1 /* $NetBSD: rfc931.c,v 1.12 2016/03/16 22:32:32 christos Exp $ */
2
3 /*
4 * rfc931() speaks a common subset of the RFC 931, AUTH, TAP, IDENT and RFC
5 * 1413 protocols. It queries an RFC 931 etc. compatible daemon on a remote
6 * host to look up the owner of a connection. The information should not be
7 * used for authentication purposes. This routine intercepts alarm signals.
8 *
9 * Diagnostics are reported through syslog(3).
10 *
11 * Author: Wietse Venema, Eindhoven University of Technology, The Netherlands.
12 */
13
14 #include <sys/cdefs.h>
15 #ifndef lint
16 #if 0
17 static char sccsid[] = "@(#) rfc931.c 1.10 95/01/02 16:11:34";
18 #else
19 __RCSID("$NetBSD: rfc931.c,v 1.12 2016/03/16 22:32:32 christos Exp $");
20 #endif
21 #endif
22
23 /* System libraries. */
24
25 #include <stdio.h>
26 #include <syslog.h>
27 #include <sys/types.h>
28 #include <sys/socket.h>
29 #include <netinet/in.h>
30 #include <stdlib.h>
31 #include <unistd.h>
32 #include <setjmp.h>
33 #include <signal.h>
34 #include <string.h>
35
36 /* Local stuff. */
37
38 #include "tcpd.h"
39
40 #define RFC931_PORT 113 /* Semi-well-known port */
41 #define ANY_PORT 0 /* Any old port will do */
42
43 int rfc931_timeout = RFC931_TIMEOUT;/* Global so it can be changed */
44
45 static jmp_buf timebuf;
46
47 static FILE *fsocket(int, int, int);
48 static void timeout(int) __dead;
49
50 /* fsocket - open stdio stream on top of socket */
51
52 static FILE *
fsocket(int domain,int type,int protocol)53 fsocket(int domain, int type, int protocol)
54 {
55 int s;
56 FILE *fp;
57
58 if ((s = socket(domain, type, protocol)) < 0) {
59 tcpd_warn("socket: %m");
60 return (0);
61 } else {
62 if ((fp = fdopen(s, "r+")) == 0) {
63 tcpd_warn("fdopen: %m");
64 close(s);
65 }
66 return (fp);
67 }
68 }
69
70 /* timeout - handle timeouts */
71
72 static void
timeout(int sig)73 timeout(int sig)
74 {
75 longjmp(timebuf, sig);
76 }
77
78 /* rfc931 - return remote user name, given socket structures */
79
80 void
rfc931(struct sockaddr * rmt_sin,struct sockaddr * our_sin,char * dest)81 rfc931(struct sockaddr *rmt_sin, struct sockaddr *our_sin, char *dest)
82 {
83 unsigned rmt_port;
84 unsigned our_port;
85 struct sockaddr_storage rmt_query_sin;
86 struct sockaddr_storage our_query_sin;
87 char user[256]; /* XXX */
88 char buffer[512]; /* XXX */
89 char *cp;
90 char * volatile result = unknown;
91 FILE *fp;
92 volatile int salen;
93 u_short * volatile rmt_portp;
94 u_short * volatile our_portp;
95
96 /* address family must be the same */
97 if (rmt_sin->sa_family != our_sin->sa_family) {
98 strlcpy(dest, unknown, STRING_LENGTH);
99 return;
100 }
101 switch (rmt_sin->sa_family) {
102 case AF_INET:
103 salen = sizeof(struct sockaddr_in);
104 rmt_portp = &(((struct sockaddr_in *)rmt_sin)->sin_port);
105 break;
106 #ifdef INET6
107 case AF_INET6:
108 salen = sizeof(struct sockaddr_in6);
109 rmt_portp = &(((struct sockaddr_in6 *)rmt_sin)->sin6_port);
110 break;
111 #endif
112 default:
113 strlcpy(dest, unknown, STRING_LENGTH);
114 return;
115 }
116 switch (our_sin->sa_family) {
117 case AF_INET:
118 our_portp = &(((struct sockaddr_in *)our_sin)->sin_port);
119 break;
120 #ifdef INET6
121 case AF_INET6:
122 our_portp = &(((struct sockaddr_in6 *)our_sin)->sin6_port);
123 break;
124 #endif
125 default:
126 strlcpy(dest, unknown, STRING_LENGTH);
127 return;
128 }
129
130 /*
131 * Use one unbuffered stdio stream for writing to and for reading from
132 * the RFC931 etc. server. This is done because of a bug in the SunOS
133 * 4.1.x stdio library. The bug may live in other stdio implementations,
134 * too. When we use a single, buffered, bidirectional stdio stream ("r+"
135 * or "w+" mode) we read our own output. Such behaviour would make sense
136 * with resources that support random-access operations, but not with
137 * sockets.
138 */
139
140 if ((fp = fsocket(rmt_sin->sa_family, SOCK_STREAM, 0)) != 0) {
141 setbuf(fp, (char *) 0);
142
143 /*
144 * Set up a timer so we won't get stuck while waiting for the server.
145 */
146
147 if (setjmp(timebuf) == 0) {
148 signal(SIGALRM, timeout);
149 alarm(rfc931_timeout);
150
151 /*
152 * Bind the local and remote ends of the query socket to the same
153 * IP addresses as the connection under investigation. We go
154 * through all this trouble because the local or remote system
155 * might have more than one network address. The RFC931 etc.
156 * client sends only port numbers; the server takes the IP
157 * addresses from the query socket.
158 */
159
160 memcpy(&our_query_sin, our_sin, salen);
161 switch (our_query_sin.ss_family) {
162 case AF_INET:
163 ((struct sockaddr_in *)&our_query_sin)->sin_port =
164 htons(ANY_PORT);
165 break;
166 #ifdef INET6
167 case AF_INET6:
168 ((struct sockaddr_in6 *)&our_query_sin)->sin6_port =
169 htons(ANY_PORT);
170 break;
171 #endif
172 }
173 memcpy(&rmt_query_sin, rmt_sin, salen);
174 switch (rmt_query_sin.ss_family) {
175 case AF_INET:
176 ((struct sockaddr_in *)&rmt_query_sin)->sin_port =
177 htons(RFC931_PORT);
178 break;
179 #ifdef INET6
180 case AF_INET6:
181 ((struct sockaddr_in6 *)&rmt_query_sin)->sin6_port =
182 htons(RFC931_PORT);
183 break;
184 #endif
185 }
186
187 if (bind(fileno(fp), (struct sockaddr *) & our_query_sin,
188 salen) >= 0 &&
189 connect(fileno(fp), (struct sockaddr *) & rmt_query_sin,
190 salen) >= 0) {
191
192 /*
193 * Send query to server. Neglect the risk that a 13-byte
194 * write would have to be fragmented by the local system and
195 * cause trouble with buggy System V stdio libraries.
196 */
197
198 fprintf(fp, "%u,%u\r\n",
199 ntohs(*rmt_portp),
200 ntohs(*our_portp));
201 fflush(fp);
202
203 /*
204 * Read response from server. Use fgets()/sscanf() so we can
205 * work around System V stdio libraries that incorrectly
206 * assume EOF when a read from a socket returns less than
207 * requested.
208 */
209
210 if (fgets(buffer, sizeof(buffer), fp) != 0
211 && ferror(fp) == 0 && feof(fp) == 0
212 && sscanf(buffer, "%u , %u : USERID :%*[^:]:%255s",
213 &rmt_port, &our_port, user) == 3
214 && ntohs(*rmt_portp) == rmt_port
215 && ntohs(*our_portp) == our_port) {
216
217 /*
218 * Strip trailing carriage return. It is part of the
219 * protocol, not part of the data.
220 */
221
222 if ((cp = strchr(user, '\r')) != NULL)
223 *cp = '\0';
224 result = user;
225 }
226 }
227 alarm(0);
228 }
229 fclose(fp);
230 }
231 strlcpy(dest, result, STRING_LENGTH);
232 }
233