usr.sbin/nfsuserd/nfsuserd.c

   1 /*-
   2  * Copyright (c) 2009 Rick Macklem, University of Guelph
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  *
  14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  24  * SUCH DAMAGE.
  25  *
  26  */
  27
  28 #include <sys/cdefs.h>
  29 __FBSDID("$FreeBSD$");
  30
  31 #include <sys/param.h>
  32 #include <sys/errno.h>
  33 #include <sys/linker.h>
  34 #include <sys/module.h>
  35 #include <sys/mount.h>
  36 #include <sys/socket.h>
  37 #include <sys/socketvar.h>
  38 #include <sys/sysctl.h>
  39 #include <sys/time.h>
  40 #include <sys/ucred.h>
  41 #include <sys/vnode.h>
  42 #include <sys/wait.h>
  43
  44 #include <netinet/in.h>
  45
  46 #include <arpa/inet.h>
  47
  48 #include <nfs/nfssvc.h>
  49
  50 #include <rpc/rpc.h>
  51
  52 #include <fs/nfs/rpcv2.h>
  53 #include <fs/nfs/nfsproto.h>
  54 #include <fs/nfs/nfskpiport.h>
  55 #include <fs/nfs/nfs.h>
  56
  57 #include <ctype.h>
  58 #include <err.h>
  59 #include <grp.h>
  60 #include <netdb.h>
  61 #include <pwd.h>
  62 #include <signal.h>
  63 #include <stdio.h>
  64 #include <stdlib.h>
  65 #include <string.h>
  66 #include <syslog.h>
  67 #include <unistd.h>
  68
  69 /*
  70  * This program loads the password and group databases into the kernel
  71  * for NFS V4.
  72  */
  73
  74 static void     cleanup_term(int);
  75 static void     usage(void);
  76 static void     nfsuserdsrv(struct svc_req *, SVCXPRT *);
  77 static bool_t   xdr_getid(XDR *, caddr_t);
  78 static bool_t   xdr_getname(XDR *, caddr_t);
  79 static bool_t   xdr_retval(XDR *, caddr_t);
  80 static int      nfsbind_localhost(void);
  81
  82 #define MAXNAME         1024
  83 #define MAXNFSUSERD     20
  84 #define DEFNFSUSERD     4
  85 #define MAXUSERMAX      100000
  86 #define MINUSERMAX      10
  87 #define DEFUSERMAX      200
  88 #define DEFUSERTIMEOUT  (1 * 60)
  89 struct info {
  90         long    id;
  91         long    retval;
  92         char    name[MAXNAME + 1];
  93 };
  94
  95 u_char *dnsname = "default.domain";
  96 u_char *defaultuser = "nobody";
  97 uid_t defaultuid = 65534;
  98 u_char *defaultgroup = "nogroup";
  99 gid_t defaultgid = 65533;
 100 int verbose = 0, im_a_server = 0, nfsuserdcnt = -1, forcestart = 0;
 101 int defusertimeout = DEFUSERTIMEOUT, manage_gids = 0;
 102 pid_t servers[MAXNFSUSERD];
 103 static struct sockaddr_storage fromip;
 104 #ifdef INET6
 105 static struct in6_addr in6loopback = IN6ADDR_LOOPBACK_INIT;
 106 #endif
 107
 108 int
 109 main(int argc, char *argv[])
 110 {
 111         int i, j;
 112         int error, fnd_dup, len, mustfreeai = 0, start_uidpos;
 113         struct nfsd_idargs nid;
 114         struct passwd *pwd;
 115         struct group *grp;
 116         int sock, one = 1;
 117         SVCXPRT *udptransp;
 118         struct nfsuserd_args nargs;
 119         sigset_t signew;
 120         char hostname[MAXHOSTNAMELEN + 1], *cp;
 121         struct addrinfo *aip, hints;
 122         static uid_t check_dups[MAXUSERMAX];
 123         gid_t grps[NGROUPS];
 124         int ngroup;
 125 #ifdef INET
 126         struct sockaddr_in *sin;
 127 #endif
 128 #ifdef INET6
 129         struct sockaddr_in6 *sin6;
 130 #endif
 131         int jailed, s;
 132         size_t jailed_size;
 133
 134         if (modfind("nfscommon") < 0) {
 135                 /* Not present in kernel, try loading it */
 136                 if (kldload("nfscommon") < 0 ||
 137                     modfind("nfscommon") < 0)
 138                         errx(1, "Experimental nfs subsystem is not available");
 139         }
 140
 141         /*
 142          * First, figure out what our domain name and Kerberos Realm
 143          * seem to be. Command line args may override these later.
 144          */
 145         if (gethostname(hostname, MAXHOSTNAMELEN) == 0) {
 146                 if ((cp = strchr(hostname, '.')) != NULL &&
 147                     *(cp + 1) != '\0') {
 148                         dnsname = cp + 1;
 149                 } else {
 150                         memset((void *)&hints, 0, sizeof (hints));
 151                         hints.ai_flags = AI_CANONNAME;
 152                         error = getaddrinfo(hostname, NULL, &hints, &aip);
 153                         if (error == 0) {
 154                             if (aip->ai_canonname != NULL &&
 155                                 (cp = strchr(aip->ai_canonname, '.')) != NULL
 156                                 && *(cp + 1) != '\0') {
 157                                         dnsname = cp + 1;
 158                                         mustfreeai = 1;
 159                                 } else {
 160                                         freeaddrinfo(aip);
 161                                 }
 162                         }
 163                 }
 164         }
 165
 166         /*
 167          * See if this server handles IPv4 or IPv6 and set up the default
 168          * localhost address.
 169          */
 170         s = -1;
 171 #ifdef INET6
 172         s = socket(PF_INET6, SOCK_DGRAM, 0);
 173         if (s >= 0) {
 174                 fromip.ss_family = AF_INET6;
 175                 fromip.ss_len = sizeof(struct sockaddr_in6);
 176                 sin6 = (struct sockaddr_in6 *)&fromip;
 177                 sin6->sin6_addr = in6loopback;
 178                 close(s);
 179         }
 180 #endif  /* INET6 */
 181 #ifdef INET
 182         if (s < 0) {
 183                 s = socket(PF_INET, SOCK_DGRAM, 0);
 184                 if (s >= 0) {
 185                         fromip.ss_family = AF_INET;
 186                         fromip.ss_len = sizeof(struct sockaddr_in);
 187                         sin = (struct sockaddr_in *)&fromip;
 188                         sin->sin_addr.s_addr = htonl(INADDR_LOOPBACK);
 189                         close(s);
 190                 }
 191         }
 192 #endif  /* INET */
 193         if (s < 0)
 194                 err(1, "Can't create a inet/inet6 socket");
 195
 196         nid.nid_usermax = DEFUSERMAX;
 197         nid.nid_usertimeout = defusertimeout;
 198
 199         argc--;
 200         argv++;
 201         while (argc >= 1) {
 202                 if (!strcmp(*argv, "-domain")) {
 203                         if (argc == 1)
 204                                 usage();
 205                         argc--;
 206                         argv++;
 207                         strncpy(hostname, *argv, MAXHOSTNAMELEN);
 208                         hostname[MAXHOSTNAMELEN] = '\0';
 209                         dnsname = hostname;
 210                 } else if (!strcmp(*argv, "-verbose")) {
 211                         verbose = 1;
 212                 } else if (!strcmp(*argv, "-force")) {
 213                         forcestart = 1;
 214                 } else if (!strcmp(*argv, "-manage-gids")) {
 215                         manage_gids = 1;
 216                 } else if (!strcmp(*argv, "-usermax")) {
 217                         if (argc == 1)
 218                                 usage();
 219                         argc--;
 220                         argv++;
 221                         i = atoi(*argv);
 222                         if (i < MINUSERMAX || i > MAXUSERMAX) {
 223                                 fprintf(stderr,
 224                                     "usermax %d out of range %d<->%d\n", i,
 225                                     MINUSERMAX, MAXUSERMAX);
 226                                 usage();
 227                         }
 228                         nid.nid_usermax = i;
 229                 } else if (!strcmp(*argv, "-usertimeout")) {
 230                         if (argc == 1)
 231                                 usage();
 232                         argc--;
 233                         argv++;
 234                         i = atoi(*argv);
 235                         if (i < 0 || i > 100000) {
 236                                 fprintf(stderr,
 237                                     "usertimeout %d out of range 0<->100000\n",
 238                                     i);
 239                                 usage();
 240                         }
 241                         nid.nid_usertimeout = defusertimeout = i * 60;
 242                 } else if (nfsuserdcnt == -1) {
 243                         nfsuserdcnt = atoi(*argv);
 244                         if (nfsuserdcnt < 1)
 245                                 usage();
 246                         if (nfsuserdcnt > MAXNFSUSERD) {
 247                                 warnx("nfsuserd count %d; reset to %d",
 248                                     nfsuserdcnt, DEFNFSUSERD);
 249                                 nfsuserdcnt = DEFNFSUSERD;
 250                         }
 251                 } else {
 252                         usage();
 253                 }
 254                 argc--;
 255                 argv++;
 256         }
 257         if (nfsuserdcnt < 1)
 258                 nfsuserdcnt = DEFNFSUSERD;
 259
 260         /*
 261          * Strip off leading and trailing '.'s in domain name and map
 262          * alphabetics to lower case.
 263          */
 264         while (*dnsname == '.')
 265                 dnsname++;
 266         if (*dnsname == '\0')
 267                 errx(1, "Domain name all '.'");
 268         len = strlen(dnsname);
 269         cp = dnsname + len - 1;
 270         while (*cp == '.') {
 271                 *cp = '\0';
 272                 len--;
 273                 cp--;
 274         }
 275         for (i = 0; i < len; i++) {
 276                 if (!isascii(dnsname[i]))
 277                         errx(1, "Domain name has non-ascii char");
 278                 if (isupper(dnsname[i]))
 279                         dnsname[i] = tolower(dnsname[i]);
 280         }
 281
 282         /*
 283          * If the nfsuserd died off ungracefully, this is necessary to
 284          * get them to start again.
 285          */
 286         if (forcestart && nfssvc(NFSSVC_NFSUSERDDELPORT, NULL) < 0)
 287                 errx(1, "Can't do nfssvc() to delete the port");
 288
 289         if (verbose)
 290                 fprintf(stderr,
 291                     "nfsuserd: domain=%s usermax=%d usertimeout=%d\n",
 292                     dnsname, nid.nid_usermax, nid.nid_usertimeout);
 293
 294         for (i = 0; i < nfsuserdcnt; i++)
 295                 servers[i] = (pid_t)-1;
 296
 297         nargs.nuserd_family = fromip.ss_family;
 298         /*
 299          * Set up the service port to accept requests via UDP from
 300          * localhost (INADDR_LOOPBACK or IN6ADDR_LOOPBACK_INIT).
 301          */
 302         if ((sock = socket(nargs.nuserd_family, SOCK_DGRAM, IPPROTO_UDP)) < 0)
 303                 err(1, "cannot create udp socket");
 304
 305         /*
 306          * Not sure what this does, so I'll leave it here for now.
 307          */
 308         setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one));
 309
 310         if ((udptransp = svcudp_create(sock)) == NULL)
 311                 err(1, "Can't set up socket");
 312
 313         /*
 314          * By not specifying a protocol, it is linked into the
 315          * dispatch queue, but not registered with portmapper,
 316          * which is just what I want.
 317          */
 318         if (!svc_register(udptransp, RPCPROG_NFSUSERD, RPCNFSUSERD_VERS,
 319             nfsuserdsrv, 0))
 320                 err(1, "Can't register nfsuserd");
 321
 322         /*
 323          * Tell the kernel what my port# is.
 324          */
 325         nargs.nuserd_port = htons(udptransp->xp_port);
 326 #ifdef DEBUG
 327         printf("portnum=0x%x\n", nargs.nuserd_port);
 328 #else
 329         if (nfssvc(NFSSVC_NFSUSERDPORT | NFSSVC_NEWSTRUCT, &nargs) < 0) {
 330                 if (errno == EPERM) {
 331                         jailed = 0;
 332                         jailed_size = sizeof(jailed);
 333                         sysctlbyname("security.jail.jailed", &jailed,
 334                             &jailed_size, NULL, 0);
 335                         if (jailed != 0) {
 336                                 fprintf(stderr, "Cannot start nfsuserd. "
 337                                     "allow.nfsd might not be configured\n");
 338                         } else {
 339                                 fprintf(stderr, "Cannot start nfsuserd "
 340                                     "when already running.");
 341                                 fprintf(stderr, " If not running, "
 342                                     "use the -force option.\n");
 343                         }
 344                 } else {
 345                         fprintf(stderr, "Can't do nfssvc() to add port\n");
 346                 }
 347                 exit(1);
 348         }
 349 #endif
 350
 351         pwd = getpwnam(defaultuser);
 352         if (pwd)
 353                 nid.nid_uid = pwd->pw_uid;
 354         else
 355                 nid.nid_uid = defaultuid;
 356         grp = getgrnam(defaultgroup);
 357         if (grp)
 358                 nid.nid_gid = grp->gr_gid;
 359         else
 360                 nid.nid_gid = defaultgid;
 361         nid.nid_name = dnsname;
 362         nid.nid_namelen = strlen(nid.nid_name);
 363         nid.nid_ngroup = 0;
 364         nid.nid_grps = NULL;
 365         nid.nid_flag = NFSID_INITIALIZE;
 366 #ifdef DEBUG
 367         printf("Initialize uid=%d gid=%d dns=%s\n", nid.nid_uid, nid.nid_gid,
 368             nid.nid_name);
 369 #else
 370         error = nfssvc(NFSSVC_IDNAME | NFSSVC_NEWSTRUCT, &nid);
 371         if (error)
 372                 errx(1, "Can't initialize nfs user/groups");
 373 #endif
 374
 375         i = 0;
 376         /*
 377          * Loop around adding all groups.
 378          */
 379         setgrent();
 380         while (i < nid.nid_usermax && (grp = getgrent())) {
 381                 nid.nid_gid = grp->gr_gid;
 382                 nid.nid_name = grp->gr_name;
 383                 nid.nid_namelen = strlen(grp->gr_name);
 384                 nid.nid_ngroup = 0;
 385                 nid.nid_grps = NULL;
 386                 nid.nid_flag = NFSID_ADDGID;
 387 #ifdef DEBUG
 388                 printf("add gid=%d name=%s\n", nid.nid_gid, nid.nid_name);
 389 #else
 390                 error = nfssvc(NFSSVC_IDNAME | NFSSVC_NEWSTRUCT, &nid);
 391                 if (error)
 392                         errx(1, "Can't add group %s", grp->gr_name);
 393 #endif
 394                 i++;
 395         }
 396         endgrent();
 397
 398         /*
 399          * Loop around adding all users.
 400          */
 401         start_uidpos = i;
 402         setpwent();
 403         while (i < nid.nid_usermax && (pwd = getpwent())) {
 404                 fnd_dup = 0;
 405                 /*
 406                  * Yes, this is inefficient, but it is only done once when
 407                  * the daemon is started and will run in a fraction of a second
 408                  * for nid_usermax at 10000. If nid_usermax is cranked up to
 409                  * 100000, it will take several seconds, depending on the CPU.
 410                  */
 411                 for (j = 0; j < (i - start_uidpos); j++)
 412                         if (check_dups[j] == pwd->pw_uid) {
 413                                 /* Found another entry for uid, so skip it */
 414                                 fnd_dup = 1;
 415                                 break;
 416                         }
 417                 if (fnd_dup != 0)
 418                         continue;
 419                 check_dups[i - start_uidpos] = pwd->pw_uid;
 420                 nid.nid_uid = pwd->pw_uid;
 421                 nid.nid_name = pwd->pw_name;
 422                 nid.nid_namelen = strlen(pwd->pw_name);
 423                 if (manage_gids != 0) {
 424                         /* Get the group list for this user. */
 425                         ngroup = NGROUPS;
 426                         if (getgrouplist(pwd->pw_name, pwd->pw_gid, grps,
 427                             &ngroup) < 0)
 428                                 syslog(LOG_ERR, "Group list too small");
 429                         nid.nid_ngroup = ngroup;
 430                         nid.nid_grps = grps;
 431                 } else {
 432                         nid.nid_ngroup = 0;
 433                         nid.nid_grps = NULL;
 434                 }
 435                 nid.nid_flag = NFSID_ADDUID;
 436 #ifdef DEBUG
 437                 printf("add uid=%d name=%s\n", nid.nid_uid, nid.nid_name);
 438 #else
 439                 error = nfssvc(NFSSVC_IDNAME | NFSSVC_NEWSTRUCT, &nid);
 440                 if (error)
 441                         errx(1, "Can't add user %s", pwd->pw_name);
 442 #endif
 443                 i++;
 444         }
 445         endpwent();
 446
 447         /*
 448          * I should feel guilty for not calling this for all the above exit()
 449          * upon error cases, but I don't.
 450          */
 451         if (mustfreeai)
 452                 freeaddrinfo(aip);
 453
 454 #ifdef DEBUG
 455         exit(0);
 456 #endif
 457         /*
 458          * Temporarily block SIGUSR1 and SIGCHLD, so servers[] can't
 459          * end up bogus.
 460          */
 461         sigemptyset(&signew);
 462         sigaddset(&signew, SIGUSR1);
 463         sigaddset(&signew, SIGCHLD);
 464         sigprocmask(SIG_BLOCK, &signew, NULL);
 465
 466         daemon(0, 0);
 467         (void)signal(SIGHUP, SIG_IGN);
 468         (void)signal(SIGINT, SIG_IGN);
 469         (void)signal(SIGQUIT, SIG_IGN);
 470         (void)signal(SIGTERM, SIG_IGN);
 471         (void)signal(SIGUSR1, cleanup_term);
 472         (void)signal(SIGCHLD, cleanup_term);
 473
 474         openlog("nfsuserd:", LOG_PID, LOG_DAEMON);
 475
 476         /*
 477          * Fork off the server daemons that do the work. All the master
 478          * does is terminate them and cleanup.
 479          */
 480         for (i = 0; i < nfsuserdcnt; i++) {
 481                 servers[i] = fork();
 482                 if (servers[i] == 0) {
 483                         im_a_server = 1;
 484                         setproctitle("server");
 485                         sigemptyset(&signew);
 486                         sigaddset(&signew, SIGUSR1);
 487                         sigprocmask(SIG_UNBLOCK, &signew, NULL);
 488
 489                         /*
 490                          * and away we go.
 491                          */
 492                         svc_run();
 493                         syslog(LOG_ERR, "nfsuserd died: %m");
 494                         exit(1);
 495                 } else if (servers[i] < 0) {
 496                         syslog(LOG_ERR, "fork: %m");
 497                 }
 498         }
 499
 500         /*
 501          * Just wait for SIGUSR1 or a child to die and then...
 502          * As the Governor of California would say, "Terminate them".
 503          */
 504         setproctitle("master");
 505         sigemptyset(&signew);
 506         while (1)
 507                 sigsuspend(&signew);
 508 }
 509
 510 /*
 511  * The nfsuserd rpc service
 512  */
 513 static void
 514 nfsuserdsrv(struct svc_req *rqstp, SVCXPRT *transp)
 515 {
 516         struct passwd *pwd;
 517         struct group *grp;
 518         int error;
 519 #if defined(INET) || defined(INET6)
 520         u_short sport;
 521         int ret;
 522 #endif
 523         struct info info;
 524         struct nfsd_idargs nid;
 525         gid_t grps[NGROUPS];
 526         int ngroup;
 527 #ifdef INET
 528         struct sockaddr_in *fromsin, *sin;
 529 #endif
 530 #ifdef INET6
 531         struct sockaddr_in6 *fromsin6, *sin6;
 532         char buf[INET6_ADDRSTRLEN];
 533 #endif
 534
 535         /*
 536          * Only handle requests from localhost on a reserved port number.
 537          * If the upcall is from a different address, call nfsbind_localhost()
 538          * to check for a remapping of localhost, due to jails.
 539          * (Since a reserved port # at localhost implies a client with
 540          *  local root, there won't be a security breach. This is about
 541          *  the only case I can think of where a reserved port # means
 542          *  something.)
 543          */
 544         if (rqstp->rq_proc != NULLPROC) {
 545                 switch (fromip.ss_family) {
 546 #ifdef INET
 547                 case AF_INET:
 548                         if (transp->xp_rtaddr.len < sizeof(*sin)) {
 549                                 syslog(LOG_ERR, "xp_rtaddr too small");
 550                                 svcerr_weakauth(transp);
 551                                 return;
 552                         }
 553                         sin = (struct sockaddr_in *)transp->xp_rtaddr.buf;
 554                         fromsin = (struct sockaddr_in *)&fromip;
 555                         sport = ntohs(sin->sin_port);
 556                         if (sport >= IPPORT_RESERVED) {
 557                                 syslog(LOG_ERR, "not a reserved port#");
 558                                 svcerr_weakauth(transp);
 559                                 return;
 560                         }
 561                         ret = 1;
 562                         if (sin->sin_addr.s_addr != fromsin->sin_addr.s_addr)
 563                                 ret = nfsbind_localhost();
 564                         if (ret == 0 || sin->sin_addr.s_addr !=
 565                             fromsin->sin_addr.s_addr) {
 566                                 syslog(LOG_ERR, "bad from ip %s",
 567                                     inet_ntoa(sin->sin_addr));
 568                                 svcerr_weakauth(transp);
 569                                 return;
 570                         }
 571                         break;
 572 #endif  /* INET */
 573 #ifdef INET6
 574                 case AF_INET6:
 575                         if (transp->xp_rtaddr.len < sizeof(*sin6)) {
 576                                 syslog(LOG_ERR, "xp_rtaddr too small");
 577                                 svcerr_weakauth(transp);
 578                                 return;
 579                         }
 580                         sin6 = (struct sockaddr_in6 *)transp->xp_rtaddr.buf;
 581                         fromsin6 = (struct sockaddr_in6 *)&fromip;
 582                         sport = ntohs(sin6->sin6_port);
 583                         if (sport >= IPV6PORT_RESERVED) {
 584                                 syslog(LOG_ERR, "not a reserved port#");
 585                                 svcerr_weakauth(transp);
 586                                 return;
 587                         }
 588                         ret = 1;
 589                         if (!IN6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
 590                             &fromsin6->sin6_addr))
 591                                 ret = nfsbind_localhost();
 592                         if (ret == 0 || !IN6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
 593                             &fromsin6->sin6_addr)) {
 594                                 if (inet_ntop(AF_INET6, &sin6->sin6_addr, buf,
 595                                     INET6_ADDRSTRLEN) != NULL)
 596                                         syslog(LOG_ERR, "bad from ip %s", buf);
 597                                 else
 598                                         syslog(LOG_ERR, "bad from ip6 addr");
 599                                 svcerr_weakauth(transp);
 600                                 return;
 601                         }
 602                         break;
 603 #endif  /* INET6 */
 604                 }
 605         }
 606         switch (rqstp->rq_proc) {
 607         case NULLPROC:
 608                 if (!svc_sendreply(transp, (xdrproc_t)xdr_void, NULL))
 609                         syslog(LOG_ERR, "Can't send reply");
 610                 return;
 611         case RPCNFSUSERD_GETUID:
 612                 if (!svc_getargs(transp, (xdrproc_t)xdr_getid,
 613                     (caddr_t)&info)) {
 614                         svcerr_decode(transp);
 615                         return;
 616                 }
 617                 pwd = getpwuid((uid_t)info.id);
 618                 info.retval = 0;
 619                 if (pwd != NULL) {
 620                         nid.nid_usertimeout = defusertimeout;
 621                         nid.nid_uid = pwd->pw_uid;
 622                         nid.nid_name = pwd->pw_name;
 623                         if (manage_gids != 0) {
 624                                 /* Get the group list for this user. */
 625                                 ngroup = NGROUPS;
 626                                 if (getgrouplist(pwd->pw_name, pwd->pw_gid,
 627                                     grps, &ngroup) < 0)
 628                                         syslog(LOG_ERR, "Group list too small");
 629                                 nid.nid_ngroup = ngroup;
 630                                 nid.nid_grps = grps;
 631                         } else {
 632                                 nid.nid_ngroup = 0;
 633                                 nid.nid_grps = NULL;
 634                         }
 635                 } else {
 636                         nid.nid_usertimeout = 5;
 637                         nid.nid_uid = (uid_t)info.id;
 638                         nid.nid_name = defaultuser;
 639                         nid.nid_ngroup = 0;
 640                         nid.nid_grps = NULL;
 641                 }
 642                 nid.nid_namelen = strlen(nid.nid_name);
 643                 nid.nid_flag = NFSID_ADDUID;
 644                 error = nfssvc(NFSSVC_IDNAME | NFSSVC_NEWSTRUCT, &nid);
 645                 if (error) {
 646                         info.retval = error;
 647                         syslog(LOG_ERR, "Can't add user %s\n", pwd->pw_name);
 648                 } else if (verbose) {
 649                         syslog(LOG_ERR,"Added uid=%d name=%s\n",
 650                             nid.nid_uid, nid.nid_name);
 651                 }
 652                 if (!svc_sendreply(transp, (xdrproc_t)xdr_retval,
 653                     (caddr_t)&info))
 654                         syslog(LOG_ERR, "Can't send reply");
 655                 return;
 656         case RPCNFSUSERD_GETGID:
 657                 if (!svc_getargs(transp, (xdrproc_t)xdr_getid,
 658                     (caddr_t)&info)) {
 659                         svcerr_decode(transp);
 660                         return;
 661                 }
 662                 grp = getgrgid((gid_t)info.id);
 663                 info.retval = 0;
 664                 if (grp != NULL) {
 665                         nid.nid_usertimeout = defusertimeout;
 666                         nid.nid_gid = grp->gr_gid;
 667                         nid.nid_name = grp->gr_name;
 668                 } else {
 669                         nid.nid_usertimeout = 5;
 670                         nid.nid_gid = (gid_t)info.id;
 671                         nid.nid_name = defaultgroup;
 672                 }
 673                 nid.nid_namelen = strlen(nid.nid_name);
 674                 nid.nid_ngroup = 0;
 675                 nid.nid_grps = NULL;
 676                 nid.nid_flag = NFSID_ADDGID;
 677                 error = nfssvc(NFSSVC_IDNAME | NFSSVC_NEWSTRUCT, &nid);
 678                 if (error) {
 679                         info.retval = error;
 680                         syslog(LOG_ERR, "Can't add group %s\n",
 681                             grp->gr_name);
 682                 } else if (verbose) {
 683                         syslog(LOG_ERR,"Added gid=%d name=%s\n",
 684                             nid.nid_gid, nid.nid_name);
 685                 }
 686                 if (!svc_sendreply(transp, (xdrproc_t)xdr_retval,
 687                     (caddr_t)&info))
 688                         syslog(LOG_ERR, "Can't send reply");
 689                 return;
 690         case RPCNFSUSERD_GETUSER:
 691                 if (!svc_getargs(transp, (xdrproc_t)xdr_getname,
 692                     (caddr_t)&info)) {
 693                         svcerr_decode(transp);
 694                         return;
 695                 }
 696                 pwd = getpwnam(info.name);
 697                 info.retval = 0;
 698                 if (pwd != NULL) {
 699                         nid.nid_usertimeout = defusertimeout;
 700                         nid.nid_uid = pwd->pw_uid;
 701                         nid.nid_name = pwd->pw_name;
 702                 } else {
 703                         nid.nid_usertimeout = 5;
 704                         nid.nid_uid = defaultuid;
 705                         nid.nid_name = info.name;
 706                 }
 707                 nid.nid_namelen = strlen(nid.nid_name);
 708                 nid.nid_ngroup = 0;
 709                 nid.nid_grps = NULL;
 710                 nid.nid_flag = NFSID_ADDUSERNAME;
 711                 error = nfssvc(NFSSVC_IDNAME | NFSSVC_NEWSTRUCT, &nid);
 712                 if (error) {
 713                         info.retval = error;
 714                         syslog(LOG_ERR, "Can't add user %s\n", pwd->pw_name);
 715                 } else if (verbose) {
 716                         syslog(LOG_ERR,"Added uid=%d name=%s\n",
 717                             nid.nid_uid, nid.nid_name);
 718                 }
 719                 if (!svc_sendreply(transp, (xdrproc_t)xdr_retval,
 720                     (caddr_t)&info))
 721                         syslog(LOG_ERR, "Can't send reply");
 722                 return;
 723         case RPCNFSUSERD_GETGROUP:
 724                 if (!svc_getargs(transp, (xdrproc_t)xdr_getname,
 725                     (caddr_t)&info)) {
 726                         svcerr_decode(transp);
 727                         return;
 728                 }
 729                 grp = getgrnam(info.name);
 730                 info.retval = 0;
 731                 if (grp != NULL) {
 732                         nid.nid_usertimeout = defusertimeout;
 733                         nid.nid_gid = grp->gr_gid;
 734                         nid.nid_name = grp->gr_name;
 735                 } else {
 736                         nid.nid_usertimeout = 5;
 737                         nid.nid_gid = defaultgid;
 738                         nid.nid_name = info.name;
 739                 }
 740                 nid.nid_namelen = strlen(nid.nid_name);
 741                 nid.nid_ngroup = 0;
 742                 nid.nid_grps = NULL;
 743                 nid.nid_flag = NFSID_ADDGROUPNAME;
 744                 error = nfssvc(NFSSVC_IDNAME | NFSSVC_NEWSTRUCT, &nid);
 745                 if (error) {
 746                         info.retval = error;
 747                         syslog(LOG_ERR, "Can't add group %s\n",
 748                             grp->gr_name);
 749                 } else if (verbose) {
 750                         syslog(LOG_ERR,"Added gid=%d name=%s\n",
 751                             nid.nid_gid, nid.nid_name);
 752                 }
 753                 if (!svc_sendreply(transp, (xdrproc_t)xdr_retval,
 754                     (caddr_t)&info))
 755                         syslog(LOG_ERR, "Can't send reply");
 756                 return;
 757         default:
 758                 svcerr_noproc(transp);
 759                 return;
 760         };
 761 }
 762
 763 /*
 764  * Xdr routine to get an id number
 765  */
 766 static bool_t
 767 xdr_getid(XDR *xdrsp, caddr_t cp)
 768 {
 769         struct info *ifp = (struct info *)cp;
 770
 771         return (xdr_long(xdrsp, &ifp->id));
 772 }
 773
 774 /*
 775  * Xdr routine to get a user name
 776  */
 777 static bool_t
 778 xdr_getname(XDR *xdrsp, caddr_t cp)
 779 {
 780         struct info *ifp = (struct info *)cp;
 781         long len;
 782
 783         if (!xdr_long(xdrsp, &len))
 784                 return (0);
 785         if (len > MAXNAME)
 786                 return (0);
 787         if (!xdr_opaque(xdrsp, ifp->name, len))
 788                 return (0);
 789         ifp->name[len] = '\0';
 790         return (1);
 791 }
 792
 793 /*
 794  * Xdr routine to return the value.
 795  */
 796 static bool_t
 797 xdr_retval(XDR *xdrsp, caddr_t cp)
 798 {
 799         struct info *ifp = (struct info *)cp;
 800         long val;
 801
 802         val = ifp->retval;
 803         return (xdr_long(xdrsp, &val));
 804 }
 805
 806 /*
 807  * cleanup_term() called via SIGUSR1.
 808  */
 809 static void
 810 cleanup_term(int signo __unused)
 811 {
 812         int i, cnt;
 813
 814         if (im_a_server)
 815                 exit(0);
 816
 817         /*
 818          * Ok, so I'm the master.
 819          * As the Governor of California might say, "Terminate them".
 820          */
 821         cnt = 0;
 822         for (i = 0; i < nfsuserdcnt; i++) {
 823                 if (servers[i] != (pid_t)-1) {
 824                         cnt++;
 825                         kill(servers[i], SIGUSR1);
 826                 }
 827         }
 828
 829         /*
 830          * and wait for them to die
 831          */
 832         for (i = 0; i < cnt; i++)
 833                 wait3(NULL, 0, NULL);
 834
 835         /*
 836          * Finally, get rid of the socket
 837          */
 838         if (nfssvc(NFSSVC_NFSUSERDDELPORT, NULL) < 0) {
 839                 syslog(LOG_ERR, "Can't do nfssvc() to delete the port\n");
 840                 exit(1);
 841         }
 842         exit(0);
 843 }
 844
 845 /*
 846  * Get the IP address that the localhost address maps to.
 847  * This is needed when jails map localhost to another IP address.
 848  */
 849 static int
 850 nfsbind_localhost(void)
 851 {
 852 #ifdef INET
 853         struct sockaddr_in sin;
 854 #endif
 855 #ifdef INET6
 856         struct sockaddr_in6 sin6;
 857 #endif
 858         socklen_t slen;
 859         int ret, s;
 860
 861         switch (fromip.ss_family) {
 862 #ifdef INET6
 863         case AF_INET6:
 864                 s = socket(PF_INET6, SOCK_DGRAM, 0);
 865                 if (s < 0)
 866                         return (0);
 867                 memset(&sin6, 0, sizeof(sin6));
 868                 sin6.sin6_len = sizeof(sin6);
 869                 sin6.sin6_family = AF_INET6;
 870                 sin6.sin6_addr = in6loopback;
 871                 sin6.sin6_port = 0;
 872                 ret = bind(s, (struct sockaddr *)&sin6, sizeof(sin6));
 873                 if (ret < 0) {
 874                         close(s);
 875                         return (0);
 876                 }
 877                 break;
 878 #endif  /* INET6 */
 879 #ifdef INET
 880         case AF_INET:
 881                 s = socket(PF_INET, SOCK_DGRAM, 0);
 882                 if (s < 0)
 883                         return (0);
 884                 memset(&sin, 0, sizeof(sin));
 885                 sin.sin_len = sizeof(sin);
 886                 sin.sin_family = AF_INET;
 887                 sin.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
 888                 sin.sin_port = 0;
 889                 ret = bind(s, (struct sockaddr *)&sin, sizeof(sin));
 890                 if (ret < 0) {
 891                         close(s);
 892                         return (0);
 893                 }
 894                 break;
 895 #endif  /* INET */
 896         }
 897         memset(&fromip, 0, sizeof(fromip));
 898         slen = sizeof(fromip);
 899         ret = getsockname(s, (struct sockaddr *)&fromip, &slen);
 900         close(s);
 901         if (ret < 0)
 902                 return (0);
 903         return (1);
 904 }
 905
 906 static void
 907 usage(void)
 908 {
 909
 910         errx(1,
 911             "usage: nfsuserd [-usermax cache_size] [-usertimeout minutes] [-verbose] [-manage-gids] [-domain domain_name] [n]");
 912 }