1 /* $NetBSD: rpcb_svc_com.c,v 1.9 2002/11/08 00:16:39 fvdl Exp $ */
2 /* $FreeBSD$ */
3
4 /*-
5 * Copyright (c) 2009, Sun Microsystems, Inc.
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions are met:
10 * - Redistributions of source code must retain the above copyright notice,
11 * this list of conditions and the following disclaimer.
12 * - Redistributions in binary form must reproduce the above copyright notice,
13 * this list of conditions and the following disclaimer in the documentation
14 * and/or other materials provided with the distribution.
15 * - Neither the name of Sun Microsystems, Inc. nor the names of its
16 * contributors may be used to endorse or promote products derived
17 * from this software without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
20 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
23 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29 * POSSIBILITY OF SUCH DAMAGE.
30 */
31 /*
32 * Copyright (c) 1986 - 1991 by Sun Microsystems, Inc.
33 */
34
35 /* #ident "@(#)rpcb_svc_com.c 1.18 94/05/02 SMI" */
36
37 /*
38 * rpcb_svc_com.c
39 * The commom server procedure for the rpcbind.
40 */
41
42 #include <sys/types.h>
43 #include <sys/stat.h>
44 #include <sys/param.h>
45 #include <sys/poll.h>
46 #include <sys/socket.h>
47 #include <rpc/rpc.h>
48 #include <rpc/rpcb_prot.h>
49 #include <rpc/svc_dg.h>
50 #include <assert.h>
51 #include <netconfig.h>
52 #include <errno.h>
53 #include <syslog.h>
54 #include <unistd.h>
55 #include <stdio.h>
56 #ifdef PORTMAP
57 #include <netinet/in.h>
58 #include <rpc/rpc_com.h>
59 #include <rpc/pmap_prot.h>
60 #endif /* PORTMAP */
61 #include <string.h>
62 #include <stdlib.h>
63
64 #include "rpcbind.h"
65
66 #define RPC_BUF_MAX 65536 /* can be raised if required */
67
68 static char *nullstring = "";
69 static int rpcb_rmtcalls;
70
71 struct rmtcallfd_list {
72 int fd;
73 SVCXPRT *xprt;
74 char *netid;
75 struct rmtcallfd_list *next;
76 };
77
78 #define NFORWARD 64
79 #define MAXTIME_OFF 300 /* 5 minutes */
80
81 struct finfo {
82 int flag;
83 #define FINFO_ACTIVE 0x1
84 u_int32_t caller_xid;
85 struct netbuf *caller_addr;
86 u_int32_t forward_xid;
87 int forward_fd;
88 char *uaddr;
89 rpcproc_t reply_type;
90 rpcvers_t versnum;
91 time_t time;
92 };
93 static struct finfo FINFO[NFORWARD];
94
95
96 static bool_t xdr_encap_parms(XDR *, struct encap_parms *);
97 static bool_t xdr_rmtcall_args(XDR *, struct r_rmtcall_args *);
98 static bool_t xdr_rmtcall_result(XDR *, struct r_rmtcall_args *);
99 static bool_t xdr_opaque_parms(XDR *, struct r_rmtcall_args *);
100 static int find_rmtcallfd_by_netid(char *);
101 static SVCXPRT *find_rmtcallxprt_by_fd(int);
102 static int forward_register(u_int32_t, struct netbuf *, int, char *,
103 rpcproc_t, rpcvers_t, u_int32_t *);
104 static struct finfo *forward_find(u_int32_t);
105 static int free_slot_by_xid(u_int32_t);
106 static int free_slot_by_index(int);
107 static int netbufcmp(struct netbuf *, struct netbuf *);
108 static struct netbuf *netbufdup(struct netbuf *);
109 static void netbuffree(struct netbuf *);
110 static int check_rmtcalls(struct pollfd *, int);
111 static void xprt_set_caller(SVCXPRT *, struct finfo *);
112 static void send_svcsyserr(SVCXPRT *, struct finfo *);
113 static void handle_reply(int, SVCXPRT *);
114 static void find_versions(rpcprog_t, char *, rpcvers_t *, rpcvers_t *);
115 static rpcblist_ptr find_service(rpcprog_t, rpcvers_t, char *);
116 static char *getowner(SVCXPRT *, char *, size_t);
117 static int add_pmaplist(RPCB *);
118 static int del_pmaplist(RPCB *);
119
120 /*
121 * Set a mapping of program, version, netid
122 */
123 /* ARGSUSED */
124 void *
rpcbproc_set_com(void * arg,struct svc_req * rqstp __unused,SVCXPRT * transp,rpcvers_t rpcbversnum)125 rpcbproc_set_com(void *arg, struct svc_req *rqstp __unused, SVCXPRT *transp,
126 rpcvers_t rpcbversnum)
127 {
128 RPCB *regp = (RPCB *)arg;
129 static bool_t ans;
130 char owner[64];
131
132 #ifdef RPCBIND_DEBUG
133 if (debugging)
134 fprintf(stderr, "RPCB_SET request for (%lu, %lu, %s, %s) : ",
135 (unsigned long)regp->r_prog, (unsigned long)regp->r_vers,
136 regp->r_netid, regp->r_addr);
137 #endif
138 ans = map_set(regp, getowner(transp, owner, sizeof owner));
139 #ifdef RPCBIND_DEBUG
140 if (debugging)
141 fprintf(stderr, "%s\n", ans == TRUE ? "succeeded" : "failed");
142 #endif
143 /* XXX: should have used some defined constant here */
144 rpcbs_set(rpcbversnum - 2, ans);
145 return (void *)&ans;
146 }
147
148 bool_t
map_set(RPCB * regp,char * owner)149 map_set(RPCB *regp, char *owner)
150 {
151 RPCB reg, *a;
152 rpcblist_ptr rbl, fnd;
153
154 reg = *regp;
155 /*
156 * check to see if already used
157 * find_service returns a hit even if
158 * the versions don't match, so check for it
159 */
160 fnd = find_service(reg.r_prog, reg.r_vers, reg.r_netid);
161 if (fnd && (fnd->rpcb_map.r_vers == reg.r_vers)) {
162 if (!strcmp(fnd->rpcb_map.r_addr, reg.r_addr))
163 /*
164 * if these match then it is already
165 * registered so just say "OK".
166 */
167 return (TRUE);
168 else
169 return (FALSE);
170 }
171 /*
172 * add to the end of the list
173 */
174 rbl = malloc(sizeof (RPCBLIST));
175 if (rbl == NULL)
176 return (FALSE);
177 a = &(rbl->rpcb_map);
178 a->r_prog = reg.r_prog;
179 a->r_vers = reg.r_vers;
180 a->r_netid = strdup(reg.r_netid);
181 a->r_addr = strdup(reg.r_addr);
182 a->r_owner = strdup(owner);
183 if (!a->r_addr || !a->r_netid || !a->r_owner) {
184 if (a->r_netid)
185 free(a->r_netid);
186 if (a->r_addr)
187 free(a->r_addr);
188 if (a->r_owner)
189 free(a->r_owner);
190 free(rbl);
191 return (FALSE);
192 }
193 rbl->rpcb_next = (rpcblist_ptr)NULL;
194 if (list_rbl == NULL) {
195 list_rbl = rbl;
196 } else {
197 for (fnd = list_rbl; fnd->rpcb_next;
198 fnd = fnd->rpcb_next)
199 ;
200 fnd->rpcb_next = rbl;
201 }
202 #ifdef PORTMAP
203 (void) add_pmaplist(regp);
204 #endif
205 return (TRUE);
206 }
207
208 /*
209 * Unset a mapping of program, version, netid
210 */
211 /* ARGSUSED */
212 void *
rpcbproc_unset_com(void * arg,struct svc_req * rqstp __unused,SVCXPRT * transp,rpcvers_t rpcbversnum)213 rpcbproc_unset_com(void *arg, struct svc_req *rqstp __unused, SVCXPRT *transp,
214 rpcvers_t rpcbversnum)
215 {
216 RPCB *regp = (RPCB *)arg;
217 static bool_t ans;
218 char owner[64];
219
220 #ifdef RPCBIND_DEBUG
221 if (debugging)
222 fprintf(stderr, "RPCB_UNSET request for (%lu, %lu, %s) : ",
223 (unsigned long)regp->r_prog, (unsigned long)regp->r_vers,
224 regp->r_netid);
225 #endif
226 ans = map_unset(regp, getowner(transp, owner, sizeof owner));
227 #ifdef RPCBIND_DEBUG
228 if (debugging)
229 fprintf(stderr, "%s\n", ans == TRUE ? "succeeded" : "failed");
230 #endif
231 /* XXX: should have used some defined constant here */
232 rpcbs_unset(rpcbversnum - 2, ans);
233 return (void *)&ans;
234 }
235
236 bool_t
map_unset(RPCB * regp,char * owner)237 map_unset(RPCB *regp, char *owner)
238 {
239 int ans = 0;
240 rpcblist_ptr rbl, prev, tmp;
241
242 if (owner == NULL)
243 return (0);
244
245 for (prev = NULL, rbl = list_rbl; rbl; /* cstyle */) {
246 if ((rbl->rpcb_map.r_prog != regp->r_prog) ||
247 (rbl->rpcb_map.r_vers != regp->r_vers) ||
248 (regp->r_netid[0] && strcasecmp(regp->r_netid,
249 rbl->rpcb_map.r_netid))) {
250 /* both rbl & prev move forwards */
251 prev = rbl;
252 rbl = rbl->rpcb_next;
253 continue;
254 }
255 /*
256 * Check whether appropriate uid. Unset only
257 * if superuser or the owner itself.
258 */
259 if (strcmp(owner, "superuser") &&
260 strcmp(rbl->rpcb_map.r_owner, owner))
261 return (0);
262 /* found it; rbl moves forward, prev stays */
263 ans = 1;
264 tmp = rbl;
265 rbl = rbl->rpcb_next;
266 if (prev == NULL)
267 list_rbl = rbl;
268 else
269 prev->rpcb_next = rbl;
270 free(tmp->rpcb_map.r_addr);
271 free(tmp->rpcb_map.r_netid);
272 free(tmp->rpcb_map.r_owner);
273 free(tmp);
274 }
275 #ifdef PORTMAP
276 if (ans)
277 (void) del_pmaplist(regp);
278 #endif
279 /*
280 * We return 1 either when the entry was not there or it
281 * was able to unset it. It can come to this point only if
282 * atleast one of the conditions is true.
283 */
284 return (1);
285 }
286
287 void
delete_prog(unsigned int prog)288 delete_prog(unsigned int prog)
289 {
290 RPCB reg;
291 register rpcblist_ptr rbl;
292
293 for (rbl = list_rbl; rbl != NULL; rbl = rbl->rpcb_next) {
294 if ((rbl->rpcb_map.r_prog != prog))
295 continue;
296 if (is_bound(rbl->rpcb_map.r_netid, rbl->rpcb_map.r_addr))
297 continue;
298 reg.r_prog = rbl->rpcb_map.r_prog;
299 reg.r_vers = rbl->rpcb_map.r_vers;
300 reg.r_netid = strdup(rbl->rpcb_map.r_netid);
301 (void) map_unset(®, "superuser");
302 free(reg.r_netid);
303 }
304 }
305
306 void *
rpcbproc_getaddr_com(RPCB * regp,struct svc_req * rqstp __unused,SVCXPRT * transp,rpcvers_t rpcbversnum,rpcvers_t verstype)307 rpcbproc_getaddr_com(RPCB *regp, struct svc_req *rqstp __unused,
308 SVCXPRT *transp, rpcvers_t rpcbversnum, rpcvers_t verstype)
309 {
310 static char *uaddr;
311 char *saddr = NULL;
312 rpcblist_ptr fnd;
313
314 if (uaddr != NULL && uaddr != nullstring) {
315 free(uaddr);
316 uaddr = NULL;
317 }
318 fnd = find_service(regp->r_prog, regp->r_vers, transp->xp_netid);
319 if (fnd && ((verstype == RPCB_ALLVERS) ||
320 (regp->r_vers == fnd->rpcb_map.r_vers))) {
321 if (*(regp->r_addr) != '\0') { /* may contain a hint about */
322 saddr = regp->r_addr; /* the interface that we */
323 } /* should use */
324 if (!(uaddr = mergeaddr(transp, transp->xp_netid,
325 fnd->rpcb_map.r_addr, saddr))) {
326 /* Try whatever we have */
327 uaddr = strdup(fnd->rpcb_map.r_addr);
328 } else if (!uaddr[0]) {
329 /*
330 * The server died. Unset all versions of this prog.
331 */
332 delete_prog(regp->r_prog);
333 uaddr = nullstring;
334 }
335 } else {
336 uaddr = nullstring;
337 }
338 #ifdef RPCBIND_DEBUG
339 if (debugging)
340 fprintf(stderr, "getaddr: %s\n", uaddr);
341 #endif
342 /* XXX: should have used some defined constant here */
343 rpcbs_getaddr(rpcbversnum - 2, regp->r_prog, regp->r_vers,
344 transp->xp_netid, uaddr);
345 return (void *)&uaddr;
346 }
347
348 /* ARGSUSED */
349 void *
rpcbproc_gettime_com(void * arg __unused,struct svc_req * rqstp __unused,SVCXPRT * transp __unused,rpcvers_t rpcbversnum __unused)350 rpcbproc_gettime_com(void *arg __unused, struct svc_req *rqstp __unused,
351 SVCXPRT *transp __unused, rpcvers_t rpcbversnum __unused)
352 {
353 static time_t curtime;
354
355 (void) time(&curtime);
356 return (void *)&curtime;
357 }
358
359 /*
360 * Convert uaddr to taddr. Should be used only by
361 * local servers/clients. (kernel level stuff only)
362 */
363 /* ARGSUSED */
364 void *
rpcbproc_uaddr2taddr_com(void * arg,struct svc_req * rqstp __unused,SVCXPRT * transp,rpcvers_t rpcbversnum __unused)365 rpcbproc_uaddr2taddr_com(void *arg, struct svc_req *rqstp __unused,
366 SVCXPRT *transp, rpcvers_t rpcbversnum __unused)
367 {
368 char **uaddrp = (char **)arg;
369 struct netconfig *nconf;
370 static struct netbuf nbuf;
371 static struct netbuf *taddr;
372
373 if (taddr) {
374 free(taddr->buf);
375 free(taddr);
376 taddr = NULL;
377 }
378 if (((nconf = rpcbind_get_conf(transp->xp_netid)) == NULL) ||
379 ((taddr = uaddr2taddr(nconf, *uaddrp)) == NULL)) {
380 (void) memset((char *)&nbuf, 0, sizeof (struct netbuf));
381 return (void *)&nbuf;
382 }
383 return (void *)taddr;
384 }
385
386 /*
387 * Convert taddr to uaddr. Should be used only by
388 * local servers/clients. (kernel level stuff only)
389 */
390 /* ARGSUSED */
391 void *
rpcbproc_taddr2uaddr_com(void * arg,struct svc_req * rqstp __unused,SVCXPRT * transp,rpcvers_t rpcbversnum __unused)392 rpcbproc_taddr2uaddr_com(void *arg, struct svc_req *rqstp __unused,
393 SVCXPRT *transp, rpcvers_t rpcbversnum __unused)
394 {
395 struct netbuf *taddr = (struct netbuf *)arg;
396 static char *uaddr;
397 struct netconfig *nconf;
398
399 #ifdef CHEW_FDS
400 int fd;
401
402 if ((fd = open("/dev/null", O_RDONLY)) == -1) {
403 uaddr = (char *)strerror(errno);
404 return (&uaddr);
405 }
406 #endif /* CHEW_FDS */
407 if (uaddr != NULL && uaddr != nullstring) {
408 free(uaddr);
409 uaddr = NULL;
410 }
411 if (((nconf = rpcbind_get_conf(transp->xp_netid)) == NULL) ||
412 ((uaddr = taddr2uaddr(nconf, taddr)) == NULL)) {
413 uaddr = nullstring;
414 }
415 return (void *)&uaddr;
416 }
417
418
419 static bool_t
xdr_encap_parms(XDR * xdrs,struct encap_parms * epp)420 xdr_encap_parms(XDR *xdrs, struct encap_parms *epp)
421 {
422 return (xdr_bytes(xdrs, &(epp->args), (u_int *) &(epp->arglen),
423 RPC_MAXDATASIZE));
424 }
425
426 /*
427 * XDR remote call arguments. It ignores the address part.
428 * written for XDR_DECODE direction only
429 */
430 static bool_t
xdr_rmtcall_args(XDR * xdrs,struct r_rmtcall_args * cap)431 xdr_rmtcall_args(XDR *xdrs, struct r_rmtcall_args *cap)
432 {
433 /* does not get the address or the arguments */
434 if (xdr_rpcprog(xdrs, &(cap->rmt_prog)) &&
435 xdr_rpcvers(xdrs, &(cap->rmt_vers)) &&
436 xdr_rpcproc(xdrs, &(cap->rmt_proc))) {
437 return (xdr_encap_parms(xdrs, &(cap->rmt_args)));
438 }
439 return (FALSE);
440 }
441
442 /*
443 * XDR remote call results along with the address. Ignore
444 * program number, version number and proc number.
445 * Written for XDR_ENCODE direction only.
446 */
447 static bool_t
xdr_rmtcall_result(XDR * xdrs,struct r_rmtcall_args * cap)448 xdr_rmtcall_result(XDR *xdrs, struct r_rmtcall_args *cap)
449 {
450 bool_t result;
451
452 #ifdef PORTMAP
453 if (cap->rmt_localvers == PMAPVERS) {
454 int h1, h2, h3, h4, p1, p2;
455 u_long port;
456
457 /* interpret the universal address for TCP/IP */
458 if (sscanf(cap->rmt_uaddr, "%d.%d.%d.%d.%d.%d",
459 &h1, &h2, &h3, &h4, &p1, &p2) != 6)
460 return (FALSE);
461 port = ((p1 & 0xff) << 8) + (p2 & 0xff);
462 result = xdr_u_long(xdrs, &port);
463 } else
464 #endif
465 if ((cap->rmt_localvers == RPCBVERS) ||
466 (cap->rmt_localvers == RPCBVERS4)) {
467 result = xdr_wrapstring(xdrs, &(cap->rmt_uaddr));
468 } else {
469 return (FALSE);
470 }
471 if (result == TRUE)
472 return (xdr_encap_parms(xdrs, &(cap->rmt_args)));
473 return (FALSE);
474 }
475
476 /*
477 * only worries about the struct encap_parms part of struct r_rmtcall_args.
478 * The arglen must already be set!!
479 */
480 static bool_t
xdr_opaque_parms(XDR * xdrs,struct r_rmtcall_args * cap)481 xdr_opaque_parms(XDR *xdrs, struct r_rmtcall_args *cap)
482 {
483 return (xdr_opaque(xdrs, cap->rmt_args.args, cap->rmt_args.arglen));
484 }
485
486 static struct rmtcallfd_list *rmthead;
487 static struct rmtcallfd_list *rmttail;
488
489 int
create_rmtcall_fd(struct netconfig * nconf)490 create_rmtcall_fd(struct netconfig *nconf)
491 {
492 int fd;
493 struct rmtcallfd_list *rmt;
494 SVCXPRT *xprt;
495
496 if ((fd = __rpc_nconf2fd(nconf)) == -1) {
497 if (debugging)
498 fprintf(stderr,
499 "create_rmtcall_fd: couldn't open \"%s\" (errno %d)\n",
500 nconf->nc_device, errno);
501 return (-1);
502 }
503 xprt = svc_tli_create(fd, 0, (struct t_bind *) 0, 0, 0);
504 if (xprt == NULL) {
505 if (debugging)
506 fprintf(stderr,
507 "create_rmtcall_fd: svc_tli_create failed\n");
508 return (-1);
509 }
510 rmt = malloc(sizeof (struct rmtcallfd_list));
511 if (rmt == NULL) {
512 syslog(LOG_ERR, "create_rmtcall_fd: no memory!");
513 return (-1);
514 }
515 rmt->xprt = xprt;
516 rmt->netid = strdup(nconf->nc_netid);
517 xprt->xp_netid = rmt->netid;
518 rmt->fd = fd;
519 rmt->next = NULL;
520 if (rmthead == NULL) {
521 rmthead = rmt;
522 rmttail = rmt;
523 } else {
524 rmttail->next = rmt;
525 rmttail = rmt;
526 }
527 /* XXX not threadsafe */
528 if (fd > svc_maxfd)
529 svc_maxfd = fd;
530 FD_SET(fd, &svc_fdset);
531 return (fd);
532 }
533
534 static int
find_rmtcallfd_by_netid(char * netid)535 find_rmtcallfd_by_netid(char *netid)
536 {
537 struct rmtcallfd_list *rmt;
538
539 for (rmt = rmthead; rmt != NULL; rmt = rmt->next) {
540 if (strcmp(netid, rmt->netid) == 0) {
541 return (rmt->fd);
542 }
543 }
544 return (-1);
545 }
546
547 static SVCXPRT *
find_rmtcallxprt_by_fd(int fd)548 find_rmtcallxprt_by_fd(int fd)
549 {
550 struct rmtcallfd_list *rmt;
551
552 for (rmt = rmthead; rmt != NULL; rmt = rmt->next) {
553 if (fd == rmt->fd) {
554 return (rmt->xprt);
555 }
556 }
557 return (NULL);
558 }
559
560
561 /*
562 * Call a remote procedure service. This procedure is very quiet when things
563 * go wrong. The proc is written to support broadcast rpc. In the broadcast
564 * case, a machine should shut-up instead of complain, lest the requestor be
565 * overrun with complaints at the expense of not hearing a valid reply.
566 * When receiving a request and verifying that the service exists, we
567 *
568 * receive the request
569 *
570 * open a new TLI endpoint on the same transport on which we received
571 * the original request
572 *
573 * remember the original request's XID (which requires knowing the format
574 * of the svc_dg_data structure)
575 *
576 * forward the request, with a new XID, to the requested service,
577 * remembering the XID used to send this request (for later use in
578 * reassociating the answer with the original request), the requestor's
579 * address, the file descriptor on which the forwarded request is
580 * made and the service's address.
581 *
582 * mark the file descriptor on which we anticipate receiving a reply from
583 * the service and one to select for in our private svc_run procedure
584 *
585 * At some time in the future, a reply will be received from the service to
586 * which we forwarded the request. At that time, we detect that the socket
587 * used was for forwarding (by looking through the finfo structures to see
588 * whether the fd corresponds to one of those) and call handle_reply() to
589 *
590 * receive the reply
591 *
592 * bundle the reply, along with the service's universal address
593 *
594 * create a SVCXPRT structure and use a version of svc_sendreply
595 * that allows us to specify the reply XID and destination, send the reply
596 * to the original requestor.
597 */
598
599 void
rpcbproc_callit_com(struct svc_req * rqstp,SVCXPRT * transp,rpcproc_t reply_type,rpcvers_t versnum)600 rpcbproc_callit_com(struct svc_req *rqstp, SVCXPRT *transp,
601 rpcproc_t reply_type, rpcvers_t versnum)
602 {
603 register rpcblist_ptr rbl;
604 struct netconfig *nconf;
605 struct netbuf *caller;
606 struct r_rmtcall_args a;
607 char *buf_alloc = NULL, *outbufp;
608 char *outbuf_alloc = NULL;
609 char buf[RPC_BUF_MAX], outbuf[RPC_BUF_MAX];
610 struct netbuf *na = (struct netbuf *) NULL;
611 struct rpc_msg call_msg;
612 int outlen;
613 u_int sendsz;
614 XDR outxdr;
615 AUTH *auth;
616 int fd = -1;
617 char *uaddr, *m_uaddr = NULL, *local_uaddr = NULL;
618 u_int32_t *xidp;
619 struct __rpc_sockinfo si;
620 struct sockaddr *localsa;
621 struct netbuf tbuf;
622
623 if (!__rpc_fd2sockinfo(transp->xp_fd, &si)) {
624 if (reply_type == RPCBPROC_INDIRECT)
625 svcerr_systemerr(transp);
626 return;
627 }
628 if (si.si_socktype != SOCK_DGRAM)
629 return; /* Only datagram type accepted */
630 sendsz = __rpc_get_t_size(si.si_af, si.si_proto, UDPMSGSIZE);
631 if (sendsz == 0) { /* data transfer not supported */
632 if (reply_type == RPCBPROC_INDIRECT)
633 svcerr_systemerr(transp);
634 return;
635 }
636 /*
637 * Should be multiple of 4 for XDR.
638 */
639 sendsz = roundup(sendsz, 4);
640 if (sendsz > RPC_BUF_MAX) {
641 #ifdef notyet
642 buf_alloc = alloca(sendsz); /* not in IDR2? */
643 #else
644 buf_alloc = malloc(sendsz);
645 #endif /* notyet */
646 if (buf_alloc == NULL) {
647 if (debugging)
648 fprintf(stderr,
649 "rpcbproc_callit_com: No Memory!\n");
650 if (reply_type == RPCBPROC_INDIRECT)
651 svcerr_systemerr(transp);
652 return;
653 }
654 a.rmt_args.args = buf_alloc;
655 } else {
656 a.rmt_args.args = buf;
657 }
658
659 call_msg.rm_xid = 0; /* For error checking purposes */
660 if (!svc_getargs(transp, (xdrproc_t) xdr_rmtcall_args, (char *) &a)) {
661 if (reply_type == RPCBPROC_INDIRECT)
662 svcerr_decode(transp);
663 if (debugging)
664 fprintf(stderr,
665 "rpcbproc_callit_com: svc_getargs failed\n");
666 goto error;
667 }
668
669 if (!check_callit(transp, &a, versnum)) {
670 svcerr_weakauth(transp);
671 goto error;
672 }
673
674 caller = svc_getrpccaller(transp);
675 #ifdef RPCBIND_DEBUG
676 if (debugging) {
677 uaddr = taddr2uaddr(rpcbind_get_conf(transp->xp_netid), caller);
678 fprintf(stderr, "%s %s req for (%lu, %lu, %lu, %s) from %s : ",
679 versnum == PMAPVERS ? "pmap_rmtcall" :
680 versnum == RPCBVERS ? "rpcb_rmtcall" :
681 versnum == RPCBVERS4 ? "rpcb_indirect" : "unknown",
682 reply_type == RPCBPROC_INDIRECT ? "indirect" : "callit",
683 (unsigned long)a.rmt_prog, (unsigned long)a.rmt_vers,
684 (unsigned long)a.rmt_proc, transp->xp_netid,
685 uaddr ? uaddr : "unknown");
686 if (uaddr)
687 free(uaddr);
688 }
689 #endif
690
691 rbl = find_service(a.rmt_prog, a.rmt_vers, transp->xp_netid);
692
693 rpcbs_rmtcall(versnum - 2, reply_type, a.rmt_prog, a.rmt_vers,
694 a.rmt_proc, transp->xp_netid, rbl);
695
696 if (rbl == (rpcblist_ptr)NULL) {
697 #ifdef RPCBIND_DEBUG
698 if (debugging)
699 fprintf(stderr, "not found\n");
700 #endif
701 if (reply_type == RPCBPROC_INDIRECT)
702 svcerr_noprog(transp);
703 goto error;
704 }
705 if (rbl->rpcb_map.r_vers != a.rmt_vers) {
706 if (reply_type == RPCBPROC_INDIRECT) {
707 rpcvers_t vers_low, vers_high;
708
709 find_versions(a.rmt_prog, transp->xp_netid,
710 &vers_low, &vers_high);
711 svcerr_progvers(transp, vers_low, vers_high);
712 }
713 goto error;
714 }
715
716 #ifdef RPCBIND_DEBUG
717 if (debugging)
718 fprintf(stderr, "found at uaddr %s\n", rbl->rpcb_map.r_addr);
719 #endif
720 /*
721 * Check whether this entry is valid and a server is present
722 * Mergeaddr() returns NULL if no such entry is present, and
723 * returns "" if the entry was present but the server is not
724 * present (i.e., it crashed).
725 */
726 if (reply_type == RPCBPROC_INDIRECT) {
727 uaddr = mergeaddr(transp, transp->xp_netid,
728 rbl->rpcb_map.r_addr, NULL);
729 if (uaddr == NULL || uaddr[0] == '\0') {
730 svcerr_noprog(transp);
731 if (uaddr != NULL)
732 free(uaddr);
733 goto error;
734 }
735 free(uaddr);
736 }
737 nconf = rpcbind_get_conf(transp->xp_netid);
738 if (nconf == (struct netconfig *)NULL) {
739 if (reply_type == RPCBPROC_INDIRECT)
740 svcerr_systemerr(transp);
741 if (debugging)
742 fprintf(stderr,
743 "rpcbproc_callit_com: rpcbind_get_conf failed\n");
744 goto error;
745 }
746 localsa = local_sa(((struct sockaddr *)caller->buf)->sa_family);
747 if (localsa == NULL) {
748 if (debugging)
749 fprintf(stderr,
750 "rpcbproc_callit_com: no local address\n");
751 goto error;
752 }
753 tbuf.len = tbuf.maxlen = localsa->sa_len;
754 tbuf.buf = localsa;
755 local_uaddr =
756 addrmerge(&tbuf, rbl->rpcb_map.r_addr, NULL, nconf->nc_netid);
757 m_uaddr = addrmerge(caller, rbl->rpcb_map.r_addr, NULL,
758 nconf->nc_netid);
759 #ifdef RPCBIND_DEBUG
760 if (debugging)
761 fprintf(stderr, "merged uaddr %s\n", m_uaddr);
762 #endif
763 if ((fd = find_rmtcallfd_by_netid(nconf->nc_netid)) == -1) {
764 if (reply_type == RPCBPROC_INDIRECT)
765 svcerr_systemerr(transp);
766 goto error;
767 }
768 xidp = __rpcb_get_dg_xidp(transp);
769 switch (forward_register(*xidp, caller, fd, m_uaddr, reply_type,
770 versnum, &call_msg.rm_xid)) {
771 case 1:
772 /* Success; forward_register() will free m_uaddr for us. */
773 m_uaddr = NULL;
774 break;
775 case 0:
776 /*
777 * A duplicate request for the slow server. Let's not
778 * beat on it any more.
779 */
780 if (debugging)
781 fprintf(stderr,
782 "rpcbproc_callit_com: duplicate request\n");
783 goto error;
784 case -1:
785 /* forward_register failed. Perhaps no memory. */
786 if (debugging)
787 fprintf(stderr,
788 "rpcbproc_callit_com: forward_register failed\n");
789 goto error;
790 }
791
792 #ifdef DEBUG_RMTCALL
793 if (debugging)
794 fprintf(stderr,
795 "rpcbproc_callit_com: original XID %x, new XID %x\n",
796 *xidp, call_msg.rm_xid);
797 #endif
798 call_msg.rm_direction = CALL;
799 call_msg.rm_call.cb_rpcvers = RPC_MSG_VERSION;
800 call_msg.rm_call.cb_prog = a.rmt_prog;
801 call_msg.rm_call.cb_vers = a.rmt_vers;
802 if (sendsz > RPC_BUF_MAX) {
803 #ifdef notyet
804 outbuf_alloc = alloca(sendsz); /* not in IDR2? */
805 #else
806 outbuf_alloc = malloc(sendsz);
807 #endif /* notyet */
808 if (outbuf_alloc == NULL) {
809 if (reply_type == RPCBPROC_INDIRECT)
810 svcerr_systemerr(transp);
811 if (debugging)
812 fprintf(stderr,
813 "rpcbproc_callit_com: No memory!\n");
814 goto error;
815 }
816 xdrmem_create(&outxdr, outbuf_alloc, sendsz, XDR_ENCODE);
817 } else {
818 xdrmem_create(&outxdr, outbuf, sendsz, XDR_ENCODE);
819 }
820 if (!xdr_callhdr(&outxdr, &call_msg)) {
821 if (reply_type == RPCBPROC_INDIRECT)
822 svcerr_systemerr(transp);
823 if (debugging)
824 fprintf(stderr,
825 "rpcbproc_callit_com: xdr_callhdr failed\n");
826 goto error;
827 }
828 if (!xdr_u_int32_t(&outxdr, &(a.rmt_proc))) {
829 if (reply_type == RPCBPROC_INDIRECT)
830 svcerr_systemerr(transp);
831 if (debugging)
832 fprintf(stderr,
833 "rpcbproc_callit_com: xdr_u_long failed\n");
834 goto error;
835 }
836
837 if (rqstp->rq_cred.oa_flavor == AUTH_NULL) {
838 auth = authnone_create();
839 } else if (rqstp->rq_cred.oa_flavor == AUTH_SYS) {
840 struct authunix_parms *au;
841
842 au = (struct authunix_parms *)rqstp->rq_clntcred;
843 auth = authunix_create(au->aup_machname,
844 au->aup_uid, au->aup_gid,
845 au->aup_len, au->aup_gids);
846 if (auth == NULL) /* fall back */
847 auth = authnone_create();
848 } else {
849 /* we do not support any other authentication scheme */
850 if (debugging)
851 fprintf(stderr,
852 "rpcbproc_callit_com: oa_flavor != AUTH_NONE and oa_flavor != AUTH_SYS\n");
853 if (reply_type == RPCBPROC_INDIRECT)
854 svcerr_weakauth(transp); /* XXX too strong.. */
855 goto error;
856 }
857 if (auth == NULL) {
858 if (reply_type == RPCBPROC_INDIRECT)
859 svcerr_systemerr(transp);
860 if (debugging)
861 fprintf(stderr,
862 "rpcbproc_callit_com: authwhatever_create returned NULL\n");
863 goto error;
864 }
865 if (!AUTH_MARSHALL(auth, &outxdr)) {
866 if (reply_type == RPCBPROC_INDIRECT)
867 svcerr_systemerr(transp);
868 AUTH_DESTROY(auth);
869 if (debugging)
870 fprintf(stderr,
871 "rpcbproc_callit_com: AUTH_MARSHALL failed\n");
872 goto error;
873 }
874 AUTH_DESTROY(auth);
875 if (!xdr_opaque_parms(&outxdr, &a)) {
876 if (reply_type == RPCBPROC_INDIRECT)
877 svcerr_systemerr(transp);
878 if (debugging)
879 fprintf(stderr,
880 "rpcbproc_callit_com: xdr_opaque_parms failed\n");
881 goto error;
882 }
883 outlen = (int) XDR_GETPOS(&outxdr);
884 if (outbuf_alloc)
885 outbufp = outbuf_alloc;
886 else
887 outbufp = outbuf;
888
889 na = uaddr2taddr(nconf, local_uaddr);
890 if (!na) {
891 if (reply_type == RPCBPROC_INDIRECT)
892 svcerr_systemerr(transp);
893 goto error;
894 }
895
896 if (sendto(fd, outbufp, outlen, 0, (struct sockaddr *)na->buf, na->len)
897 != outlen) {
898 if (debugging)
899 fprintf(stderr,
900 "rpcbproc_callit_com: sendto failed: errno %d\n", errno);
901 if (reply_type == RPCBPROC_INDIRECT)
902 svcerr_systemerr(transp);
903 goto error;
904 }
905 goto out;
906
907 error:
908 if (call_msg.rm_xid != 0)
909 (void) free_slot_by_xid(call_msg.rm_xid);
910 out:
911 if (local_uaddr)
912 free(local_uaddr);
913 if (buf_alloc)
914 free(buf_alloc);
915 if (outbuf_alloc)
916 free(outbuf_alloc);
917 if (na) {
918 free(na->buf);
919 free(na);
920 }
921 if (m_uaddr != NULL)
922 free(m_uaddr);
923 }
924
925 /*
926 * Makes an entry into the FIFO for the given request.
927 * Returns 1 on success, 0 if this is a duplicate request, or -1 on error.
928 * *callxidp is set to the xid of the call.
929 */
930 static int
forward_register(u_int32_t caller_xid,struct netbuf * caller_addr,int forward_fd,char * uaddr,rpcproc_t reply_type,rpcvers_t versnum,u_int32_t * callxidp)931 forward_register(u_int32_t caller_xid, struct netbuf *caller_addr,
932 int forward_fd, char *uaddr, rpcproc_t reply_type,
933 rpcvers_t versnum, u_int32_t *callxidp)
934 {
935 int i;
936 int j = 0;
937 time_t min_time, time_now;
938 static u_int32_t lastxid;
939 int entry = -1;
940
941 min_time = FINFO[0].time;
942 time_now = time((time_t *)0);
943 /* initialization */
944 if (lastxid == 0)
945 lastxid = time_now * NFORWARD;
946
947 /*
948 * Check if it is a duplicate entry. Then,
949 * try to find an empty slot. If not available, then
950 * use the slot with the earliest time.
951 */
952 for (i = 0; i < NFORWARD; i++) {
953 if (FINFO[i].flag & FINFO_ACTIVE) {
954 if ((FINFO[i].caller_xid == caller_xid) &&
955 (FINFO[i].reply_type == reply_type) &&
956 (FINFO[i].versnum == versnum) &&
957 (!netbufcmp(FINFO[i].caller_addr,
958 caller_addr))) {
959 FINFO[i].time = time((time_t *)0);
960 return (0); /* Duplicate entry */
961 } else {
962 /* Should we wait any longer */
963 if ((time_now - FINFO[i].time) > MAXTIME_OFF)
964 (void) free_slot_by_index(i);
965 }
966 }
967 if (entry == -1) {
968 if ((FINFO[i].flag & FINFO_ACTIVE) == 0) {
969 entry = i;
970 } else if (FINFO[i].time < min_time) {
971 j = i;
972 min_time = FINFO[i].time;
973 }
974 }
975 }
976 if (entry != -1) {
977 /* use this empty slot */
978 j = entry;
979 } else {
980 (void) free_slot_by_index(j);
981 }
982 if ((FINFO[j].caller_addr = netbufdup(caller_addr)) == NULL) {
983 return (-1);
984 }
985 rpcb_rmtcalls++; /* no of pending calls */
986 FINFO[j].flag = FINFO_ACTIVE;
987 FINFO[j].reply_type = reply_type;
988 FINFO[j].versnum = versnum;
989 FINFO[j].time = time_now;
990 FINFO[j].caller_xid = caller_xid;
991 FINFO[j].forward_fd = forward_fd;
992 /*
993 * Though uaddr is not allocated here, it will still be freed
994 * from free_slot_*().
995 */
996 FINFO[j].uaddr = uaddr;
997 lastxid = lastxid + NFORWARD;
998 /* Don't allow a zero xid below. */
999 if ((u_int32_t)(lastxid + NFORWARD) <= NFORWARD)
1000 lastxid = NFORWARD;
1001 FINFO[j].forward_xid = lastxid + j; /* encode slot */
1002 *callxidp = FINFO[j].forward_xid; /* forward on this xid */
1003 return (1);
1004 }
1005
1006 static struct finfo *
forward_find(u_int32_t reply_xid)1007 forward_find(u_int32_t reply_xid)
1008 {
1009 int i;
1010
1011 i = reply_xid % (u_int32_t)NFORWARD;
1012 if ((FINFO[i].flag & FINFO_ACTIVE) &&
1013 (FINFO[i].forward_xid == reply_xid)) {
1014 return (&FINFO[i]);
1015 }
1016 return (NULL);
1017 }
1018
1019 static int
free_slot_by_xid(u_int32_t xid)1020 free_slot_by_xid(u_int32_t xid)
1021 {
1022 int entry;
1023
1024 entry = xid % (u_int32_t)NFORWARD;
1025 return (free_slot_by_index(entry));
1026 }
1027
1028 static int
free_slot_by_index(int index)1029 free_slot_by_index(int index)
1030 {
1031 struct finfo *fi;
1032
1033 fi = &FINFO[index];
1034 if (fi->flag & FINFO_ACTIVE) {
1035 netbuffree(fi->caller_addr);
1036 /* XXX may be too big, but can't access xprt array here */
1037 if (fi->forward_fd >= svc_maxfd)
1038 svc_maxfd--;
1039 free(fi->uaddr);
1040 fi->flag &= ~FINFO_ACTIVE;
1041 rpcb_rmtcalls--;
1042 return (1);
1043 }
1044 return (0);
1045 }
1046
1047 static int
netbufcmp(struct netbuf * n1,struct netbuf * n2)1048 netbufcmp(struct netbuf *n1, struct netbuf *n2)
1049 {
1050 return ((n1->len != n2->len) || memcmp(n1->buf, n2->buf, n1->len));
1051 }
1052
1053 static bool_t
netbuf_copybuf(struct netbuf * dst,const struct netbuf * src)1054 netbuf_copybuf(struct netbuf *dst, const struct netbuf *src)
1055 {
1056 assert(src->len <= src->maxlen);
1057
1058 if (dst->maxlen < src->len || dst->buf == NULL) {
1059 if (dst->buf != NULL)
1060 free(dst->buf);
1061 if ((dst->buf = calloc(1, src->maxlen)) == NULL)
1062 return (FALSE);
1063 dst->maxlen = src->maxlen;
1064 }
1065
1066 dst->len = src->len;
1067 memcpy(dst->buf, src->buf, src->len);
1068
1069 return (TRUE);
1070 }
1071
1072 static struct netbuf *
netbufdup(struct netbuf * ap)1073 netbufdup(struct netbuf *ap)
1074 {
1075 struct netbuf *np;
1076
1077 if ((np = calloc(1, sizeof(struct netbuf))) == NULL)
1078 return (NULL);
1079 if (netbuf_copybuf(np, ap) == FALSE) {
1080 free(np);
1081 return (NULL);
1082 }
1083 return (np);
1084 }
1085
1086 static void
netbuffree(struct netbuf * ap)1087 netbuffree(struct netbuf *ap)
1088 {
1089 free(ap->buf);
1090 ap->buf = NULL;
1091 free(ap);
1092 }
1093
1094
1095 #define MASKVAL (POLLIN | POLLPRI | POLLRDNORM | POLLRDBAND)
1096 extern bool_t __svc_clean_idle(fd_set *, int, bool_t);
1097
1098 void
my_svc_run(void)1099 my_svc_run(void)
1100 {
1101 size_t nfds;
1102 struct pollfd pollfds[FD_SETSIZE];
1103 int poll_ret, check_ret;
1104 int n;
1105 #ifdef SVC_RUN_DEBUG
1106 int i;
1107 #endif
1108 register struct pollfd *p;
1109 fd_set cleanfds;
1110
1111 for (;;) {
1112 p = pollfds;
1113 for (n = 0; n <= svc_maxfd; n++) {
1114 if (FD_ISSET(n, &svc_fdset)) {
1115 p->fd = n;
1116 p->events = MASKVAL;
1117 p++;
1118 }
1119 }
1120 nfds = p - pollfds;
1121 poll_ret = 0;
1122 #ifdef SVC_RUN_DEBUG
1123 if (debugging) {
1124 fprintf(stderr, "polling for read on fd < ");
1125 for (i = 0, p = pollfds; i < nfds; i++, p++)
1126 if (p->events)
1127 fprintf(stderr, "%d ", p->fd);
1128 fprintf(stderr, ">\n");
1129 }
1130 #endif
1131 switch (poll_ret = poll(pollfds, nfds, 30 * 1000)) {
1132 case -1:
1133 /*
1134 * We ignore all errors, continuing with the assumption
1135 * that it was set by the signal handlers (or any
1136 * other outside event) and not caused by poll().
1137 */
1138 case 0:
1139 cleanfds = svc_fdset;
1140 __svc_clean_idle(&cleanfds, 30, FALSE);
1141 continue;
1142 default:
1143 #ifdef SVC_RUN_DEBUG
1144 if (debugging) {
1145 fprintf(stderr, "poll returned read fds < ");
1146 for (i = 0, p = pollfds; i < nfds; i++, p++)
1147 if (p->revents)
1148 fprintf(stderr, "%d ", p->fd);
1149 fprintf(stderr, ">\n");
1150 }
1151 #endif
1152 /*
1153 * If we found as many replies on callback fds
1154 * as the number of descriptors selectable which
1155 * poll() returned, there can be no more so we
1156 * don't call svc_getreq_poll. Otherwise, there
1157 * must be another so we must call svc_getreq_poll.
1158 */
1159 if ((check_ret = check_rmtcalls(pollfds, nfds)) ==
1160 poll_ret)
1161 continue;
1162 svc_getreq_poll(pollfds, poll_ret-check_ret);
1163 }
1164 #ifdef SVC_RUN_DEBUG
1165 if (debugging) {
1166 fprintf(stderr, "svc_maxfd now %u\n", svc_maxfd);
1167 }
1168 #endif
1169 }
1170 }
1171
1172 static int
check_rmtcalls(struct pollfd * pfds,int nfds)1173 check_rmtcalls(struct pollfd *pfds, int nfds)
1174 {
1175 int j, ncallbacks_found = 0, rmtcalls_pending;
1176 SVCXPRT *xprt;
1177
1178 if (rpcb_rmtcalls == 0)
1179 return (0);
1180
1181 rmtcalls_pending = rpcb_rmtcalls;
1182 for (j = 0; j < nfds; j++) {
1183 if ((xprt = find_rmtcallxprt_by_fd(pfds[j].fd)) != NULL) {
1184 if (pfds[j].revents) {
1185 ncallbacks_found++;
1186 #ifdef DEBUG_RMTCALL
1187 if (debugging)
1188 fprintf(stderr,
1189 "my_svc_run: polled on forwarding fd %d, netid %s - calling handle_reply\n",
1190 pfds[j].fd, xprt->xp_netid);
1191 #endif
1192 handle_reply(pfds[j].fd, xprt);
1193 pfds[j].revents = 0;
1194 if (ncallbacks_found >= rmtcalls_pending) {
1195 break;
1196 }
1197 }
1198 }
1199 }
1200 return (ncallbacks_found);
1201 }
1202
1203 static void
xprt_set_caller(SVCXPRT * xprt,struct finfo * fi)1204 xprt_set_caller(SVCXPRT *xprt, struct finfo *fi)
1205 {
1206 u_int32_t *xidp;
1207
1208 netbuf_copybuf(svc_getrpccaller(xprt), fi->caller_addr);
1209 xidp = __rpcb_get_dg_xidp(xprt);
1210 *xidp = fi->caller_xid;
1211 }
1212
1213 /*
1214 * Call svcerr_systemerr() only if RPCBVERS4
1215 */
1216 static void
send_svcsyserr(SVCXPRT * xprt,struct finfo * fi)1217 send_svcsyserr(SVCXPRT *xprt, struct finfo *fi)
1218 {
1219 if (fi->reply_type == RPCBPROC_INDIRECT) {
1220 xprt_set_caller(xprt, fi);
1221 svcerr_systemerr(xprt);
1222 }
1223 return;
1224 }
1225
1226 static void
handle_reply(int fd,SVCXPRT * xprt)1227 handle_reply(int fd, SVCXPRT *xprt)
1228 {
1229 XDR reply_xdrs;
1230 struct rpc_msg reply_msg;
1231 struct rpc_err reply_error;
1232 char *buffer;
1233 struct finfo *fi;
1234 int inlen, pos, len;
1235 struct r_rmtcall_args a;
1236 struct sockaddr_storage ss;
1237 socklen_t fromlen;
1238 #ifdef SVC_RUN_DEBUG
1239 char *uaddr;
1240 #endif
1241
1242 buffer = malloc(RPC_BUF_MAX);
1243 if (buffer == NULL)
1244 goto done;
1245
1246 do {
1247 fromlen = sizeof(ss);
1248 inlen = recvfrom(fd, buffer, RPC_BUF_MAX, 0,
1249 (struct sockaddr *)&ss, &fromlen);
1250 } while (inlen < 0 && errno == EINTR);
1251 if (inlen < 0) {
1252 if (debugging)
1253 fprintf(stderr,
1254 "handle_reply: recvfrom returned %d, errno %d\n", inlen, errno);
1255 goto done;
1256 }
1257
1258 reply_msg.acpted_rply.ar_verf = _null_auth;
1259 reply_msg.acpted_rply.ar_results.where = 0;
1260 reply_msg.acpted_rply.ar_results.proc = (xdrproc_t) xdr_void;
1261
1262 xdrmem_create(&reply_xdrs, buffer, (u_int)inlen, XDR_DECODE);
1263 if (!xdr_replymsg(&reply_xdrs, &reply_msg)) {
1264 if (debugging)
1265 (void) fprintf(stderr,
1266 "handle_reply: xdr_replymsg failed\n");
1267 goto done;
1268 }
1269 fi = forward_find(reply_msg.rm_xid);
1270 #ifdef SVC_RUN_DEBUG
1271 if (debugging) {
1272 fprintf(stderr, "handle_reply: reply xid: %d fi addr: %p\n",
1273 reply_msg.rm_xid, fi);
1274 }
1275 #endif
1276 if (fi == NULL) {
1277 goto done;
1278 }
1279 _seterr_reply(&reply_msg, &reply_error);
1280 if (reply_error.re_status != RPC_SUCCESS) {
1281 if (debugging)
1282 (void) fprintf(stderr, "handle_reply: %s\n",
1283 clnt_sperrno(reply_error.re_status));
1284 send_svcsyserr(xprt, fi);
1285 goto done;
1286 }
1287 pos = XDR_GETPOS(&reply_xdrs);
1288 len = inlen - pos;
1289 a.rmt_args.args = &buffer[pos];
1290 a.rmt_args.arglen = len;
1291 a.rmt_uaddr = fi->uaddr;
1292 a.rmt_localvers = fi->versnum;
1293
1294 xprt_set_caller(xprt, fi);
1295 #ifdef SVC_RUN_DEBUG
1296 uaddr = taddr2uaddr(rpcbind_get_conf("udp"),
1297 svc_getrpccaller(xprt));
1298 if (debugging) {
1299 fprintf(stderr, "handle_reply: forwarding address %s to %s\n",
1300 a.rmt_uaddr, uaddr ? uaddr : "unknown");
1301 }
1302 if (uaddr)
1303 free(uaddr);
1304 #endif
1305 svc_sendreply(xprt, (xdrproc_t) xdr_rmtcall_result, (char *) &a);
1306 done:
1307 if (buffer)
1308 free(buffer);
1309
1310 if (reply_msg.rm_xid == 0) {
1311 #ifdef SVC_RUN_DEBUG
1312 if (debugging) {
1313 fprintf(stderr, "handle_reply: NULL xid on exit!\n");
1314 }
1315 #endif
1316 } else
1317 (void) free_slot_by_xid(reply_msg.rm_xid);
1318 return;
1319 }
1320
1321 static void
find_versions(rpcprog_t prog,char * netid,rpcvers_t * lowvp,rpcvers_t * highvp)1322 find_versions(rpcprog_t prog, char *netid, rpcvers_t *lowvp, rpcvers_t *highvp)
1323 {
1324 register rpcblist_ptr rbl;
1325 unsigned int lowv = 0;
1326 unsigned int highv = 0;
1327
1328 for (rbl = list_rbl; rbl != NULL; rbl = rbl->rpcb_next) {
1329 if ((rbl->rpcb_map.r_prog != prog) ||
1330 ((rbl->rpcb_map.r_netid != NULL) &&
1331 (strcasecmp(rbl->rpcb_map.r_netid, netid) != 0)))
1332 continue;
1333 if (lowv == 0) {
1334 highv = rbl->rpcb_map.r_vers;
1335 lowv = highv;
1336 } else if (rbl->rpcb_map.r_vers < lowv) {
1337 lowv = rbl->rpcb_map.r_vers;
1338 } else if (rbl->rpcb_map.r_vers > highv) {
1339 highv = rbl->rpcb_map.r_vers;
1340 }
1341 }
1342 *lowvp = lowv;
1343 *highvp = highv;
1344 return;
1345 }
1346
1347 /*
1348 * returns the item with the given program, version number and netid.
1349 * If that version number is not found, it returns the item with that
1350 * program number, so that address is now returned to the caller. The
1351 * caller when makes a call to this program, version number, the call
1352 * will fail and it will return with PROGVERS_MISMATCH. The user can
1353 * then determine the highest and the lowest version number for this
1354 * program using clnt_geterr() and use those program version numbers.
1355 *
1356 * Returns the RPCBLIST for the given prog, vers and netid
1357 */
1358 static rpcblist_ptr
find_service(rpcprog_t prog,rpcvers_t vers,char * netid)1359 find_service(rpcprog_t prog, rpcvers_t vers, char *netid)
1360 {
1361 register rpcblist_ptr hit = NULL;
1362 register rpcblist_ptr rbl;
1363
1364 for (rbl = list_rbl; rbl != NULL; rbl = rbl->rpcb_next) {
1365 if ((rbl->rpcb_map.r_prog != prog) ||
1366 ((rbl->rpcb_map.r_netid != NULL) &&
1367 (strcasecmp(rbl->rpcb_map.r_netid, netid) != 0)))
1368 continue;
1369 hit = rbl;
1370 if (rbl->rpcb_map.r_vers == vers)
1371 break;
1372 }
1373 return (hit);
1374 }
1375
1376 /*
1377 * Copies the name associated with the uid of the caller and returns
1378 * a pointer to it. Similar to getwd().
1379 */
1380 static char *
getowner(SVCXPRT * transp,char * owner,size_t ownersize)1381 getowner(SVCXPRT *transp, char *owner, size_t ownersize)
1382 {
1383 uid_t uid;
1384
1385 if (__rpc_get_local_uid(transp, &uid) < 0)
1386 strlcpy(owner, "unknown", ownersize);
1387 else if (uid == 0)
1388 strlcpy(owner, "superuser", ownersize);
1389 else
1390 snprintf(owner, ownersize, "%d", uid);
1391
1392 return owner;
1393 }
1394
1395 #ifdef PORTMAP
1396 /*
1397 * Add this to the pmap list only if it is UDP or TCP.
1398 */
1399 static int
add_pmaplist(RPCB * arg)1400 add_pmaplist(RPCB *arg)
1401 {
1402 struct pmap pmap;
1403 struct pmaplist *pml;
1404 int h1, h2, h3, h4, p1, p2;
1405
1406 if (strcmp(arg->r_netid, udptrans) == 0) {
1407 /* It is UDP! */
1408 pmap.pm_prot = IPPROTO_UDP;
1409 } else if (strcmp(arg->r_netid, tcptrans) == 0) {
1410 /* It is TCP */
1411 pmap.pm_prot = IPPROTO_TCP;
1412 } else
1413 /* Not an IP protocol */
1414 return (0);
1415
1416 /* interpret the universal address for TCP/IP */
1417 if (sscanf(arg->r_addr, "%d.%d.%d.%d.%d.%d",
1418 &h1, &h2, &h3, &h4, &p1, &p2) != 6)
1419 return (0);
1420 pmap.pm_port = ((p1 & 0xff) << 8) + (p2 & 0xff);
1421 pmap.pm_prog = arg->r_prog;
1422 pmap.pm_vers = arg->r_vers;
1423 /*
1424 * add to END of list
1425 */
1426 pml = malloc(sizeof (struct pmaplist));
1427 if (pml == NULL) {
1428 (void) syslog(LOG_ERR, "rpcbind: no memory!\n");
1429 return (1);
1430 }
1431 pml->pml_map = pmap;
1432 pml->pml_next = NULL;
1433 if (list_pml == NULL) {
1434 list_pml = pml;
1435 } else {
1436 struct pmaplist *fnd;
1437
1438 /* Attach to the end of the list */
1439 for (fnd = list_pml; fnd->pml_next; fnd = fnd->pml_next)
1440 ;
1441 fnd->pml_next = pml;
1442 }
1443 return (0);
1444 }
1445
1446 /*
1447 * Delete this from the pmap list only if it is UDP or TCP.
1448 */
1449 static int
del_pmaplist(RPCB * arg)1450 del_pmaplist(RPCB *arg)
1451 {
1452 struct pmaplist *pml;
1453 struct pmaplist *prevpml, *fnd;
1454 unsigned long prot;
1455
1456 if (strcmp(arg->r_netid, udptrans) == 0) {
1457 /* It is UDP! */
1458 prot = IPPROTO_UDP;
1459 } else if (strcmp(arg->r_netid, tcptrans) == 0) {
1460 /* It is TCP */
1461 prot = IPPROTO_TCP;
1462 } else if (arg->r_netid[0] == 0) {
1463 prot = 0; /* Remove all occurrences */
1464 } else {
1465 /* Not an IP protocol */
1466 return (0);
1467 }
1468 for (prevpml = NULL, pml = list_pml; pml; /* cstyle */) {
1469 if ((pml->pml_map.pm_prog != arg->r_prog) ||
1470 (pml->pml_map.pm_vers != arg->r_vers) ||
1471 (prot && (pml->pml_map.pm_prot != prot))) {
1472 /* both pml & prevpml move forwards */
1473 prevpml = pml;
1474 pml = pml->pml_next;
1475 continue;
1476 }
1477 /* found it; pml moves forward, prevpml stays */
1478 fnd = pml;
1479 pml = pml->pml_next;
1480 if (prevpml == NULL)
1481 list_pml = pml;
1482 else
1483 prevpml->pml_next = pml;
1484 free(fnd);
1485 }
1486 return (0);
1487 }
1488 #endif /* PORTMAP */
1489