1 /*        $NetBSD: rlogind.c,v 1.42 2012/11/04 21:35:45 christos Exp $          */
2 
3 /*
4  * Copyright (C) 1998 WIDE Project.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. All advertising materials mentioning features or use of this software
16  *    must display the following acknowledgement:
17  *    This product includes software developed by WIDE Project and
18  *    its contributors.
19  * 4. Neither the name of the project nor the names of its contributors
20  *    may be used to endorse or promote products derived from this software
21  *    without specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33  * SUCH DAMAGE.
34  */
35 
36 /*-
37  * Copyright (c) 1983, 1988, 1989, 1993
38  *        The Regents of the University of California.  All rights reserved.
39  *
40  * Redistribution and use in source and binary forms, with or without
41  * modification, are permitted provided that the following conditions
42  * are met:
43  * 1. Redistributions of source code must retain the above copyright
44  *    notice, this list of conditions and the following disclaimer.
45  * 2. Redistributions in binary form must reproduce the above copyright
46  *    notice, this list of conditions and the following disclaimer in the
47  *    documentation and/or other materials provided with the distribution.
48  * 3. Neither the name of the University nor the names of its contributors
49  *    may be used to endorse or promote products derived from this software
50  *    without specific prior written permission.
51  *
52  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
53  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
54  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
55  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
56  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
57  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
58  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
59  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
60  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
61  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
62  * SUCH DAMAGE.
63  */
64 
65 #include <sys/cdefs.h>
66 #ifndef lint
67 __COPYRIGHT("@(#) Copyright (c) 1983, 1988, 1989, 1993\
68  The Regents of the University of California.  All rights reserved.");
69 #if 0
70 static char sccsid[] = "@(#)rlogind.c   8.2 (Berkeley) 4/28/95";
71 #else
72 __RCSID("$NetBSD: rlogind.c,v 1.42 2012/11/04 21:35:45 christos Exp $");
73 #endif
74 #endif /* not lint */
75 
76 /*
77  * remote login server:
78  *        \0
79  *        remuser\0
80  *        locuser\0
81  *        terminal_type/speed\0
82  *        data
83  */
84 
85 #include <sys/param.h>
86 #include <sys/stat.h>
87 #include <sys/ioctl.h>
88 #include <signal.h>
89 #include <termios.h>
90 #include <poll.h>
91 #include <vis.h>
92 
93 #include <sys/socket.h>
94 #include <netinet/in.h>
95 #include <netinet/in_systm.h>
96 #include <netinet/ip.h>
97 #include <arpa/inet.h>
98 #include <netdb.h>
99 
100 #include <pwd.h>
101 #include <syslog.h>
102 #include <errno.h>
103 #include <stdio.h>
104 #include <unistd.h>
105 #include <stdlib.h>
106 #include <string.h>
107 #ifdef SUPPORT_UTMPX
108 #include <utmpx.h>
109 #endif
110 #include <util.h>
111 #include "pathnames.h"
112 
113 #ifndef TIOCPKT_WINDOW
114 #define TIOCPKT_WINDOW 0x80
115 #endif
116 
117 #define             OPTIONS                       "alnL"
118 
119 static char         *env[2];
120 #define   NMAX 30
121 static char         lusername[NMAX+1], rusername[NMAX+1];
122 static    char term[64] = "TERM=";
123 #define   ENVSIZE   (sizeof("TERM=")-1) /* skip null for concatenation */
124 static int          keepalive = 1;
125 static int          check_all = 0;
126 static int          log_success = 0;
127 
128 static struct       passwd *pwd;
129 
130 __dead static void  doit(int, struct sockaddr_storage *);
131 static int          control(int, char *, int);
132 static void         protocol(int, int);
133 __dead static void  cleanup(int);
134 __dead static void  fatal(int, const char *, int);
135 static int          do_rlogin(struct sockaddr *, char *);
136 static void         getstr(char *, int, const char *);
137 static void         setup_term(int);
138 #if 0
139 static int          do_krb_login(union sockunion *);
140 #endif
141 __dead static void  usage(void);
142 static int          local_domain(char *);
143 static char         *topdomain(char *);
144 
145 extern int __check_rhosts_file;
146 extern char *__rcmd_errstr;   /* syslog hook from libc/net/rcmd.c */
147 extern char **environ;
148 
149 int
main(int argc,char * argv[])150 main(int argc, char *argv[])
151 {
152           struct sockaddr_storage from;
153           int ch, on;
154           socklen_t fromlen = sizeof(from);
155 
156           openlog("rlogind", LOG_PID, LOG_AUTH);
157 
158           opterr = 0;
159           while ((ch = getopt(argc, argv, OPTIONS)) != -1)
160                     switch (ch) {
161                     case 'a':
162                               check_all = 1;
163                               break;
164                     case 'l':
165                               __check_rhosts_file = 0;
166                               break;
167                     case 'n':
168                               keepalive = 0;
169                               break;
170                     case 'L':
171                               log_success = 1;
172                               break;
173                     case '?':
174                     default:
175                               usage();
176                               break;
177                     }
178           argc -= optind;
179           argv += optind;
180 
181           if (getpeername(0, (struct sockaddr *)&from, &fromlen) < 0) {
182                     syslog(LOG_ERR,"Can't get peer name of remote host: %m");
183                     fatal(STDERR_FILENO, "Can't get peer name of remote host", 1);
184           }
185 #ifdef INET6
186           if (from.ss_family == AF_INET6 &&
187               IN6_IS_ADDR_V4MAPPED(&((struct sockaddr_in6 *)&from)->sin6_addr) &&
188               sizeof(struct sockaddr_in) <= sizeof(from)) {
189                     struct sockaddr_in sin4;
190                     struct sockaddr_in6 *sin6;
191                     const int off = sizeof(struct sockaddr_in6) -
192                         sizeof(struct sockaddr_in);
193 
194                     sin6 = (struct sockaddr_in6 *)&from;
195                     memset(&sin4, 0, sizeof(sin4));
196                     sin4.sin_family = AF_INET;
197                     sin4.sin_len = sizeof(struct sockaddr_in);
198                     memcpy(&sin4.sin_addr, &sin6->sin6_addr.s6_addr[off],
199                         sizeof(sin4.sin_addr));
200                     memcpy(&from, &sin4, sizeof(sin4));
201           }
202 #else
203           if (from.ss_family == AF_INET6 &&
204               IN6_IS_ADDR_V4MAPPED(&((struct sockaddr_in6 *)&from)->sin6_addr)) {
205                     char hbuf[NI_MAXHOST];
206                     if (getnameinfo((struct sockaddr *)&from, fromlen, hbuf,
207                                         sizeof(hbuf), NULL, 0, NI_NUMERICHOST) != 0) {
208                               strlcpy(hbuf, "invalid", sizeof(hbuf));
209                     }
210                     syslog(LOG_ERR, "malformed \"from\" address (v4 mapped, %s)\n",
211                         hbuf);
212                     exit(1);
213           }
214 #endif
215           on = 1;
216           if (keepalive &&
217               setsockopt(0, SOL_SOCKET, SO_KEEPALIVE, &on, sizeof (on)) < 0)
218                     syslog(LOG_WARNING, "setsockopt (SO_KEEPALIVE): %m");
219 #if defined(IP_TOS)
220           if (from.ss_family == AF_INET) {
221                     on = IPTOS_LOWDELAY;
222                     if (setsockopt(0, IPPROTO_IP, IP_TOS, (char *)&on, sizeof(int)) < 0)
223                               syslog(LOG_WARNING, "setsockopt (IP_TOS): %m");
224           }
225 #endif
226           doit(0, &from);
227           /* NOTREACHED */
228 #ifdef __GNUC__
229           exit(0);
230 #endif
231 }
232 
233 static int          netf;
234 static char         line[MAXPATHLEN];
235 static int          confirmed;
236 
237 static struct winsize win = { 0, 0, 0, 0 };
238 
239 static void
doit(int f,struct sockaddr_storage * fromp)240 doit(int f, struct sockaddr_storage *fromp)
241 {
242           int master, pid, on = 1;
243           int authenticated = 0;
244           char *hostname;
245           char hostnamebuf[2 * MAXHOSTNAMELEN + 1];
246           char hostaddrbuf[sizeof(*fromp) * 4 + 1];
247           char c;
248           char naddr[NI_MAXHOST];
249           char saddr[NI_MAXHOST];
250           char raddr[NI_MAXHOST];
251           int af = fromp->ss_family;
252           u_int16_t *portp;
253           struct addrinfo hints, *res, *res0;
254           int gaierror;
255           socklen_t fromlen = fromp->ss_len > sizeof(*fromp)
256               ? sizeof(*fromp) : fromp->ss_len;
257           const int niflags = NI_NUMERICHOST | NI_NUMERICSERV;
258 
259           alarm(60);
260           read(f, &c, 1);
261 
262           if (c != 0)
263                     exit(1);
264 
265           alarm(0);
266           switch (af) {
267           case AF_INET:
268                     portp = &((struct sockaddr_in *)fromp)->sin_port;
269                     break;
270 #ifdef INET6
271           case AF_INET6:
272                     portp = &((struct sockaddr_in6 *)fromp)->sin6_port;
273                     break;
274 #endif
275           default:
276                     syslog(LOG_ERR, "malformed \"from\" address (af %d)\n", af);
277                     exit(1);
278           }
279           if (getnameinfo((struct sockaddr *)fromp, fromlen,
280                         naddr, sizeof(naddr), NULL, 0, niflags) != 0) {
281                     syslog(LOG_ERR, "malformed \"from\" address (af %d)\n", af);
282                     exit(1);
283           }
284 
285           if (getnameinfo((struct sockaddr *)fromp, fromlen,
286                         saddr, sizeof(saddr), NULL, 0, NI_NAMEREQD) == 0) {
287                     /*
288                      * If name returned by getnameinfo is in our domain,
289                      * attempt to verify that we haven't been fooled by someone
290                      * in a remote net; look up the name and check that this
291                      * address corresponds to the name.
292                      */
293                     hostname = saddr;
294                     res0 = NULL;
295                     if (check_all || local_domain(saddr)) {
296                               strlcpy(hostnamebuf, saddr, sizeof(hostnamebuf));
297                               memset(&hints, 0, sizeof(hints));
298                               hints.ai_family = fromp->ss_family;
299                               hints.ai_socktype = SOCK_STREAM;
300                               hints.ai_flags = AI_CANONNAME;
301                               gaierror = getaddrinfo(hostnamebuf, "0", &hints, &res0);
302                               if (gaierror) {
303                                         syslog(LOG_NOTICE,
304                                             "Couldn't look up address for %s: %s",
305                                             hostnamebuf, gai_strerror(gaierror));
306                                         hostname = naddr;
307                               } else {
308                                         for (res = res0; res; res = res->ai_next) {
309                                                   if (res->ai_family != fromp->ss_family)
310                                                             continue;
311                                                   if (res->ai_addrlen != fromp->ss_len)
312                                                             continue;
313                                                   if (getnameinfo(res->ai_addr,
314                                                             res->ai_addrlen,
315                                                             raddr, sizeof(raddr), NULL, 0,
316                                                             niflags) == 0
317                                                    && strcmp(naddr, raddr) == 0) {
318                                                             hostname = res->ai_canonname
319                                                                       ? res->ai_canonname
320                                                                       : saddr;
321                                                             break;
322                                                   }
323                                         }
324                                         if (res == NULL) {
325                                                   syslog(LOG_NOTICE,
326                                                     "Host addr %s not listed for host %s",
327                                                       naddr, res0->ai_canonname
328                                                                 ? res0->ai_canonname
329                                                                 : saddr);
330                                                   hostname = naddr;
331                                         }
332                               }
333                     }
334                     strlcpy(hostnamebuf, hostname, sizeof(hostnamebuf));
335                     hostname = hostnamebuf;
336                     if (res0)
337                               freeaddrinfo(res0);
338           } else {
339                     strlcpy(hostnamebuf, naddr, sizeof(hostnamebuf));
340                     hostname = hostnamebuf;
341           }
342 
343           if (ntohs(*portp) >= IPPORT_RESERVED ||
344               ntohs(*portp) < IPPORT_RESERVED/2) {
345                     syslog(LOG_NOTICE, "Connection from %s on illegal port",
346                            naddr);
347                     fatal(f, "Permission denied", 0);
348           }
349 #ifdef IP_OPTIONS
350           if (fromp->ss_family == AF_INET) {
351                     u_char optbuf[BUFSIZ/3], *cp;
352                     char lbuf[BUFSIZ], *lp, *ep;
353                     socklen_t optsize = sizeof(optbuf);
354                     int ipproto;
355                     struct protoent *ip;
356 
357                     if ((ip = getprotobyname("ip")) != NULL)
358                               ipproto = ip->p_proto;
359                     else
360                               ipproto = IPPROTO_IP;
361                     if (getsockopt(0, ipproto, IP_OPTIONS, (char *)optbuf,
362                         &optsize) == 0 && optsize != 0) {
363                               lp = lbuf;
364                               ep = lbuf + sizeof(lbuf);
365                               for (cp = optbuf; optsize > 0; cp++, optsize--, lp += 3)
366                                         snprintf(lp, ep - lp, " %2.2x", *cp);
367                               syslog(LOG_NOTICE,
368                                   "Connection received using IP options (ignored):%s",
369                                   lbuf);
370                               if (setsockopt(0, ipproto, IP_OPTIONS,
371                                   NULL, optsize) != 0) {
372                                         syslog(LOG_ERR,
373                                             "setsockopt IP_OPTIONS NULL: %m");
374                                         exit(1);
375                               }
376                     }
377           }
378 #endif
379           if (do_rlogin((struct sockaddr *)fromp, hostname) == 0)
380                     authenticated++;
381           if (confirmed == 0) {
382                     write(f, "", 1);
383                     confirmed = 1;                /* we sent the null! */
384           }
385           netf = f;
386 
387           pid = forkpty(&master, line, NULL, &win);
388           if (pid < 0) {
389                     if (errno == ENOENT)
390                               fatal(f, "Out of ptys", 0);
391                     else
392                               fatal(f, "Forkpty", 1);
393           }
394           if (pid == 0) {
395                     if (f > 2)          /* f should always be 0, but... */
396                               (void) close(f);
397                     setup_term(0);
398                     (void)strvisx(hostaddrbuf, (const char *)(const void *)fromp,
399                         sizeof(*fromp), VIS_WHITE);
400                     if (authenticated)
401                               execl(_PATH_LOGIN, "login", "-p",
402                                   "-h", hostname, "-a", hostaddrbuf,
403                                   "-f", "--", lusername, (char *)0);
404                     else
405                               execl(_PATH_LOGIN, "login", "-p",
406                                   "-h", hostname, "-a", hostaddrbuf,
407                                   "--", lusername, (char *)0);
408                     fatal(STDERR_FILENO, _PATH_LOGIN, 1);
409                     /*NOTREACHED*/
410           }
411           ioctl(f, FIONBIO, &on);
412           ioctl(master, FIONBIO, &on);
413           ioctl(master, TIOCPKT, &on);
414           signal(SIGCHLD, cleanup);
415           protocol(f, master);
416           signal(SIGCHLD, SIG_IGN);
417           cleanup(0);
418 }
419 
420 static char         magic[2] = { 0377, 0377 };
421 static char         oobdata[] = {TIOCPKT_WINDOW};
422 
423 /*
424  * Handle a "control" request (signaled by magic being present)
425  * in the data stream.  For now, we are only willing to handle
426  * window size changes.
427  */
428 static int
control(int pty,char * cp,int n)429 control(int pty, char *cp, int n)
430 {
431           struct winsize w;
432 
433           if (n < (int)(4+sizeof (w)) || cp[2] != 's' || cp[3] != 's')
434                     return (0);
435           oobdata[0] &= ~TIOCPKT_WINDOW;          /* we know he heard */
436           memmove(&w, cp+4, sizeof(w));
437           w.ws_row = ntohs(w.ws_row);
438           w.ws_col = ntohs(w.ws_col);
439           w.ws_xpixel = ntohs(w.ws_xpixel);
440           w.ws_ypixel = ntohs(w.ws_ypixel);
441           (void)ioctl(pty, TIOCSWINSZ, &w);
442           return (4+sizeof (w));
443 }
444 
445 /*
446  * rlogin "protocol" machine.
447  */
448 static void
protocol(int f,int p)449 protocol(int f, int p)
450 {
451           char pibuf[1024+1], fibuf[1024], *pbp = NULL, *fbp = NULL;
452                                                   /* XXX gcc above */
453           int pcc = 0, fcc = 0;
454           int cc, nfd;
455           char cntl;
456           struct pollfd set[2];
457 
458           /*
459            * Must ignore SIGTTOU, otherwise we'll stop
460            * when we try and set slave pty's window shape
461            * (our controlling tty is the master pty).
462            */
463           (void) signal(SIGTTOU, SIG_IGN);
464           send(f, oobdata, 1, MSG_OOB); /* indicate new rlogin */
465           set[0].fd = p;
466           set[1].fd = f;
467           for (;;) {
468                     set[0].events = POLLPRI;
469                     set[1].events = 0;
470                     if (fcc)
471                               set[0].events |= POLLOUT;
472                     else
473                               set[1].events |= POLLIN;
474                     if (pcc >= 0) {
475                               if (pcc)
476                                         set[1].events |= POLLOUT;
477                               else
478                                         set[0].events |= POLLIN;
479                     }
480                     if ((nfd = poll(set, 2, INFTIM)) < 0) {
481                               if (errno == EINTR)
482                                         continue;
483                               fatal(f, "poll", 1);
484                     }
485                     if (nfd == 0) {
486                               /* shouldn't happen... */
487                               sleep(5);
488                               continue;
489                     }
490 #define   pkcontrol(c)        ((c)&(TIOCPKT_FLUSHWRITE|TIOCPKT_NOSTOP|TIOCPKT_DOSTOP))
491                     if (set[0].revents & POLLPRI) {
492                               cc = read(p, &cntl, 1);
493                               if (cc == 1 && pkcontrol(cntl)) {
494                                         cntl |= oobdata[0];
495                                         send(f, &cntl, 1, MSG_OOB);
496                                         if (cntl & TIOCPKT_FLUSHWRITE)
497                                                   pcc = 0;
498                               }
499                     }
500                     if (set[1].revents & POLLIN) {
501                               fcc = read(f, fibuf, sizeof(fibuf));
502                               if (fcc < 0 && errno == EWOULDBLOCK)
503                                         fcc = 0;
504                               else {
505                                         char *cp;
506                                         int left, n;
507 
508                                         if (fcc <= 0)
509                                                   break;
510                                         fbp = fibuf;
511 
512                               top:
513                                         for (cp = fibuf; cp < fibuf+fcc-1; cp++)
514                                                   if (cp[0] == magic[0] &&
515                                                       cp[1] == magic[1]) {
516                                                             left = fcc - (cp-fibuf);
517                                                             n = control(p, cp, left);
518                                                             if (n) {
519                                                                       left -= n;
520                                                                       if (left > 0)
521                                                                                 memmove(cp,
522                                                                                     cp+n,
523                                                                                     left);
524                                                                       fcc -= n;
525                                                                       goto top; /* n^2 */
526                                                             }
527                                                   }
528                               }
529                     }
530 
531                     if (set[0].revents & POLLOUT && fcc > 0) {
532                               cc = write(p, fbp, fcc);
533                               if (cc > 0) {
534                                         fcc -= cc;
535                                         fbp += cc;
536                               }
537                     }
538 
539                     if (set[0].revents & POLLIN) {
540                               pcc = read(p, pibuf, sizeof (pibuf));
541                               pbp = pibuf;
542                               if (pcc < 0 && errno == EWOULDBLOCK)
543                                         pcc = 0;
544                               else if (pcc <= 0)
545                                         break;
546                               else if (pibuf[0] == 0) {
547                                         pbp++, pcc--;
548                               } else {
549                                         if (pkcontrol(pibuf[0])) {
550                                                   pibuf[0] |= oobdata[0];
551                                                   send(f, &pibuf[0], 1, MSG_OOB);
552                                         }
553                                         pcc = 0;
554                               }
555                     }
556                     if (set[1].revents & POLLOUT && pcc > 0) {
557                               cc = write(f, pbp, pcc);
558                               if (cc > 0) {
559                                         pcc -= cc;
560                                         pbp += cc;
561                               }
562                     }
563           }
564 }
565 
566 static void
cleanup(int signo)567 cleanup(int signo)
568 {
569           char *p, c;
570 
571           p = line + sizeof(_PATH_DEV) - 1;
572 #ifdef SUPPORT_UTMP
573           if (logout(p))
574                     logwtmp(p, "", "");
575 #endif
576 #ifdef SUPPORT_UTMPX
577           if (logoutx(p, 0, DEAD_PROCESS))
578                     logwtmpx(p, "", "", 0, DEAD_PROCESS);
579 #endif
580           (void)chmod(line, 0666);
581           (void)chown(line, 0, 0);
582           c = *p; *p = 'p';
583           (void)chmod(line, 0666);
584           (void)chown(line, 0, 0);
585           *p = c;
586           if (ttyaction(line, "rlogind", "root"))
587                     syslog(LOG_ERR, "%s: ttyaction failed", line);
588           shutdown(netf, 2);
589           exit(1);
590 }
591 
592 static void
fatal(int f,const char * msg,int syserr)593 fatal(int f, const char *msg, int syserr)
594 {
595           int len;
596           char buf[BUFSIZ], *bp, *ep;
597 
598           bp = buf;
599           ep = buf + sizeof(buf);
600 
601           /*
602            * Prepend binary one to message if we haven't sent
603            * the magic null as confirmation.
604            */
605           if (!confirmed)
606                     *bp++ = '\001';               /* error indicator */
607           if (syserr)
608                     len = snprintf(bp, ep - bp, "rlogind: %s: %s.\r\n",
609                         msg, strerror(errno));
610           else
611                     len = snprintf(bp, ep - bp, "rlogind: %s.\r\n", msg);
612           (void) write(f, buf, bp + len - buf);
613           exit(1);
614 }
615 
616 static int
do_rlogin(struct sockaddr * dest,char * host)617 do_rlogin(struct sockaddr *dest, char *host)
618 {
619           int retval;
620 
621           getstr(rusername, sizeof(rusername), "remuser too long");
622           getstr(lusername, sizeof(lusername), "locuser too long");
623           getstr(term+ENVSIZE, sizeof(term)-ENVSIZE, "Terminal type too long");
624 
625           pwd = getpwnam(lusername);
626           if (pwd == NULL) {
627                     syslog(LOG_INFO,
628                         "%s@%s as %s: unknown login.", rusername, host, lusername);
629                     return (-1);
630           }
631 
632           retval = iruserok_sa(dest, dest->sa_len, pwd->pw_uid == 0, rusername,
633                     lusername);
634 /* XXX put inet_ntoa(dest->sin_addr.s_addr) into all messages below */
635           if (retval == 0) {
636                     if (log_success)
637                               syslog(LOG_INFO, "%s@%s as %s: iruserok succeeded",
638                                   rusername, host, lusername);
639           } else {
640                     if (__rcmd_errstr)
641                               syslog(LOG_INFO, "%s@%s as %s: iruserok failed (%s)",
642                                   rusername, host, lusername, __rcmd_errstr);
643                     else
644                               syslog(LOG_INFO, "%s@%s as %s: iruserok failed",
645                                   rusername, host, lusername);
646           }
647           return(retval);
648 }
649 
650 static void
getstr(char * buf,int cnt,const char * errmsg)651 getstr(char *buf, int cnt, const char *errmsg)
652 {
653           char c;
654 
655           do {
656                     if (read(0, &c, 1) != 1)
657                               exit(1);
658                     if (--cnt < 0)
659                               fatal(STDOUT_FILENO, errmsg, 0);
660                     *buf++ = c;
661           } while (c != 0);
662 }
663 
664 
665 static void
setup_term(int fd)666 setup_term(int fd)
667 {
668           char *cp = index(term+ENVSIZE, '/');
669           char *speed;
670           struct termios tt;
671 
672 #ifndef notyet
673           tcgetattr(fd, &tt);
674           if (cp) {
675                     *cp++ = '\0';
676                     speed = cp;
677                     cp = index(speed, '/');
678                     if (cp)
679                               *cp++ = '\0';
680                     cfsetspeed(&tt, atoi(speed));
681           }
682 
683           tt.c_iflag = TTYDEF_IFLAG;
684           tt.c_oflag = TTYDEF_OFLAG;
685           tt.c_lflag = TTYDEF_LFLAG;
686           tcsetattr(fd, TCSAFLUSH, &tt);
687 #else
688           if (cp) {
689                     *cp++ = '\0';
690                     speed = cp;
691                     cp = index(speed, '/');
692                     if (cp)
693                               *cp++ = '\0';
694                     tcgetattr(fd, &tt);
695                     cfsetspeed(&tt, atoi(speed));
696                     tcsetattr(fd, TCSAFLUSH, &tt);
697           }
698 #endif
699 
700           env[0] = term;
701           env[1] = 0;
702           environ = env;
703 }
704 
705 
706 static void
usage(void)707 usage(void)
708 {
709           syslog(LOG_ERR, "usage: rlogind [-alnL]");
710           exit(1);
711 }
712 
713 /*
714  * Check whether host h is in our local domain,
715  * defined as sharing the last two components of the domain part,
716  * or the entire domain part if the local domain has only one component.
717  * If either name is unqualified (contains no '.'),
718  * assume that the host is local, as it will be
719  * interpreted as such.
720  */
721 static int
local_domain(char * h)722 local_domain(char *h)
723 {
724           char localhost[MAXHOSTNAMELEN + 1];
725           char *p1, *p2;
726 
727           localhost[0] = 0;
728           (void) gethostname(localhost, sizeof(localhost));
729           localhost[sizeof(localhost) - 1] = '\0';
730           p1 = topdomain(localhost);
731           p2 = topdomain(h);
732           if (p1 == NULL || p2 == NULL || !strcasecmp(p1, p2))
733                     return (1);
734           return (0);
735 }
736 
737 static char *
topdomain(char * h)738 topdomain(char *h)
739 {
740           char *p;
741           char *maybe = NULL;
742           int dots = 0;
743 
744           for (p = h + strlen(h); p >= h; p--) {
745                     if (*p == '.') {
746                               if (++dots == 2)
747                                         return (p);
748                               maybe = p;
749                     }
750           }
751           return (maybe);
752 }
753