1 /* $NetBSD: rpcb_svc_com.c,v 1.28 2024/02/09 22:08:38 andvar Exp $ */
2 /* $FreeBSD: head/usr.sbin/rpcbind/rpcb_svc_com.c 301770 2016-06-09 22:25:00Z pfg $ */
3
4 /*-
5 * Copyright (c) 2009, Sun Microsystems, Inc.
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions are met:
10 * - Redistributions of source code must retain the above copyright notice,
11 * this list of conditions and the following disclaimer.
12 * - Redistributions in binary form must reproduce the above copyright notice,
13 * this list of conditions and the following disclaimer in the documentation
14 * and/or other materials provided with the distribution.
15 * - Neither the name of Sun Microsystems, Inc. nor the names of its
16 * contributors may be used to endorse or promote products derived
17 * from this software without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
20 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
23 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29 * POSSIBILITY OF SUCH DAMAGE.
30 */
31 /*
32 * Copyright (c) 1986 - 1991 by Sun Microsystems, Inc.
33 */
34
35 /* #ident "@(#)rpcb_svc_com.c 1.18 94/05/02 SMI" */
36
37 /*
38 * rpcb_svc_com.c
39 * The commom server procedure for the rpcbind.
40 */
41
42 #include <sys/types.h>
43 #include <sys/stat.h>
44 #include <sys/param.h>
45 #include <sys/socket.h>
46 #include <rpc/rpc.h>
47 #include <rpc/rpcb_prot.h>
48 #include <rpc/rpc_com.h>
49 #include <assert.h>
50 #include <netconfig.h>
51 #include <errno.h>
52 #include <syslog.h>
53 #include <unistd.h>
54 #include <stdio.h>
55 #include <poll.h>
56 #ifdef PORTMAP
57 #include <netinet/in.h>
58 #include <rpc/pmap_prot.h>
59 #endif /* PORTMAP */
60 #include <string.h>
61 #include <stdlib.h>
62
63 #ifdef RPCBIND_RUMP
64 #include <rump/rump.h>
65 #include <rump/rump_syscallshotgun.h>
66 #include <rump/rump_syscalls.h>
67 #endif
68
69 #include "svc_dg.h"
70 #include "rpcbind.h"
71 #ifdef RPCBIND_RUMP
72 #include "svc_fdset.h"
73 #endif
74
75 #define RPC_BUF_MAX 65536 /* can be raised if required */
76
77 static char nullstring[] = "";
78 static int rpcb_rmtcalls;
79
80 struct rmtcallfd_list {
81 int fd;
82 SVCXPRT *xprt;
83 char *netid;
84 struct rmtcallfd_list *next;
85 };
86
87 #define NFORWARD 64
88 #define MAXTIME_OFF 300 /* 5 minutes */
89
90 struct finfo {
91 int flag;
92 #define FINFO_ACTIVE 0x1
93 u_int32_t caller_xid;
94 struct netbuf *caller_addr;
95 u_int32_t forward_xid;
96 int forward_fd;
97 char *uaddr;
98 rpcproc_t reply_type;
99 rpcvers_t versnum;
100 time_t time;
101 };
102 static struct finfo FINFO[NFORWARD];
103
104
105 static bool_t xdr_encap_parms(XDR *, struct encap_parms *);
106 static bool_t xdr_rmtcall_args(XDR *, struct r_rmtcall_args *);
107 static bool_t xdr_rmtcall_result(XDR *, struct r_rmtcall_args *);
108 static bool_t xdr_opaque_parms(XDR *, struct r_rmtcall_args *);
109 static int find_rmtcallfd_by_netid(char *);
110 static SVCXPRT *find_rmtcallxprt_by_fd(int);
111 static int forward_register(u_int32_t, struct netbuf *, int, char *,
112 rpcproc_t, rpcvers_t, u_int32_t *);
113 static struct finfo *forward_find(u_int32_t);
114 static int free_slot_by_xid(u_int32_t);
115 static int free_slot_by_index(int);
116 static int netbufcmp(struct netbuf *, struct netbuf *);
117 static struct netbuf *netbufdup(struct netbuf *);
118 static void netbuffree(struct netbuf *);
119 static int check_rmtcalls(struct pollfd *, int);
120 static void xprt_set_caller(SVCXPRT *, struct finfo *);
121 static void send_svcsyserr(SVCXPRT *, struct finfo *);
122 static void handle_reply(int, SVCXPRT *);
123 static void find_versions(rpcprog_t, char *, rpcvers_t *, rpcvers_t *);
124 static rpcblist_ptr find_service(rpcprog_t, rpcvers_t, char *);
125 static char *getowner(SVCXPRT *, char *, size_t);
126 static int add_pmaplist(RPCB *);
127 static int del_pmaplist(RPCB *);
128
129 /*
130 * Set a mapping of program, version, netid
131 */
132 /* ARGSUSED */
133 void *
rpcbproc_set_com(void * arg,struct svc_req * rqstp __unused,SVCXPRT * transp,rpcvers_t rpcbversnum)134 rpcbproc_set_com(void *arg, struct svc_req *rqstp __unused, SVCXPRT *transp,
135 rpcvers_t rpcbversnum)
136 {
137 RPCB *regp = arg;
138 static bool_t ans;
139 char owner[64];
140
141 #ifdef RPCBIND_DEBUG
142 if (debugging)
143 fprintf(stderr, "%s: RPCB_SET request for (%lu, %lu, %s, %s): ",
144 __func__, (unsigned long)regp->r_prog,
145 (unsigned long)regp->r_vers, regp->r_netid, regp->r_addr);
146 #endif
147 ans = map_set(regp, getowner(transp, owner, sizeof owner));
148 #ifdef RPCBIND_DEBUG
149 if (debugging)
150 fprintf(stderr, "%s\n", ans == TRUE ? "succeeded" : "failed");
151 #endif
152 /* XXX: should have used some defined constant here */
153 rpcbs_set(rpcbversnum - 2, ans);
154 return (void *)&ans;
155 }
156
157 bool_t
map_set(RPCB * regp,char * owner)158 map_set(RPCB *regp, char *owner)
159 {
160 RPCB reg, *a;
161 rpcblist_ptr rbl, fnd;
162
163 reg = *regp;
164 /*
165 * check to see if already used
166 * find_service returns a hit even if
167 * the versions don't match, so check for it
168 */
169 fnd = find_service(reg.r_prog, reg.r_vers, reg.r_netid);
170 if (fnd && (fnd->rpcb_map.r_vers == reg.r_vers)) {
171 if (!strcmp(fnd->rpcb_map.r_addr, reg.r_addr))
172 /*
173 * if these match then it is already
174 * registered so just say "OK".
175 */
176 return (TRUE);
177 else
178 return (FALSE);
179 }
180 /*
181 * add to the end of the list
182 */
183 rbl = malloc(sizeof(*rbl));
184 if (rbl == NULL)
185 return (FALSE);
186 a = &(rbl->rpcb_map);
187 a->r_prog = reg.r_prog;
188 a->r_vers = reg.r_vers;
189 a->r_netid = strdup(reg.r_netid);
190 a->r_addr = strdup(reg.r_addr);
191 a->r_owner = strdup(owner);
192 if (!a->r_addr || !a->r_netid || !a->r_owner) {
193 if (a->r_netid)
194 free(a->r_netid);
195 if (a->r_addr)
196 free(a->r_addr);
197 if (a->r_owner)
198 free(a->r_owner);
199 free(rbl);
200 return (FALSE);
201 }
202 rbl->rpcb_next = NULL;
203 if (list_rbl == NULL) {
204 list_rbl = rbl;
205 } else {
206 for (fnd = list_rbl; fnd->rpcb_next;
207 fnd = fnd->rpcb_next)
208 ;
209 fnd->rpcb_next = rbl;
210 }
211 #ifdef PORTMAP
212 (void) add_pmaplist(regp);
213 #endif
214 return (TRUE);
215 }
216
217 /*
218 * Unset a mapping of program, version, netid
219 */
220 /* ARGSUSED */
221 void *
rpcbproc_unset_com(void * arg,struct svc_req * rqstp __unused,SVCXPRT * transp,rpcvers_t rpcbversnum)222 rpcbproc_unset_com(void *arg, struct svc_req *rqstp __unused, SVCXPRT *transp,
223 rpcvers_t rpcbversnum)
224 {
225 RPCB *regp = arg;
226 static bool_t ans;
227 char owner[64];
228
229 #ifdef RPCBIND_DEBUG
230 if (debugging)
231 fprintf(stderr, "%s: RPCB_UNSET request for (%lu, %lu, %s): ",
232 __func__, (unsigned long)regp->r_prog,
233 (unsigned long)regp->r_vers, regp->r_netid);
234 #endif
235 ans = map_unset(regp, getowner(transp, owner, sizeof owner));
236 #ifdef RPCBIND_DEBUG
237 if (debugging)
238 fprintf(stderr, "%s\n", ans == TRUE ? "succeeded" : "failed");
239 #endif
240 /* XXX: should have used some defined constant here */
241 rpcbs_unset(rpcbversnum - 2, ans);
242 return (void *)&ans;
243 }
244
245 bool_t
map_unset(RPCB * regp,const char * owner)246 map_unset(RPCB *regp, const char *owner)
247 {
248 int ans = 0;
249 rpcblist_ptr rbl, prev, tmp;
250
251 if (owner == NULL)
252 return (0);
253
254 for (prev = NULL, rbl = list_rbl; rbl; /* cstyle */) {
255 if ((rbl->rpcb_map.r_prog != regp->r_prog) ||
256 (rbl->rpcb_map.r_vers != regp->r_vers) ||
257 (regp->r_netid[0] && strcasecmp(regp->r_netid,
258 rbl->rpcb_map.r_netid))) {
259 /* both rbl & prev move forwards */
260 prev = rbl;
261 rbl = rbl->rpcb_next;
262 continue;
263 }
264 /*
265 * Check whether appropriate uid. Unset only
266 * if superuser or the owner itself.
267 */
268 if (strcmp(owner, rpcbind_superuser) &&
269 strcmp(rbl->rpcb_map.r_owner, owner))
270 return (0);
271 /* found it; rbl moves forward, prev stays */
272 ans = 1;
273 tmp = rbl;
274 rbl = rbl->rpcb_next;
275 if (prev == NULL)
276 list_rbl = rbl;
277 else
278 prev->rpcb_next = rbl;
279 free(tmp->rpcb_map.r_addr);
280 free(tmp->rpcb_map.r_netid);
281 free(tmp->rpcb_map.r_owner);
282 free(tmp);
283 }
284 #ifdef PORTMAP
285 if (ans)
286 (void) del_pmaplist(regp);
287 #endif
288 /*
289 * We return 1 either when the entry was not there or it
290 * was able to unset it. It can come to this point only if
291 * at least one of the conditions is true.
292 */
293 return (1);
294 }
295
296 void
delete_prog(rpcprog_t prog)297 delete_prog(rpcprog_t prog)
298 {
299 RPCB reg;
300 rpcblist_ptr rbl;
301
302 for (rbl = list_rbl; rbl != NULL; rbl = rbl->rpcb_next) {
303 if ((rbl->rpcb_map.r_prog != prog))
304 continue;
305 if (is_bound(rbl->rpcb_map.r_netid, rbl->rpcb_map.r_addr))
306 continue;
307 reg.r_prog = rbl->rpcb_map.r_prog;
308 reg.r_vers = rbl->rpcb_map.r_vers;
309 reg.r_netid = strdup(rbl->rpcb_map.r_netid);
310 if (reg.r_netid == NULL)
311 syslog(LOG_ERR, "%s: Cannot allocate memory", __func__);
312 else {
313 (void)map_unset(®, rpcbind_superuser);
314 free(reg.r_netid);
315 }
316 }
317 }
318
319 void *
rpcbproc_getaddr_com(RPCB * regp,struct svc_req * rqstp __unused,SVCXPRT * transp,rpcvers_t rpcbversnum,rpcvers_t verstype)320 rpcbproc_getaddr_com(RPCB *regp, struct svc_req *rqstp __unused,
321 SVCXPRT *transp, rpcvers_t rpcbversnum, rpcvers_t verstype)
322 {
323 static char *uaddr;
324 char *saddr = NULL;
325 rpcblist_ptr fnd;
326
327 if (uaddr != NULL && uaddr != nullstring) {
328 free(uaddr);
329 uaddr = NULL;
330 }
331 fnd = find_service(regp->r_prog, regp->r_vers, transp->xp_netid);
332 if (fnd && ((verstype == RPCB_ALLVERS) ||
333 (regp->r_vers == fnd->rpcb_map.r_vers))) {
334 if (*(regp->r_addr) != '\0') { /* may contain a hint about */
335 saddr = regp->r_addr; /* the interface that we */
336 } /* should use */
337 if (!(uaddr = mergeaddr(transp, transp->xp_netid,
338 fnd->rpcb_map.r_addr, saddr))) {
339 /* Try whatever we have */
340 uaddr = strdup(fnd->rpcb_map.r_addr);
341 } else if (!uaddr[0]) {
342 /*
343 * The server died. Unset all versions of this prog.
344 */
345 delete_prog(regp->r_prog);
346 uaddr = nullstring;
347 }
348 } else {
349 uaddr = nullstring;
350 }
351 #ifdef RPCBIND_DEBUG
352 if (debugging)
353 fprintf(stderr, "%s: %s\n", __func__, uaddr);
354 #endif
355 /* XXX: should have used some defined constant here */
356 rpcbs_getaddr(rpcbversnum - 2, regp->r_prog, regp->r_vers,
357 transp->xp_netid, uaddr);
358 return (void *)&uaddr;
359 }
360
361 /* ARGSUSED */
362 void *
rpcbproc_gettime_com(void * arg __unused,struct svc_req * rqstp __unused,SVCXPRT * transp __unused,rpcvers_t rpcbversnum __unused)363 rpcbproc_gettime_com(void *arg __unused, struct svc_req *rqstp __unused,
364 SVCXPRT *transp __unused, rpcvers_t rpcbversnum __unused)
365 {
366 static time_t curtime;
367
368 (void) time(&curtime);
369 return &curtime;
370 }
371
372 /*
373 * Convert uaddr to taddr. Should be used only by
374 * local servers/clients. (kernel level stuff only)
375 */
376 /* ARGSUSED */
377 void *
rpcbproc_uaddr2taddr_com(void * arg,struct svc_req * rqstp __unused,SVCXPRT * transp,rpcvers_t rpcbversnum __unused)378 rpcbproc_uaddr2taddr_com(void *arg, struct svc_req *rqstp __unused,
379 SVCXPRT *transp, rpcvers_t rpcbversnum __unused)
380 {
381 char **uaddrp = arg;
382 struct netconfig *nconf;
383 static struct netbuf nbuf;
384 static struct netbuf *taddr;
385
386 if (taddr) {
387 free(taddr->buf);
388 free(taddr);
389 taddr = NULL;
390 }
391 if (((nconf = rpcbind_get_conf(transp->xp_netid)) == NULL) ||
392 ((taddr = uaddr2taddr(nconf, *uaddrp)) == NULL)) {
393 (void) memset(&nbuf, 0, sizeof (struct netbuf));
394 return &nbuf;
395 }
396 return taddr;
397 }
398
399 /*
400 * Convert taddr to uaddr. Should be used only by
401 * local servers/clients. (kernel level stuff only)
402 */
403 /* ARGSUSED */
404 void *
rpcbproc_taddr2uaddr_com(void * arg,struct svc_req * rqstp __unused,SVCXPRT * transp,rpcvers_t rpcbversnum __unused)405 rpcbproc_taddr2uaddr_com(void *arg, struct svc_req *rqstp __unused,
406 SVCXPRT *transp, rpcvers_t rpcbversnum __unused)
407 {
408 struct netbuf *taddr = arg;
409 static char *uaddr;
410 struct netconfig *nconf;
411
412 #ifdef CHEW_FDS
413 int fd;
414
415 if ((fd = open("/dev/null", O_RDONLY)) == -1) {
416 uaddr = strerror(errno);
417 return (&uaddr);
418 }
419 #endif /* CHEW_FDS */
420 if (uaddr != NULL && uaddr != nullstring) {
421 free(uaddr);
422 uaddr = NULL;
423 }
424 if (((nconf = rpcbind_get_conf(transp->xp_netid)) == NULL) ||
425 ((uaddr = taddr2uaddr(nconf, taddr)) == NULL)) {
426 uaddr = nullstring;
427 }
428 return (void *)&uaddr;
429 }
430
431
432 static bool_t
xdr_encap_parms(XDR * xdrs,struct encap_parms * epp)433 xdr_encap_parms(XDR *xdrs, struct encap_parms *epp)
434 {
435 return (xdr_bytes(xdrs, &(epp->args), (u_int *) &(epp->arglen),
436 RPC_MAXDATASIZE));
437 }
438
439 /*
440 * XDR remote call arguments. It ignores the address part.
441 * written for XDR_DECODE direction only
442 */
443 static bool_t
xdr_rmtcall_args(XDR * xdrs,struct r_rmtcall_args * cap)444 xdr_rmtcall_args(XDR *xdrs, struct r_rmtcall_args *cap)
445 {
446 /* does not get the address or the arguments */
447 if (xdr_rpcprog(xdrs, &(cap->rmt_prog)) &&
448 xdr_rpcvers(xdrs, &(cap->rmt_vers)) &&
449 xdr_rpcproc(xdrs, &(cap->rmt_proc))) {
450 return (xdr_encap_parms(xdrs, &(cap->rmt_args)));
451 }
452 return (FALSE);
453 }
454
455 /*
456 * XDR remote call results along with the address. Ignore
457 * program number, version number and proc number.
458 * Written for XDR_ENCODE direction only.
459 */
460 static bool_t
xdr_rmtcall_result(XDR * xdrs,struct r_rmtcall_args * cap)461 xdr_rmtcall_result(XDR *xdrs, struct r_rmtcall_args *cap)
462 {
463 bool_t result;
464
465 #ifdef PORTMAP
466 if (cap->rmt_localvers == PMAPVERS) {
467 int h1, h2, h3, h4, p1, p2;
468 u_long port;
469
470 /* interpret the universal address for TCP/IP */
471 if (sscanf(cap->rmt_uaddr, "%d.%d.%d.%d.%d.%d",
472 &h1, &h2, &h3, &h4, &p1, &p2) != 6)
473 return (FALSE);
474 port = ((p1 & 0xff) << 8) + (p2 & 0xff);
475 result = xdr_u_long(xdrs, &port);
476 } else
477 #endif
478 if ((cap->rmt_localvers == RPCBVERS) ||
479 (cap->rmt_localvers == RPCBVERS4)) {
480 result = xdr_wrapstring(xdrs, &(cap->rmt_uaddr));
481 } else {
482 return (FALSE);
483 }
484 if (result == TRUE)
485 return (xdr_encap_parms(xdrs, &(cap->rmt_args)));
486 return (FALSE);
487 }
488
489 /*
490 * only worries about the struct encap_parms part of struct r_rmtcall_args.
491 * The arglen must already be set!!
492 */
493 static bool_t
xdr_opaque_parms(XDR * xdrs,struct r_rmtcall_args * cap)494 xdr_opaque_parms(XDR *xdrs, struct r_rmtcall_args *cap)
495 {
496 return (xdr_opaque(xdrs, cap->rmt_args.args, cap->rmt_args.arglen));
497 }
498
499 static struct rmtcallfd_list *rmthead;
500 static struct rmtcallfd_list *rmttail;
501
502 int
create_rmtcall_fd(struct netconfig * nconf)503 create_rmtcall_fd(struct netconfig *nconf)
504 {
505 int fd;
506 struct rmtcallfd_list *rmt;
507 SVCXPRT *xprt;
508
509 if ((fd = __rpc_nconf2fd(nconf)) == -1) {
510 if (debugging)
511 fprintf(stderr, "%s: couldn't open \"%s\" (%s)\n",
512 __func__, nconf->nc_device, strerror(errno));
513 return (-1);
514 }
515 xprt = svc_tli_create(fd, 0, NULL, 0, 0);
516 if (xprt == NULL) {
517 if (debugging)
518 fprintf(stderr,
519 "%s: svc_tli_create failed\n", __func__);
520 return (-1);
521 }
522 rmt = malloc(sizeof(*rmt));
523 if (rmt == NULL) {
524 syslog(LOG_ERR, "%s: Cannot allocate memory", __func__);
525 return (-1);
526 }
527 rmt->xprt = xprt;
528 rmt->netid = strdup(nconf->nc_netid);
529 xprt->xp_netid = rmt->netid;
530 rmt->fd = fd;
531 rmt->next = NULL;
532 if (rmthead == NULL) {
533 rmthead = rmt;
534 rmttail = rmt;
535 } else {
536 rmttail->next = rmt;
537 rmttail = rmt;
538 }
539 svc_fdset_set(fd);
540 return (fd);
541 }
542
543 static int
find_rmtcallfd_by_netid(char * netid)544 find_rmtcallfd_by_netid(char *netid)
545 {
546 struct rmtcallfd_list *rmt;
547
548 for (rmt = rmthead; rmt != NULL; rmt = rmt->next) {
549 if (strcmp(netid, rmt->netid) == 0) {
550 return (rmt->fd);
551 }
552 }
553 return (-1);
554 }
555
556 static SVCXPRT *
find_rmtcallxprt_by_fd(int fd)557 find_rmtcallxprt_by_fd(int fd)
558 {
559 struct rmtcallfd_list *rmt;
560
561 for (rmt = rmthead; rmt != NULL; rmt = rmt->next) {
562 if (fd == rmt->fd) {
563 return (rmt->xprt);
564 }
565 }
566 return (NULL);
567 }
568
569
570 /*
571 * Call a remote procedure service. This procedure is very quiet when things
572 * go wrong. The proc is written to support broadcast rpc. In the broadcast
573 * case, a machine should shut-up instead of complain, lest the requestor be
574 * overrun with complaints at the expense of not hearing a valid reply.
575 * When receiving a request and verifying that the service exists, we
576 *
577 * receive the request
578 *
579 * open a new TLI endpoint on the same transport on which we received
580 * the original request
581 *
582 * remember the original request's XID (which requires knowing the format
583 * of the svc_dg_data structure)
584 *
585 * forward the request, with a new XID, to the requested service,
586 * remembering the XID used to send this request (for later use in
587 * reassociating the answer with the original request), the requestor's
588 * address, the file descriptor on which the forwarded request is
589 * made and the service's address.
590 *
591 * mark the file descriptor on which we anticipate receiving a reply from
592 * the service and one to select for in our private svc_run procedure
593 *
594 * At some time in the future, a reply will be received from the service to
595 * which we forwarded the request. At that time, we detect that the socket
596 * used was for forwarding (by looking through the finfo structures to see
597 * whether the fd corresponds to one of those) and call handle_reply() to
598 *
599 * receive the reply
600 *
601 * bundle the reply, along with the service's universal address
602 *
603 * create a SVCXPRT structure and use a version of svc_sendreply
604 * that allows us to specify the reply XID and destination, send the reply
605 * to the original requestor.
606 */
607
608 void
rpcbproc_callit_com(struct svc_req * rqstp,SVCXPRT * transp,rpcproc_t reply_type,rpcvers_t versnum)609 rpcbproc_callit_com(struct svc_req *rqstp, SVCXPRT *transp,
610 rpcproc_t reply_type, rpcvers_t versnum)
611 {
612 rpcblist_ptr rbl;
613 struct netconfig *nconf;
614 struct netbuf *caller;
615 struct r_rmtcall_args a;
616 char *buf_alloc = NULL, *outbufp;
617 char *outbuf_alloc = NULL;
618 char buf[RPC_BUF_MAX], outbuf[RPC_BUF_MAX];
619 struct netbuf *na = NULL;
620 struct rpc_msg call_msg;
621 int outlen;
622 u_int sendsz;
623 XDR outxdr;
624 AUTH *auth;
625 int fd = -1;
626 char *uaddr, *m_uaddr = NULL, *local_uaddr = NULL;
627 u_int32_t *xidp;
628 struct __rpc_sockinfo si;
629 struct sockaddr *localsa;
630 struct netbuf tbuf;
631
632 if (!__rpc_fd2sockinfo(transp->xp_fd, &si)) {
633 if (reply_type == RPCBPROC_INDIRECT)
634 svcerr_systemerr(transp);
635 return;
636 }
637 if (si.si_socktype != SOCK_DGRAM)
638 return; /* Only datagram type accepted */
639 sendsz = __rpc_get_t_size(si.si_af, si.si_proto, UDPMSGSIZE);
640 if (sendsz == 0) { /* data transfer not supported */
641 if (reply_type == RPCBPROC_INDIRECT)
642 svcerr_systemerr(transp);
643 return;
644 }
645 /*
646 * Should be multiple of 4 for XDR.
647 */
648 sendsz = roundup(sendsz, 4);
649 if (sendsz > RPC_BUF_MAX) {
650 #ifdef notyet
651 buf_alloc = alloca(sendsz); /* not in IDR2? */
652 #else
653 buf_alloc = malloc(sendsz);
654 #endif /* notyet */
655 if (buf_alloc == NULL) {
656 if (debugging)
657 fprintf(stderr, "%s: No Memory!\n", __func__);
658 if (reply_type == RPCBPROC_INDIRECT)
659 svcerr_systemerr(transp);
660 return;
661 }
662 a.rmt_args.args = buf_alloc;
663 } else {
664 a.rmt_args.args = buf;
665 }
666
667 call_msg.rm_xid = 0; /* For error checking purposes */
668 if (!svc_getargs(transp, (xdrproc_t) xdr_rmtcall_args, (char *) &a)) {
669 if (reply_type == RPCBPROC_INDIRECT)
670 svcerr_decode(transp);
671 if (debugging)
672 fprintf(stderr, "%s: svc_getargs failed\n", __func__);
673 goto error;
674 }
675
676 if (!check_callit(transp, &a, versnum)) {
677 svcerr_weakauth(transp);
678 goto error;
679 }
680
681 caller = svc_getrpccaller(transp);
682 #ifdef RPCBIND_DEBUG
683 if (debugging) {
684 uaddr = taddr2uaddr(rpcbind_get_conf(transp->xp_netid), caller);
685 fprintf(stderr,
686 "%s: %s %s req for (%lu, %lu, %lu, %s) from %s: ",
687 __func__, versnum == PMAPVERS ? "pmap_rmtcall" :
688 versnum == RPCBVERS ? "rpcb_rmtcall" :
689 versnum == RPCBVERS4 ? "rpcb_indirect" :
690 rpcbind_unknown,
691 reply_type == RPCBPROC_INDIRECT ? "indirect" : "callit",
692 (unsigned long)a.rmt_prog, (unsigned long)a.rmt_vers,
693 (unsigned long)a.rmt_proc, transp->xp_netid,
694 uaddr ? uaddr : rpcbind_unknown);
695 if (uaddr)
696 free(uaddr);
697 }
698 #endif
699
700 rbl = find_service(a.rmt_prog, a.rmt_vers, transp->xp_netid);
701
702 rpcbs_rmtcall(versnum - 2, reply_type, a.rmt_prog, a.rmt_vers,
703 a.rmt_proc, transp->xp_netid, rbl);
704
705 if (rbl == NULL) {
706 #ifdef RPCBIND_DEBUG
707 if (debugging)
708 fprintf(stderr, "not found\n");
709 #endif
710 if (reply_type == RPCBPROC_INDIRECT)
711 svcerr_noprog(transp);
712 goto error;
713 }
714 if (rbl->rpcb_map.r_vers != a.rmt_vers) {
715 if (reply_type == RPCBPROC_INDIRECT) {
716 rpcvers_t vers_low, vers_high;
717
718 find_versions(a.rmt_prog, transp->xp_netid,
719 &vers_low, &vers_high);
720 svcerr_progvers(transp, vers_low, vers_high);
721 }
722 goto error;
723 }
724
725 #ifdef RPCBIND_DEBUG
726 if (debugging)
727 fprintf(stderr, "found at uaddr %s\n", rbl->rpcb_map.r_addr);
728 #endif
729 /*
730 * Check whether this entry is valid and a server is present
731 * Mergeaddr() returns NULL if no such entry is present, and
732 * returns "" if the entry was present but the server is not
733 * present (i.e., it crashed).
734 */
735 if (reply_type == RPCBPROC_INDIRECT) {
736 uaddr = mergeaddr(transp, transp->xp_netid,
737 rbl->rpcb_map.r_addr, NULL);
738 if (uaddr == NULL || uaddr[0] == '\0') {
739 svcerr_noprog(transp);
740 free(uaddr);
741 goto error;
742 }
743 free(uaddr);
744 }
745 nconf = rpcbind_get_conf(transp->xp_netid);
746 if (nconf == NULL) {
747 if (reply_type == RPCBPROC_INDIRECT)
748 svcerr_systemerr(transp);
749 if (debugging)
750 fprintf(stderr, "%s: rpcbind_get_conf failed\n",
751 __func__);
752 goto error;
753 }
754 localsa = local_sa(((struct sockaddr *)caller->buf)->sa_family);
755 if (localsa == NULL) {
756 if (debugging)
757 fprintf(stderr, "%s: no local address\n", __func__);
758 goto error;
759 }
760 tbuf.len = tbuf.maxlen = localsa->sa_len;
761 tbuf.buf = localsa;
762 local_uaddr =
763 addrmerge(&tbuf, rbl->rpcb_map.r_addr, NULL, nconf->nc_netid);
764 m_uaddr = addrmerge(caller, rbl->rpcb_map.r_addr, NULL,
765 nconf->nc_netid);
766 #ifdef RPCBIND_DEBUG
767 if (debugging)
768 fprintf(stderr, "%s: merged uaddr %s\n", __func__, m_uaddr);
769 #endif
770 if ((fd = find_rmtcallfd_by_netid(nconf->nc_netid)) == -1) {
771 if (reply_type == RPCBPROC_INDIRECT)
772 svcerr_systemerr(transp);
773 goto error;
774 }
775 xidp = __rpcb_get_dg_xidp(transp);
776 switch (forward_register(*xidp, caller, fd, m_uaddr, reply_type,
777 versnum, &call_msg.rm_xid)) {
778 case 1:
779 /* Success; forward_register() will free m_uaddr for us. */
780 m_uaddr = NULL;
781 break;
782 case 0:
783 /*
784 * A duplicate request for the slow server. Let's not
785 * beat on it any more.
786 */
787 if (debugging)
788 fprintf(stderr, "%s: duplicate request\n", __func__);
789 goto error;
790 case -1:
791 /* forward_register failed. Perhaps no memory. */
792 if (debugging)
793 fprintf(stderr, "%s: forward_register failed\n",
794 __func__);
795 goto error;
796 }
797
798 #ifdef DEBUG_RMTCALL
799 if (debugging)
800 fprintf(stderr, "%s: original XID %x, new XID %x\n", __func__,
801 *xidp, call_msg.rm_xid);
802 #endif
803 call_msg.rm_direction = CALL;
804 call_msg.rm_call.cb_rpcvers = RPC_MSG_VERSION;
805 call_msg.rm_call.cb_prog = a.rmt_prog;
806 call_msg.rm_call.cb_vers = a.rmt_vers;
807 if (sendsz > RPC_BUF_MAX) {
808 #ifdef notyet
809 outbuf_alloc = alloca(sendsz); /* not in IDR2? */
810 #else
811 outbuf_alloc = malloc(sendsz);
812 #endif /* notyet */
813 if (outbuf_alloc == NULL) {
814 if (reply_type == RPCBPROC_INDIRECT)
815 svcerr_systemerr(transp);
816 syslog(LOG_ERR, "%s: Cannot allocate memory", __func__);
817 goto error;
818 }
819 xdrmem_create(&outxdr, outbuf_alloc, sendsz, XDR_ENCODE);
820 } else {
821 xdrmem_create(&outxdr, outbuf, sendsz, XDR_ENCODE);
822 }
823 if (!xdr_callhdr(&outxdr, &call_msg)) {
824 if (reply_type == RPCBPROC_INDIRECT)
825 svcerr_systemerr(transp);
826 if (debugging)
827 fprintf(stderr, "%s: xdr_callhdr failed\n", __func__);
828 goto error;
829 }
830 if (!xdr_u_int32_t(&outxdr, &(a.rmt_proc))) {
831 if (reply_type == RPCBPROC_INDIRECT)
832 svcerr_systemerr(transp);
833 if (debugging)
834 fprintf(stderr, "%s: xdr_u_long failed\n", __func__);
835 goto error;
836 }
837
838 if (rqstp->rq_cred.oa_flavor == AUTH_NULL) {
839 auth = authnone_create();
840 } else if (rqstp->rq_cred.oa_flavor == AUTH_SYS) {
841 struct authunix_parms *au;
842
843 au = (struct authunix_parms *)rqstp->rq_clntcred;
844 auth = authunix_create(au->aup_machname,
845 au->aup_uid, au->aup_gid,
846 au->aup_len, au->aup_gids);
847 if (auth == NULL) /* fall back */
848 auth = authnone_create();
849 } else {
850 /* we do not support any other authentication scheme */
851 if (debugging)
852 fprintf(stderr, "%s: oa_flavor != AUTH_NONE and"
853 " oa_flavor != AUTH_SYS\n", __func__);
854 if (reply_type == RPCBPROC_INDIRECT)
855 svcerr_weakauth(transp); /* XXX too strong.. */
856 goto error;
857 }
858 if (auth == NULL) {
859 if (reply_type == RPCBPROC_INDIRECT)
860 svcerr_systemerr(transp);
861 if (debugging)
862 fprintf(stderr,
863 "%s: authwhatever_create returned NULL\n",
864 __func__);
865 goto error;
866 }
867 if (!AUTH_MARSHALL(auth, &outxdr)) {
868 if (reply_type == RPCBPROC_INDIRECT)
869 svcerr_systemerr(transp);
870 AUTH_DESTROY(auth);
871 if (debugging)
872 fprintf(stderr,
873 "%s: AUTH_MARSHALL failed\n", __func__);
874 goto error;
875 }
876 AUTH_DESTROY(auth);
877 if (!xdr_opaque_parms(&outxdr, &a)) {
878 if (reply_type == RPCBPROC_INDIRECT)
879 svcerr_systemerr(transp);
880 if (debugging)
881 fprintf(stderr, "%s: xdr_opaque_parms failed\n",
882 __func__);
883 goto error;
884 }
885 outlen = (int) XDR_GETPOS(&outxdr);
886 if (outbuf_alloc)
887 outbufp = outbuf_alloc;
888 else
889 outbufp = outbuf;
890
891 na = uaddr2taddr(nconf, local_uaddr);
892 if (!na) {
893 if (reply_type == RPCBPROC_INDIRECT)
894 svcerr_systemerr(transp);
895 goto error;
896 }
897
898 if (sendto(fd, outbufp, outlen, 0, (struct sockaddr *)na->buf, na->len)
899 != outlen) {
900 if (debugging)
901 fprintf(stderr, "%s: sendto failed (%s)\n", __func__,
902 strerror(errno));
903 if (reply_type == RPCBPROC_INDIRECT)
904 svcerr_systemerr(transp);
905 goto error;
906 }
907 goto out;
908
909 error:
910 if (call_msg.rm_xid != 0)
911 (void) free_slot_by_xid(call_msg.rm_xid);
912 out:
913 if (local_uaddr)
914 free(local_uaddr);
915 if (buf_alloc)
916 free(buf_alloc);
917 if (outbuf_alloc)
918 free(outbuf_alloc);
919 if (na) {
920 free(na->buf);
921 free(na);
922 }
923 if (m_uaddr != NULL)
924 free(m_uaddr);
925 }
926
927 /*
928 * Makes an entry into the FIFO for the given request.
929 * Returns 1 on success, 0 if this is a duplicate request, or -1 on error.
930 * *callxidp is set to the xid of the call.
931 */
932 static int
forward_register(u_int32_t caller_xid,struct netbuf * caller_addr,int forward_fd,char * uaddr,rpcproc_t reply_type,rpcvers_t versnum,u_int32_t * callxidp)933 forward_register(u_int32_t caller_xid, struct netbuf *caller_addr,
934 int forward_fd, char *uaddr, rpcproc_t reply_type,
935 rpcvers_t versnum, u_int32_t *callxidp)
936 {
937 int i;
938 int j = 0;
939 time_t min_time, time_now;
940 static u_int32_t lastxid;
941 int entry = -1;
942
943 min_time = FINFO[0].time;
944 time_now = time((time_t *)0);
945 /* initialization */
946 if (lastxid == 0)
947 lastxid = time_now * NFORWARD;
948
949 /*
950 * Check if it is a duplicate entry. Then,
951 * try to find an empty slot. If not available, then
952 * use the slot with the earliest time.
953 */
954 for (i = 0; i < NFORWARD; i++) {
955 if (FINFO[i].flag & FINFO_ACTIVE) {
956 if ((FINFO[i].caller_xid == caller_xid) &&
957 (FINFO[i].reply_type == reply_type) &&
958 (FINFO[i].versnum == versnum) &&
959 (!netbufcmp(FINFO[i].caller_addr,
960 caller_addr))) {
961 FINFO[i].time = time((time_t *)0);
962 return (0); /* Duplicate entry */
963 } else {
964 /* Should we wait any longer */
965 if ((time_now - FINFO[i].time) > MAXTIME_OFF)
966 (void) free_slot_by_index(i);
967 }
968 }
969 if (entry == -1) {
970 if ((FINFO[i].flag & FINFO_ACTIVE) == 0) {
971 entry = i;
972 } else if (FINFO[i].time < min_time) {
973 j = i;
974 min_time = FINFO[i].time;
975 }
976 }
977 }
978 if (entry != -1) {
979 /* use this empty slot */
980 j = entry;
981 } else {
982 (void) free_slot_by_index(j);
983 }
984 if ((FINFO[j].caller_addr = netbufdup(caller_addr)) == NULL) {
985 return (-1);
986 }
987 rpcb_rmtcalls++; /* no of pending calls */
988 FINFO[j].flag = FINFO_ACTIVE;
989 FINFO[j].reply_type = reply_type;
990 FINFO[j].versnum = versnum;
991 FINFO[j].time = time_now;
992 FINFO[j].caller_xid = caller_xid;
993 FINFO[j].forward_fd = forward_fd;
994 /*
995 * Though uaddr is not allocated here, it will still be freed
996 * from free_slot_*().
997 */
998 FINFO[j].uaddr = uaddr;
999 lastxid = lastxid + NFORWARD;
1000 /* Don't allow a zero xid below. */
1001 if ((u_int32_t)(lastxid + NFORWARD) <= NFORWARD)
1002 lastxid = NFORWARD;
1003 FINFO[j].forward_xid = lastxid + j; /* encode slot */
1004 *callxidp = FINFO[j].forward_xid; /* forward on this xid */
1005 return (1);
1006 }
1007
1008 static struct finfo *
forward_find(u_int32_t reply_xid)1009 forward_find(u_int32_t reply_xid)
1010 {
1011 int i;
1012
1013 i = reply_xid % NFORWARD;
1014 if (i < 0)
1015 i += NFORWARD;
1016 if ((FINFO[i].flag & FINFO_ACTIVE) &&
1017 (FINFO[i].forward_xid == reply_xid)) {
1018 return (&FINFO[i]);
1019 }
1020 return (NULL);
1021 }
1022
1023 static int
free_slot_by_xid(u_int32_t xid)1024 free_slot_by_xid(u_int32_t xid)
1025 {
1026 int entry;
1027
1028 entry = xid % NFORWARD;
1029 if (entry < 0)
1030 entry += NFORWARD;
1031 return (free_slot_by_index(entry));
1032 }
1033
1034 static int
free_slot_by_index(int idx)1035 free_slot_by_index(int idx)
1036 {
1037 struct finfo *fi;
1038
1039 fi = &FINFO[idx];
1040 if (fi->flag & FINFO_ACTIVE) {
1041 netbuffree(fi->caller_addr);
1042 /* XXX may be too big, but can't access xprt array here */
1043 if (fi->forward_fd >= *svc_fdset_getmax())
1044 (*svc_fdset_getmax())--;
1045 free(fi->uaddr);
1046 fi->flag &= ~FINFO_ACTIVE;
1047 rpcb_rmtcalls--;
1048 return (1);
1049 }
1050 return (0);
1051 }
1052
1053 static int
netbufcmp(struct netbuf * n1,struct netbuf * n2)1054 netbufcmp(struct netbuf *n1, struct netbuf *n2)
1055 {
1056 return ((n1->len != n2->len) || memcmp(n1->buf, n2->buf, n1->len));
1057 }
1058
1059 static bool_t
netbuf_copybuf(struct netbuf * dst,const struct netbuf * src)1060 netbuf_copybuf(struct netbuf *dst, const struct netbuf *src)
1061 {
1062 assert(src->len <= src->maxlen);
1063
1064 if (dst->maxlen < src->len || dst->buf == NULL) {
1065 if (dst->buf != NULL)
1066 free(dst->buf);
1067 if ((dst->buf = calloc(1, src->maxlen)) == NULL)
1068 return (FALSE);
1069 dst->maxlen = src->maxlen;
1070 }
1071
1072 dst->len = src->len;
1073 memcpy(dst->buf, src->buf, src->len);
1074
1075 return (TRUE);
1076 }
1077
1078 static struct netbuf *
netbufdup(struct netbuf * ap)1079 netbufdup(struct netbuf *ap)
1080 {
1081 struct netbuf *np;
1082
1083 if ((np = calloc(1, sizeof(struct netbuf))) == NULL)
1084 return (NULL);
1085 if (netbuf_copybuf(np, ap) == FALSE) {
1086 free(np);
1087 return (NULL);
1088 }
1089 return (np);
1090 }
1091
1092 static void
netbuffree(struct netbuf * ap)1093 netbuffree(struct netbuf *ap)
1094 {
1095 free(ap->buf);
1096 ap->buf = NULL;
1097 free(ap);
1098 }
1099
1100
1101 #define MASKVAL (POLLIN | POLLPRI | POLLRDNORM | POLLRDBAND)
1102 extern bool_t __svc_clean_idle(fd_set *, int, bool_t);
1103
1104 void
my_svc_run(void)1105 my_svc_run(void)
1106 {
1107 size_t nfds;
1108 struct pollfd *pollfds;
1109 int npollfds, newfdcount;
1110 int poll_ret, check_ret;
1111 int n, *m;
1112 #ifdef SVC_RUN_DEBUG
1113 size_t i;
1114 #endif
1115 struct pollfd *p;
1116
1117 pollfds = NULL;
1118 npollfds = 0;
1119
1120 for (;;) {
1121 newfdcount = svc_fdset_getsize(0);
1122 if (newfdcount != npollfds) {
1123 if (reallocarr(&pollfds,
1124 newfdcount, sizeof(*pollfds)) != 0) {
1125 wait:
1126 syslog(LOG_ERR, "Cannot allocate pollfds");
1127 sleep(1);
1128 continue;
1129 }
1130 npollfds = newfdcount;
1131 }
1132 p = pollfds;
1133 if ((m = svc_fdset_getmax()) == NULL)
1134 goto wait;
1135 for (n = 0; n <= *m; n++) {
1136 if (svc_fdset_isset(n)) {
1137 p->fd = n;
1138 p->events = MASKVAL;
1139 p++;
1140 }
1141 }
1142 nfds = p - pollfds;
1143 poll_ret = 0;
1144 #ifdef SVC_RUN_DEBUG
1145 if (debugging > 1) {
1146 fprintf(stderr, "%s: polling for read on fd < ",
1147 __func__);
1148 for (i = 0, p = pollfds; i < nfds; i++, p++)
1149 if (p->events)
1150 fprintf(stderr, "%d ", p->fd);
1151 fprintf(stderr, ">\n");
1152 }
1153 #endif
1154 #ifdef RPCBIND_RUMP
1155 poll_ret = rump_sys_poll(pollfds, nfds, 30 * 1000);
1156 #else
1157 poll_ret = poll(pollfds, nfds, 30 * 1000);
1158 #endif
1159 switch (poll_ret) {
1160 case -1:
1161 /*
1162 * We ignore all errors, continuing with the assumption
1163 * that it was set by the signal handlers (or any
1164 * other outside event) and not caused by poll().
1165 */
1166 #ifdef SVC_RUN_DEBUG
1167 if (debugging > 1) {
1168 fprintf(stderr, "%s: poll returned %d (%s)\n",
1169 __func__, poll_ret, strerror(errno));
1170 }
1171 #endif
1172 /* FALLTHROUGH */
1173 case 0:
1174 __svc_clean_idle(NULL, 30, FALSE);
1175 continue;
1176 default:
1177 #ifdef SVC_RUN_DEBUG
1178 if (debugging) {
1179 fprintf(stderr, "%s: poll returned read fds < ",
1180 __func__);
1181 for (i = 0, p = pollfds; i < nfds; i++, p++)
1182 if (p->revents)
1183 fprintf(stderr, "%d (%#x)",
1184 p->fd, p->revents);
1185 fprintf(stderr, ">\n");
1186 }
1187 #endif
1188 /*
1189 * If we found as many replies on callback fds
1190 * as the number of descriptors selectable which
1191 * poll() returned, there can be no more so we
1192 * don't call svc_getreq_poll. Otherwise, there
1193 * must be another so we must call svc_getreq_poll.
1194 */
1195 if ((check_ret = check_rmtcalls(pollfds, nfds)) ==
1196 poll_ret)
1197 continue;
1198 svc_getreq_poll(pollfds, poll_ret-check_ret);
1199 }
1200 #ifdef SVC_RUN_DEBUG
1201 if (debugging) {
1202 fprintf(stderr, "%s: svc_maxfd now %u\n", __func__,
1203 *svc_fdset_getmax());
1204 }
1205 #endif
1206 }
1207 }
1208
1209 static int
check_rmtcalls(struct pollfd * pfds,int nfds)1210 check_rmtcalls(struct pollfd *pfds, int nfds)
1211 {
1212 int j, ncallbacks_found = 0, rmtcalls_pending;
1213 SVCXPRT *xprt;
1214
1215 if (rpcb_rmtcalls == 0)
1216 return (0);
1217
1218 rmtcalls_pending = rpcb_rmtcalls;
1219 for (j = 0; j < nfds; j++) {
1220 if ((xprt = find_rmtcallxprt_by_fd(pfds[j].fd)) != NULL) {
1221 if (pfds[j].revents) {
1222 ncallbacks_found++;
1223 #ifdef DEBUG_RMTCALL
1224 if (debugging)
1225 fprintf(stderr, "%s: polled on forwarding "
1226 "fd %d, netid %s - calling handle_reply\n",
1227 __func__, pfds[j].fd, xprt->xp_netid);
1228 #endif
1229 handle_reply(pfds[j].fd, xprt);
1230 pfds[j].revents = 0;
1231 if (ncallbacks_found >= rmtcalls_pending) {
1232 break;
1233 }
1234 }
1235 }
1236 }
1237 return (ncallbacks_found);
1238 }
1239
1240 static void
xprt_set_caller(SVCXPRT * xprt,struct finfo * fi)1241 xprt_set_caller(SVCXPRT *xprt, struct finfo *fi)
1242 {
1243 u_int32_t *xidp;
1244
1245 netbuf_copybuf(svc_getrpccaller(xprt), fi->caller_addr);
1246 xidp = __rpcb_get_dg_xidp(xprt);
1247 *xidp = fi->caller_xid;
1248 }
1249
1250 /*
1251 * Call svcerr_systemerr() only if RPCBVERS4
1252 */
1253 static void
send_svcsyserr(SVCXPRT * xprt,struct finfo * fi)1254 send_svcsyserr(SVCXPRT *xprt, struct finfo *fi)
1255 {
1256 if (fi->reply_type == RPCBPROC_INDIRECT) {
1257 xprt_set_caller(xprt, fi);
1258 svcerr_systemerr(xprt);
1259 }
1260 return;
1261 }
1262
1263 static void
handle_reply(int fd,SVCXPRT * xprt)1264 handle_reply(int fd, SVCXPRT *xprt)
1265 {
1266 XDR reply_xdrs;
1267 struct rpc_msg reply_msg;
1268 struct rpc_err reply_error;
1269 char *buffer;
1270 struct finfo *fi;
1271 int inlen, pos, len;
1272 struct r_rmtcall_args a;
1273 struct sockaddr_storage ss;
1274 socklen_t fromlen;
1275 #ifdef SVC_RUN_DEBUG
1276 char *uaddr;
1277 #endif
1278
1279 reply_msg.rm_xid = 0;
1280
1281 buffer = malloc(RPC_BUF_MAX);
1282 if (buffer == NULL)
1283 goto done;
1284
1285 do {
1286 fromlen = sizeof(ss);
1287 inlen = recvfrom(fd, buffer, RPC_BUF_MAX, 0,
1288 (struct sockaddr *)&ss, &fromlen);
1289 } while (inlen < 0 && errno == EINTR);
1290 if (inlen < 0) {
1291 if (debugging)
1292 fprintf(stderr, "%s: recvfrom returned %d (%s)\n",
1293 __func__, inlen, strerror(errno));
1294 goto done;
1295 }
1296
1297 reply_msg.acpted_rply.ar_verf = _null_auth;
1298 reply_msg.acpted_rply.ar_results.where = 0;
1299 reply_msg.acpted_rply.ar_results.proc = (xdrproc_t) xdr_void;
1300
1301 xdrmem_create(&reply_xdrs, buffer, (u_int)inlen, XDR_DECODE);
1302 if (!xdr_replymsg(&reply_xdrs, &reply_msg)) {
1303 if (debugging)
1304 fprintf(stderr, "%s: xdr_replymsg failed\n", __func__);
1305 goto done;
1306 }
1307 fi = forward_find(reply_msg.rm_xid);
1308 #ifdef SVC_RUN_DEBUG
1309 if (debugging) {
1310 fprintf(stderr, "%s: reply xid: %d fi addr: %p\n",
1311 __func__, reply_msg.rm_xid, fi);
1312 }
1313 #endif
1314 if (fi == NULL) {
1315 goto done;
1316 }
1317 _seterr_reply(&reply_msg, &reply_error);
1318 if (reply_error.re_status != RPC_SUCCESS) {
1319 if (debugging)
1320 fprintf(stderr, "%s: %s\n", __func__,
1321 clnt_sperrno(reply_error.re_status));
1322 send_svcsyserr(xprt, fi);
1323 goto done;
1324 }
1325 pos = XDR_GETPOS(&reply_xdrs);
1326 len = inlen - pos;
1327 a.rmt_args.args = &buffer[pos];
1328 a.rmt_args.arglen = len;
1329 a.rmt_uaddr = fi->uaddr;
1330 a.rmt_localvers = fi->versnum;
1331
1332 xprt_set_caller(xprt, fi);
1333 #ifdef SVC_RUN_DEBUG
1334 uaddr = taddr2uaddr(rpcbind_get_conf("udp"),
1335 svc_getrpccaller(xprt));
1336 if (debugging) {
1337 fprintf(stderr, "%s:forwarding address %s to %s\n",
1338 __func__, a.rmt_uaddr, uaddr ? uaddr : rpcbind_unknown);
1339 }
1340 if (uaddr)
1341 free(uaddr);
1342 #endif
1343 svc_sendreply(xprt, (xdrproc_t) xdr_rmtcall_result, (char *) &a);
1344 done:
1345 if (buffer)
1346 free(buffer);
1347
1348 if (reply_msg.rm_xid == 0) {
1349 #ifdef SVC_RUN_DEBUG
1350 if (debugging) {
1351 fprintf(stderr, "%s: NULL xid on exit!\n", __func__);
1352 }
1353 #endif
1354 } else
1355 (void) free_slot_by_xid(reply_msg.rm_xid);
1356 return;
1357 }
1358
1359 static void
find_versions(rpcprog_t prog,char * netid,rpcvers_t * lowvp,rpcvers_t * highvp)1360 find_versions(rpcprog_t prog, char *netid, rpcvers_t *lowvp, rpcvers_t *highvp)
1361 {
1362 rpcblist_ptr rbl;
1363 rpcvers_t lowv = 0;
1364 rpcvers_t highv = 0;
1365
1366 for (rbl = list_rbl; rbl != NULL; rbl = rbl->rpcb_next) {
1367 if ((rbl->rpcb_map.r_prog != prog) ||
1368 ((rbl->rpcb_map.r_netid != NULL) &&
1369 (strcasecmp(rbl->rpcb_map.r_netid, netid) != 0)))
1370 continue;
1371 if (lowv == 0) {
1372 highv = rbl->rpcb_map.r_vers;
1373 lowv = highv;
1374 } else if (rbl->rpcb_map.r_vers < lowv) {
1375 lowv = rbl->rpcb_map.r_vers;
1376 } else if (rbl->rpcb_map.r_vers > highv) {
1377 highv = rbl->rpcb_map.r_vers;
1378 }
1379 }
1380 *lowvp = lowv;
1381 *highvp = highv;
1382 return;
1383 }
1384
1385 /*
1386 * returns the item with the given program, version number and netid.
1387 * If that version number is not found, it returns the item with that
1388 * program number, so that address is now returned to the caller. The
1389 * caller when makes a call to this program, version number, the call
1390 * will fail and it will return with PROGVERS_MISMATCH. The user can
1391 * then determine the highest and the lowest version number for this
1392 * program using clnt_geterr() and use those program version numbers.
1393 *
1394 * Returns the RPCBLIST for the given prog, vers and netid
1395 */
1396 static rpcblist_ptr
find_service(rpcprog_t prog,rpcvers_t vers,char * netid)1397 find_service(rpcprog_t prog, rpcvers_t vers, char *netid)
1398 {
1399 rpcblist_ptr hit = NULL;
1400 rpcblist_ptr rbl;
1401
1402 for (rbl = list_rbl; rbl != NULL; rbl = rbl->rpcb_next) {
1403 if ((rbl->rpcb_map.r_prog != prog) ||
1404 ((rbl->rpcb_map.r_netid != NULL) &&
1405 (strcasecmp(rbl->rpcb_map.r_netid, netid) != 0)))
1406 continue;
1407 hit = rbl;
1408 if (rbl->rpcb_map.r_vers == vers)
1409 break;
1410 }
1411 return (hit);
1412 }
1413
1414 /*
1415 * Copies the name associated with the uid of the caller and returns
1416 * a pointer to it. Similar to getwd().
1417 */
1418 static char *
getowner(SVCXPRT * transp,char * owner,size_t ownersize)1419 getowner(SVCXPRT *transp, char *owner, size_t ownersize)
1420 {
1421 struct sockcred *sc;
1422
1423 sc = __svc_getcallercreds(transp);
1424 if (sc == NULL)
1425 strlcpy(owner, rpcbind_unknown, ownersize);
1426 else if (sc->sc_uid == 0)
1427 strlcpy(owner, rpcbind_superuser, ownersize);
1428 else
1429 snprintf(owner, ownersize, "%d", sc->sc_uid);
1430
1431 return owner;
1432 }
1433
1434 #ifdef PORTMAP
1435 /*
1436 * Add this to the pmap list only if it is UDP or TCP.
1437 */
1438 static int
add_pmaplist(RPCB * arg)1439 add_pmaplist(RPCB *arg)
1440 {
1441 struct pmap pmap;
1442 struct pmaplist *pml;
1443 int h1, h2, h3, h4, p1, p2;
1444
1445 if (strcmp(arg->r_netid, udptrans) == 0) {
1446 /* It is UDP! */
1447 pmap.pm_prot = IPPROTO_UDP;
1448 } else if (strcmp(arg->r_netid, tcptrans) == 0) {
1449 /* It is TCP */
1450 pmap.pm_prot = IPPROTO_TCP;
1451 } else
1452 /* Not an IP protocol */
1453 return (0);
1454
1455 /* interpret the universal address for TCP/IP */
1456 if (sscanf(arg->r_addr, "%d.%d.%d.%d.%d.%d",
1457 &h1, &h2, &h3, &h4, &p1, &p2) != 6)
1458 return (0);
1459 pmap.pm_port = ((p1 & 0xff) << 8) + (p2 & 0xff);
1460 pmap.pm_prog = arg->r_prog;
1461 pmap.pm_vers = arg->r_vers;
1462 /*
1463 * add to END of list
1464 */
1465 pml = malloc(sizeof(*pml));
1466 if (pml == NULL) {
1467 syslog(LOG_ERR, "%s: Cannot allocate memory", __func__);
1468 return (1);
1469 }
1470 pml->pml_map = pmap;
1471 pml->pml_next = NULL;
1472 if (list_pml == NULL) {
1473 list_pml = pml;
1474 } else {
1475 struct pmaplist *fnd;
1476
1477 /* Attach to the end of the list */
1478 for (fnd = list_pml; fnd->pml_next; fnd = fnd->pml_next)
1479 continue;
1480 fnd->pml_next = pml;
1481 }
1482 return (0);
1483 }
1484
1485 /*
1486 * Delete this from the pmap list only if it is UDP or TCP.
1487 */
1488 static int
del_pmaplist(RPCB * arg)1489 del_pmaplist(RPCB *arg)
1490 {
1491 struct pmaplist *pml;
1492 struct pmaplist *prevpml, *fnd;
1493 unsigned long prot;
1494
1495 if (strcmp(arg->r_netid, udptrans) == 0) {
1496 /* It is UDP! */
1497 prot = IPPROTO_UDP;
1498 } else if (strcmp(arg->r_netid, tcptrans) == 0) {
1499 /* It is TCP */
1500 prot = IPPROTO_TCP;
1501 } else if (arg->r_netid[0] == 0) {
1502 prot = 0; /* Remove all occurrences */
1503 } else {
1504 /* Not an IP protocol */
1505 return (0);
1506 }
1507 for (prevpml = NULL, pml = list_pml; pml; /* cstyle */) {
1508 if ((pml->pml_map.pm_prog != arg->r_prog) ||
1509 (pml->pml_map.pm_vers != arg->r_vers) ||
1510 (prot && (pml->pml_map.pm_prot != prot))) {
1511 /* both pml & prevpml move forwards */
1512 prevpml = pml;
1513 pml = pml->pml_next;
1514 continue;
1515 }
1516 /* found it; pml moves forward, prevpml stays */
1517 fnd = pml;
1518 pml = pml->pml_next;
1519 if (prevpml == NULL)
1520 list_pml = pml;
1521 else
1522 prevpml->pml_next = pml;
1523 free(fnd);
1524 }
1525 return (0);
1526 }
1527 #endif /* PORTMAP */
1528