/*
* Record login in wtmp file.
*/
void dologin(struct passwd *pw, struct sockaddr *sin)
{
#if __FreeBSD_version >= 900007
struct utmpx ut;
memset(&ut, 0, sizeof ut);
ut.ut_type = USER_PROCESS;
gettimeofday(&ut.ut_tv, NULL);
ut.ut_pid = getpid();
snprintf(ut.ut_id, sizeof ut.ut_id, "%xuucp", ut.ut_pid);
SCPYN(ut.ut_user, pw->pw_name);
realhostname_sa(ut.ut_host, sizeof ut.ut_host, sin, sin->sa_len);
pututxline(&ut);
#else
char line[32];
char remotehost[UT_HOSTSIZE + 1];
int f;
time_t cur_time;
realhostname_sa(remotehost, sizeof(remotehost) - 1, sin, sin->sa_len);
remotehost[sizeof remotehost - 1] = '\0';
/* hack, but must be unique and no tty line */
sprintf(line, "uucp%ld", (long)getpid());
time(&cur_time);
if ((f = open(_PATH_LASTLOG, O_RDWR)) >= 0) {
struct lastlog ll;
ll.ll_time = cur_time;
lseek(f, (off_t)pw->pw_uid * sizeof(struct lastlog), L_SET);
SCPYN(ll.ll_line, line);
SCPYN(ll.ll_host, remotehost);
(void) write(f, (char *) &ll, sizeof ll);
(void) close(f);
}
logwtmp(line, pw->pw_name, remotehost);
#endif
}
int main(int argc, char **argv)
{
struct sockaddr *sin;
environ = nenv;
close(1); close(2);
dup(0); dup(0);
hisaddrlen = sizeof (hisctladdr);
openlog("uucpd", LOG_PID, LOG_DAEMON);
sin = (struct sockaddr *)&hisctladdr;
if (getpeername(0, sin, &hisaddrlen) < 0) {
syslog(LOG_ERR, "getpeername: %m");
_exit(1);
}
realhostname_sa(remotehost, sizeof(remotehost) - 1, sin, sin->sa_len);
remotehost[sizeof(remotehost) - 1] = '\0';
doit(sin);
exit(0);
}
/*
* Modified version of logwtmp that holds wtmp file open
* after first call, for use with ftp (which may chroot
* after login, but before logout).
*/
void
ftpd_logwtmp(char *line, char *name, struct sockaddr *addr)
{
struct utmp ut;
struct stat buf;
char host[UT_HOSTSIZE];
if (addr == NULL)
host[0] = '\0';
else
realhostname_sa(host, sizeof(host), addr, addr->sa_len);
if (fd < 0 && (fd = open(_PATH_WTMP, O_WRONLY|O_APPEND, 0)) < 0)
return;
if (fstat(fd, &buf) == 0) {
(void)strncpy(ut.ut_line, line, sizeof(ut.ut_line));
(void)strncpy(ut.ut_name, name, sizeof(ut.ut_name));
(void)strncpy(ut.ut_host, host, sizeof(ut.ut_host));
(void)time(&ut.ut_time);
if (write(fd, &ut, sizeof(struct utmp)) !=
sizeof(struct utmp))
(void)ftruncate(fd, buf.st_size);
}
}
int
main(int argc, char *argv[])
{
struct kinfo_proc *kp;
struct kinfo_proc *dkp;
struct stat *stp;
time_t touched;
int ch, i, nentries, nusers, wcmd, longidle, longattime, dropgid;
const char *memf, *nlistf, *p;
char *x_suffix;
char buf[MAXHOSTNAMELEN], errbuf[_POSIX2_LINE_MAX];
char fn[MAXHOSTNAMELEN];
char *dot;
(void)setlocale(LC_ALL, "");
use_ampm = (*nl_langinfo(T_FMT_AMPM) != '\0');
use_comma = (*nl_langinfo(RADIXCHAR) != ',');
/* Are we w(1) or uptime(1)? */
if (this_is_uptime(argv[0]) == 0) {
wcmd = 0;
p = "";
} else {
wcmd = 1;
p = "dhiflM:N:nsuw";
}
dropgid = 0;
memf = _PATH_DEVNULL;
nlistf = NULL;
while ((ch = getopt(argc, argv, p)) != -1)
switch (ch) {
case 'd':
dflag = 1;
break;
case 'h':
header = 0;
break;
case 'i':
sortidle = 1;
break;
case 'M':
header = 0;
memf = optarg;
dropgid = 1;
break;
case 'N':
nlistf = optarg;
dropgid = 1;
break;
case 'n':
nflag = 1;
break;
case 'f': case 'l': case 's': case 'u': case 'w':
warnx("[-flsuw] no longer supported");
/* FALLTHROUGH */
case '?':
default:
usage(wcmd);
}
argc -= optind;
argv += optind;
if (!(_res.options & RES_INIT))
res_init();
_res.retrans = 2; /* resolver timeout to 2 seconds per try */
_res.retry = 1; /* only try once.. */
/*
* Discard setgid privileges if not the running kernel so that bad
* guys can't print interesting stuff from kernel memory.
*/
if (dropgid)
setgid(getgid());
if ((kd = kvm_openfiles(nlistf, memf, NULL, O_RDONLY, errbuf)) == NULL)
errx(1, "%s", errbuf);
(void)time(&now);
if (*argv)
sel_users = argv;
setutxent();
for (nusers = 0; (utmp = getutxent()) != NULL;) {
if (utmp->ut_type != USER_PROCESS)
continue;
if (!(stp = ttystat(utmp->ut_line)))
continue; /* corrupted record */
++nusers;
if (wcmd == 0)
continue;
if (sel_users) {
int usermatch;
char **user;
usermatch = 0;
for (user = sel_users; !usermatch && *user; user++)
if (!strcmp(utmp->ut_user, *user))
usermatch = 1;
if (!usermatch)
continue;
}
if ((ep = calloc(1, sizeof(struct entry))) == NULL)
errx(1, "calloc");
*nextp = ep;
nextp = &ep->next;
memmove(&ep->utmp, utmp, sizeof *utmp);
ep->tdev = stp->st_rdev;
/*
* If this is the console device, attempt to ascertain
* the true console device dev_t.
*/
if (ep->tdev == 0) {
size_t size;
size = sizeof(dev_t);
(void)sysctlbyname("machdep.consdev", &ep->tdev, &size, NULL, 0);
}
touched = stp->st_atime;
if (touched < ep->utmp.ut_tv.tv_sec) {
/* tty untouched since before login */
touched = ep->utmp.ut_tv.tv_sec;
}
if ((ep->idle = now - touched) < 0)
ep->idle = 0;
}
endutxent();
if (header || wcmd == 0) {
pr_header(&now, nusers);
if (wcmd == 0) {
(void)kvm_close(kd);
exit(0);
}
#define HEADER_USER "USER"
#define HEADER_TTY "TTY"
#define HEADER_FROM "FROM"
#define HEADER_LOGIN_IDLE "LOGIN@ IDLE "
#define HEADER_WHAT "WHAT\n"
#define WUSED (W_DISPUSERSIZE + W_DISPLINESIZE + W_DISPHOSTSIZE + \
sizeof(HEADER_LOGIN_IDLE) + 3) /* header width incl. spaces */
(void)printf("%-*.*s %-*.*s %-*.*s %s",
W_DISPUSERSIZE, W_DISPUSERSIZE, HEADER_USER,
W_DISPLINESIZE, W_DISPLINESIZE, HEADER_TTY,
W_DISPHOSTSIZE, W_DISPHOSTSIZE, HEADER_FROM,
HEADER_LOGIN_IDLE HEADER_WHAT);
}
if ((kp = kvm_getprocs(kd, KERN_PROC_ALL, 0, &nentries)) == NULL)
err(1, "%s", kvm_geterr(kd));
for (i = 0; i < nentries; i++, kp++) {
if (kp->ki_stat == SIDL || kp->ki_stat == SZOMB ||
kp->ki_tdev == NODEV)
continue;
for (ep = ehead; ep != NULL; ep = ep->next) {
if (ep->tdev == kp->ki_tdev) {
/*
* proc is associated with this terminal
*/
if (ep->kp == NULL && kp->ki_pgid == kp->ki_tpgid) {
/*
* Proc is 'most interesting'
*/
if (proc_compare(ep->kp, kp))
ep->kp = kp;
}
/*
* Proc debug option info; add to debug
* list using kinfo_proc ki_spare[0]
* as next pointer; ptr to ptr avoids the
* ptr = long assumption.
*/
dkp = ep->dkp;
ep->dkp = kp;
debugproc(kp) = dkp;
}
}
}
if ((ioctl(STDOUT_FILENO, TIOCGWINSZ, &ws) == -1 &&
ioctl(STDERR_FILENO, TIOCGWINSZ, &ws) == -1 &&
ioctl(STDIN_FILENO, TIOCGWINSZ, &ws) == -1) || ws.ws_col == 0)
ttywidth = 79;
else
ttywidth = ws.ws_col - 1;
argwidth = ttywidth - WUSED;
if (argwidth < 4)
argwidth = 8;
for (ep = ehead; ep != NULL; ep = ep->next) {
if (ep->kp == NULL) {
ep->args = strdup("-");
continue;
}
ep->args = fmt_argv(kvm_getargv(kd, ep->kp, argwidth),
ep->kp->ki_comm, NULL, MAXCOMLEN);
if (ep->args == NULL)
err(1, NULL);
}
/* sort by idle time */
if (sortidle && ehead != NULL) {
struct entry *from, *save;
from = ehead;
ehead = NULL;
while (from != NULL) {
for (nextp = &ehead;
(*nextp) && from->idle >= (*nextp)->idle;
nextp = &(*nextp)->next)
continue;
save = from;
from = from->next;
save->next = *nextp;
*nextp = save;
}
}
for (ep = ehead; ep != NULL; ep = ep->next) {
struct addrinfo hints, *res;
struct sockaddr_storage ss;
struct sockaddr *sa = (struct sockaddr *)&ss;
struct sockaddr_in *lsin = (struct sockaddr_in *)&ss;
struct sockaddr_in6 *lsin6 = (struct sockaddr_in6 *)&ss;
time_t t;
int isaddr;
p = *ep->utmp.ut_host ? ep->utmp.ut_host : "-";
if ((x_suffix = strrchr(p, ':')) != NULL) {
if ((dot = strchr(x_suffix, '.')) != NULL &&
strchr(dot+1, '.') == NULL)
*x_suffix++ = '\0';
else
x_suffix = NULL;
}
isaddr = 0;
memset(&ss, '\0', sizeof(ss));
if (inet_pton(AF_INET6, p, &lsin6->sin6_addr) == 1) {
lsin6->sin6_len = sizeof(*lsin6);
lsin6->sin6_family = AF_INET6;
isaddr = 1;
} else if (inet_pton(AF_INET, p, &lsin->sin_addr) == 1) {
lsin->sin_len = sizeof(*lsin);
lsin->sin_family = AF_INET;
isaddr = 1;
}
if (!nflag) {
/* Attempt to change an IP address into a name */
if (isaddr && realhostname_sa(fn, sizeof(fn), sa,
sa->sa_len) == HOSTNAME_FOUND)
p = fn;
} else if (!isaddr) {
/*
* If a host has only one A/AAAA RR, change a
* name into an IP address
*/
memset(&hints, 0, sizeof(hints));
hints.ai_flags = AI_PASSIVE;
hints.ai_family = AF_UNSPEC;
hints.ai_socktype = SOCK_STREAM;
if (getaddrinfo(p, NULL, &hints, &res) == 0) {
if (res->ai_next == NULL &&
getnameinfo(res->ai_addr, res->ai_addrlen,
fn, sizeof(fn), NULL, 0,
NI_NUMERICHOST) == 0)
p = fn;
freeaddrinfo(res);
}
}
if (x_suffix) {
(void)snprintf(buf, sizeof(buf), "%s:%s", p, x_suffix);
p = buf;
}
if (dflag) {
for (dkp = ep->dkp; dkp != NULL; dkp = debugproc(dkp)) {
const char *ptr;
ptr = fmt_argv(kvm_getargv(kd, dkp, argwidth),
dkp->ki_comm, NULL, MAXCOMLEN);
if (ptr == NULL)
ptr = "-";
(void)printf("\t\t%-9d %s\n",
dkp->ki_pid, ptr);
}
}
(void)printf("%-*.*s %-*.*s %-*.*s ",
W_DISPUSERSIZE, W_DISPUSERSIZE, ep->utmp.ut_user,
W_DISPLINESIZE, W_DISPLINESIZE,
*ep->utmp.ut_line ?
(strncmp(ep->utmp.ut_line, "tty", 3) &&
strncmp(ep->utmp.ut_line, "cua", 3) ?
ep->utmp.ut_line : ep->utmp.ut_line + 3) : "-",
W_DISPHOSTSIZE, W_DISPHOSTSIZE, *p ? p : "-");
t = ep->utmp.ut_tv.tv_sec;
longattime = pr_attime(&t, &now);
longidle = pr_idle(ep->idle);
(void)printf("%.*s\n", argwidth - longidle - longattime,
ep->args);
}
(void)kvm_close(kd);
exit(0);
}
void
doit(struct sockaddr *fromp)
{
extern char *__rcmd_errstr; /* syslog hook from libc/net/rcmd.c. */
struct passwd *pwd;
u_short port;
fd_set ready, readfrom;
int cc, fd, nfd, pv[2], pid, s;
int one = 1;
const char *cp, *errorstr;
char sig, buf[BUFSIZ];
char *cmdbuf, luser[16], ruser[16];
char rhost[2 * MAXHOSTNAMELEN + 1];
char numericname[INET6_ADDRSTRLEN];
int af, srcport;
int maxcmdlen;
#ifndef __APPLE__
login_cap_t *lc;
#else
struct hostent *hp;
char *hostname, *errorhost = NULL;
#endif
maxcmdlen = (int)sysconf(_SC_ARG_MAX);
if (maxcmdlen <= 0 || (cmdbuf = malloc(maxcmdlen)) == NULL)
exit(1);
#if defined(KERBEROS)
AUTH_DAT *kdata = (AUTH_DAT *) NULL;
KTEXT ticket = (KTEXT) NULL;
char instance[INST_SZ], version[VERSION_SIZE];
struct sockaddr_in fromaddr;
int rc;
long authopts;
int pv1[2], pv2[2];
fd_set wready, writeto;
fromaddr = *fromp;
#endif /* KERBEROS */
(void) signal(SIGINT, SIG_DFL);
(void) signal(SIGQUIT, SIG_DFL);
(void) signal(SIGTERM, SIG_DFL);
af = fromp->sa_family;
srcport = ntohs(*((in_port_t *)&fromp->sa_data));
if (af == AF_INET) {
inet_ntop(af, &((struct sockaddr_in *)fromp)->sin_addr,
numericname, sizeof numericname);
} else if (af == AF_INET6) {
inet_ntop(af, &((struct sockaddr_in6 *)fromp)->sin6_addr,
numericname, sizeof numericname);
} else {
syslog(LOG_ERR, "malformed \"from\" address (af %d)", af);
exit(1);
}
#ifdef IP_OPTIONS
if (af == AF_INET) {
u_char optbuf[BUFSIZ/3];
socklen_t optsize = sizeof(optbuf), ipproto, i;
struct protoent *ip;
if ((ip = getprotobyname("ip")) != NULL)
ipproto = ip->p_proto;
else
ipproto = IPPROTO_IP;
if (!getsockopt(0, ipproto, IP_OPTIONS, optbuf, &optsize) &&
optsize != 0) {
for (i = 0; i < optsize; ) {
u_char c = optbuf[i];
if (c == IPOPT_LSRR || c == IPOPT_SSRR) {
syslog(LOG_NOTICE,
"connection refused from %s with IP option %s",
numericname,
c == IPOPT_LSRR ? "LSRR" : "SSRR");
exit(1);
}
if (c == IPOPT_EOL)
break;
i += (c == IPOPT_NOP) ? 1 : optbuf[i+1];
}
}
}
#endif
#if defined(KERBEROS)
if (!use_kerberos)
#endif
if (srcport >= IPPORT_RESERVED ||
srcport < IPPORT_RESERVED/2) {
syslog(LOG_NOTICE|LOG_AUTH,
"connection from %s on illegal port %u",
numericname,
srcport);
exit(1);
}
(void) alarm(60);
port = 0;
s = 0; /* not set or used if port == 0 */
for (;;) {
char c;
if ((cc = read(STDIN_FILENO, &c, 1)) != 1) {
if (cc < 0)
syslog(LOG_NOTICE, "read: %m");
shutdown(0, SHUT_RDWR);
exit(1);
}
if (c == 0)
break;
port = port * 10 + c - '0';
}
(void) alarm(0);
if (port != 0) {
int lport = IPPORT_RESERVED - 1;
s = rresvport_af(&lport, af);
if (s < 0) {
syslog(LOG_ERR, "can't get stderr port: %m");
exit(1);
}
#if defined(KERBEROS)
if (!use_kerberos)
#endif
if (port >= IPPORT_RESERVED ||
port < IPPORT_RESERVED/2) {
syslog(LOG_NOTICE|LOG_AUTH,
"2nd socket from %s on unreserved port %u",
numericname,
port);
exit(1);
}
*((in_port_t *)&fromp->sa_data) = htons(port);
if (connect(s, fromp, fromp->sa_len) < 0) {
syslog(LOG_INFO, "connect second port %d: %m", port);
exit(1);
}
}
#if defined(KERBEROS)
if (vacuous) {
error("rshd: remote host requires Kerberos authentication\n");
exit(1);
}
#endif
errorstr = NULL;
#ifndef __APPLE__
realhostname_sa(rhost, sizeof(rhost) - 1, fromp, fromp->sa_len);
rhost[sizeof(rhost) - 1] = '\0';
/* XXX truncation! */
#else
errorstr = NULL;
hp = gethostbyaddr((char *)&((struct sockaddr_in *)fromp)->sin_addr, sizeof (struct in_addr),
((struct sockaddr_in *)fromp)->sin_family);
if (hp) {
/*
* If name returned by gethostbyaddr is in our domain,
* attempt to verify that we haven't been fooled by someone
* in a remote net; look up the name and check that this
* address corresponds to the name.
*/
hostname = hp->h_name;
#if defined(KERBEROS)
if (!use_kerberos)
#endif
if (check_all || local_domain(hp->h_name)) {
strncpy(rhost, hp->h_name, sizeof(rhost) - 1);
rhost[sizeof(rhost) - 1] = 0;
errorhost = rhost;
hp = gethostbyname(rhost);
if (hp == NULL) {
syslog(LOG_INFO,
"Couldn't look up address for %s",
rhost);
errorstr =
"Couldn't look up address for your host (%s)\n";
hostname = inet_ntoa(((struct sockaddr_in *)fromp)->sin_addr);
} else for (; ; hp->h_addr_list++) {
if (hp->h_addr_list[0] == NULL) {
syslog(LOG_NOTICE,
"Host addr %s not listed for host %s",
inet_ntoa(((struct sockaddr_in *)fromp)->sin_addr),
hp->h_name);
errorstr =
"Host address mismatch for %s\n";
hostname = inet_ntoa(((struct sockaddr_in *)fromp)->sin_addr);
break;
}
if (!bcmp(hp->h_addr_list[0],
(caddr_t)&((struct sockaddr_in *)fromp)->sin_addr,
sizeof(((struct sockaddr_in *)fromp)->sin_addr))) {
hostname = hp->h_name;
break;
}
}
}
} else
errorhost = hostname = inet_ntoa(((struct sockaddr_in *)fromp)->sin_addr);
#if defined(KERBEROS)
if (use_kerberos) {
kdata = (AUTH_DAT *) authbuf;
ticket = (KTEXT) tickbuf;
authopts = 0L;
strcpy(instance, "*");
version[VERSION_SIZE - 1] = '\0';
#if defined(CRYPT)
if (doencrypt) {
struct sockaddr_in local_addr;
rc = sizeof(local_addr);
if (getsockname(0, (struct sockaddr *)&local_addr,
&rc) < 0) {
syslog(LOG_ERR, "getsockname: %m");
error("rshd: getsockname: %m");
exit(1);
}
authopts = KOPT_DO_MUTUAL;
rc = krb_recvauth(authopts, 0, ticket,
"rcmd", instance, &fromaddr,
&local_addr, kdata, "", schedule,
version);
des_set_key(kdata->session, schedule);
} else
#endif /* CRYPT */
rc = krb_recvauth(authopts, 0, ticket, "rcmd",
instance, &fromaddr,
(struct sockaddr_in *) 0,
kdata, "", (bit_64 *) 0, version);
if (rc != KSUCCESS) {
error("Kerberos authentication failure: %s\n",
krb_err_txt[rc]);
exit(1);
}
} else
#endif /* KERBEROS */
#endif
(void) alarm(60);
getstr(ruser, sizeof(ruser), "ruser");
getstr(luser, sizeof(luser), "luser");
getstr(cmdbuf, maxcmdlen, "command");
(void) alarm(0);
#if !TARGET_OS_EMBEDDED
pam_err = pam_start("rshd", luser, &pamc, &pamh);
if (pam_err != PAM_SUCCESS) {
syslog(LOG_ERR|LOG_AUTH, "pam_start(): %s",
pam_strerror(pamh, pam_err));
rshd_errx(1, "Login incorrect.");
}
if ((pam_err = pam_set_item(pamh, PAM_RUSER, ruser)) != PAM_SUCCESS ||
(pam_err = pam_set_item(pamh, PAM_RHOST, rhost) != PAM_SUCCESS)) {
syslog(LOG_ERR|LOG_AUTH, "pam_set_item(): %s",
pam_strerror(pamh, pam_err));
rshd_errx(1, "Login incorrect.");
}
pam_err = pam_authenticate(pamh, 0);
if (pam_err == PAM_SUCCESS) {
if ((pam_err = pam_get_user(pamh, &cp, NULL)) == PAM_SUCCESS) {
strncpy(luser, cp, sizeof(luser));
luser[sizeof(luser) - 1] = '\0';
/* XXX truncation! */
}
pam_err = pam_acct_mgmt(pamh, 0);
}
if (pam_err != PAM_SUCCESS) {
syslog(LOG_INFO|LOG_AUTH,
"%s@%s as %s: permission denied (%s). cmd='%.80s'",
ruser, rhost, luser, pam_strerror(pamh, pam_err), cmdbuf);
rshd_errx(1, "Login incorrect.");
}
#endif
setpwent();
pwd = getpwnam(luser);
if (pwd == NULL) {
syslog(LOG_INFO|LOG_AUTH,
"%s@%s as %s: unknown login. cmd='%.80s'",
ruser, rhost, luser, cmdbuf);
if (errorstr == NULL)
errorstr = "Login incorrect.";
rshd_errx(1, errorstr, rhost);
}
#ifndef __APPLE__
lc = login_getpwclass(pwd);
if (pwd->pw_uid)
auth_checknologin(lc);
#endif
if (chdir(pwd->pw_dir) < 0) {
if (chdir("/") < 0 ||
#ifndef __APPLE__
login_getcapbool(lc, "requirehome", !!pwd->pw_uid)) {
#else
0) {
#endif /* __APPLE__ */
#ifdef notdef
syslog(LOG_INFO|LOG_AUTH,
"%s@%s as %s: no home directory. cmd='%.80s'",
ruser, rhost, luser, cmdbuf);
rshd_errx(0, "No remote home directory.");
#endif
}
pwd->pw_dir = slash;
}
#if defined(KERBEROS)
if (use_kerberos) {
if (pwd->pw_passwd != 0 && *pwd->pw_passwd != '\0') {
if (kuserok(kdata, luser) != 0) {
syslog(LOG_INFO|LOG_AUTH,
"Kerberos rsh denied to %s.%s@%s",
kdata->pname, kdata->pinst, kdata->prealm);
error("Permission denied.\n");
exit(1);
}
}
} else
#endif
#ifdef __APPLE__
if (errorstr ||
(pwd->pw_passwd != 0 && *pwd->pw_passwd != '\0' &&
iruserok(((struct sockaddr_in *)fromp)->sin_addr.s_addr,
#if TARGET_OS_EMBEDDED
// rdar://problem/5381734
0,
#else
pwd->pw_uid == 0,
#endif
ruser, luser) < 0)) {
if (__rcmd_errstr)
syslog(LOG_INFO|LOG_AUTH,
"%s@%s as %s: permission denied (%s). cmd='%.80s'",
ruser, rhost, luser, __rcmd_errstr,
cmdbuf);
else
syslog(LOG_INFO|LOG_AUTH,
"%s@%s as %s: permission denied. cmd='%.80s'",
ruser, rhost, luser, cmdbuf);
if (errorstr == NULL)
errorstr = "Permission denied.";
rshd_errx(1, errorstr, errorhost);
}
if (pwd->pw_uid && !access(_PATH_NOLOGIN, F_OK)) {
rshd_errx(1, "Logins currently disabled.");
}
#else
if (lc != NULL && fromp->sa_family == AF_INET) { /*XXX*/
char remote_ip[MAXHOSTNAMELEN];
strncpy(remote_ip, numericname,
sizeof(remote_ip) - 1);
remote_ip[sizeof(remote_ip) - 1] = 0;
/* XXX truncation! */
if (!auth_hostok(lc, rhost, remote_ip)) {
syslog(LOG_INFO|LOG_AUTH,
"%s@%s as %s: permission denied (%s). cmd='%.80s'",
ruser, rhost, luser, __rcmd_errstr,
cmdbuf);
rshd_errx(1, "Login incorrect.");
}
if (!auth_timeok(lc, time(NULL)))
rshd_errx(1, "Logins not available right now");
}
/*
* PAM modules might add supplementary groups in
* pam_setcred(), so initialize them first.
* But we need to open the session as root.
*/
if (setusercontext(lc, pwd, pwd->pw_uid, LOGIN_SETGROUP) != 0) {
syslog(LOG_ERR, "setusercontext: %m");
exit(1);
}
#endif /* !__APPLE__ */
#if !TARGET_OS_EMBEDDED
if ((pam_err = pam_open_session(pamh, 0)) != PAM_SUCCESS) {
syslog(LOG_ERR, "pam_open_session: %s", pam_strerror(pamh, pam_err));
} else if ((pam_err = pam_setcred(pamh, PAM_ESTABLISH_CRED)) != PAM_SUCCESS) {
syslog(LOG_ERR, "pam_setcred: %s", pam_strerror(pamh, pam_err));
}
#endif
(void) write(STDERR_FILENO, "\0", 1);
sent_null = 1;
if (port) {
if (pipe(pv) < 0)
rshd_errx(1, "Can't make pipe.");
#if defined(KERBEROS) && defined(CRYPT)
if (doencrypt) {
if (pipe(pv1) < 0)
rshd_errx(1, "Can't make 2nd pipe.");
if (pipe(pv2) < 0)
rshd_errx(1, "Can't make 3rd pipe.");
}
#endif /* KERBEROS && CRYPT */
pid = fork();
if (pid == -1)
rshd_errx(1, "Can't fork; try again.");
if (pid) {
#if defined(KERBEROS) && defined(CRYPT)
if (doencrypt) {
static char msg[] = SECURE_MESSAGE;
(void) close(pv1[1]);
(void) close(pv2[1]);
des_write(s, msg, sizeof(msg) - 1);
} else
#endif /* KERBEROS && CRYPT */
(void) close(0);
(void) close(1);
(void) close(2);
(void) close(pv[1]);
FD_ZERO(&readfrom);
FD_SET(s, &readfrom);
FD_SET(pv[0], &readfrom);
if (pv[0] > s)
nfd = pv[0];
else
nfd = s;
#if defined(KERBEROS) && defined(CRYPT)
if (doencrypt) {
FD_ZERO(&writeto);
FD_SET(pv2[0], &writeto);
FD_SET(pv1[0], &readfrom);
nfd = MAX(nfd, pv2[0]);
nfd = MAX(nfd, pv1[0]);
} else
#endif /* KERBEROS && CRYPT */
ioctl(pv[0], FIONBIO, (char *)&one);
/* should set s nbio! */
nfd++;
do {
ready = readfrom;
#if defined(KERBEROS) && defined(CRYPT)
if (doencrypt) {
wready = writeto;
if (select(nfd, &ready,
&wready, (fd_set *) 0,
(struct timeval *) 0) < 0)
break;
} else
#endif /* KERBEROS && CRYPT */
if (select(nfd, &ready, (fd_set *)0,
(fd_set *)0, (struct timeval *)0) < 0)
break;
if (FD_ISSET(s, &ready)) {
int ret;
#if defined(KERBEROS) && defined(CRYPT)
if (doencrypt)
ret = des_read(s, &sig, 1);
else
#endif /* KERBEROS && CRYPT */
ret = read(s, &sig, 1);
if (ret <= 0)
FD_CLR(s, &readfrom);
else
killpg(pid, sig);
}
if (FD_ISSET(pv[0], &ready)) {
errno = 0;
cc = read(pv[0], buf, sizeof(buf));
if (cc <= 0) {
shutdown(s, SHUT_RDWR);
FD_CLR(pv[0], &readfrom);
} else {
#if defined(KERBEROS) && defined(CRYPT)
if (doencrypt)
(void)
des_write(s, buf, cc);
else
#endif /* KERBEROS && CRYPT */
(void)write(s, buf, cc);
}
}
#if defined(KERBEROS) && defined(CRYPT)
if (doencrypt && FD_ISSET(pv1[0], &ready)) {
errno = 0;
cc = read(pv1[0], buf, sizeof(buf));
if (cc <= 0) {
shutdown(pv1[0], 1+1);
FD_CLR(pv1[0], &readfrom);
} else
(void) des_write(STDOUT_FILENO,
buf, cc);
}
if (doencrypt && FD_ISSET(pv2[0], &wready)) {
errno = 0;
cc = des_read(STDIN_FILENO,
buf, sizeof(buf));
if (cc <= 0) {
shutdown(pv2[0], 1+1);
FD_CLR(pv2[0], &writeto);
} else
(void) write(pv2[0], buf, cc);
}
#endif /* KERBEROS && CRYPT */
} while (FD_ISSET(s, &readfrom) ||
#if defined(KERBEROS) && defined(CRYPT)
(doencrypt && FD_ISSET(pv1[0], &readfrom)) ||
#endif /* KERBEROS && CRYPT */
FD_ISSET(pv[0], &readfrom));
#if !TARGET_OS_EMBEDDED
PAM_END;
#endif
exit(0);
}
#ifdef __APPLE__
// rdar://problem/4485794
setpgid(0, getpid());
#endif
(void) close(s);
(void) close(pv[0]);
#if defined(KERBEROS) && defined(CRYPT)
if (doencrypt) {
close(pv1[0]); close(pv2[0]);
dup2(pv1[1], 1);
dup2(pv2[1], 0);
close(pv1[1]);
close(pv2[1]);
}
#endif /* KERBEROS && CRYPT */
dup2(pv[1], 2);
close(pv[1]);
}
#ifndef __APPLE__
else {
pid = fork();
if (pid == -1)
rshd_errx(1, "Can't fork; try again.");
if (pid) {
/* Parent. */
while (wait(NULL) > 0 || errno == EINTR)
/* nothing */ ;
PAM_END;
exit(0);
}
}
#endif
for (fd = getdtablesize(); fd > 2; fd--) {
#ifdef __APPLE__
(void) fcntl(fd, F_SETFD, FD_CLOEXEC);
#else
(void) close(fd);
#endif
}
if (setsid() == -1)
syslog(LOG_ERR, "setsid() failed: %m");
if (setlogin(pwd->pw_name) < 0)
syslog(LOG_ERR, "setlogin() failed: %m");
if (*pwd->pw_shell == '\0')
pwd->pw_shell = bshell;
#ifdef __APPLE__
(void) setgid((gid_t)pwd->pw_gid);
initgroups(pwd->pw_name, pwd->pw_gid);
(void) setuid((uid_t)pwd->pw_uid);
environ = envinit;
strncat(homedir, pwd->pw_dir, sizeof(homedir)-6);
strcat(path, _PATH_DEFPATH);
strncat(shell, pwd->pw_shell, sizeof(shell)-7);
strncat(username, pwd->pw_name, sizeof(username)-6);
#endif
#if !TARGET_OS_EMBEDDED
(void) pam_setenv(pamh, "HOME", pwd->pw_dir, 1);
(void) pam_setenv(pamh, "SHELL", pwd->pw_shell, 1);
(void) pam_setenv(pamh, "USER", pwd->pw_name, 1);
(void) pam_setenv(pamh, "PATH", _PATH_DEFPATH, 1);
environ = pam_getenvlist(pamh);
(void) pam_end(pamh, pam_err);
#endif
cp = strrchr(pwd->pw_shell, '/');
if (cp)
cp++;
else
cp = pwd->pw_shell;
#ifndef __APPLE__
if (setusercontext(lc, pwd, pwd->pw_uid,
LOGIN_SETALL & ~LOGIN_SETGROUP) < 0) {
syslog(LOG_ERR, "setusercontext(): %m");
exit(1);
}
login_close(lc);
#endif
endpwent();
if (log_success || pwd->pw_uid == 0) {
#if defined(KERBEROS)
if (use_kerberos)
syslog(LOG_INFO|LOG_AUTH,
"Kerberos shell from %s.%s@%s on %s as %s, cmd='%.80s'",
kdata->pname, kdata->pinst, kdata->prealm,
hostname, luser, cmdbuf);
else
#endif /* KERBEROS */
syslog(LOG_INFO|LOG_AUTH, "%s@%s as %s: cmd='%.80s'",
ruser, rhost, luser, cmdbuf);
}
execl(pwd->pw_shell, cp, "-c", cmdbuf, (char *)NULL);
err(1, "%s", pwd->pw_shell);
exit(1);
}
void
doit(struct sockaddr *fromp)
{
extern char *__rcmd_errstr; /* syslog hook from libc/net/rcmd.c. */
struct passwd *pwd;
u_short port;
fd_set ready, readfrom;
int cc, fd, nfd, pv[2], pid, s;
int one = 1;
const char *cp, *errorstr;
char sig, buf[BUFSIZ];
char *cmdbuf, luser[16], ruser[16];
char rhost[2 * MAXHOSTNAMELEN + 1];
char numericname[INET6_ADDRSTRLEN];
int af, srcport;
int maxcmdlen;
login_cap_t *lc;
maxcmdlen = (int)sysconf(_SC_ARG_MAX);
if (maxcmdlen <= 0 || (cmdbuf = malloc(maxcmdlen)) == NULL)
exit(1);
(void) signal(SIGINT, SIG_DFL);
(void) signal(SIGQUIT, SIG_DFL);
(void) signal(SIGTERM, SIG_DFL);
af = fromp->sa_family;
srcport = ntohs(*((in_port_t *)&fromp->sa_data));
if (af == AF_INET) {
inet_ntop(af, &((struct sockaddr_in *)fromp)->sin_addr,
numericname, sizeof numericname);
} else if (af == AF_INET6) {
inet_ntop(af, &((struct sockaddr_in6 *)fromp)->sin6_addr,
numericname, sizeof numericname);
} else {
syslog(LOG_ERR, "malformed \"from\" address (af %d)", af);
exit(1);
}
#ifdef IP_OPTIONS
if (af == AF_INET) {
u_char optbuf[BUFSIZ/3];
socklen_t optsize = sizeof(optbuf), ipproto, i;
struct protoent *ip;
if ((ip = getprotobyname("ip")) != NULL)
ipproto = ip->p_proto;
else
ipproto = IPPROTO_IP;
if (!getsockopt(0, ipproto, IP_OPTIONS, optbuf, &optsize) &&
optsize != 0) {
for (i = 0; i < optsize; ) {
u_char c = optbuf[i];
if (c == IPOPT_LSRR || c == IPOPT_SSRR) {
syslog(LOG_NOTICE,
"connection refused from %s with IP option %s",
numericname,
c == IPOPT_LSRR ? "LSRR" : "SSRR");
exit(1);
}
if (c == IPOPT_EOL)
break;
i += (c == IPOPT_NOP) ? 1 : optbuf[i+1];
}
}
}
#endif
if (srcport >= IPPORT_RESERVED ||
srcport < IPPORT_RESERVED/2) {
syslog(LOG_NOTICE|LOG_AUTH,
"connection from %s on illegal port %u",
numericname,
srcport);
exit(1);
}
(void) alarm(60);
port = 0;
s = 0; /* not set or used if port == 0 */
for (;;) {
char c;
if ((cc = read(STDIN_FILENO, &c, 1)) != 1) {
if (cc < 0)
syslog(LOG_NOTICE, "read: %m");
shutdown(0, SHUT_RDWR);
exit(1);
}
if (c == 0)
break;
port = port * 10 + c - '0';
}
(void) alarm(0);
if (port != 0) {
int lport = IPPORT_RESERVED - 1;
s = rresvport_af(&lport, af);
if (s < 0) {
syslog(LOG_ERR, "can't get stderr port: %m");
exit(1);
}
if (port >= IPPORT_RESERVED ||
port < IPPORT_RESERVED/2) {
syslog(LOG_NOTICE|LOG_AUTH,
"2nd socket from %s on unreserved port %u",
numericname,
port);
exit(1);
}
*((in_port_t *)&fromp->sa_data) = htons(port);
if (connect(s, fromp, fromp->sa_len) < 0) {
syslog(LOG_INFO, "connect second port %d: %m", port);
exit(1);
}
}
errorstr = NULL;
realhostname_sa(rhost, sizeof(rhost) - 1, fromp, fromp->sa_len);
rhost[sizeof(rhost) - 1] = '\0';
/* XXX truncation! */
(void) alarm(60);
getstr(ruser, sizeof(ruser), "ruser");
getstr(luser, sizeof(luser), "luser");
getstr(cmdbuf, maxcmdlen, "command");
(void) alarm(0);
pam_err = pam_start("rsh", luser, &pamc, &pamh);
if (pam_err != PAM_SUCCESS) {
syslog(LOG_ERR|LOG_AUTH, "pam_start(): %s",
pam_strerror(pamh, pam_err));
rshd_errx(1, "Login incorrect.");
}
if ((pam_err = pam_set_item(pamh, PAM_RUSER, ruser)) != PAM_SUCCESS ||
(pam_err = pam_set_item(pamh, PAM_RHOST, rhost)) != PAM_SUCCESS) {
syslog(LOG_ERR|LOG_AUTH, "pam_set_item(): %s",
pam_strerror(pamh, pam_err));
rshd_errx(1, "Login incorrect.");
}
pam_err = pam_authenticate(pamh, 0);
if (pam_err == PAM_SUCCESS) {
if ((pam_err = pam_get_user(pamh, &cp, NULL)) == PAM_SUCCESS) {
strncpy(luser, cp, sizeof(luser));
luser[sizeof(luser) - 1] = '\0';
/* XXX truncation! */
}
pam_err = pam_acct_mgmt(pamh, 0);
}
if (pam_err != PAM_SUCCESS) {
syslog(LOG_INFO|LOG_AUTH,
"%s@%s as %s: permission denied (%s). cmd='%.80s'",
ruser, rhost, luser, pam_strerror(pamh, pam_err), cmdbuf);
rshd_errx(1, "Login incorrect.");
}
setpwent();
pwd = getpwnam(luser);
if (pwd == NULL) {
syslog(LOG_INFO|LOG_AUTH,
"%s@%s as %s: unknown login. cmd='%.80s'",
ruser, rhost, luser, cmdbuf);
if (errorstr == NULL)
errorstr = "Login incorrect.";
rshd_errx(1, errorstr, rhost);
}
lc = login_getpwclass(pwd);
if (pwd->pw_uid)
auth_checknologin(lc);
if (chdir(pwd->pw_dir) < 0) {
if (chdir("/") < 0 ||
login_getcapbool(lc, "requirehome", !!pwd->pw_uid)) {
syslog(LOG_INFO|LOG_AUTH,
"%s@%s as %s: no home directory. cmd='%.80s'",
ruser, rhost, luser, cmdbuf);
rshd_errx(0, "No remote home directory.");
}
pwd->pw_dir = slash;
}
if (lc != NULL && fromp->sa_family == AF_INET) { /*XXX*/
char remote_ip[MAXHOSTNAMELEN];
strncpy(remote_ip, numericname,
sizeof(remote_ip) - 1);
remote_ip[sizeof(remote_ip) - 1] = 0;
/* XXX truncation! */
if (!auth_hostok(lc, rhost, remote_ip)) {
syslog(LOG_INFO|LOG_AUTH,
"%s@%s as %s: permission denied (%s). cmd='%.80s'",
ruser, rhost, luser, __rcmd_errstr,
cmdbuf);
rshd_errx(1, "Login incorrect.");
}
if (!auth_timeok(lc, time(NULL)))
rshd_errx(1, "Logins not available right now");
}
/*
* PAM modules might add supplementary groups in
* pam_setcred(), so initialize them first.
* But we need to open the session as root.
*/
if (setusercontext(lc, pwd, pwd->pw_uid, LOGIN_SETGROUP) != 0) {
syslog(LOG_ERR, "setusercontext: %m");
exit(1);
}
if ((pam_err = pam_open_session(pamh, 0)) != PAM_SUCCESS) {
syslog(LOG_ERR, "pam_open_session: %s", pam_strerror(pamh, pam_err));
} else if ((pam_err = pam_setcred(pamh, PAM_ESTABLISH_CRED)) != PAM_SUCCESS) {
syslog(LOG_ERR, "pam_setcred: %s", pam_strerror(pamh, pam_err));
}
(void) write(STDERR_FILENO, "\0", 1);
sent_null = 1;
if (port) {
if (pipe(pv) < 0)
rshd_errx(1, "Can't make pipe.");
pid = fork();
if (pid == -1)
rshd_errx(1, "Can't fork; try again.");
if (pid) {
(void) close(0);
(void) close(1);
(void) close(2);
(void) close(pv[1]);
FD_ZERO(&readfrom);
FD_SET(s, &readfrom);
FD_SET(pv[0], &readfrom);
if (pv[0] > s)
nfd = pv[0];
else
nfd = s;
ioctl(pv[0], FIONBIO, (char *)&one);
/* should set s nbio! */
nfd++;
do {
ready = readfrom;
if (select(nfd, &ready, (fd_set *)0,
(fd_set *)0, (struct timeval *)0) < 0)
break;
if (FD_ISSET(s, &ready)) {
int ret;
ret = read(s, &sig, 1);
if (ret <= 0)
FD_CLR(s, &readfrom);
else
killpg(pid, sig);
}
if (FD_ISSET(pv[0], &ready)) {
errno = 0;
cc = read(pv[0], buf, sizeof(buf));
if (cc <= 0) {
shutdown(s, SHUT_RDWR);
FD_CLR(pv[0], &readfrom);
} else {
(void)write(s, buf, cc);
}
}
} while (FD_ISSET(s, &readfrom) ||
FD_ISSET(pv[0], &readfrom));
PAM_END;
exit(0);
}
(void) close(s);
(void) close(pv[0]);
dup2(pv[1], 2);
close(pv[1]);
}
else {
pid = fork();
if (pid == -1)
rshd_errx(1, "Can't fork; try again.");
if (pid) {
/* Parent. */
while (wait(NULL) > 0 || errno == EINTR)
/* nothing */ ;
PAM_END;
exit(0);
}
}
for (fd = getdtablesize(); fd > 2; fd--)
(void) close(fd);
if (setsid() == -1)
syslog(LOG_ERR, "setsid() failed: %m");
if (setlogin(pwd->pw_name) < 0)
syslog(LOG_ERR, "setlogin() failed: %m");
if (*pwd->pw_shell == '\0')
pwd->pw_shell = bshell;
(void) pam_setenv(pamh, "HOME", pwd->pw_dir, 1);
(void) pam_setenv(pamh, "SHELL", pwd->pw_shell, 1);
(void) pam_setenv(pamh, "USER", pwd->pw_name, 1);
(void) pam_setenv(pamh, "PATH", _PATH_DEFPATH, 1);
environ = pam_getenvlist(pamh);
(void) pam_end(pamh, pam_err);
cp = strrchr(pwd->pw_shell, '/');
if (cp)
cp++;
else
cp = pwd->pw_shell;
if (setusercontext(lc, pwd, pwd->pw_uid,
LOGIN_SETALL & ~LOGIN_SETGROUP) < 0) {
syslog(LOG_ERR, "setusercontext(): %m");
exit(1);
}
login_close(lc);
endpwent();
if (log_success || pwd->pw_uid == 0) {
syslog(LOG_INFO|LOG_AUTH, "%s@%s as %s: cmd='%.80s'",
ruser, rhost, luser, cmdbuf);
}
execl(pwd->pw_shell, cp, "-c", cmdbuf, (char *)NULL);
err(1, "%s", pwd->pw_shell);
exit(1);
}
int
main(int argc, char *argv[])
{
FILE *fp;
int ch;
char *lp;
struct sockaddr_storage ss;
socklen_t sval;
int p[2], debug, kflag, logging, pflag, secure;
#define ENTRIES 50
char **ap, *av[ENTRIES + 1], **comp, line[1024], *prog;
char rhost[MAXHOSTNAMELEN];
prog = _PATH_FINGER;
debug = logging = kflag = pflag = secure = 0;
openlog("fingerd", LOG_PID | LOG_CONS, LOG_DAEMON);
opterr = 0;
while ((ch = getopt(argc, argv, "dklp:s")) != -1)
switch (ch) {
case 'd':
debug = 1;
break;
case 'k':
kflag = 1;
break;
case 'l':
logging = 1;
break;
case 'p':
prog = optarg;
pflag = 1;
break;
case 's':
secure = 1;
break;
case '?':
default:
logerr("illegal option -- %c", optopt);
}
/*
* Enable server-side Transaction TCP.
*/
if (!debug) {
int one = 1;
if (setsockopt(STDOUT_FILENO, IPPROTO_TCP, TCP_NOPUSH, &one,
sizeof one) < 0) {
logerr("setsockopt(TCP_NOPUSH) failed: %m");
}
}
if (!fgets(line, sizeof(line), stdin))
exit(1);
if (!debug && (logging || pflag)) {
sval = sizeof(ss);
if (getpeername(0, (struct sockaddr *)&ss, &sval) < 0)
logerr("getpeername: %s", strerror(errno));
realhostname_sa(rhost, sizeof rhost - 1,
(struct sockaddr *)&ss, sval);
rhost[sizeof(rhost) - 1] = '\0';
if (pflag)
setenv("FINGERD_REMOTE_HOST", rhost, 1);
}
if (logging) {
char *t;
char *end;
end = memchr(line, 0, sizeof(line));
if (end == NULL) {
if ((t = malloc(sizeof(line) + 1)) == NULL)
logerr("malloc: %s", strerror(errno));
memcpy(t, line, sizeof(line));
t[sizeof(line)] = 0;
} else {
if ((t = strdup(line)) == NULL)
logerr("strdup: %s", strerror(errno));
}
for (end = t; *end; end++)
if (*end == '\n' || *end == '\r')
*end = ' ';
syslog(LOG_NOTICE, "query from %s: `%s'", rhost, t);
}
comp = &av[2];
av[3] = "--";
if (kflag)
*comp-- = "-k";
for (lp = line, ap = &av[4];;) {
*ap = strtok(lp, " \t\r\n");
if (!*ap) {
if (secure && ap == &av[4]) {
puts("must provide username\r\n");
exit(1);
}
break;
}
if (secure && strchr(*ap, '@')) {
puts("forwarding service denied\r\n");
exit(1);
}
/* RFC742: "/[Ww]" == "-l" */
if ((*ap)[0] == '/' && ((*ap)[1] == 'W' || (*ap)[1] == 'w')) {
*comp-- = "-l";
}
else if (++ap == av + ENTRIES) {
*ap = NULL;
break;
}
lp = NULL;
}
if ((lp = strrchr(prog, '/')) != NULL)
*comp = ++lp;
else
*comp = prog;
if (pipe(p) < 0)
logerr("pipe: %s", strerror(errno));
if (debug) {
fprintf(stderr, "%s", prog);
for (ap = comp; *ap != NULL; ++ap)
fprintf(stderr, " %s", *ap);
fprintf(stderr, "\n");
}
switch(vfork()) {
case 0:
(void)close(p[0]);
if (p[1] != STDOUT_FILENO) {
(void)dup2(p[1], STDOUT_FILENO);
(void)close(p[1]);
}
dup2(STDOUT_FILENO, STDERR_FILENO);
execv(prog, comp);
write(STDERR_FILENO, prog, strlen(prog));
#define MSG ": cannot execute\n"
write(STDERR_FILENO, MSG, strlen(MSG));
#undef MSG
_exit(1);
case -1:
logerr("fork: %s", strerror(errno));
}
(void)close(p[1]);
if (!(fp = fdopen(p[0], "r")))
logerr("fdopen: %s", strerror(errno));
while ((ch = getc(fp)) != EOF) {
if (ch == '\n')
putchar('\r');
putchar(ch);
}
exit(0);
}