summaryrefslogtreecommitdiff
path: root/usr/src/cmd/tcpd/tcpdmatch.c.org
diff options
context:
space:
mode:
authorJohn Sonnenschein <johns@joyent.com>2011-10-03 21:04:40 +0000
committerJohn Sonnenschein <johns@joyent.com>2011-10-03 21:04:40 +0000
commit4171a80dc48c62297457d0820f26cac6516e068a (patch)
tree5e20c8b91e74482baeed81d9cda1af2f63207b82 /usr/src/cmd/tcpd/tcpdmatch.c.org
parentcb866ae1d95a57b3ac6bf38040e40ed0cd4fe835 (diff)
parented22c7109fc5dd9e1b7a5d0333bdc7ad2718e2ab (diff)
downloadillumos-joyent-4171a80dc48c62297457d0820f26cac6516e068a.tar.gz
[OS-663] Post-6.5 Illumos sync
Merge https://github.com/illumos/illumos-gate Conflicts: exception_lists/packaging usr/src/cmd/dtrace/test/cmd/scripts/dtest.pl usr/src/cmd/dtrace/test/tst/common/usdt/tst.badguess.ksh usr/src/cmd/dtrace/test/tst/common/usdt/tst.enabled2.ksh usr/src/cmd/dtrace/test/tst/common/usdt/tst.guess32.ksh usr/src/cmd/dtrace/test/tst/common/usdt/tst.guess64.ksh usr/src/cmd/dtrace/test/tst/common/usdt/tst.include.ksh usr/src/cmd/dtrace/test/tst/common/usdt/tst.nodtrace.ksh usr/src/cmd/dtrace/test/tst/common/usdt/tst.noreap.ksh usr/src/cmd/dtrace/test/tst/common/usdt/tst.noreapring.ksh usr/src/cmd/dtrace/test/tst/common/usdt/tst.reap.ksh usr/src/cmd/lp/Makefile usr/src/cmd/lp/cmd/lpadmin/options.c usr/src/cmd/lp/cmd/lpfilter.c usr/src/cmd/lp/cmd/lpforms.c usr/src/cmd/lp/cmd/lpusers.c usr/src/cmd/lp/lib/lp/isterminfo.c usr/src/cmd/lp/lib/lp/tidbit.c usr/src/cmd/terminfo/att.ti usr/src/cmd/zpool/zpool_main.c usr/src/common/dis/i386/dis_tables.c usr/src/lib/libdtrace/common/dt_options.c usr/src/lib/libzfs/common/libzfs_dataset.c usr/src/man/man1m/dladm.1m usr/src/man/man1m/flowadm.1m usr/src/man/man1m/zoneadm.1m usr/src/man/man1m/zonecfg.1m usr/src/pkg/manifests/print-lp-print-client-commands.mf usr/src/pkg/manifests/print-lp.mf usr/src/uts/common/fs/zfs/sys/zio.h usr/src/uts/common/fs/zfs/zio.c usr/src/uts/i86pc/ml/mach_offsets.in usr/src/uts/intel/amd64/ml/mach_offsets.in usr/src/uts/intel/sys/tss.h
Diffstat (limited to 'usr/src/cmd/tcpd/tcpdmatch.c.org')
-rw-r--r--usr/src/cmd/tcpd/tcpdmatch.c.org328
1 files changed, 0 insertions, 328 deletions
diff --git a/usr/src/cmd/tcpd/tcpdmatch.c.org b/usr/src/cmd/tcpd/tcpdmatch.c.org
deleted file mode 100644
index b1cf75f25c..0000000000
--- a/usr/src/cmd/tcpd/tcpdmatch.c.org
+++ /dev/null
@@ -1,328 +0,0 @@
- /*
- * tcpdmatch - explain what tcpd would do in a specific case
- *
- * usage: tcpdmatch [-d] [-i inet_conf] daemon[@host] [user@]host
- *
- * -d: use the access control tables in the current directory.
- *
- * -i: location of inetd.conf file.
- *
- * All errors are reported to the standard error stream, including the errors
- * that would normally be reported via the syslog daemon.
- *
- * Author: Wietse Venema, Eindhoven University of Technology, The Netherlands.
- */
-
-#ifndef lint
-static char sccsid[] = "@(#) tcpdmatch.c 1.5 96/02/11 17:01:36";
-#endif
-
-/* System libraries. */
-
-#include <sys/types.h>
-#include <sys/stat.h>
-#include <sys/socket.h>
-#include <netinet/in.h>
-#include <arpa/inet.h>
-#include <netdb.h>
-#include <stdio.h>
-#include <syslog.h>
-#include <setjmp.h>
-#include <string.h>
-
-extern void exit();
-extern int optind;
-extern char *optarg;
-
-#ifndef INADDR_NONE
-#define INADDR_NONE (-1) /* XXX should be 0xffffffff */
-#endif
-
-#ifndef S_ISDIR
-#define S_ISDIR(m) (((m) & S_IFMT) == S_IFDIR)
-#endif
-
-/* Application-specific. */
-
-#include "tcpd.h"
-#include "inetcf.h"
-#include "scaffold.h"
-
-static void usage();
-static void tcpdmatch();
-
-/* The main program */
-
-int main(argc, argv)
-int argc;
-char **argv;
-{
- struct hostent *hp;
- char *myname = argv[0];
- char *client;
- char *server;
- char *addr;
- char *user;
- char *daemon;
- struct request_info request;
- int ch;
- char *inetcf = 0;
- int count;
- struct sockaddr_in server_sin;
- struct sockaddr_in client_sin;
- struct stat st;
-
- /*
- * Show what rule actually matched.
- */
- hosts_access_verbose = 2;
-
- /*
- * Parse the JCL.
- */
- while ((ch = getopt(argc, argv, "di:")) != EOF) {
- switch (ch) {
- case 'd':
- hosts_allow_table = "hosts.allow";
- hosts_deny_table = "hosts.deny";
- break;
- case 'i':
- inetcf = optarg;
- break;
- default:
- usage(myname);
- /* NOTREACHED */
- }
- }
- if (argc != optind + 2)
- usage(myname);
-
- /*
- * When confusion really strikes...
- */
- if (check_path(REAL_DAEMON_DIR, &st) < 0) {
- tcpd_warn("REAL_DAEMON_DIR %s: %m", REAL_DAEMON_DIR);
- } else if (!S_ISDIR(st.st_mode)) {
- tcpd_warn("REAL_DAEMON_DIR %s is not a directory", REAL_DAEMON_DIR);
- }
-
- /*
- * Default is to specify a daemon process name. When daemon@host is
- * specified, separate the two parts.
- */
- if ((server = split_at(argv[optind], '@')) == 0)
- server = unknown;
- if (argv[optind][0] == '/') {
- daemon = strrchr(argv[optind], '/') + 1;
- tcpd_warn("%s: daemon name normalized to: %s", argv[optind], daemon);
- } else {
- daemon = argv[optind];
- }
-
- /*
- * Default is to specify a client hostname or address. When user@host is
- * specified, separate the two parts.
- */
- if ((client = split_at(argv[optind + 1], '@')) != 0) {
- user = argv[optind + 1];
- } else {
- client = argv[optind + 1];
- user = unknown;
- }
-
- /*
- * Analyze the inetd (or tlid) configuration file, so that we can warn
- * the user about services that may not be wrapped, services that are not
- * configured, or services that are wrapped in an incorrect manner. Allow
- * for services that are not run from inetd, or that have tcpd access
- * control built into them.
- */
- inetcf = inet_cfg(inetcf);
- inet_set("portmap", WR_NOT);
- inet_set("rpcbind", WR_NOT);
- switch (inet_get(daemon)) {
- case WR_UNKNOWN:
- tcpd_warn("%s: no such process name in %s", daemon, inetcf);
- break;
- case WR_NOT:
- tcpd_warn("%s: service possibly not wrapped", daemon);
- break;
- }
-
- /*
- * Check accessibility of access control files.
- */
- (void) check_path(hosts_allow_table, &st);
- (void) check_path(hosts_deny_table, &st);
-
- /*
- * Fill in what we have figured out sofar. Use socket and DNS routines
- * for address and name conversions. We attach stdout to the request so
- * that banner messages will become visible.
- */
- request_init(&request, RQ_DAEMON, daemon, RQ_USER, user, RQ_FILE, 1, 0);
- sock_methods(&request);
-
- /*
- * If a server hostname is specified, insist that the name maps to at
- * most one address. eval_hostname() warns the user about name server
- * problems, while using the request.server structure as a cache for host
- * address and name conversion results.
- */
- if (NOT_INADDR(server) == 0 || HOSTNAME_KNOWN(server)) {
- if ((hp = find_inet_addr(server)) == 0)
- exit(1);
- memset((char *) &server_sin, 0, sizeof(server_sin));
- server_sin.sin_family = AF_INET;
- request_set(&request, RQ_SERVER_SIN, &server_sin, 0);
-
- for (count = 0; (addr = hp->h_addr_list[count]) != 0; count++) {
- memcpy((char *) &server_sin.sin_addr, addr,
- sizeof(server_sin.sin_addr));
-
- /*
- * Force evaluation of server host name and address. Host name
- * conflicts will be reported while eval_hostname() does its job.
- */
- request_set(&request, RQ_SERVER_NAME, "", RQ_SERVER_ADDR, "", 0);
- if (STR_EQ(eval_hostname(request.server), unknown))
- tcpd_warn("host address %s->name lookup failed",
- eval_hostaddr(request.server));
- }
- if (count > 1) {
- fprintf(stderr, "Error: %s has more than one address\n", server);
- fprintf(stderr, "Please specify an address instead\n");
- exit(1);
- }
- free((char *) hp);
- } else {
- request_set(&request, RQ_SERVER_NAME, server, 0);
- }
-
- /*
- * If a client address is specified, we simulate the effect of client
- * hostname lookup failure.
- */
- if (dot_quad_addr(client) != INADDR_NONE) {
- request_set(&request, RQ_CLIENT_ADDR, client, 0);
- tcpdmatch(&request);
- exit(0);
- }
-
- /*
- * Perhaps they are testing special client hostname patterns that aren't
- * really host names at all.
- */
- if (NOT_INADDR(client) && HOSTNAME_KNOWN(client) == 0) {
- request_set(&request, RQ_CLIENT_NAME, client, 0);
- tcpdmatch(&request);
- exit(0);
- }
-
- /*
- * Otherwise, assume that a client hostname is specified, and insist that
- * the address can be looked up. The reason for this requirement is that
- * in real life the client address is available (at least with IP). Let
- * eval_hostname() figure out if this host is properly registered, while
- * using the request.client structure as a cache for host name and
- * address conversion results.
- */
- if ((hp = find_inet_addr(client)) == 0)
- exit(1);
- memset((char *) &client_sin, 0, sizeof(client_sin));
- client_sin.sin_family = AF_INET;
- request_set(&request, RQ_CLIENT_SIN, &client_sin, 0);
-
- for (count = 0; (addr = hp->h_addr_list[count]) != 0; count++) {
- memcpy((char *) &client_sin.sin_addr, addr,
- sizeof(client_sin.sin_addr));
-
- /*
- * Force evaluation of client host name and address. Host name
- * conflicts will be reported while eval_hostname() does its job.
- */
- request_set(&request, RQ_CLIENT_NAME, "", RQ_CLIENT_ADDR, "", 0);
- if (STR_EQ(eval_hostname(request.client), unknown))
- tcpd_warn("host address %s->name lookup failed",
- eval_hostaddr(request.client));
- tcpdmatch(&request);
- if (hp->h_addr_list[count + 1])
- printf("\n");
- }
- free((char *) hp);
- exit(0);
-}
-
-/* Explain how to use this program */
-
-static void usage(myname)
-char *myname;
-{
- fprintf(stderr, "usage: %s [-d] [-i inet_conf] daemon[@host] [user@]host\n",
- myname);
- fprintf(stderr, " -d: use allow/deny files in current directory\n");
- fprintf(stderr, " -i: location of inetd.conf file\n");
- exit(1);
-}
-
-/* Print interesting expansions */
-
-static void expand(text, pattern, request)
-char *text;
-char *pattern;
-struct request_info *request;
-{
- char buf[BUFSIZ];
-
- if (STR_NE(percent_x(buf, sizeof(buf), pattern, request), unknown))
- printf("%s %s\n", text, buf);
-}
-
-/* Try out a (server,client) pair */
-
-static void tcpdmatch(request)
-struct request_info *request;
-{
- int verdict;
-
- /*
- * Show what we really know. Suppress uninteresting noise.
- */
- expand("client: hostname", "%n", request);
- expand("client: address ", "%a", request);
- expand("client: username", "%u", request);
- expand("server: hostname", "%N", request);
- expand("server: address ", "%A", request);
- expand("server: process ", "%d", request);
-
- /*
- * Reset stuff that might be changed by options handlers. In dry-run
- * mode, extension language routines that would not return should inform
- * us of their plan, by clearing the dry_run flag. This is a bit clumsy
- * but we must be able to verify hosts with more than one network
- * address.
- */
- rfc931_timeout = RFC931_TIMEOUT;
- allow_severity = SEVERITY;
- deny_severity = LOG_WARNING;
- dry_run = 1;
-
- /*
- * When paranoid mode is enabled, access is rejected no matter what the
- * access control rules say.
- */
-#ifdef PARANOID
- if (STR_EQ(eval_hostname(request->client), paranoid)) {
- printf("access: denied (PARANOID mode)\n\n");
- return;
- }
-#endif
-
- /*
- * Report the access control verdict.
- */
- verdict = hosts_access(request);
- printf("access: %s\n",
- dry_run == 0 ? "delegated" :
- verdict ? "granted" : "denied");
-}