1 /* $FreeBSD$ */
2 /*
3 * Routines to parse an inetd.conf or tlid.conf file. This would be a great
4 * job for a PERL script.
5 *
6 * Author: Wietse Venema, Eindhoven University of Technology, The Netherlands.
7 */
8
9 #ifndef lint
10 static char sccsid[] = "@(#) inetcf.c 1.7 97/02/12 02:13:23";
11 #endif
12
13 #include <sys/types.h>
14 #include <sys/stat.h>
15 #include <stdio.h>
16 #include <errno.h>
17 #include <stdlib.h>
18 #include <string.h>
19
20 #include "tcpd.h"
21 #include "inetcf.h"
22 #include "scaffold.h"
23
24 /*
25 * Network configuration files may live in unusual places. Here are some
26 * guesses. Shorter names follow longer ones.
27 */
28 char *inet_files[] = {
29 "/private/etc/inetd.conf", /* NEXT */
30 "/etc/inet/inetd.conf", /* SYSV4 */
31 "/usr/etc/inetd.conf", /* IRIX?? */
32 "/etc/inetd.conf", /* BSD */
33 "/etc/net/tlid.conf", /* SYSV4?? */
34 "/etc/saf/tlid.conf", /* SYSV4?? */
35 "/etc/tlid.conf", /* SYSV4?? */
36 0,
37 };
38
39 static void inet_chk(char *protocol, char *path, char *arg0, char *arg1);
40 static char *base_name(char *path);
41 extern char *percent_m(char *obuf, char *ibuf);
42
43 /*
44 * Structure with everything we know about a service.
45 */
46 struct inet_ent {
47 struct inet_ent *next;
48 int type;
49 char name[1];
50 };
51
52 static struct inet_ent *inet_list = 0;
53
54 static char whitespace[] = " \t\r\n";
55
56 /* inet_conf - read in and examine inetd.conf (or tlid.conf) entries */
57
inet_cfg(char * conf)58 char *inet_cfg(char *conf)
59 {
60 char buf[BUFSIZ];
61 FILE *fp;
62 char *service;
63 char *protocol;
64 char *user;
65 char *path;
66 char *arg0;
67 char *arg1;
68 struct tcpd_context saved_context;
69 int i;
70 struct stat st;
71
72 saved_context = tcpd_context;
73
74 /*
75 * The inetd.conf (or tlid.conf) information is so useful that we insist
76 * on its availability. When no file is given run a series of educated
77 * guesses.
78 */
79 if (conf != 0) {
80 if ((fp = fopen(conf, "r")) == 0) {
81 fprintf(stderr, percent_m(buf, "open %s: %m\n"), conf);
82 exit(1);
83 }
84 } else {
85 for (i = 0; inet_files[i] && (fp = fopen(inet_files[i], "r")) == 0; i++)
86 /* void */ ;
87 if (fp == 0) {
88 fprintf(stderr, "Cannot find your inetd.conf or tlid.conf file.\n");
89 fprintf(stderr, "Please specify its location.\n");
90 exit(1);
91 }
92 conf = inet_files[i];
93 check_path(conf, &st);
94 }
95
96 /*
97 * Process the file. After the 7.0 wrapper release it became clear that
98 * there are many more inetd.conf formats than the 8 systems that I had
99 * studied. EP/IX uses a two-line specification for rpc services; HP-UX
100 * permits long lines to be broken with backslash-newline.
101 */
102 tcpd_context.file = conf;
103 tcpd_context.line = 0;
104 while (xgets(buf, sizeof(buf), fp)) {
105 service = strtok(buf, whitespace); /* service */
106 if (service == 0 || *service == '#')
107 continue;
108 if (STR_NE(service, "stream") && STR_NE(service, "dgram"))
109 strtok((char *) 0, whitespace); /* endpoint */
110 protocol = strtok((char *) 0, whitespace);
111 (void) strtok((char *) 0, whitespace); /* wait */
112 if ((user = strtok((char *) 0, whitespace)) == 0)
113 continue;
114 if (user[0] == '/') { /* user */
115 path = user;
116 } else { /* path */
117 if ((path = strtok((char *) 0, whitespace)) == 0)
118 continue;
119 }
120 if (path[0] == '?') /* IRIX optional service */
121 path++;
122 if (STR_EQ(path, "internal"))
123 continue;
124 if (path[strspn(path, "-0123456789")] == 0) {
125
126 /*
127 * ConvexOS puts RPC version numbers before path names. Jukka
128 * Ukkonen <ukkonen@csc.fi>.
129 */
130 if ((path = strtok((char *) 0, whitespace)) == 0)
131 continue;
132 }
133 if ((arg0 = strtok((char *) 0, whitespace)) == 0) {
134 tcpd_warn("incomplete line");
135 continue;
136 }
137 if (arg0[strspn(arg0, "0123456789")] == 0) {
138
139 /*
140 * We're reading a tlid.conf file, the format is:
141 *
142 * ...stuff... path arg_count arguments mod_count modules
143 */
144 if ((arg0 = strtok((char *) 0, whitespace)) == 0) {
145 tcpd_warn("incomplete line");
146 continue;
147 }
148 }
149 if ((arg1 = strtok((char *) 0, whitespace)) == 0)
150 arg1 = "";
151
152 inet_chk(protocol, path, arg0, arg1);
153 }
154 fclose(fp);
155 tcpd_context = saved_context;
156 return (conf);
157 }
158
159 /* inet_chk - examine one inetd.conf (tlid.conf?) entry */
160
inet_chk(char * protocol,char * path,char * arg0,char * arg1)161 static void inet_chk(char *protocol, char *path, char *arg0, char *arg1)
162 {
163 char daemon[BUFSIZ];
164 struct stat st;
165 int wrap_status = WR_MAYBE;
166 char *base_name_path = base_name(path);
167 char *tcpd_proc_name = (arg0[0] == '/' ? base_name(arg0) : arg0);
168
169 /*
170 * Always warn when the executable does not exist or when it is not
171 * executable.
172 */
173 if (check_path(path, &st) < 0) {
174 tcpd_warn("%s: not found: %m", path);
175 } else if ((st.st_mode & 0100) == 0) {
176 tcpd_warn("%s: not executable", path);
177 }
178
179 /*
180 * Cheat on the miscd tests, nobody uses it anymore.
181 */
182 if (STR_EQ(base_name_path, "miscd")) {
183 inet_set(arg0, WR_YES);
184 return;
185 }
186
187 /*
188 * While we are here...
189 */
190 if (STR_EQ(tcpd_proc_name, "rexd") || STR_EQ(tcpd_proc_name, "rpc.rexd"))
191 tcpd_warn("%s may be an insecure service", tcpd_proc_name);
192
193 /*
194 * The tcpd program gets most of the attention.
195 */
196 if (STR_EQ(base_name_path, "tcpd")) {
197
198 if (STR_EQ(tcpd_proc_name, "tcpd"))
199 tcpd_warn("%s is recursively calling itself", tcpd_proc_name);
200
201 wrap_status = WR_YES;
202
203 /*
204 * Check: some sites install the wrapper set-uid.
205 */
206 if ((st.st_mode & 06000) != 0)
207 tcpd_warn("%s: file is set-uid or set-gid", path);
208
209 /*
210 * Check: some sites insert tcpd in inetd.conf, instead of replacing
211 * the daemon pathname.
212 */
213 if (arg0[0] == '/' && STR_EQ(tcpd_proc_name, base_name(arg1)))
214 tcpd_warn("%s inserted before %s", path, arg0);
215
216 /*
217 * Check: make sure files exist and are executable. On some systems
218 * the network daemons are set-uid so we cannot complain. Note that
219 * tcpd takes the basename only in case of absolute pathnames.
220 */
221 if (arg0[0] == '/') { /* absolute path */
222 if (check_path(arg0, &st) < 0) {
223 tcpd_warn("%s: not found: %m", arg0);
224 } else if ((st.st_mode & 0100) == 0) {
225 tcpd_warn("%s: not executable", arg0);
226 }
227 } else { /* look in REAL_DAEMON_DIR */
228 sprintf(daemon, "%s/%s", REAL_DAEMON_DIR, arg0);
229 if (check_path(daemon, &st) < 0) {
230 tcpd_warn("%s: not found in %s: %m",
231 arg0, REAL_DAEMON_DIR);
232 } else if ((st.st_mode & 0100) == 0) {
233 tcpd_warn("%s: not executable", daemon);
234 }
235 }
236
237 } else {
238
239 /*
240 * No tcpd program found. Perhaps they used the "simple installation"
241 * recipe. Look for a file with the same basename in REAL_DAEMON_DIR.
242 * Draw some conservative conclusions when a distinct file is found.
243 */
244 sprintf(daemon, "%s/%s", REAL_DAEMON_DIR, arg0);
245 if (STR_EQ(path, daemon)) {
246 #ifdef __FreeBSD__
247 wrap_status = WR_MAYBE;
248 #else
249 wrap_status = WR_NOT;
250 #endif
251 } else if (check_path(daemon, &st) >= 0) {
252 wrap_status = WR_MAYBE;
253 } else if (errno == ENOENT) {
254 wrap_status = WR_NOT;
255 } else {
256 tcpd_warn("%s: file lookup: %m", daemon);
257 wrap_status = WR_MAYBE;
258 }
259 }
260
261 /*
262 * Alas, we cannot wrap rpc/tcp services.
263 */
264 if (wrap_status == WR_YES && STR_EQ(protocol, "rpc/tcp"))
265 tcpd_warn("%s: cannot wrap rpc/tcp services", tcpd_proc_name);
266
267 inet_set(tcpd_proc_name, wrap_status);
268 }
269
270 /* inet_set - remember service status */
271
inet_set(char * name,int type)272 void inet_set(char *name, int type)
273 {
274 struct inet_ent *ip =
275 (struct inet_ent *) malloc(sizeof(struct inet_ent) + strlen(name));
276
277 if (ip == 0) {
278 fprintf(stderr, "out of memory\n");
279 exit(1);
280 }
281 ip->next = inet_list;
282 strcpy(ip->name, name);
283 ip->type = type;
284 inet_list = ip;
285 }
286
287 /* inet_get - look up service status */
288
inet_get(char * name)289 int inet_get(char *name)
290 {
291 struct inet_ent *ip;
292
293 if (inet_list == 0)
294 return (WR_MAYBE);
295
296 for (ip = inet_list; ip; ip = ip->next)
297 if (STR_EQ(ip->name, name))
298 return (ip->type);
299
300 return (-1);
301 }
302
303 /* base_name - compute last pathname component */
304
base_name(char * path)305 static char *base_name(char *path)
306 {
307 char *cp;
308
309 if ((cp = strrchr(path, '/')) != 0)
310 path = cp + 1;
311 return (path);
312 }
313