rlogind.tproj/rlogind.c

   1 /*
   2  * Copyright (c) 1999 Apple Computer, Inc. All rights reserved.
   3  *
   4  * @APPLE_LICENSE_HEADER_START@
   5  *
   6  * "Portions Copyright (c) 1999 Apple Computer, Inc.  All Rights
   7  * Reserved.  This file contains Original Code and/or Modifications of
   8  * Original Code as defined in and that are subject to the Apple Public
   9  * Source License Version 1.0 (the 'License').  You may not use this file
  10  * except in compliance with the License.  Please obtain a copy of the
  11  * License at http://www.apple.com/publicsource and read it before using
  12  * this file.
  13  *
  14  * The Original Code and all software distributed under the License are
  15  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  16  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  17  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT.  Please see the
  19  * License for the specific language governing rights and limitations
  20  * under the License."
  21  *
  22  * @APPLE_LICENSE_HEADER_END@
  23  */
  24 /*-
  25  * Copyright (c) 1983, 1988, 1989, 1993
  26  *      The Regents of the University of California.  All rights reserved.
  27  *
  28  * Redistribution and use in source and binary forms, with or without
  29  * modification, are permitted provided that the following conditions
  30  * are met:
  31  * 1. Redistributions of source code must retain the above copyright
  32  *    notice, this list of conditions and the following disclaimer.
  33  * 2. Redistributions in binary form must reproduce the above copyright
  34  *    notice, this list of conditions and the following disclaimer in the
  35  *    documentation and/or other materials provided with the distribution.
  36  * 3. All advertising materials mentioning features or use of this software
  37  *    must display the following acknowledgement:
  38  *      This product includes software developed by the University of
  39  *      California, Berkeley and its contributors.
  40  * 4. Neither the name of the University nor the names of its contributors
  41  *    may be used to endorse or promote products derived from this software
  42  *    without specific prior written permission.
  43  *
  44  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  45  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  46  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  47  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  48  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  49  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  50  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  51  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  52  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  53  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  54  * SUCH DAMAGE.
  55  */
  56
  57 #ifndef lint
  58 static char copyright[] =
  59 "@(#) Copyright (c) 1983, 1988, 1989, 1993\n\
  60         The Regents of the University of California.  All rights reserved.\n";
  61 #endif /* not lint */
  62
  63 #ifndef lint
  64 static char sccsid[] = "@(#)rlogind.c   8.2 (Berkeley) 4/28/95";
  65 #endif /* not lint */
  66
  67 /*
  68  * remote login server:
  69  *      \0
  70  *      remuser\0
  71  *      locuser\0
  72  *      terminal_type/speed\0
  73  *      data
  74  */
  75
  76 #define FD_SETSIZE      16              /* don't need many bits for select */
  77 #include <sys/param.h>
  78 #include <sys/stat.h>
  79 #include <sys/ioctl.h>
  80 #include <signal.h>
  81 #ifdef __APPLE__
  82 #include <sys/termios.h>
  83 #else
  84 #include <termios.h>
  85 #endif
  86
  87 #include <sys/socket.h>
  88 #include <netinet/in.h>
  89 #include <netinet/in_systm.h>
  90 #include <netinet/ip.h>
  91 #include <arpa/inet.h>
  92 #include <netdb.h>
  93
  94 #include <pwd.h>
  95 #include <syslog.h>
  96 #include <errno.h>
  97 #include <stdio.h>
  98 #include <unistd.h>
  99 #include <stdlib.h>
 100 #include <string.h>
 101 #include "pathnames.h"
 102
 103 #ifndef TIOCPKT_WINDOW
 104 #define TIOCPKT_WINDOW 0x80
 105 #endif
 106
 107 #ifdef  KERBEROS
 108 #include <kerberosIV/des.h>
 109 #include <kerberosIV/krb.h>
 110 #define SECURE_MESSAGE "This rlogin session is using DES encryption for all transmissions.\r\n"
 111
 112 AUTH_DAT        *kdata;
 113 KTEXT           ticket;
 114 u_char          auth_buf[sizeof(AUTH_DAT)];
 115 u_char          tick_buf[sizeof(KTEXT_ST)];
 116 Key_schedule    schedule;
 117 int             doencrypt, retval, use_kerberos, vacuous;
 118
 119 #define         ARGSTR                  "alnkvx"
 120 #else
 121 #define         ARGSTR                  "aln"
 122 #endif  /* KERBEROS */
 123
 124 char    *env[2];
 125 #define NMAX 30
 126 char    lusername[NMAX+1], rusername[NMAX+1];
 127 static  char term[64] = "TERM=";
 128 #define ENVSIZE (sizeof("TERM=")-1)     /* skip null for concatenation */
 129 int     keepalive = 1;
 130 int     check_all = 0;
 131
 132 struct  passwd *pwd;
 133
 134 void    doit __P((int, struct sockaddr_in *));
 135 int     control __P((int, char *, int));
 136 void    protocol __P((int, int));
 137 void    cleanup __P((int));
 138 void    fatal __P((int, char *, int));
 139 int     do_rlogin __P((struct sockaddr_in *));
 140 void    getstr __P((char *, int, char *));
 141 void    setup_term __P((int));
 142 int     do_krb_login __P((struct sockaddr_in *));
 143 void    usage __P((void));
 144 int     local_domain __P((char *));
 145 char    *topdomain __P((char *));
 146
 147 int
 148 main(argc, argv)
 149         int argc;
 150         char *argv[];
 151 {
 152         extern int __check_rhosts_file;
 153         struct sockaddr_in from;
 154         int ch, fromlen, on;
 155
 156         openlog("rlogind", LOG_PID | LOG_CONS, LOG_AUTH);
 157
 158         opterr = 0;
 159         while ((ch = getopt(argc, argv, ARGSTR)) != EOF)
 160                 switch (ch) {
 161                 case 'a':
 162                         check_all = 1;
 163                         break;
 164                 case 'l':
 165                         __check_rhosts_file = 0;
 166                         break;
 167                 case 'n':
 168                         keepalive = 0;
 169                         break;
 170 #ifdef KERBEROS
 171                 case 'k':
 172                         use_kerberos = 1;
 173                         break;
 174                 case 'v':
 175                         vacuous = 1;
 176                         break;
 177 #ifdef CRYPT
 178                 case 'x':
 179                         doencrypt = 1;
 180                         break;
 181 #endif
 182 #endif
 183                 case '?':
 184                 default:
 185                         usage();
 186                         break;
 187                 }
 188         argc -= optind;
 189         argv += optind;
 190
 191 #ifdef  KERBEROS
 192         if (use_kerberos && vacuous) {
 193                 usage();
 194                 fatal(STDERR_FILENO, "only one of -k and -v allowed", 0);
 195         }
 196 #endif
 197         fromlen = sizeof (from);
 198         if (getpeername(0, (struct sockaddr *)&from, &fromlen) < 0) {
 199                 syslog(LOG_ERR,"Can't get peer name of remote host: %m");
 200                 fatal(STDERR_FILENO, "Can't get peer name of remote host", 1);
 201         }
 202         on = 1;
 203         if (keepalive &&
 204             setsockopt(0, SOL_SOCKET, SO_KEEPALIVE, &on, sizeof (on)) < 0)
 205                 syslog(LOG_WARNING, "setsockopt (SO_KEEPALIVE): %m");
 206         on = IPTOS_LOWDELAY;
 207         if (setsockopt(0, IPPROTO_IP, IP_TOS, (char *)&on, sizeof(int)) < 0)
 208                 syslog(LOG_WARNING, "setsockopt (IP_TOS): %m");
 209         doit(0, &from);
 210 }
 211
 212 int     child;
 213 int     netf;
 214 char    line[MAXPATHLEN];
 215 int     confirmed;
 216
 217 struct winsize win = { 0, 0, 0, 0 };
 218
 219
 220 void
 221 doit(f, fromp)
 222         int f;
 223         struct sockaddr_in *fromp;
 224 {
 225         int master, pid, on = 1;
 226         int authenticated = 0;
 227         register struct hostent *hp;
 228         char hostname[2 * MAXHOSTNAMELEN + 1];
 229         char c;
 230
 231         alarm(60);
 232         read(f, &c, 1);
 233
 234         if (c != 0)
 235                 exit(1);
 236 #ifdef  KERBEROS
 237         if (vacuous)
 238                 fatal(f, "Remote host requires Kerberos authentication", 0);
 239 #endif
 240
 241         alarm(0);
 242         fromp->sin_port = ntohs((u_short)fromp->sin_port);
 243         hp = gethostbyaddr((char *)&fromp->sin_addr, sizeof(struct in_addr),
 244             fromp->sin_family);
 245         if (hp)
 246                 (void)strcpy(hostname, hp->h_name);
 247         else
 248                 (void)strcpy(hostname, inet_ntoa(fromp->sin_addr));
 249
 250 #ifdef  KERBEROS
 251         if (use_kerberos) {
 252                 retval = do_krb_login(fromp);
 253                 if (retval == 0)
 254                         authenticated++;
 255                 else if (retval > 0)
 256                         fatal(f, krb_err_txt[retval], 0);
 257                 write(f, &c, 1);
 258                 confirmed = 1;          /* we sent the null! */
 259         } else
 260 #endif
 261         {
 262                 if (fromp->sin_family != AF_INET ||
 263                     fromp->sin_port >= IPPORT_RESERVED ||
 264                     fromp->sin_port < IPPORT_RESERVED/2) {
 265                         syslog(LOG_NOTICE, "Connection from %s on illegal port",
 266                                 inet_ntoa(fromp->sin_addr));
 267                         fatal(f, "Permission denied", 0);
 268                 }
 269 #ifdef IP_OPTIONS
 270                 {
 271                 u_char optbuf[BUFSIZ/3], *cp;
 272                 char lbuf[BUFSIZ], *lp;
 273                 int optsize = sizeof(optbuf), ipproto;
 274                 struct protoent *ip;
 275
 276                 if ((ip = getprotobyname("ip")) != NULL)
 277                         ipproto = ip->p_proto;
 278                 else
 279                         ipproto = IPPROTO_IP;
 280                 if (getsockopt(0, ipproto, IP_OPTIONS, (char *)optbuf,
 281                     &optsize) == 0 && optsize != 0) {
 282                         lp = lbuf;
 283                         for (cp = optbuf; optsize > 0; cp++, optsize--, lp += 3)
 284                                 sprintf(lp, " %2.2x", *cp);
 285                         syslog(LOG_NOTICE,
 286                             "Connection received using IP options (ignored):%s",
 287                             lbuf);
 288                         if (setsockopt(0, ipproto, IP_OPTIONS,
 289                             (char *)NULL, optsize) != 0) {
 290                                 syslog(LOG_ERR,
 291                                     "setsockopt IP_OPTIONS NULL: %m");
 292                                 exit(1);
 293                         }
 294                 }
 295                 }
 296 #endif
 297                 if (do_rlogin(fromp) == 0)
 298                         authenticated++;
 299         }
 300         if (confirmed == 0) {
 301                 write(f, "", 1);
 302                 confirmed = 1;          /* we sent the null! */
 303         }
 304 #ifdef  KERBEROS
 305 #ifdef  CRYPT
 306         if (doencrypt)
 307                 (void) des_write(f, SECURE_MESSAGE, sizeof(SECURE_MESSAGE) - 1);
 308 #endif
 309 #endif
 310         netf = f;
 311
 312         pid = forkpty(&master, line, NULL, &win);
 313         if (pid < 0) {
 314                 if (errno == ENOENT)
 315                         fatal(f, "Out of ptys", 0);
 316                 else
 317                         fatal(f, "Forkpty", 1);
 318         }
 319         if (pid == 0) {
 320                 if (f > 2)      /* f should always be 0, but... */
 321                         (void) close(f);
 322                 setup_term(0);
 323                 if (authenticated) {
 324 #ifdef  KERBEROS
 325                         if (use_kerberos && (pwd->pw_uid == 0))
 326                                 syslog(LOG_INFO|LOG_AUTH,
 327                                     "ROOT Kerberos login from %s.%s@%s on %s\n",
 328                                     kdata->pname, kdata->pinst, kdata->prealm,
 329                                     hostname);
 330 #endif
 331
 332                         execle(_PATH_LOGIN, "login", "-p",
 333                             "-h", hostname, "-f", "--", lusername, NULL, env);
 334                 } else
 335                         execle(_PATH_LOGIN, "login", "-p",
 336                             "-h", hostname, "--", lusername, NULL, env);
 337                 fatal(STDERR_FILENO, _PATH_LOGIN, 1);
 338                 /*NOTREACHED*/
 339         }
 340 #ifdef  CRYPT
 341 #ifdef  KERBEROS
 342         /*
 343          * If encrypted, don't turn on NBIO or the des read/write
 344          * routines will croak.
 345          */
 346
 347         if (!doencrypt)
 348 #endif
 349 #endif
 350                 ioctl(f, FIONBIO, &on);
 351         ioctl(master, FIONBIO, &on);
 352         ioctl(master, TIOCPKT, &on);
 353         signal(SIGCHLD, cleanup);
 354         protocol(f, master);
 355         signal(SIGCHLD, SIG_IGN);
 356         cleanup(0);
 357 }
 358
 359 char    magic[2] = { 0377, 0377 };
 360 char    oobdata[] = {TIOCPKT_WINDOW};
 361
 362 /*
 363  * Handle a "control" request (signaled by magic being present)
 364  * in the data stream.  For now, we are only willing to handle
 365  * window size changes.
 366  */
 367 int
 368 control(pty, cp, n)
 369         int pty;
 370         char *cp;
 371         int n;
 372 {
 373         struct winsize w;
 374
 375         if (n < 4+sizeof (w) || cp[2] != 's' || cp[3] != 's')
 376                 return (0);
 377         oobdata[0] &= ~TIOCPKT_WINDOW;  /* we know he heard */
 378         memmove(&w, cp+4, sizeof(w));
 379         w.ws_row = ntohs(w.ws_row);
 380         w.ws_col = ntohs(w.ws_col);
 381         w.ws_xpixel = ntohs(w.ws_xpixel);
 382         w.ws_ypixel = ntohs(w.ws_ypixel);
 383         (void)ioctl(pty, TIOCSWINSZ, &w);
 384         return (4+sizeof (w));
 385 }
 386
 387 /*
 388  * rlogin "protocol" machine.
 389  */
 390 void
 391 protocol(f, p)
 392         register int f, p;
 393 {
 394         char pibuf[1024+1], fibuf[1024], *pbp, *fbp;
 395         register pcc = 0, fcc = 0;
 396         int cc, nfd, n;
 397         char cntl;
 398
 399         /*
 400          * Must ignore SIGTTOU, otherwise we'll stop
 401          * when we try and set slave pty's window shape
 402          * (our controlling tty is the master pty).
 403          */
 404         (void) signal(SIGTTOU, SIG_IGN);
 405         send(f, oobdata, 1, MSG_OOB);   /* indicate new rlogin */
 406         if (f > p)
 407                 nfd = f + 1;
 408         else
 409                 nfd = p + 1;
 410         if (nfd > FD_SETSIZE) {
 411                 syslog(LOG_ERR, "select mask too small, increase FD_SETSIZE");
 412                 fatal(f, "internal error (select mask too small)", 0);
 413         }
 414         for (;;) {
 415                 fd_set ibits, obits, ebits, *omask;
 416
 417                 FD_ZERO(&ebits);
 418                 FD_ZERO(&ibits);
 419                 FD_ZERO(&obits);
 420                 omask = (fd_set *)NULL;
 421                 if (fcc) {
 422                         FD_SET(p, &obits);
 423                         omask = &obits;
 424                 } else
 425                         FD_SET(f, &ibits);
 426                 if (pcc >= 0)
 427                         if (pcc) {
 428                                 FD_SET(f, &obits);
 429                                 omask = &obits;
 430                         } else
 431                                 FD_SET(p, &ibits);
 432                 FD_SET(p, &ebits);
 433                 if ((n = select(nfd, &ibits, omask, &ebits, 0)) < 0) {
 434                         if (errno == EINTR)
 435                                 continue;
 436                         fatal(f, "select", 1);
 437                 }
 438                 if (n == 0) {
 439                         /* shouldn't happen... */
 440                         sleep(5);
 441                         continue;
 442                 }
 443 #define pkcontrol(c)    ((c)&(TIOCPKT_FLUSHWRITE|TIOCPKT_NOSTOP|TIOCPKT_DOSTOP))
 444                 if (FD_ISSET(p, &ebits)) {
 445                         cc = read(p, &cntl, 1);
 446                         if (cc == 1 && pkcontrol(cntl)) {
 447                                 cntl |= oobdata[0];
 448                                 send(f, &cntl, 1, MSG_OOB);
 449                                 if (cntl & TIOCPKT_FLUSHWRITE) {
 450                                         pcc = 0;
 451                                         FD_CLR(p, &ibits);
 452                                 }
 453                         }
 454                 }
 455                 if (FD_ISSET(f, &ibits)) {
 456 #ifdef  CRYPT
 457 #ifdef  KERBEROS
 458                         if (doencrypt)
 459                                 fcc = des_read(f, fibuf, sizeof(fibuf));
 460                         else
 461 #endif
 462 #endif
 463                                 fcc = read(f, fibuf, sizeof(fibuf));
 464                         if (fcc < 0 && errno == EWOULDBLOCK)
 465                                 fcc = 0;
 466                         else {
 467                                 register char *cp;
 468                                 int left, n;
 469
 470                                 if (fcc <= 0)
 471                                         break;
 472                                 fbp = fibuf;
 473
 474                         top:
 475                                 for (cp = fibuf; cp < fibuf+fcc-1; cp++)
 476                                         if (cp[0] == magic[0] &&
 477                                             cp[1] == magic[1]) {
 478                                                 left = fcc - (cp-fibuf);
 479                                                 n = control(p, cp, left);
 480                                                 if (n) {
 481                                                         left -= n;
 482                                                         if (left > 0)
 483                                                                 bcopy(cp+n, cp, left);
 484                                                         fcc -= n;
 485                                                         goto top; /* n^2 */
 486                                                 }
 487                                         }
 488                                 FD_SET(p, &obits);              /* try write */
 489                         }
 490                 }
 491
 492                 if (FD_ISSET(p, &obits) && fcc > 0) {
 493                         cc = write(p, fbp, fcc);
 494                         if (cc > 0) {
 495                                 fcc -= cc;
 496                                 fbp += cc;
 497                         }
 498                 }
 499
 500                 if (FD_ISSET(p, &ibits)) {
 501                         pcc = read(p, pibuf, sizeof (pibuf));
 502                         pbp = pibuf;
 503                         if (pcc < 0 && errno == EWOULDBLOCK)
 504                                 pcc = 0;
 505                         else if (pcc <= 0)
 506                                 break;
 507                         else if (pibuf[0] == 0) {
 508                                 pbp++, pcc--;
 509 #ifdef  CRYPT
 510 #ifdef  KERBEROS
 511                                 if (!doencrypt)
 512 #endif
 513 #endif
 514                                         FD_SET(f, &obits);      /* try write */
 515                         } else {
 516                                 if (pkcontrol(pibuf[0])) {
 517                                         pibuf[0] |= oobdata[0];
 518                                         send(f, &pibuf[0], 1, MSG_OOB);
 519                                 }
 520                                 pcc = 0;
 521                         }
 522                 }
 523                 if ((FD_ISSET(f, &obits)) && pcc > 0) {
 524 #ifdef  CRYPT
 525 #ifdef  KERBEROS
 526                         if (doencrypt)
 527                                 cc = des_write(f, pbp, pcc);
 528                         else
 529 #endif
 530 #endif
 531                                 cc = write(f, pbp, pcc);
 532                         if (cc < 0 && errno == EWOULDBLOCK) {
 533                                 /*
 534                                  * This happens when we try write after read
 535                                  * from p, but some old kernels balk at large
 536                                  * writes even when select returns true.
 537                                  */
 538                                 if (!FD_ISSET(p, &ibits))
 539                                         sleep(5);
 540                                 continue;
 541                         }
 542                         if (cc > 0) {
 543                                 pcc -= cc;
 544                                 pbp += cc;
 545                         }
 546                 }
 547         }
 548 }
 549
 550 void
 551 cleanup(signo)
 552         int signo;
 553 {
 554         char *p;
 555
 556         p = line + sizeof(_PATH_DEV) - 1;
 557         if (logout(p))
 558                 logwtmp(p, "", "");
 559         (void)chmod(line, 0666);
 560         (void)chown(line, 0, 0);
 561         *p = 'p';
 562         (void)chmod(line, 0666);
 563         (void)chown(line, 0, 0);
 564         shutdown(netf, 2);
 565         exit(1);
 566 }
 567
 568 void
 569 fatal(f, msg, syserr)
 570         int f;
 571         char *msg;
 572         int syserr;
 573 {
 574         int len;
 575         char buf[BUFSIZ], *bp = buf;
 576
 577         /*
 578          * Prepend binary one to message if we haven't sent
 579          * the magic null as confirmation.
 580          */
 581         if (!confirmed)
 582                 *bp++ = '\01';          /* error indicator */
 583         if (syserr)
 584                 len = sprintf(bp, "rlogind: %s: %s.\r\n",
 585                     msg, strerror(errno));
 586         else
 587                 len = sprintf(bp, "rlogind: %s.\r\n", msg);
 588         (void) write(f, buf, bp + len - buf);
 589         exit(1);
 590 }
 591
 592 int
 593 do_rlogin(dest)
 594         struct sockaddr_in *dest;
 595 {
 596         getstr(rusername, sizeof(rusername), "remuser too long");
 597         getstr(lusername, sizeof(lusername), "locuser too long");
 598         getstr(term+ENVSIZE, sizeof(term)-ENVSIZE, "Terminal type too long");
 599
 600         pwd = getpwnam(lusername);
 601         if (pwd == NULL)
 602                 return (-1);
 603         if (pwd->pw_uid == 0)
 604                 return (-1);
 605         /* XXX why don't we syslog() failure? */
 606         return (iruserok(dest->sin_addr.s_addr, 0, rusername, lusername));
 607 }
 608
 609 void
 610 getstr(buf, cnt, errmsg)
 611         char *buf;
 612         int cnt;
 613         char *errmsg;
 614 {
 615         char c;
 616
 617         do {
 618                 if (read(0, &c, 1) != 1)
 619                         exit(1);
 620                 if (--cnt < 0)
 621                         fatal(STDOUT_FILENO, errmsg, 0);
 622                 *buf++ = c;
 623         } while (c != 0);
 624 }
 625
 626 void
 627 setup_term(fd)
 628         int fd;
 629 {
 630         register char *cp = index(term+ENVSIZE, '/');
 631         char *speed;
 632         struct termios tt;
 633
 634 #ifndef notyet
 635         tcgetattr(fd, &tt);
 636         if (cp) {
 637                 *cp++ = '\0';
 638                 speed = cp;
 639                 cp = index(speed, '/');
 640                 if (cp)
 641                         *cp++ = '\0';
 642                 cfsetspeed(&tt, atoi(speed));
 643         }
 644
 645         tt.c_iflag = TTYDEF_IFLAG;
 646         tt.c_oflag = TTYDEF_OFLAG;
 647         tt.c_lflag = TTYDEF_LFLAG;
 648         tcsetattr(fd, TCSAFLUSH, &tt);
 649 #else
 650         if (cp) {
 651                 *cp++ = '\0';
 652                 speed = cp;
 653                 cp = index(speed, '/');
 654                 if (cp)
 655                         *cp++ = '\0';
 656                 tcgetattr(fd, &tt);
 657                 cfsetspeed(&tt, atoi(speed));
 658                 tcsetattr(fd, TCSAFLUSH, &tt);
 659         }
 660 #endif
 661
 662         env[0] = term;
 663         env[1] = 0;
 664 }
 665
 666 #ifdef  KERBEROS
 667 #define VERSION_SIZE    9
 668
 669 /*
 670  * Do the remote kerberos login to the named host with the
 671  * given inet address
 672  *
 673  * Return 0 on valid authorization
 674  * Return -1 on valid authentication, no authorization
 675  * Return >0 for error conditions
 676  */
 677 int
 678 do_krb_login(dest)
 679         struct sockaddr_in *dest;
 680 {
 681         int rc;
 682         char instance[INST_SZ], version[VERSION_SIZE];
 683         long authopts = 0L;     /* !mutual */
 684         struct sockaddr_in faddr;
 685
 686         kdata = (AUTH_DAT *) auth_buf;
 687         ticket = (KTEXT) tick_buf;
 688
 689         instance[0] = '*';
 690         instance[1] = '\0';
 691
 692 #ifdef  CRYPT
 693         if (doencrypt) {
 694                 rc = sizeof(faddr);
 695                 if (getsockname(0, (struct sockaddr *)&faddr, &rc))
 696                         return (-1);
 697                 authopts = KOPT_DO_MUTUAL;
 698                 rc = krb_recvauth(
 699                         authopts, 0,
 700                         ticket, "rcmd",
 701                         instance, dest, &faddr,
 702                         kdata, "", schedule, version);
 703                  des_set_key(kdata->session, schedule);
 704
 705         } else
 706 #endif
 707                 rc = krb_recvauth(
 708                         authopts, 0,
 709                         ticket, "rcmd",
 710                         instance, dest, (struct sockaddr_in *) 0,
 711                         kdata, "", (bit_64 *) 0, version);
 712
 713         if (rc != KSUCCESS)
 714                 return (rc);
 715
 716         getstr(lusername, sizeof(lusername), "locuser");
 717         /* get the "cmd" in the rcmd protocol */
 718         getstr(term+ENVSIZE, sizeof(term)-ENVSIZE, "Terminal type");
 719
 720         pwd = getpwnam(lusername);
 721         if (pwd == NULL)
 722                 return (-1);
 723
 724         /* returns nonzero for no access */
 725         if (kuserok(kdata, lusername) != 0)
 726                 return (-1);
 727
 728         return (0);
 729
 730 }
 731 #endif /* KERBEROS */
 732
 733 void
 734 usage()
 735 {
 736 #ifdef KERBEROS
 737         syslog(LOG_ERR, "usage: rlogind [-aln] [-k | -v]");
 738 #else
 739         syslog(LOG_ERR, "usage: rlogind [-aln]");
 740 #endif
 741 }
 742
 743 /*
 744  * Check whether host h is in our local domain,
 745  * defined as sharing the last two components of the domain part,
 746  * or the entire domain part if the local domain has only one component.
 747  * If either name is unqualified (contains no '.'),
 748  * assume that the host is local, as it will be
 749  * interpreted as such.
 750  */
 751 int
 752 local_domain(h)
 753         char *h;
 754 {
 755         char localhost[MAXHOSTNAMELEN];
 756         char *p1, *p2;
 757
 758         localhost[0] = 0;
 759         (void) gethostname(localhost, sizeof(localhost));
 760         p1 = topdomain(localhost);
 761         p2 = topdomain(h);
 762         if (p1 == NULL || p2 == NULL || !strcasecmp(p1, p2))
 763                 return (1);
 764         return (0);
 765 }
 766
 767 char *
 768 topdomain(h)
 769         char *h;
 770 {
 771         register char *p;
 772         char *maybe = NULL;
 773         int dots = 0;
 774
 775         for (p = h + strlen(h); p >= h; p--) {
 776                 if (*p == '.') {
 777                         if (++dots == 2)
 778                                 return (p);
 779                         maybe = p;
 780                 }
 781         }
 782         return (maybe);
 783 }