OpenSolaris Launch

1 files changed, 288 insertions, 0 deletions

diff --git a/usr/src/lib/libwrap/socket.c b/usr/src/lib/libwrap/socket.c
new file mode 100644
index 0000000000..0d914f9ead
--- /dev/null
+++ b/usr/src/lib/libwrap/socket.c
@@ -0,0 +1,288 @@
+/*
+ * Copyright 2004 Sun Microsystems, Inc.  All rights reserved.
+ * Use is subject to license terms.
+ */
+
+#pragma ident	"%Z%%M%	%I%	%E% SMI"
+
+ /*
+  * This module determines the type of socket (datagram, stream), the client
+  * socket address and port, the server socket address and port. In addition,
+  * it provides methods to map a transport address to a printable host name
+  * or address. Socket address information results are in static memory.
+  * 
+  * The result from the hostname lookup method is STRING_PARANOID when a host
+  * pretends to have someone elses name, or when a host name is available but
+  * could not be verified.
+  * 
+  * When lookup or conversion fails the result is set to STRING_UNKNOWN.
+  * 
+  * Diagnostics are reported through syslog(3).
+  * 
+  * Author: Wietse Venema, Eindhoven University of Technology, The Netherlands.
+  */
+
+#ifndef lint
+static char sccsid[] = "@(#) socket.c 1.15 97/03/21 19:27:24";
+#endif
+
+/* System libraries. */
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <netdb.h>
+#include <stdio.h>
+#include <syslog.h>
+#include <string.h>
+
+extern char *inet_ntoa();
+
+/* Local stuff. */
+
+#include "tcpd.h"
+
+/* Forward declarations. */
+
+static void sock_sink();
+
+#ifdef APPEND_DOT
+
+ /*
+  * Speed up DNS lookups by terminating the host name with a dot. Should be
+  * done with care. The speedup can give problems with lookups from sources
+  * that lack DNS-style trailing dot magic, such as local files or NIS maps.
+  */
+
+static struct hostent *tcpd_gethostbyname_dot(name, af)
+char   *name;
+int af;
+{
+    char    dot_name[MAXHOSTNAMELEN + 1];
+
+    /*
+     * Don't append dots to unqualified names. Such names are likely to come
+     * from local hosts files or from NIS.
+     */
+
+    if (strchr(name, '.') == 0 || strlen(name) >= MAXHOSTNAMELEN - 1) {
+	return (tcpd_gethostbyname(name, af));
+    } else {
+	sprintf(dot_name, "%s.", name);
+	return (tcpd_gethostbyname(dot_name, af));
+    }
+}
+
+#define tcpd_gethostbyname tcpd_gethostbyname_dot
+#endif
+
+/* sock_host - look up endpoint addresses and install conversion methods */
+
+void    sock_host(request)
+struct request_info *request;
+{
+    static struct sockaddr_gen client;
+    static struct sockaddr_gen server;
+    int     len;
+    char    buf[BUFSIZ];
+    int     fd = request->fd;
+
+    sock_methods(request);
+
+    /*
+     * Look up the client host address. Hal R. Brand <BRAND@addvax.llnl.gov>
+     * suggested how to get the client host info in case of UDP connections:
+     * peek at the first message without actually looking at its contents. We
+     * really should verify that client.sin_family gets the value AF_INET,
+     * but this program has already caused too much grief on systems with
+     * broken library code.
+     */
+
+    len = sizeof(client);
+    if (getpeername(fd, (struct sockaddr *) & client, &len) < 0) {
+	request->sink = sock_sink;
+	len = sizeof(client);
+	if (recvfrom(fd, buf, sizeof(buf), MSG_PEEK,
+		     (struct sockaddr *) & client, &len) < 0) {
+	    tcpd_warn("can't get client address: %m");
+	    return;				/* give up */
+	}
+#ifdef really_paranoid
+	memset(buf, 0 sizeof(buf));
+#endif
+    }
+    sockgen_simplify(&client);
+    request->client->sin = &client;
+
+    /*
+     * Determine the server binding. This is used for client username
+     * lookups, and for access control rules that trigger on the server
+     * address or name.
+     */
+
+    len = sizeof(server);
+    if (getsockname(fd, (struct sockaddr *) & server, &len) < 0) {
+	tcpd_warn("getsockname: %m");
+	return;
+    }
+    sockgen_simplify(&server);
+    request->server->sin = &server;
+}
+
+/* sock_hostaddr - map endpoint address to printable form */
+
+void    sock_hostaddr(host)
+struct host_info *host;
+{
+    struct sockaddr_gen *sin = host->sin;
+
+    if (sin != 0)
+#ifdef HAVE_IPV6
+	
+	(void) inet_ntop(SGFAM(sin), SGADDRP(sin), host->addr, sizeof(host->addr));
+#else
+	STRN_CPY(host->addr, inet_ntoa(sin->sg_sin.sin_addr), sizeof(host->addr));
+#endif
+}
+
+/* sock_hostname - map endpoint address to host name */
+
+void    sock_hostname(host)
+struct host_info *host;
+{
+    struct sockaddr_gen *sin = host->sin;
+    struct hostent *hp;
+    int     i;
+    int     herr;
+
+    /*
+     * On some systems, for example Solaris 2.3, gethostbyaddr(0.0.0.0) does
+     * not fail. Instead it returns "INADDR_ANY". Unfortunately, this does
+     * not work the other way around: gethostbyname("INADDR_ANY") fails. We
+     * have to special-case 0.0.0.0, in order to avoid false alerts from the
+     * host name/address checking code below.
+     */
+    if (sin != 0
+	&& !SG_IS_UNSPECIFIED(sin)
+	&& (hp = gethostbyaddr(SGADDRP(sin), SGADDRSZ(sin), SGFAM(sin))) != 0) {
+
+	STRN_CPY(host->name, hp->h_name, sizeof(host->name));
+
+	/*
+	 * Verify that the address is a member of the address list returned
+	 * by gethostbyname(hostname).
+	 * 
+	 * Verify also that gethostbyaddr() and gethostbyname() return the same
+	 * hostname, or rshd and rlogind may still end up being spoofed.
+	 * 
+	 * On some sites, gethostbyname("localhost") returns "localhost.domain".
+	 * This is a DNS artefact. We treat it as a special case. When we
+	 * can't believe the address list from gethostbyname("localhost")
+	 * we're in big trouble anyway.
+	 */
+
+	if ((hp = tcpd_gethostbyname(host->name, SGFAM(sin))) == 0) {
+
+	    /*
+	     * Unable to verify that the host name matches the address. This
+	     * may be a transient problem or a botched name server setup.
+	     */
+
+	    tcpd_warn("can't verify hostname: gethostbyname(%s) failed",
+		      host->name);
+
+	} else if (STR_NE(host->name, hp->h_name)
+		   && STR_NE(host->name, "localhost")) {
+
+	    /*
+	     * The gethostbyaddr() and gethostbyname() calls did not return
+	     * the same hostname. This could be a nameserver configuration
+	     * problem. It could also be that someone is trying to spoof us.
+	     */
+
+	    tcpd_warn("host name/name mismatch: %s != %.*s",
+		      host->name, STRING_LENGTH, hp->h_name);
+
+	} else {
+#ifdef HAVE_IPV6
+	    char buf[INET6_ADDRSTRLEN];
+#endif
+
+	    /*
+	     * The address should be a member of the address list returned by
+	     * gethostbyname(). We should first verify that the h_addrtype
+	     * field is AF_INET, but this program has already caused too much
+	     * grief on systems with broken library code.
+	     */
+
+	    for (i = 0; hp->h_addr_list[i]; i++) {
+		if (memcmp(hp->h_addr_list[i],
+			   (char *) SGADDRP(sin),
+			   SGADDRSZ(sin)) == 0) {
+		    return;			/* name is good, keep it */
+		}
+	    }
+
+	    /*
+	     * The host name does not map to the initial address. Perhaps
+	     * someone has messed up. Perhaps someone compromised a name
+	     * server.
+	     */
+	    tcpd_warn("host name/address mismatch: %s != %.*s",
+#ifdef HAVE_IPV6
+		      inet_ntop(SGFAM(sin), SGADDRP(sin), buf, sizeof(buf)),
+#else
+		      inet_ntoa(sin->sg_sin.sin_addr),
+#endif
+		      STRING_LENGTH, hp->h_name);
+	}
+	strcpy(host->name, paranoid);		/* name is bad, clobber it */
+    }
+}
+
+/* sock_sink - absorb unreceived IP datagram */
+
+static void sock_sink(fd)
+int     fd;
+{
+    char    buf[BUFSIZ];
+    struct sockaddr_in sin;
+    int     size = sizeof(sin);
+
+    /*
+     * Eat up the not-yet received datagram. Some systems insist on a
+     * non-zero source address argument in the recvfrom() call below.
+     */
+
+    (void) recvfrom(fd, buf, sizeof(buf), 0, (struct sockaddr *) & sin, &size);
+}
+
+/*
+ * If we receive a V4 connection on a V6 socket, we pretend we really
+ * got a V4 connection.
+ */
+void sockgen_simplify(sg)
+sockaddr_gen *sg;
+{
+#ifdef HAVE_IPV6
+    if (sg->sg_family == AF_INET6 &&
+	IN6_IS_ADDR_V4MAPPED(&sg->sg_sin6.sin6_addr)) {
+	    struct sockaddr_in v4_addr;
+
+#ifdef IN6_V4MAPPED_TO_INADDR			/* Solaris 8 */
+	    IN6_V4MAPPED_TO_INADDR(&sg->sg_sin6.sin6_addr, &v4_addr.sin_addr);
+#elif defined(IN6_MAPPED_TO_V4) 		/* Solaris 8 Beta only? */
+	    IN6_MAPPED_TO_V4(&sg->sg_sin6.sin6_addr, &v4_addr.sin_addr);
+#else						/* Do it the hard way */
+	    memcpy(&v4_addr.sin_addr, ((char*) &sg->sg_sin6.sin6_addr) + 12, 4);
+#endif
+	    v4_addr.sin_port = sg->sg_sin6.sin6_port;
+	    v4_addr.sin_family = AF_INET;
+	    memcpy(&sg->sg_sin, &v4_addr, sizeof(v4_addr));
+    }
+#else
+    return;
+#endif /* HAVE_IPV6 */
+}