xref: /freebsd/usr.sbin/rpcbind/rpcb_svc_com.c (revision 273c26a3c3bea87a241d6879abd4f991db180bf0)
1 /*	$NetBSD: rpcb_svc_com.c,v 1.9 2002/11/08 00:16:39 fvdl Exp $	*/
2 /*	$FreeBSD$ */
3 
4 /*-
5  * Copyright (c) 2009, Sun Microsystems, Inc.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions are met:
10  * - Redistributions of source code must retain the above copyright notice,
11  *   this list of conditions and the following disclaimer.
12  * - Redistributions in binary form must reproduce the above copyright notice,
13  *   this list of conditions and the following disclaimer in the documentation
14  *   and/or other materials provided with the distribution.
15  * - Neither the name of Sun Microsystems, Inc. nor the names of its
16  *   contributors may be used to endorse or promote products derived
17  *   from this software without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
20  * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
23  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
24  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
25  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
26  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
27  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
28  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
29  * POSSIBILITY OF SUCH DAMAGE.
30  */
31 /*
32  * Copyright (c) 1986 - 1991 by Sun Microsystems, Inc.
33  */
34 
35 /* #ident	"@(#)rpcb_svc_com.c	1.18	94/05/02 SMI" */
36 
37 /*
38  * rpcb_svc_com.c
39  * The commom server procedure for the rpcbind.
40  */
41 
42 #include <sys/types.h>
43 #include <sys/stat.h>
44 #include <sys/param.h>
45 #include <sys/poll.h>
46 #include <sys/socket.h>
47 #include <rpc/rpc.h>
48 #include <rpc/rpcb_prot.h>
49 #include <rpc/svc_dg.h>
50 #include <assert.h>
51 #include <netconfig.h>
52 #include <errno.h>
53 #include <syslog.h>
54 #include <unistd.h>
55 #include <stdio.h>
56 #ifdef PORTMAP
57 #include <netinet/in.h>
58 #include <rpc/pmap_prot.h>
59 #endif /* PORTMAP */
60 #include <string.h>
61 #include <stdlib.h>
62 
63 #include "rpcbind.h"
64 
65 #define RPC_BUF_MAX	65536	/* can be raised if required */
66 
67 static char *nullstring = "";
68 static int rpcb_rmtcalls;
69 
70 struct rmtcallfd_list {
71 	int fd;
72 	SVCXPRT *xprt;
73 	char *netid;
74 	struct rmtcallfd_list *next;
75 };
76 
77 #define NFORWARD        64
78 #define MAXTIME_OFF     300     /* 5 minutes */
79 
80 struct finfo {
81 	int             flag;
82 #define FINFO_ACTIVE    0x1
83 	u_int32_t       caller_xid;
84         struct netbuf   *caller_addr;
85 	u_int32_t       forward_xid;
86 	int             forward_fd;
87 	char            *uaddr;
88 	rpcproc_t       reply_type;
89 	rpcvers_t       versnum;
90 	time_t          time;
91 };
92 static struct finfo     FINFO[NFORWARD];
93 
94 
95 static bool_t xdr_encap_parms(XDR *, struct encap_parms *);
96 static bool_t xdr_rmtcall_args(XDR *, struct r_rmtcall_args *);
97 static bool_t xdr_rmtcall_result(XDR *, struct r_rmtcall_args *);
98 static bool_t xdr_opaque_parms(XDR *, struct r_rmtcall_args *);
99 static int find_rmtcallfd_by_netid(char *);
100 static SVCXPRT *find_rmtcallxprt_by_fd(int);
101 static int forward_register(u_int32_t, struct netbuf *, int, char *,
102     rpcproc_t, rpcvers_t, u_int32_t *);
103 static struct finfo *forward_find(u_int32_t);
104 static int free_slot_by_xid(u_int32_t);
105 static int free_slot_by_index(int);
106 static int netbufcmp(struct netbuf *, struct netbuf *);
107 static struct netbuf *netbufdup(struct netbuf *);
108 static void netbuffree(struct netbuf *);
109 static int check_rmtcalls(struct pollfd *, int);
110 static void xprt_set_caller(SVCXPRT *, struct finfo *);
111 static void send_svcsyserr(SVCXPRT *, struct finfo *);
112 static void handle_reply(int, SVCXPRT *);
113 static void find_versions(rpcprog_t, char *, rpcvers_t *, rpcvers_t *);
114 static rpcblist_ptr find_service(rpcprog_t, rpcvers_t, char *);
115 static char *getowner(SVCXPRT *, char *, size_t);
116 static int add_pmaplist(RPCB *);
117 static int del_pmaplist(RPCB *);
118 
119 /*
120  * Set a mapping of program, version, netid
121  */
122 /* ARGSUSED */
123 void *
124 rpcbproc_set_com(void *arg, struct svc_req *rqstp __unused, SVCXPRT *transp,
125 		 rpcvers_t rpcbversnum)
126 {
127 	RPCB *regp = (RPCB *)arg;
128 	static bool_t ans;
129 	char owner[64];
130 
131 #ifdef RPCBIND_DEBUG
132 	if (debugging)
133 		fprintf(stderr, "RPCB_SET request for (%lu, %lu, %s, %s) : ",
134 		    (unsigned long)regp->r_prog, (unsigned long)regp->r_vers,
135 		    regp->r_netid, regp->r_addr);
136 #endif
137 	ans = map_set(regp, getowner(transp, owner, sizeof owner));
138 #ifdef RPCBIND_DEBUG
139 	if (debugging)
140 		fprintf(stderr, "%s\n", ans == TRUE ? "succeeded" : "failed");
141 #endif
142 	/* XXX: should have used some defined constant here */
143 	rpcbs_set(rpcbversnum - 2, ans);
144 	return (void *)&ans;
145 }
146 
147 bool_t
148 map_set(RPCB *regp, char *owner)
149 {
150 	RPCB reg, *a;
151 	rpcblist_ptr rbl, fnd;
152 
153 	reg = *regp;
154 	/*
155 	 * check to see if already used
156 	 * find_service returns a hit even if
157 	 * the versions don't match, so check for it
158 	 */
159 	fnd = find_service(reg.r_prog, reg.r_vers, reg.r_netid);
160 	if (fnd && (fnd->rpcb_map.r_vers == reg.r_vers)) {
161 		if (!strcmp(fnd->rpcb_map.r_addr, reg.r_addr))
162 			/*
163 			 * if these match then it is already
164 			 * registered so just say "OK".
165 			 */
166 			return (TRUE);
167 		else
168 			return (FALSE);
169 	}
170 	/*
171 	 * add to the end of the list
172 	 */
173 	rbl = malloc(sizeof (RPCBLIST));
174 	if (rbl == NULL)
175 		return (FALSE);
176 	a = &(rbl->rpcb_map);
177 	a->r_prog = reg.r_prog;
178 	a->r_vers = reg.r_vers;
179 	a->r_netid = strdup(reg.r_netid);
180 	a->r_addr = strdup(reg.r_addr);
181 	a->r_owner = strdup(owner);
182 	if (!a->r_addr || !a->r_netid || !a->r_owner) {
183 		if (a->r_netid)
184 			free(a->r_netid);
185 		if (a->r_addr)
186 			free(a->r_addr);
187 		if (a->r_owner)
188 			free(a->r_owner);
189 		free(rbl);
190 		return (FALSE);
191 	}
192 	rbl->rpcb_next = (rpcblist_ptr)NULL;
193 	if (list_rbl == NULL) {
194 		list_rbl = rbl;
195 	} else {
196 		for (fnd = list_rbl; fnd->rpcb_next;
197 			fnd = fnd->rpcb_next)
198 			;
199 		fnd->rpcb_next = rbl;
200 	}
201 #ifdef PORTMAP
202 	(void) add_pmaplist(regp);
203 #endif
204 	return (TRUE);
205 }
206 
207 /*
208  * Unset a mapping of program, version, netid
209  */
210 /* ARGSUSED */
211 void *
212 rpcbproc_unset_com(void *arg, struct svc_req *rqstp __unused, SVCXPRT *transp,
213 		   rpcvers_t rpcbversnum)
214 {
215 	RPCB *regp = (RPCB *)arg;
216 	static bool_t ans;
217 	char owner[64];
218 
219 #ifdef RPCBIND_DEBUG
220 	if (debugging)
221 		fprintf(stderr, "RPCB_UNSET request for (%lu, %lu, %s) : ",
222 		    (unsigned long)regp->r_prog, (unsigned long)regp->r_vers,
223 		    regp->r_netid);
224 #endif
225 	ans = map_unset(regp, getowner(transp, owner, sizeof owner));
226 #ifdef RPCBIND_DEBUG
227 	if (debugging)
228 		fprintf(stderr, "%s\n", ans == TRUE ? "succeeded" : "failed");
229 #endif
230 	/* XXX: should have used some defined constant here */
231 	rpcbs_unset(rpcbversnum - 2, ans);
232 	return (void *)&ans;
233 }
234 
235 bool_t
236 map_unset(RPCB *regp, char *owner)
237 {
238 	int ans = 0;
239 	rpcblist_ptr rbl, prev, tmp;
240 
241 	if (owner == NULL)
242 		return (0);
243 
244 	for (prev = NULL, rbl = list_rbl; rbl; /* cstyle */) {
245 		if ((rbl->rpcb_map.r_prog != regp->r_prog) ||
246 			(rbl->rpcb_map.r_vers != regp->r_vers) ||
247 			(regp->r_netid[0] && strcasecmp(regp->r_netid,
248 				rbl->rpcb_map.r_netid))) {
249 			/* both rbl & prev move forwards */
250 			prev = rbl;
251 			rbl = rbl->rpcb_next;
252 			continue;
253 		}
254 		/*
255 		 * Check whether appropriate uid. Unset only
256 		 * if superuser or the owner itself.
257 		 */
258 		if (strcmp(owner, "superuser") &&
259 			strcmp(rbl->rpcb_map.r_owner, owner))
260 			return (0);
261 		/* found it; rbl moves forward, prev stays */
262 		ans = 1;
263 		tmp = rbl;
264 		rbl = rbl->rpcb_next;
265 		if (prev == NULL)
266 			list_rbl = rbl;
267 		else
268 			prev->rpcb_next = rbl;
269 		free(tmp->rpcb_map.r_addr);
270 		free(tmp->rpcb_map.r_netid);
271 		free(tmp->rpcb_map.r_owner);
272 		free(tmp);
273 	}
274 #ifdef PORTMAP
275 	if (ans)
276 		(void) del_pmaplist(regp);
277 #endif
278 	/*
279 	 * We return 1 either when the entry was not there or it
280 	 * was able to unset it.  It can come to this point only if
281 	 * atleast one of the conditions is true.
282 	 */
283 	return (1);
284 }
285 
286 void
287 delete_prog(unsigned int prog)
288 {
289 	RPCB reg;
290 	register rpcblist_ptr rbl;
291 
292 	for (rbl = list_rbl; rbl != NULL; rbl = rbl->rpcb_next) {
293 		if ((rbl->rpcb_map.r_prog != prog))
294 			continue;
295 		if (is_bound(rbl->rpcb_map.r_netid, rbl->rpcb_map.r_addr))
296 			continue;
297 		reg.r_prog = rbl->rpcb_map.r_prog;
298 		reg.r_vers = rbl->rpcb_map.r_vers;
299 		reg.r_netid = strdup(rbl->rpcb_map.r_netid);
300 		(void) map_unset(&reg, "superuser");
301 		free(reg.r_netid);
302 	}
303 }
304 
305 void *
306 rpcbproc_getaddr_com(RPCB *regp, struct svc_req *rqstp __unused,
307 		     SVCXPRT *transp, rpcvers_t rpcbversnum, rpcvers_t verstype)
308 {
309 	static char *uaddr;
310 	char *saddr = NULL;
311 	rpcblist_ptr fnd;
312 
313 	if (uaddr != NULL && uaddr != nullstring) {
314 		free(uaddr);
315 		uaddr = NULL;
316 	}
317 	fnd = find_service(regp->r_prog, regp->r_vers, transp->xp_netid);
318 	if (fnd && ((verstype == RPCB_ALLVERS) ||
319 		    (regp->r_vers == fnd->rpcb_map.r_vers))) {
320 		if (*(regp->r_addr) != '\0') {  /* may contain a hint about */
321 			saddr = regp->r_addr;   /* the interface that we    */
322 		}				/* should use */
323 		if (!(uaddr = mergeaddr(transp, transp->xp_netid,
324 				fnd->rpcb_map.r_addr, saddr))) {
325 			/* Try whatever we have */
326 			uaddr = strdup(fnd->rpcb_map.r_addr);
327 		} else if (!uaddr[0]) {
328 			/*
329 			 * The server died.  Unset all versions of this prog.
330 			 */
331 			delete_prog(regp->r_prog);
332 			uaddr = nullstring;
333 		}
334 	} else {
335 		uaddr = nullstring;
336 	}
337 #ifdef RPCBIND_DEBUG
338 	if (debugging)
339 		fprintf(stderr, "getaddr: %s\n", uaddr);
340 #endif
341 	/* XXX: should have used some defined constant here */
342 	rpcbs_getaddr(rpcbversnum - 2, regp->r_prog, regp->r_vers,
343 		transp->xp_netid, uaddr);
344 	return (void *)&uaddr;
345 }
346 
347 /* ARGSUSED */
348 void *
349 rpcbproc_gettime_com(void *arg __unused, struct svc_req *rqstp __unused,
350 		     SVCXPRT *transp __unused, rpcvers_t rpcbversnum __unused)
351 {
352 	static time_t curtime;
353 
354 	(void) time(&curtime);
355 	return (void *)&curtime;
356 }
357 
358 /*
359  * Convert uaddr to taddr. Should be used only by
360  * local servers/clients. (kernel level stuff only)
361  */
362 /* ARGSUSED */
363 void *
364 rpcbproc_uaddr2taddr_com(void *arg, struct svc_req *rqstp __unused,
365 			 SVCXPRT *transp, rpcvers_t rpcbversnum __unused)
366 {
367 	char **uaddrp = (char **)arg;
368 	struct netconfig *nconf;
369 	static struct netbuf nbuf;
370 	static struct netbuf *taddr;
371 
372 	if (taddr) {
373 		free(taddr->buf);
374 		free(taddr);
375 		taddr = NULL;
376 	}
377 	if (((nconf = rpcbind_get_conf(transp->xp_netid)) == NULL) ||
378 	    ((taddr = uaddr2taddr(nconf, *uaddrp)) == NULL)) {
379 		(void) memset((char *)&nbuf, 0, sizeof (struct netbuf));
380 		return (void *)&nbuf;
381 	}
382 	return (void *)taddr;
383 }
384 
385 /*
386  * Convert taddr to uaddr. Should be used only by
387  * local servers/clients. (kernel level stuff only)
388  */
389 /* ARGSUSED */
390 void *
391 rpcbproc_taddr2uaddr_com(void *arg, struct svc_req *rqstp __unused,
392 			 SVCXPRT *transp, rpcvers_t rpcbversnum __unused)
393 {
394 	struct netbuf *taddr = (struct netbuf *)arg;
395 	static char *uaddr;
396 	struct netconfig *nconf;
397 
398 #ifdef CHEW_FDS
399 	int fd;
400 
401 	if ((fd = open("/dev/null", O_RDONLY)) == -1) {
402 		uaddr = (char *)strerror(errno);
403 		return (&uaddr);
404 	}
405 #endif /* CHEW_FDS */
406 	if (uaddr != NULL && uaddr != nullstring) {
407 		free(uaddr);
408 		uaddr = NULL;
409 	}
410 	if (((nconf = rpcbind_get_conf(transp->xp_netid)) == NULL) ||
411 		((uaddr = taddr2uaddr(nconf, taddr)) == NULL)) {
412 		uaddr = nullstring;
413 	}
414 	return (void *)&uaddr;
415 }
416 
417 
418 static bool_t
419 xdr_encap_parms(XDR *xdrs, struct encap_parms *epp)
420 {
421 	return (xdr_bytes(xdrs, &(epp->args), (u_int *) &(epp->arglen), ~0));
422 }
423 
424 /*
425  * XDR remote call arguments.  It ignores the address part.
426  * written for XDR_DECODE direction only
427  */
428 static bool_t
429 xdr_rmtcall_args(XDR *xdrs, struct r_rmtcall_args *cap)
430 {
431 	/* does not get the address or the arguments */
432 	if (xdr_rpcprog(xdrs, &(cap->rmt_prog)) &&
433 	    xdr_rpcvers(xdrs, &(cap->rmt_vers)) &&
434 	    xdr_rpcproc(xdrs, &(cap->rmt_proc))) {
435 		return (xdr_encap_parms(xdrs, &(cap->rmt_args)));
436 	}
437 	return (FALSE);
438 }
439 
440 /*
441  * XDR remote call results along with the address.  Ignore
442  * program number, version  number and proc number.
443  * Written for XDR_ENCODE direction only.
444  */
445 static bool_t
446 xdr_rmtcall_result(XDR *xdrs, struct r_rmtcall_args *cap)
447 {
448 	bool_t result;
449 
450 #ifdef PORTMAP
451 	if (cap->rmt_localvers == PMAPVERS) {
452 		int h1, h2, h3, h4, p1, p2;
453 		u_long port;
454 
455 		/* interpret the universal address for TCP/IP */
456 		if (sscanf(cap->rmt_uaddr, "%d.%d.%d.%d.%d.%d",
457 			&h1, &h2, &h3, &h4, &p1, &p2) != 6)
458 			return (FALSE);
459 		port = ((p1 & 0xff) << 8) + (p2 & 0xff);
460 		result = xdr_u_long(xdrs, &port);
461 	} else
462 #endif
463 		if ((cap->rmt_localvers == RPCBVERS) ||
464 		    (cap->rmt_localvers == RPCBVERS4)) {
465 		result = xdr_wrapstring(xdrs, &(cap->rmt_uaddr));
466 	} else {
467 		return (FALSE);
468 	}
469 	if (result == TRUE)
470 		return (xdr_encap_parms(xdrs, &(cap->rmt_args)));
471 	return (FALSE);
472 }
473 
474 /*
475  * only worries about the struct encap_parms part of struct r_rmtcall_args.
476  * The arglen must already be set!!
477  */
478 static bool_t
479 xdr_opaque_parms(XDR *xdrs, struct r_rmtcall_args *cap)
480 {
481 	return (xdr_opaque(xdrs, cap->rmt_args.args, cap->rmt_args.arglen));
482 }
483 
484 static struct rmtcallfd_list *rmthead;
485 static struct rmtcallfd_list *rmttail;
486 
487 int
488 create_rmtcall_fd(struct netconfig *nconf)
489 {
490 	int fd;
491 	struct rmtcallfd_list *rmt;
492 	SVCXPRT *xprt;
493 
494 	if ((fd = __rpc_nconf2fd(nconf)) == -1) {
495 		if (debugging)
496 			fprintf(stderr,
497 	"create_rmtcall_fd: couldn't open \"%s\" (errno %d)\n",
498 			nconf->nc_device, errno);
499 		return (-1);
500 	}
501 	xprt = svc_tli_create(fd, 0, (struct t_bind *) 0, 0, 0);
502 	if (xprt == NULL) {
503 		if (debugging)
504 			fprintf(stderr,
505 				"create_rmtcall_fd: svc_tli_create failed\n");
506 		return (-1);
507 	}
508 	rmt = malloc(sizeof (struct rmtcallfd_list));
509 	if (rmt == NULL) {
510 		syslog(LOG_ERR, "create_rmtcall_fd: no memory!");
511 		return (-1);
512 	}
513 	rmt->xprt = xprt;
514 	rmt->netid = strdup(nconf->nc_netid);
515 	xprt->xp_netid = rmt->netid;
516 	rmt->fd = fd;
517 	rmt->next = NULL;
518 	if (rmthead == NULL) {
519 		rmthead = rmt;
520 		rmttail = rmt;
521 	} else {
522 		rmttail->next = rmt;
523 		rmttail = rmt;
524 	}
525 	/* XXX not threadsafe */
526 	if (fd > svc_maxfd)
527 		svc_maxfd = fd;
528 	FD_SET(fd, &svc_fdset);
529 	return (fd);
530 }
531 
532 static int
533 find_rmtcallfd_by_netid(char *netid)
534 {
535 	struct rmtcallfd_list *rmt;
536 
537 	for (rmt = rmthead; rmt != NULL; rmt = rmt->next) {
538 		if (strcmp(netid, rmt->netid) == 0) {
539 			return (rmt->fd);
540 		}
541 	}
542 	return (-1);
543 }
544 
545 static SVCXPRT *
546 find_rmtcallxprt_by_fd(int fd)
547 {
548 	struct rmtcallfd_list *rmt;
549 
550 	for (rmt = rmthead; rmt != NULL; rmt = rmt->next) {
551 		if (fd == rmt->fd) {
552 			return (rmt->xprt);
553 		}
554 	}
555 	return (NULL);
556 }
557 
558 
559 /*
560  * Call a remote procedure service.  This procedure is very quiet when things
561  * go wrong.  The proc is written to support broadcast rpc.  In the broadcast
562  * case, a machine should shut-up instead of complain, lest the requestor be
563  * overrun with complaints at the expense of not hearing a valid reply.
564  * When receiving a request and verifying that the service exists, we
565  *
566  *	receive the request
567  *
568  *	open a new TLI endpoint on the same transport on which we received
569  *	the original request
570  *
571  *	remember the original request's XID (which requires knowing the format
572  *	of the svc_dg_data structure)
573  *
574  *	forward the request, with a new XID, to the requested service,
575  *	remembering the XID used to send this request (for later use in
576  *	reassociating the answer with the original request), the requestor's
577  *	address, the file descriptor on which the forwarded request is
578  *	made and the service's address.
579  *
580  *	mark the file descriptor on which we anticipate receiving a reply from
581  *	the service and one to select for in our private svc_run procedure
582  *
583  * At some time in the future, a reply will be received from the service to
584  * which we forwarded the request.  At that time, we detect that the socket
585  * used was for forwarding (by looking through the finfo structures to see
586  * whether the fd corresponds to one of those) and call handle_reply() to
587  *
588  *	receive the reply
589  *
590  *	bundle the reply, along with the service's universal address
591  *
592  *	create a SVCXPRT structure and use a version of svc_sendreply
593  *	that allows us to specify the reply XID and destination, send the reply
594  *	to the original requestor.
595  */
596 
597 void
598 rpcbproc_callit_com(struct svc_req *rqstp, SVCXPRT *transp,
599 		    rpcproc_t reply_type, rpcvers_t versnum)
600 {
601 	register rpcblist_ptr rbl;
602 	struct netconfig *nconf;
603 	struct netbuf *caller;
604 	struct r_rmtcall_args a;
605 	char *buf_alloc = NULL, *outbufp;
606 	char *outbuf_alloc = NULL;
607 	char buf[RPC_BUF_MAX], outbuf[RPC_BUF_MAX];
608 	struct netbuf *na = (struct netbuf *) NULL;
609 	struct rpc_msg call_msg;
610 	int outlen;
611 	u_int sendsz;
612 	XDR outxdr;
613 	AUTH *auth;
614 	int fd = -1;
615 	char *uaddr, *m_uaddr = NULL, *local_uaddr = NULL;
616 	u_int32_t *xidp;
617 	struct __rpc_sockinfo si;
618 	struct sockaddr *localsa;
619 	struct netbuf tbuf;
620 
621 	if (!__rpc_fd2sockinfo(transp->xp_fd, &si)) {
622 		if (reply_type == RPCBPROC_INDIRECT)
623 			svcerr_systemerr(transp);
624 		return;
625 	}
626 	if (si.si_socktype != SOCK_DGRAM)
627 		return;	/* Only datagram type accepted */
628 	sendsz = __rpc_get_t_size(si.si_af, si.si_proto, UDPMSGSIZE);
629 	if (sendsz == 0) {	/* data transfer not supported */
630 		if (reply_type == RPCBPROC_INDIRECT)
631 			svcerr_systemerr(transp);
632 		return;
633 	}
634 	/*
635 	 * Should be multiple of 4 for XDR.
636 	 */
637 	sendsz = roundup(sendsz, 4);
638 	if (sendsz > RPC_BUF_MAX) {
639 #ifdef	notyet
640 		buf_alloc = alloca(sendsz);		/* not in IDR2? */
641 #else
642 		buf_alloc = malloc(sendsz);
643 #endif	/* notyet */
644 		if (buf_alloc == NULL) {
645 			if (debugging)
646 				fprintf(stderr,
647 					"rpcbproc_callit_com:  No Memory!\n");
648 			if (reply_type == RPCBPROC_INDIRECT)
649 				svcerr_systemerr(transp);
650 			return;
651 		}
652 		a.rmt_args.args = buf_alloc;
653 	} else {
654 		a.rmt_args.args = buf;
655 	}
656 
657 	call_msg.rm_xid = 0;	/* For error checking purposes */
658 	if (!svc_getargs(transp, (xdrproc_t) xdr_rmtcall_args, (char *) &a)) {
659 		if (reply_type == RPCBPROC_INDIRECT)
660 			svcerr_decode(transp);
661 		if (debugging)
662 			fprintf(stderr,
663 			"rpcbproc_callit_com:  svc_getargs failed\n");
664 		goto error;
665 	}
666 
667 	if (!check_callit(transp, &a, versnum)) {
668 		svcerr_weakauth(transp);
669 		goto error;
670 	}
671 
672 	caller = svc_getrpccaller(transp);
673 #ifdef RPCBIND_DEBUG
674 	if (debugging) {
675 		uaddr = taddr2uaddr(rpcbind_get_conf(transp->xp_netid), caller);
676 		fprintf(stderr, "%s %s req for (%lu, %lu, %lu, %s) from %s : ",
677 			versnum == PMAPVERS ? "pmap_rmtcall" :
678 			versnum == RPCBVERS ? "rpcb_rmtcall" :
679 			versnum == RPCBVERS4 ? "rpcb_indirect" : "unknown",
680 			reply_type == RPCBPROC_INDIRECT ? "indirect" : "callit",
681 			(unsigned long)a.rmt_prog, (unsigned long)a.rmt_vers,
682 			(unsigned long)a.rmt_proc, transp->xp_netid,
683 			uaddr ? uaddr : "unknown");
684 		if (uaddr)
685 			free(uaddr);
686 	}
687 #endif
688 
689 	rbl = find_service(a.rmt_prog, a.rmt_vers, transp->xp_netid);
690 
691 	rpcbs_rmtcall(versnum - 2, reply_type, a.rmt_prog, a.rmt_vers,
692 			a.rmt_proc, transp->xp_netid, rbl);
693 
694 	if (rbl == (rpcblist_ptr)NULL) {
695 #ifdef RPCBIND_DEBUG
696 		if (debugging)
697 			fprintf(stderr, "not found\n");
698 #endif
699 		if (reply_type == RPCBPROC_INDIRECT)
700 			svcerr_noprog(transp);
701 		goto error;
702 	}
703 	if (rbl->rpcb_map.r_vers != a.rmt_vers) {
704 		if (reply_type == RPCBPROC_INDIRECT) {
705 			rpcvers_t vers_low, vers_high;
706 
707 			find_versions(a.rmt_prog, transp->xp_netid,
708 				&vers_low, &vers_high);
709 			svcerr_progvers(transp, vers_low, vers_high);
710 		}
711 		goto error;
712 	}
713 
714 #ifdef RPCBIND_DEBUG
715 	if (debugging)
716 		fprintf(stderr, "found at uaddr %s\n", rbl->rpcb_map.r_addr);
717 #endif
718 	/*
719 	 *	Check whether this entry is valid and a server is present
720 	 *	Mergeaddr() returns NULL if no such entry is present, and
721 	 *	returns "" if the entry was present but the server is not
722 	 *	present (i.e., it crashed).
723 	 */
724 	if (reply_type == RPCBPROC_INDIRECT) {
725 		uaddr = mergeaddr(transp, transp->xp_netid,
726 			rbl->rpcb_map.r_addr, NULL);
727 		if (uaddr == NULL || uaddr[0] == '\0') {
728 			svcerr_noprog(transp);
729 			if (uaddr != NULL)
730 				free(uaddr);
731 			goto error;
732 		}
733 		free(uaddr);
734 	}
735 	nconf = rpcbind_get_conf(transp->xp_netid);
736 	if (nconf == (struct netconfig *)NULL) {
737 		if (reply_type == RPCBPROC_INDIRECT)
738 			svcerr_systemerr(transp);
739 		if (debugging)
740 			fprintf(stderr,
741 			"rpcbproc_callit_com:  rpcbind_get_conf failed\n");
742 		goto error;
743 	}
744 	localsa = local_sa(((struct sockaddr *)caller->buf)->sa_family);
745 	if (localsa == NULL) {
746 		if (debugging)
747 			fprintf(stderr,
748 			"rpcbproc_callit_com: no local address\n");
749 		goto error;
750 	}
751 	tbuf.len = tbuf.maxlen = localsa->sa_len;
752 	tbuf.buf = localsa;
753 	local_uaddr =
754 	    addrmerge(&tbuf, rbl->rpcb_map.r_addr, NULL, nconf->nc_netid);
755 	m_uaddr = addrmerge(caller, rbl->rpcb_map.r_addr, NULL,
756 			nconf->nc_netid);
757 #ifdef RPCBIND_DEBUG
758 	if (debugging)
759 		fprintf(stderr, "merged uaddr %s\n", m_uaddr);
760 #endif
761 	if ((fd = find_rmtcallfd_by_netid(nconf->nc_netid)) == -1) {
762 		if (reply_type == RPCBPROC_INDIRECT)
763 			svcerr_systemerr(transp);
764 		goto error;
765 	}
766 	xidp = __rpcb_get_dg_xidp(transp);
767 	switch (forward_register(*xidp, caller, fd, m_uaddr, reply_type,
768 	    versnum, &call_msg.rm_xid)) {
769 	case 1:
770 		/* Success; forward_register() will free m_uaddr for us. */
771 		m_uaddr = NULL;
772 		break;
773 	case 0:
774 		/*
775 		 * A duplicate request for the slow server.  Let's not
776 		 * beat on it any more.
777 		 */
778 		if (debugging)
779 			fprintf(stderr,
780 			"rpcbproc_callit_com:  duplicate request\n");
781 		goto error;
782 	case -1:
783 		/*  forward_register failed.  Perhaps no memory. */
784 		if (debugging)
785 			fprintf(stderr,
786 			"rpcbproc_callit_com:  forward_register failed\n");
787 		goto error;
788 	}
789 
790 #ifdef DEBUG_RMTCALL
791 	if (debugging)
792 		fprintf(stderr,
793 			"rpcbproc_callit_com:  original XID %x, new XID %x\n",
794 				*xidp, call_msg.rm_xid);
795 #endif
796 	call_msg.rm_direction = CALL;
797 	call_msg.rm_call.cb_rpcvers = RPC_MSG_VERSION;
798 	call_msg.rm_call.cb_prog = a.rmt_prog;
799 	call_msg.rm_call.cb_vers = a.rmt_vers;
800 	if (sendsz > RPC_BUF_MAX) {
801 #ifdef	notyet
802 		outbuf_alloc = alloca(sendsz);	/* not in IDR2? */
803 #else
804 		outbuf_alloc = malloc(sendsz);
805 #endif	/* notyet */
806 		if (outbuf_alloc == NULL) {
807 			if (reply_type == RPCBPROC_INDIRECT)
808 				svcerr_systemerr(transp);
809 			if (debugging)
810 				fprintf(stderr,
811 				"rpcbproc_callit_com:  No memory!\n");
812 			goto error;
813 		}
814 		xdrmem_create(&outxdr, outbuf_alloc, sendsz, XDR_ENCODE);
815 	} else {
816 		xdrmem_create(&outxdr, outbuf, sendsz, XDR_ENCODE);
817 	}
818 	if (!xdr_callhdr(&outxdr, &call_msg)) {
819 		if (reply_type == RPCBPROC_INDIRECT)
820 			svcerr_systemerr(transp);
821 		if (debugging)
822 			fprintf(stderr,
823 			"rpcbproc_callit_com:  xdr_callhdr failed\n");
824 		goto error;
825 	}
826 	if (!xdr_u_int32_t(&outxdr, &(a.rmt_proc))) {
827 		if (reply_type == RPCBPROC_INDIRECT)
828 			svcerr_systemerr(transp);
829 		if (debugging)
830 			fprintf(stderr,
831 			"rpcbproc_callit_com:  xdr_u_long failed\n");
832 		goto error;
833 	}
834 
835 	if (rqstp->rq_cred.oa_flavor == AUTH_NULL) {
836 		auth = authnone_create();
837 	} else if (rqstp->rq_cred.oa_flavor == AUTH_SYS) {
838 		struct authunix_parms *au;
839 
840 		au = (struct authunix_parms *)rqstp->rq_clntcred;
841 		auth = authunix_create(au->aup_machname,
842 				au->aup_uid, au->aup_gid,
843 				au->aup_len, au->aup_gids);
844 		if (auth == NULL) /* fall back */
845 			auth = authnone_create();
846 	} else {
847 		/* we do not support any other authentication scheme */
848 		if (debugging)
849 			fprintf(stderr,
850 "rpcbproc_callit_com:  oa_flavor != AUTH_NONE and oa_flavor != AUTH_SYS\n");
851 		if (reply_type == RPCBPROC_INDIRECT)
852 			svcerr_weakauth(transp); /* XXX too strong.. */
853 		goto error;
854 	}
855 	if (auth == NULL) {
856 		if (reply_type == RPCBPROC_INDIRECT)
857 			svcerr_systemerr(transp);
858 		if (debugging)
859 			fprintf(stderr,
860 		"rpcbproc_callit_com:  authwhatever_create returned NULL\n");
861 		goto error;
862 	}
863 	if (!AUTH_MARSHALL(auth, &outxdr)) {
864 		if (reply_type == RPCBPROC_INDIRECT)
865 			svcerr_systemerr(transp);
866 		AUTH_DESTROY(auth);
867 		if (debugging)
868 			fprintf(stderr,
869 		"rpcbproc_callit_com:  AUTH_MARSHALL failed\n");
870 		goto error;
871 	}
872 	AUTH_DESTROY(auth);
873 	if (!xdr_opaque_parms(&outxdr, &a)) {
874 		if (reply_type == RPCBPROC_INDIRECT)
875 			svcerr_systemerr(transp);
876 		if (debugging)
877 			fprintf(stderr,
878 		"rpcbproc_callit_com:  xdr_opaque_parms failed\n");
879 		goto error;
880 	}
881 	outlen = (int) XDR_GETPOS(&outxdr);
882 	if (outbuf_alloc)
883 		outbufp = outbuf_alloc;
884 	else
885 		outbufp = outbuf;
886 
887 	na = uaddr2taddr(nconf, local_uaddr);
888 	if (!na) {
889 		if (reply_type == RPCBPROC_INDIRECT)
890 			svcerr_systemerr(transp);
891 		goto error;
892 	}
893 
894 	if (sendto(fd, outbufp, outlen, 0, (struct sockaddr *)na->buf, na->len)
895 	    != outlen) {
896 		if (debugging)
897 			fprintf(stderr,
898 	"rpcbproc_callit_com:  sendto failed:  errno %d\n", errno);
899 		if (reply_type == RPCBPROC_INDIRECT)
900 			svcerr_systemerr(transp);
901 		goto error;
902 	}
903 	goto out;
904 
905 error:
906 	if (call_msg.rm_xid != 0)
907 		(void) free_slot_by_xid(call_msg.rm_xid);
908 out:
909 	if (local_uaddr)
910 		free(local_uaddr);
911 	if (buf_alloc)
912 		free(buf_alloc);
913 	if (outbuf_alloc)
914 		free(outbuf_alloc);
915 	if (na) {
916 		free(na->buf);
917 		free(na);
918 	}
919 	if (m_uaddr != NULL)
920 		free(m_uaddr);
921 }
922 
923 /*
924  * Makes an entry into the FIFO for the given request.
925  * Returns 1 on success, 0 if this is a duplicate request, or -1 on error.
926  * *callxidp is set to the xid of the call.
927  */
928 static int
929 forward_register(u_int32_t caller_xid, struct netbuf *caller_addr,
930 		 int forward_fd, char *uaddr, rpcproc_t reply_type,
931 		 rpcvers_t versnum, u_int32_t *callxidp)
932 {
933 	int		i;
934 	int		j = 0;
935 	time_t		min_time, time_now;
936 	static u_int32_t	lastxid;
937 	int		entry = -1;
938 
939 	min_time = FINFO[0].time;
940 	time_now = time((time_t *)0);
941 	/* initialization */
942 	if (lastxid == 0)
943 		lastxid = time_now * NFORWARD;
944 
945 	/*
946 	 * Check if it is a duplicate entry. Then,
947 	 * try to find an empty slot.  If not available, then
948 	 * use the slot with the earliest time.
949 	 */
950 	for (i = 0; i < NFORWARD; i++) {
951 		if (FINFO[i].flag & FINFO_ACTIVE) {
952 			if ((FINFO[i].caller_xid == caller_xid) &&
953 			    (FINFO[i].reply_type == reply_type) &&
954 			    (FINFO[i].versnum == versnum) &&
955 			    (!netbufcmp(FINFO[i].caller_addr,
956 					    caller_addr))) {
957 				FINFO[i].time = time((time_t *)0);
958 				return (0);	/* Duplicate entry */
959 			} else {
960 				/* Should we wait any longer */
961 				if ((time_now - FINFO[i].time) > MAXTIME_OFF)
962 					(void) free_slot_by_index(i);
963 			}
964 		}
965 		if (entry == -1) {
966 			if ((FINFO[i].flag & FINFO_ACTIVE) == 0) {
967 				entry = i;
968 			} else if (FINFO[i].time < min_time) {
969 				j = i;
970 				min_time = FINFO[i].time;
971 			}
972 		}
973 	}
974 	if (entry != -1) {
975 		/* use this empty slot */
976 		j = entry;
977 	} else {
978 		(void) free_slot_by_index(j);
979 	}
980 	if ((FINFO[j].caller_addr = netbufdup(caller_addr)) == NULL) {
981 		return (-1);
982 	}
983 	rpcb_rmtcalls++;	/* no of pending calls */
984 	FINFO[j].flag = FINFO_ACTIVE;
985 	FINFO[j].reply_type = reply_type;
986 	FINFO[j].versnum = versnum;
987 	FINFO[j].time = time_now;
988 	FINFO[j].caller_xid = caller_xid;
989 	FINFO[j].forward_fd = forward_fd;
990 	/*
991 	 * Though uaddr is not allocated here, it will still be freed
992 	 * from free_slot_*().
993 	 */
994 	FINFO[j].uaddr = uaddr;
995 	lastxid = lastxid + NFORWARD;
996 	/* Don't allow a zero xid below. */
997 	if ((u_int32_t)(lastxid + NFORWARD) <= NFORWARD)
998 		lastxid = NFORWARD;
999 	FINFO[j].forward_xid = lastxid + j;	/* encode slot */
1000 	*callxidp = FINFO[j].forward_xid;	/* forward on this xid */
1001 	return (1);
1002 }
1003 
1004 static struct finfo *
1005 forward_find(u_int32_t reply_xid)
1006 {
1007 	int		i;
1008 
1009 	i = reply_xid % (u_int32_t)NFORWARD;
1010 	if ((FINFO[i].flag & FINFO_ACTIVE) &&
1011 	    (FINFO[i].forward_xid == reply_xid)) {
1012 		return (&FINFO[i]);
1013 	}
1014 	return (NULL);
1015 }
1016 
1017 static int
1018 free_slot_by_xid(u_int32_t xid)
1019 {
1020 	int entry;
1021 
1022 	entry = xid % (u_int32_t)NFORWARD;
1023 	return (free_slot_by_index(entry));
1024 }
1025 
1026 static int
1027 free_slot_by_index(int index)
1028 {
1029 	struct finfo	*fi;
1030 
1031 	fi = &FINFO[index];
1032 	if (fi->flag & FINFO_ACTIVE) {
1033 		netbuffree(fi->caller_addr);
1034 		/* XXX may be too big, but can't access xprt array here */
1035 		if (fi->forward_fd >= svc_maxfd)
1036 			svc_maxfd--;
1037 		free(fi->uaddr);
1038 		fi->flag &= ~FINFO_ACTIVE;
1039 		rpcb_rmtcalls--;
1040 		return (1);
1041 	}
1042 	return (0);
1043 }
1044 
1045 static int
1046 netbufcmp(struct netbuf *n1, struct netbuf *n2)
1047 {
1048 	return ((n1->len != n2->len) || memcmp(n1->buf, n2->buf, n1->len));
1049 }
1050 
1051 static bool_t
1052 netbuf_copybuf(struct netbuf *dst, const struct netbuf *src)
1053 {
1054 	assert(src->len <= src->maxlen);
1055 
1056 	if (dst->maxlen < src->len || dst->buf == NULL) {
1057 		if (dst->buf != NULL)
1058 			free(dst->buf);
1059 		if ((dst->buf = calloc(1, src->maxlen)) == NULL)
1060 			return (FALSE);
1061 		dst->maxlen = src->maxlen;
1062 	}
1063 
1064 	dst->len = src->len;
1065 	memcpy(dst->buf, src->buf, src->len);
1066 
1067 	return (TRUE);
1068 }
1069 
1070 static struct netbuf *
1071 netbufdup(struct netbuf *ap)
1072 {
1073 	struct netbuf  *np;
1074 
1075 	if ((np = calloc(1, sizeof(struct netbuf))) == NULL)
1076 		return (NULL);
1077 	if (netbuf_copybuf(np, ap) == FALSE) {
1078 		free(np);
1079 		return (NULL);
1080 	}
1081 	return (np);
1082 }
1083 
1084 static void
1085 netbuffree(struct netbuf *ap)
1086 {
1087 	free(ap->buf);
1088 	ap->buf = NULL;
1089 	free(ap);
1090 }
1091 
1092 
1093 #define	MASKVAL	(POLLIN | POLLPRI | POLLRDNORM | POLLRDBAND)
1094 extern bool_t __svc_clean_idle(fd_set *, int, bool_t);
1095 
1096 void
1097 my_svc_run(void)
1098 {
1099 	size_t nfds;
1100 	struct pollfd pollfds[FD_SETSIZE];
1101 	int poll_ret, check_ret;
1102 	int n;
1103 #ifdef SVC_RUN_DEBUG
1104 	int i;
1105 #endif
1106 	register struct pollfd	*p;
1107 	fd_set cleanfds;
1108 
1109 	for (;;) {
1110 		p = pollfds;
1111 		for (n = 0; n <= svc_maxfd; n++) {
1112 			if (FD_ISSET(n, &svc_fdset)) {
1113 				p->fd = n;
1114 				p->events = MASKVAL;
1115 				p++;
1116 			}
1117 		}
1118 		nfds = p - pollfds;
1119 		poll_ret = 0;
1120 #ifdef SVC_RUN_DEBUG
1121 		if (debugging) {
1122 			fprintf(stderr, "polling for read on fd < ");
1123 			for (i = 0, p = pollfds; i < nfds; i++, p++)
1124 				if (p->events)
1125 					fprintf(stderr, "%d ", p->fd);
1126 			fprintf(stderr, ">\n");
1127 		}
1128 #endif
1129 		switch (poll_ret = poll(pollfds, nfds, 30 * 1000)) {
1130 		case -1:
1131 			/*
1132 			 * We ignore all errors, continuing with the assumption
1133 			 * that it was set by the signal handlers (or any
1134 			 * other outside event) and not caused by poll().
1135 			 */
1136 		case 0:
1137 			cleanfds = svc_fdset;
1138 			__svc_clean_idle(&cleanfds, 30, FALSE);
1139 			continue;
1140 		default:
1141 #ifdef SVC_RUN_DEBUG
1142 			if (debugging) {
1143 				fprintf(stderr, "poll returned read fds < ");
1144 				for (i = 0, p = pollfds; i < nfds; i++, p++)
1145 					if (p->revents)
1146 						fprintf(stderr, "%d ", p->fd);
1147 				fprintf(stderr, ">\n");
1148 			}
1149 #endif
1150 			/*
1151 			 * If we found as many replies on callback fds
1152 			 * as the number of descriptors selectable which
1153 			 * poll() returned, there can be no more so we
1154 			 * don't call svc_getreq_poll.  Otherwise, there
1155 			 * must be another so we must call svc_getreq_poll.
1156 			 */
1157 			if ((check_ret = check_rmtcalls(pollfds, nfds)) ==
1158 			    poll_ret)
1159 				continue;
1160 			svc_getreq_poll(pollfds, poll_ret-check_ret);
1161 		}
1162 #ifdef SVC_RUN_DEBUG
1163 		if (debugging) {
1164 			fprintf(stderr, "svc_maxfd now %u\n", svc_maxfd);
1165 		}
1166 #endif
1167 	}
1168 }
1169 
1170 static int
1171 check_rmtcalls(struct pollfd *pfds, int nfds)
1172 {
1173 	int j, ncallbacks_found = 0, rmtcalls_pending;
1174 	SVCXPRT *xprt;
1175 
1176 	if (rpcb_rmtcalls == 0)
1177 		return (0);
1178 
1179 	rmtcalls_pending = rpcb_rmtcalls;
1180 	for (j = 0; j < nfds; j++) {
1181 		if ((xprt = find_rmtcallxprt_by_fd(pfds[j].fd)) != NULL) {
1182 			if (pfds[j].revents) {
1183 				ncallbacks_found++;
1184 #ifdef DEBUG_RMTCALL
1185 			if (debugging)
1186 				fprintf(stderr,
1187 "my_svc_run:  polled on forwarding fd %d, netid %s - calling handle_reply\n",
1188 		pfds[j].fd, xprt->xp_netid);
1189 #endif
1190 				handle_reply(pfds[j].fd, xprt);
1191 				pfds[j].revents = 0;
1192 				if (ncallbacks_found >= rmtcalls_pending) {
1193 					break;
1194 				}
1195 			}
1196 		}
1197 	}
1198 	return (ncallbacks_found);
1199 }
1200 
1201 static void
1202 xprt_set_caller(SVCXPRT *xprt, struct finfo *fi)
1203 {
1204 	u_int32_t *xidp;
1205 
1206 	netbuf_copybuf(svc_getrpccaller(xprt), fi->caller_addr);
1207 	xidp = __rpcb_get_dg_xidp(xprt);
1208 	*xidp = fi->caller_xid;
1209 }
1210 
1211 /*
1212  * Call svcerr_systemerr() only if RPCBVERS4
1213  */
1214 static void
1215 send_svcsyserr(SVCXPRT *xprt, struct finfo *fi)
1216 {
1217 	if (fi->reply_type == RPCBPROC_INDIRECT) {
1218 		xprt_set_caller(xprt, fi);
1219 		svcerr_systemerr(xprt);
1220 	}
1221 	return;
1222 }
1223 
1224 static void
1225 handle_reply(int fd, SVCXPRT *xprt)
1226 {
1227 	XDR		reply_xdrs;
1228 	struct rpc_msg	reply_msg;
1229 	struct rpc_err	reply_error;
1230 	char		*buffer;
1231 	struct finfo	*fi;
1232 	int		inlen, pos, len;
1233 	struct r_rmtcall_args a;
1234 	struct sockaddr_storage ss;
1235 	socklen_t fromlen;
1236 #ifdef SVC_RUN_DEBUG
1237 	char *uaddr;
1238 #endif
1239 
1240 	buffer = malloc(RPC_BUF_MAX);
1241 	if (buffer == NULL)
1242 		goto done;
1243 
1244 	do {
1245 		fromlen = sizeof(ss);
1246 		inlen = recvfrom(fd, buffer, RPC_BUF_MAX, 0,
1247 			    (struct sockaddr *)&ss, &fromlen);
1248 	} while (inlen < 0 && errno == EINTR);
1249 	if (inlen < 0) {
1250 		if (debugging)
1251 			fprintf(stderr,
1252 	"handle_reply:  recvfrom returned %d, errno %d\n", inlen, errno);
1253 		goto done;
1254 	}
1255 
1256 	reply_msg.acpted_rply.ar_verf = _null_auth;
1257 	reply_msg.acpted_rply.ar_results.where = 0;
1258 	reply_msg.acpted_rply.ar_results.proc = (xdrproc_t) xdr_void;
1259 
1260 	xdrmem_create(&reply_xdrs, buffer, (u_int)inlen, XDR_DECODE);
1261 	if (!xdr_replymsg(&reply_xdrs, &reply_msg)) {
1262 		if (debugging)
1263 			(void) fprintf(stderr,
1264 				"handle_reply:  xdr_replymsg failed\n");
1265 		goto done;
1266 	}
1267 	fi = forward_find(reply_msg.rm_xid);
1268 #ifdef	SVC_RUN_DEBUG
1269 	if (debugging) {
1270 		fprintf(stderr, "handle_reply:  reply xid: %d fi addr: %p\n",
1271 			reply_msg.rm_xid, fi);
1272 	}
1273 #endif
1274 	if (fi == NULL) {
1275 		goto done;
1276 	}
1277 	_seterr_reply(&reply_msg, &reply_error);
1278 	if (reply_error.re_status != RPC_SUCCESS) {
1279 		if (debugging)
1280 			(void) fprintf(stderr, "handle_reply:  %s\n",
1281 				clnt_sperrno(reply_error.re_status));
1282 		send_svcsyserr(xprt, fi);
1283 		goto done;
1284 	}
1285 	pos = XDR_GETPOS(&reply_xdrs);
1286 	len = inlen - pos;
1287 	a.rmt_args.args = &buffer[pos];
1288 	a.rmt_args.arglen = len;
1289 	a.rmt_uaddr = fi->uaddr;
1290 	a.rmt_localvers = fi->versnum;
1291 
1292 	xprt_set_caller(xprt, fi);
1293 #ifdef	SVC_RUN_DEBUG
1294 	uaddr =	taddr2uaddr(rpcbind_get_conf("udp"),
1295 				    svc_getrpccaller(xprt));
1296 	if (debugging) {
1297 		fprintf(stderr, "handle_reply:  forwarding address %s to %s\n",
1298 			a.rmt_uaddr, uaddr ? uaddr : "unknown");
1299 	}
1300 	if (uaddr)
1301 		free(uaddr);
1302 #endif
1303 	svc_sendreply(xprt, (xdrproc_t) xdr_rmtcall_result, (char *) &a);
1304 done:
1305 	if (buffer)
1306 		free(buffer);
1307 
1308 	if (reply_msg.rm_xid == 0) {
1309 #ifdef	SVC_RUN_DEBUG
1310 	if (debugging) {
1311 		fprintf(stderr, "handle_reply:  NULL xid on exit!\n");
1312 	}
1313 #endif
1314 	} else
1315 		(void) free_slot_by_xid(reply_msg.rm_xid);
1316 	return;
1317 }
1318 
1319 static void
1320 find_versions(rpcprog_t prog, char *netid, rpcvers_t *lowvp, rpcvers_t *highvp)
1321 {
1322 	register rpcblist_ptr rbl;
1323 	unsigned int lowv = 0;
1324 	unsigned int highv = 0;
1325 
1326 	for (rbl = list_rbl; rbl != NULL; rbl = rbl->rpcb_next) {
1327 		if ((rbl->rpcb_map.r_prog != prog) ||
1328 		    ((rbl->rpcb_map.r_netid != NULL) &&
1329 			(strcasecmp(rbl->rpcb_map.r_netid, netid) != 0)))
1330 			continue;
1331 		if (lowv == 0) {
1332 			highv = rbl->rpcb_map.r_vers;
1333 			lowv = highv;
1334 		} else if (rbl->rpcb_map.r_vers < lowv) {
1335 			lowv = rbl->rpcb_map.r_vers;
1336 		} else if (rbl->rpcb_map.r_vers > highv) {
1337 			highv = rbl->rpcb_map.r_vers;
1338 		}
1339 	}
1340 	*lowvp = lowv;
1341 	*highvp = highv;
1342 	return;
1343 }
1344 
1345 /*
1346  * returns the item with the given program, version number and netid.
1347  * If that version number is not found, it returns the item with that
1348  * program number, so that address is now returned to the caller. The
1349  * caller when makes a call to this program, version number, the call
1350  * will fail and it will return with PROGVERS_MISMATCH. The user can
1351  * then determine the highest and the lowest version number for this
1352  * program using clnt_geterr() and use those program version numbers.
1353  *
1354  * Returns the RPCBLIST for the given prog, vers and netid
1355  */
1356 static rpcblist_ptr
1357 find_service(rpcprog_t prog, rpcvers_t vers, char *netid)
1358 {
1359 	register rpcblist_ptr hit = NULL;
1360 	register rpcblist_ptr rbl;
1361 
1362 	for (rbl = list_rbl; rbl != NULL; rbl = rbl->rpcb_next) {
1363 		if ((rbl->rpcb_map.r_prog != prog) ||
1364 		    ((rbl->rpcb_map.r_netid != NULL) &&
1365 			(strcasecmp(rbl->rpcb_map.r_netid, netid) != 0)))
1366 			continue;
1367 		hit = rbl;
1368 		if (rbl->rpcb_map.r_vers == vers)
1369 			break;
1370 	}
1371 	return (hit);
1372 }
1373 
1374 /*
1375  * Copies the name associated with the uid of the caller and returns
1376  * a pointer to it.  Similar to getwd().
1377  */
1378 static char *
1379 getowner(SVCXPRT *transp, char *owner, size_t ownersize)
1380 {
1381 	uid_t uid;
1382 
1383 	if (__rpc_get_local_uid(transp, &uid) < 0)
1384                 strlcpy(owner, "unknown", ownersize);
1385 	else if (uid == 0)
1386 		strlcpy(owner, "superuser", ownersize);
1387 	else
1388 		snprintf(owner, ownersize, "%d", uid);
1389 
1390 	return owner;
1391 }
1392 
1393 #ifdef PORTMAP
1394 /*
1395  * Add this to the pmap list only if it is UDP or TCP.
1396  */
1397 static int
1398 add_pmaplist(RPCB *arg)
1399 {
1400 	struct pmap pmap;
1401 	struct pmaplist *pml;
1402 	int h1, h2, h3, h4, p1, p2;
1403 
1404 	if (strcmp(arg->r_netid, udptrans) == 0) {
1405 		/* It is UDP! */
1406 		pmap.pm_prot = IPPROTO_UDP;
1407 	} else if (strcmp(arg->r_netid, tcptrans) == 0) {
1408 		/* It is TCP */
1409 		pmap.pm_prot = IPPROTO_TCP;
1410 	} else
1411 		/* Not an IP protocol */
1412 		return (0);
1413 
1414 	/* interpret the universal address for TCP/IP */
1415 	if (sscanf(arg->r_addr, "%d.%d.%d.%d.%d.%d",
1416 		&h1, &h2, &h3, &h4, &p1, &p2) != 6)
1417 		return (0);
1418 	pmap.pm_port = ((p1 & 0xff) << 8) + (p2 & 0xff);
1419 	pmap.pm_prog = arg->r_prog;
1420 	pmap.pm_vers = arg->r_vers;
1421 	/*
1422 	 * add to END of list
1423 	 */
1424 	pml = malloc(sizeof (struct pmaplist));
1425 	if (pml == NULL) {
1426 		(void) syslog(LOG_ERR, "rpcbind: no memory!\n");
1427 		return (1);
1428 	}
1429 	pml->pml_map = pmap;
1430 	pml->pml_next = NULL;
1431 	if (list_pml == NULL) {
1432 		list_pml = pml;
1433 	} else {
1434 		struct pmaplist *fnd;
1435 
1436 		/* Attach to the end of the list */
1437 		for (fnd = list_pml; fnd->pml_next; fnd = fnd->pml_next)
1438 			;
1439 		fnd->pml_next = pml;
1440 	}
1441 	return (0);
1442 }
1443 
1444 /*
1445  * Delete this from the pmap list only if it is UDP or TCP.
1446  */
1447 static int
1448 del_pmaplist(RPCB *arg)
1449 {
1450 	struct pmaplist *pml;
1451 	struct pmaplist *prevpml, *fnd;
1452 	unsigned long prot;
1453 
1454 	if (strcmp(arg->r_netid, udptrans) == 0) {
1455 		/* It is UDP! */
1456 		prot = IPPROTO_UDP;
1457 	} else if (strcmp(arg->r_netid, tcptrans) == 0) {
1458 		/* It is TCP */
1459 		prot = IPPROTO_TCP;
1460 	} else if (arg->r_netid[0] == 0) {
1461 		prot = 0;	/* Remove all occurrences */
1462 	} else {
1463 		/* Not an IP protocol */
1464 		return (0);
1465 	}
1466 	for (prevpml = NULL, pml = list_pml; pml; /* cstyle */) {
1467 		if ((pml->pml_map.pm_prog != arg->r_prog) ||
1468 			(pml->pml_map.pm_vers != arg->r_vers) ||
1469 			(prot && (pml->pml_map.pm_prot != prot))) {
1470 			/* both pml & prevpml move forwards */
1471 			prevpml = pml;
1472 			pml = pml->pml_next;
1473 			continue;
1474 		}
1475 		/* found it; pml moves forward, prevpml stays */
1476 		fnd = pml;
1477 		pml = pml->pml_next;
1478 		if (prevpml == NULL)
1479 			list_pml = pml;
1480 		else
1481 			prevpml->pml_next = pml;
1482 		free(fnd);
1483 	}
1484 	return (0);
1485 }
1486 #endif /* PORTMAP */
1487