2 * Copyright (c) 1983, 1988, 1989, 1993
3 * The Regents of the University of California. All rights reserved.
4 * Copyright (c) 2002 Networks Associates Technology, Inc.
7 * Portions of this software were developed for the FreeBSD Project by
8 * ThinkSec AS and NAI Labs, the Security Research Division of Network
9 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035
10 * ("CBOSS"), as part of the DARPA CHATS research program.
12 * Redistribution and use in source and binary forms, with or without
13 * modification, are permitted provided that the following conditions
15 * 1. Redistributions of source code must retain the above copyright
16 * notice, this list of conditions and the following disclaimer.
17 * 2. Redistributions in binary form must reproduce the above copyright
18 * notice, this list of conditions and the following disclaimer in the
19 * documentation and/or other materials provided with the distribution.
20 * 3. Neither the name of the University nor the names of its contributors
21 * may be used to endorse or promote products derived from this software
22 * without specific prior written permission.
24 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
39 static const char copyright[] =
40 "@(#) Copyright (c) 1983, 1988, 1989, 1993\n\
41 The Regents of the University of California. All rights reserved.\n";
45 static const char sccsid[] = "@(#)rlogind.c 8.1 (Berkeley) 6/4/93";
48 #include <sys/cdefs.h>
49 __FBSDID("$FreeBSD$");
52 * remote login server:
56 * terminal_type/speed\0
60 #define FD_SETSIZE 16 /* don't need many bits for select */
61 #include <sys/types.h>
62 #include <sys/param.h>
64 #include <sys/ioctl.h>
68 #include <sys/socket.h>
69 #include <netinet/in.h>
70 #include <netinet/in_systm.h>
71 #include <netinet/ip.h>
72 #include <netinet/tcp.h>
73 #include <arpa/inet.h>
87 #include <blacklist.h>
90 #ifndef TIOCPKT_WINDOW
91 #define TIOCPKT_WINDOW 0x80
98 char lusername[NMAX+1], rusername[NMAX+1];
99 static char term[64] = "TERM=";
100 #define ENVSIZE (sizeof("TERM=")-1) /* skip null for concatenation */
113 struct sockaddr_in su_sin;
114 struct sockaddr_in6 su_sin6;
116 #define su_len su_si.si_len
117 #define su_family su_si.si_family
118 #define su_port su_si.si_port
120 void doit(int, union sockunion *);
121 int control(int, char *, int);
122 void protocol(int, int);
124 void fatal(int, char *, int);
125 int do_rlogin(union sockunion *);
126 void getstr(char *, int, char *);
127 void setup_term(int);
128 int do_krb_login(struct sockaddr_in *);
133 main(int argc, char *argv[])
135 extern int __check_rhosts_file;
136 union sockunion from;
140 openlog("rlogind", LOG_PID | LOG_CONS, LOG_AUTH);
143 while ((ch = getopt(argc, argv, ARGSTR)) != -1)
152 __check_rhosts_file = 0;
165 fromlen = sizeof (from);
166 if (getpeername(0, (struct sockaddr *)&from, &fromlen) < 0) {
167 syslog(LOG_ERR,"Can't get peer name of remote host: %m");
168 fatal(STDERR_FILENO, "Can't get peer name of remote host", 1);
172 setsockopt(0, SOL_SOCKET, SO_KEEPALIVE, &on, sizeof (on)) < 0)
173 syslog(LOG_WARNING, "setsockopt (SO_KEEPALIVE): %m");
175 setsockopt(0, IPPROTO_TCP, TCP_NODELAY, &on, sizeof(on)) < 0)
176 syslog(LOG_WARNING, "setsockopt (TCP_NODELAY): %m");
177 if (from.su_family == AF_INET)
180 if (setsockopt(0, IPPROTO_IP, IP_TOS, (char *)&on, sizeof(int)) < 0)
181 syslog(LOG_WARNING, "setsockopt (IP_TOS): %m");
190 char line[MAXPATHLEN];
193 struct winsize win = { 0, 0, 0, 0 };
197 doit(int f, union sockunion *fromp)
199 int master, pid, on = 1;
200 int authenticated = 0;
201 char hostname[2 * MAXHOSTNAMELEN + 1];
202 char nameinfo[2 * INET6_ADDRSTRLEN + 1];
213 realhostname_sa(hostname, sizeof(hostname) - 1,
214 (struct sockaddr *)fromp, fromp->su_len);
216 fromp->su_port = ntohs((u_short)fromp->su_port);
217 hostname[sizeof(hostname) - 1] = '\0';
220 if ((fromp->su_family != AF_INET
222 && fromp->su_family != AF_INET6
225 fromp->su_port >= IPPORT_RESERVED ||
226 fromp->su_port < IPPORT_RESERVED/2) {
227 getnameinfo((struct sockaddr *)fromp,
229 nameinfo, sizeof(nameinfo), NULL, 0,
232 syslog(LOG_NOTICE, "Connection from %s on illegal port",
235 blacklist(1, STDIN_FILENO, "illegal port");
237 fatal(f, "Permission denied", 0);
240 if (fromp->su_family == AF_INET)
242 u_char optbuf[BUFSIZ/3];
243 socklen_t optsize = sizeof(optbuf);
247 if ((ip = getprotobyname("ip")) != NULL)
248 ipproto = ip->p_proto;
250 ipproto = IPPROTO_IP;
251 if (getsockopt(0, ipproto, IP_OPTIONS, (char *)optbuf,
252 &optsize) == 0 && optsize != 0) {
253 for (i = 0; i < optsize; ) {
254 u_char c = optbuf[i];
255 if (c == IPOPT_LSRR || c == IPOPT_SSRR) {
257 "Connection refused from %s with IP option %s",
258 inet_ntoa(fromp->su_sin.sin_addr),
259 c == IPOPT_LSRR ? "LSRR" : "SSRR");
261 blacklist(1, STDIN_FILENO, "source routing present");
267 i += (c == IPOPT_NOP) ? 1 : optbuf[i+1];
272 if (do_rlogin(fromp) == 0)
275 if (confirmed == 0) {
277 confirmed = 1; /* we sent the null! */
281 pid = forkpty(&master, line, NULL, &win);
284 fatal(f, "Out of ptys", 0);
286 fatal(f, "Forkpty", 1);
289 if (f > 2) /* f should always be 0, but... */
292 if (*lusername=='-') {
293 syslog(LOG_ERR, "tried to pass user \"%s\" to login",
296 blacklist(1, STDIN_FILENO, "invalid user");
298 fatal(STDERR_FILENO, "invalid user", 0);
301 blacklist(0, STDIN_FILENO, "success");
304 execl(_PATH_LOGIN, "login", "-p",
305 "-h", hostname, "-f", lusername, (char *)NULL);
307 execl(_PATH_LOGIN, "login", "-p",
308 "-h", hostname, lusername, (char *)NULL);
309 fatal(STDERR_FILENO, _PATH_LOGIN, 1);
312 ioctl(f, FIONBIO, &on);
313 ioctl(master, FIONBIO, &on);
314 ioctl(master, TIOCPKT, &on);
315 signal(SIGCHLD, cleanup);
317 signal(SIGCHLD, SIG_IGN);
321 char magic[2] = { 0377, 0377 };
322 char oobdata[] = {TIOCPKT_WINDOW};
325 * Handle a "control" request (signaled by magic being present)
326 * in the data stream. For now, we are only willing to handle
327 * window size changes.
330 control(int pty, char *cp, int n)
334 if (n < 4 + (int)sizeof(w) || cp[2] != 's' || cp[3] != 's')
336 oobdata[0] &= ~TIOCPKT_WINDOW; /* we know he heard */
337 bcopy(cp+4, (char *)&w, sizeof(w));
338 w.ws_row = ntohs(w.ws_row);
339 w.ws_col = ntohs(w.ws_col);
340 w.ws_xpixel = ntohs(w.ws_xpixel);
341 w.ws_ypixel = ntohs(w.ws_ypixel);
342 (void)ioctl(pty, TIOCSWINSZ, &w);
343 return (4+sizeof (w));
347 * rlogin "protocol" machine.
350 protocol(int f, int p)
352 char pibuf[1024+1], fibuf[1024], *pbp = NULL, *fbp = NULL;
353 int pcc = 0, fcc = 0;
358 * Must ignore SIGTTOU, otherwise we'll stop
359 * when we try and set slave pty's window shape
360 * (our controlling tty is the master pty).
362 (void) signal(SIGTTOU, SIG_IGN);
363 send(f, oobdata, 1, MSG_OOB); /* indicate new rlogin */
369 struct pollfd set[2];
372 set[0].events = POLLPRI;
376 set[0].events |= POLLOUT;
378 set[1].events |= POLLIN;
381 set[1].events |= POLLOUT;
383 set[0].events |= POLLIN;
385 if ((n = poll(set, 2, INFTIM)) < 0) {
391 /* shouldn't happen... */
395 #define pkcontrol(c) ((c)&(TIOCPKT_FLUSHWRITE|TIOCPKT_NOSTOP|TIOCPKT_DOSTOP))
396 if (set[0].revents & POLLPRI) {
397 cc = read(p, &cntl, 1);
398 if (cc == 1 && pkcontrol(cntl)) {
400 send(f, &cntl, 1, MSG_OOB);
401 if (cntl & TIOCPKT_FLUSHWRITE)
405 if (set[1].revents & POLLIN) {
406 fcc = read(f, fibuf, sizeof(fibuf));
407 if (fcc < 0 && errno == EWOULDBLOCK)
418 for (cp = fibuf; cp < fibuf+fcc-1; cp++)
419 if (cp[0] == magic[0] &&
421 left = fcc - (cp-fibuf);
422 n = control(p, cp, left);
426 bcopy(cp+n, cp, left);
434 if (set[0].revents & POLLOUT && fcc > 0) {
435 cc = write(p, fbp, fcc);
442 if (set[0].revents & POLLIN) {
443 pcc = read(p, pibuf, sizeof (pibuf));
445 if (pcc < 0 && errno == EWOULDBLOCK)
449 else if (pibuf[0] == 0) {
452 if (pkcontrol(pibuf[0])) {
453 pibuf[0] |= oobdata[0];
454 send(f, &pibuf[0], 1, MSG_OOB);
459 if (set[1].revents & POLLOUT && pcc > 0) {
460 cc = write(f, pbp, pcc);
470 cleanup(int signo __unused)
473 shutdown(netf, SHUT_RDWR);
478 fatal(int f, char *msg, int syserr)
481 char buf[BUFSIZ], *bp = buf;
484 * Prepend binary one to message if we haven't sent
485 * the magic null as confirmation.
488 *bp++ = '\01'; /* error indicator */
490 len = snprintf(bp, sizeof(buf), "rlogind: %s: %s.\r\n",
491 msg, strerror(errno));
493 len = snprintf(bp, sizeof(buf), "rlogind: %s.\r\n", msg);
496 (void) write(f, buf, bp + len - buf);
501 do_rlogin(union sockunion *dest)
504 getstr(rusername, sizeof(rusername), "remuser too long");
505 getstr(lusername, sizeof(lusername), "locuser too long");
506 getstr(term+ENVSIZE, sizeof(term)-ENVSIZE, "Terminal type too long");
508 pwd = getpwnam(lusername);
511 /* XXX why don't we syslog() failure? */
513 return (iruserok_sa(dest, dest->su_len, pwd->pw_uid == 0, rusername,
518 getstr(char *buf, int cnt, char *errmsg)
523 if (read(STDIN_FILENO, &c, 1) != 1)
527 blacklist(1, STDIN_FILENO, "buffer overflow");
529 fatal(STDOUT_FILENO, errmsg, 0);
535 extern char **environ;
542 struct termios tt, def;
544 cp = strchr(term + ENVSIZE, '/');
550 cp = strchr(speed, '/');
553 cfsetspeed(&tt, atoi(speed));
557 tt.c_iflag = def.c_iflag;
558 tt.c_oflag = def.c_oflag;
559 tt.c_lflag = def.c_lflag;
560 tcsetattr(fd, TCSAFLUSH, &tt);
565 cp = strchr(speed, '/');
569 cfsetspeed(&tt, atoi(speed));
570 tcsetattr(fd, TCSAFLUSH, &tt);
582 syslog(LOG_ERR, "usage: rlogind [-" ARGSTR "]");