2 * Copyright (c) 1983, 1988, 1989, 1993
3 * The Regents of the University of California. All rights reserved.
4 * Copyright (c) 2002 Networks Associates Technology, Inc.
7 * Portions of this software were developed for the FreeBSD Project by
8 * ThinkSec AS and NAI Labs, the Security Research Division of Network
9 * Associates, Inc. under DARPA/SPAWAR contract N66001-01-C-8035
10 * ("CBOSS"), as part of the DARPA CHATS research program.
12 * Redistribution and use in source and binary forms, with or without
13 * modification, are permitted provided that the following conditions
15 * 1. Redistributions of source code must retain the above copyright
16 * notice, this list of conditions and the following disclaimer.
17 * 2. Redistributions in binary form must reproduce the above copyright
18 * notice, this list of conditions and the following disclaimer in the
19 * documentation and/or other materials provided with the distribution.
20 * 3. Neither the name of the University nor the names of its contributors
21 * may be used to endorse or promote products derived from this software
22 * without specific prior written permission.
24 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
39 static const char copyright[] =
40 "@(#) Copyright (c) 1983, 1988, 1989, 1993\n\
41 The Regents of the University of California. All rights reserved.\n";
45 static const char sccsid[] = "@(#)rlogind.c 8.1 (Berkeley) 6/4/93";
48 #include <sys/cdefs.h>
49 __FBSDID("$FreeBSD$");
52 * remote login server:
56 * terminal_type/speed\0
60 #define FD_SETSIZE 16 /* don't need many bits for select */
61 #include <sys/types.h>
62 #include <sys/param.h>
64 #include <sys/ioctl.h>
68 #include <sys/socket.h>
69 #include <netinet/in.h>
70 #include <netinet/in_systm.h>
71 #include <netinet/ip.h>
72 #include <netinet/tcp.h>
73 #include <arpa/inet.h>
87 #ifndef TIOCPKT_WINDOW
88 #define TIOCPKT_WINDOW 0x80
95 char lusername[NMAX+1], rusername[NMAX+1];
96 static char term[64] = "TERM=";
97 #define ENVSIZE (sizeof("TERM=")-1) /* skip null for concatenation */
110 struct sockaddr_in su_sin;
111 struct sockaddr_in6 su_sin6;
113 #define su_len su_si.si_len
114 #define su_family su_si.si_family
115 #define su_port su_si.si_port
117 void doit(int, union sockunion *);
118 int control(int, char *, int);
119 void protocol(int, int);
121 void fatal(int, char *, int);
122 int do_rlogin(union sockunion *);
123 void getstr(char *, int, char *);
124 void setup_term(int);
125 int do_krb_login(struct sockaddr_in *);
130 main(int argc, char *argv[])
132 extern int __check_rhosts_file;
133 union sockunion from;
137 openlog("rlogind", LOG_PID | LOG_CONS, LOG_AUTH);
140 while ((ch = getopt(argc, argv, ARGSTR)) != -1)
149 __check_rhosts_file = 0;
162 fromlen = sizeof (from);
163 if (getpeername(0, (struct sockaddr *)&from, &fromlen) < 0) {
164 syslog(LOG_ERR,"Can't get peer name of remote host: %m");
165 fatal(STDERR_FILENO, "Can't get peer name of remote host", 1);
169 setsockopt(0, SOL_SOCKET, SO_KEEPALIVE, &on, sizeof (on)) < 0)
170 syslog(LOG_WARNING, "setsockopt (SO_KEEPALIVE): %m");
172 setsockopt(0, IPPROTO_TCP, TCP_NODELAY, &on, sizeof(on)) < 0)
173 syslog(LOG_WARNING, "setsockopt (TCP_NODELAY): %m");
174 if (from.su_family == AF_INET)
177 if (setsockopt(0, IPPROTO_IP, IP_TOS, (char *)&on, sizeof(int)) < 0)
178 syslog(LOG_WARNING, "setsockopt (IP_TOS): %m");
187 char line[MAXPATHLEN];
190 struct winsize win = { 0, 0, 0, 0 };
194 doit(int f, union sockunion *fromp)
196 int master, pid, on = 1;
197 int authenticated = 0;
198 char hostname[2 * MAXHOSTNAMELEN + 1];
199 char nameinfo[2 * INET6_ADDRSTRLEN + 1];
210 realhostname_sa(hostname, sizeof(hostname) - 1,
211 (struct sockaddr *)fromp, fromp->su_len);
213 fromp->su_port = ntohs((u_short)fromp->su_port);
214 hostname[sizeof(hostname) - 1] = '\0';
217 if ((fromp->su_family != AF_INET
219 && fromp->su_family != AF_INET6
222 fromp->su_port >= IPPORT_RESERVED ||
223 fromp->su_port < IPPORT_RESERVED/2) {
224 getnameinfo((struct sockaddr *)fromp,
226 nameinfo, sizeof(nameinfo), NULL, 0,
229 syslog(LOG_NOTICE, "Connection from %s on illegal port",
231 fatal(f, "Permission denied", 0);
234 if (fromp->su_family == AF_INET)
236 u_char optbuf[BUFSIZ/3];
237 socklen_t optsize = sizeof(optbuf);
241 if ((ip = getprotobyname("ip")) != NULL)
242 ipproto = ip->p_proto;
244 ipproto = IPPROTO_IP;
245 if (getsockopt(0, ipproto, IP_OPTIONS, (char *)optbuf,
246 &optsize) == 0 && optsize != 0) {
247 for (i = 0; i < optsize; ) {
248 u_char c = optbuf[i];
249 if (c == IPOPT_LSRR || c == IPOPT_SSRR) {
251 "Connection refused from %s with IP option %s",
252 inet_ntoa(fromp->su_sin.sin_addr),
253 c == IPOPT_LSRR ? "LSRR" : "SSRR");
258 i += (c == IPOPT_NOP) ? 1 : optbuf[i+1];
263 if (do_rlogin(fromp) == 0)
266 if (confirmed == 0) {
268 confirmed = 1; /* we sent the null! */
272 pid = forkpty(&master, line, NULL, &win);
275 fatal(f, "Out of ptys", 0);
277 fatal(f, "Forkpty", 1);
280 if (f > 2) /* f should always be 0, but... */
283 if (*lusername=='-') {
284 syslog(LOG_ERR, "tried to pass user \"%s\" to login",
286 fatal(STDERR_FILENO, "invalid user", 0);
289 execl(_PATH_LOGIN, "login", "-p",
290 "-h", hostname, "-f", lusername, (char *)NULL);
292 execl(_PATH_LOGIN, "login", "-p",
293 "-h", hostname, lusername, (char *)NULL);
294 fatal(STDERR_FILENO, _PATH_LOGIN, 1);
297 ioctl(f, FIONBIO, &on);
298 ioctl(master, FIONBIO, &on);
299 ioctl(master, TIOCPKT, &on);
300 signal(SIGCHLD, cleanup);
302 signal(SIGCHLD, SIG_IGN);
306 char magic[2] = { 0377, 0377 };
307 char oobdata[] = {TIOCPKT_WINDOW};
310 * Handle a "control" request (signaled by magic being present)
311 * in the data stream. For now, we are only willing to handle
312 * window size changes.
315 control(int pty, char *cp, int n)
319 if (n < 4 + (int)sizeof(w) || cp[2] != 's' || cp[3] != 's')
321 oobdata[0] &= ~TIOCPKT_WINDOW; /* we know he heard */
322 bcopy(cp+4, (char *)&w, sizeof(w));
323 w.ws_row = ntohs(w.ws_row);
324 w.ws_col = ntohs(w.ws_col);
325 w.ws_xpixel = ntohs(w.ws_xpixel);
326 w.ws_ypixel = ntohs(w.ws_ypixel);
327 (void)ioctl(pty, TIOCSWINSZ, &w);
328 return (4+sizeof (w));
332 * rlogin "protocol" machine.
335 protocol(int f, int p)
337 char pibuf[1024+1], fibuf[1024], *pbp = NULL, *fbp = NULL;
338 int pcc = 0, fcc = 0;
343 * Must ignore SIGTTOU, otherwise we'll stop
344 * when we try and set slave pty's window shape
345 * (our controlling tty is the master pty).
347 (void) signal(SIGTTOU, SIG_IGN);
348 send(f, oobdata, 1, MSG_OOB); /* indicate new rlogin */
353 if (nfd > FD_SETSIZE) {
354 syslog(LOG_ERR, "select mask too small, increase FD_SETSIZE");
355 fatal(f, "internal error (select mask too small)", 0);
358 fd_set ibits, obits, ebits, *omask;
363 omask = (fd_set *)NULL;
377 if ((n = select(nfd, &ibits, omask, &ebits, 0)) < 0) {
380 fatal(f, "select", 1);
383 /* shouldn't happen... */
387 #define pkcontrol(c) ((c)&(TIOCPKT_FLUSHWRITE|TIOCPKT_NOSTOP|TIOCPKT_DOSTOP))
388 if (FD_ISSET(p, &ebits)) {
389 cc = read(p, &cntl, 1);
390 if (cc == 1 && pkcontrol(cntl)) {
392 send(f, &cntl, 1, MSG_OOB);
393 if (cntl & TIOCPKT_FLUSHWRITE) {
399 if (FD_ISSET(f, &ibits)) {
400 fcc = read(f, fibuf, sizeof(fibuf));
401 if (fcc < 0 && errno == EWOULDBLOCK)
412 for (cp = fibuf; cp < fibuf+fcc-1; cp++)
413 if (cp[0] == magic[0] &&
415 left = fcc - (cp-fibuf);
416 n = control(p, cp, left);
420 bcopy(cp+n, cp, left);
425 FD_SET(p, &obits); /* try write */
429 if (FD_ISSET(p, &obits) && fcc > 0) {
430 cc = write(p, fbp, fcc);
437 if (FD_ISSET(p, &ibits)) {
438 pcc = read(p, pibuf, sizeof (pibuf));
440 if (pcc < 0 && errno == EWOULDBLOCK)
444 else if (pibuf[0] == 0) {
446 FD_SET(f, &obits); /* try write */
448 if (pkcontrol(pibuf[0])) {
449 pibuf[0] |= oobdata[0];
450 send(f, &pibuf[0], 1, MSG_OOB);
455 if ((FD_ISSET(f, &obits)) && pcc > 0) {
456 cc = write(f, pbp, pcc);
457 if (cc < 0 && errno == EWOULDBLOCK) {
459 * This happens when we try write after read
460 * from p, but some old kernels balk at large
461 * writes even when select returns true.
463 if (!FD_ISSET(p, &ibits))
476 cleanup(int signo __unused)
479 shutdown(netf, SHUT_RDWR);
484 fatal(int f, char *msg, int syserr)
487 char buf[BUFSIZ], *bp = buf;
490 * Prepend binary one to message if we haven't sent
491 * the magic null as confirmation.
494 *bp++ = '\01'; /* error indicator */
496 len = snprintf(bp, sizeof(buf), "rlogind: %s: %s.\r\n",
497 msg, strerror(errno));
499 len = snprintf(bp, sizeof(buf), "rlogind: %s.\r\n", msg);
502 (void) write(f, buf, bp + len - buf);
507 do_rlogin(union sockunion *dest)
510 getstr(rusername, sizeof(rusername), "remuser too long");
511 getstr(lusername, sizeof(lusername), "locuser too long");
512 getstr(term+ENVSIZE, sizeof(term)-ENVSIZE, "Terminal type too long");
514 pwd = getpwnam(lusername);
517 /* XXX why don't we syslog() failure? */
519 return (iruserok_sa(dest, dest->su_len, pwd->pw_uid == 0, rusername,
524 getstr(char *buf, int cnt, char *errmsg)
529 if (read(STDIN_FILENO, &c, 1) != 1)
532 fatal(STDOUT_FILENO, errmsg, 0);
537 extern char **environ;
544 struct termios tt, def;
546 cp = strchr(term + ENVSIZE, '/');
552 cp = strchr(speed, '/');
555 cfsetspeed(&tt, atoi(speed));
559 tt.c_iflag = def.c_iflag;
560 tt.c_oflag = def.c_oflag;
561 tt.c_lflag = def.c_lflag;
562 tcsetattr(fd, TCSAFLUSH, &tt);
567 cp = strchr(speed, '/');
571 cfsetspeed(&tt, atoi(speed));
572 tcsetattr(fd, TCSAFLUSH, &tt);
584 syslog(LOG_ERR, "usage: rlogind [-" ARGSTR "]");