1 /* $FreeBSD$ */ 2 /* 3 * Routines to parse an inetd.conf or tlid.conf file. This would be a great 4 * job for a PERL script. 5 * 6 * Author: Wietse Venema, Eindhoven University of Technology, The Netherlands. 7 */ 8 9 #ifndef lint 10 static char sccsid[] = "@(#) inetcf.c 1.7 97/02/12 02:13:23"; 11 #endif 12 13 #include <sys/types.h> 14 #include <sys/stat.h> 15 #include <stdio.h> 16 #include <errno.h> 17 #include <string.h> 18 19 extern int errno; 20 extern void exit(); 21 extern char *malloc(); 22 23 #include "tcpd.h" 24 #include "inetcf.h" 25 26 /* 27 * Network configuration files may live in unusual places. Here are some 28 * guesses. Shorter names follow longer ones. 29 */ 30 char *inet_files[] = { 31 "/private/etc/inetd.conf", /* NEXT */ 32 "/etc/inet/inetd.conf", /* SYSV4 */ 33 "/usr/etc/inetd.conf", /* IRIX?? */ 34 "/etc/inetd.conf", /* BSD */ 35 "/etc/net/tlid.conf", /* SYSV4?? */ 36 "/etc/saf/tlid.conf", /* SYSV4?? */ 37 "/etc/tlid.conf", /* SYSV4?? */ 38 0, 39 }; 40 41 static void inet_chk(); 42 static char *base_name(); 43 44 /* 45 * Structure with everything we know about a service. 46 */ 47 struct inet_ent { 48 struct inet_ent *next; 49 int type; 50 char name[1]; 51 }; 52 53 static struct inet_ent *inet_list = 0; 54 55 static char whitespace[] = " \t\r\n"; 56 57 /* inet_conf - read in and examine inetd.conf (or tlid.conf) entries */ 58 59 char *inet_cfg(conf) 60 char *conf; 61 { 62 char buf[BUFSIZ]; 63 FILE *fp; 64 char *service; 65 char *protocol; 66 char *user; 67 char *path; 68 char *arg0; 69 char *arg1; 70 struct tcpd_context saved_context; 71 char *percent_m(); 72 int i; 73 struct stat st; 74 75 saved_context = tcpd_context; 76 77 /* 78 * The inetd.conf (or tlid.conf) information is so useful that we insist 79 * on its availability. When no file is given run a series of educated 80 * guesses. 81 */ 82 if (conf != 0) { 83 if ((fp = fopen(conf, "r")) == 0) { 84 fprintf(stderr, percent_m(buf, "open %s: %m\n"), conf); 85 exit(1); 86 } 87 } else { 88 for (i = 0; inet_files[i] && (fp = fopen(inet_files[i], "r")) == 0; i++) 89 /* void */ ; 90 if (fp == 0) { 91 fprintf(stderr, "Cannot find your inetd.conf or tlid.conf file.\n"); 92 fprintf(stderr, "Please specify its location.\n"); 93 exit(1); 94 } 95 conf = inet_files[i]; 96 check_path(conf, &st); 97 } 98 99 /* 100 * Process the file. After the 7.0 wrapper release it became clear that 101 * there are many more inetd.conf formats than the 8 systems that I had 102 * studied. EP/IX uses a two-line specification for rpc services; HP-UX 103 * permits long lines to be broken with backslash-newline. 104 */ 105 tcpd_context.file = conf; 106 tcpd_context.line = 0; 107 while (xgets(buf, sizeof(buf), fp)) { 108 service = strtok(buf, whitespace); /* service */ 109 if (service == 0 || *service == '#') 110 continue; 111 if (STR_NE(service, "stream") && STR_NE(service, "dgram")) 112 strtok((char *) 0, whitespace); /* endpoint */ 113 protocol = strtok((char *) 0, whitespace); 114 (void) strtok((char *) 0, whitespace); /* wait */ 115 if ((user = strtok((char *) 0, whitespace)) == 0) 116 continue; 117 if (user[0] == '/') { /* user */ 118 path = user; 119 } else { /* path */ 120 if ((path = strtok((char *) 0, whitespace)) == 0) 121 continue; 122 } 123 if (path[0] == '?') /* IRIX optional service */ 124 path++; 125 if (STR_EQ(path, "internal")) 126 continue; 127 if (path[strspn(path, "-0123456789")] == 0) { 128 129 /* 130 * ConvexOS puts RPC version numbers before path names. Jukka 131 * Ukkonen <ukkonen@csc.fi>. 132 */ 133 if ((path = strtok((char *) 0, whitespace)) == 0) 134 continue; 135 } 136 if ((arg0 = strtok((char *) 0, whitespace)) == 0) { 137 tcpd_warn("incomplete line"); 138 continue; 139 } 140 if (arg0[strspn(arg0, "0123456789")] == 0) { 141 142 /* 143 * We're reading a tlid.conf file, the format is: 144 * 145 * ...stuff... path arg_count arguments mod_count modules 146 */ 147 if ((arg0 = strtok((char *) 0, whitespace)) == 0) { 148 tcpd_warn("incomplete line"); 149 continue; 150 } 151 } 152 if ((arg1 = strtok((char *) 0, whitespace)) == 0) 153 arg1 = ""; 154 155 inet_chk(protocol, path, arg0, arg1); 156 } 157 fclose(fp); 158 tcpd_context = saved_context; 159 return (conf); 160 } 161 162 /* inet_chk - examine one inetd.conf (tlid.conf?) entry */ 163 164 static void inet_chk(protocol, path, arg0, arg1) 165 char *protocol; 166 char *path; 167 char *arg0; 168 char *arg1; 169 { 170 char daemon[BUFSIZ]; 171 struct stat st; 172 int wrap_status = WR_MAYBE; 173 char *base_name_path = base_name(path); 174 char *tcpd_proc_name = (arg0[0] == '/' ? base_name(arg0) : arg0); 175 176 /* 177 * Always warn when the executable does not exist or when it is not 178 * executable. 179 */ 180 if (check_path(path, &st) < 0) { 181 tcpd_warn("%s: not found: %m", path); 182 } else if ((st.st_mode & 0100) == 0) { 183 tcpd_warn("%s: not executable", path); 184 } 185 186 /* 187 * Cheat on the miscd tests, nobody uses it anymore. 188 */ 189 if (STR_EQ(base_name_path, "miscd")) { 190 inet_set(arg0, WR_YES); 191 return; 192 } 193 194 /* 195 * While we are here... 196 */ 197 if (STR_EQ(tcpd_proc_name, "rexd") || STR_EQ(tcpd_proc_name, "rpc.rexd")) 198 tcpd_warn("%s may be an insecure service", tcpd_proc_name); 199 200 /* 201 * The tcpd program gets most of the attention. 202 */ 203 if (STR_EQ(base_name_path, "tcpd")) { 204 205 if (STR_EQ(tcpd_proc_name, "tcpd")) 206 tcpd_warn("%s is recursively calling itself", tcpd_proc_name); 207 208 wrap_status = WR_YES; 209 210 /* 211 * Check: some sites install the wrapper set-uid. 212 */ 213 if ((st.st_mode & 06000) != 0) 214 tcpd_warn("%s: file is set-uid or set-gid", path); 215 216 /* 217 * Check: some sites insert tcpd in inetd.conf, instead of replacing 218 * the daemon pathname. 219 */ 220 if (arg0[0] == '/' && STR_EQ(tcpd_proc_name, base_name(arg1))) 221 tcpd_warn("%s inserted before %s", path, arg0); 222 223 /* 224 * Check: make sure files exist and are executable. On some systems 225 * the network daemons are set-uid so we cannot complain. Note that 226 * tcpd takes the basename only in case of absolute pathnames. 227 */ 228 if (arg0[0] == '/') { /* absolute path */ 229 if (check_path(arg0, &st) < 0) { 230 tcpd_warn("%s: not found: %m", arg0); 231 } else if ((st.st_mode & 0100) == 0) { 232 tcpd_warn("%s: not executable", arg0); 233 } 234 } else { /* look in REAL_DAEMON_DIR */ 235 sprintf(daemon, "%s/%s", REAL_DAEMON_DIR, arg0); 236 if (check_path(daemon, &st) < 0) { 237 tcpd_warn("%s: not found in %s: %m", 238 arg0, REAL_DAEMON_DIR); 239 } else if ((st.st_mode & 0100) == 0) { 240 tcpd_warn("%s: not executable", daemon); 241 } 242 } 243 244 } else { 245 246 /* 247 * No tcpd program found. Perhaps they used the "simple installation" 248 * recipe. Look for a file with the same basename in REAL_DAEMON_DIR. 249 * Draw some conservative conclusions when a distinct file is found. 250 */ 251 sprintf(daemon, "%s/%s", REAL_DAEMON_DIR, arg0); 252 if (STR_EQ(path, daemon)) { 253 #ifdef __FreeBSD__ 254 wrap_status = WR_MAYBE; 255 #else 256 wrap_status = WR_NOT; 257 #endif 258 } else if (check_path(daemon, &st) >= 0) { 259 wrap_status = WR_MAYBE; 260 } else if (errno == ENOENT) { 261 wrap_status = WR_NOT; 262 } else { 263 tcpd_warn("%s: file lookup: %m", daemon); 264 wrap_status = WR_MAYBE; 265 } 266 } 267 268 /* 269 * Alas, we cannot wrap rpc/tcp services. 270 */ 271 if (wrap_status == WR_YES && STR_EQ(protocol, "rpc/tcp")) 272 tcpd_warn("%s: cannot wrap rpc/tcp services", tcpd_proc_name); 273 274 inet_set(tcpd_proc_name, wrap_status); 275 } 276 277 /* inet_set - remember service status */ 278 279 void inet_set(name, type) 280 char *name; 281 int type; 282 { 283 struct inet_ent *ip = 284 (struct inet_ent *) malloc(sizeof(struct inet_ent) + strlen(name)); 285 286 if (ip == 0) { 287 fprintf(stderr, "out of memory\n"); 288 exit(1); 289 } 290 ip->next = inet_list; 291 strcpy(ip->name, name); 292 ip->type = type; 293 inet_list = ip; 294 } 295 296 /* inet_get - look up service status */ 297 298 int inet_get(name) 299 char *name; 300 { 301 struct inet_ent *ip; 302 303 if (inet_list == 0) 304 return (WR_MAYBE); 305 306 for (ip = inet_list; ip; ip = ip->next) 307 if (STR_EQ(ip->name, name)) 308 return (ip->type); 309 310 return (-1); 311 } 312 313 /* base_name - compute last pathname component */ 314 315 static char *base_name(path) 316 char *path; 317 { 318 char *cp; 319 320 if ((cp = strrchr(path, '/')) != 0) 321 path = cp + 1; 322 return (path); 323 } 324