rmt->next) {
547 		if (fd == rmt->fd) {
548 			return (rmt->xprt);
549 		}
550 	}
551 	return (NULL);
552 }
553 
554 
555 /*
556  * Call a remote procedure service.  This procedure is very quiet when things
557  * go wrong.  The proc is written to support broadcast rpc.  In the broadcast
558  * case, a machine should shut-up instead of complain, lest the requestor be
559  * overrun with complaints at the expense of not hearing a valid reply.
560  * When receiving a request and verifying that the service exists, we
561  *
562  *	receive the request
563  *
564  *	open a new TLI endpoint on the same transport on which we received
565  *	the original request
566  *
567  *	remember the original request's XID (which requires knowing the format
568  *	of the svc_dg_data structure)
569  *
570  *	forward the request, with a new XID, to the requested service,
571  *	remembering the XID used to send this request (for later use in
572  *	reassociating the answer with the original request), the requestor's
573  *	address, the file descriptor on which the forwarded request is
574  *	made and the service's address.
575  *
576  *	mark the file descriptor on which we anticipate receiving a reply from
577  *	the service and one to select for in our private svc_run procedure
578  *
579  * At some time in the future, a reply will be received from the service to
580  * which we forwarded the request.  At that time, we detect that the socket
581  * used was for forwarding (by looking through the finfo structures to see
582  * whether the fd corresponds to one of those) and call handle_reply() to
583  *
584  *	receive the reply
585  *
586  *	bundle the reply, along with the service's universal address
587  *
588  *	create a SVCXPRT structure and use a version of svc_sendreply
589  *	that allows us to specify the reply XID and destination, send the reply
590  *	to the original requestor.
591  */
592 
593 void
594 rpcbproc_callit_com(struct svc_req *rqstp, SVCXPRT *transp,
595 		    rpcproc_t reply_type, rpcvers_t versnum)
596 {
597 	register rpcblist_ptr rbl;
598 	struct netconfig *nconf;
599 	struct netbuf *caller;
600 	struct r_rmtcall_args a;
601 	char *buf_alloc = NULL, *outbufp;
602 	char *outbuf_alloc = NULL;
603 	char buf[RPC_BUF_MAX], outbuf[RPC_BUF_MAX];
604 	struct netbuf *na = (struct netbuf *) NULL;
605 	struct rpc_msg call_msg;
606 	int outlen;
607 	u_int sendsz;
608 	XDR outxdr;
609 	AUTH *auth;
610 	int fd = -1;
611 	char *uaddr, *m_uaddr, *local_uaddr = NULL;
612 	u_int32_t *xidp;
613 	struct __rpc_sockinfo si;
614 	struct sockaddr *localsa;
615 	struct netbuf tbuf;
616 
617 	if (!__rpc_fd2sockinfo(transp->xp_fd, &si)) {
618 		if (reply_type == RPCBPROC_INDIRECT)
619 			svcerr_systemerr(transp);
620 		return;
621 	}
622 	if (si.si_socktype != SOCK_DGRAM)
623 		return;	/* Only datagram type accepted */
624 	sendsz = __rpc_get_t_size(si.si_af, si.si_proto, UDPMSGSIZE);
625 	if (sendsz == 0) {	/* data transfer not supported */
626 		if (reply_type == RPCBPROC_INDIRECT)
627 			svcerr_systemerr(transp);
628 		return;
629 	}
630 	/*
631 	 * Should be multiple of 4 for XDR.
632 	 */
633 	sendsz = ((sendsz + 3) / 4) * 4;
634 	if (sendsz > RPC_BUF_MAX) {
635 #ifdef	notyet
636 		buf_alloc = alloca(sendsz);		/* not in IDR2? */
637 #else
638 		buf_alloc = malloc(sendsz);
639 #endif	/* notyet */
640 		if (buf_alloc == NULL) {
641 			if (debugging)
642 				fprintf(stderr,
643 					"rpcbproc_callit_com:  No Memory!\n");
644 			if (reply_type == RPCBPROC_INDIRECT)
645 				svcerr_systemerr(transp);
646 			return;
647 		}
648 		a.rmt_args.args = buf_alloc;
649 	} else {
650 		a.rmt_args.args = buf;
651 	}
652 
653 	call_msg.rm_xid = 0;	/* For error checking purposes */
654 	if (!svc_getargs(transp, (xdrproc_t) xdr_rmtcall_args, (char *) &a)) {
655 		if (reply_type == RPCBPROC_INDIRECT)
656 			svcerr_decode(transp);
657 		if (debugging)
658 			fprintf(stderr,
659 			"rpcbproc_callit_com:  svc_getargs failed\n");
660 		goto error;
661 	}
662 
663 	if (!check_callit(transp, &a, versnum)) {
664 		svcerr_weakauth(transp);
665 		goto error;
666 	}
667 
668 	caller = svc_getrpccaller(transp);
669 #ifdef RPCBIND_DEBUG
670 	if (debugging) {
671 		uaddr = taddr2uaddr(rpcbind_get_conf(transp->xp_netid), caller);
672 		fprintf(stderr, "%s %s req for (%lu, %lu, %lu, %s) from %s : ",
673 			versnum == PMAPVERS ? "pmap_rmtcall" :
674 			versnum == RPCBVERS ? "rpcb_rmtcall" :
675 			versnum == RPCBVERS4 ? "rpcb_indirect" : "unknown",
676 			reply_type == RPCBPROC_INDIRECT ? "indirect" : "callit",
677 			(unsigned long)a.rmt_prog, (unsigned long)a.rmt_vers,
678 			(unsigned long)a.rmt_proc, transp->xp_netid,
679 			uaddr ? uaddr : "unknown");
680 		if (uaddr)
681 			free((void *) uaddr);
682 	}
683 #endif
684 
685 	rbl = find_service(a.rmt_prog, a.rmt_vers, transp->xp_netid);
686 
687 	rpcbs_rmtcall(versnum - 2, reply_type, a.rmt_prog, a.rmt_vers,
688 			a.rmt_proc, transp->xp_netid, rbl);
689 
690 	if (rbl == (rpcblist_ptr)NULL) {
691 #ifdef RPCBIND_DEBUG
692 		if (debugging)
693 			fprintf(stderr, "not found\n");
694 #endif
695 		if (reply_type == RPCBPROC_INDIRECT)
696 			svcerr_noprog(transp);
697 		goto error;
698 	}
699 	if (rbl->rpcb_map.r_vers != a.rmt_vers) {
700 		if (reply_type == RPCBPROC_INDIRECT) {
701 			rpcvers_t vers_low, vers_high;
702 
703 			find_versions(a.rmt_prog, transp->xp_netid,
704 				&vers_low, &vers_high);
705 			svcerr_progvers(transp, vers_low, vers_high);
706 		}
707 		goto error;
708 	}
709 
710 #ifdef RPCBIND_DEBUG
711 	if (debugging)
712 		fprintf(stderr, "found at uaddr %s\n", rbl->rpcb_map.r_addr);
713 #endif
714 	/*
715 	 *	Check whether this entry is valid and a server is present
716 	 *	Mergeaddr() returns NULL if no such entry is present, and
717 	 *	returns "" if the entry was present but the server is not
718 	 *	present (i.e., it crashed).
719 	 */
720 	if (reply_type == RPCBPROC_INDIRECT) {
721 		uaddr = mergeaddr(transp, transp->xp_netid,
722 			rbl->rpcb_map.r_addr, NULL);
723 		if ((uaddr == (char *) NULL) || uaddr[0] == '\0') {
724 			svcerr_noprog(transp);
725 			if (uaddr != NULL) {
726 				free((void *) uaddr);
727 			}
728 			goto error;
729 		}
730 		if (uaddr != NULL) {
731 			free((void *) uaddr);
732 		}
733 	}
734 	nconf = rpcbind_get_conf(transp->xp_netid);
735 	if (nconf == (struct netconfig *)NULL) {
736 		if (reply_type == RPCBPROC_INDIRECT)
737 			svcerr_systemerr(transp);
738 		if (debugging)
739 			fprintf(stderr,
740 			"rpcbproc_callit_com:  rpcbind_get_conf failed\n");
741 		goto error;
742 	}
743 	localsa = local_sa(((struct sockaddr *)caller->buf)->sa_family);
744 	if (localsa == NULL) {
745 		if (debugging)
746 			fprintf(stderr,
747 			"rpcbproc_callit_com: no local address\n");
748 		goto error;
749 	}
750 	tbuf.len = tbuf.maxlen = localsa->sa_len;
751 	tbuf.buf = localsa;
752 	local_uaddr =
753 	    addrmerge(&tbuf, rbl->rpcb_map.r_addr, NULL, nconf->nc_netid);
754 	m_uaddr = addrmerge(caller, rbl->rpcb_map.r_addr, NULL,
755 			nconf->nc_netid);
756 #ifdef RPCBIND_DEBUG
757 	if (debugging)
758 		fprintf(stderr, "merged uaddr %s\n", m_uaddr);
759 #endif
760 	if ((fd = find_rmtcallfd_by_netid(nconf->nc_netid)) == -1) {
761 		if (reply_type == RPCBPROC_INDIRECT)
762 			svcerr_systemerr(transp);
763 		free((void *) m_uaddr);
764 		goto error;
765 	}
766 	xidp = __rpcb_get_dg_xidp(transp);
767 	call_msg.rm_xid = forward_register(*xidp,
768 			caller, fd, m_uaddr, reply_type, versnum);
769 	if (call_msg.rm_xid == 0) {
770 		/*
771 		 * A duplicate request for the slow server.  Let's not
772 		 * beat on it any more.
773 		 */
774 		if (debugging)
775 			fprintf(stderr,
776 			"rpcbproc_callit_com:  duplicate request\n");
777 		free((void *) m_uaddr);
778 		goto error;
779 	} else 	if (call_msg.rm_xid == -1) {
780 		/*  forward_register failed.  Perhaps no memory. */
781 		if (debugging)
782 			fprintf(stderr,
783 			"rpcbproc_callit_com:  forward_register failed\n");
784 		free((void *) m_uaddr);
785 		goto error;
786 	}
787 
788 #ifdef DEBUG_RMTCALL
789 	if (debugging)
790 		fprintf(stderr,
791 			"rpcbproc_callit_com:  original XID %x, new XID %x\n",
792 				*xidp, call_msg.rm_xid);
793 #endif
794 	call_msg.rm_direction = CALL;
795 	call_msg.rm_call.cb_rpcvers = RPC_MSG_VERSION;
796 	call_msg.rm_call.cb_prog = a.rmt_prog;
797 	call_msg.rm_call.cb_vers = a.rmt_vers;
798 	if (sendsz > RPC_BUF_MAX) {
799 #ifdef	notyet
800 		outbuf_alloc = alloca(sendsz);	/* not in IDR2? */
801 #else
802 		outbuf_alloc = malloc(sendsz);
803 #endif	/* notyet */
804 		if (outbuf_alloc == NULL) {
805 			if (reply_type == RPCBPROC_INDIRECT)
806 				svcerr_systemerr(transp);
807 			if (debugging)
808 				fprintf(stderr,
809 				"rpcbproc_callit_com:  No memory!\n");
810 			goto error;
811 		}
812 		xdrmem_create(&outxdr, outbuf_alloc, sendsz, XDR_ENCODE);
813 	} else {
814 		xdrmem_create(&outxdr, outbuf, sendsz, XDR_ENCODE);
815 	}
816 	if (!xdr_callhdr(&outxdr, &call_msg)) {
817 		if (reply_type == RPCBPROC_INDIRECT)
818 			svcerr_systemerr(transp);
819 		if (debugging)
820 			fprintf(stderr,
821 			"rpcbproc_callit_com:  xdr_callhdr failed\n");
822 		goto error;
823 	}
824 	if (!xdr_u_int32_t(&outxdr, &(a.rmt_proc))) {
825 		if (reply_type == RPCBPROC_INDIRECT)
826 			svcerr_systemerr(transp);
827 		if (debugging)
828 			fprintf(stderr,
829 			"rpcbproc_callit_com:  xdr_u_long failed\n");
830 		goto error;
831 	}
832 
833 	if (rqstp->rq_cred.oa_flavor == AUTH_NULL) {
834 		auth = authnone_create();
835 	} else if (rqstp->rq_cred.oa_flavor == AUTH_SYS) {
836 		struct authunix_parms *au;
837 
838 		au = (struct authunix_parms *)rqstp->rq_clntcred;
839 		auth = authunix_create(au->aup_machname,
840 				au->aup_uid, au->aup_gid,
841 				au->aup_len, au->aup_gids);
842 		if (auth == NULL) /* fall back */
843 			auth = authnone_create();
844 	} else {
845 		/* we do not support any other authentication scheme */
846 		if (debugging)
847 			fprintf(stderr,
848 "rpcbproc_callit_com:  oa_flavor != AUTH_NONE and oa_flavor != AUTH_SYS\n");
849 		if (reply_type == RPCBPROC_INDIRECT)
850 			svcerr_weakauth(transp); /* XXX too strong.. */
851 		goto error;
852 	}
853 	if (auth == NULL) {
854 		if (reply_type == RPCBPROC_INDIRECT)
855 			svcerr_systemerr(transp);
856 		if (debugging)
857 			fprintf(stderr,
858 		"rpcbproc_callit_com:  authwhatever_create returned NULL\n");
859 		goto error;
860 	}
861 	if (!AUTH_MARSHALL(auth, &outxdr)) {
862 		if (reply_type == RPCBPROC_INDIRECT)
863 			svcerr_systemerr(transp);
864 		AUTH_DESTROY(auth);
865 		if (debugging)
866 			fprintf(stderr,
867 		"rpcbproc_callit_com:  AUTH_MARSHALL failed\n");
868 		goto error;
869 	}
870 	AUTH_DESTROY(auth);
871 	if (!xdr_opaque_parms(&outxdr, &a)) {
872 		if (reply_type == RPCBPROC_INDIRECT)
873 			svcerr_systemerr(transp);
874 		if (debugging)
875 			fprintf(stderr,
876 		"rpcbproc_callit_com:  xdr_opaque_parms failed\n");
877 		goto error;
878 	}
879 	outlen = (int) XDR_GETPOS(&outxdr);
880 	if (outbuf_alloc)
881 		outbufp = outbuf_alloc;
882 	else
883 		outbufp = outbuf;
884 
885 	na = uaddr2taddr(nconf, local_uaddr);
886 	if (!na) {
887 		if (reply_type == RPCBPROC_INDIRECT)
888 			svcerr_systemerr(transp);
889 		goto error;
890 	}
891 
892 	if (sendto(fd, outbufp, outlen, 0, (struct sockaddr *)na->buf, na->len)
893 	    != outlen) {
894 		if (debugging)
895 			fprintf(stderr,
896 	"rpcbproc_callit_com:  sendto failed:  errno %d\n", errno);
897 		if (reply_type == RPCBPROC_INDIRECT)
898 			svcerr_systemerr(transp);
899 		goto error;
900 	}
901 	goto out;
902 
903 error:
904 	if (call_msg.rm_xid != 0)
905 		(void) free_slot_by_xid(call_msg.rm_xid);
906 out:
907 	if (local_uaddr)
908 		free(local_uaddr);
909 	if (buf_alloc)
910 		free((void *) buf_alloc);
911 	if (outbuf_alloc)
912 		free((void *) outbuf_alloc);
913 	if (na) {
914 		free(na->buf);
915 		free(na);
916 	}
917 }
918 
919 /*
920  * Makes an entry into the FIFO for the given request.
921  * If duplicate request, returns a 0, else returns the xid of its call.
922  */
923 static u_int32_t
924 forward_register(u_int32_t caller_xid, struct netbuf *caller_addr,
925 		 int forward_fd, char *uaddr, rpcproc_t reply_type,
926 		 rpcvers_t versnum)
927 {
928 	int		i;
929 	int		j = 0;
930 	time_t		min_time, time_now;
931 	static u_int32_t	lastxid;
932 	int		entry = -1;
933 
934 	min_time = FINFO[0].time;
935 	time_now = time((time_t *)0);
936 	/* initialization */
937 	if (lastxid == 0)
938 		lastxid = time_now * NFORWARD;
939 
940 	/*
941 	 * Check if it is an duplicate entry. Then,
942 	 * try to find an empty slot.  If not available, then
943 	 * use the slot with the earliest time.
944 	 */
945 	for (i = 0; i < NFORWARD; i++) {
946 		if (FINFO[i].flag & FINFO_ACTIVE) {
947 			if ((FINFO[i].caller_xid == caller_xid) &&
948 			    (FINFO[i].reply_type == reply_type) &&
949 			    (FINFO[i].versnum == versnum) &&
950 			    (!netbufcmp(FINFO[i].caller_addr,
951 					    caller_addr))) {
952 				FINFO[i].time = time((time_t *)0);
953 				return (0);	/* Duplicate entry */
954 			} else {
955 				/* Should we wait any longer */
956 				if ((time_now - FINFO[i].time) > MAXTIME_OFF)
957 					(void) free_slot_by_index(i);
958 			}
959 		}
960 		if (entry == -1) {
961 			if ((FINFO[i].flag & FINFO_ACTIVE) == 0) {
962 				entry = i;
963 			} else if (FINFO[i].time < min_time) {
964 				j = i;
965 				min_time = FINFO[i].time;
966 			}
967 		}
968 	}
969 	if (entry != -1) {
970 		/* use this empty slot */
971 		j = entry;
972 	} else {
973 		(void) free_slot_by_index(j);
974 	}
975 	if ((FINFO[j].caller_addr = netbufdup(caller_addr)) == NULL) {
976 		return (-1);
977 	}
978 	rpcb_rmtcalls++;	/* no of pending calls */
979 	FINFO[j].flag = FINFO_ACTIVE;
980 	FINFO[j].reply_type = reply_type;
981 	FINFO[j].versnum = versnum;
982 	FINFO[j].time = time_now;
983 	FINFO[j].caller_xid = caller_xid;
984 	FINFO[j].forward_fd = forward_fd;
985 	/*
986 	 * Though uaddr is not allocated here, it will still be freed
987 	 * from free_slot_*().
988 	 */
989 	FINFO[j].uaddr = uaddr;
990 	lastxid = lastxid + NFORWARD;
991 	FINFO[j].forward_xid = lastxid + j;	/* encode slot */
992 	return (FINFO[j].forward_xid);		/* forward on this xid */
993 }
994 
995 static struct finfo *
996 forward_find(u_int32_t reply_xid)
997 {
998 	int		i;
999 
1000 	i = reply_xid % NFORWARD;
1001 	if (i < 0)
1002 		i += NFORWARD;
1003 	if ((FINFO[i].flag & FINFO_ACTIVE) &&
1004 	    (FINFO[i].forward_xid == reply_xid)) {
1005 		return (&FINFO[i]);
1006 	}
1007 	return (NULL);
1008 }
1009 
1010 static int
1011 free_slot_by_xid(u_int32_t xid)
1012 {
1013 	int entry;
1014 
1015 	entry = xid % NFORWARD;
1016 	if (entry < 0)
1017 		entry += NFORWARD;
1018 	return (free_slot_by_index(entry));
1019 }
1020 
1021 static int
1022 free_slot_by_index(int index)
1023 {
1024 	struct finfo	*fi;
1025 
1026 	fi = &FINFO[index];
1027 	if (fi->flag & FINFO_ACTIVE) {
1028 		netbuffree(fi->caller_addr);
1029 		/* XXX may be too big, but can't access xprt array here */
1030 		if (fi->forward_fd >= svc_maxfd)
1031 			svc_maxfd--;
1032 		free((void *) fi->uaddr);
1033 		fi->flag &= ~FINFO_ACTIVE;
1034 		rpcb_rmtcalls--;
1035 		return (1);
1036 	}
1037 	return (0);
1038 }
1039 
1040 static int
1041 netbufcmp(struct netbuf *n1, struct netbuf *n2)
1042 {
1043 	return ((n1->len != n2->len) || memcmp(n1->buf, n2->buf, n1->len));
1044 }
1045 
1046 static struct netbuf *
1047 netbufdup(struct netbuf *ap)
1048 {
1049 	struct netbuf  *np;
1050 
1051 	np = (struct netbuf *) malloc(sizeof (struct netbuf) + ap->len);
1052 	if (np) {
1053 		np->maxlen = np->len = ap->len;
1054 		np->buf = ((char *) np) + sizeof (struct netbuf);
1055 		(void) memcpy(np->buf, ap->buf, ap->len);
1056 	}
1057 	return (np);
1058 }
1059 
1060 static void
1061 netbuffree(struct netbuf *ap)
1062 {
1063 	free((void *) ap);
1064 }
1065 
1066 
1067 #define	MASKVAL	(POLLIN | POLLPRI | POLLRDNORM | POLLRDBAND)
1068 
1069 void
1070 my_svc_run()
1071 {
1072 	size_t nfds;
1073 	struct pollfd pollfds[FD_SETSIZE];
1074 	int poll_ret, check_ret;
1075 	int n;
1076 #ifdef SVC_RUN_DEBUG
1077 	int i;
1078 #endif
1079 	register struct pollfd	*p;
1080 
1081 	for (;;) {
1082 		p = pollfds;
1083 		for (n = 0; n <= svc_maxfd; n++) {
1084 			if (FD_ISSET(n, &svc_fdset)) {
1085 				p->fd = n;
1086 				p->events = MASKVAL;
1087 				p++;
1088 			}
1089 		}
1090 		nfds = p - pollfds;
1091 		poll_ret = 0;
1092 #ifdef SVC_RUN_DEBUG
1093 		if (debugging) {
1094 			fprintf(stderr, "polling for read on fd < ");
1095 			for (i = 0, p = pollfds; i < nfds; i++, p++)
1096 				if (p->events)
1097 					fprintf(stderr, "%d ", p->fd);
1098 			fprintf(stderr, ">\n");
1099 		}
1100 #endif
1101 		switch (poll_ret = poll(pollfds, nfds, INFTIM)) {
1102 		case -1:
1103 			/*
1104 			 * We ignore all errors, continuing with the assumption
1105 			 * that it was set by the signal handlers (or any
1106 			 * other outside event) and not caused by poll().
1107 			 */
1108 		case 0:
1109 			continue;
1110 		default:
1111 #ifdef SVC_RUN_DEBUG
1112 			if (debugging) {
1113 				fprintf(stderr, "poll returned read fds < ");
1114 				for (i = 0, p = pollfds; i < nfds; i++, p++)
1115 					if (p->revents)
1116 						fprintf(stderr, "%d ", p->fd);
1117 				fprintf(stderr, ">\n");
1118 			}
1119 #endif
1120 			/*
1121 			 * If we found as many replies on callback fds
1122 			 * as the number of descriptors selectable which
1123 			 * poll() returned, there can be no more so we
1124 			 * don't call svc_getreq_poll.  Otherwise, there
1125 			 * must be another so we must call svc_getreq_poll.
1126 			 */
1127 			if ((check_ret = check_rmtcalls(pollfds, nfds)) ==
1128 			    poll_ret)
1129 				continue;
1130 			svc_getreq_poll(pollfds, poll_ret-check_ret);
1131 		}
1132 #ifdef SVC_RUN_DEBUG
1133 		if (debugging) {
1134 			fprintf(stderr, "svc_maxfd now %u\n", svc_maxfd);
1135 		}
1136 #endif
1137 	}
1138 }
1139 
1140 static int
1141 check_rmtcalls(struct pollfd *pfds, int nfds)
1142 {
1143 	int j, ncallbacks_found = 0, rmtcalls_pending;
1144 	SVCXPRT *xprt;
1145 
1146 	if (rpcb_rmtcalls == 0)
1147 		return (0);
1148 
1149 	rmtcalls_pending = rpcb_rmtcalls;
1150 	for (j = 0; j < nfds; j++) {
1151 		if ((xprt = find_rmtcallxprt_by_fd(pfds[j].fd)) != NULL) {
1152 			if (pfds[j].revents) {
1153 				ncallbacks_found++;
1154 #ifdef DEBUG_RMTCALL
1155 			if (debugging)
1156 				fprintf(stderr,
1157 "my_svc_run:  polled on forwarding fd %d, netid %s - calling handle_reply\n",
1158 		pfds[j].fd, xprt->xp_netid);
1159 #endif
1160 				handle_reply(pfds[j].fd, xprt);
1161 				pfds[j].revents = 0;
1162 				if (ncallbacks_found >= rmtcalls_pending) {
1163 					break;
1164 				}
1165 			}
1166 		}
1167 	}
1168 	return (ncallbacks_found);
1169 }
1170 
1171 static void
1172 xprt_set_caller(SVCXPRT *xprt, struct finfo *fi)
1173 {
1174 	u_int32_t *xidp;
1175 
1176 	*(svc_getrpccaller(xprt)) = *(fi->caller_addr);
1177 	xidp = __rpcb_get_dg_xidp(xprt);
1178 	*xidp = fi->caller_xid;
1179 }
1180 
1181 /*
1182  * Call svcerr_systemerr() only if RPCBVERS4
1183  */
1184 static void
1185 send_svcsyserr(SVCXPRT *xprt, struct finfo *fi)
1186 {
1187 	if (fi->reply_type == RPCBPROC_INDIRECT) {
1188 		xprt_set_caller(xprt, fi);
1189 		svcerr_systemerr(xprt);
1190 	}
1191 	return;
1192 }
1193 
1194 static void
1195 handle_reply(int fd, SVCXPRT *xprt)
1196 {
1197 	XDR		reply_xdrs;
1198 	struct rpc_msg	reply_msg;
1199 	struct rpc_err	reply_error;
1200 	char		*buffer;
1201 	struct finfo	*fi;
1202 	int		inlen, pos, len;
1203 	struct r_rmtcall_args a;
1204 	struct sockaddr_storage ss;
1205 	socklen_t fromlen;
1206 #ifdef SVC_RUN_DEBUG
1207 	char *uaddr;
1208 #endif
1209 
1210 	buffer = malloc(RPC_BUF_MAX);
1211 	if (buffer == NULL)
1212 		goto done;
1213 
1214 	do {
1215 		inlen = recvfrom(fd, buffer, RPC_BUF_MAX, 0,
1216 			    (struct sockaddr *)&ss, &fromlen);
1217 	} while (inlen < 0 && errno == EINTR);
1218 	if (inlen < 0) {
1219 		if (debugging)
1220 			fprintf(stderr,
1221 	"handle_reply:  recvfrom returned %d, errno %d\n", inlen, errno);
1222 		goto done;
1223 	}
1224 
1225 	reply_msg.acpted_rply.ar_verf = _null_auth;
1226 	reply_msg.acpted_rply.ar_results.where = 0;
1227 	reply_msg.acpted_rply.ar_results.proc = (xdrproc_t) xdr_void;
1228 
1229 	xdrmem_create(&reply_xdrs, buffer, (u_int)inlen, XDR_DECODE);
1230 	if (!xdr_replymsg(&reply_xdrs, &reply_msg)) {
1231 		if (debugging)
1232 			(void) fprintf(stderr,
1233 				"handle_reply:  xdr_replymsg failed\n");
1234 		goto done;
1235 	}
1236 	fi = forward_find(reply_msg.rm_xid);
1237 #ifdef	SVC_RUN_DEBUG
1238 	if (debugging) {
1239 		fprintf(stderr, "handle_reply:  reply xid: %d fi addr: %p\n",
1240 			reply_msg.rm_xid, fi);
1241 	}
1242 #endif
1243 	if (fi == NULL) {
1244 		goto done;
1245 	}
1246 	_seterr_reply(&reply_msg, &reply_error);
1247 	if (reply_error.re_status != RPC_SUCCESS) {
1248 		if (debugging)
1249 			(void) fprintf(stderr, "handle_reply:  %s\n",
1250 				clnt_sperrno(reply_error.re_status));
1251 		send_svcsyserr(xprt, fi);
1252 		goto done;
1253 	}
1254 	pos = XDR_GETPOS(&reply_xdrs);
1255 	len = inlen - pos;
1256 	a.rmt_args.args = &buffer[pos];
1257 	a.rmt_args.arglen = len;
1258 	a.rmt_uaddr = fi->uaddr;
1259 	a.rmt_localvers = fi->versnum;
1260 
1261 	xprt_set_caller(xprt, fi);
1262 #ifdef	SVC_RUN_DEBUG
1263 	uaddr =	taddr2uaddr(rpcbind_get_conf("udp"),
1264 				    svc_getrpccaller(xprt));
1265 	if (debugging) {
1266 		fprintf(stderr, "handle_reply:  forwarding address %s to %s\n",
1267 			a.rmt_uaddr, uaddr ? uaddr : "unknown");
1268 	}
1269 	if (uaddr)
1270 		free((void *) uaddr);
1271 #endif
1272 	svc_sendreply(xprt, (xdrproc_t) xdr_rmtcall_result, (char *) &a);
1273 done:
1274 	if (buffer)
1275 		free(buffer);
1276 
1277 	if (reply_msg.rm_xid == 0) {
1278 #ifdef	SVC_RUN_DEBUG
1279 	if (debugging) {
1280 		fprintf(stderr, "handle_reply:  NULL xid on exit!\n");
1281 	}
1282 #endif
1283 	} else
1284 		(void) free_slot_by_xid(reply_msg.rm_xid);
1285 	return;
1286 }
1287 
1288 static void
1289 find_versions(rpcprog_t prog, char *netid, rpcvers_t *lowvp, rpcvers_t *highvp)
1290 {
1291 	register rpcblist_ptr rbl;
1292 	int lowv = 0;
1293 	int highv = 0;
1294 
1295 	for (rbl = list_rbl; rbl != NULL; rbl = rbl->rpcb_next) {
1296 		if ((rbl->rpcb_map.r_prog != prog) ||
1297 		    ((rbl->rpcb_map.r_netid != NULL) &&
1298 			(strcasecmp(rbl->rpcb_map.r_netid, netid) != 0)))
1299 			continue;
1300 		if (lowv == 0) {
1301 			highv = rbl->rpcb_map.r_vers;
1302 			lowv = highv;
1303 		} else if (rbl->rpcb_map.r_vers < lowv) {
1304 			lowv = rbl->rpcb_map.r_vers;
1305 		} else if (rbl->rpcb_map.r_vers > highv) {
1306 			highv = rbl->rpcb_map.r_vers;
1307 		}
1308 	}
1309 	*lowvp = lowv;
1310 	*highvp = highv;
1311 	return;
1312 }
1313 
1314 /*
1315  * returns the item with the given program, version number and netid.
1316  * If that version number is not found, it returns the item with that
1317  * program number, so that address is now returned to the caller. The
1318  * caller when makes a call to this program, version number, the call
1319  * will fail and it will return with PROGVERS_MISMATCH. The user can
1320  * then determine the highest and the lowest version number for this
1321  * program using clnt_geterr() and use those program version numbers.
1322  *
1323  * Returns the RPCBLIST for the given prog, vers and netid
1324  */
1325 static rpcblist_ptr
1326 find_service(rpcprog_t prog, rpcvers_t vers, char *netid)
1327 {
1328 	register rpcblist_ptr hit = NULL;
1329 	register rpcblist_ptr rbl;
1330 
1331 	for (rbl = list_rbl; rbl != NULL; rbl = rbl->rpcb_next) {
1332 		if ((rbl->rpcb_map.r_prog != prog) ||
1333 		    ((rbl->rpcb_map.r_netid != NULL) &&
1334 			(strcasecmp(rbl->rpcb_map.r_netid, netid) != 0)))
1335 			continue;
1336 		hit = rbl;
1337 		if (rbl->rpcb_map.r_vers == vers)
1338 			break;
1339 	}
1340 	return (hit);
1341 }
1342 
1343 /*
1344  * Copies the name associated with the uid of the caller and returns
1345  * a pointer to it.  Similar to getwd().
1346  */
1347 static char *
1348 getowner(SVCXPRT *transp, char *owner, size_t ownersize)
1349 {
1350 	struct sockcred *sc;
1351 
1352 	sc = __svc_getcallercreds(transp);
1353 	if (sc == NULL)
1354 		strlcpy(owner, "unknown", ownersize);
1355 	else if (sc->sc_uid == 0)
1356 		strlcpy(owner, "superuser", ownersize);
1357 	else
1358 		snprintf(owner, ownersize, "%d", sc->sc_uid);
1359 
1360 	return owner;
1361 }
1362 
1363 #ifdef PORTMAP
1364 /*
1365  * Add this to the pmap list only if it is UDP or TCP.
1366  */
1367 static int
1368 add_pmaplist(RPCB *arg)
1369 {
1370 	struct pmap pmap;
1371 	struct pmaplist *pml;
1372 	int h1, h2, h3, h4, p1, p2;
1373 
1374 	if (strcmp(arg->r_netid, udptrans) == 0) {
1375 		/* It is UDP! */
1376 		pmap.pm_prot = IPPROTO_UDP;
1377 	} else if (strcmp(arg->r_netid, tcptrans) == 0) {
1378 		/* It is TCP */
1379 		pmap.pm_prot = IPPROTO_TCP;
1380 	} else
1381 		/* Not a IP protocol */
1382 		return (0);
1383 
1384 	/* interpret the universal address for TCP/IP */
1385 	if (sscanf(arg->r_addr, "%d.%d.%d.%d.%d.%d",
1386 		&h1, &h2, &h3, &h4, &p1, &p2) != 6)
1387 		return (0);
1388 	pmap.pm_port = ((p1 & 0xff) << 8) + (p2 & 0xff);
1389 	pmap.pm_prog = arg->r_prog;
1390 	pmap.pm_vers = arg->r_vers;
1391 	/*
1392 	 * add to END of list
1393 	 */
1394 	pml = (struct pmaplist *) malloc((u_int)sizeof (struct pmaplist));
1395 	if (pml == NULL) {
1396 		(void) syslog(LOG_ERR, "rpcbind: no memory!\n");
1397 		return (1);
1398 	}
1399 	pml->pml_map = pmap;
1400 	pml->pml_next = NULL;
1401 	if (list_pml == NULL) {
1402 		list_pml = pml;
1403 	} else {
1404 		struct pmaplist *fnd;
1405 
1406 		/* Attach to the end of the list */
1407 		for (fnd = list_pml; fnd->pml_next; fnd = fnd->pml_next)
1408 			;
1409 		fnd->pml_next = pml;
1410 	}
1411 	return (0);
1412 }
1413 
1414 /*
1415  * Delete this from the pmap list only if it is UDP or TCP.
1416  */
1417 static int
1418 del_pmaplist(RPCB *arg)
1419 {
1420 	struct pmaplist *pml;
1421 	struct pmaplist *prevpml, *fnd;
1422 	long prot;
1423 
1424 	if (strcmp(arg->r_netid, udptrans) == 0) {
1425 		/* It is UDP! */
1426 		prot = IPPROTO_UDP;
1427 	} else if (strcmp(arg->r_netid, tcptrans) == 0) {
1428 		/* It is TCP */
1429 		prot = IPPROTO_TCP;
1430 	} else if (arg->r_netid[0] == NULL) {
1431 		prot = 0;	/* Remove all occurrences */
1432 	} else {
1433 		/* Not a IP protocol */
1434 		return (0);
1435 	}
1436 	for (prevpml = NULL, pml = list_pml; pml; /* cstyle */) {
1437 		if ((pml->pml_map.pm_prog != arg->r_prog) ||
1438 			(pml->pml_map.pm_vers != arg->r_vers) ||
1439 			(prot && (pml->pml_map.pm_prot != prot))) {
1440 			/* both pml & prevpml move forwards */
1441 			prevpml = pml;
1442 			pml = pml->pml_next;
1443 			continue;
1444 		}
1445 		/* found it; pml moves forward, prevpml stays */
1446 		fnd = pml;
1447 		pml = pml->pml_next;
1448 		if (prevpml == NULL)
1449 			list_pml = pml;
1450 		else
1451 			prevpml->pml_next = pml;
1452 		free((void *) fnd);
1453 	}
1454 	return (0);
1455 }
1456 #endif /* PORTMAP */
1457