inetcf.c revision 1.2
1 /* 2 * Routines to parse an inetd.conf or tlid.conf file. This would be a great 3 * job for a PERL script. 4 * 5 * Author: Wietse Venema, Eindhoven University of Technology, The Netherlands. 6 */ 7 8 #ifndef lint 9 static char sccsid[] = "@(#) inetcf.c 1.6 96/02/11 17:01:29"; 10 #endif 11 12 #include <sys/types.h> 13 #include <sys/stat.h> 14 #include <stdio.h> 15 #include <errno.h> 16 #include <string.h> 17 18 extern int errno; 19 extern void exit(); 20 21 #include "tcpd.h" 22 #include "inetcf.h" 23 24 /* 25 * Programs that use libwrap directly are not in inetd.conf, and so must 26 * be added here in a similar format. (We pretend we found them in 27 * /etc/inetd.conf.) Each one is a set of three strings that correspond 28 * to fields in /etc/inetd.conf: 29 * protocol (field 3), path (field 6), arg0 (field 7) 30 * The last entry should be a NULL. 31 */ 32 char *uses_libwrap[] = { 33 "tcp", "/usr/sbin/sendmail", "sendmail", 34 (char *) NULL 35 }; 36 37 /* 38 * Network configuration files may live in unusual places. Here are some 39 * guesses. Shorter names follow longer ones. 40 */ 41 char *inet_files[] = { 42 "/private/etc/inetd.conf", /* NEXT */ 43 "/etc/inet/inetd.conf", /* SYSV4 */ 44 "/usr/etc/inetd.conf", /* IRIX?? */ 45 "/etc/inetd.conf", /* BSD */ 46 "/etc/net/tlid.conf", /* SYSV4?? */ 47 "/etc/saf/tlid.conf", /* SYSV4?? */ 48 "/etc/tlid.conf", /* SYSV4?? */ 49 0, 50 }; 51 52 static void inet_chk(); 53 static char *base_name(); 54 55 /* 56 * Structure with everything we know about a service. 57 */ 58 struct inet_ent { 59 struct inet_ent *next; 60 int type; 61 char name[1]; 62 }; 63 64 static struct inet_ent *inet_list = 0; 65 66 static char whitespace[] = " \t\r\n"; 67 68 /* inet_conf - read in and examine inetd.conf (or tlid.conf) entries */ 69 70 char *inet_cfg(conf) 71 char *conf; 72 { 73 char buf[BUFSIZ]; 74 FILE *fp; 75 char **wrapped; 76 char *service; 77 char *protocol; 78 char *user; 79 char *path; 80 char *arg0; 81 char *arg1; 82 struct tcpd_context saved_context; 83 char *percent_m(); 84 int i; 85 struct stat st; 86 87 saved_context = tcpd_context; 88 89 /* 90 * The inetd.conf (or tlid.conf) information is so useful that we insist 91 * on its availability. When no file is given run a series of educated 92 * guesses. 93 */ 94 if (conf != 0) { 95 if ((fp = fopen(conf, "r")) == 0) { 96 fprintf(stderr, percent_m(buf, "open %s: %m\n"), conf); 97 exit(1); 98 } 99 } else { 100 for (i = 0; inet_files[i] && (fp = fopen(inet_files[i], "r")) == 0; i++) 101 /* void */ ; 102 if (fp == 0) { 103 fprintf(stderr, "Cannot find your inetd.conf or tlid.conf file.\n"); 104 fprintf(stderr, "Please specify its location.\n"); 105 exit(1); 106 } 107 conf = inet_files[i]; 108 check_path(conf, &st); 109 } 110 111 /* 112 * Process the list of programs that use libwrap directly. 113 */ 114 wrapped = uses_libwrap; 115 while (*wrapped != NULL) { 116 inet_chk(wrapped[0], wrapped[1], wrapped[2], ""); 117 wrapped += 3; 118 } 119 120 /* 121 * Process the file. After the 7.0 wrapper release it became clear that 122 * there are many more inetd.conf formats than the 8 systems that I had 123 * studied. EP/IX uses a two-line specification for rpc services; HP-UX 124 * permits long lines to be broken with backslash-newline. 125 */ 126 tcpd_context.file = conf; 127 tcpd_context.line = 0; 128 while (xgets(buf, sizeof(buf), fp)) { 129 service = strtok(buf, whitespace); /* service */ 130 if (service == 0 || *service == '#') 131 continue; 132 if (STR_NE(service, "stream") && STR_NE(service, "dgram")) 133 strtok((char *) 0, whitespace); /* endpoint */ 134 protocol = strtok((char *) 0, whitespace); 135 (void) strtok((char *) 0, whitespace); /* wait */ 136 if ((user = strtok((char *) 0, whitespace)) == 0) 137 continue; 138 if (user[0] == '/') { /* user */ 139 path = user; 140 } else { /* path */ 141 if ((path = strtok((char *) 0, whitespace)) == 0) 142 continue; 143 } 144 if (STR_EQ(path, "internal")) 145 continue; 146 if (path[strspn(path, "-0123456789")] == 0) { 147 148 /* 149 * ConvexOS puts RPC version numbers before path names. Jukka 150 * Ukkonen <ukkonen (at) csc.fi>. 151 */ 152 if ((path = strtok((char *) 0, whitespace)) == 0) 153 continue; 154 } 155 if ((arg0 = strtok((char *) 0, whitespace)) == 0) { 156 tcpd_warn("incomplete line"); 157 continue; 158 } 159 if (arg0[strspn(arg0, "0123456789")] == 0) { 160 161 /* 162 * We're reading a tlid.conf file, the format is: 163 * 164 * ...stuff... path arg_count arguments mod_count modules 165 */ 166 if ((arg0 = strtok((char *) 0, whitespace)) == 0) { 167 tcpd_warn("incomplete line"); 168 continue; 169 } 170 } 171 if ((arg1 = strtok((char *) 0, whitespace)) == 0) 172 arg1 = ""; 173 174 inet_chk(protocol, path, arg0, arg1); 175 } 176 fclose(fp); 177 tcpd_context = saved_context; 178 return (conf); 179 } 180 181 /* inet_chk - examine one inetd.conf (tlid.conf?) entry */ 182 183 static void inet_chk(protocol, path, arg0, arg1) 184 char *protocol; 185 char *path; 186 char *arg0; 187 char *arg1; 188 { 189 char daemon[BUFSIZ]; 190 struct stat st; 191 int wrap_status = WR_MAYBE; 192 char *base_name_path = base_name(path); 193 char *tcpd_proc_name = (arg0[0] == '/' ? base_name(arg0) : arg0); 194 195 /* 196 * Always warn when the executable does not exist or when it is not 197 * executable. 198 */ 199 if (check_path(path, &st) < 0) { 200 tcpd_warn("%s: not found: %m", path); 201 } else if ((st.st_mode & 0100) == 0) { 202 tcpd_warn("%s: not executable", path); 203 } 204 205 /* 206 * Cheat on the miscd tests, nobody uses it anymore. 207 */ 208 if (STR_EQ(base_name_path, "miscd")) { 209 inet_set(arg0, WR_YES); 210 return; 211 } 212 213 /* 214 * While we are here... 215 */ 216 if (STR_EQ(tcpd_proc_name, "rexd") || STR_EQ(tcpd_proc_name, "rpc.rexd")) 217 tcpd_warn("%s may be an insecure service", tcpd_proc_name); 218 219 /* 220 * The tcpd program gets most of the attention. 221 */ 222 if (STR_EQ(base_name_path, "tcpd")) { 223 224 if (STR_EQ(tcpd_proc_name, "tcpd")) 225 tcpd_warn("%s is recursively calling itself", tcpd_proc_name); 226 227 wrap_status = WR_YES; 228 229 /* 230 * Check: some sites install the wrapper set-uid. 231 */ 232 if ((st.st_mode & 06000) != 0) 233 tcpd_warn("%s: file is set-uid or set-gid", path); 234 235 /* 236 * Check: some sites insert tcpd in inetd.conf, instead of replacing 237 * the daemon pathname. 238 */ 239 if (arg0[0] == '/' && STR_EQ(tcpd_proc_name, base_name(arg1))) 240 tcpd_warn("%s inserted before %s", path, arg0); 241 242 /* 243 * Check: make sure files exist and are executable. On some systems 244 * the network daemons are set-uid so we cannot complain. Note that 245 * tcpd takes the basename only in case of absolute pathnames. 246 */ 247 if (arg0[0] == '/') { /* absolute path */ 248 if (check_path(arg0, &st) < 0) { 249 tcpd_warn("%s: not found: %m", arg0); 250 } else if ((st.st_mode & 0100) == 0) { 251 tcpd_warn("%s: not executable", arg0); 252 } 253 } else { /* look in REAL_DAEMON_DIR */ 254 sprintf(daemon, "%s/%s", REAL_DAEMON_DIR, arg0); 255 if (check_path(daemon, &st) < 0) { 256 tcpd_warn("%s: not found in %s: %m", 257 arg0, REAL_DAEMON_DIR); 258 } else if ((st.st_mode & 0100) == 0) { 259 tcpd_warn("%s: not executable", daemon); 260 } 261 } 262 263 } else { 264 265 /* 266 * No tcpd program found. Perhaps they used the "simple installation" 267 * recipe. Look for a file with the same basename in REAL_DAEMON_DIR. 268 * Draw some conservative conclusions when a distinct file is found. 269 */ 270 sprintf(daemon, "%s/%s", REAL_DAEMON_DIR, arg0); 271 if (STR_EQ(path, daemon)) { 272 wrap_status = WR_NOT; 273 } else if (check_path(daemon, &st) >= 0) { 274 wrap_status = WR_MAYBE; 275 } else if (errno == ENOENT) { 276 wrap_status = WR_NOT; 277 } else { 278 tcpd_warn("%s: file lookup: %m", daemon); 279 wrap_status = WR_MAYBE; 280 } 281 } 282 283 /* 284 * Alas, we cannot wrap rpc/tcp services. 285 */ 286 if (wrap_status == WR_YES && STR_EQ(protocol, "rpc/tcp")) 287 tcpd_warn("%s: cannot wrap rpc/tcp services", tcpd_proc_name); 288 289 /* NetBSD inetd wraps all programs */ 290 if (! STR_EQ(protocol, "rpc/tcp")) 291 wrap_status = WR_YES; 292 293 inet_set(tcpd_proc_name, wrap_status); 294 } 295 296 /* inet_set - remember service status */ 297 298 void inet_set(name, type) 299 char *name; 300 int type; 301 { 302 struct inet_ent *ip = 303 (struct inet_ent *) malloc(sizeof(struct inet_ent) + strlen(name)); 304 305 if (ip == 0) { 306 fprintf(stderr, "out of memory\n"); 307 exit(1); 308 } 309 ip->next = inet_list; 310 strcpy(ip->name, name); 311 ip->type = type; 312 inet_list = ip; 313 } 314 315 /* inet_get - look up service status */ 316 317 int inet_get(name) 318 char *name; 319 { 320 struct inet_ent *ip; 321 322 if (inet_list == 0) 323 return (WR_MAYBE); 324 325 for (ip = inet_list; ip; ip = ip->next) 326 if (STR_EQ(ip->name, name)) 327 return (ip->type); 328 329 return (-1); 330 } 331 332 /* base_name - compute last pathname component */ 333 334 static char *base_name(path) 335 char *path; 336 { 337 char *cp; 338 339 if ((cp = strrchr(path, '/')) != 0) 340 path = cp + 1; 341 return (path); 342 } 343
Indexes created Tue Sep 23 14:10:03 GMT 2025