xref: /netbsd-src/libexec/identd/identd.c (revision 2b50e65cd37cf520e17fbc475d57395ae4d281b1) 
1 /* $NetBSD: identd.c,v 1.38 2021/12/05 05:03:05 msaitoh Exp $ */
2 
3 /*
4  * identd.c - TCP/IP Ident protocol server.
5  *
6  * This software is in the public domain.
7  * Written by Peter Postma <peter@NetBSD.org>
8  */
9 
10 #include <sys/cdefs.h>
11 __RCSID("$NetBSD: identd.c,v 1.38 2021/12/05 05:03:05 msaitoh Exp $");
12 
13 #include <sys/param.h>
14 #include <sys/socket.h>
15 #include <sys/stat.h>
16 #include <sys/sysctl.h>
17 
18 #include <netinet/in.h>
19 #include <netinet/ip_var.h>
20 #include <netinet/tcp.h>
21 #include <netinet/tcp_timer.h>
22 #include <netinet/tcp_var.h>
23 
24 #include <arpa/inet.h>
25 
26 #include <ctype.h>
27 #include <err.h>
28 #include <errno.h>
29 #include <fcntl.h>
30 #include <grp.h>
31 #include <netdb.h>
32 #include <poll.h>
33 #include <pwd.h>
34 #include <signal.h>
35 #include <stdarg.h>
36 #include <stdio.h>
37 #include <stdlib.h>
38 #include <string.h>
39 #include <syslog.h>
40 #include <unistd.h>
41 
42 #include "identd.h"
43 
44 #define	OPSYS_NAME	"UNIX"
45 #define	IDENT_SERVICE	"auth"
46 #define	TIMEOUT		30	/* seconds */
47 
48 static int   idhandle(int, const char *, const char *, const char *,
49 		const char *, struct sockaddr *, int);
50 static void  idparse(int, int, int, const char *, const char *, const char *);
51 static void  iderror(int, int, int, const char *);
52 static const char *gethost(struct sockaddr *);
53 static int  *socketsetup(const char *, const char *, int);
54 static int   ident_getuid(struct sockaddr_storage *, socklen_t,
55 		struct sockaddr *, uid_t *);
56 static int   sysctl_getuid(struct sockaddr_storage *, socklen_t, uid_t *);
57 static int   sysctl_proxy_getuid(struct sockaddr_storage *,
58 		struct sockaddr *, uid_t *);
59 static int   forward(int, struct sockaddr *, int, int, int);
60 static int   check_noident(const char *);
61 static int   check_userident(const char *, char *, size_t);
62 static void  random_string(char *, size_t);
63 static int   change_format(const char *, struct passwd *, char *, size_t);
64 __dead static void  timeout_handler(int);
65 __dead static void  fatal(const char *);
66 __dead static void  die(const char *, ...) __printflike(1, 2);
67 
68 static int   bflag, dflag, eflag, fflag, iflag, Iflag;
69 static int   lflag, Lflag, nflag, Nflag, rflag;
70 
71 /* NAT lookup function pointer. */
72 typedef int (*nat_lookup_t)(const struct sockaddr_storage *,
73     struct sockaddr_storage *, in_port_t *);
74 
75 static nat_lookup_t  nat_lookup;
76 
77 /* Packet filters. */
78 static const struct {
79 	const char *name;
80 	nat_lookup_t fn;
81 } filters[] = {
82 #ifdef WITH_PF
83 	{ "pf", pf_natlookup },
84 #endif
85 #ifdef WITH_IPF
86 	{ "ipfilter", ipf_natlookup },
87 #endif
88 #ifdef WITH_NPF
89 	{ "npf", npf_natlookup },
90 #endif
91 	{ NULL, NULL }
92 };
93 
94 int
main(int argc,char * argv[])95 main(int argc, char *argv[])
96 {
97 	int IPv4or6, ch, error, i, *socks, timeout;
98 	const char *filter, *osname, *portno, *proxy;
99 	char *address, *charset, *fmt, *p;
100 	char user[LOGIN_NAME_MAX];
101 	struct addrinfo *ai, hints;
102 	struct sockaddr *proxy_addr;
103 	struct group *grp;
104 	struct passwd *pw;
105 	gid_t gid;
106 	uid_t uid;
107 
108 	socks = NULL;
109 	IPv4or6 = AF_UNSPEC;
110 	osname = OPSYS_NAME;
111 	portno = IDENT_SERVICE;
112 	timeout = TIMEOUT;
113 	nat_lookup = NULL;
114 	proxy_addr = NULL;
115 	filter = proxy = NULL;
116 	address = charset = fmt = NULL;
117 	uid = gid = 0;
118 	bflag = dflag = eflag = fflag = iflag = Iflag = 0;
119 	lflag = Lflag = nflag = Nflag = rflag = 0;
120 
121 	/* Started from a tty? then run as daemon. */
122 	if (isatty(STDIN_FILENO))
123 		bflag = 1;
124 
125 	/* Parse command line arguments. */
126 	while ((ch = getopt(argc, argv,
127 	    "46a:bcdeF:f:g:IiL:lm:Nno:P:p:rt:u:")) != -1) {
128 		switch (ch) {
129 		case '4':
130 			IPv4or6 = AF_INET;
131 			break;
132 		case '6':
133 			IPv4or6 = AF_INET6;
134 			break;
135 		case 'a':
136 			address = optarg;
137 			break;
138 		case 'b':
139 			bflag = 1;
140 			break;
141 		case 'c':
142 			charset = optarg;
143 			break;
144 		case 'd':
145 			dflag++;
146 			break;
147 		case 'e':
148 			eflag = 1;
149 			break;
150 		case 'F':
151 			fmt = optarg;
152 			break;
153 		case 'f':
154 			fflag = 1;
155 			(void)strlcpy(user, optarg, sizeof(user));
156 			break;
157 		case 'g':
158 			gid = (gid_t)strtol(optarg, &p, 0);
159 			if (*p != '\0') {
160 				if ((grp = getgrnam(optarg)) != NULL)
161 					gid = grp->gr_gid;
162 				else
163 					die("No such group `%s'", optarg);
164 			}
165 			break;
166 		case 'I':
167 			Iflag = 1;
168 			/* FALLTHROUGH */
169 		case 'i':
170 			iflag = 1;
171 			break;
172 		case 'L':
173 			Lflag = 1;
174 			(void)strlcpy(user, optarg, sizeof(user));
175 			break;
176 		case 'l':
177 			if (!lflag)
178 				openlog("identd", LOG_PID, LOG_DAEMON);
179 			lflag = 1;
180 			break;
181 		case 'm':
182 			filter = optarg;
183 			break;
184 		case 'N':
185 			Nflag = 1;
186 			break;
187 		case 'n':
188 			nflag = 1;
189 			break;
190 		case 'o':
191 			osname = optarg;
192 			break;
193 		case 'P':
194 			proxy = optarg;
195 			break;
196 		case 'p':
197 			portno = optarg;
198 			break;
199 		case 'r':
200 			rflag = 1;
201 			break;
202 		case 't':
203 			timeout = (int)strtol(optarg, &p, 0);
204 			if (*p != '\0' || timeout < 1)
205 				die("Invalid timeout value `%s'", optarg);
206 			break;
207 		case 'u':
208 			uid = (uid_t)strtol(optarg, &p, 0);
209 			if (*p != '\0') {
210 				if ((pw = getpwnam(optarg)) != NULL) {
211 					uid = pw->pw_uid;
212 					gid = pw->pw_gid;
213 				} else
214 					die("No such user `%s'", optarg);
215 			}
216 			break;
217 		default:
218 			exit(EXIT_FAILURE);
219 		}
220 	}
221 
222 	/* Verify proxy address, if enabled. */
223 	if (proxy != NULL) {
224 		(void)memset(&hints, 0, sizeof(hints));
225 		hints.ai_family = IPv4or6;
226 		hints.ai_socktype = SOCK_STREAM;
227 		error = getaddrinfo(proxy, NULL, &hints, &ai);
228 		if (error != 0)
229 			die("Bad proxy `%s': %s", proxy, gai_strerror(error));
230 		if (ai->ai_next != NULL)
231 			die("Bad proxy `%s': resolves to multiple addresses",
232 			    proxy);
233 		proxy_addr = ai->ai_addr;
234 	}
235 
236 	/* Verify filter, if enabled. */
237 	if (filter != NULL) {
238 		for (i = 0; filters[i].name != NULL; i++) {
239 			if (strcasecmp(filter, filters[i].name) == 0) {
240 				nat_lookup = filters[i].fn;
241 				break;
242 			}
243 		}
244 		if (nat_lookup == NULL)
245 			die("Packet filter `%s' is not supported", filter);
246 	}
247 
248 	/* Setup sockets when running in the background. */
249 	if (bflag)
250 		socks = socketsetup(address, portno, IPv4or6);
251 
252 	/* Switch to another uid/gid? */
253 	if (gid && setgid(gid) == -1)
254 		die("Failed to set GID to `%d': %s", gid, strerror(errno));
255 	if (uid && setuid(uid) == -1)
256 		die("Failed to set UID to `%d': %s", uid, strerror(errno));
257 
258 	/*
259 	 * When running as daemon: daemonize, setup pollfds and go into
260 	 * the mainloop.  Otherwise, just read the input from stdin and
261 	 * let inetd handle the sockets.
262 	 */
263 	if (bflag) {
264 		int fd, nfds, rv;
265 		struct pollfd *rfds;
266 
267 		if (!dflag && daemon(0, 0) < 0)
268 			die("daemon: %s", strerror(errno));
269 
270 		rfds = malloc(*socks * sizeof(struct pollfd));
271 		if (rfds == NULL)
272 			fatal("malloc");
273 		nfds = *socks;
274 		for (i = 0; i < nfds; i++) {
275 			rfds[i].fd = socks[i+1];
276 			rfds[i].events = POLLIN;
277 			rfds[i].revents = 0;
278 		}
279 		/* Mainloop for daemon. */
280 		for (;;) {
281 			rv = poll(rfds, nfds, INFTIM);
282 			if (rv < 0) {
283 				if (errno == EINTR)
284 					continue;
285 				fatal("poll");
286 			}
287 			for (i = 0; i < nfds; i++) {
288 				if (rfds[i].revents & POLLIN) {
289 					fd = accept(rfds[i].fd, NULL, NULL);
290 					if (fd < 0) {
291 						maybe_syslog(LOG_ERR,
292 						    "accept: %m");
293 						continue;
294 					}
295 					switch (fork()) {
296 					case -1:	/* error */
297 						maybe_syslog(LOG_ERR,
298 						    "fork: %m");
299 						(void)sleep(1);
300 						break;
301 					case 0:		/* child */
302 						(void)idhandle(fd, charset,
303 						    fmt, osname, user,
304 						    proxy_addr, timeout);
305 						_exit(EXIT_SUCCESS);
306 					default:	/* parent */
307 						(void)signal(SIGCHLD, SIG_IGN);
308 						(void)close(fd);
309 					}
310 				}
311 			}
312 		}
313 	} else
314 		(void)idhandle(STDIN_FILENO, charset, fmt, osname, user,
315 		    proxy_addr, timeout);
316 
317 	return 0;
318 }
319 
320 /*
321  * Handle a request on the ident port.  Returns 0 on success or 1 on
322  * failure.  The return values are currently ignored.
323  */
324 static int
idhandle(int fd,const char * charset,const char * fmt,const char * osname,const char * user,struct sockaddr * proxy,int timeout)325 idhandle(int fd, const char *charset, const char *fmt, const char *osname,
326     const char *user, struct sockaddr *proxy, int timeout)
327 {
328 	struct sockaddr_storage ss[2];
329 	char userbuf[LOGIN_NAME_MAX];	/* actual user name (or numeric uid) */
330 	char idbuf[LOGIN_NAME_MAX];	/* name to be used in response */
331 	char buf[BUFSIZ], *p;
332 	struct passwd *pw;
333 	int lport, fport;
334 	socklen_t len;
335 	uid_t uid;
336 	ssize_t n;
337 	size_t qlen;
338 
339 	lport = fport = 0;
340 
341 	(void)strlcpy(idbuf, user, sizeof(idbuf));
342 	(void)signal(SIGALRM, timeout_handler);
343 	(void)alarm(timeout);
344 
345 	/* Get foreign internet address. */
346 	len = sizeof(ss[0]);
347 	if (getpeername(fd, (struct sockaddr *)&ss[0], &len) < 0)
348 		fatal("getpeername");
349 
350 	maybe_syslog(LOG_INFO, "Connection from %s",
351 	    gethost((struct sockaddr *)&ss[0]));
352 
353 	/* Get local internet address. */
354 	len = sizeof(ss[1]);
355 	if (getsockname(fd, (struct sockaddr *)&ss[1], &len) < 0)
356 		fatal("getsockname");
357 
358 	/* Be sure to have the same address families. */
359 	if (ss[0].ss_family != ss[1].ss_family) {
360 		maybe_syslog(LOG_ERR, "Different foreign/local address family");
361 		return 1;
362 	}
363 
364 	/* Receive data from the client. */
365 	qlen = 0;
366 	for (;;) {
367 		if ((n = recv(fd, &buf[qlen], sizeof(buf) - qlen, 0)) < 0) {
368 			fatal("recv");
369 		} else if (n == 0) {
370 			maybe_syslog(LOG_NOTICE, "recv: EOF");
371 			iderror(fd, 0, 0, "UNKNOWN-ERROR");
372 			return 1;
373 		}
374 		/*
375 		 * 1413 is not clear on what to do if data follows the first
376 		 * CRLF before we respond.  We do not consider the query
377 		 * complete until we get a CRLF _at the end of the buffer_.
378 		 */
379 		qlen += n;
380 		if (qlen >= sizeof(buf)) {
381 			maybe_syslog(LOG_NOTICE, "recv: message too long");
382 			exit(0);
383 		}
384 		if ((qlen >= 2) && (buf[qlen - 2] == '\r') &&
385 		    (buf[qlen - 1] == '\n'))
386 			break;
387 	}
388 	buf[qlen - 2] = '\0';
389 
390 	/* Get local and remote ports from the received data. */
391 	p = buf;
392 	while (*p != '\0' && isspace((unsigned char)*p))
393 		p++;
394 	if ((p = strtok(p, " \t,")) != NULL) {
395 		lport = atoi(p);
396 		if ((p = strtok(NULL, " \t,")) != NULL)
397 			fport = atoi(p);
398 	}
399 
400 	/* Are the ports valid? */
401 	if (lport < 1 || lport > 65535 || fport < 1 || fport > 65535) {
402 		maybe_syslog(LOG_NOTICE, "Invalid port(s): %d, %d from %s",
403 		    lport, fport, gethost((struct sockaddr *)&ss[0]));
404 		iderror(fd, 0, 0, eflag ? "UNKNOWN-ERROR" : "INVALID-PORT");
405 		return 1;
406 	}
407 
408 	/* If there is a 'lie' user enabled, then handle it now and stop. */
409 	if (Lflag) {
410 		maybe_syslog(LOG_NOTICE, "Lying with name %s to %s",
411 		    idbuf, gethost((struct sockaddr *)&ss[0]));
412 		idparse(fd, lport, fport, charset, osname, idbuf);
413 		return 0;
414 	}
415 
416 	/* Protocol dependent stuff. */
417 	switch (ss[0].ss_family) {
418 	case AF_INET:
419 		satosin(&ss[0])->sin_port = htons(fport);
420 		satosin(&ss[1])->sin_port = htons(lport);
421 		break;
422 	case AF_INET6:
423 		satosin6(&ss[0])->sin6_port = htons(fport);
424 		satosin6(&ss[1])->sin6_port = htons(lport);
425 		break;
426 	default:
427 		maybe_syslog(LOG_ERR, "Unsupported protocol (no. %d)",
428 		    ss[0].ss_family);
429 		return 1;
430 	}
431 
432 	/* Try to get the UID of the connection owner using sysctl. */
433 	if (ident_getuid(ss, sizeof(ss), proxy, &uid) == -1) {
434 		/* Lookup failed, try to forward if enabled. */
435 		if (nat_lookup != NULL) {
436 			struct sockaddr_storage nat_addr;
437 			in_port_t nat_lport;
438 
439 			(void)memset(&nat_addr, 0, sizeof(nat_addr));
440 			if ((*nat_lookup)(ss, &nat_addr, &nat_lport) &&
441 			    forward(fd, (struct sockaddr *)&nat_addr,
442 			    nat_lport, fport, lport)) {
443 				maybe_syslog(LOG_INFO,
444 				    "Successfully forwarded the request to %s",
445 				    gethost((struct sockaddr *)&nat_addr));
446 				return 0;
447 			}
448 		}
449 		/* Fall back to a default name? */
450 		if (fflag) {
451 			maybe_syslog(LOG_NOTICE, "Using fallback name %s to %s",
452 			    idbuf, gethost((struct sockaddr *)&ss[0]));
453 			idparse(fd, lport, fport, charset, osname, idbuf);
454 			return 0;
455 		}
456 		maybe_syslog(LOG_ERR, "Lookup failed, returning error to %s",
457 		    gethost((struct sockaddr *)&ss[0]));
458 		iderror(fd, lport, fport, eflag ? "UNKNOWN-ERROR" : "NO-USER");
459 		return 1;
460 	}
461 
462 	/* Fill in userbuf with user name if possible, else numeric UID. */
463 	if ((pw = getpwuid(uid)) == NULL) {
464 		maybe_syslog(LOG_ERR, "Couldn't map uid (%u) to name", uid);
465 		(void)snprintf(userbuf, sizeof(userbuf), "%u", uid);
466 	} else {
467 		maybe_syslog(LOG_INFO, "Successful lookup: %d, %d: %s for %s",
468 		    lport, fport, pw->pw_name,
469 		    gethost((struct sockaddr *)&ss[0]));
470 		(void)strlcpy(userbuf, pw->pw_name, sizeof(userbuf));
471 	}
472 
473 	/* No ident enabled? */
474 	if (Nflag && pw && check_noident(pw->pw_dir)) {
475 		maybe_syslog(LOG_NOTICE, "Returning HIDDEN-USER for user %s"
476 		    " to %s", pw->pw_name, gethost((struct sockaddr *)&ss[0]));
477 		iderror(fd, lport, fport, "HIDDEN-USER");
478 		return 1;
479 	}
480 
481 	/* User ident enabled? */
482 	if (iflag && pw && check_userident(pw->pw_dir, idbuf, sizeof(idbuf))) {
483 		if (!Iflag) {
484 			if ((strspn(idbuf, "0123456789") &&
485 			     getpwuid(atoi(idbuf)) != NULL) ||
486 			    (getpwnam(idbuf) != NULL)) {
487 				maybe_syslog(LOG_NOTICE,
488 				    "Ignoring user-specified '%s' for user %s",
489 				    idbuf, userbuf);
490 				(void)strlcpy(idbuf, userbuf, sizeof(idbuf));
491 			}
492 		}
493 		maybe_syslog(LOG_NOTICE,
494 		    "Returning user-specified '%s' for user %s to %s",
495 		    idbuf, userbuf, gethost((struct sockaddr *)&ss[0]));
496 		idparse(fd, lport, fport, charset, osname, idbuf);
497 		return 0;
498 	}
499 
500 	/* Send a random message? */
501 	if (rflag) {
502 		/* Random number or string? */
503 		if (nflag)
504 			(void)snprintf(idbuf, sizeof(idbuf), "%u",
505 			    (unsigned int)(arc4random() % 65535));
506 		else
507 			random_string(idbuf, sizeof(idbuf));
508 
509 		maybe_syslog(LOG_NOTICE,
510 		    "Returning random '%s' for user %s to %s",
511 		    idbuf, userbuf, gethost((struct sockaddr *)&ss[0]));
512 		idparse(fd, lport, fport, charset, osname, idbuf);
513 		return 0;
514 	}
515 
516 	/* Return numeric user ID? */
517 	if (nflag)
518 		(void)snprintf(idbuf, sizeof(idbuf), "%u", uid);
519 	else
520 		(void)strlcpy(idbuf, userbuf, sizeof(idbuf));
521 
522 	/*
523 	 * Change the output format?  Note that 512 is the maximum
524 	 * size of the result according to RFC 1413.
525 	 */
526 	if (fmt && change_format(fmt, pw, buf, 512 + 1))
527 		idparse(fd, lport, fport, charset, osname, buf);
528 	else
529 		idparse(fd, lport, fport, charset, osname, idbuf);
530 
531 	return 0;
532 }
533 
534 /* Send/parse the ident result. */
535 static void
idparse(int fd,int lport,int fport,const char * charset,const char * osname,const char * user)536 idparse(int fd, int lport, int fport, const char *charset, const char *osname,
537     const char *user)
538 {
539 	char *p;
540 
541 	if (asprintf(&p, "%d,%d:USERID:%s%s%s:%s\r\n", lport, fport,
542 	    osname, charset ? "," : "", charset ? charset : "", user) < 0)
543 		fatal("asprintf");
544 	if (send(fd, p, strlen(p), 0) < 0) {
545 		free(p);
546 		fatal("send");
547 	}
548 	free(p);
549 }
550 
551 /* Return a specified ident error. */
552 static void
iderror(int fd,int lport,int fport,const char * error)553 iderror(int fd, int lport, int fport, const char *error)
554 {
555 	char *p;
556 
557 	if (asprintf(&p, "%d,%d:ERROR:%s\r\n", lport, fport, error) < 0)
558 		fatal("asprintf");
559 	if (send(fd, p, strlen(p), 0) < 0) {
560 		free(p);
561 		fatal("send");
562 	}
563 	free(p);
564 }
565 
566 /* Return the IP address of the connecting host. */
567 static const char *
gethost(struct sockaddr * sa)568 gethost(struct sockaddr *sa)
569 {
570 	static char host[NI_MAXHOST];
571 
572 	if (getnameinfo(sa, sa->sa_len, host, sizeof(host),
573 	    NULL, 0, NI_NUMERICHOST) == 0)
574 		return host;
575 
576 	return "UNKNOWN";
577 }
578 
579 /* Setup sockets, for daemon mode. */
580 static int *
socketsetup(const char * address,const char * port,int af)581 socketsetup(const char *address, const char *port, int af)
582 {
583 	struct addrinfo hints, *res, *res0;
584 	int error, maxs, *s, *socks;
585 	const char *cause = NULL;
586 	socklen_t y = 1;
587 
588 	(void)memset(&hints, 0, sizeof(hints));
589 	hints.ai_flags = AI_PASSIVE;
590 	hints.ai_family = af;
591 	hints.ai_socktype = SOCK_STREAM;
592 	error = getaddrinfo(address, port, &hints, &res0);
593 	if (error) {
594 		die("getaddrinfo: %s", gai_strerror(error));
595 		/* NOTREACHED */
596 	}
597 
598 	/* Count max number of sockets we may open. */
599 	for (maxs = 0, res = res0; res != NULL; res = res->ai_next)
600 		maxs++;
601 
602 	socks = malloc((maxs + 1) * sizeof(int));
603 	if (socks == NULL) {
604 		die("malloc: %s", strerror(errno));
605 		/* NOTREACHED */
606 	}
607 
608 	*socks = 0;
609 	s = socks + 1;
610 	for (res = res0; res != NULL; res = res->ai_next) {
611 		*s = socket(res->ai_family, res->ai_socktype, res->ai_protocol);
612 		if (*s < 0) {
613 			cause = "socket";
614 			continue;
615 		}
616 		(void)setsockopt(*s, SOL_SOCKET, SO_REUSEADDR, &y, sizeof(y));
617 		if (bind(*s, res->ai_addr, res->ai_addrlen) < 0) {
618 			cause = "bind";
619 			(void)close(*s);
620 			continue;
621 		}
622 		if (listen(*s, 5) < 0) {
623 			cause = "listen";
624 			(void)close(*s);
625 			continue;
626 		}
627 		*socks = *socks + 1;
628 		s++;
629 	}
630 
631 	if (*socks == 0) {
632 		free(socks);
633 		die("%s: %s", cause, strerror(errno));
634 		/* NOTREACHED */
635 	}
636 	if (res0)
637 		freeaddrinfo(res0);
638 
639 	return socks;
640 }
641 
642 /* UID lookup wrapper. */
643 static int
ident_getuid(struct sockaddr_storage * ss,socklen_t len,struct sockaddr * proxy,uid_t * uid)644 ident_getuid(struct sockaddr_storage *ss, socklen_t len,
645     struct sockaddr *proxy, uid_t *uid)
646 {
647 	int rc;
648 
649 	rc = sysctl_getuid(ss, len, uid);
650 	if (rc == -1 && proxy != NULL)
651 		rc = sysctl_proxy_getuid(ss, proxy, uid);
652 
653 	return rc;
654 }
655 
656 /* Try to get the UID of the connection owner using sysctl. */
657 static int
sysctl_getuid(struct sockaddr_storage * ss,socklen_t len,uid_t * uid)658 sysctl_getuid(struct sockaddr_storage *ss, socklen_t len, uid_t *uid)
659 {
660 	int mib[4];
661 	uid_t myuid;
662 	size_t uidlen;
663 
664 	uidlen = sizeof(myuid);
665 
666 	mib[0] = CTL_NET;
667 	mib[1] = ss->ss_family;
668 	mib[2] = IPPROTO_TCP;
669 	mib[3] = TCPCTL_IDENT;
670 
671 	if (sysctl(mib, sizeof(mib)/ sizeof(int), &myuid, &uidlen, ss, len) < 0)
672 		return -1;
673 	*uid = myuid;
674 
675 	return 0;
676 }
677 
678 /* Try to get the UID of the connection owner using sysctl (proxy version). */
679 static int
sysctl_proxy_getuid(struct sockaddr_storage * ss,struct sockaddr * proxy,uid_t * uid)680 sysctl_proxy_getuid(struct sockaddr_storage *ss, struct sockaddr *proxy,
681     uid_t *uid)
682 {
683 	struct sockaddr_storage new[2];
684 	int rc, name[CTL_MAXNAME];
685 	size_t i;
686 	struct kinfo_pcb *kp;
687 	size_t sz, len;
688 	const char *list;
689 
690 	rc = -1;
691 	sz = CTL_MAXNAME;
692 	list = NULL;
693 
694 	/* Retrieve a list of sockets. */
695 	switch (ss[0].ss_family) {
696 	case AF_INET:
697 		/* We only accept queries from the proxy. */
698 		if (in_hosteq(satosin(&ss[0])->sin_addr,
699 		    satosin(proxy)->sin_addr))
700 			list = "net.inet.tcp.pcblist";
701 		break;
702 	case AF_INET6:
703 		/* We only accept queries from the proxy. */
704 		if (IN6_ARE_ADDR_EQUAL(&satosin6(&ss[0])->sin6_addr,
705 		    &satosin6(proxy)->sin6_addr))
706 			list = "net.inet6.tcp.pcblist";
707 		break;
708 	default:
709 		maybe_syslog(LOG_ERR, "Unsupported protocol for proxy (no. %d)",
710 		    ss[0].ss_family);
711 	}
712 	if (list != NULL)
713 		rc = sysctlnametomib(list, &name[0], &sz);
714 	if (rc == -1)
715 		return -1;
716 	len = sz;
717 
718 	name[len++] = PCB_ALL;
719 	name[len++] = 0;
720 	name[len++] = sizeof(struct kinfo_pcb);
721 	name[len++] = INT_MAX;
722 
723 	kp = NULL;
724 	sz = 0;
725 	do {
726 		rc = sysctl(&name[0], len, kp, &sz, NULL, 0);
727 		if (rc == -1 && errno != ENOMEM)
728 			return -1;
729 		if (kp == NULL) {
730 			kp = malloc(sz);
731 			rc = -1;
732 		}
733 		if (kp == NULL)
734 			return -1;
735 	} while (rc == -1);
736 
737 	rc = -1;
738 	/*
739 	 * Walk through the list of sockets and try to find a match.
740 	 * We don't know who has sent the query (we only know that the
741 	 * proxy has forwarded to us) so just try to match the ports and
742 	 * the local address.
743 	 */
744 	for (i = 0; i < sz / sizeof(struct kinfo_pcb); i++) {
745 		switch (ss[0].ss_family) {
746 		case AF_INET:
747 			/* Foreign and local ports must match. */
748 			if (satosin(&ss[0])->sin_port !=
749 			    satosin(&kp[i].ki_src)->sin_port)
750 				continue;
751 			if (satosin(&ss[1])->sin_port !=
752 			    satosin(&kp[i].ki_dst)->sin_port)
753 				continue;
754 			/* Foreign address may not match proxy address. */
755 			if (in_hosteq(satosin(proxy)->sin_addr,
756 			    satosin(&kp[i].ki_dst)->sin_addr))
757 				continue;
758 			/* Local addresses must match. */
759 			if (!in_hosteq(satosin(&ss[1])->sin_addr,
760 			    satosin(&kp[i].ki_src)->sin_addr))
761 				continue;
762 			break;
763 		case AF_INET6:
764 			/* Foreign and local ports must match. */
765 			if (satosin6(&ss[0])->sin6_port !=
766 			    satosin6(&kp[i].ki_src)->sin6_port)
767 				continue;
768 			if (satosin6(&ss[1])->sin6_port !=
769 			    satosin6(&kp[i].ki_dst)->sin6_port)
770 				continue;
771 			/* Foreign address may not match proxy address. */
772 			if (IN6_ARE_ADDR_EQUAL(&satosin6(proxy)->sin6_addr,
773 			    &satosin6(&kp[i].ki_dst)->sin6_addr))
774 				continue;
775 			/* Local addresses must match. */
776 			if (!IN6_ARE_ADDR_EQUAL(&satosin6(&ss[1])->sin6_addr,
777 			    &satosin6(&kp[i].ki_src)->sin6_addr))
778 				continue;
779 			break;
780 		}
781 
782 		/*
783 		 * We have found the foreign address, copy it to a new
784 		 * struct and retrieve the UID of the connection owner.
785 		 */
786 		(void)memcpy(&new[0], &kp[i].ki_dst, kp[i].ki_dst.sa_len);
787 		(void)memcpy(&new[1], &kp[i].ki_src, kp[i].ki_src.sa_len);
788 
789 		rc = sysctl_getuid(new, sizeof(new), uid);
790 
791 		/* Done. */
792 		break;
793 	}
794 
795 	free(kp);
796 	return rc;
797 }
798 
799 /* Forward ident queries. Returns 1 when successful, or zero if not. */
800 static int
forward(int fd,struct sockaddr * nat_addr,int nat_lport,int fport,int lport)801 forward(int fd, struct sockaddr *nat_addr, int nat_lport, int fport, int lport)
802 {
803 	char buf[BUFSIZ], reply[BUFSIZ], *p;
804 	ssize_t n;
805 	int sock;
806 
807 	/* Connect to the NAT host. */
808 	sock = socket(nat_addr->sa_family, SOCK_STREAM, 0);
809 	if (sock < 0) {
810 		maybe_syslog(LOG_ERR, "socket: %m");
811 		return 0;
812 	}
813 	if (connect(sock, nat_addr, nat_addr->sa_len) < 0) {
814 		maybe_syslog(LOG_ERR, "Can't connect to %s: %m",
815 		    gethost(nat_addr));
816 		(void)close(sock);
817 		return 0;
818 	}
819 
820 	/*
821 	 * Send the ident query to the NAT host, but use as local port
822 	 * the port of the NAT host.
823 	 */
824 	(void)snprintf(buf, sizeof(buf), "%d , %d\r\n", fport, nat_lport);
825 	if (send(sock, buf, strlen(buf), 0) < 0) {
826 		maybe_syslog(LOG_ERR, "send: %m");
827 		(void)close(sock);
828 		return 0;
829 	}
830 
831 	/* Read the reply from the NAT host. */
832 	if ((n = recv(sock, reply, sizeof(reply) - 1, 0)) < 0) {
833 		maybe_syslog(LOG_ERR, "recv: %m");
834 		(void)close(sock);
835 		return 0;
836 	} else if (n == 0) {
837 		maybe_syslog(LOG_NOTICE, "recv: EOF");
838 		(void)close(sock);
839 		return 0;
840 	}
841 	reply[n] = '\0';
842 	if (dflag)
843 		maybe_syslog(LOG_ERR, "Replied %s", reply);
844 	(void)close(sock);
845 
846 	/* Extract everything after the port specs from the ident reply. */
847 	for (p = reply; *p != '\0' && *p != ':'; p++)
848 		continue;
849 	if (*p == '\0' || *++p == '\0') {
850 		maybe_syslog(LOG_ERR, "Malformed ident reply from %s",
851 		    gethost(nat_addr));
852 		return 0;
853 	}
854 	/* Build reply for the requesting host, use the original local port. */
855 	(void)snprintf(buf, sizeof(buf), "%d,%d:%s", lport, fport, p);
856 
857 	/* Send the reply from the NAT host back to the requesting host. */
858 	if (send(fd, buf, strlen(buf), 0) < 0) {
859 		maybe_syslog(LOG_ERR, "send: %m");
860 		return 0;
861 	}
862 
863 	return 1;
864 }
865 
866 /* Check if a .noident file exists in the user home directory. */
867 static int
check_noident(const char * homedir)868 check_noident(const char *homedir)
869 {
870 	struct stat sb;
871 	char *path;
872 	int ret;
873 
874 	if (homedir == NULL)
875 		return 0;
876 	if (asprintf(&path, "%s/.noident", homedir) < 0)
877 		return 0;
878 	ret = stat(path, &sb);
879 
880 	free(path);
881 	return (ret == 0);
882 }
883 
884 /*
885  * Check if a .ident file exists in the user home directory and
886  * return the contents of that file.
887  */
888 static int
check_userident(const char * homedir,char * username,size_t len)889 check_userident(const char *homedir, char *username, size_t len)
890 {
891 	struct stat sb;
892 	char *path, *p;
893 	ssize_t n;
894 	int fd;
895 
896 	if (len == 0 || homedir == NULL)
897 		return 0;
898 	if (asprintf(&path, "%s/.ident", homedir) < 0)
899 		return 0;
900 	if ((fd = open(path, O_RDONLY|O_NONBLOCK|O_NOFOLLOW, 0)) < 0) {
901 		free(path);
902 		return 0;
903 	}
904 	if (fstat(fd, &sb) < 0 || !S_ISREG(sb.st_mode)) {
905 		(void)close(fd);
906 		free(path);
907 		return 0;
908 	}
909 	if ((n = read(fd, username, len - 1)) < 1) {
910 		(void)close(fd);
911 		free(path);
912 		return 0;
913 	}
914 	username[n] = '\0';
915 
916 	if ((p = strpbrk(username, "\r\n")) != NULL)
917 		*p = '\0';
918 
919 	(void)close(fd);
920 	free(path);
921 	return 1;
922 }
923 
924 /* Generate a random string. */
925 static void
random_string(char * str,size_t len)926 random_string(char *str, size_t len)
927 {
928 	static const char chars[] = "abcdefghijklmnopqrstuvwxyz1234567890";
929 	char *p;
930 
931 	if (len == 0)
932 		return;
933 	for (p = str; len > 1; len--)
934 		*p++ = chars[arc4random() % (sizeof(chars) - 1)];
935 	*p = '\0';
936 }
937 
938 /* Change the output format. */
939 static int
change_format(const char * format,struct passwd * pw,char * dest,size_t len)940 change_format(const char *format, struct passwd *pw, char *dest, size_t len)
941 {
942 	struct group *gr;
943 	const char *cp;
944 	char **gmp;
945 	size_t bp;
946 
947 	if (len == 0 || ((gr = getgrgid(pw->pw_gid)) == NULL))
948 		return 0;
949 
950 	for (bp = 0, cp = format; *cp != '\0' && bp < len - 1; cp++) {
951 		if (*cp != '%') {
952 			dest[bp++] = *cp;
953 			continue;
954 		}
955 		if (*++cp == '\0')
956 			break;
957 		switch (*cp) {
958 		case 'u':
959 			(void)snprintf(&dest[bp], len - bp, "%s", pw->pw_name);
960 			break;
961 		case 'U':
962 			(void)snprintf(&dest[bp], len - bp, "%d", pw->pw_uid);
963 			break;
964 		case 'g':
965 			(void)snprintf(&dest[bp], len - bp, "%s", gr->gr_name);
966 			break;
967 		case 'G':
968 			(void)snprintf(&dest[bp], len - bp, "%d", gr->gr_gid);
969 			break;
970 		case 'l':
971 			(void)snprintf(&dest[bp], len - bp, "%s", gr->gr_name);
972 			bp += strlen(&dest[bp]);
973 			if (bp >= len)
974 				break;
975 			setgrent();
976 			while ((gr = getgrent()) != NULL) {
977 				if (gr->gr_gid == pw->pw_gid)
978 					continue;
979 				for (gmp = gr->gr_mem; *gmp && **gmp; gmp++) {
980 					if (strcmp(*gmp, pw->pw_name) == 0) {
981 						(void)snprintf(&dest[bp],
982 						    len - bp, ",%s",
983 						    gr->gr_name);
984 						bp += strlen(&dest[bp]);
985 						break;
986 					}
987 				}
988 				if (bp >= len)
989 					break;
990 			}
991 			endgrent();
992 			break;
993 		case 'L':
994 			(void)snprintf(&dest[bp], len - bp, "%u", gr->gr_gid);
995 			bp += strlen(&dest[bp]);
996 			if (bp >= len)
997 				break;
998 			setgrent();
999 			while ((gr = getgrent()) != NULL) {
1000 				if (gr->gr_gid == pw->pw_gid)
1001 					continue;
1002 				for (gmp = gr->gr_mem; *gmp && **gmp; gmp++) {
1003 					if (strcmp(*gmp, pw->pw_name) == 0) {
1004 						(void)snprintf(&dest[bp],
1005 						    len - bp, ",%u",
1006 						    gr->gr_gid);
1007 						bp += strlen(&dest[bp]);
1008 						break;
1009 					}
1010 				}
1011 				if (bp >= len)
1012 					break;
1013 			}
1014 			endgrent();
1015 			break;
1016 		default:
1017 			dest[bp] = *cp;
1018 			dest[bp+1] = '\0';
1019 			break;
1020 		}
1021 		bp += strlen(&dest[bp]);
1022 	}
1023 	dest[bp] = '\0';
1024 
1025 	return 1;
1026 }
1027 
1028 /* Just exit when we caught SIGALRM. */
1029 static void
timeout_handler(int __unused s)1030 timeout_handler(int __unused s)
1031 {
1032 	maybe_syslog(LOG_INFO, "Timeout for request, closing connection...");
1033 	exit(EXIT_FAILURE);
1034 }
1035 
1036 /* Report error message string through syslog and quit. */
1037 static void
fatal(const char * func)1038 fatal(const char *func)
1039 {
1040 	maybe_syslog(LOG_ERR, "%s: %m", func);
1041 	exit(EXIT_FAILURE);
1042 }
1043 
1044 /*
1045  * Report an error through syslog and/or stderr and quit.  Only used when
1046  * running identd in the background and when it isn't a daemon yet.
1047  */
1048 static void
die(const char * message,...)1049 die(const char *message, ...)
1050 {
1051 	va_list ap;
1052 
1053 	if (bflag) {
1054 		va_start(ap, message);
1055 		vwarnx(message, ap);
1056 		va_end(ap);
1057 	}
1058 
1059 	if (lflag) {
1060 		va_start(ap, message);
1061 		vsyslog(LOG_ERR, message, ap);
1062 		va_end(ap);
1063 	}
1064 
1065 	exit(EXIT_FAILURE);
1066 }
1067 
1068 /* Log using syslog, but only if enabled with the -l flag. */
1069 void
maybe_syslog(int priority,const char * message,...)1070 maybe_syslog(int priority, const char *message, ...)
1071 {
1072 	va_list ap;
1073 
1074 	if (lflag) {
1075 		va_start(ap, message);
1076 		vsyslog(priority, message, ap);
1077 		va_end(ap);
1078 	}
1079 }
1080