1 /*
2 * rfc931() speaks a common subset of the RFC 931, AUTH, TAP, IDENT and RFC
3 * 1413 protocols. It queries an RFC 931 etc. compatible daemon on a remote
4 * host to look up the owner of a connection. The information should not be
5 * used for authentication purposes. This routine intercepts alarm signals.
6 *
7 * Diagnostics are reported through syslog(3).
8 *
9 * Author: Wietse Venema, Eindhoven University of Technology, The Netherlands.
10 *
11 * $FreeBSD: src/contrib/tcp_wrappers/rfc931.c,v 1.2.2.1 2000/07/18 16:41:11 dwmalone Exp $
12 */
13
14 /* System libraries. */
15
16 #include <stdio.h>
17 #include <syslog.h>
18 #include <sys/types.h>
19 #include <sys/socket.h>
20 #include <netinet/in.h>
21 #include <setjmp.h>
22 #include <signal.h>
23 #include <string.h>
24 #include <unistd.h>
25
26 #ifndef SEEK_SET
27 #define SEEK_SET 0
28 #endif
29
30 /* Local stuff. */
31
32 #include "tcpd.h"
33
34 #define RFC931_PORT 113 /* Semi-well-known port */
35 #define ANY_PORT 0 /* Any old port will do */
36
37 int rfc931_timeout = RFC931_TIMEOUT;/* Global so it can be changed */
38
39 static jmp_buf timebuf;
40
41 /* fsocket - open stdio stream on top of socket */
42
fsocket(domain,type,protocol)43 static FILE *fsocket(domain, type, protocol)
44 int domain;
45 int type;
46 int protocol;
47 {
48 int s;
49 FILE *fp;
50
51 if ((s = socket(domain, type, protocol)) < 0) {
52 tcpd_warn("socket: %m");
53 return (0);
54 } else {
55 if ((fp = fdopen(s, "r+")) == 0) {
56 tcpd_warn("fdopen: %m");
57 close(s);
58 }
59 return (fp);
60 }
61 }
62
63 /* timeout - handle timeouts */
64
timeout(sig)65 static void timeout(sig)
66 int sig;
67 {
68 longjmp(timebuf, sig);
69 }
70
71 /* rfc931 - return remote user name, given socket structures */
72
rfc931(rmt_sin,our_sin,dest)73 void rfc931(rmt_sin, our_sin, dest)
74 #ifdef INET6
75 struct sockaddr *rmt_sin;
76 struct sockaddr *our_sin;
77 #else
78 struct sockaddr_in *rmt_sin;
79 struct sockaddr_in *our_sin;
80 #endif
81 char *dest;
82 {
83 unsigned rmt_port;
84 unsigned our_port;
85 #ifdef INET6
86 struct sockaddr_storage rmt_query_sin;
87 struct sockaddr_storage our_query_sin;
88 int alen;
89 #else
90 struct sockaddr_in rmt_query_sin;
91 struct sockaddr_in our_query_sin;
92 #endif
93 char user[256]; /* XXX */
94 char buffer[512]; /* XXX */
95 char *cp;
96 char *result = unknown;
97 FILE *fp;
98
99 #ifdef INET6
100 /* address family must be the same */
101 if (rmt_sin->sa_family != our_sin->sa_family) {
102 STRN_CPY(dest, result, STRING_LENGTH);
103 return;
104 }
105 switch (our_sin->sa_family) {
106 case AF_INET:
107 alen = sizeof(struct sockaddr_in);
108 break;
109 case AF_INET6:
110 alen = sizeof(struct sockaddr_in6);
111 break;
112 default:
113 STRN_CPY(dest, result, STRING_LENGTH);
114 return;
115 }
116 #endif
117
118 /*
119 * If we use a single, buffered, bidirectional stdio stream ("r+" or
120 * "w+" mode) we may read our own output. Such behaviour would make sense
121 * with resources that support random-access operations, but not with
122 * sockets. ANSI C suggests several functions which can be called when
123 * you want to change IO direction, fseek seems the most portable.
124 */
125
126 #ifdef INET6
127 if ((fp = fsocket(our_sin->sa_family, SOCK_STREAM, 0)) != 0) {
128 #else
129 if ((fp = fsocket(AF_INET, SOCK_STREAM, 0)) != 0) {
130 #endif
131 /*
132 * Set up a timer so we won't get stuck while waiting for the server.
133 */
134
135 if (setjmp(timebuf) == 0) {
136 signal(SIGALRM, timeout);
137 alarm(rfc931_timeout);
138
139 /*
140 * Bind the local and remote ends of the query socket to the same
141 * IP addresses as the connection under investigation. We go
142 * through all this trouble because the local or remote system
143 * might have more than one network address. The RFC931 etc.
144 * client sends only port numbers; the server takes the IP
145 * addresses from the query socket.
146 */
147
148 #ifdef INET6
149 memcpy(&our_query_sin, our_sin, alen);
150 memcpy(&rmt_query_sin, rmt_sin, alen);
151 switch (our_sin->sa_family) {
152 case AF_INET:
153 ((struct sockaddr_in *)&our_query_sin)->sin_port = htons(ANY_PORT);
154 ((struct sockaddr_in *)&rmt_query_sin)->sin_port = htons(RFC931_PORT);
155 break;
156 case AF_INET6:
157 ((struct sockaddr_in6 *)&our_query_sin)->sin6_port = htons(ANY_PORT);
158 ((struct sockaddr_in6 *)&rmt_query_sin)->sin6_port = htons(RFC931_PORT);
159 break;
160 }
161
162 if (bind(fileno(fp), (struct sockaddr *) & our_query_sin,
163 alen) >= 0 &&
164 connect(fileno(fp), (struct sockaddr *) & rmt_query_sin,
165 alen) >= 0) {
166 #else
167 our_query_sin = *our_sin;
168 our_query_sin.sin_port = htons(ANY_PORT);
169 rmt_query_sin = *rmt_sin;
170 rmt_query_sin.sin_port = htons(RFC931_PORT);
171
172 if (bind(fileno(fp), (struct sockaddr *) & our_query_sin,
173 sizeof(our_query_sin)) >= 0 &&
174 connect(fileno(fp), (struct sockaddr *) & rmt_query_sin,
175 sizeof(rmt_query_sin)) >= 0) {
176 #endif
177
178 /*
179 * Send query to server. Neglect the risk that a 13-byte
180 * write would have to be fragmented by the local system and
181 * cause trouble with buggy System V stdio libraries.
182 */
183
184 fprintf(fp, "%u,%u\r\n",
185 #ifdef INET6
186 ntohs(((struct sockaddr_in *)rmt_sin)->sin_port),
187 ntohs(((struct sockaddr_in *)our_sin)->sin_port));
188 #else
189 ntohs(rmt_sin->sin_port),
190 ntohs(our_sin->sin_port));
191 #endif
192 fflush(fp);
193 fseek(fp, 0, SEEK_SET);
194
195 /*
196 * Read response from server. Use fgets()/sscanf() so we can
197 * work around System V stdio libraries that incorrectly
198 * assume EOF when a read from a socket returns less than
199 * requested.
200 */
201
202 if (fgets(buffer, sizeof(buffer), fp) != 0
203 && ferror(fp) == 0 && feof(fp) == 0
204 && sscanf(buffer, "%u , %u : USERID :%*[^:]:%255s",
205 &rmt_port, &our_port, user) == 3
206 #ifdef INET6
207 && ntohs(((struct sockaddr_in *)rmt_sin)->sin_port) == rmt_port
208 && ntohs(((struct sockaddr_in *)our_sin)->sin_port) == our_port) {
209 #else
210 && ntohs(rmt_sin->sin_port) == rmt_port
211 && ntohs(our_sin->sin_port) == our_port) {
212 #endif
213
214 /*
215 * Strip trailing carriage return. It is part of the
216 * protocol, not part of the data.
217 */
218
219 if ((cp = strchr(user, '\r')) != NULL)
220 *cp = 0;
221 result = user;
222 }
223 }
224 alarm(0);
225 }
226 fclose(fp);
227 }
228 STRN_CPY(dest, result, STRING_LENGTH);
229 }
230