identd.c revision 1.25 1 /* $NetBSD: identd.c,v 1.25 2005/03/11 15:49:52 peter Exp $ */
2
3 /*
4 * identd.c - TCP/IP Ident protocol server.
5 *
6 * This software is in the public domain.
7 * Written by Peter Postma <peter (at) pointless.nl>
8 */
9
10 #include <sys/types.h>
11 #include <sys/socket.h>
12 #include <sys/stat.h>
13 #include <sys/param.h>
14 #include <sys/sysctl.h>
15 #include <sys/wait.h>
16
17 #include <netinet/in.h>
18 #include <netinet/ip_var.h>
19 #include <netinet/tcp.h>
20 #include <netinet/tcp_timer.h>
21 #include <netinet/tcp_var.h>
22
23 #include <arpa/inet.h>
24
25 #include <ctype.h>
26 #include <err.h>
27 #include <errno.h>
28 #include <fcntl.h>
29 #include <grp.h>
30 #include <netdb.h>
31 #include <poll.h>
32 #include <pwd.h>
33 #include <signal.h>
34 #include <stdarg.h>
35 #include <stdio.h>
36 #include <stdlib.h>
37 #include <string.h>
38 #include <syslog.h>
39 #include <unistd.h>
40
41 __RCSID("$NetBSD: identd.c,v 1.25 2005/03/11 15:49:52 peter Exp $");
42
43 #define OPSYS_NAME "UNIX"
44 #define IDENT_SERVICE "auth"
45 #define TIMEOUT 30 /* seconds */
46
47 static int idhandle(int, const char *, const char *, const char *,
48 const char *, int);
49 static void idparse(int, int, int, const char *, const char *, const char *);
50 static void iderror(int, int, int, const char *);
51 static const char *gethost(struct sockaddr_storage *);
52 static int *socketsetup(const char *, const char *, int);
53 static int sysctl_getuid(struct sockaddr_storage *, socklen_t, uid_t *);
54 static int check_noident(const char *);
55 static int check_userident(const char *, char *, size_t);
56 static void random_string(char *, size_t);
57 static int change_format(const char *, struct passwd *, char *, size_t);
58 static void timeout_handler(int);
59 static void waitchild(int);
60 static void fatal(const char *);
61 static void maybe_syslog(int, const char *, ...);
62
63 static int bflag, eflag, fflag, Fflag, iflag, Iflag;
64 static int lflag, Lflag, nflag, Nflag, rflag;
65
66 int
67 main(int argc, char *argv[])
68 {
69 int IPv4or6, ch, *socks, timeout;
70 char *address, *charset, *fmt, *p;
71 const char *osname, *portno;
72 char user[LOGIN_NAME_MAX];
73 struct group *grp;
74 struct passwd *pw;
75 gid_t gid;
76 uid_t uid;
77
78 IPv4or6 = AF_UNSPEC;
79 osname = OPSYS_NAME;
80 portno = IDENT_SERVICE;
81 timeout = TIMEOUT;
82 address = charset = fmt = NULL;
83 uid = gid = 0;
84 bflag = eflag = fflag = Fflag = iflag = Iflag = 0;
85 lflag = Lflag = nflag = Nflag = rflag = 0;
86
87 /* Started from a tty? then run as daemon. */
88 if (isatty(0))
89 bflag = 1;
90
91 /* Parse command line arguments. */
92 while ((ch = getopt(argc, argv, "46a:bceF:f:g:IiL:lNno:p:rt:u:")) != -1)
93 switch (ch) {
94 case '4':
95 IPv4or6 = AF_INET;
96 break;
97 case '6':
98 IPv4or6 = AF_INET6;
99 break;
100 case 'a':
101 address = optarg;
102 break;
103 case 'b':
104 bflag = 1;
105 break;
106 case 'c':
107 charset = optarg;
108 break;
109 case 'e':
110 eflag = 1;
111 break;
112 case 'F':
113 Fflag = 1;
114 fmt = optarg;
115 break;
116 case 'f':
117 fflag = 1;
118 (void)strlcpy(user, optarg, sizeof(user));
119 break;
120 case 'g':
121 gid = (gid_t)strtol(optarg, &p, 0);
122 if (*p != '\0') {
123 if ((grp = getgrnam(optarg)) != NULL)
124 gid = grp->gr_gid;
125 else
126 errx(EXIT_FAILURE,
127 "No such group '%s'", optarg);
128 }
129 break;
130 case 'I':
131 Iflag = 1;
132 /* FALLTHROUGH */
133 case 'i':
134 iflag = 1;
135 break;
136 case 'L':
137 Lflag = 1;
138 (void)strlcpy(user, optarg, sizeof(user));
139 break;
140 case 'l':
141 lflag = 1;
142 break;
143 case 'N':
144 Nflag = 1;
145 break;
146 case 'n':
147 nflag = 1;
148 break;
149 case 'o':
150 osname = optarg;
151 break;
152 case 'p':
153 portno = optarg;
154 break;
155 case 'r':
156 rflag = 1;
157 break;
158 case 't':
159 timeout = (int)strtol(optarg, &p, 0);
160 if (*p != '\0')
161 errx(EXIT_FAILURE,
162 "Invalid timeout value '%s'", optarg);
163 break;
164 case 'u':
165 uid = (uid_t)strtol(optarg, &p, 0);
166 if (*p != '\0') {
167 if ((pw = getpwnam(optarg)) != NULL) {
168 uid = pw->pw_uid;
169 gid = pw->pw_gid;
170 } else
171 errx(EXIT_FAILURE,
172 "No such user '%s'", optarg);
173 }
174 break;
175 default:
176 exit(EXIT_FAILURE);
177 }
178
179 if (lflag)
180 openlog("identd", LOG_PID, LOG_DAEMON);
181
182 /* Setup sockets when running in the background. */
183 if (bflag)
184 socks = socketsetup(address, portno, IPv4or6);
185
186 /* Switch to another uid/gid? */
187 if (gid && setgid(gid) == -1) {
188 maybe_syslog(LOG_ERR, "setgid: %m");
189 if (bflag)
190 warn("setgid");
191 exit(EXIT_FAILURE);
192 }
193 if (uid && setuid(uid) == -1) {
194 maybe_syslog(LOG_ERR, "setuid: %m");
195 if (bflag)
196 warn("setuid");
197 exit(EXIT_FAILURE);
198 }
199
200 /*
201 * When running as daemon: daemonize, setup pollfds and go into
202 * the mainloop. Otherwise, just read the input from stdin and
203 * let inetd handle the sockets.
204 */
205 if (bflag) {
206 int fd, i, nfds, rv;
207 struct pollfd *rfds;
208
209 (void)signal(SIGCHLD, waitchild);
210 if (daemon(0, 0) < 0)
211 err(EXIT_FAILURE, "daemon");
212
213 rfds = malloc(*socks * sizeof(struct pollfd));
214 if (rfds == NULL)
215 fatal("malloc");
216 nfds = *socks;
217 for (i = 0; i < nfds; i++) {
218 rfds[i].fd = socks[i+1];
219 rfds[i].events = POLLIN;
220 rfds[i].revents = 0;
221 }
222 /* Mainloop for daemon. */
223 for (;;) {
224 rv = poll(rfds, nfds, INFTIM);
225 if (rv < 0) {
226 if (errno == EINTR)
227 continue;
228 fatal("poll");
229 }
230 for (i = 0; i < nfds; i++) {
231 if (rfds[i].revents & POLLIN) {
232 fd = accept(rfds[i].fd, NULL, NULL);
233 if (fd < 0) {
234 maybe_syslog(LOG_ERR,
235 "accept: %m");
236 continue;
237 }
238 switch (fork()) {
239 case -1: /* error */
240 maybe_syslog(LOG_ERR,
241 "fork: %m");
242 (void)sleep(1);
243 break;
244 case 0: /* child */
245 (void)idhandle(fd, charset,
246 fmt, osname, user, timeout);
247 _exit(EXIT_SUCCESS);
248 default: /* parent */
249 (void)close(fd);
250 }
251 }
252 }
253 }
254 } else
255 (void)idhandle(STDIN_FILENO, charset, fmt, osname, user,
256 timeout);
257
258 return 0;
259 }
260
261 static int
262 idhandle(int fd, const char *charset, const char *fmt, const char *osname,
263 const char *user, int timeout)
264 {
265 struct sockaddr_storage ss[2];
266 char userbuf[LOGIN_NAME_MAX]; /* actual user name (or numeric uid) */
267 char idbuf[LOGIN_NAME_MAX]; /* name to be used in response */
268 char buf[BUFSIZ], *p;
269 int n, lport, fport;
270 struct passwd *pw;
271 socklen_t len;
272 uid_t uid;
273
274 lport = fport = 0;
275
276 (void)strlcpy(idbuf, user, sizeof(idbuf));
277 (void)signal(SIGALRM, timeout_handler);
278 (void)alarm(timeout);
279
280 /* Get foreign internet address. */
281 len = sizeof(ss[0]);
282 if (getpeername(fd, (struct sockaddr *)&ss[0], &len) < 0)
283 fatal("getpeername");
284
285 maybe_syslog(LOG_INFO, "Connection from %s", gethost(&ss[0]));
286
287 /* Get local internet address. */
288 len = sizeof(ss[1]);
289 if (getsockname(fd, (struct sockaddr *)&ss[1], &len) < 0)
290 fatal("getsockname");
291
292 /* Be sure to have the same address families. */
293 if (ss[0].ss_family != ss[1].ss_family) {
294 maybe_syslog(LOG_ERR, "Different foreign/local address family");
295 return 1;
296 }
297
298 /* Receive data from the client. */
299 if ((n = recv(fd, buf, sizeof(buf) - 1, 0)) < 0) {
300 fatal("recv");
301 } else if (n == 0) {
302 maybe_syslog(LOG_NOTICE, "recv: EOF");
303 iderror(fd, 0, 0, "UNKNOWN-ERROR");
304 return 1;
305 }
306 buf[n] = '\0';
307
308 /* Get local and remote ports from the received data. */
309 p = buf;
310 while (*p != '\0' && isspace((unsigned char)*p))
311 p++;
312 if ((p = strtok(p, " \t,")) != NULL) {
313 lport = atoi(p);
314 if ((p = strtok(NULL, " \t,")) != NULL)
315 fport = atoi(p);
316 }
317
318 /* Are the ports valid? */
319 if (lport < 1 || lport > 65535 || fport < 1 || fport > 65535) {
320 maybe_syslog(LOG_NOTICE, "Invalid port(s): %d, %d from %s",
321 lport, fport, gethost(&ss[0]));
322 iderror(fd, 0, 0, eflag ? "UNKNOWN-ERROR" : "INVALID-PORT");
323 return 1;
324 }
325
326 /* If there is a 'lie' user enabled, then handle it now and stop. */
327 if (Lflag) {
328 maybe_syslog(LOG_NOTICE, "Lying with name %s to %s",
329 idbuf, gethost(&ss[0]));
330 idparse(fd, lport, fport, charset, osname, idbuf);
331 return 0;
332 }
333
334 /* Protocol dependent stuff. */
335 switch (ss[0].ss_family) {
336 case AF_INET:
337 ((struct sockaddr_in *)&ss[0])->sin_port = htons(fport);
338 ((struct sockaddr_in *)&ss[1])->sin_port = htons(lport);
339 break;
340 case AF_INET6:
341 ((struct sockaddr_in6 *)&ss[0])->sin6_port = htons(fport);
342 ((struct sockaddr_in6 *)&ss[1])->sin6_port = htons(lport);
343 break;
344 default:
345 maybe_syslog(LOG_ERR, "Unsupported protocol (no. %d)",
346 ss[0].ss_family);
347 return 1;
348 }
349
350 /* Try to get the UID of the connection owner using sysctl. */
351 if (sysctl_getuid(ss, sizeof(ss), &uid) == -1) {
352 maybe_syslog(LOG_ERR, "sysctl: %m");
353 if (fflag) {
354 maybe_syslog(LOG_NOTICE, "Using fallback name %s to %s",
355 idbuf, gethost(&ss[0]));
356 idparse(fd, lport, fport, charset, osname, idbuf);
357 return 0;
358 }
359 iderror(fd, lport, fport, eflag ? "UNKNOWN-ERROR" : "NO-USER");
360 return 1;
361 }
362
363 /* Fill in userbuf with user name if possible, else numeric UID. */
364 if ((pw = getpwuid(uid)) == NULL) {
365 maybe_syslog(LOG_ERR, "Couldn't map uid (%u) to name", uid);
366 (void)snprintf(userbuf, sizeof(userbuf), "%u", uid);
367 } else {
368 maybe_syslog(LOG_INFO, "Successful lookup: %d, %d: %s for %s",
369 lport, fport, pw->pw_name, gethost(&ss[0]));
370 (void)strlcpy(userbuf, pw->pw_name, sizeof(userbuf));
371 }
372
373 /* No ident enabled? */
374 if (Nflag && pw && check_noident(pw->pw_dir)) {
375 maybe_syslog(LOG_NOTICE, "Returning HIDDEN-USER for user %s"
376 " to %s", pw->pw_name, gethost(&ss[0]));
377 iderror(fd, lport, fport, "HIDDEN-USER");
378 return 1;
379 }
380
381 /* User ident enabled? */
382 if (iflag && pw && check_userident(pw->pw_dir, idbuf, sizeof(idbuf))) {
383 if (!Iflag) {
384 if ((strspn(idbuf, "0123456789") &&
385 getpwuid(atoi(idbuf)) != NULL) ||
386 (getpwnam(idbuf) != NULL)) {
387 maybe_syslog(LOG_NOTICE,
388 "Ignoring user-specified '%s' for user %s",
389 idbuf, userbuf);
390 (void)strlcpy(idbuf, userbuf, sizeof(idbuf));
391 }
392 }
393 maybe_syslog(LOG_NOTICE, "Returning user-specified '%s' for "
394 "user %s to %s", idbuf, userbuf, gethost(&ss[0]));
395 idparse(fd, lport, fport, charset, osname, idbuf);
396 return 0;
397 }
398
399 /* Send a random message? */
400 if (rflag) {
401 /* Random number or string? */
402 if (nflag)
403 (void)snprintf(idbuf, sizeof(idbuf), "%u",
404 (unsigned int)(arc4random() % 65535));
405 else
406 random_string(idbuf, sizeof(idbuf));
407
408 maybe_syslog(LOG_NOTICE, "Returning random '%s' for user %s"
409 " to %s", idbuf, userbuf, gethost(&ss[0]));
410 idparse(fd, lport, fport, charset, osname, idbuf);
411 return 0;
412 }
413
414 /* Return numberic user ID? */
415 if (nflag)
416 (void)snprintf(idbuf, sizeof(idbuf), "%u", uid);
417 else
418 (void)strlcpy(idbuf, userbuf, sizeof(idbuf));
419
420 /*
421 * Change the output format? Note that 512 is the maximum
422 * size of the result according to RFC 1413.
423 */
424 if (Fflag && change_format(fmt, pw, buf, 512))
425 idparse(fd, lport, fport, charset, osname, buf);
426 else
427 idparse(fd, lport, fport, charset, osname, idbuf);
428
429 return 0;
430 }
431
432 /* Send/parse the ident result. */
433 static void
434 idparse(int fd, int lport, int fport, const char *charset, const char *osname,
435 const char *user)
436 {
437 char *p;
438
439 if (asprintf(&p, "%d,%d:USERID:%s%s%s:%s\r\n", lport, fport,
440 osname, charset ? "," : "", charset ? charset : "", user) < 0)
441 fatal("asprintf");
442 if (send(fd, p, strlen(p), 0) < 0) {
443 free(p);
444 fatal("send");
445 }
446 free(p);
447 }
448
449 /* Return a specified ident error. */
450 static void
451 iderror(int fd, int lport, int fport, const char *error)
452 {
453 char *p;
454
455 if (asprintf(&p, "%d,%d:ERROR:%s\r\n", lport, fport, error) < 0)
456 fatal("asprintf");
457 if (send(fd, p, strlen(p), 0) < 0) {
458 free(p);
459 fatal("send");
460 }
461 free(p);
462 }
463
464 /* Return the IP address of the connecting host. */
465 static const char *
466 gethost(struct sockaddr_storage *ss)
467 {
468 static char host[NI_MAXHOST];
469
470 if (getnameinfo((struct sockaddr *)ss, ss->ss_len, host,
471 sizeof(host), NULL, 0, NI_NUMERICHOST) == 0)
472 return host;
473
474 return "UNKNOWN";
475 }
476
477 /* Setup sockets, for daemon mode. */
478 static int *
479 socketsetup(const char *address, const char *port, int af)
480 {
481 struct addrinfo hints, *res, *res0;
482 int error, maxs, *s, *socks, y = 1;
483 const char *cause = NULL;
484
485 (void)memset(&hints, 0, sizeof(hints));
486 hints.ai_flags = AI_PASSIVE;
487 hints.ai_family = af;
488 hints.ai_socktype = SOCK_STREAM;
489 error = getaddrinfo(address, port, &hints, &res0);
490 if (error) {
491 maybe_syslog(LOG_ERR, "getaddrinfo: %s", gai_strerror(error));
492 errx(EXIT_FAILURE, "%s", gai_strerror(error));
493 /* NOTREACHED */
494 }
495
496 /* Count max number of sockets we may open. */
497 for (maxs = 0, res = res0; res != NULL; res = res->ai_next)
498 maxs++;
499
500 socks = malloc((maxs + 1) * sizeof(int));
501 if (socks == NULL) {
502 maybe_syslog(LOG_ERR, "malloc: %m");
503 err(EXIT_FAILURE, "malloc");
504 /* NOTREACHED */
505 }
506
507 *socks = 0;
508 s = socks + 1;
509 for (res = res0; res != NULL; res = res->ai_next) {
510 *s = socket(res->ai_family, res->ai_socktype, res->ai_protocol);
511 if (*s < 0) {
512 cause = "socket";
513 continue;
514 }
515 (void)setsockopt(*s, SOL_SOCKET, SO_REUSEADDR, &y, sizeof(y));
516 if (bind(*s, res->ai_addr, res->ai_addrlen) < 0) {
517 cause = "bind";
518 (void)close(*s);
519 continue;
520 }
521 if (listen(*s, 5) < 0) {
522 cause = "listen";
523 (void)close(*s);
524 continue;
525 }
526 *socks = *socks + 1;
527 s++;
528 }
529
530 if (*socks == 0) {
531 free(socks);
532 maybe_syslog(LOG_ERR, "%s: %m", cause);
533 err(EXIT_FAILURE, "%s", cause);
534 /* NOTREACHED */
535 }
536 if (res0)
537 freeaddrinfo(res0);
538
539 return socks;
540 }
541
542 /* Try to get the UID of the connection owner using sysctl. */
543 static int
544 sysctl_getuid(struct sockaddr_storage *ss, socklen_t len, uid_t *uid)
545 {
546 int mib[4];
547 uid_t myuid;
548 size_t uidlen;
549
550 uidlen = sizeof(myuid);
551
552 mib[0] = CTL_NET;
553 mib[1] = ss->ss_family;
554 mib[2] = IPPROTO_TCP;
555 mib[3] = TCPCTL_IDENT;
556
557 if (sysctl(mib, sizeof(mib)/ sizeof(int), &myuid, &uidlen, ss, len) < 0)
558 return -1;
559 *uid = myuid;
560
561 return 0;
562 }
563
564 /* Check if a .noident file exists in the user home directory. */
565 static int
566 check_noident(const char *homedir)
567 {
568 struct stat sb;
569 char *path;
570 int ret;
571
572 if (homedir == NULL)
573 return 0;
574 if (asprintf(&path, "%s/.noident", homedir) < 0)
575 return 0;
576 ret = stat(path, &sb);
577
578 free(path);
579 return (ret == 0);
580 }
581
582 /*
583 * Check if a .ident file exists in the user home directory and
584 * return the contents of that file.
585 */
586 static int
587 check_userident(const char *homedir, char *username, size_t len)
588 {
589 struct stat sb;
590 char *path, *p;
591 int fd, n;
592
593 if (len == 0 || homedir == NULL)
594 return 0;
595 if (asprintf(&path, "%s/.ident", homedir) < 0)
596 return 0;
597 if ((fd = open(path, O_RDONLY|O_NONBLOCK|O_NOFOLLOW, 0)) < 0) {
598 free(path);
599 return 0;
600 }
601 if (fstat(fd, &sb) < 0 || !S_ISREG(sb.st_mode)) {
602 (void)close(fd);
603 free(path);
604 return 0;
605 }
606 if ((n = read(fd, username, len - 1)) < 1) {
607 (void)close(fd);
608 free(path);
609 return 0;
610 }
611 username[n] = '\0';
612
613 if ((p = strpbrk(username, "\r\n")) != NULL)
614 *p = '\0';
615
616 (void)close(fd);
617 free(path);
618 return 1;
619 }
620
621 /* Generate a random string. */
622 static void
623 random_string(char *str, size_t len)
624 {
625 static const char chars[] = "abcdefghijklmnopqrstuvwxyz1234567890";
626 char *p;
627
628 if (len == 0)
629 return;
630 for (p = str; len > 1; len--)
631 *p++ = chars[arc4random() % (sizeof(chars) - 1)];
632 *p = '\0';
633 }
634
635 /* Change the output format. */
636 static int
637 change_format(const char *format, struct passwd *pw, char *dest, size_t len)
638 {
639 struct group *gr;
640 const char *cp;
641 char **gmp;
642 int bp;
643
644 if (len == 0 || ((gr = getgrgid(pw->pw_gid)) == NULL))
645 return 0;
646
647 for (bp = 0, cp = format; *cp != '\0' && bp < 490; cp++) {
648 if (*cp != '%') {
649 dest[bp++] = *cp;
650 continue;
651 }
652 if (*++cp == '\0')
653 break;
654 switch (*cp) {
655 case 'u':
656 (void)snprintf(&dest[bp], len - bp, "%.*s", 490 - bp,
657 pw->pw_name);
658 break;
659 case 'U':
660 (void)snprintf(&dest[bp], len - bp, "%d", pw->pw_uid);
661 break;
662 case 'g':
663 (void)snprintf(&dest[bp], len - bp, "%.*s", 490 - bp,
664 gr->gr_name);
665 break;
666 case 'G':
667 (void)snprintf(&dest[bp], len - bp, "%d", gr->gr_gid);
668 break;
669 case 'l':
670 (void)snprintf(&dest[bp], len - bp, "%.*s", 490 - bp,
671 gr->gr_name);
672 bp += strlen(&dest[bp]);
673 if (bp >= 490)
674 break;
675 setgrent();
676 while ((gr = getgrent()) != NULL) {
677 if (gr->gr_gid == pw->pw_gid)
678 continue;
679 for (gmp = gr->gr_mem; *gmp && **gmp; gmp++) {
680 if (strcmp(*gmp, pw->pw_name) == 0) {
681 (void)snprintf(&dest[bp],
682 len - bp, ",%.*s",
683 490 - bp, gr->gr_name);
684 bp += strlen(&dest[bp]);
685 break;
686 }
687 }
688 if (bp >= 490)
689 break;
690 }
691 endgrent();
692 break;
693 case 'L':
694 (void)snprintf(&dest[bp], len - bp, "%u", gr->gr_gid);
695 bp += strlen(&dest[bp]);
696 if (bp >= 490)
697 break;
698 setgrent();
699 while ((gr = getgrent()) != NULL) {
700 if (gr->gr_gid == pw->pw_gid)
701 continue;
702 for (gmp = gr->gr_mem; *gmp && **gmp; gmp++) {
703 if (strcmp(*gmp, pw->pw_name) == 0) {
704 (void)snprintf(&dest[bp],
705 len - bp, ",%u",
706 gr->gr_gid);
707 bp += strlen(&dest[bp]);
708 break;
709 }
710 }
711 if (bp >= 490)
712 break;
713 }
714 endgrent();
715 break;
716 default:
717 dest[bp] = *cp;
718 dest[bp+1] = '\0';
719 break;
720 }
721 bp += strlen(&dest[bp]);
722 }
723 if (bp >= 490) {
724 (void)snprintf(&dest[490], len - 490, "...");
725 bp = 493;
726 }
727 dest[bp] = '\0';
728
729 return 1;
730 }
731
732 /* Just exit when we caught SIGALRM. */
733 static void
734 timeout_handler(int s)
735 {
736 maybe_syslog(LOG_DEBUG, "SIGALRM triggered, exiting...");
737 exit(EXIT_FAILURE);
738 }
739
740 /* This is to clean up zombie processes when in daemon mode. */
741 static void
742 waitchild(int s)
743 {
744 while (waitpid(-1, NULL, WNOHANG) > 0)
745 continue;
746 }
747
748 /* Report error message string through syslog and quit. */
749 static void
750 fatal(const char *func)
751 {
752 maybe_syslog(LOG_ERR, "%s: %m", func);
753 exit(EXIT_FAILURE);
754 }
755
756 /* Log using syslog, but only if enabled with the -l flag. */
757 static void
758 maybe_syslog(int priority, const char *message, ...)
759 {
760 va_list ap;
761
762 if (lflag) {
763 va_start(ap, message);
764 vsyslog(priority, message, ap);
765 va_end(ap);
766 }
767 }
768