1 /* $NetBSD: rpcb_svc_com.c,v 1.9 2002/11/08 00:16:39 fvdl Exp $ */
2
3 /*-
4 * SPDX-License-Identifier: BSD-3-Clause
5 *
6 * Copyright (c) 2009, Sun Microsystems, Inc.
7 * All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions are met:
11 * - Redistributions of source code must retain the above copyright notice,
12 * this list of conditions and the following disclaimer.
13 * - Redistributions in binary form must reproduce the above copyright notice,
14 * this list of conditions and the following disclaimer in the documentation
15 * and/or other materials provided with the distribution.
16 * - Neither the name of Sun Microsystems, Inc. nor the names of its
17 * contributors may be used to endorse or promote products derived
18 * from this software without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
21 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
24 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
25 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
26 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
27 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
28 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
29 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
30 * POSSIBILITY OF SUCH DAMAGE.
31 */
32 /*
33 * Copyright (c) 1986 - 1991 by Sun Microsystems, Inc.
34 */
35
36 /* #ident "@(#)rpcb_svc_com.c 1.18 94/05/02 SMI" */
37
38 /*
39 * rpcb_svc_com.c
40 * The commom server procedure for the rpcbind.
41 */
42
43 #include <sys/types.h>
44 #include <sys/stat.h>
45 #include <sys/param.h>
46 #include <sys/poll.h>
47 #include <sys/socket.h>
48 #include <rpc/rpc.h>
49 #include <rpc/rpcb_prot.h>
50 #include <rpc/svc_dg.h>
51 #include <assert.h>
52 #include <netconfig.h>
53 #include <errno.h>
54 #include <syslog.h>
55 #include <stdio.h>
56 #include <string.h>
57 #include <stdlib.h>
58 #include <unistd.h>
59 #ifdef PORTMAP
60 #include <netinet/in.h>
61 #include <rpc/rpc_com.h>
62 #include <rpc/pmap_prot.h>
63 #endif /* PORTMAP */
64
65 #include "rpcbind.h"
66
67 #define RPC_BUF_MAX 65536 /* can be raised if required */
68
69 static char *nullstring = "";
70 static int rpcb_rmtcalls;
71
72 struct rmtcallfd_list {
73 int fd;
74 SVCXPRT *xprt;
75 char *netid;
76 struct rmtcallfd_list *next;
77 };
78
79 #define NFORWARD 64
80 #define MAXTIME_OFF 300 /* 5 minutes */
81
82 struct finfo {
83 int flag;
84 #define FINFO_ACTIVE 0x1
85 u_int32_t caller_xid;
86 struct netbuf *caller_addr;
87 u_int32_t forward_xid;
88 int forward_fd;
89 char *uaddr;
90 rpcproc_t reply_type;
91 rpcvers_t versnum;
92 time_t time;
93 };
94 static struct finfo FINFO[NFORWARD];
95
96
97 static bool_t xdr_encap_parms(XDR *, struct encap_parms *);
98 static bool_t xdr_rmtcall_args(XDR *, struct r_rmtcall_args *);
99 static bool_t xdr_rmtcall_result(XDR *, struct r_rmtcall_args *);
100 static bool_t xdr_opaque_parms(XDR *, struct r_rmtcall_args *);
101 static int find_rmtcallfd_by_netid(char *);
102 static SVCXPRT *find_rmtcallxprt_by_fd(int);
103 static int forward_register(u_int32_t, struct netbuf *, int, char *,
104 rpcproc_t, rpcvers_t, u_int32_t *);
105 static struct finfo *forward_find(u_int32_t);
106 static int free_slot_by_xid(u_int32_t);
107 static int free_slot_by_index(int);
108 static int netbufcmp(struct netbuf *, struct netbuf *);
109 static struct netbuf *netbufdup(struct netbuf *);
110 static void netbuffree(struct netbuf *);
111 static int check_rmtcalls(struct pollfd *, int);
112 static void xprt_set_caller(SVCXPRT *, struct finfo *);
113 static void send_svcsyserr(SVCXPRT *, struct finfo *);
114 static void handle_reply(int, SVCXPRT *);
115 static void find_versions(rpcprog_t, char *, rpcvers_t *, rpcvers_t *);
116 static rpcblist_ptr find_service(rpcprog_t, rpcvers_t, char *);
117 static char *getowner(SVCXPRT *, char *, size_t);
118 static int add_pmaplist(RPCB *);
119 static int del_pmaplist(RPCB *);
120
121 /*
122 * Set a mapping of program, version, netid
123 */
124 /* ARGSUSED */
125 void *
rpcbproc_set_com(void * arg,struct svc_req * rqstp __unused,SVCXPRT * transp,rpcvers_t rpcbversnum)126 rpcbproc_set_com(void *arg, struct svc_req *rqstp __unused, SVCXPRT *transp,
127 rpcvers_t rpcbversnum)
128 {
129 RPCB *regp = (RPCB *)arg;
130 static bool_t ans;
131 char owner[64];
132
133 #ifdef RPCBIND_DEBUG
134 if (debugging)
135 fprintf(stderr, "RPCB_SET request for (%lu, %lu, %s, %s) : ",
136 (unsigned long)regp->r_prog, (unsigned long)regp->r_vers,
137 regp->r_netid, regp->r_addr);
138 #endif
139 ans = map_set(regp, getowner(transp, owner, sizeof owner));
140 #ifdef RPCBIND_DEBUG
141 if (debugging)
142 fprintf(stderr, "%s\n", ans == TRUE ? "succeeded" : "failed");
143 #endif
144 /* XXX: should have used some defined constant here */
145 rpcbs_set(rpcbversnum - 2, ans);
146 return (void *)&ans;
147 }
148
149 bool_t
map_set(RPCB * regp,char * owner)150 map_set(RPCB *regp, char *owner)
151 {
152 RPCB reg, *a;
153 rpcblist_ptr rbl, fnd;
154
155 reg = *regp;
156 /*
157 * check to see if already used
158 * find_service returns a hit even if
159 * the versions don't match, so check for it
160 */
161 fnd = find_service(reg.r_prog, reg.r_vers, reg.r_netid);
162 if (fnd && (fnd->rpcb_map.r_vers == reg.r_vers)) {
163 if (!strcmp(fnd->rpcb_map.r_addr, reg.r_addr))
164 /*
165 * if these match then it is already
166 * registered so just say "OK".
167 */
168 return (TRUE);
169 else
170 return (FALSE);
171 }
172 /*
173 * add to the end of the list
174 */
175 rbl = malloc(sizeof (RPCBLIST));
176 if (rbl == NULL)
177 return (FALSE);
178 a = &(rbl->rpcb_map);
179 a->r_prog = reg.r_prog;
180 a->r_vers = reg.r_vers;
181 a->r_netid = strdup(reg.r_netid);
182 a->r_addr = strdup(reg.r_addr);
183 a->r_owner = strdup(owner);
184 if (!a->r_addr || !a->r_netid || !a->r_owner) {
185 free(a->r_netid);
186 free(a->r_addr);
187 free(a->r_owner);
188 free(rbl);
189 return (FALSE);
190 }
191 rbl->rpcb_next = (rpcblist_ptr)NULL;
192 if (list_rbl == NULL) {
193 list_rbl = rbl;
194 } else {
195 for (fnd = list_rbl; fnd->rpcb_next;
196 fnd = fnd->rpcb_next)
197 ;
198 fnd->rpcb_next = rbl;
199 }
200 #ifdef PORTMAP
201 (void) add_pmaplist(regp);
202 #endif
203 return (TRUE);
204 }
205
206 /*
207 * Unset a mapping of program, version, netid
208 */
209 /* ARGSUSED */
210 void *
rpcbproc_unset_com(void * arg,struct svc_req * rqstp __unused,SVCXPRT * transp,rpcvers_t rpcbversnum)211 rpcbproc_unset_com(void *arg, struct svc_req *rqstp __unused, SVCXPRT *transp,
212 rpcvers_t rpcbversnum)
213 {
214 RPCB *regp = (RPCB *)arg;
215 static bool_t ans;
216 char owner[64];
217
218 #ifdef RPCBIND_DEBUG
219 if (debugging)
220 fprintf(stderr, "RPCB_UNSET request for (%lu, %lu, %s) : ",
221 (unsigned long)regp->r_prog, (unsigned long)regp->r_vers,
222 regp->r_netid);
223 #endif
224 ans = map_unset(regp, getowner(transp, owner, sizeof owner));
225 #ifdef RPCBIND_DEBUG
226 if (debugging)
227 fprintf(stderr, "%s\n", ans == TRUE ? "succeeded" : "failed");
228 #endif
229 /* XXX: should have used some defined constant here */
230 rpcbs_unset(rpcbversnum - 2, ans);
231 return (void *)&ans;
232 }
233
234 bool_t
map_unset(RPCB * regp,char * owner)235 map_unset(RPCB *regp, char *owner)
236 {
237 int ans = 0;
238 rpcblist_ptr rbl, prev, tmp;
239
240 if (owner == NULL)
241 return (0);
242
243 for (prev = NULL, rbl = list_rbl; rbl; /* cstyle */) {
244 if ((rbl->rpcb_map.r_prog != regp->r_prog) ||
245 (rbl->rpcb_map.r_vers != regp->r_vers) ||
246 (regp->r_netid[0] && strcasecmp(regp->r_netid,
247 rbl->rpcb_map.r_netid))) {
248 /* both rbl & prev move forwards */
249 prev = rbl;
250 rbl = rbl->rpcb_next;
251 continue;
252 }
253 /*
254 * Check whether appropriate uid. Unset only
255 * if superuser or the owner itself.
256 */
257 if (strcmp(owner, "superuser") &&
258 strcmp(rbl->rpcb_map.r_owner, owner))
259 return (0);
260 /* found it; rbl moves forward, prev stays */
261 ans = 1;
262 tmp = rbl;
263 rbl = rbl->rpcb_next;
264 if (prev == NULL)
265 list_rbl = rbl;
266 else
267 prev->rpcb_next = rbl;
268 free(tmp->rpcb_map.r_addr);
269 free(tmp->rpcb_map.r_netid);
270 free(tmp->rpcb_map.r_owner);
271 free(tmp);
272 }
273 #ifdef PORTMAP
274 if (ans)
275 (void) del_pmaplist(regp);
276 #endif
277 /*
278 * We return 1 either when the entry was not there or it
279 * was able to unset it. It can come to this point only if
280 * atleast one of the conditions is true.
281 */
282 return (1);
283 }
284
285 void
delete_prog(unsigned int prog)286 delete_prog(unsigned int prog)
287 {
288 RPCB reg;
289 register rpcblist_ptr rbl;
290
291 for (rbl = list_rbl; rbl != NULL; rbl = rbl->rpcb_next) {
292 if ((rbl->rpcb_map.r_prog != prog))
293 continue;
294 if (is_bound(rbl->rpcb_map.r_netid, rbl->rpcb_map.r_addr))
295 continue;
296 reg.r_prog = rbl->rpcb_map.r_prog;
297 reg.r_vers = rbl->rpcb_map.r_vers;
298 reg.r_netid = strdup(rbl->rpcb_map.r_netid);
299 (void) map_unset(®, "superuser");
300 free(reg.r_netid);
301 }
302 }
303
304 void *
rpcbproc_getaddr_com(RPCB * regp,struct svc_req * rqstp __unused,SVCXPRT * transp,rpcvers_t rpcbversnum,rpcvers_t verstype)305 rpcbproc_getaddr_com(RPCB *regp, struct svc_req *rqstp __unused,
306 SVCXPRT *transp, rpcvers_t rpcbversnum, rpcvers_t verstype)
307 {
308 static char *uaddr;
309 char *saddr = NULL;
310 rpcblist_ptr fnd;
311
312 if (uaddr != NULL && uaddr != nullstring) {
313 free(uaddr);
314 uaddr = NULL;
315 }
316 fnd = find_service(regp->r_prog, regp->r_vers, transp->xp_netid);
317 if (fnd && ((verstype == RPCB_ALLVERS) ||
318 (regp->r_vers == fnd->rpcb_map.r_vers))) {
319 if (*(regp->r_addr) != '\0') { /* may contain a hint about */
320 saddr = regp->r_addr; /* the interface that we */
321 } /* should use */
322 if (!(uaddr = mergeaddr(transp, transp->xp_netid,
323 fnd->rpcb_map.r_addr, saddr))) {
324 /* Try whatever we have */
325 uaddr = strdup(fnd->rpcb_map.r_addr);
326 } else if (!uaddr[0]) {
327 /*
328 * The server died. Unset all versions of this prog.
329 */
330 delete_prog(regp->r_prog);
331 uaddr = nullstring;
332 }
333 } else {
334 uaddr = nullstring;
335 }
336 #ifdef RPCBIND_DEBUG
337 if (debugging)
338 fprintf(stderr, "getaddr: %s\n", uaddr);
339 #endif
340 /* XXX: should have used some defined constant here */
341 rpcbs_getaddr(rpcbversnum - 2, regp->r_prog, regp->r_vers,
342 transp->xp_netid, uaddr);
343 return (void *)&uaddr;
344 }
345
346 /* ARGSUSED */
347 void *
rpcbproc_gettime_com(void * arg __unused,struct svc_req * rqstp __unused,SVCXPRT * transp __unused,rpcvers_t rpcbversnum __unused)348 rpcbproc_gettime_com(void *arg __unused, struct svc_req *rqstp __unused,
349 SVCXPRT *transp __unused, rpcvers_t rpcbversnum __unused)
350 {
351 static time_t curtime;
352
353 (void) time(&curtime);
354 return (void *)&curtime;
355 }
356
357 /*
358 * Convert uaddr to taddr. Should be used only by
359 * local servers/clients. (kernel level stuff only)
360 */
361 /* ARGSUSED */
362 void *
rpcbproc_uaddr2taddr_com(void * arg,struct svc_req * rqstp __unused,SVCXPRT * transp,rpcvers_t rpcbversnum __unused)363 rpcbproc_uaddr2taddr_com(void *arg, struct svc_req *rqstp __unused,
364 SVCXPRT *transp, rpcvers_t rpcbversnum __unused)
365 {
366 char **uaddrp = (char **)arg;
367 struct netconfig *nconf;
368 static struct netbuf nbuf;
369 static struct netbuf *taddr;
370
371 netbuffree(taddr);
372 taddr = NULL;
373 if (((nconf = rpcbind_get_conf(transp->xp_netid)) == NULL) ||
374 ((taddr = uaddr2taddr(nconf, *uaddrp)) == NULL)) {
375 (void) memset((char *)&nbuf, 0, sizeof (struct netbuf));
376 return (void *)&nbuf;
377 }
378 return (void *)taddr;
379 }
380
381 /*
382 * Convert taddr to uaddr. Should be used only by
383 * local servers/clients. (kernel level stuff only)
384 */
385 /* ARGSUSED */
386 void *
rpcbproc_taddr2uaddr_com(void * arg,struct svc_req * rqstp __unused,SVCXPRT * transp,rpcvers_t rpcbversnum __unused)387 rpcbproc_taddr2uaddr_com(void *arg, struct svc_req *rqstp __unused,
388 SVCXPRT *transp, rpcvers_t rpcbversnum __unused)
389 {
390 struct netbuf *taddr = (struct netbuf *)arg;
391 static char *uaddr;
392 struct netconfig *nconf;
393
394 #ifdef CHEW_FDS
395 int fd;
396
397 if ((fd = open("/dev/null", O_RDONLY)) == -1) {
398 uaddr = (char *)strerror(errno);
399 return (&uaddr);
400 }
401 #endif /* CHEW_FDS */
402 if (uaddr != NULL && uaddr != nullstring) {
403 free(uaddr);
404 uaddr = NULL;
405 }
406 if (((nconf = rpcbind_get_conf(transp->xp_netid)) == NULL) ||
407 ((uaddr = taddr2uaddr(nconf, taddr)) == NULL)) {
408 uaddr = nullstring;
409 }
410 return (void *)&uaddr;
411 }
412
413
414 static bool_t
xdr_encap_parms(XDR * xdrs,struct encap_parms * epp)415 xdr_encap_parms(XDR *xdrs, struct encap_parms *epp)
416 {
417 return (xdr_bytes(xdrs, &(epp->args), (u_int *) &(epp->arglen),
418 RPC_MAXDATASIZE));
419 }
420
421 /*
422 * XDR remote call arguments. It ignores the address part.
423 * written for XDR_DECODE direction only
424 */
425 static bool_t
xdr_rmtcall_args(XDR * xdrs,struct r_rmtcall_args * cap)426 xdr_rmtcall_args(XDR *xdrs, struct r_rmtcall_args *cap)
427 {
428 /* does not get the address or the arguments */
429 if (xdr_rpcprog(xdrs, &(cap->rmt_prog)) &&
430 xdr_rpcvers(xdrs, &(cap->rmt_vers)) &&
431 xdr_rpcproc(xdrs, &(cap->rmt_proc))) {
432 return (xdr_encap_parms(xdrs, &(cap->rmt_args)));
433 }
434 return (FALSE);
435 }
436
437 /*
438 * XDR remote call results along with the address. Ignore
439 * program number, version number and proc number.
440 * Written for XDR_ENCODE direction only.
441 */
442 static bool_t
xdr_rmtcall_result(XDR * xdrs,struct r_rmtcall_args * cap)443 xdr_rmtcall_result(XDR *xdrs, struct r_rmtcall_args *cap)
444 {
445 bool_t result;
446
447 #ifdef PORTMAP
448 if (cap->rmt_localvers == PMAPVERS) {
449 int h1, h2, h3, h4, p1, p2;
450 u_long port;
451
452 /* interpret the universal address for TCP/IP */
453 if (sscanf(cap->rmt_uaddr, "%d.%d.%d.%d.%d.%d",
454 &h1, &h2, &h3, &h4, &p1, &p2) != 6)
455 return (FALSE);
456 port = ((p1 & 0xff) << 8) + (p2 & 0xff);
457 result = xdr_u_long(xdrs, &port);
458 } else
459 #endif
460 if ((cap->rmt_localvers == RPCBVERS) ||
461 (cap->rmt_localvers == RPCBVERS4)) {
462 result = xdr_wrapstring(xdrs, &(cap->rmt_uaddr));
463 } else {
464 return (FALSE);
465 }
466 if (result == TRUE)
467 return (xdr_encap_parms(xdrs, &(cap->rmt_args)));
468 return (FALSE);
469 }
470
471 /*
472 * only worries about the struct encap_parms part of struct r_rmtcall_args.
473 * The arglen must already be set!!
474 */
475 static bool_t
xdr_opaque_parms(XDR * xdrs,struct r_rmtcall_args * cap)476 xdr_opaque_parms(XDR *xdrs, struct r_rmtcall_args *cap)
477 {
478 return (xdr_opaque(xdrs, cap->rmt_args.args, cap->rmt_args.arglen));
479 }
480
481 static struct rmtcallfd_list *rmthead;
482 static struct rmtcallfd_list *rmttail;
483
484 int
create_rmtcall_fd(struct netconfig * nconf)485 create_rmtcall_fd(struct netconfig *nconf)
486 {
487 int fd;
488 struct rmtcallfd_list *rmt;
489 SVCXPRT *xprt;
490
491 if ((fd = __rpc_nconf2fd(nconf)) == -1) {
492 if (debugging)
493 fprintf(stderr,
494 "create_rmtcall_fd: couldn't open \"%s\" (errno %d)\n",
495 nconf->nc_device, errno);
496 return (-1);
497 }
498 xprt = svc_tli_create(fd, 0, (struct t_bind *) 0, 0, 0);
499 if (xprt == NULL) {
500 if (debugging)
501 fprintf(stderr,
502 "create_rmtcall_fd: svc_tli_create failed\n");
503 return (-1);
504 }
505 rmt = malloc(sizeof (struct rmtcallfd_list));
506 if (rmt == NULL) {
507 syslog(LOG_ERR, "create_rmtcall_fd: no memory!");
508 return (-1);
509 }
510 rmt->xprt = xprt;
511 rmt->netid = strdup(nconf->nc_netid);
512 xprt->xp_netid = rmt->netid;
513 rmt->fd = fd;
514 rmt->next = NULL;
515 if (rmthead == NULL) {
516 rmthead = rmt;
517 rmttail = rmt;
518 } else {
519 rmttail->next = rmt;
520 rmttail = rmt;
521 }
522 /* XXX not threadsafe */
523 if (fd > svc_maxfd)
524 svc_maxfd = fd;
525 FD_SET(fd, &svc_fdset);
526 return (fd);
527 }
528
529 static int
find_rmtcallfd_by_netid(char * netid)530 find_rmtcallfd_by_netid(char *netid)
531 {
532 struct rmtcallfd_list *rmt;
533
534 for (rmt = rmthead; rmt != NULL; rmt = rmt->next) {
535 if (strcmp(netid, rmt->netid) == 0) {
536 return (rmt->fd);
537 }
538 }
539 return (-1);
540 }
541
542 static SVCXPRT *
find_rmtcallxprt_by_fd(int fd)543 find_rmtcallxprt_by_fd(int fd)
544 {
545 struct rmtcallfd_list *rmt;
546
547 for (rmt = rmthead; rmt != NULL; rmt = rmt->next) {
548 if (fd == rmt->fd) {
549 return (rmt->xprt);
550 }
551 }
552 return (NULL);
553 }
554
555
556 /*
557 * Call a remote procedure service. This procedure is very quiet when things
558 * go wrong. The proc is written to support broadcast rpc. In the broadcast
559 * case, a machine should shut-up instead of complain, lest the requestor be
560 * overrun with complaints at the expense of not hearing a valid reply.
561 * When receiving a request and verifying that the service exists, we
562 *
563 * receive the request
564 *
565 * open a new TLI endpoint on the same transport on which we received
566 * the original request
567 *
568 * remember the original request's XID (which requires knowing the format
569 * of the svc_dg_data structure)
570 *
571 * forward the request, with a new XID, to the requested service,
572 * remembering the XID used to send this request (for later use in
573 * reassociating the answer with the original request), the requestor's
574 * address, the file descriptor on which the forwarded request is
575 * made and the service's address.
576 *
577 * mark the file descriptor on which we anticipate receiving a reply from
578 * the service and one to select for in our private svc_run procedure
579 *
580 * At some time in the future, a reply will be received from the service to
581 * which we forwarded the request. At that time, we detect that the socket
582 * used was for forwarding (by looking through the finfo structures to see
583 * whether the fd corresponds to one of those) and call handle_reply() to
584 *
585 * receive the reply
586 *
587 * bundle the reply, along with the service's universal address
588 *
589 * create a SVCXPRT structure and use a version of svc_sendreply
590 * that allows us to specify the reply XID and destination, send the reply
591 * to the original requestor.
592 */
593
594 void
rpcbproc_callit_com(struct svc_req * rqstp,SVCXPRT * transp,rpcproc_t reply_type,rpcvers_t versnum)595 rpcbproc_callit_com(struct svc_req *rqstp, SVCXPRT *transp,
596 rpcproc_t reply_type, rpcvers_t versnum)
597 {
598 register rpcblist_ptr rbl;
599 struct netconfig *nconf;
600 struct netbuf *caller;
601 struct r_rmtcall_args a;
602 char *buf_alloc = NULL, *outbufp;
603 char *outbuf_alloc = NULL;
604 char buf[RPC_BUF_MAX], outbuf[RPC_BUF_MAX];
605 struct netbuf *na = (struct netbuf *) NULL;
606 struct rpc_msg call_msg;
607 int outlen;
608 u_int sendsz;
609 XDR outxdr;
610 AUTH *auth;
611 int fd = -1;
612 char *uaddr, *m_uaddr = NULL, *local_uaddr = NULL;
613 u_int32_t *xidp;
614 struct __rpc_sockinfo si;
615 struct sockaddr *localsa;
616 struct netbuf tbuf;
617
618 if (!__rpc_fd2sockinfo(transp->xp_fd, &si)) {
619 if (reply_type == RPCBPROC_INDIRECT)
620 svcerr_systemerr(transp);
621 return;
622 }
623 if (si.si_socktype != SOCK_DGRAM)
624 return; /* Only datagram type accepted */
625 sendsz = __rpc_get_t_size(si.si_af, si.si_proto, UDPMSGSIZE);
626 if (sendsz == 0) { /* data transfer not supported */
627 if (reply_type == RPCBPROC_INDIRECT)
628 svcerr_systemerr(transp);
629 return;
630 }
631 /*
632 * Should be multiple of 4 for XDR.
633 */
634 sendsz = roundup(sendsz, 4);
635 if (sendsz > RPC_BUF_MAX) {
636 #ifdef notyet
637 buf_alloc = alloca(sendsz); /* not in IDR2? */
638 #else
639 buf_alloc = malloc(sendsz);
640 #endif /* notyet */
641 if (buf_alloc == NULL) {
642 if (debugging)
643 fprintf(stderr,
644 "rpcbproc_callit_com: No Memory!\n");
645 if (reply_type == RPCBPROC_INDIRECT)
646 svcerr_systemerr(transp);
647 return;
648 }
649 a.rmt_args.args = buf_alloc;
650 } else {
651 a.rmt_args.args = buf;
652 }
653
654 call_msg.rm_xid = 0; /* For error checking purposes */
655 if (!svc_getargs(transp, (xdrproc_t) xdr_rmtcall_args, (char *) &a)) {
656 if (reply_type == RPCBPROC_INDIRECT)
657 svcerr_decode(transp);
658 if (debugging)
659 fprintf(stderr,
660 "rpcbproc_callit_com: svc_getargs failed\n");
661 goto error;
662 }
663
664 if (!check_callit(transp, &a, versnum)) {
665 svcerr_weakauth(transp);
666 goto error;
667 }
668
669 caller = svc_getrpccaller(transp);
670 #ifdef RPCBIND_DEBUG
671 if (debugging) {
672 uaddr = taddr2uaddr(rpcbind_get_conf(transp->xp_netid), caller);
673 fprintf(stderr, "%s %s req for (%lu, %lu, %lu, %s) from %s : ",
674 versnum == PMAPVERS ? "pmap_rmtcall" :
675 versnum == RPCBVERS ? "rpcb_rmtcall" :
676 versnum == RPCBVERS4 ? "rpcb_indirect" : "unknown",
677 reply_type == RPCBPROC_INDIRECT ? "indirect" : "callit",
678 (unsigned long)a.rmt_prog, (unsigned long)a.rmt_vers,
679 (unsigned long)a.rmt_proc, transp->xp_netid,
680 uaddr ? uaddr : "unknown");
681 free(uaddr);
682 }
683 #endif
684
685 rbl = find_service(a.rmt_prog, a.rmt_vers, transp->xp_netid);
686
687 rpcbs_rmtcall(versnum - 2, reply_type, a.rmt_prog, a.rmt_vers,
688 a.rmt_proc, transp->xp_netid, rbl);
689
690 if (rbl == (rpcblist_ptr)NULL) {
691 #ifdef RPCBIND_DEBUG
692 if (debugging)
693 fprintf(stderr, "not found\n");
694 #endif
695 if (reply_type == RPCBPROC_INDIRECT)
696 svcerr_noprog(transp);
697 goto error;
698 }
699 if (rbl->rpcb_map.r_vers != a.rmt_vers) {
700 if (reply_type == RPCBPROC_INDIRECT) {
701 rpcvers_t vers_low, vers_high;
702
703 find_versions(a.rmt_prog, transp->xp_netid,
704 &vers_low, &vers_high);
705 svcerr_progvers(transp, vers_low, vers_high);
706 }
707 goto error;
708 }
709
710 #ifdef RPCBIND_DEBUG
711 if (debugging)
712 fprintf(stderr, "found at uaddr %s\n", rbl->rpcb_map.r_addr);
713 #endif
714 /*
715 * Check whether this entry is valid and a server is present
716 * Mergeaddr() returns NULL if no such entry is present, and
717 * returns "" if the entry was present but the server is not
718 * present (i.e., it crashed).
719 */
720 if (reply_type == RPCBPROC_INDIRECT) {
721 uaddr = mergeaddr(transp, transp->xp_netid,
722 rbl->rpcb_map.r_addr, NULL);
723 if (uaddr == NULL || uaddr[0] == '\0') {
724 svcerr_noprog(transp);
725 free(uaddr);
726 goto error;
727 }
728 free(uaddr);
729 }
730 nconf = rpcbind_get_conf(transp->xp_netid);
731 if (nconf == (struct netconfig *)NULL) {
732 if (reply_type == RPCBPROC_INDIRECT)
733 svcerr_systemerr(transp);
734 if (debugging)
735 fprintf(stderr,
736 "rpcbproc_callit_com: rpcbind_get_conf failed\n");
737 goto error;
738 }
739 localsa = local_sa(((struct sockaddr *)caller->buf)->sa_family);
740 if (localsa == NULL) {
741 if (debugging)
742 fprintf(stderr,
743 "rpcbproc_callit_com: no local address\n");
744 goto error;
745 }
746 tbuf.len = tbuf.maxlen = localsa->sa_len;
747 tbuf.buf = localsa;
748 local_uaddr =
749 addrmerge(&tbuf, rbl->rpcb_map.r_addr, NULL, nconf->nc_netid);
750 m_uaddr = addrmerge(caller, rbl->rpcb_map.r_addr, NULL,
751 nconf->nc_netid);
752 #ifdef RPCBIND_DEBUG
753 if (debugging)
754 fprintf(stderr, "merged uaddr %s\n", m_uaddr);
755 #endif
756 if ((fd = find_rmtcallfd_by_netid(nconf->nc_netid)) == -1) {
757 if (reply_type == RPCBPROC_INDIRECT)
758 svcerr_systemerr(transp);
759 goto error;
760 }
761 xidp = __rpcb_get_dg_xidp(transp);
762 switch (forward_register(*xidp, caller, fd, m_uaddr, reply_type,
763 versnum, &call_msg.rm_xid)) {
764 case 1:
765 /* Success; forward_register() will free m_uaddr for us. */
766 m_uaddr = NULL;
767 break;
768 case 0:
769 /*
770 * A duplicate request for the slow server. Let's not
771 * beat on it any more.
772 */
773 if (debugging)
774 fprintf(stderr,
775 "rpcbproc_callit_com: duplicate request\n");
776 goto error;
777 case -1:
778 /* forward_register failed. Perhaps no memory. */
779 if (debugging)
780 fprintf(stderr,
781 "rpcbproc_callit_com: forward_register failed\n");
782 goto error;
783 }
784
785 #ifdef DEBUG_RMTCALL
786 if (debugging)
787 fprintf(stderr,
788 "rpcbproc_callit_com: original XID %x, new XID %x\n",
789 *xidp, call_msg.rm_xid);
790 #endif
791 call_msg.rm_direction = CALL;
792 call_msg.rm_call.cb_rpcvers = RPC_MSG_VERSION;
793 call_msg.rm_call.cb_prog = a.rmt_prog;
794 call_msg.rm_call.cb_vers = a.rmt_vers;
795 if (sendsz > RPC_BUF_MAX) {
796 #ifdef notyet
797 outbuf_alloc = alloca(sendsz); /* not in IDR2? */
798 #else
799 outbuf_alloc = malloc(sendsz);
800 #endif /* notyet */
801 if (outbuf_alloc == NULL) {
802 if (reply_type == RPCBPROC_INDIRECT)
803 svcerr_systemerr(transp);
804 if (debugging)
805 fprintf(stderr,
806 "rpcbproc_callit_com: No memory!\n");
807 goto error;
808 }
809 xdrmem_create(&outxdr, outbuf_alloc, sendsz, XDR_ENCODE);
810 } else {
811 xdrmem_create(&outxdr, outbuf, sendsz, XDR_ENCODE);
812 }
813 if (!xdr_callhdr(&outxdr, &call_msg)) {
814 if (reply_type == RPCBPROC_INDIRECT)
815 svcerr_systemerr(transp);
816 if (debugging)
817 fprintf(stderr,
818 "rpcbproc_callit_com: xdr_callhdr failed\n");
819 goto error;
820 }
821 if (!xdr_u_int32_t(&outxdr, &(a.rmt_proc))) {
822 if (reply_type == RPCBPROC_INDIRECT)
823 svcerr_systemerr(transp);
824 if (debugging)
825 fprintf(stderr,
826 "rpcbproc_callit_com: xdr_u_long failed\n");
827 goto error;
828 }
829
830 if (rqstp->rq_cred.oa_flavor == AUTH_NULL) {
831 auth = authnone_create();
832 } else if (rqstp->rq_cred.oa_flavor == AUTH_SYS) {
833 struct authunix_parms *au;
834
835 au = (struct authunix_parms *)rqstp->rq_clntcred;
836 auth = authunix_create(au->aup_machname,
837 au->aup_uid, au->aup_gid,
838 au->aup_len, au->aup_gids);
839 if (auth == NULL) /* fall back */
840 auth = authnone_create();
841 } else {
842 /* we do not support any other authentication scheme */
843 if (debugging)
844 fprintf(stderr,
845 "rpcbproc_callit_com: oa_flavor != AUTH_NONE and oa_flavor != AUTH_SYS\n");
846 if (reply_type == RPCBPROC_INDIRECT)
847 svcerr_weakauth(transp); /* XXX too strong.. */
848 goto error;
849 }
850 if (auth == NULL) {
851 if (reply_type == RPCBPROC_INDIRECT)
852 svcerr_systemerr(transp);
853 if (debugging)
854 fprintf(stderr,
855 "rpcbproc_callit_com: authwhatever_create returned NULL\n");
856 goto error;
857 }
858 if (!AUTH_MARSHALL(auth, &outxdr)) {
859 if (reply_type == RPCBPROC_INDIRECT)
860 svcerr_systemerr(transp);
861 AUTH_DESTROY(auth);
862 if (debugging)
863 fprintf(stderr,
864 "rpcbproc_callit_com: AUTH_MARSHALL failed\n");
865 goto error;
866 }
867 AUTH_DESTROY(auth);
868 if (!xdr_opaque_parms(&outxdr, &a)) {
869 if (reply_type == RPCBPROC_INDIRECT)
870 svcerr_systemerr(transp);
871 if (debugging)
872 fprintf(stderr,
873 "rpcbproc_callit_com: xdr_opaque_parms failed\n");
874 goto error;
875 }
876 outlen = (int) XDR_GETPOS(&outxdr);
877 if (outbuf_alloc)
878 outbufp = outbuf_alloc;
879 else
880 outbufp = outbuf;
881
882 na = uaddr2taddr(nconf, local_uaddr);
883 if (!na) {
884 if (reply_type == RPCBPROC_INDIRECT)
885 svcerr_systemerr(transp);
886 goto error;
887 }
888
889 if (sendto(fd, outbufp, outlen, 0, (struct sockaddr *)na->buf, na->len)
890 != outlen) {
891 if (debugging)
892 fprintf(stderr,
893 "rpcbproc_callit_com: sendto failed: errno %d\n", errno);
894 if (reply_type == RPCBPROC_INDIRECT)
895 svcerr_systemerr(transp);
896 goto error;
897 }
898 goto out;
899
900 error:
901 if (call_msg.rm_xid != 0)
902 (void) free_slot_by_xid(call_msg.rm_xid);
903 out:
904 free(local_uaddr);
905 free(buf_alloc);
906 free(outbuf_alloc);
907 netbuffree(na);
908 free(m_uaddr);
909 }
910
911 /*
912 * Makes an entry into the FIFO for the given request.
913 * Returns 1 on success, 0 if this is a duplicate request, or -1 on error.
914 * *callxidp is set to the xid of the call.
915 */
916 static int
forward_register(u_int32_t caller_xid,struct netbuf * caller_addr,int forward_fd,char * uaddr,rpcproc_t reply_type,rpcvers_t versnum,u_int32_t * callxidp)917 forward_register(u_int32_t caller_xid, struct netbuf *caller_addr,
918 int forward_fd, char *uaddr, rpcproc_t reply_type,
919 rpcvers_t versnum, u_int32_t *callxidp)
920 {
921 int i;
922 int j = 0;
923 time_t min_time, time_now;
924 static u_int32_t lastxid;
925 int entry = -1;
926
927 min_time = FINFO[0].time;
928 time_now = time((time_t *)0);
929 /* initialization */
930 if (lastxid == 0)
931 lastxid = time_now * NFORWARD;
932
933 /*
934 * Check if it is a duplicate entry. Then,
935 * try to find an empty slot. If not available, then
936 * use the slot with the earliest time.
937 */
938 for (i = 0; i < NFORWARD; i++) {
939 if (FINFO[i].flag & FINFO_ACTIVE) {
940 if ((FINFO[i].caller_xid == caller_xid) &&
941 (FINFO[i].reply_type == reply_type) &&
942 (FINFO[i].versnum == versnum) &&
943 (!netbufcmp(FINFO[i].caller_addr,
944 caller_addr))) {
945 FINFO[i].time = time((time_t *)0);
946 return (0); /* Duplicate entry */
947 } else {
948 /* Should we wait any longer */
949 if ((time_now - FINFO[i].time) > MAXTIME_OFF)
950 (void) free_slot_by_index(i);
951 }
952 }
953 if (entry == -1) {
954 if ((FINFO[i].flag & FINFO_ACTIVE) == 0) {
955 entry = i;
956 } else if (FINFO[i].time < min_time) {
957 j = i;
958 min_time = FINFO[i].time;
959 }
960 }
961 }
962 if (entry != -1) {
963 /* use this empty slot */
964 j = entry;
965 } else {
966 (void) free_slot_by_index(j);
967 }
968 if ((FINFO[j].caller_addr = netbufdup(caller_addr)) == NULL) {
969 return (-1);
970 }
971 rpcb_rmtcalls++; /* no of pending calls */
972 FINFO[j].flag = FINFO_ACTIVE;
973 FINFO[j].reply_type = reply_type;
974 FINFO[j].versnum = versnum;
975 FINFO[j].time = time_now;
976 FINFO[j].caller_xid = caller_xid;
977 FINFO[j].forward_fd = forward_fd;
978 /*
979 * Though uaddr is not allocated here, it will still be freed
980 * from free_slot_*().
981 */
982 FINFO[j].uaddr = uaddr;
983 lastxid = lastxid + NFORWARD;
984 /* Don't allow a zero xid below. */
985 if ((u_int32_t)(lastxid + NFORWARD) <= NFORWARD)
986 lastxid = NFORWARD;
987 FINFO[j].forward_xid = lastxid + j; /* encode slot */
988 *callxidp = FINFO[j].forward_xid; /* forward on this xid */
989 return (1);
990 }
991
992 static struct finfo *
forward_find(u_int32_t reply_xid)993 forward_find(u_int32_t reply_xid)
994 {
995 int i;
996
997 i = reply_xid % (u_int32_t)NFORWARD;
998 if ((FINFO[i].flag & FINFO_ACTIVE) &&
999 (FINFO[i].forward_xid == reply_xid)) {
1000 return (&FINFO[i]);
1001 }
1002 return (NULL);
1003 }
1004
1005 static int
free_slot_by_xid(u_int32_t xid)1006 free_slot_by_xid(u_int32_t xid)
1007 {
1008 int entry;
1009
1010 entry = xid % (u_int32_t)NFORWARD;
1011 return (free_slot_by_index(entry));
1012 }
1013
1014 static int
free_slot_by_index(int index)1015 free_slot_by_index(int index)
1016 {
1017 struct finfo *fi;
1018
1019 fi = &FINFO[index];
1020 if (fi->flag & FINFO_ACTIVE) {
1021 netbuffree(fi->caller_addr);
1022 /* XXX may be too big, but can't access xprt array here */
1023 if (fi->forward_fd >= svc_maxfd)
1024 svc_maxfd--;
1025 free(fi->uaddr);
1026 fi->flag &= ~FINFO_ACTIVE;
1027 rpcb_rmtcalls--;
1028 return (1);
1029 }
1030 return (0);
1031 }
1032
1033 static int
netbufcmp(struct netbuf * n1,struct netbuf * n2)1034 netbufcmp(struct netbuf *n1, struct netbuf *n2)
1035 {
1036 return ((n1->len != n2->len) || memcmp(n1->buf, n2->buf, n1->len));
1037 }
1038
1039 static bool_t
netbuf_copybuf(struct netbuf * dst,const struct netbuf * src)1040 netbuf_copybuf(struct netbuf *dst, const struct netbuf *src)
1041 {
1042 assert(src->len <= src->maxlen);
1043
1044 if (dst->maxlen < src->len || dst->buf == NULL) {
1045 free(dst->buf);
1046 if ((dst->buf = calloc(1, src->maxlen)) == NULL)
1047 return (FALSE);
1048 dst->maxlen = src->maxlen;
1049 }
1050
1051 dst->len = src->len;
1052 memcpy(dst->buf, src->buf, src->len);
1053
1054 return (TRUE);
1055 }
1056
1057 static struct netbuf *
netbufdup(struct netbuf * ap)1058 netbufdup(struct netbuf *ap)
1059 {
1060 struct netbuf *np;
1061
1062 if ((np = calloc(1, sizeof(struct netbuf))) == NULL)
1063 return (NULL);
1064 if (netbuf_copybuf(np, ap) == FALSE) {
1065 free(np);
1066 return (NULL);
1067 }
1068 return (np);
1069 }
1070
1071 static void
netbuffree(struct netbuf * ap)1072 netbuffree(struct netbuf *ap)
1073 {
1074
1075 if (ap == NULL)
1076 return;
1077 free(ap->buf);
1078 ap->buf = NULL;
1079 free(ap);
1080 }
1081
1082
1083 #define MASKVAL (POLLIN | POLLPRI | POLLRDNORM | POLLRDBAND)
1084 extern bool_t __svc_clean_idle(fd_set *, int, bool_t);
1085
1086 void
my_svc_run(void)1087 my_svc_run(void)
1088 {
1089 size_t nfds;
1090 struct pollfd pollfds[FD_SETSIZE + 1];
1091 int poll_ret, check_ret;
1092 int n;
1093 #ifdef SVC_RUN_DEBUG
1094 int i;
1095 #endif
1096 register struct pollfd *p;
1097 fd_set cleanfds;
1098
1099 for (;;) {
1100 p = pollfds;
1101 p->fd = terminate_rfd;
1102 p->events = MASKVAL;
1103 p++;
1104 for (n = 0; n <= svc_maxfd; n++) {
1105 if (FD_ISSET(n, &svc_fdset)) {
1106 p->fd = n;
1107 p->events = MASKVAL;
1108 p++;
1109 }
1110 }
1111 nfds = p - pollfds;
1112 poll_ret = 0;
1113 #ifdef SVC_RUN_DEBUG
1114 if (debugging) {
1115 fprintf(stderr, "polling for read on fd < ");
1116 for (i = 0, p = pollfds; i < nfds; i++, p++)
1117 if (p->events)
1118 fprintf(stderr, "%d ", p->fd);
1119 fprintf(stderr, ">\n");
1120 }
1121 #endif
1122 poll_ret = poll(pollfds, nfds, 30 * 1000);
1123
1124 if (doterminate != 0) {
1125 close(rpcbindlockfd);
1126 #ifdef WARMSTART
1127 syslog(LOG_ERR,
1128 "rpcbind terminating on signal %d. Restart with \"rpcbind -w\"",
1129 (int)doterminate);
1130 write_warmstart(); /* Dump yourself */
1131 #endif
1132 exit(2);
1133 }
1134
1135 switch (poll_ret) {
1136 case -1:
1137 /*
1138 * We ignore all errors, continuing with the assumption
1139 * that it was set by the signal handlers (or any
1140 * other outside event) and not caused by poll().
1141 */
1142 case 0:
1143 cleanfds = svc_fdset;
1144 __svc_clean_idle(&cleanfds, 30, FALSE);
1145 continue;
1146 default:
1147 #ifdef SVC_RUN_DEBUG
1148 if (debugging) {
1149 fprintf(stderr, "poll returned read fds < ");
1150 for (i = 0, p = pollfds; i < nfds; i++, p++)
1151 if (p->revents)
1152 fprintf(stderr, "%d ", p->fd);
1153 fprintf(stderr, ">\n");
1154 }
1155 #endif
1156 /*
1157 * If we found as many replies on callback fds
1158 * as the number of descriptors selectable which
1159 * poll() returned, there can be no more so we
1160 * don't call svc_getreq_poll. Otherwise, there
1161 * must be another so we must call svc_getreq_poll.
1162 */
1163 if ((check_ret = check_rmtcalls(pollfds, nfds)) ==
1164 poll_ret)
1165 continue;
1166 svc_getreq_poll(pollfds, poll_ret-check_ret);
1167 }
1168 #ifdef SVC_RUN_DEBUG
1169 if (debugging) {
1170 fprintf(stderr, "svc_maxfd now %u\n", svc_maxfd);
1171 }
1172 #endif
1173 }
1174 }
1175
1176 static int
check_rmtcalls(struct pollfd * pfds,int nfds)1177 check_rmtcalls(struct pollfd *pfds, int nfds)
1178 {
1179 int j, ncallbacks_found = 0, rmtcalls_pending;
1180 SVCXPRT *xprt;
1181
1182 if (rpcb_rmtcalls == 0)
1183 return (0);
1184
1185 rmtcalls_pending = rpcb_rmtcalls;
1186 for (j = 0; j < nfds; j++) {
1187 if ((xprt = find_rmtcallxprt_by_fd(pfds[j].fd)) != NULL) {
1188 if (pfds[j].revents) {
1189 ncallbacks_found++;
1190 #ifdef DEBUG_RMTCALL
1191 if (debugging)
1192 fprintf(stderr,
1193 "my_svc_run: polled on forwarding fd %d, netid %s - calling handle_reply\n",
1194 pfds[j].fd, xprt->xp_netid);
1195 #endif
1196 handle_reply(pfds[j].fd, xprt);
1197 pfds[j].revents = 0;
1198 if (ncallbacks_found >= rmtcalls_pending) {
1199 break;
1200 }
1201 }
1202 }
1203 }
1204 return (ncallbacks_found);
1205 }
1206
1207 static void
xprt_set_caller(SVCXPRT * xprt,struct finfo * fi)1208 xprt_set_caller(SVCXPRT *xprt, struct finfo *fi)
1209 {
1210 u_int32_t *xidp;
1211
1212 netbuf_copybuf(svc_getrpccaller(xprt), fi->caller_addr);
1213 xidp = __rpcb_get_dg_xidp(xprt);
1214 *xidp = fi->caller_xid;
1215 }
1216
1217 /*
1218 * Call svcerr_systemerr() only if RPCBVERS4
1219 */
1220 static void
send_svcsyserr(SVCXPRT * xprt,struct finfo * fi)1221 send_svcsyserr(SVCXPRT *xprt, struct finfo *fi)
1222 {
1223 if (fi->reply_type == RPCBPROC_INDIRECT) {
1224 xprt_set_caller(xprt, fi);
1225 svcerr_systemerr(xprt);
1226 }
1227 }
1228
1229 static void
handle_reply(int fd,SVCXPRT * xprt)1230 handle_reply(int fd, SVCXPRT *xprt)
1231 {
1232 XDR reply_xdrs;
1233 struct rpc_msg reply_msg;
1234 struct rpc_err reply_error;
1235 char *buffer;
1236 struct finfo *fi;
1237 int inlen, pos, len;
1238 struct r_rmtcall_args a;
1239 struct sockaddr_storage ss;
1240 socklen_t fromlen;
1241 #ifdef SVC_RUN_DEBUG
1242 char *uaddr;
1243 #endif
1244
1245 buffer = malloc(RPC_BUF_MAX);
1246 if (buffer == NULL)
1247 goto done;
1248
1249 do {
1250 fromlen = sizeof(ss);
1251 inlen = recvfrom(fd, buffer, RPC_BUF_MAX, 0,
1252 (struct sockaddr *)&ss, &fromlen);
1253 } while (inlen < 0 && errno == EINTR);
1254 if (inlen < 0) {
1255 if (debugging)
1256 fprintf(stderr,
1257 "handle_reply: recvfrom returned %d, errno %d\n", inlen, errno);
1258 goto done;
1259 }
1260
1261 reply_msg.acpted_rply.ar_verf = _null_auth;
1262 reply_msg.acpted_rply.ar_results.where = 0;
1263 reply_msg.acpted_rply.ar_results.proc = (xdrproc_t) xdr_void;
1264
1265 xdrmem_create(&reply_xdrs, buffer, (u_int)inlen, XDR_DECODE);
1266 if (!xdr_replymsg(&reply_xdrs, &reply_msg)) {
1267 if (debugging)
1268 (void) fprintf(stderr,
1269 "handle_reply: xdr_replymsg failed\n");
1270 goto done;
1271 }
1272 fi = forward_find(reply_msg.rm_xid);
1273 #ifdef SVC_RUN_DEBUG
1274 if (debugging) {
1275 fprintf(stderr, "handle_reply: reply xid: %d fi addr: %p\n",
1276 reply_msg.rm_xid, fi);
1277 }
1278 #endif
1279 if (fi == NULL) {
1280 goto done;
1281 }
1282 _seterr_reply(&reply_msg, &reply_error);
1283 if (reply_error.re_status != RPC_SUCCESS) {
1284 if (debugging)
1285 (void) fprintf(stderr, "handle_reply: %s\n",
1286 clnt_sperrno(reply_error.re_status));
1287 send_svcsyserr(xprt, fi);
1288 goto done;
1289 }
1290 pos = XDR_GETPOS(&reply_xdrs);
1291 len = inlen - pos;
1292 a.rmt_args.args = &buffer[pos];
1293 a.rmt_args.arglen = len;
1294 a.rmt_uaddr = fi->uaddr;
1295 a.rmt_localvers = fi->versnum;
1296
1297 xprt_set_caller(xprt, fi);
1298 #ifdef SVC_RUN_DEBUG
1299 uaddr = taddr2uaddr(rpcbind_get_conf("udp"),
1300 svc_getrpccaller(xprt));
1301 if (debugging) {
1302 fprintf(stderr, "handle_reply: forwarding address %s to %s\n",
1303 a.rmt_uaddr, uaddr ? uaddr : "unknown");
1304 }
1305 free(uaddr);
1306 #endif
1307 svc_sendreply(xprt, (xdrproc_t) xdr_rmtcall_result, (char *) &a);
1308 done:
1309 free(buffer);
1310
1311 if (reply_msg.rm_xid == 0) {
1312 #ifdef SVC_RUN_DEBUG
1313 if (debugging) {
1314 fprintf(stderr, "handle_reply: NULL xid on exit!\n");
1315 }
1316 #endif
1317 } else
1318 (void) free_slot_by_xid(reply_msg.rm_xid);
1319 }
1320
1321 static void
find_versions(rpcprog_t prog,char * netid,rpcvers_t * lowvp,rpcvers_t * highvp)1322 find_versions(rpcprog_t prog, char *netid, rpcvers_t *lowvp, rpcvers_t *highvp)
1323 {
1324 register rpcblist_ptr rbl;
1325 unsigned int lowv = 0;
1326 unsigned int highv = 0;
1327
1328 for (rbl = list_rbl; rbl != NULL; rbl = rbl->rpcb_next) {
1329 if ((rbl->rpcb_map.r_prog != prog) ||
1330 ((rbl->rpcb_map.r_netid != NULL) &&
1331 (strcasecmp(rbl->rpcb_map.r_netid, netid) != 0)))
1332 continue;
1333 if (lowv == 0) {
1334 highv = rbl->rpcb_map.r_vers;
1335 lowv = highv;
1336 } else if (rbl->rpcb_map.r_vers < lowv) {
1337 lowv = rbl->rpcb_map.r_vers;
1338 } else if (rbl->rpcb_map.r_vers > highv) {
1339 highv = rbl->rpcb_map.r_vers;
1340 }
1341 }
1342 *lowvp = lowv;
1343 *highvp = highv;
1344 }
1345
1346 /*
1347 * returns the item with the given program, version number and netid.
1348 * If that version number is not found, it returns the item with that
1349 * program number, so that address is now returned to the caller. The
1350 * caller when makes a call to this program, version number, the call
1351 * will fail and it will return with PROGVERS_MISMATCH. The user can
1352 * then determine the highest and the lowest version number for this
1353 * program using clnt_geterr() and use those program version numbers.
1354 *
1355 * Returns the RPCBLIST for the given prog, vers and netid
1356 */
1357 static rpcblist_ptr
find_service(rpcprog_t prog,rpcvers_t vers,char * netid)1358 find_service(rpcprog_t prog, rpcvers_t vers, char *netid)
1359 {
1360 register rpcblist_ptr hit = NULL;
1361 register rpcblist_ptr rbl;
1362
1363 for (rbl = list_rbl; rbl != NULL; rbl = rbl->rpcb_next) {
1364 if ((rbl->rpcb_map.r_prog != prog) ||
1365 ((rbl->rpcb_map.r_netid != NULL) &&
1366 (strcasecmp(rbl->rpcb_map.r_netid, netid) != 0)))
1367 continue;
1368 hit = rbl;
1369 if (rbl->rpcb_map.r_vers == vers)
1370 break;
1371 }
1372 return (hit);
1373 }
1374
1375 /*
1376 * Copies the name associated with the uid of the caller and returns
1377 * a pointer to it. Similar to getwd().
1378 */
1379 static char *
getowner(SVCXPRT * transp,char * owner,size_t ownersize)1380 getowner(SVCXPRT *transp, char *owner, size_t ownersize)
1381 {
1382 uid_t uid;
1383
1384 if (__rpc_get_local_uid(transp, &uid) < 0)
1385 strlcpy(owner, "unknown", ownersize);
1386 else if (uid == 0)
1387 strlcpy(owner, "superuser", ownersize);
1388 else
1389 snprintf(owner, ownersize, "%d", uid);
1390
1391 return owner;
1392 }
1393
1394 #ifdef PORTMAP
1395 /*
1396 * Add this to the pmap list only if it is UDP or TCP.
1397 */
1398 static int
add_pmaplist(RPCB * arg)1399 add_pmaplist(RPCB *arg)
1400 {
1401 struct pmap pmap;
1402 struct pmaplist *pml;
1403 int h1, h2, h3, h4, p1, p2;
1404
1405 if (strcmp(arg->r_netid, udptrans) == 0) {
1406 /* It is UDP! */
1407 pmap.pm_prot = IPPROTO_UDP;
1408 } else if (strcmp(arg->r_netid, tcptrans) == 0) {
1409 /* It is TCP */
1410 pmap.pm_prot = IPPROTO_TCP;
1411 } else
1412 /* Not an IP protocol */
1413 return (0);
1414
1415 /* interpret the universal address for TCP/IP */
1416 if (sscanf(arg->r_addr, "%d.%d.%d.%d.%d.%d",
1417 &h1, &h2, &h3, &h4, &p1, &p2) != 6)
1418 return (0);
1419 pmap.pm_port = ((p1 & 0xff) << 8) + (p2 & 0xff);
1420 pmap.pm_prog = arg->r_prog;
1421 pmap.pm_vers = arg->r_vers;
1422 /*
1423 * add to END of list
1424 */
1425 pml = malloc(sizeof (struct pmaplist));
1426 if (pml == NULL) {
1427 (void) syslog(LOG_ERR, "rpcbind: no memory!\n");
1428 return (1);
1429 }
1430 pml->pml_map = pmap;
1431 pml->pml_next = NULL;
1432 if (list_pml == NULL) {
1433 list_pml = pml;
1434 } else {
1435 struct pmaplist *fnd;
1436
1437 /* Attach to the end of the list */
1438 for (fnd = list_pml; fnd->pml_next; fnd = fnd->pml_next)
1439 ;
1440 fnd->pml_next = pml;
1441 }
1442 return (0);
1443 }
1444
1445 /*
1446 * Delete this from the pmap list only if it is UDP or TCP.
1447 */
1448 static int
del_pmaplist(RPCB * arg)1449 del_pmaplist(RPCB *arg)
1450 {
1451 struct pmaplist *pml;
1452 struct pmaplist *prevpml, *fnd;
1453 unsigned long prot;
1454
1455 if (strcmp(arg->r_netid, udptrans) == 0) {
1456 /* It is UDP! */
1457 prot = IPPROTO_UDP;
1458 } else if (strcmp(arg->r_netid, tcptrans) == 0) {
1459 /* It is TCP */
1460 prot = IPPROTO_TCP;
1461 } else if (arg->r_netid[0] == 0) {
1462 prot = 0; /* Remove all occurrences */
1463 } else {
1464 /* Not an IP protocol */
1465 return (0);
1466 }
1467 for (prevpml = NULL, pml = list_pml; pml; /* cstyle */) {
1468 if ((pml->pml_map.pm_prog != arg->r_prog) ||
1469 (pml->pml_map.pm_vers != arg->r_vers) ||
1470 (prot && (pml->pml_map.pm_prot != prot))) {
1471 /* both pml & prevpml move forwards */
1472 prevpml = pml;
1473 pml = pml->pml_next;
1474 continue;
1475 }
1476 /* found it; pml moves forward, prevpml stays */
1477 fnd = pml;
1478 pml = pml->pml_next;
1479 if (prevpml == NULL)
1480 list_pml = pml;
1481 else
1482 prevpml->pml_next = pml;
1483 free(fnd);
1484 }
1485 return (0);
1486 }
1487 #endif /* PORTMAP */
1488