Home | History | Annotate | Line # | Download | only in ypserv
ypserv.c revision 1.22 
      1 /*	$NetBSD: ypserv.c,v 1.22 2008/05/16 16:41:42 chuck Exp $	*/
      2 
      3 /*
      4  * Copyright (c) 1994 Mats O Jansson <moj (at) stacken.kth.se>
      5  * All rights reserved.
      6  *
      7  * Redistribution and use in source and binary forms, with or without
      8  * modification, are permitted provided that the following conditions
      9  * are met:
     10  * 1. Redistributions of source code must retain the above copyright
     11  *    notice, this list of conditions and the following disclaimer.
     12  * 2. Redistributions in binary form must reproduce the above copyright
     13  *    notice, this list of conditions and the following disclaimer in the
     14  *    documentation and/or other materials provided with the distribution.
     15  * 3. All advertising materials mentioning features or use of this software
     16  *    must display the following acknowledgement:
     17  *	This product includes software developed by Mats O Jansson
     18  * 4. The name of the author may not be used to endorse or promote products
     19  *    derived from this software without specific prior written permission.
     20  *
     21  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS
     22  * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
     23  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
     25  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     31  * SUCH DAMAGE.
     32  */
     33 
     34 #include <sys/cdefs.h>
     35 #ifndef lint
     36 __RCSID("$NetBSD: ypserv.c,v 1.22 2008/05/16 16:41:42 chuck Exp $");
     37 #endif
     38 
     39 #include <sys/types.h>
     40 #include <sys/socket.h>
     41 #include <sys/wait.h>
     42 
     43 #include <err.h>
     44 #include <netdb.h>
     45 #include <signal.h>
     46 #include <stdio.h>
     47 #include <stdlib.h>
     48 #include <string.h>
     49 #include <syslog.h>
     50 #include <unistd.h>
     51 #include <util.h>
     52 #include <stdarg.h>
     53 #include <errno.h>
     54 
     55 #include <rpc/rpc.h>
     56 #include <rpc/xdr.h>
     57 #include <rpc/pmap_clnt.h>
     58 
     59 #include <rpcsvc/yp_prot.h>
     60 
     61 #include "ypdef.h"
     62 #include "ypserv.h"
     63 
     64 #ifdef LIBWRAP
     65 #include <tcpd.h>
     66 
     67 int allow_severity = LOG_DAEMON | LOG_INFO;
     68 int deny_severity = LOG_DAEMON | LOG_WARNING;
     69 
     70 /* XXX For ypserv_proc.c -- NOT THREAD SAFE!  (like any of this code is) */
     71 const char *clientstr;
     72 const char *svcname;
     73 #endif /* LIBWRAP */
     74 
     75 int	usedns;
     76 #ifdef DEBUG
     77 static int	foreground = 1;
     78 #else
     79 static int	foreground;
     80 #endif
     81 
     82 #ifdef LIBWRAP
     83 int	lflag;
     84 #endif
     85 
     86 static struct bindsock {
     87 	sa_family_t family;
     88 	int type;
     89 	int proto;
     90 	const char *name;
     91 } socklist[] = {
     92 	{ AF_INET, SOCK_DGRAM, IPPROTO_UDP, "udp" },
     93 	{ AF_INET, SOCK_STREAM, IPPROTO_TCP, "tcp" },
     94 	{ AF_INET6, SOCK_DGRAM, IPPROTO_UDP, "udp6" },
     95 	{ AF_INET6, SOCK_STREAM, IPPROTO_TCP, "tcp6" },
     96 };
     97 
     98 static void	usage(void) __dead;
     99 static int	bind_resv_port(int, sa_family_t, in_port_t);
    100 void		ypserv_sock_hostname(struct host_info *host);
    101 
    102 static void
    103 _msgout(int level, const char *msg, ...)
    104 {
    105 	va_list ap;
    106 	va_start(ap, msg);
    107 	if (foreground)
    108                 vwarnx(msg, ap);
    109         else
    110 		vsyslog(level, msg, ap);
    111 	va_end(ap);
    112 }
    113 
    114 void ypserv_sock_hostname(struct host_info *host)
    115 {
    116 	host->name[0] = 0;
    117 }
    118 
    119 static void
    120 ypprog_2(struct svc_req *rqstp, SVCXPRT *transp)
    121 {
    122 	union {
    123 		char * ypproc_domain_2_arg;
    124 		char * ypproc_domain_nonack_2_arg;
    125 		struct ypreq_key ypproc_match_2_arg;
    126 		struct ypreq_nokey ypproc_first_2_arg;
    127 		struct ypreq_key ypproc_next_2_arg;
    128 		struct ypreq_xfr ypproc_xfr_2_arg;
    129 		struct ypreq_nokey ypproc_all_2_arg;
    130 		struct ypreq_nokey ypproc_master_2_arg;
    131 		struct ypreq_nokey ypproc_order_2_arg;
    132 		char * ypproc_maplist_2_arg;
    133 	} argument;
    134 	void *argp = &argument;
    135 	char *result;
    136 	xdrproc_t xdr_argument, xdr_result;
    137 	void *(*local)(void *, struct svc_req *);
    138 #ifdef LIBWRAP
    139 	struct request_info req;
    140 	struct sockaddr *caller;
    141 #define	SVCNAME(x)	svcname = x
    142 #else
    143 #define	SVCNAME(x)	/* nothing */
    144 #endif
    145 
    146 #ifdef LIBWRAP
    147 	caller = svc_getrpccaller(transp)->buf;
    148 	(void)request_init(&req, RQ_DAEMON, getprogname(), RQ_CLIENT_SIN,
    149 	    caller, NULL);
    150 	sock_methods(&req);
    151 
    152 	/*
    153 	 * Do not do hostname lookups!  This avoids possible delays due
    154 	 * to DNS, preventing a possible DoS attack, as well as possible
    155 	 * circular lookups (e.g. a hostname lookup requiring a request
    156 	 * to ourselves).
    157 	 */
    158 	req.hostname = ypserv_sock_hostname;
    159 #endif
    160 
    161 	switch (rqstp->rq_proc) {
    162 	case YPPROC_NULL:
    163 		xdr_argument = xdr_void;
    164 		xdr_result = xdr_void;
    165 		local = ypproc_null_2_svc;
    166 		SVCNAME("null_2");
    167 		break;
    168 
    169 	case YPPROC_DOMAIN:
    170 		xdr_argument = xdr_ypdomain_wrap_string;
    171 		xdr_result = xdr_bool;
    172 		local = ypproc_domain_2_svc;
    173 		SVCNAME("domain_2");
    174 		break;
    175 
    176 	case YPPROC_DOMAIN_NONACK:
    177 		xdr_argument = xdr_ypdomain_wrap_string;
    178 		xdr_result = xdr_bool;
    179 		local = ypproc_domain_nonack_2_svc;
    180 		SVCNAME("domain_nonack_2");
    181 		break;
    182 
    183 	case YPPROC_MATCH:
    184 		xdr_argument = xdr_ypreq_key;
    185 		xdr_result = xdr_ypresp_val;
    186 		local = ypproc_match_2_svc;
    187 		SVCNAME("match_2");
    188 		break;
    189 
    190 	case YPPROC_FIRST:
    191 		xdr_argument = xdr_ypreq_nokey;
    192 		xdr_result = xdr_ypresp_key_val;
    193 		local = ypproc_first_2_svc;
    194 		SVCNAME("first_2");
    195 		break;
    196 
    197 	case YPPROC_NEXT:
    198 		xdr_argument = xdr_ypreq_key;
    199 		xdr_result = xdr_ypresp_key_val;
    200 		local = ypproc_next_2_svc;
    201 		SVCNAME("next_2");
    202 		break;
    203 
    204 	case YPPROC_XFR:
    205 		xdr_argument = xdr_ypreq_xfr;
    206 		xdr_result = xdr_ypresp_xfr;
    207 		local = ypproc_xfr_2_svc;
    208 		SVCNAME("xfer_2");
    209 		break;
    210 
    211 	case YPPROC_CLEAR:
    212 		xdr_argument = xdr_void;
    213 		xdr_result = xdr_void;
    214 		local = ypproc_clear_2_svc;
    215 		SVCNAME("clear_2");
    216 		break;
    217 
    218 	case YPPROC_ALL:
    219 		xdr_argument = xdr_ypreq_nokey;
    220 		xdr_result = xdr_ypresp_all;
    221 		local = ypproc_all_2_svc;
    222 		SVCNAME("all_2");
    223 		break;
    224 
    225 	case YPPROC_MASTER:
    226 		xdr_argument = xdr_ypreq_nokey;
    227 		xdr_result = xdr_ypresp_master;
    228 		local = ypproc_master_2_svc;
    229 		SVCNAME("master_2");
    230 		break;
    231 
    232 	case YPPROC_ORDER:
    233 		xdr_argument = xdr_ypreq_nokey;
    234 		xdr_result = xdr_ypresp_order;
    235 		local = ypproc_order_2_svc;
    236 		SVCNAME("order_2");
    237 		break;
    238 
    239 	case YPPROC_MAPLIST:
    240 		xdr_argument = xdr_ypdomain_wrap_string;
    241 		xdr_result = xdr_ypresp_maplist;
    242 		local = ypproc_maplist_2_svc;
    243 		SVCNAME("maplist_2");
    244 		break;
    245 
    246 	default:
    247 		svcerr_noproc(transp);
    248 		return;
    249 	}
    250 
    251 #ifdef LIBWRAP
    252 	clientstr = eval_client(&req);
    253 
    254 	if (hosts_access(&req) == 0) {
    255 		syslog(deny_severity,
    256 		    "%s: refused request from %.500s", svcname, clientstr);
    257 		svcerr_auth(transp, AUTH_FAILED);
    258 		return;
    259 	}
    260 #endif
    261 
    262 	(void)memset(&argument, 0, sizeof (argument));
    263 	if (!svc_getargs(transp, xdr_argument, argp)) {
    264 		svcerr_decode(transp);
    265 		return;
    266 	}
    267 	result = (*local)(&argument, rqstp);
    268 	if (result != NULL && !svc_sendreply(transp, xdr_result, result)) {
    269 		svcerr_systemerr(transp);
    270 	}
    271 	if (!svc_freeargs(transp, xdr_argument, argp)) {
    272 		_msgout(LOG_ERR, "unable to free arguments");
    273 		exit(1);
    274 	}
    275 	return;
    276 }
    277 
    278 /*
    279  * limited NIS version 1 support: the null, domain, and domain_nonack
    280  * request/reply format is identical between v1 and v2.  SunOS4's ypbind
    281  * makes v1 domain_nonack calls.
    282  */
    283 static void
    284 ypprog_1(struct svc_req *rqstp, SVCXPRT *transp)
    285 {
    286 	switch (rqstp->rq_proc) {
    287 	case YPPROC_NULL:
    288 	case YPPROC_DOMAIN:
    289 	case YPPROC_DOMAIN_NONACK:
    290 		ypprog_2(rqstp, transp);
    291 		return;
    292 
    293 	default:
    294 		svcerr_noproc(transp);
    295 		return;
    296 	}
    297 }
    298 
    299 int
    300 main(int argc, char *argv[])
    301 {
    302 	SVCXPRT *xprt;
    303 	struct netconfig *cfg = NULL;
    304 	int s;
    305 	struct sigaction sa;
    306 	struct bindsock *bs;
    307 	in_port_t port = 0;
    308 	int ch, xcreated = 0, one = 1;
    309 
    310 	setprogname(argv[0]);
    311 
    312 #ifdef LIBWRAP
    313 #define	GETOPTSTR	"dflp:"
    314 #else
    315 #define	GETOPTSTR	"dfp:"
    316 #endif
    317 	while ((ch = getopt(argc, argv, GETOPTSTR)) != -1) {
    318 		switch (ch) {
    319 		case 'd':
    320 			usedns = 1;
    321 			break;
    322 		case 'f':
    323 			foreground = 1;
    324 			break;
    325 		case 'p':
    326 			port = atoi(optarg);
    327 			break;
    328 #ifdef LIBWRAP
    329 		case 'l':
    330 			lflag = 1;
    331 			break;
    332 #endif
    333 		default:
    334 			usage();
    335 		}
    336 	}
    337 
    338 #undef GETOPTSTR
    339 
    340 	/* This program must be run by root. */
    341 	if (geteuid() != 0)
    342 		errx(1, "must run as root");
    343 
    344 	if (foreground == 0 && daemon(0, 0))
    345 		err(1, "can't detach");
    346 
    347 	openlog("ypserv", LOG_PID, LOG_DAEMON);
    348 	syslog(LOG_INFO, "starting");
    349 	(void)pidfile(NULL);
    350 
    351 	(void) rpcb_unset((u_int)YPPROG, (u_int)YPVERS, NULL);
    352 	(void) rpcb_unset((u_int)YPPROG, (u_int)YPVERS_ORIG, NULL);
    353 
    354 
    355 	ypdb_init();	/* init db stuff */
    356 
    357 	sa.sa_handler = SIG_IGN;
    358 	sa.sa_flags = SA_NOCLDWAIT;
    359 	if (sigemptyset(&sa.sa_mask)) {
    360 		_msgout(LOG_ERR, "sigemptyset: %s", strerror(errno));
    361 		exit(1);
    362 	}
    363 	if (sigaction(SIGCHLD, &sa, NULL)) {
    364 		_msgout(LOG_ERR, "sigaction: %s", strerror(errno));
    365 		exit(1);
    366 	}
    367 
    368 	for (bs = socklist;
    369 	    bs < &socklist[sizeof(socklist) / sizeof(socklist[0])]; bs++) {
    370 
    371 		if ((s = socket(bs->family, bs->type, bs->proto)) == -1)
    372 			continue;
    373 
    374 		if (bs->family == AF_INET6) {
    375 			/*
    376 			 * We're doing host-based access checks here, so don't
    377 			 * allow v4-in-v6 to confuse things.
    378 			 */
    379 			if (setsockopt(s, IPPROTO_IPV6,
    380 			    IPV6_V6ONLY, &one, sizeof(one)) == -1) {
    381 				_msgout(LOG_ERR,
    382 				    "can't disable v4-in-v6 on %s socket",
    383 				    bs->name);
    384 				exit(1);
    385 			}
    386 		}
    387 
    388 		if ((cfg = getnetconfigent(bs->name)) == NULL) {
    389 			_msgout(LOG_ERR,
    390 			    "unable to get network configuration for %s port",
    391 			    bs->name);
    392 			goto out;
    393 		}
    394 
    395 		if (bind_resv_port(s, bs->family, port) != 0)
    396 			goto out;
    397 
    398 		if (bs->type == SOCK_STREAM) {
    399 			(void)listen(s, SOMAXCONN);
    400 			xprt = svc_vc_create(s, 0, 0);
    401 		} else {
    402 			xprt = svc_dg_create(s, 0, 0);
    403 		}
    404 
    405 		if (xprt == NULL) {
    406 			_msgout(LOG_WARNING, "unable to create %s service",
    407 			    bs->name);
    408 			goto out;
    409 		}
    410 		if (svc_reg(xprt, (u_int)YPPROG, (u_int)YPVERS_ORIG, ypprog_1,
    411 		    cfg) == 0 ||
    412 		    svc_reg(xprt, (u_int)YPPROG, (u_int)YPVERS, ypprog_2,
    413 		    cfg) == 0) {
    414 			_msgout(LOG_WARNING, "unable to register %s service",
    415 			    bs->name);
    416 			goto out;
    417 		}
    418 		xcreated++;
    419 		freenetconfigent(cfg);
    420 		continue;
    421 out:
    422 		if (s != -1)
    423 			(void)close(s);
    424 		if (cfg) {
    425 			freenetconfigent(cfg);
    426 			cfg = NULL;
    427 		}
    428 	}
    429 
    430 	if (xcreated == 0) {
    431 		_msgout(LOG_ERR, "unable to create any services");
    432 		exit(1);
    433 	}
    434 
    435 	svc_run();
    436 	_msgout(LOG_ERR, "svc_run returned");
    437 	exit(1);
    438 	/* NOTREACHED */
    439 }
    440 
    441 static void
    442 usage(void)
    443 {
    444 
    445 #ifdef LIBWRAP
    446 #define	USAGESTR	"Usage: %s [-d] [-l] [-p <port>]\n"
    447 #else
    448 #define	USAGESTR	"Usage: %s [-d] [-p <port>]\n"
    449 #endif
    450 
    451 	(void)fprintf(stderr, USAGESTR, getprogname());
    452 	exit(1);
    453 
    454 #undef USAGESTR
    455 }
    456 
    457 /*
    458  * _yp_invalid_map: check if given map name isn't legal.
    459  * returns non-zero if invalid
    460  *
    461  * XXX: this probably should be in libc/yp/yplib.c
    462  */
    463 int
    464 _yp_invalid_map(const char *map)
    465 {
    466 	if (map == NULL || *map == '\0')
    467 		return 1;
    468 
    469 	if (strlen(map) > YPMAXMAP)
    470 		return 1;
    471 
    472 	if (strchr(map, '/') != NULL)
    473 		return 1;
    474 
    475 	return 0;
    476 }
    477 
    478 static int
    479 bind_resv_port(int sock, sa_family_t family, in_port_t port)
    480 {
    481 	struct sockaddr *sa;
    482 	struct sockaddr_in sasin;
    483 	struct sockaddr_in6 sasin6;
    484 
    485 	switch (family) {
    486 	case AF_INET:
    487 		(void)memset(&sasin, 0, sizeof(sasin));
    488 		sasin.sin_len = sizeof(sasin);
    489 		sasin.sin_family = family;
    490 		sasin.sin_port = htons(port);
    491 		sa = (struct sockaddr *)(void *)&sasin;
    492 		break;
    493 	case AF_INET6:
    494 		(void)memset(&sasin6, 0, sizeof(sasin6));
    495 		sasin6.sin6_len = sizeof(sasin6);
    496 		sasin6.sin6_family = family;
    497 		sasin6.sin6_port = htons(port);
    498 		sa = (struct sockaddr *)(void *)&sasin6;
    499 		break;
    500 	default:
    501 		_msgout(LOG_ERR, "Unsupported address family %d", family);
    502 		return -1;
    503 	}
    504 	if (bindresvport_sa(sock, sa) == -1) {
    505 		_msgout(LOG_ERR, "Cannot bind to reserved port %d (%s)", port,
    506 		    strerror(errno));
    507 		return -1;
    508 	}
    509 	return 0;
    510 }
    511