1*5b133f3fSguenther /* $OpenBSD: portmap.c,v 1.51 2023/03/08 04:43:14 guenther Exp $ */
2456a2117Smillert
3df930be7Sderaadt /*-
49d791f75Sderaadt * Copyright (c) 1996, 1997 Theo de Raadt (OpenBSD). All rights reserved.
5df930be7Sderaadt * Copyright (c) 1990 The Regents of the University of California.
6df930be7Sderaadt * All rights reserved.
7df930be7Sderaadt *
8df930be7Sderaadt * Redistribution and use in source and binary forms, with or without
9df930be7Sderaadt * modification, are permitted provided that the following conditions
10df930be7Sderaadt * are met:
11df930be7Sderaadt * 1. Redistributions of source code must retain the above copyright
12df930be7Sderaadt * notice, this list of conditions and the following disclaimer.
13df930be7Sderaadt * 2. Redistributions in binary form must reproduce the above copyright
14df930be7Sderaadt * notice, this list of conditions and the following disclaimer in the
15df930be7Sderaadt * documentation and/or other materials provided with the distribution.
1629295d1cSmillert * 3. Neither the name of the University nor the names of its contributors
17df930be7Sderaadt * may be used to endorse or promote products derived from this software
18df930be7Sderaadt * without specific prior written permission.
19df930be7Sderaadt *
20df930be7Sderaadt * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21df930be7Sderaadt * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22df930be7Sderaadt * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23df930be7Sderaadt * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24df930be7Sderaadt * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25df930be7Sderaadt * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26df930be7Sderaadt * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27df930be7Sderaadt * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28df930be7Sderaadt * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29df930be7Sderaadt * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30df930be7Sderaadt * SUCH DAMAGE.
31df930be7Sderaadt */
32cb7760d1Smillert /*
33cb7760d1Smillert * Copyright (c) 2010, Oracle America, Inc.
34cb7760d1Smillert *
35cb7760d1Smillert * Redistribution and use in source and binary forms, with or without
36cb7760d1Smillert * modification, are permitted provided that the following conditions are
37cb7760d1Smillert * met:
38cb7760d1Smillert *
39cb7760d1Smillert * * Redistributions of source code must retain the above copyright
40cb7760d1Smillert * notice, this list of conditions and the following disclaimer.
41cb7760d1Smillert * * Redistributions in binary form must reproduce the above
42cb7760d1Smillert * copyright notice, this list of conditions and the following
43cb7760d1Smillert * disclaimer in the documentation and/or other materials
44cb7760d1Smillert * provided with the distribution.
45cb7760d1Smillert * * Neither the name of the "Oracle America, Inc." nor the names of its
46cb7760d1Smillert * contributors may be used to endorse or promote products derived
47cb7760d1Smillert * from this software without specific prior written permission.
48cb7760d1Smillert *
49cb7760d1Smillert * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
50cb7760d1Smillert * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
51cb7760d1Smillert * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
52cb7760d1Smillert * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
53cb7760d1Smillert * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
54cb7760d1Smillert * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
55cb7760d1Smillert * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE
56cb7760d1Smillert * GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
57cb7760d1Smillert * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
58cb7760d1Smillert * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
59cb7760d1Smillert * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
60cb7760d1Smillert * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
61cb7760d1Smillert */
62df930be7Sderaadt
63df930be7Sderaadt /*
64df930be7Sderaadt * portmap.c, Implements the program,version to port number mapping for
65df930be7Sderaadt * rpc.
66df930be7Sderaadt */
67df930be7Sderaadt
68606f45d1Smillert #include <sys/types.h>
69606f45d1Smillert #include <sys/socket.h>
70606f45d1Smillert #include <sys/wait.h>
71606f45d1Smillert #include <sys/resource.h>
72606f45d1Smillert
73606f45d1Smillert #include <rpcsvc/nfs_prot.h>
74606f45d1Smillert #include <arpa/inet.h>
75df930be7Sderaadt #include <rpc/rpc.h>
76df930be7Sderaadt #include <rpc/pmap_prot.h>
77606f45d1Smillert
78606f45d1Smillert #include <signal.h>
79df930be7Sderaadt #include <stdio.h>
80df930be7Sderaadt #include <stdlib.h>
81df930be7Sderaadt #include <string.h>
82df930be7Sderaadt #include <syslog.h>
83df930be7Sderaadt #include <unistd.h>
84df930be7Sderaadt #include <netdb.h>
8546aa5dceSderaadt #include <pwd.h>
8653a76164Stedu #include <errno.h>
875a47b5f6Sjsg #include <err.h>
88df930be7Sderaadt
89c72b5b24Smillert void reg_service(struct svc_req *, SVCXPRT *);
9083e8fa08Sderaadt void reap(int);
91c72b5b24Smillert void callit(struct svc_req *, SVCXPRT *);
92f99230ebSdhill int check_callit(struct sockaddr_in *, u_long, u_long);
93f99230ebSdhill struct pmaplist *find_service(u_long, u_long, u_long);
94df930be7Sderaadt
95df930be7Sderaadt struct pmaplist *pmaplist;
96591391d8Stedu int debugging;
97df930be7Sderaadt
9877baebbfSderaadt SVCXPRT *ludpxprt, *ltcpxprt;
9977baebbfSderaadt
100d91d7659Sderaadt int
main(int argc,char * argv[])10146aa5dceSderaadt main(int argc, char *argv[])
102df930be7Sderaadt {
103591391d8Stedu int sock, lsock, c, on = 1;
104591391d8Stedu socklen_t len = sizeof(struct sockaddr_in);
10577baebbfSderaadt struct sockaddr_in addr, laddr;
1060ac0d02eSmpech struct pmaplist *pml;
1070f99c42cSderaadt struct passwd *pw;
10846aa5dceSderaadt SVCXPRT *xprt;
109df930be7Sderaadt
11072799b18Smillert while ((c = getopt(argc, argv, "d")) != -1) {
111df930be7Sderaadt switch (c) {
112df930be7Sderaadt case 'd':
113df930be7Sderaadt debugging = 1;
114df930be7Sderaadt break;
115df930be7Sderaadt default:
116df930be7Sderaadt (void)fprintf(stderr, "usage: %s [-d]\n", argv[0]);
117df930be7Sderaadt exit(1);
118df930be7Sderaadt }
119df930be7Sderaadt }
120df930be7Sderaadt
121df930be7Sderaadt if (!debugging && daemon(0, 0)) {
122df930be7Sderaadt (void)fprintf(stderr, "portmap: fork: %s", strerror(errno));
123df930be7Sderaadt exit(1);
124df930be7Sderaadt }
125df930be7Sderaadt
126591391d8Stedu openlog("portmap", LOG_NDELAY | (debugging ? LOG_PID | LOG_PERROR :
127591391d8Stedu LOG_PID), LOG_DAEMON);
128df930be7Sderaadt
129591391d8Stedu bzero(&addr, sizeof addr);
13077baebbfSderaadt addr.sin_addr.s_addr = 0;
13177baebbfSderaadt addr.sin_family = AF_INET;
13277baebbfSderaadt addr.sin_addr.s_addr = htonl(INADDR_ANY);
13377baebbfSderaadt addr.sin_port = htons(PMAPPORT);
13477baebbfSderaadt
135591391d8Stedu bzero(&laddr, sizeof laddr);
13677baebbfSderaadt laddr.sin_addr.s_addr = 0;
13777baebbfSderaadt laddr.sin_family = AF_INET;
13877baebbfSderaadt laddr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
13977baebbfSderaadt laddr.sin_port = htons(PMAPPORT);
14077baebbfSderaadt
141df69c215Sderaadt if ((sock = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
142df930be7Sderaadt syslog(LOG_ERR, "cannot create udp socket: %m");
143df930be7Sderaadt exit(1);
144df930be7Sderaadt }
145afeed3b4Sderaadt setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &on, sizeof on);
146df69c215Sderaadt if (bind(sock, (struct sockaddr *)&addr, len) == -1) {
147df930be7Sderaadt syslog(LOG_ERR, "cannot bind udp: %m");
148df930be7Sderaadt exit(1);
149df930be7Sderaadt }
150df930be7Sderaadt
151591391d8Stedu if ((xprt = svcudp_create(sock)) == NULL) {
152df930be7Sderaadt syslog(LOG_ERR, "couldn't do udp_create");
153df930be7Sderaadt exit(1);
154df930be7Sderaadt }
15577baebbfSderaadt
156df69c215Sderaadt if ((lsock = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP)) == -1) {
15777baebbfSderaadt syslog(LOG_ERR, "cannot create udp socket: %m");
15877baebbfSderaadt exit(1);
15977baebbfSderaadt }
16077baebbfSderaadt setsockopt(lsock, SOL_SOCKET, SO_REUSEADDR, &on, sizeof on);
161df69c215Sderaadt if (bind(lsock, (struct sockaddr *)&laddr, len) == -1) {
1627e963911Smickey syslog(LOG_ERR, "cannot bind local udp: %m");
16377baebbfSderaadt exit(1);
16477baebbfSderaadt }
16577baebbfSderaadt
166591391d8Stedu if ((ludpxprt = svcudp_create(lsock)) == NULL) {
16777baebbfSderaadt syslog(LOG_ERR, "couldn't do udp_create");
16877baebbfSderaadt exit(1);
16977baebbfSderaadt }
17077baebbfSderaadt
171df930be7Sderaadt /* make an entry for ourself */
172591391d8Stedu pml = malloc(sizeof(struct pmaplist));
173acfba6e6Sderaadt if (pml == NULL) {
174acfba6e6Sderaadt syslog(LOG_ERR, "out of memory");
175acfba6e6Sderaadt exit(1);
176acfba6e6Sderaadt }
177df930be7Sderaadt pml->pml_next = 0;
178df930be7Sderaadt pml->pml_map.pm_prog = PMAPPROG;
179df930be7Sderaadt pml->pml_map.pm_vers = PMAPVERS;
180df930be7Sderaadt pml->pml_map.pm_prot = IPPROTO_UDP;
181df930be7Sderaadt pml->pml_map.pm_port = PMAPPORT;
182df930be7Sderaadt pmaplist = pml;
183df930be7Sderaadt
184df69c215Sderaadt if ((sock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) == -1) {
185df930be7Sderaadt syslog(LOG_ERR, "cannot create tcp socket: %m");
186df930be7Sderaadt exit(1);
187df930be7Sderaadt }
188afeed3b4Sderaadt setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &on, sizeof on);
189df69c215Sderaadt if (bind(sock, (struct sockaddr *)&addr, len) == -1) {
190da52f073Sderaadt syslog(LOG_ERR, "cannot bind tcp: %m");
191df930be7Sderaadt exit(1);
192df930be7Sderaadt }
193591391d8Stedu if ((xprt = svctcp_create(sock, RPCSMALLMSGSIZE, RPCSMALLMSGSIZE)) ==
194591391d8Stedu NULL) {
195df930be7Sderaadt syslog(LOG_ERR, "couldn't do tcp_create");
196df930be7Sderaadt exit(1);
197df930be7Sderaadt }
19877baebbfSderaadt
199df69c215Sderaadt if ((lsock = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP)) == -1) {
20077baebbfSderaadt syslog(LOG_ERR, "cannot create tcp socket: %m");
20177baebbfSderaadt exit(1);
20277baebbfSderaadt }
20377baebbfSderaadt setsockopt(lsock, SOL_SOCKET, SO_REUSEADDR, &on, sizeof on);
204df69c215Sderaadt if (bind(lsock, (struct sockaddr *)&laddr, len) == -1) {
205da52f073Sderaadt syslog(LOG_ERR, "cannot bind tcp: %m");
20677baebbfSderaadt exit(1);
20777baebbfSderaadt }
20877baebbfSderaadt if ((ltcpxprt = svctcp_create(lsock, RPCSMALLMSGSIZE,
209591391d8Stedu RPCSMALLMSGSIZE)) == NULL) {
21077baebbfSderaadt syslog(LOG_ERR, "couldn't do tcp_create");
21177baebbfSderaadt exit(1);
21277baebbfSderaadt }
21377baebbfSderaadt
214df930be7Sderaadt /* make an entry for ourself */
215591391d8Stedu pml = malloc(sizeof(struct pmaplist));
216acfba6e6Sderaadt if (pml == NULL) {
217acfba6e6Sderaadt syslog(LOG_ERR, "out of memory");
218acfba6e6Sderaadt exit(1);
219acfba6e6Sderaadt }
220df930be7Sderaadt pml->pml_map.pm_prog = PMAPPROG;
221df930be7Sderaadt pml->pml_map.pm_vers = PMAPVERS;
222df930be7Sderaadt pml->pml_map.pm_prot = IPPROTO_TCP;
223df930be7Sderaadt pml->pml_map.pm_port = PMAPPORT;
224df930be7Sderaadt pml->pml_next = pmaplist;
225df930be7Sderaadt pmaplist = pml;
226df930be7Sderaadt
227ac4529faSthib if ((pw = getpwnam("_portmap")) == NULL) {
228ac4529faSthib syslog(LOG_ERR, "no such user _portmap");
229ac4529faSthib exit(1);
230ac4529faSthib }
2310f99c42cSderaadt if (chroot("/var/empty") == -1) {
232591391d8Stedu syslog(LOG_ERR, "cannot chroot to /var/empty.");
233591391d8Stedu exit(1);
234591391d8Stedu }
235591391d8Stedu if (chdir("/") == -1) {
236591391d8Stedu syslog(LOG_ERR, "cannot chdir to new /.");
2370f99c42cSderaadt exit(1);
2380f99c42cSderaadt }
239ac4529faSthib
2400f99c42cSderaadt if (pw) {
2415bb60d39Sdjm if (setgroups(1, &pw->pw_gid) == -1 ||
2425bb60d39Sdjm setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) == -1 ||
2435bb60d39Sdjm setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid) == -1) {
2445bb60d39Sdjm syslog(LOG_ERR, "revoke privs: %s", strerror(errno));
2455bb60d39Sdjm exit(1);
2465bb60d39Sdjm }
2470f99c42cSderaadt }
248cb074343Shenning endpwent();
2490f99c42cSderaadt
25052612c9bSderaadt if (pledge("stdio inet proc", NULL) == -1)
2510bd1216cSderaadt err(1, "pledge");
252a828131dSderaadt
2535b63b19eSpvalchev if (svc_register(xprt, PMAPPROG, PMAPVERS, reg_service, FALSE) == 0) {
2545b63b19eSpvalchev syslog(LOG_ERR, "svc_register failed.");
2555b63b19eSpvalchev exit(1);
2565b63b19eSpvalchev }
257df930be7Sderaadt
258606f45d1Smillert (void)signal(SIGCHLD, reap);
259df930be7Sderaadt svc_run();
260da52f073Sderaadt syslog(LOG_ERR, "svc_run returned unexpectedly");
261df930be7Sderaadt abort();
262df930be7Sderaadt }
263df930be7Sderaadt
2643aef48d5Sderaadt struct pmaplist *
find_service(u_long prog,u_long vers,u_long prot)26546aa5dceSderaadt find_service(u_long prog, u_long vers, u_long prot)
266df930be7Sderaadt {
2670ac0d02eSmpech struct pmaplist *hit = NULL;
2680ac0d02eSmpech struct pmaplist *pml;
269df930be7Sderaadt
270df930be7Sderaadt for (pml = pmaplist; pml != NULL; pml = pml->pml_next) {
271df930be7Sderaadt if ((pml->pml_map.pm_prog != prog) ||
272df930be7Sderaadt (pml->pml_map.pm_prot != prot))
273df930be7Sderaadt continue;
274df930be7Sderaadt hit = pml;
275df930be7Sderaadt if (pml->pml_map.pm_vers == vers)
276df930be7Sderaadt break;
277df930be7Sderaadt }
278df930be7Sderaadt return (hit);
279df930be7Sderaadt }
280df930be7Sderaadt
281df930be7Sderaadt /*
282df930be7Sderaadt * 1 OK, 0 not
283df930be7Sderaadt */
284df930be7Sderaadt void
reg_service(struct svc_req * rqstp,SVCXPRT * xprt)28546aa5dceSderaadt reg_service(struct svc_req *rqstp, SVCXPRT *xprt)
286df930be7Sderaadt {
287df930be7Sderaadt struct pmap reg;
288df930be7Sderaadt struct pmaplist *pml, *prevpml, *fnd;
28977baebbfSderaadt struct sockaddr_in *fromsin;
29077baebbfSderaadt long ans = 0, port;
291591391d8Stedu void *t;
292df930be7Sderaadt
29377baebbfSderaadt fromsin = svc_getcaller(xprt);
29477baebbfSderaadt
295df930be7Sderaadt if (debugging)
296df930be7Sderaadt (void)fprintf(stderr, "server: about to do a switch\n");
297df930be7Sderaadt switch (rqstp->rq_proc) {
298df930be7Sderaadt case PMAPPROC_NULL:
299df930be7Sderaadt /*
300df930be7Sderaadt * Null proc call
301df930be7Sderaadt */
302591391d8Stedu if (!svc_sendreply(xprt, xdr_void, NULL) && debugging) {
303df930be7Sderaadt abort();
304df930be7Sderaadt }
305df930be7Sderaadt break;
306df930be7Sderaadt case PMAPPROC_SET:
307df930be7Sderaadt /*
308df930be7Sderaadt * Set a program,version to port mapping
309df930be7Sderaadt */
31077baebbfSderaadt if (xprt != ltcpxprt && xprt != ludpxprt) {
31177baebbfSderaadt syslog(LOG_WARNING,
31277baebbfSderaadt "non-local set attempt (might be from %s)",
3139430a6aeSderaadt inet_ntoa(fromsin->sin_addr));
31477baebbfSderaadt svcerr_noproc(xprt);
31577baebbfSderaadt return;
31677baebbfSderaadt }
31760cef36bSderaadt if (!svc_getargs(xprt, xdr_pmap, (caddr_t)®)) {
318df930be7Sderaadt svcerr_decode(xprt);
31960cef36bSderaadt break;
32060cef36bSderaadt }
3213aef48d5Sderaadt
322df930be7Sderaadt /*
323df930be7Sderaadt * check to see if already used
324df930be7Sderaadt * find_service returns a hit even if
325df930be7Sderaadt * the versions don't match, so check for it
326df930be7Sderaadt */
327df930be7Sderaadt fnd = find_service(reg.pm_prog, reg.pm_vers, reg.pm_prot);
328df930be7Sderaadt if (fnd && fnd->pml_map.pm_vers == reg.pm_vers) {
32977baebbfSderaadt if (fnd->pml_map.pm_port == reg.pm_port)
330df930be7Sderaadt ans = 1;
331df930be7Sderaadt goto done;
332df930be7Sderaadt }
33377baebbfSderaadt
334a982d679Sderaadt if (debugging)
33531cea007Spvalchev printf("set: prog %lu vers %lu port %lu\n",
336a982d679Sderaadt reg.pm_prog, reg.pm_vers, reg.pm_port);
337a982d679Sderaadt
338a982d679Sderaadt if (reg.pm_port & ~0xffff)
339a982d679Sderaadt goto done;
340a982d679Sderaadt
341a982d679Sderaadt /*
342a982d679Sderaadt * only permit localhost root to create
343a982d679Sderaadt * mappings pointing at sensitive ports
344a982d679Sderaadt */
345a982d679Sderaadt if ((reg.pm_port < IPPORT_RESERVED ||
346a982d679Sderaadt reg.pm_port == NFS_PORT) &&
34777baebbfSderaadt htons(fromsin->sin_port) >= IPPORT_RESERVED) {
348a982d679Sderaadt syslog(LOG_WARNING,
349a982d679Sderaadt "resvport set attempt by non-root");
350df930be7Sderaadt goto done;
351df930be7Sderaadt }
35277baebbfSderaadt
353df930be7Sderaadt /*
354df930be7Sderaadt * add to END of list
355df930be7Sderaadt */
356591391d8Stedu pml = malloc(sizeof(struct pmaplist));
357acfba6e6Sderaadt if (pml == NULL) {
358acfba6e6Sderaadt syslog(LOG_ERR, "out of memory");
359acfba6e6Sderaadt svcerr_systemerr(xprt);
360acfba6e6Sderaadt return;
361acfba6e6Sderaadt }
362acfba6e6Sderaadt
363df930be7Sderaadt pml->pml_map = reg;
364df930be7Sderaadt pml->pml_next = 0;
36537ef7afbSderaadt if (pmaplist == NULL) {
366df930be7Sderaadt pmaplist = pml;
367df930be7Sderaadt } else {
368df930be7Sderaadt for (fnd = pmaplist; fnd->pml_next != 0;
36937ef7afbSderaadt fnd = fnd->pml_next)
37037ef7afbSderaadt ;
371df930be7Sderaadt fnd->pml_next = pml;
372df930be7Sderaadt }
373df930be7Sderaadt ans = 1;
374df930be7Sderaadt done:
375df930be7Sderaadt if ((!svc_sendreply(xprt, xdr_long, (caddr_t)&ans)) &&
376df930be7Sderaadt debugging) {
377df930be7Sderaadt (void)fprintf(stderr, "svc_sendreply\n");
378df930be7Sderaadt abort();
379df930be7Sderaadt }
380df930be7Sderaadt break;
381df930be7Sderaadt case PMAPPROC_UNSET:
382df930be7Sderaadt /*
383df930be7Sderaadt * Remove a program,version to port mapping.
384df930be7Sderaadt */
38577baebbfSderaadt if (xprt != ltcpxprt && xprt != ludpxprt) {
38677baebbfSderaadt syslog(LOG_WARNING,
38777baebbfSderaadt "non-local unset attempt (might be from %s)",
3889430a6aeSderaadt inet_ntoa(fromsin->sin_addr));
38977baebbfSderaadt svcerr_noproc(xprt);
39077baebbfSderaadt return;
39177baebbfSderaadt }
39277baebbfSderaadt if (!svc_getargs(xprt, xdr_pmap, (caddr_t)®)) {
393df930be7Sderaadt svcerr_decode(xprt);
39477baebbfSderaadt break;
39577baebbfSderaadt }
396df930be7Sderaadt for (prevpml = NULL, pml = pmaplist; pml != NULL; ) {
397df930be7Sderaadt if ((pml->pml_map.pm_prog != reg.pm_prog) ||
398df930be7Sderaadt (pml->pml_map.pm_vers != reg.pm_vers)) {
399df930be7Sderaadt /* both pml & prevpml move forwards */
400df930be7Sderaadt prevpml = pml;
401df930be7Sderaadt pml = pml->pml_next;
402df930be7Sderaadt continue;
403df930be7Sderaadt }
40477baebbfSderaadt if ((pml->pml_map.pm_port < IPPORT_RESERVED ||
40577baebbfSderaadt pml->pml_map.pm_port == NFS_PORT) &&
40677baebbfSderaadt htons(fromsin->sin_port) >= IPPORT_RESERVED) {
40777baebbfSderaadt syslog(LOG_WARNING,
40877baebbfSderaadt "resvport unset attempt by non-root");
40977baebbfSderaadt break;
41077baebbfSderaadt }
41177baebbfSderaadt
412df930be7Sderaadt /* found it; pml moves forward, prevpml stays */
413df930be7Sderaadt ans = 1;
414591391d8Stedu t = pml;
415df930be7Sderaadt pml = pml->pml_next;
416df930be7Sderaadt if (prevpml == NULL)
417df930be7Sderaadt pmaplist = pml;
418df930be7Sderaadt else
419df930be7Sderaadt prevpml->pml_next = pml;
420df930be7Sderaadt free(t);
421df930be7Sderaadt }
422df930be7Sderaadt if ((!svc_sendreply(xprt, xdr_long, (caddr_t)&ans)) &&
423df930be7Sderaadt debugging) {
42460cef36bSderaadt fprintf(stderr, "svc_sendreply\n");
425df930be7Sderaadt abort();
426df930be7Sderaadt }
427df930be7Sderaadt break;
428df930be7Sderaadt case PMAPPROC_GETPORT:
429df930be7Sderaadt /*
430df930be7Sderaadt * Lookup the mapping for a program,version and return its port
431df930be7Sderaadt */
43260cef36bSderaadt if (!svc_getargs(xprt, xdr_pmap, (caddr_t)®)) {
433df930be7Sderaadt svcerr_decode(xprt);
43460cef36bSderaadt break;
43560cef36bSderaadt }
436df930be7Sderaadt fnd = find_service(reg.pm_prog, reg.pm_vers, reg.pm_prot);
437df930be7Sderaadt if (fnd)
438df930be7Sderaadt port = fnd->pml_map.pm_port;
439df930be7Sderaadt else
440df930be7Sderaadt port = 0;
441df930be7Sderaadt if ((!svc_sendreply(xprt, xdr_long, (caddr_t)&port)) &&
442df930be7Sderaadt debugging) {
44360cef36bSderaadt fprintf(stderr, "svc_sendreply\n");
444df930be7Sderaadt abort();
445df930be7Sderaadt }
446df930be7Sderaadt break;
447df930be7Sderaadt case PMAPPROC_DUMP:
448df930be7Sderaadt /*
449df930be7Sderaadt * Return the current set of mapped program,version
450df930be7Sderaadt */
45160cef36bSderaadt if (!svc_getargs(xprt, xdr_void, NULL)) {
452df930be7Sderaadt svcerr_decode(xprt);
45360cef36bSderaadt break;
45460cef36bSderaadt }
45560cef36bSderaadt if (!svc_sendreply(xprt, xdr_pmaplist, (caddr_t)&pmaplist) &&
45660cef36bSderaadt debugging) {
45760cef36bSderaadt fprintf(stderr, "svc_sendreply\n");
458df930be7Sderaadt abort();
459df930be7Sderaadt }
460df930be7Sderaadt break;
461df930be7Sderaadt case PMAPPROC_CALLIT:
462df930be7Sderaadt /*
463df930be7Sderaadt * Calls a procedure on the local machine. If the requested
464df930be7Sderaadt * procedure is not registered this procedure does not return
465df930be7Sderaadt * error information!!
466df930be7Sderaadt * This procedure is only supported on rpc/udp and calls via
467df930be7Sderaadt * rpc/udp. It passes null authentication parameters.
468df930be7Sderaadt */
469df930be7Sderaadt callit(rqstp, xprt);
470df930be7Sderaadt break;
471df930be7Sderaadt default:
472df930be7Sderaadt svcerr_noproc(xprt);
473df930be7Sderaadt break;
474df930be7Sderaadt }
475df930be7Sderaadt }
476df930be7Sderaadt
477df930be7Sderaadt
478df930be7Sderaadt /*
479df930be7Sderaadt * Stuff for the rmtcall service
480df930be7Sderaadt */
481df930be7Sderaadt #define ARGSIZE 9000
482df930be7Sderaadt
483df930be7Sderaadt struct encap_parms {
484df930be7Sderaadt u_int arglen;
485df930be7Sderaadt char *args;
486df930be7Sderaadt };
487df930be7Sderaadt
488df930be7Sderaadt static bool_t
xdr_encap_parms(XDR * xdrs,struct encap_parms * epp)48946aa5dceSderaadt xdr_encap_parms(XDR *xdrs, struct encap_parms *epp)
490df930be7Sderaadt {
491df930be7Sderaadt
492df930be7Sderaadt return (xdr_bytes(xdrs, &(epp->args), &(epp->arglen), ARGSIZE));
493df930be7Sderaadt }
494df930be7Sderaadt
495df930be7Sderaadt struct rmtcallargs {
496df930be7Sderaadt u_long rmt_prog;
497df930be7Sderaadt u_long rmt_vers;
498df930be7Sderaadt u_long rmt_port;
499df930be7Sderaadt u_long rmt_proc;
500df930be7Sderaadt struct encap_parms rmt_args;
501df930be7Sderaadt };
502df930be7Sderaadt
503c1198d48Sguenther /*
504c1198d48Sguenther * Version of xdr_rmtcall_args() that supports both directions
505c1198d48Sguenther */
506df930be7Sderaadt static bool_t
portmap_xdr_rmtcall_args(XDR * xdrs,struct rmtcallargs * cap)507c1198d48Sguenther portmap_xdr_rmtcall_args(XDR *xdrs, struct rmtcallargs *cap)
508df930be7Sderaadt {
509df930be7Sderaadt
510df930be7Sderaadt /* does not get a port number */
511df930be7Sderaadt if (xdr_u_long(xdrs, &(cap->rmt_prog)) &&
512df930be7Sderaadt xdr_u_long(xdrs, &(cap->rmt_vers)) &&
513df930be7Sderaadt xdr_u_long(xdrs, &(cap->rmt_proc))) {
514df930be7Sderaadt return (xdr_encap_parms(xdrs, &(cap->rmt_args)));
515df930be7Sderaadt }
516df930be7Sderaadt return (FALSE);
517df930be7Sderaadt }
518df930be7Sderaadt
519c1198d48Sguenther /*
520c1198d48Sguenther * Version of xdr_rmtcallres() that supports both directions
521c1198d48Sguenther */
522df930be7Sderaadt static bool_t
portmap_xdr_rmtcallres(XDR * xdrs,struct rmtcallargs * cap)523c1198d48Sguenther portmap_xdr_rmtcallres(XDR *xdrs, struct rmtcallargs *cap)
524df930be7Sderaadt {
525df930be7Sderaadt if (xdr_u_long(xdrs, &(cap->rmt_port)))
526df930be7Sderaadt return (xdr_encap_parms(xdrs, &(cap->rmt_args)));
527df930be7Sderaadt return (FALSE);
528df930be7Sderaadt }
529df930be7Sderaadt
530df930be7Sderaadt /*
531df930be7Sderaadt * only worries about the struct encap_parms part of struct rmtcallargs.
532df930be7Sderaadt * The arglen must already be set!!
533df930be7Sderaadt */
534df930be7Sderaadt static bool_t
xdr_opaque_parms(XDR * xdrs,struct rmtcallargs * cap)53546aa5dceSderaadt xdr_opaque_parms(XDR *xdrs, struct rmtcallargs *cap)
536df930be7Sderaadt {
537df930be7Sderaadt
538df930be7Sderaadt return (xdr_opaque(xdrs, cap->rmt_args.args, cap->rmt_args.arglen));
539df930be7Sderaadt }
540df930be7Sderaadt
541df930be7Sderaadt /*
542df930be7Sderaadt * This routine finds and sets the length of incoming opaque paraters
543df930be7Sderaadt * and then calls xdr_opaque_parms.
544df930be7Sderaadt */
545df930be7Sderaadt static bool_t
xdr_len_opaque_parms(XDR * xdrs,struct rmtcallargs * cap)54646aa5dceSderaadt xdr_len_opaque_parms(XDR *xdrs, struct rmtcallargs *cap)
547df930be7Sderaadt {
5480ac0d02eSmpech u_int beginpos, lowpos, highpos, currpos, pos;
549df930be7Sderaadt
550df930be7Sderaadt beginpos = lowpos = pos = xdr_getpos(xdrs);
551df930be7Sderaadt highpos = lowpos + ARGSIZE;
552591391d8Stedu while (highpos >= lowpos) {
553df930be7Sderaadt currpos = (lowpos + highpos) / 2;
554df930be7Sderaadt if (xdr_setpos(xdrs, currpos)) {
555df930be7Sderaadt pos = currpos;
556df930be7Sderaadt lowpos = currpos + 1;
557df930be7Sderaadt } else {
558df930be7Sderaadt highpos = currpos - 1;
559df930be7Sderaadt }
560df930be7Sderaadt }
561df930be7Sderaadt xdr_setpos(xdrs, beginpos);
562df930be7Sderaadt cap->rmt_args.arglen = pos - beginpos;
563df930be7Sderaadt return (xdr_opaque_parms(xdrs, cap));
564df930be7Sderaadt }
565df930be7Sderaadt
566df930be7Sderaadt /*
567df930be7Sderaadt * Call a remote procedure service
568df930be7Sderaadt * This procedure is very quiet when things go wrong.
569df930be7Sderaadt * The proc is written to support broadcast rpc. In the broadcast case,
570df930be7Sderaadt * a machine should shut-up instead of complain, less the requestor be
571df930be7Sderaadt * overrun with complaints at the expense of not hearing a valid reply ...
572df930be7Sderaadt *
573df930be7Sderaadt * This now forks so that the program & process that it calls can call
574df930be7Sderaadt * back to the portmapper.
575df930be7Sderaadt */
576d91d7659Sderaadt void
callit(struct svc_req * rqstp,SVCXPRT * xprt)57746aa5dceSderaadt callit(struct svc_req *rqstp, SVCXPRT *xprt)
578df930be7Sderaadt {
579df930be7Sderaadt struct rmtcallargs a;
580df930be7Sderaadt struct pmaplist *pml;
581df930be7Sderaadt u_short port;
582df930be7Sderaadt struct sockaddr_in me;
58348822293Sderaadt pid_t pid;
5844f68b03bSguenther int so = -1;
585df930be7Sderaadt CLIENT *client;
586df930be7Sderaadt struct authunix_parms *au = (struct authunix_parms *)rqstp->rq_clntcred;
587df930be7Sderaadt struct timeval timeout;
588df930be7Sderaadt char buf[ARGSIZE];
589df930be7Sderaadt
590df930be7Sderaadt timeout.tv_sec = 5;
591df930be7Sderaadt timeout.tv_usec = 0;
592df930be7Sderaadt a.rmt_args.args = buf;
593c1198d48Sguenther if (!svc_getargs(xprt, portmap_xdr_rmtcall_args, (caddr_t)&a))
594df930be7Sderaadt return;
595f99230ebSdhill if (!check_callit(svc_getcaller(xprt), a.rmt_prog, a.rmt_proc))
596f94670b8Sderaadt return;
597df930be7Sderaadt if ((pml = find_service(a.rmt_prog, a.rmt_vers,
598df930be7Sderaadt (u_long)IPPROTO_UDP)) == NULL)
599df930be7Sderaadt return;
60077baebbfSderaadt
601df930be7Sderaadt /*
602df930be7Sderaadt * fork a child to do the work. Parent immediately returns.
603df930be7Sderaadt * Child exits upon completion.
604df930be7Sderaadt */
605df930be7Sderaadt if ((pid = fork()) != 0) {
606df930be7Sderaadt if (pid == -1)
607df930be7Sderaadt syslog(LOG_ERR, "CALLIT (prog %lu): fork: %m",
608df930be7Sderaadt a.rmt_prog);
609df930be7Sderaadt return;
610df930be7Sderaadt }
611a828131dSderaadt
61252612c9bSderaadt if (pledge("stdio inet", NULL) == -1)
6130bd1216cSderaadt err(1, "pledge");
614a828131dSderaadt
615df930be7Sderaadt port = pml->pml_map.pm_port;
616df930be7Sderaadt get_myaddress(&me);
617df930be7Sderaadt me.sin_port = htons(port);
618df930be7Sderaadt
619df930be7Sderaadt /* Avoid implicit binding to reserved port by clntudp_create() */
6204f68b03bSguenther so = socket(AF_INET, SOCK_DGRAM | SOCK_NONBLOCK, IPPROTO_UDP);
621df930be7Sderaadt if (so == -1)
622df930be7Sderaadt exit(1);
623df930be7Sderaadt
624df930be7Sderaadt client = clntudp_create(&me, a.rmt_prog, a.rmt_vers, timeout, &so);
625591391d8Stedu if (client != NULL) {
62677baebbfSderaadt if (rqstp->rq_cred.oa_flavor == AUTH_UNIX)
627df930be7Sderaadt client->cl_auth = authunix_create(au->aup_machname,
628df930be7Sderaadt au->aup_uid, au->aup_gid, au->aup_len, au->aup_gids);
629df930be7Sderaadt a.rmt_port = (u_long)port;
630df930be7Sderaadt if (clnt_call(client, a.rmt_proc, xdr_opaque_parms, &a,
63177baebbfSderaadt xdr_len_opaque_parms, &a, timeout) == RPC_SUCCESS)
632c1198d48Sguenther svc_sendreply(xprt, portmap_xdr_rmtcallres, (caddr_t)&a);
633df930be7Sderaadt AUTH_DESTROY(client->cl_auth);
634df930be7Sderaadt clnt_destroy(client);
635df930be7Sderaadt }
636df930be7Sderaadt (void)close(so);
637df930be7Sderaadt exit(0);
638df930be7Sderaadt }
639df930be7Sderaadt
640df930be7Sderaadt void
reap(int signo)64183e8fa08Sderaadt reap(int signo)
642df930be7Sderaadt {
643df930be7Sderaadt int save_errno = errno;
644df930be7Sderaadt
6457af3e1e5Sderaadt while (wait3(NULL, WNOHANG, NULL) > 0)
646df930be7Sderaadt ;
647df930be7Sderaadt errno = save_errno;
648df930be7Sderaadt }
649f94670b8Sderaadt
650f94670b8Sderaadt #define NFSPROG ((u_long) 100003)
651f94670b8Sderaadt #define MOUNTPROG ((u_long) 100005)
652f94670b8Sderaadt #define YPXPROG ((u_long) 100069)
653f94670b8Sderaadt #define YPPROG ((u_long) 100004)
654f94670b8Sderaadt #define YPPROC_DOMAIN_NONACK ((u_long) 2)
655f94670b8Sderaadt #define MOUNTPROC_MNT ((u_long) 1)
6569d791f75Sderaadt #define XXXPROC_NOP ((u_long) 0)
657f94670b8Sderaadt
658f94670b8Sderaadt int
check_callit(struct sockaddr_in * addr,u_long prog,u_long aproc)659f99230ebSdhill check_callit(struct sockaddr_in *addr, u_long prog, u_long aproc)
660f94670b8Sderaadt {
6619d791f75Sderaadt if ((prog == PMAPPROG && aproc != XXXPROC_NOP) ||
6629d791f75Sderaadt (prog == NFSPROG && aproc != XXXPROC_NOP) ||
6639d791f75Sderaadt (prog == YPXPROG && aproc != XXXPROC_NOP) ||
664f94670b8Sderaadt (prog == MOUNTPROG && aproc == MOUNTPROC_MNT) ||
665f94670b8Sderaadt (prog == YPPROG && aproc != YPPROC_DOMAIN_NONACK)) {
666f94670b8Sderaadt syslog(LOG_WARNING,
667591391d8Stedu "callit prog %ld aproc %ld (might be from %s)",
668591391d8Stedu prog, aproc, inet_ntoa(addr->sin_addr));
669f94670b8Sderaadt return (FALSE);
670f94670b8Sderaadt }
671f94670b8Sderaadt return (TRUE);
672f94670b8Sderaadt }
673