identd.tproj/parse.c

   1 /*
   2  * Copyright (c) 1999 Apple Computer, Inc. All rights reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * "Portions Copyright (c) 1999 Apple Computer, Inc.  All Rights
   7  * Reserved.  This file contains Original Code and/or Modifications of
   8  * Original Code as defined in and that are subject to the Apple Public
   9  * Source License Version 1.0 (the 'License').  You may not use this file
  10  * except in compliance with the License.  Please obtain a copy of the
  11  * License at http://www.apple.com/publicsource and read it before using
  12  * this file.
  13  *
  14  * The Original Code and all software distributed under the License are
  15  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  16  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  17  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT.  Please see the
  19  * License for the specific language governing rights and limitations
  20  * under the License."
  21  *
  22  * @APPLE_LICENSE_HEADER_END@
  23  */
  24 /*
  25 **      $Id: parse.c,v 1.2 2000/10/03 02:38:32 lindak Exp $
  26 **
  27 ** parse.c                         This file contains the protocol parser
  28 **
  29 ** This program is in the public domain and may be used freely by anyone
  30 ** who wants to.
  31 **
  32 ** Last update: 6 Dec 1992
  33 **
  34 ** Please send bug fixes/bug reports to: Peter Eriksson <pen@lysator.liu.se>
  35 */
  36
  37 #include <stdio.h>
  38 #include <errno.h>
  39 #include <ctype.h>
  40 #include <pwd.h>
  41
  42 #include <sys/types.h>
  43 #include <netinet/in.h>
  44
  45 #ifndef HPUX7
  46 #  include <arpa/inet.h>
  47 #endif
  48
  49 #include <nlist.h>
  50 #include <kvm.h>
  51
  52 #include <sys/types.h>
  53 #include <sys/stat.h>
  54
  55 #if defined(MIPS) || defined(BSD43)
  56 extern int errno;
  57 #endif
  58
  59 #include "identd.h"
  60 #include "error.h"
  61
  62 extern void *malloc();
  63
  64 /*
  65 ** This function will eat whitespace characters until
  66 ** either a non-whitespace character is read, or EOF
  67 ** occurs. This function is only used if the "-m" option
  68 ** is enabled.
  69 */
  70 static int eat_whitespace()
  71 {
  72   int c;
  73
  74
  75   while ((c = getchar()) != EOF &&
  76          !(c == '\r' || c == '\n'))
  77     ;
  78
  79   if (c != EOF)
  80     while ((c = getchar()) != EOF &&
  81            (c == ' ' || c == '\t' || c == '\n' || c == '\r'))
  82       ;
  83
  84   if (c != EOF)
  85     ungetc(c, stdin);
  86
  87   return (c != EOF);
  88 }
  89
  90
  91 #ifdef INCLUDE_EXTENSIONS
  92 /*
  93 ** Validate an indirect request
  94 */
  95 static int valid_fhost(faddr, password)
  96   struct in_addr *faddr;
  97   char *password;
  98 {
  99   if (indirect_host == NULL)
 100     return 0;
 101
 102   if (strcmp(indirect_host, "*") != 0)
 103   {
 104     if (isdigit(indirect_host[0]))
 105     {
 106       if (strcmp(inet_ntoa(*faddr), indirect_host))
 107       {
 108         syslog(LOG_NOTICE, "valid_fhost: access denied for: %s",
 109                gethost(faddr));
 110         return 0;
 111       }
 112     }
 113     else
 114     {
 115       if (strcmp(gethost(faddr), indirect_host))
 116       {
 117         syslog(LOG_NOTICE, "valid_fhost: access denied for: %s",
 118                gethost(faddr));
 119         return 0;
 120       }
 121     }
 122   }
 123
 124   if (indirect_password == NULL)
 125     return 1;
 126
 127   if (strcmp(password, indirect_password))
 128   {
 129     syslog(LOG_NOTICE, "valid_fhost: invalid password from: %s",
 130            gethost(faddr));
 131     return 0;
 132   }
 133
 134   return 1;
 135 }
 136 #endif
 137
 138 /*
 139 ** A small routine to check for the existance of the ".noident"
 140 ** file in a users home directory.
 141 */
 142 static int check_noident(homedir)
 143   char *homedir;
 144 {
 145   char *tmp_path;
 146   struct stat sbuf;
 147   int rcode;
 148
 149
 150   if (!homedir)
 151     return 0;
 152
 153   tmp_path = (char *) malloc(strlen(homedir) + sizeof("/.noident") + 1);
 154   if (!tmp_path)
 155     return 0;
 156
 157   strcpy(tmp_path, homedir);
 158   strcat(tmp_path, "/.noident");
 159
 160   rcode = stat(tmp_path, &sbuf);
 161   free(tmp_path);
 162
 163   return (rcode == 0);
 164 }
 165
 166
 167 int parse(fp, laddr, faddr)
 168   FILE *fp;
 169   struct in_addr *laddr, *faddr;
 170 {
 171   int uid, try, rcode;
 172   struct passwd *pwp;
 173   char lhostaddr[16];
 174   char fhostaddr[16];
 175   char password[33];
 176 #ifdef INCLUDE_EXTENSIONS
 177   char arg[33];
 178   int c;
 179 #endif
 180   struct in_addr laddr2;
 181   struct in_addr faddr2;
 182
 183
 184   if (debug_flag && syslog_flag)
 185     syslog(LOG_DEBUG, "In function parse()");
 186
 187   /*
 188   ** Get the local/foreign port pair from the luser
 189   */
 190   do
 191   {
 192     if (debug_flag && syslog_flag)
 193       syslog(LOG_DEBUG, "  Before fscanf()");
 194
 195     faddr2 = *faddr;
 196     laddr2 = *laddr;
 197     lport = fport = 0;
 198     lhostaddr[0] = fhostaddr[0] = password[0] = '\0';
 199
 200     /* Read query from client */
 201     rcode = fscanf(fp, " %d , %d", &lport, &fport);
 202
 203 #ifdef INCLUDE_EXTENSIONS
 204     /*
 205     ** Do additional parsing in case of extended request
 206     */
 207     if (rcode == 0)
 208     {
 209       rcode = fscanf(fp, "%32[^ \t\n\r:]", arg);
 210
 211       /* Skip leading space up to EOF, EOL or non-space char */
 212       while ((c = getc(fp)) == ' ' || c == '\t')
 213         ;
 214
 215       if (rcode <= 0)
 216       {
 217         printf("%d , %d : ERROR : %s\r\n",
 218                lport, fport,
 219                unknown_flag ? "UNKNOWN-ERROR" : "X-INVALID-REQUEST");
 220         continue;
 221       }
 222
 223       /*
 224       ** Non-standard extended request, returns with Pidentd
 225       ** version information
 226       */
 227       if (strcmp(arg, "VERSION") == 0)
 228       {
 229         printf("%d , %d : ERROR : X-VERSION : %s\r\n", lport, fport,
 230                version);
 231         continue;
 232       }
 233
 234       /*
 235       ** Non-standard extended proxy request
 236       */
 237       else if (strcmp(arg, "PROXY") == 0 && c == ':')
 238       {
 239         /* We have a colon char, check for port numbers */
 240         rcode = fscanf(fp, " %d , %d : %15[0-9.] , %15[0-9.]",
 241                        &lport, &fport, fhostaddr, lhostaddr);
 242
 243         if (!(rcode == 3 || rcode == 4))
 244         {
 245           printf("%d , %d : ERROR : %s\r\n",
 246                  lport, fport,
 247                  unknown_flag ? "UNKNOWN-ERROR" : "X-INVALID-REQUEST");
 248           continue;
 249         }
 250
 251         if (rcode == 4)
 252           laddr2.s_addr = inet_addr(lhostaddr);
 253
 254         faddr2.s_addr = inet_addr(fhostaddr);
 255
 256         proxy(&laddr2, &faddr2, lport, fport, NULL);
 257         continue;
 258       }
 259
 260       /*
 261       ** Non-standard extended remote indirect request
 262       */
 263       else if (strcmp(arg, "REMOTE") == 0 && c == ':')
 264       {
 265         /* We have a colon char, check for port numbers */
 266         rcode = fscanf(fp, " %d , %d", &lport, &fport);
 267
 268         /* Skip leading space up to EOF, EOL or non-space char */
 269         while ((c = getc(fp)) == ' ' || c == '\t')
 270           ;
 271
 272         if (rcode != 2 || c != ':')
 273         {
 274           printf("%d , %d : ERROR : %s\r\n",
 275                  lport, fport,
 276                  unknown_flag ? "UNKNOWN-ERROR" : "X-INVALID-REQUEST");
 277           continue;
 278         }
 279
 280         /* We have a colon char, check for addr and password */
 281         rcode = fscanf(fp, " %15[0-9.] , %32[^ \t\r\n]",
 282                        fhostaddr, password);
 283         if (rcode > 0)
 284           rcode += 2;
 285         else
 286         {
 287           printf("%d , %d : ERROR : %s\r\n",
 288                  lport, fport,
 289                  unknown_flag ? "UNKNOWN-ERROR" : "X-INVALID-REQUEST");
 290           continue;
 291         }
 292
 293         /*
 294         ** Verify that the host originating the indirect request
 295         ** is allowed to do that
 296         */
 297         if (!valid_fhost(faddr, password))
 298         {
 299           printf("%d , %d : ERROR : %s\r\n",
 300                  lport, fport,
 301                  unknown_flag ? "UNKNOWN-ERROR" : "X-ACCESS-DENIED");
 302           continue;
 303         }
 304
 305         faddr2.s_addr = inet_addr(fhostaddr);
 306       }
 307
 308       else
 309       {
 310         printf("%d , %d : ERROR : %s\r\n",
 311                lport, fport,
 312                unknown_flag ? "UNKNOWN-ERROR" : "X-INVALID-REQUEST");
 313         continue;
 314       }
 315     }
 316 #endif /* EXTENSIONS */
 317
 318     if (rcode < 2 || lport < 1 || lport > 65535 || fport < 1 || fport > 65535)
 319     {
 320       if (syslog_flag && rcode > 0)
 321         syslog(LOG_NOTICE, "scanf: invalid-port(s): %d , %d from %s",
 322                lport, fport, gethost(faddr));
 323
 324       printf("%d , %d : ERROR : %s\r\n",
 325              lport, fport,
 326              unknown_flag ? "UNKNOWN-ERROR" : "INVALID-PORT");
 327       continue;
 328     }
 329
 330     if (syslog_flag && verbose_flag)
 331         syslog(LOG_NOTICE, "request for (%d,%d) from %s",
 332                lport, fport, gethost(faddr));
 333
 334     if (debug_flag && syslog_flag)
 335       syslog(LOG_DEBUG, "  After fscanf(), before k_getuid()");
 336
 337     /*
 338     ** Next - get the specific TCP connection and return the
 339     ** uid - user number.
 340     **
 341     ** Try to fetch the information 5 times incase the
 342     ** kernel changed beneath us and we missed or took
 343     ** a fault.
 344     */
 345     for (try = 0;
 346          (try < 5 &&
 347            k_getuid(&faddr2, htons(fport), laddr, htons(lport), &uid) == -1);
 348          try++)
 349       ;
 350
 351     if (try >= 5)
 352     {
 353       if (syslog_flag)
 354         syslog(LOG_DEBUG, "Returned: %d , %d : NO-USER", lport, fport);
 355
 356       printf("%d , %d : ERROR : %s\r\n",
 357              lport, fport,
 358              unknown_flag ? "UNKNOWN-ERROR" : "NO-USER");
 359       continue;
 360     }
 361
 362     if (try > 0 && syslog_flag)
 363       syslog(LOG_NOTICE, "k_getuid retries: %d", try);
 364
 365     if (debug_flag && syslog_flag)
 366       syslog(LOG_DEBUG, "  After k_getuid(), before getpwuid()");
 367
 368     /*
 369     ** Then we should try to get the username. If that fails we
 370     ** return it as an OTHER identifier
 371     */
 372     pwp = getpwuid(uid);
 373
 374     if (!pwp)
 375     {
 376       if (syslog_flag)
 377         syslog(LOG_WARNING, "getpwuid() could not map uid (%d) to name",
 378                uid);
 379
 380       printf("%d , %d : USERID : OTHER%s%s : %d\r\n",
 381              lport, fport,
 382              charset_name ? " , " : "",
 383              charset_name ? charset_name : "",
 384              uid);
 385       continue;
 386     }
 387
 388     /*
 389     ** Hey! We finally made it!!!
 390     */
 391     if (syslog_flag)
 392       syslog(LOG_DEBUG, "Successful lookup: %d , %d : %s",
 393              lport, fport, pwp->pw_name);
 394
 395     if (noident_flag && check_noident(pwp->pw_dir))
 396     {
 397       if (syslog_flag && verbose_flag)
 398         syslog(LOG_NOTICE, "user %s requested HIDDEN-USER for host %s: %d, %d",
 399                pwp->pw_name,
 400                gethost(faddr),
 401                lport, fport);
 402
 403       printf("%d , %d : ERROR : HIDDEN-USER\r\n",
 404            lport, fport);
 405       continue;
 406     }
 407
 408     if (number_flag)
 409       printf("%d , %d : USERID : OTHER%s%s : %d\r\n",
 410              lport, fport,
 411              charset_name ? " , " : "",
 412              charset_name ? charset_name : "",
 413              uid);
 414     else
 415       printf("%d , %d : USERID : %s%s%s : %s\r\n",
 416              lport, fport,
 417              other_flag ? "OTHER" : "UNIX",
 418              charset_name ? " , " : "",
 419              charset_name ? charset_name : "",
 420              pwp->pw_name);
 421
 422   } while(fflush(stdout), fflush(stderr), multi_flag && eat_whitespace());
 423
 424   return 0;
 425 }