17c478bd9Sstevel@tonic-gate /*
2*0b4fd3b1SSurya Prakki * Copyright 2010 Sun Microsystems, Inc. All rights reserved.
37c478bd9Sstevel@tonic-gate * Use is subject to license terms.
47c478bd9Sstevel@tonic-gate */
57c478bd9Sstevel@tonic-gate
67c478bd9Sstevel@tonic-gate /*
77c478bd9Sstevel@tonic-gate * Copyright (c) 1983 Regents of the University of California.
87c478bd9Sstevel@tonic-gate * All rights reserved. The Berkeley software License Agreement
97c478bd9Sstevel@tonic-gate * specifies the terms and conditions for redistribution.
107c478bd9Sstevel@tonic-gate *
117c478bd9Sstevel@tonic-gate */
127c478bd9Sstevel@tonic-gate
137c478bd9Sstevel@tonic-gate #define _FILE_OFFSET_BITS 64
147c478bd9Sstevel@tonic-gate
157c478bd9Sstevel@tonic-gate #include <sys/time.h>
167c478bd9Sstevel@tonic-gate #include <sys/types.h>
177c478bd9Sstevel@tonic-gate #include <sys/socket.h>
187c478bd9Sstevel@tonic-gate #include <sys/ioctl.h>
197c478bd9Sstevel@tonic-gate /* just for FIONBIO ... */
207c478bd9Sstevel@tonic-gate #include <sys/filio.h>
217c478bd9Sstevel@tonic-gate #include <sys/stat.h>
227c478bd9Sstevel@tonic-gate #include <sys/select.h>
237c478bd9Sstevel@tonic-gate
247c478bd9Sstevel@tonic-gate #include <netinet/in.h>
257c478bd9Sstevel@tonic-gate
267c478bd9Sstevel@tonic-gate #include <assert.h>
277c478bd9Sstevel@tonic-gate #include <fcntl.h>
287c478bd9Sstevel@tonic-gate #include <stdlib.h>
297c478bd9Sstevel@tonic-gate #include <string.h>
307c478bd9Sstevel@tonic-gate #include <unistd.h>
317c478bd9Sstevel@tonic-gate #include <stdio.h>
327c478bd9Sstevel@tonic-gate #include <errno.h>
337c478bd9Sstevel@tonic-gate #include <signal.h>
347c478bd9Sstevel@tonic-gate #include <pwd.h>
357c478bd9Sstevel@tonic-gate #include <netdb.h>
367c478bd9Sstevel@tonic-gate #include <locale.h>
377c478bd9Sstevel@tonic-gate #include <priv_utils.h>
387c478bd9Sstevel@tonic-gate
397c478bd9Sstevel@tonic-gate #include <k5-int.h>
407c478bd9Sstevel@tonic-gate #include <profile/prof_int.h>
417c478bd9Sstevel@tonic-gate #include <com_err.h>
427c478bd9Sstevel@tonic-gate #include <kcmd.h>
437c478bd9Sstevel@tonic-gate #include <krb5.h>
447c478bd9Sstevel@tonic-gate
457c478bd9Sstevel@tonic-gate /* signal disposition - signal handler or SIG_IGN, SIG_ERR, etc. */
467c478bd9Sstevel@tonic-gate typedef void (*sigdisp_t)(int);
477c478bd9Sstevel@tonic-gate
487c478bd9Sstevel@tonic-gate extern errcode_t profile_get_options_boolean(profile_t, char **,
497c478bd9Sstevel@tonic-gate profile_options_boolean *);
507c478bd9Sstevel@tonic-gate extern errcode_t profile_get_options_string(profile_t, char **,
517c478bd9Sstevel@tonic-gate profile_option_strings *);
527c478bd9Sstevel@tonic-gate
537c478bd9Sstevel@tonic-gate #define RSH_BUFSIZ (1024 * 50)
547c478bd9Sstevel@tonic-gate
557c478bd9Sstevel@tonic-gate static char des_inbuf[2 * RSH_BUFSIZ]; /* needs to be > largest read size */
567c478bd9Sstevel@tonic-gate static char des_outbuf[2 * RSH_BUFSIZ]; /* needs to be > largest write size */
577c478bd9Sstevel@tonic-gate static krb5_data desinbuf, desoutbuf;
587c478bd9Sstevel@tonic-gate static krb5_encrypt_block eblock; /* eblock for encrypt/decrypt */
593ca4cacdSPeter Shoults static krb5_context bsd_context = NULL;
607c478bd9Sstevel@tonic-gate static krb5_auth_context auth_context;
617c478bd9Sstevel@tonic-gate static krb5_creds *cred;
627c478bd9Sstevel@tonic-gate static krb5_keyblock *session_key;
637c478bd9Sstevel@tonic-gate
647c478bd9Sstevel@tonic-gate static int encrypt_flag; /* Flag set, when encryption is used */
653ca4cacdSPeter Shoults static int krb5auth_flag; /* Flag set, when KERBEROS is enabled */
663ca4cacdSPeter Shoults static profile_options_boolean autologin_option[] = {
673ca4cacdSPeter Shoults { "autologin", &krb5auth_flag, 0 },
683ca4cacdSPeter Shoults { NULL, NULL, 0 }
693ca4cacdSPeter Shoults };
703ca4cacdSPeter Shoults
713ca4cacdSPeter Shoults static int no_krb5auth_flag = 0;
727c478bd9Sstevel@tonic-gate static int fflag; /* Flag set, if creds to be fwd'ed via -f */
737c478bd9Sstevel@tonic-gate static int Fflag; /* Flag set, if fwd'able creds to be fwd'ed via -F */
747c478bd9Sstevel@tonic-gate
757c478bd9Sstevel@tonic-gate /* Flag set, if -PN / -PO is specified */
767c478bd9Sstevel@tonic-gate static boolean_t rcmdoption_done;
777c478bd9Sstevel@tonic-gate
787c478bd9Sstevel@tonic-gate /* Flags set, if corres. cmd line options are turned on */
797c478bd9Sstevel@tonic-gate static boolean_t encrypt_done, fwd_done, fwdable_done;
807c478bd9Sstevel@tonic-gate
817c478bd9Sstevel@tonic-gate static profile_options_boolean option[] = {
827c478bd9Sstevel@tonic-gate { "encrypt", &encrypt_flag, 0 },
837c478bd9Sstevel@tonic-gate { "forward", &fflag, 0 },
847c478bd9Sstevel@tonic-gate { "forwardable", &Fflag, 0 },
857c478bd9Sstevel@tonic-gate { NULL, NULL, 0 }
867c478bd9Sstevel@tonic-gate };
877c478bd9Sstevel@tonic-gate
887c478bd9Sstevel@tonic-gate static char *rcmdproto;
897c478bd9Sstevel@tonic-gate static profile_option_strings rcmdversion[] = {
907c478bd9Sstevel@tonic-gate { "rcmd_protocol", &rcmdproto, 0 },
917c478bd9Sstevel@tonic-gate { NULL, NULL, 0 }
927c478bd9Sstevel@tonic-gate };
937c478bd9Sstevel@tonic-gate
947c478bd9Sstevel@tonic-gate static char *realmdef[] = { "realms", NULL, "rsh", NULL };
957c478bd9Sstevel@tonic-gate static char *appdef[] = { "appdefaults", "rsh", NULL };
967c478bd9Sstevel@tonic-gate
977c478bd9Sstevel@tonic-gate static void sendsig(int);
987c478bd9Sstevel@tonic-gate static sigdisp_t sigdisp(int);
997c478bd9Sstevel@tonic-gate static boolean_t init_service(boolean_t);
1007c478bd9Sstevel@tonic-gate static int desrshread(int, char *, int);
1017c478bd9Sstevel@tonic-gate static int desrshwrite(int, char *, int);
1027c478bd9Sstevel@tonic-gate
1037c478bd9Sstevel@tonic-gate static int options;
1047c478bd9Sstevel@tonic-gate static int rfd2;
1057c478bd9Sstevel@tonic-gate static int portnumber;
1067c478bd9Sstevel@tonic-gate
1077c478bd9Sstevel@tonic-gate static const char rlogin_path[] = "/usr/bin/rlogin";
1087c478bd9Sstevel@tonic-gate static const char dash_x[] = "-x "; /* Note the blank after -x */
1097c478bd9Sstevel@tonic-gate
1107c478bd9Sstevel@tonic-gate static boolean_t readiv, writeiv;
1117c478bd9Sstevel@tonic-gate
1127c478bd9Sstevel@tonic-gate #define set2mask(setp) ((setp)->__sigbits[0])
1137c478bd9Sstevel@tonic-gate #define mask2set(mask, setp) \
1147c478bd9Sstevel@tonic-gate ((mask) == -1 ? sigfillset(setp) : (set2mask(setp) = (mask)))
1157c478bd9Sstevel@tonic-gate
1167c478bd9Sstevel@tonic-gate #ifdef DEBUG
1177c478bd9Sstevel@tonic-gate #define DEBUGOPTSTRING "D:"
1187c478bd9Sstevel@tonic-gate #else
1197c478bd9Sstevel@tonic-gate #define DEBUGOPTSTRING ""
1207c478bd9Sstevel@tonic-gate #endif /* DEBUG */
1217c478bd9Sstevel@tonic-gate
1227c478bd9Sstevel@tonic-gate static void
sigsetmask(int mask)1237c478bd9Sstevel@tonic-gate sigsetmask(int mask)
1247c478bd9Sstevel@tonic-gate {
1257c478bd9Sstevel@tonic-gate sigset_t nset;
1267c478bd9Sstevel@tonic-gate
1277c478bd9Sstevel@tonic-gate (void) sigprocmask(0, NULL, &nset);
1287c478bd9Sstevel@tonic-gate mask2set(mask, &nset);
1297c478bd9Sstevel@tonic-gate (void) sigprocmask(SIG_SETMASK, &nset, NULL);
1307c478bd9Sstevel@tonic-gate }
1317c478bd9Sstevel@tonic-gate
1327c478bd9Sstevel@tonic-gate static int
sigblock(int mask)1337c478bd9Sstevel@tonic-gate sigblock(int mask)
1347c478bd9Sstevel@tonic-gate {
1357c478bd9Sstevel@tonic-gate sigset_t oset;
1367c478bd9Sstevel@tonic-gate sigset_t nset;
1377c478bd9Sstevel@tonic-gate
1387c478bd9Sstevel@tonic-gate (void) sigprocmask(0, NULL, &nset);
1397c478bd9Sstevel@tonic-gate mask2set(mask, &nset);
1407c478bd9Sstevel@tonic-gate (void) sigprocmask(SIG_BLOCK, &nset, &oset);
1417c478bd9Sstevel@tonic-gate return (set2mask(&oset));
1427c478bd9Sstevel@tonic-gate }
1437c478bd9Sstevel@tonic-gate
1447c478bd9Sstevel@tonic-gate /*
1457c478bd9Sstevel@tonic-gate * Get signal disposition (or signal handler) for a given signal
1467c478bd9Sstevel@tonic-gate */
1477c478bd9Sstevel@tonic-gate static sigdisp_t
sigdisp(int sig)1487c478bd9Sstevel@tonic-gate sigdisp(int sig)
1497c478bd9Sstevel@tonic-gate {
1507c478bd9Sstevel@tonic-gate struct sigaction act;
1517c478bd9Sstevel@tonic-gate
1527c478bd9Sstevel@tonic-gate act.sa_handler = NULL;
1537c478bd9Sstevel@tonic-gate act.sa_flags = 0;
1547c478bd9Sstevel@tonic-gate (void) sigemptyset(&act.sa_mask);
1557c478bd9Sstevel@tonic-gate (void) sigaction(sig, NULL, &act);
1567c478bd9Sstevel@tonic-gate return (act.sa_handler);
1577c478bd9Sstevel@tonic-gate }
1587c478bd9Sstevel@tonic-gate
1597c478bd9Sstevel@tonic-gate static pid_t child_pid = -1;
1607c478bd9Sstevel@tonic-gate
1617c478bd9Sstevel@tonic-gate /*
1627c478bd9Sstevel@tonic-gate * If you do a command like "rsh host output | wc"
1637c478bd9Sstevel@tonic-gate * and wc terminates, then the parent will receive SIGPIPE
1647c478bd9Sstevel@tonic-gate * and the child needs to be terminated.
1657c478bd9Sstevel@tonic-gate */
1667c478bd9Sstevel@tonic-gate /* ARGSUSED */
1677c478bd9Sstevel@tonic-gate static void
sigpipehandler(int signal)1687c478bd9Sstevel@tonic-gate sigpipehandler(int signal)
1697c478bd9Sstevel@tonic-gate {
1707c478bd9Sstevel@tonic-gate if (child_pid != -1)
1717c478bd9Sstevel@tonic-gate (void) kill(child_pid, SIGKILL);
1727c478bd9Sstevel@tonic-gate exit(EXIT_SUCCESS);
1737c478bd9Sstevel@tonic-gate }
1747c478bd9Sstevel@tonic-gate
1757c478bd9Sstevel@tonic-gate #define mask(s) (1 << ((s) - 1))
1767c478bd9Sstevel@tonic-gate
1777c478bd9Sstevel@tonic-gate static void
usage(void)1787c478bd9Sstevel@tonic-gate usage(void) {
1797c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "%s\n%s\n",
1807c478bd9Sstevel@tonic-gate gettext("usage: rsh [ -PN / -PO ] [ -l login ] [ -n ] "
1817c478bd9Sstevel@tonic-gate "[ -k realm ] [ -a ] [ -x ] [ -f / -F ] host command"),
1827c478bd9Sstevel@tonic-gate gettext(" rsh [ -PN / -PO ] [ -l login ] [ -k realm ] "
1837c478bd9Sstevel@tonic-gate "[ -a ] [ -x ] [ -f / -F ] host"));
1847c478bd9Sstevel@tonic-gate exit(EXIT_FAILURE);
1857c478bd9Sstevel@tonic-gate }
1867c478bd9Sstevel@tonic-gate
1877c478bd9Sstevel@tonic-gate static void
die(const char * message)1887c478bd9Sstevel@tonic-gate die(const char *message)
1897c478bd9Sstevel@tonic-gate {
1907c478bd9Sstevel@tonic-gate (void) fputs(message, stderr);
1917c478bd9Sstevel@tonic-gate usage();
1927c478bd9Sstevel@tonic-gate }
1937c478bd9Sstevel@tonic-gate
1947c478bd9Sstevel@tonic-gate static void
usage_forward(void)1957c478bd9Sstevel@tonic-gate usage_forward(void)
1967c478bd9Sstevel@tonic-gate {
1977c478bd9Sstevel@tonic-gate die(gettext("rsh: Only one of -f and -F allowed.\n"));
1987c478bd9Sstevel@tonic-gate }
1997c478bd9Sstevel@tonic-gate
2007c478bd9Sstevel@tonic-gate /*
2017c478bd9Sstevel@tonic-gate * rsh - remote shell
2027c478bd9Sstevel@tonic-gate */
2037c478bd9Sstevel@tonic-gate /* VARARGS */
2047c478bd9Sstevel@tonic-gate int
main(int argc,char ** argv)2057c478bd9Sstevel@tonic-gate main(int argc, char **argv)
2067c478bd9Sstevel@tonic-gate {
2077c478bd9Sstevel@tonic-gate int c, rem;
2087c478bd9Sstevel@tonic-gate char *cmd, *cp, **ap, buf[RSH_BUFSIZ], **argv0, *args, *args_no_x;
2097c478bd9Sstevel@tonic-gate char *host = NULL, *user = NULL;
2107c478bd9Sstevel@tonic-gate int cc;
2117c478bd9Sstevel@tonic-gate boolean_t asrsh = B_FALSE;
2127c478bd9Sstevel@tonic-gate struct passwd *pwd;
2137c478bd9Sstevel@tonic-gate boolean_t readfrom_rem;
2147c478bd9Sstevel@tonic-gate boolean_t readfrom_rfd2;
2157c478bd9Sstevel@tonic-gate int one = 1;
2167c478bd9Sstevel@tonic-gate int omask;
2177c478bd9Sstevel@tonic-gate boolean_t nflag = B_FALSE;
2187c478bd9Sstevel@tonic-gate char *krb_realm = NULL;
2197c478bd9Sstevel@tonic-gate krb5_flags authopts;
2207c478bd9Sstevel@tonic-gate krb5_error_code status;
2217c478bd9Sstevel@tonic-gate enum kcmd_proto kcmd_proto = KCMD_NEW_PROTOCOL;
2227c478bd9Sstevel@tonic-gate uid_t uid = getuid();
2237c478bd9Sstevel@tonic-gate
2247c478bd9Sstevel@tonic-gate c = (argc + 1) * sizeof (char *);
2257c478bd9Sstevel@tonic-gate if ((argv0 = malloc(c)) == NULL) {
2267c478bd9Sstevel@tonic-gate perror("malloc");
2277c478bd9Sstevel@tonic-gate return (EXIT_FAILURE);
2287c478bd9Sstevel@tonic-gate }
2297c478bd9Sstevel@tonic-gate (void) memcpy(argv0, argv, c);
2307c478bd9Sstevel@tonic-gate
2317c478bd9Sstevel@tonic-gate (void) setlocale(LC_ALL, "");
2327c478bd9Sstevel@tonic-gate
2337c478bd9Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN);
2347c478bd9Sstevel@tonic-gate
2357c478bd9Sstevel@tonic-gate /*
2367c478bd9Sstevel@tonic-gate * Determine command name used to invoke to rlogin(1). Users can
2377c478bd9Sstevel@tonic-gate * create links named by a host pointing to the binary and type
2387c478bd9Sstevel@tonic-gate * "hostname" to log into that host afterwards.
2397c478bd9Sstevel@tonic-gate */
2407c478bd9Sstevel@tonic-gate cmd = strrchr(argv[0], '/');
2417c478bd9Sstevel@tonic-gate cmd = (cmd != NULL) ? (cmd + 1) : argv[0];
2427c478bd9Sstevel@tonic-gate
2437c478bd9Sstevel@tonic-gate /*
2447c478bd9Sstevel@tonic-gate * Add "remsh" as an alias for "rsh" (System III, V networking
2457c478bd9Sstevel@tonic-gate * add-ons often used this name for the remote shell since rsh
2467c478bd9Sstevel@tonic-gate * was already taken for the restricted shell). Note that this
2477c478bd9Sstevel@tonic-gate * usurps the ability to use "remsh" as the name of a host (by
2487c478bd9Sstevel@tonic-gate * symlinking it to rsh), so we go one step farther: if the
2497c478bd9Sstevel@tonic-gate * file "/usr/bin/remsh" does not exist, we behave as if "remsh"
2507c478bd9Sstevel@tonic-gate * is a host name. If it does exist, we accept "remsh" as an
2517c478bd9Sstevel@tonic-gate * "rsh" alias.
2527c478bd9Sstevel@tonic-gate */
2537c478bd9Sstevel@tonic-gate if (strcmp(cmd, "remsh") == 0) {
2547c478bd9Sstevel@tonic-gate struct stat sb;
2557c478bd9Sstevel@tonic-gate
2567c478bd9Sstevel@tonic-gate if (stat("/usr/bin/remsh", &sb) < 0)
2577c478bd9Sstevel@tonic-gate host = cmd;
2587c478bd9Sstevel@tonic-gate } else if (strcmp(cmd, "rsh") != 0) {
2597c478bd9Sstevel@tonic-gate host = cmd;
2607c478bd9Sstevel@tonic-gate }
2617c478bd9Sstevel@tonic-gate
2627c478bd9Sstevel@tonic-gate /* Handle legacy synopsis "rsh hostname options [command]". */
2637c478bd9Sstevel@tonic-gate if (host == NULL) {
2647c478bd9Sstevel@tonic-gate if (argc < 2)
2657c478bd9Sstevel@tonic-gate usage();
2667c478bd9Sstevel@tonic-gate if (*argv[1] != '-') {
2677c478bd9Sstevel@tonic-gate host = argv[1];
2687c478bd9Sstevel@tonic-gate argc--;
2697c478bd9Sstevel@tonic-gate argv[1] = argv[0];
2707c478bd9Sstevel@tonic-gate argv++;
2717c478bd9Sstevel@tonic-gate asrsh = B_TRUE;
2727c478bd9Sstevel@tonic-gate }
2737c478bd9Sstevel@tonic-gate }
2747c478bd9Sstevel@tonic-gate
2757c478bd9Sstevel@tonic-gate while ((c = getopt(argc, argv,
2763ca4cacdSPeter Shoults DEBUGOPTSTRING "8AFKLP:ade:fk:l:nwx")) != -1) {
2777c478bd9Sstevel@tonic-gate switch (c) {
2787c478bd9Sstevel@tonic-gate #ifdef DEBUG
2797c478bd9Sstevel@tonic-gate case 'D':
2807c478bd9Sstevel@tonic-gate portnumber = htons(atoi(optarg));
2813ca4cacdSPeter Shoults krb5auth_flag++;
2827c478bd9Sstevel@tonic-gate break;
2837c478bd9Sstevel@tonic-gate #endif /* DEBUG */
2847c478bd9Sstevel@tonic-gate case 'F':
2857c478bd9Sstevel@tonic-gate if (fflag)
2867c478bd9Sstevel@tonic-gate usage_forward();
2877c478bd9Sstevel@tonic-gate Fflag = 1;
2883ca4cacdSPeter Shoults krb5auth_flag++;
2897c478bd9Sstevel@tonic-gate fwdable_done = B_TRUE;
2907c478bd9Sstevel@tonic-gate break;
2917c478bd9Sstevel@tonic-gate case 'f':
2927c478bd9Sstevel@tonic-gate if (Fflag)
2937c478bd9Sstevel@tonic-gate usage_forward();
2947c478bd9Sstevel@tonic-gate fflag = 1;
2953ca4cacdSPeter Shoults krb5auth_flag++;
2967c478bd9Sstevel@tonic-gate fwd_done = B_TRUE;
2977c478bd9Sstevel@tonic-gate break;
2987c478bd9Sstevel@tonic-gate case 'P':
2997c478bd9Sstevel@tonic-gate if (strcmp(optarg, "N") == 0)
3007c478bd9Sstevel@tonic-gate kcmd_proto = KCMD_NEW_PROTOCOL;
3017c478bd9Sstevel@tonic-gate else if (strcmp(optarg, "O") == 0)
3027c478bd9Sstevel@tonic-gate kcmd_proto = KCMD_OLD_PROTOCOL;
3037c478bd9Sstevel@tonic-gate else
3047c478bd9Sstevel@tonic-gate die(gettext("rsh: Only -PN or -PO "
3057c478bd9Sstevel@tonic-gate "allowed.\n"));
3067c478bd9Sstevel@tonic-gate if (rcmdoption_done)
3077c478bd9Sstevel@tonic-gate die(gettext("rsh: Only one of -PN and -PO "
3087c478bd9Sstevel@tonic-gate "allowed.\n"));
3097c478bd9Sstevel@tonic-gate rcmdoption_done = B_TRUE;
3103ca4cacdSPeter Shoults krb5auth_flag++;
3117c478bd9Sstevel@tonic-gate break;
3127c478bd9Sstevel@tonic-gate case 'a':
3133ca4cacdSPeter Shoults krb5auth_flag++;
3143ca4cacdSPeter Shoults break;
3153ca4cacdSPeter Shoults case 'K':
3163ca4cacdSPeter Shoults no_krb5auth_flag++;
3177c478bd9Sstevel@tonic-gate break;
3187c478bd9Sstevel@tonic-gate case 'd':
3197c478bd9Sstevel@tonic-gate options |= SO_DEBUG;
3207c478bd9Sstevel@tonic-gate break;
3217c478bd9Sstevel@tonic-gate case 'k':
3227c478bd9Sstevel@tonic-gate krb_realm = optarg;
3233ca4cacdSPeter Shoults krb5auth_flag++;
3247c478bd9Sstevel@tonic-gate break;
3257c478bd9Sstevel@tonic-gate case 'l':
3267c478bd9Sstevel@tonic-gate user = optarg;
3277c478bd9Sstevel@tonic-gate break;
3287c478bd9Sstevel@tonic-gate case 'n':
3297c478bd9Sstevel@tonic-gate if (!nflag) {
3307c478bd9Sstevel@tonic-gate if (close(STDIN_FILENO) < 0) {
3317c478bd9Sstevel@tonic-gate perror("close");
3327c478bd9Sstevel@tonic-gate return (EXIT_FAILURE);
3337c478bd9Sstevel@tonic-gate }
3347c478bd9Sstevel@tonic-gate /*
3357c478bd9Sstevel@tonic-gate * "STDION_FILENO" defined to 0 by POSIX
3367c478bd9Sstevel@tonic-gate * and hence the lowest file descriptor.
3377c478bd9Sstevel@tonic-gate * So the open(2) below is guaranteed to
3387c478bd9Sstevel@tonic-gate * reopen it because we closed it above.
3397c478bd9Sstevel@tonic-gate */
3407c478bd9Sstevel@tonic-gate if (open("/dev/null", O_RDONLY) < 0) {
3417c478bd9Sstevel@tonic-gate perror("open");
3427c478bd9Sstevel@tonic-gate return (EXIT_FAILURE);
3437c478bd9Sstevel@tonic-gate }
3447c478bd9Sstevel@tonic-gate nflag = B_TRUE;
3457c478bd9Sstevel@tonic-gate }
3467c478bd9Sstevel@tonic-gate break;
3477c478bd9Sstevel@tonic-gate case 'x':
3487c478bd9Sstevel@tonic-gate encrypt_flag = 1;
3493ca4cacdSPeter Shoults krb5auth_flag++;
3507c478bd9Sstevel@tonic-gate encrypt_done = B_TRUE;
3517c478bd9Sstevel@tonic-gate break;
3527c478bd9Sstevel@tonic-gate /*
3537c478bd9Sstevel@tonic-gate * Ignore the -L, -w, -e and -8 flags to allow aliases with
3547c478bd9Sstevel@tonic-gate * rlogin to work. Actually rlogin(1) doesn't understand
3557c478bd9Sstevel@tonic-gate * -w either but because "rsh -w hostname command" used
3567c478bd9Sstevel@tonic-gate * to work we still accept it.
3577c478bd9Sstevel@tonic-gate */
3587c478bd9Sstevel@tonic-gate case '8':
3597c478bd9Sstevel@tonic-gate case 'L':
3607c478bd9Sstevel@tonic-gate case 'e':
3617c478bd9Sstevel@tonic-gate case 'w':
3627c478bd9Sstevel@tonic-gate /*
3637c478bd9Sstevel@tonic-gate * On the lines of the -L, -w, -e and -8 options above, we
3647c478bd9Sstevel@tonic-gate * ignore the -A option too, in order to allow aliases with
3657c478bd9Sstevel@tonic-gate * rlogin to work.
3667c478bd9Sstevel@tonic-gate *
3677c478bd9Sstevel@tonic-gate * Mind you !, the -a option to trigger Kerberos authentication
3687c478bd9Sstevel@tonic-gate * in rsh, has a totally different usage in rlogin, its the
3697c478bd9Sstevel@tonic-gate * -A option (in rlogin) which needs to be used to talk
3707c478bd9Sstevel@tonic-gate * Kerberos.
3717c478bd9Sstevel@tonic-gate */
3727c478bd9Sstevel@tonic-gate case 'A':
3737c478bd9Sstevel@tonic-gate break;
3747c478bd9Sstevel@tonic-gate default:
3757c478bd9Sstevel@tonic-gate usage();
3767c478bd9Sstevel@tonic-gate }
3777c478bd9Sstevel@tonic-gate }
3787c478bd9Sstevel@tonic-gate
3797c478bd9Sstevel@tonic-gate argc -= optind;
3807c478bd9Sstevel@tonic-gate argv += optind;
3817c478bd9Sstevel@tonic-gate
3827c478bd9Sstevel@tonic-gate if (host == NULL) {
3837c478bd9Sstevel@tonic-gate if (argc == 0)
3847c478bd9Sstevel@tonic-gate usage();
3857c478bd9Sstevel@tonic-gate argc--;
3867c478bd9Sstevel@tonic-gate host = *argv++;
3877c478bd9Sstevel@tonic-gate asrsh = B_TRUE;
3887c478bd9Sstevel@tonic-gate }
3897c478bd9Sstevel@tonic-gate
3907c478bd9Sstevel@tonic-gate if (argc == 0) {
3917c478bd9Sstevel@tonic-gate (void) setreuid(uid, uid);
3927c478bd9Sstevel@tonic-gate if (nflag)
3937c478bd9Sstevel@tonic-gate usage();
3947c478bd9Sstevel@tonic-gate if (asrsh)
3957c478bd9Sstevel@tonic-gate *argv0 = "rlogin";
3967c478bd9Sstevel@tonic-gate (void) execv(rlogin_path, argv0);
3977c478bd9Sstevel@tonic-gate perror(rlogin_path);
3987c478bd9Sstevel@tonic-gate
3997c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("No local rlogin "
4007c478bd9Sstevel@tonic-gate "program found.\n"));
4017c478bd9Sstevel@tonic-gate return (EXIT_FAILURE);
4027c478bd9Sstevel@tonic-gate }
4037c478bd9Sstevel@tonic-gate
4047c478bd9Sstevel@tonic-gate if (__init_suid_priv(0, PRIV_NET_PRIVADDR, NULL) == -1) {
4057c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
4067c478bd9Sstevel@tonic-gate gettext("Insufficient privileges, "
4077c478bd9Sstevel@tonic-gate "rsh must be set-uid root\n"));
4087c478bd9Sstevel@tonic-gate return (EXIT_FAILURE);
4097c478bd9Sstevel@tonic-gate }
4107c478bd9Sstevel@tonic-gate
4117c478bd9Sstevel@tonic-gate pwd = getpwuid(uid);
4127c478bd9Sstevel@tonic-gate if (pwd == NULL) {
4137c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("who are you?\n"));
4147c478bd9Sstevel@tonic-gate return (EXIT_FAILURE);
4157c478bd9Sstevel@tonic-gate }
4167c478bd9Sstevel@tonic-gate if (user == NULL)
4177c478bd9Sstevel@tonic-gate user = pwd->pw_name;
4187c478bd9Sstevel@tonic-gate
4193ca4cacdSPeter Shoults /*
4203ca4cacdSPeter Shoults * if the user disables krb5 on the cmdline (-K), then skip
4213ca4cacdSPeter Shoults * all krb5 setup.
4223ca4cacdSPeter Shoults *
4233ca4cacdSPeter Shoults * if the user does not disable krb5 or enable krb5 on the
4243ca4cacdSPeter Shoults * cmdline, check krb5.conf to see if it should be enabled.
4253ca4cacdSPeter Shoults */
4263ca4cacdSPeter Shoults
4273ca4cacdSPeter Shoults if (no_krb5auth_flag) {
4283ca4cacdSPeter Shoults krb5auth_flag = 0;
4293ca4cacdSPeter Shoults Fflag = fflag = encrypt_flag = 0;
4303ca4cacdSPeter Shoults } else if (!krb5auth_flag) {
4313ca4cacdSPeter Shoults /* is autologin set in krb5.conf? */
4323ca4cacdSPeter Shoults status = krb5_init_context(&bsd_context);
4333ca4cacdSPeter Shoults /* don't sweat failure here */
4343ca4cacdSPeter Shoults if (!status) {
4353ca4cacdSPeter Shoults /*
4363ca4cacdSPeter Shoults * note that the call to profile_get_options_boolean
4373ca4cacdSPeter Shoults * with autologin_option can affect value of
4383ca4cacdSPeter Shoults * krb5auth_flag
4393ca4cacdSPeter Shoults */
4403ca4cacdSPeter Shoults (void) profile_get_options_boolean(bsd_context->profile,
4413ca4cacdSPeter Shoults appdef,
4423ca4cacdSPeter Shoults autologin_option);
4433ca4cacdSPeter Shoults }
4443ca4cacdSPeter Shoults }
4453ca4cacdSPeter Shoults
4467c478bd9Sstevel@tonic-gate if (krb5auth_flag) {
4473ca4cacdSPeter Shoults if (!bsd_context) {
4487c478bd9Sstevel@tonic-gate status = krb5_init_context(&bsd_context);
4497c478bd9Sstevel@tonic-gate if (status) {
4503ca4cacdSPeter Shoults com_err("rsh", status,
4513ca4cacdSPeter Shoults "while initializing krb5");
4527c478bd9Sstevel@tonic-gate return (EXIT_FAILURE);
4533ca4cacdSPeter Shoults
4543ca4cacdSPeter Shoults }
4557c478bd9Sstevel@tonic-gate }
4567c478bd9Sstevel@tonic-gate
4577c478bd9Sstevel@tonic-gate /*
4587c478bd9Sstevel@tonic-gate * Get our local realm to look up local realm options.
4597c478bd9Sstevel@tonic-gate */
4607c478bd9Sstevel@tonic-gate status = krb5_get_default_realm(bsd_context, &realmdef[1]);
4617c478bd9Sstevel@tonic-gate if (status) {
4627c478bd9Sstevel@tonic-gate com_err("rsh", status,
4637c478bd9Sstevel@tonic-gate gettext("while getting default realm"));
4647c478bd9Sstevel@tonic-gate return (EXIT_FAILURE);
4657c478bd9Sstevel@tonic-gate }
4667c478bd9Sstevel@tonic-gate /*
4677c478bd9Sstevel@tonic-gate * Check the realms section in krb5.conf for encryption,
4687c478bd9Sstevel@tonic-gate * forward & forwardable info
4697c478bd9Sstevel@tonic-gate */
470*0b4fd3b1SSurya Prakki (void) profile_get_options_boolean(bsd_context->profile,
471*0b4fd3b1SSurya Prakki realmdef, option);
4727c478bd9Sstevel@tonic-gate /*
4737c478bd9Sstevel@tonic-gate * Check the appdefaults section
4747c478bd9Sstevel@tonic-gate */
475*0b4fd3b1SSurya Prakki (void) profile_get_options_boolean(bsd_context->profile,
476*0b4fd3b1SSurya Prakki appdef, option);
477*0b4fd3b1SSurya Prakki (void) profile_get_options_string(bsd_context->profile,
478*0b4fd3b1SSurya Prakki appdef, rcmdversion);
4797c478bd9Sstevel@tonic-gate /*
4807c478bd9Sstevel@tonic-gate * Set the *_flag variables, if the corresponding *_done are
4817c478bd9Sstevel@tonic-gate * set to 1, because we dont want the config file values
4827c478bd9Sstevel@tonic-gate * overriding the command line options.
4837c478bd9Sstevel@tonic-gate */
4847c478bd9Sstevel@tonic-gate if (encrypt_done)
4857c478bd9Sstevel@tonic-gate encrypt_flag = 1;
4867c478bd9Sstevel@tonic-gate if (fwd_done) {
4877c478bd9Sstevel@tonic-gate fflag = 1;
4887c478bd9Sstevel@tonic-gate Fflag = 0;
4897c478bd9Sstevel@tonic-gate } else if (fwdable_done) {
4907c478bd9Sstevel@tonic-gate Fflag = 1;
4917c478bd9Sstevel@tonic-gate fflag = 0;
4927c478bd9Sstevel@tonic-gate }
4937c478bd9Sstevel@tonic-gate if (!rcmdoption_done && (rcmdproto != NULL)) {
4947c478bd9Sstevel@tonic-gate if (strncmp(rcmdproto, "rcmdv2", 6) == 0) {
4957c478bd9Sstevel@tonic-gate kcmd_proto = KCMD_NEW_PROTOCOL;
4967c478bd9Sstevel@tonic-gate } else if (strncmp(rcmdproto, "rcmdv1", 6) == 0) {
4977c478bd9Sstevel@tonic-gate kcmd_proto = KCMD_OLD_PROTOCOL;
4987c478bd9Sstevel@tonic-gate } else {
4997c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("Unrecognized "
5007c478bd9Sstevel@tonic-gate "KCMD protocol (%s)"), rcmdproto);
5017c478bd9Sstevel@tonic-gate return (EXIT_FAILURE);
5027c478bd9Sstevel@tonic-gate }
5037c478bd9Sstevel@tonic-gate }
5047c478bd9Sstevel@tonic-gate
5057c478bd9Sstevel@tonic-gate
5067c478bd9Sstevel@tonic-gate if (encrypt_flag && (!krb5_privacy_allowed())) {
5077c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("rsh: Encryption not "
5087c478bd9Sstevel@tonic-gate "supported.\n"));
5097c478bd9Sstevel@tonic-gate return (EXIT_FAILURE);
5107c478bd9Sstevel@tonic-gate }
5117c478bd9Sstevel@tonic-gate }
5127c478bd9Sstevel@tonic-gate
5137c478bd9Sstevel@tonic-gate /*
5147c478bd9Sstevel@tonic-gate * Connect with the service (shell/kshell) on the daemon side
5157c478bd9Sstevel@tonic-gate */
5167c478bd9Sstevel@tonic-gate if (portnumber == 0) {
5177c478bd9Sstevel@tonic-gate while (!init_service(krb5auth_flag)) {
5187c478bd9Sstevel@tonic-gate /*
5197c478bd9Sstevel@tonic-gate * Connecting to the 'kshell' service failed,
5207c478bd9Sstevel@tonic-gate * fallback to normal rsh; Reset all KRB5 flags
5217c478bd9Sstevel@tonic-gate * and connect to 'shell' service on the server
5227c478bd9Sstevel@tonic-gate */
5233ca4cacdSPeter Shoults krb5auth_flag = 0;
5247c478bd9Sstevel@tonic-gate encrypt_flag = fflag = Fflag = 0;
5257c478bd9Sstevel@tonic-gate }
5267c478bd9Sstevel@tonic-gate }
5277c478bd9Sstevel@tonic-gate
5287c478bd9Sstevel@tonic-gate cc = encrypt_flag ? strlen(dash_x) : 0;
5297c478bd9Sstevel@tonic-gate for (ap = argv; *ap != NULL; ap++)
5307c478bd9Sstevel@tonic-gate cc += strlen(*ap) + 1;
5317c478bd9Sstevel@tonic-gate cp = args = malloc(cc);
5327c478bd9Sstevel@tonic-gate if (cp == NULL)
5337c478bd9Sstevel@tonic-gate perror("malloc");
5347c478bd9Sstevel@tonic-gate if (encrypt_flag) {
5357c478bd9Sstevel@tonic-gate int length;
5367c478bd9Sstevel@tonic-gate
5377c478bd9Sstevel@tonic-gate length = strlcpy(args, dash_x, cc);
5387c478bd9Sstevel@tonic-gate cp += length;
5397c478bd9Sstevel@tonic-gate cc -= length;
5407c478bd9Sstevel@tonic-gate }
5417c478bd9Sstevel@tonic-gate args_no_x = args;
5427c478bd9Sstevel@tonic-gate
5437c478bd9Sstevel@tonic-gate for (ap = argv; *ap != NULL; ap++) {
5447c478bd9Sstevel@tonic-gate int length;
5457c478bd9Sstevel@tonic-gate
5467c478bd9Sstevel@tonic-gate length = strlcpy(cp, *ap, cc);
5477c478bd9Sstevel@tonic-gate assert(length < cc);
5487c478bd9Sstevel@tonic-gate cp += length;
5497c478bd9Sstevel@tonic-gate cc -= length;
5507c478bd9Sstevel@tonic-gate if (ap[1] != NULL) {
5517c478bd9Sstevel@tonic-gate *cp++ = ' ';
5527c478bd9Sstevel@tonic-gate cc--;
5537c478bd9Sstevel@tonic-gate }
5547c478bd9Sstevel@tonic-gate }
5557c478bd9Sstevel@tonic-gate
5567c478bd9Sstevel@tonic-gate if (krb5auth_flag) {
5577c478bd9Sstevel@tonic-gate authopts = AP_OPTS_MUTUAL_REQUIRED;
5587c478bd9Sstevel@tonic-gate /*
5597c478bd9Sstevel@tonic-gate * Piggy-back forwarding flags on top of authopts;
5607c478bd9Sstevel@tonic-gate * they will be reset in kcmd
5617c478bd9Sstevel@tonic-gate */
5627c478bd9Sstevel@tonic-gate if (fflag || Fflag)
5637c478bd9Sstevel@tonic-gate authopts |= OPTS_FORWARD_CREDS;
5647c478bd9Sstevel@tonic-gate if (Fflag)
5657c478bd9Sstevel@tonic-gate authopts |= OPTS_FORWARDABLE_CREDS;
5667c478bd9Sstevel@tonic-gate
5677c478bd9Sstevel@tonic-gate status = kcmd(&rem, &host, portnumber,
5687c478bd9Sstevel@tonic-gate pwd->pw_name, user,
5697c478bd9Sstevel@tonic-gate args, &rfd2, "host", krb_realm,
5707c478bd9Sstevel@tonic-gate bsd_context, &auth_context, &cred,
5717c478bd9Sstevel@tonic-gate NULL, /* No need for sequence number */
5727c478bd9Sstevel@tonic-gate NULL, /* No need for server seq # */
5737c478bd9Sstevel@tonic-gate authopts,
5747c478bd9Sstevel@tonic-gate 1, /* Always set anyport */
5757c478bd9Sstevel@tonic-gate &kcmd_proto);
5767c478bd9Sstevel@tonic-gate if (status != 0) {
5777c478bd9Sstevel@tonic-gate /*
5787c478bd9Sstevel@tonic-gate * If new protocol requested, we dont fallback to
5797c478bd9Sstevel@tonic-gate * less secure ones.
5807c478bd9Sstevel@tonic-gate */
5817c478bd9Sstevel@tonic-gate if (kcmd_proto == KCMD_NEW_PROTOCOL) {
5827c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("rsh: kcmdv2 "
5837c478bd9Sstevel@tonic-gate "to host %s failed - %s\n"
5847c478bd9Sstevel@tonic-gate "Fallback to normal rsh denied."),
5857c478bd9Sstevel@tonic-gate host, error_message(status));
5867c478bd9Sstevel@tonic-gate return (EXIT_FAILURE);
5877c478bd9Sstevel@tonic-gate }
5887c478bd9Sstevel@tonic-gate /* check NO_TKT_FILE or equivalent... */
5897c478bd9Sstevel@tonic-gate if (status != -1) {
5907c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
5917c478bd9Sstevel@tonic-gate gettext("rsh: kcmd to host %s failed - %s\n"
5927c478bd9Sstevel@tonic-gate "trying normal rsh...\n\n"),
5937c478bd9Sstevel@tonic-gate host, error_message(status));
5947c478bd9Sstevel@tonic-gate } else {
5957c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
5967c478bd9Sstevel@tonic-gate gettext("trying normal rsh...\n"));
5977c478bd9Sstevel@tonic-gate }
5987c478bd9Sstevel@tonic-gate /*
5997c478bd9Sstevel@tonic-gate * kcmd() failed, so we now fallback to normal rsh,
6007c478bd9Sstevel@tonic-gate * after resetting the KRB5 flags and the 'args' array
6017c478bd9Sstevel@tonic-gate */
6023ca4cacdSPeter Shoults krb5auth_flag = 0;
6037c478bd9Sstevel@tonic-gate encrypt_flag = fflag = Fflag = 0;
6047c478bd9Sstevel@tonic-gate args = args_no_x;
6057c478bd9Sstevel@tonic-gate (void) init_service(B_FALSE);
6067c478bd9Sstevel@tonic-gate } else {
6077c478bd9Sstevel@tonic-gate /*
6087c478bd9Sstevel@tonic-gate * Set up buffers for desread and deswrite.
6097c478bd9Sstevel@tonic-gate */
6107c478bd9Sstevel@tonic-gate desinbuf.data = des_inbuf;
6117c478bd9Sstevel@tonic-gate desoutbuf.data = des_outbuf;
6127c478bd9Sstevel@tonic-gate desinbuf.length = sizeof (des_inbuf);
6137c478bd9Sstevel@tonic-gate desoutbuf.length = sizeof (des_outbuf);
6147c478bd9Sstevel@tonic-gate
6157c478bd9Sstevel@tonic-gate session_key = &cred->keyblock;
6167c478bd9Sstevel@tonic-gate
6177c478bd9Sstevel@tonic-gate if (kcmd_proto == KCMD_NEW_PROTOCOL) {
6187c478bd9Sstevel@tonic-gate status = krb5_auth_con_getlocalsubkey(
6197c478bd9Sstevel@tonic-gate bsd_context,
6207c478bd9Sstevel@tonic-gate auth_context,
6217c478bd9Sstevel@tonic-gate &session_key);
6227c478bd9Sstevel@tonic-gate if (status) {
6237c478bd9Sstevel@tonic-gate com_err("rsh", status,
6247c478bd9Sstevel@tonic-gate "determining subkey for session");
6257c478bd9Sstevel@tonic-gate return (EXIT_FAILURE);
6267c478bd9Sstevel@tonic-gate }
6277c478bd9Sstevel@tonic-gate if (session_key == NULL) {
6287c478bd9Sstevel@tonic-gate com_err("rsh", 0, "no subkey "
6297c478bd9Sstevel@tonic-gate "negotiated for connection");
6307c478bd9Sstevel@tonic-gate return (EXIT_FAILURE);
6317c478bd9Sstevel@tonic-gate }
6327c478bd9Sstevel@tonic-gate }
6337c478bd9Sstevel@tonic-gate
6347c478bd9Sstevel@tonic-gate eblock.crypto_entry = session_key->enctype;
6357c478bd9Sstevel@tonic-gate eblock.key = (krb5_keyblock *)session_key;
6367c478bd9Sstevel@tonic-gate
6377c478bd9Sstevel@tonic-gate init_encrypt(encrypt_flag, bsd_context, kcmd_proto,
6387c478bd9Sstevel@tonic-gate &desinbuf, &desoutbuf, CLIENT, &eblock);
6397c478bd9Sstevel@tonic-gate if (encrypt_flag) {
6407c478bd9Sstevel@tonic-gate char *s = gettext("This rsh session is using "
6417c478bd9Sstevel@tonic-gate "encryption for all data transmissions.");
6427c478bd9Sstevel@tonic-gate (void) write(STDERR_FILENO, s, strlen(s));
6437c478bd9Sstevel@tonic-gate (void) write(STDERR_FILENO, "\r\n", 2);
6447c478bd9Sstevel@tonic-gate }
6457c478bd9Sstevel@tonic-gate }
6467c478bd9Sstevel@tonic-gate }
6477c478bd9Sstevel@tonic-gate
6487c478bd9Sstevel@tonic-gate /*
6497c478bd9Sstevel@tonic-gate * Don't merge this with the "if" statement above because
6507c478bd9Sstevel@tonic-gate * "krb5auth_flag" might be set to false inside it.
6517c478bd9Sstevel@tonic-gate */
6527c478bd9Sstevel@tonic-gate if (!krb5auth_flag) {
6537c478bd9Sstevel@tonic-gate rem = rcmd_af(&host, portnumber, pwd->pw_name, user, args,
6547c478bd9Sstevel@tonic-gate &rfd2, AF_INET6);
6557c478bd9Sstevel@tonic-gate if (rem < 0)
6567c478bd9Sstevel@tonic-gate return (EXIT_FAILURE);
6577c478bd9Sstevel@tonic-gate }
6587c478bd9Sstevel@tonic-gate __priv_relinquish();
6597c478bd9Sstevel@tonic-gate
6607c478bd9Sstevel@tonic-gate if (rfd2 < 0) {
6617c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("rsh: can't establish "
6627c478bd9Sstevel@tonic-gate "stderr\n"));
6637c478bd9Sstevel@tonic-gate return (EXIT_FAILURE);
6647c478bd9Sstevel@tonic-gate }
6657c478bd9Sstevel@tonic-gate if (options & SO_DEBUG) {
6667c478bd9Sstevel@tonic-gate if (setsockopt(rem, SOL_SOCKET, SO_DEBUG, (char *)&one,
6677c478bd9Sstevel@tonic-gate sizeof (one)) < 0)
6687c478bd9Sstevel@tonic-gate perror("rsh: setsockopt (stdin)");
6697c478bd9Sstevel@tonic-gate if (setsockopt(rfd2, SOL_SOCKET, SO_DEBUG, (char *)&one,
6707c478bd9Sstevel@tonic-gate sizeof (one)) < 0)
6717c478bd9Sstevel@tonic-gate perror("rsh: setsockopt (stderr)");
6727c478bd9Sstevel@tonic-gate }
6737c478bd9Sstevel@tonic-gate omask = sigblock(mask(SIGINT)|mask(SIGQUIT)|mask(SIGTERM));
6747c478bd9Sstevel@tonic-gate
6757c478bd9Sstevel@tonic-gate if (sigdisp(SIGINT) != SIG_IGN)
6767c478bd9Sstevel@tonic-gate (void) sigset(SIGINT, sendsig);
6777c478bd9Sstevel@tonic-gate if (sigdisp(SIGQUIT) != SIG_IGN)
6787c478bd9Sstevel@tonic-gate (void) sigset(SIGQUIT, sendsig);
6797c478bd9Sstevel@tonic-gate if (sigdisp(SIGTERM) != SIG_IGN)
6807c478bd9Sstevel@tonic-gate (void) sigset(SIGTERM, sendsig);
6817c478bd9Sstevel@tonic-gate
6827c478bd9Sstevel@tonic-gate if (nflag) {
6837c478bd9Sstevel@tonic-gate (void) shutdown(rem, SHUT_WR);
6847c478bd9Sstevel@tonic-gate } else {
6857c478bd9Sstevel@tonic-gate child_pid = fork();
6867c478bd9Sstevel@tonic-gate if (child_pid < 0) {
6877c478bd9Sstevel@tonic-gate perror("rsh: fork");
6887c478bd9Sstevel@tonic-gate return (EXIT_FAILURE);
6897c478bd9Sstevel@tonic-gate }
6907c478bd9Sstevel@tonic-gate
6917c478bd9Sstevel@tonic-gate if (!encrypt_flag) {
6927c478bd9Sstevel@tonic-gate (void) ioctl(rfd2, FIONBIO, &one);
6937c478bd9Sstevel@tonic-gate (void) ioctl(rem, FIONBIO, &one);
6947c478bd9Sstevel@tonic-gate }
6957c478bd9Sstevel@tonic-gate
6967c478bd9Sstevel@tonic-gate if (child_pid == 0) {
6977c478bd9Sstevel@tonic-gate /* Child */
6987c478bd9Sstevel@tonic-gate fd_set remset;
6997c478bd9Sstevel@tonic-gate char *bp;
7007c478bd9Sstevel@tonic-gate int wc;
7017c478bd9Sstevel@tonic-gate (void) close(rfd2);
7027c478bd9Sstevel@tonic-gate reread:
7037c478bd9Sstevel@tonic-gate errno = 0;
7047c478bd9Sstevel@tonic-gate cc = read(0, buf, sizeof (buf));
7057c478bd9Sstevel@tonic-gate if (cc <= 0)
7067c478bd9Sstevel@tonic-gate goto done;
7077c478bd9Sstevel@tonic-gate bp = buf;
7087c478bd9Sstevel@tonic-gate rewrite:
7097c478bd9Sstevel@tonic-gate FD_ZERO(&remset);
7107c478bd9Sstevel@tonic-gate FD_SET(rem, &remset);
7117c478bd9Sstevel@tonic-gate if (select(rem + 1, NULL, &remset, NULL, NULL) < 0) {
7127c478bd9Sstevel@tonic-gate if (errno != EINTR) {
7137c478bd9Sstevel@tonic-gate perror("rsh: select");
7147c478bd9Sstevel@tonic-gate return (EXIT_FAILURE);
7157c478bd9Sstevel@tonic-gate }
7167c478bd9Sstevel@tonic-gate goto rewrite;
7177c478bd9Sstevel@tonic-gate }
7187c478bd9Sstevel@tonic-gate if (!FD_ISSET(rem, &remset))
7197c478bd9Sstevel@tonic-gate goto rewrite;
7207c478bd9Sstevel@tonic-gate writeiv = B_FALSE;
7217c478bd9Sstevel@tonic-gate wc = desrshwrite(rem, bp, cc);
7227c478bd9Sstevel@tonic-gate if (wc < 0) {
7237c478bd9Sstevel@tonic-gate if (errno == EWOULDBLOCK)
7247c478bd9Sstevel@tonic-gate goto rewrite;
7257c478bd9Sstevel@tonic-gate goto done;
7267c478bd9Sstevel@tonic-gate }
7277c478bd9Sstevel@tonic-gate cc -= wc; bp += wc;
7287c478bd9Sstevel@tonic-gate if (cc == 0)
7297c478bd9Sstevel@tonic-gate goto reread;
7307c478bd9Sstevel@tonic-gate goto rewrite;
7317c478bd9Sstevel@tonic-gate done:
7327c478bd9Sstevel@tonic-gate (void) shutdown(rem, SHUT_WR);
7337c478bd9Sstevel@tonic-gate return (EXIT_SUCCESS);
7347c478bd9Sstevel@tonic-gate }
7357c478bd9Sstevel@tonic-gate }
7367c478bd9Sstevel@tonic-gate
7377c478bd9Sstevel@tonic-gate #define MAX(a, b) (((a) > (b)) ? (a) : (b))
7387c478bd9Sstevel@tonic-gate
7397c478bd9Sstevel@tonic-gate sigsetmask(omask);
7407c478bd9Sstevel@tonic-gate readfrom_rem = B_TRUE;
7417c478bd9Sstevel@tonic-gate readfrom_rfd2 = B_TRUE;
7427c478bd9Sstevel@tonic-gate (void) sigset(SIGPIPE, sigpipehandler);
7437c478bd9Sstevel@tonic-gate do {
7447c478bd9Sstevel@tonic-gate fd_set readyset;
7457c478bd9Sstevel@tonic-gate
7467c478bd9Sstevel@tonic-gate FD_ZERO(&readyset);
7477c478bd9Sstevel@tonic-gate if (readfrom_rem)
7487c478bd9Sstevel@tonic-gate FD_SET(rem, &readyset);
7497c478bd9Sstevel@tonic-gate if (readfrom_rfd2)
7507c478bd9Sstevel@tonic-gate FD_SET(rfd2, &readyset);
7517c478bd9Sstevel@tonic-gate if (select(MAX(rem, rfd2) + 1, &readyset, NULL, NULL,
7527c478bd9Sstevel@tonic-gate NULL) < 0) {
7537c478bd9Sstevel@tonic-gate if (errno != EINTR) {
7547c478bd9Sstevel@tonic-gate perror("rsh: select");
7557c478bd9Sstevel@tonic-gate return (EXIT_FAILURE);
7567c478bd9Sstevel@tonic-gate }
7577c478bd9Sstevel@tonic-gate continue;
7587c478bd9Sstevel@tonic-gate }
7597c478bd9Sstevel@tonic-gate if (FD_ISSET(rfd2, &readyset)) {
7607c478bd9Sstevel@tonic-gate errno = 0;
7617c478bd9Sstevel@tonic-gate readiv = B_TRUE;
7627c478bd9Sstevel@tonic-gate cc = desrshread(rfd2, buf, sizeof (buf));
7637c478bd9Sstevel@tonic-gate if (cc <= 0) {
7647c478bd9Sstevel@tonic-gate if (errno != EWOULDBLOCK)
7657c478bd9Sstevel@tonic-gate readfrom_rfd2 = B_FALSE;
7667c478bd9Sstevel@tonic-gate } else {
7677c478bd9Sstevel@tonic-gate (void) write(STDERR_FILENO, buf, cc);
7687c478bd9Sstevel@tonic-gate }
7697c478bd9Sstevel@tonic-gate }
7707c478bd9Sstevel@tonic-gate if (FD_ISSET(rem, &readyset)) {
7717c478bd9Sstevel@tonic-gate errno = 0;
7727c478bd9Sstevel@tonic-gate readiv = B_FALSE;
7737c478bd9Sstevel@tonic-gate cc = desrshread(rem, buf, sizeof (buf));
7747c478bd9Sstevel@tonic-gate if (cc <= 0) {
7757c478bd9Sstevel@tonic-gate if (errno != EWOULDBLOCK)
7767c478bd9Sstevel@tonic-gate readfrom_rem = B_FALSE;
7777c478bd9Sstevel@tonic-gate } else
7787c478bd9Sstevel@tonic-gate (void) write(STDOUT_FILENO, buf, cc);
7797c478bd9Sstevel@tonic-gate }
7807c478bd9Sstevel@tonic-gate } while (readfrom_rem || readfrom_rfd2);
7817c478bd9Sstevel@tonic-gate
7827c478bd9Sstevel@tonic-gate if (!nflag)
7837c478bd9Sstevel@tonic-gate (void) kill(child_pid, SIGKILL);
7847c478bd9Sstevel@tonic-gate return (EXIT_SUCCESS);
7857c478bd9Sstevel@tonic-gate }
7867c478bd9Sstevel@tonic-gate
7877c478bd9Sstevel@tonic-gate static void
sendsig(int signum)7887c478bd9Sstevel@tonic-gate sendsig(int signum)
7897c478bd9Sstevel@tonic-gate {
7907c478bd9Sstevel@tonic-gate char buffer;
7917c478bd9Sstevel@tonic-gate
7927c478bd9Sstevel@tonic-gate writeiv = B_TRUE;
7937c478bd9Sstevel@tonic-gate buffer = (char)signum;
7947c478bd9Sstevel@tonic-gate (void) desrshwrite(rfd2, &buffer, 1);
7957c478bd9Sstevel@tonic-gate }
7967c478bd9Sstevel@tonic-gate
7977c478bd9Sstevel@tonic-gate static boolean_t
init_service(boolean_t krb5flag)7987c478bd9Sstevel@tonic-gate init_service(boolean_t krb5flag)
7997c478bd9Sstevel@tonic-gate {
8007c478bd9Sstevel@tonic-gate struct servent *sp;
8017c478bd9Sstevel@tonic-gate
8027c478bd9Sstevel@tonic-gate if (krb5flag) {
8037c478bd9Sstevel@tonic-gate sp = getservbyname("kshell", "tcp");
8047c478bd9Sstevel@tonic-gate if (sp == NULL) {
8057c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
8067c478bd9Sstevel@tonic-gate gettext("rsh: kshell/tcp: unknown service.\n"
8077c478bd9Sstevel@tonic-gate "trying normal shell/tcp service\n"));
8087c478bd9Sstevel@tonic-gate return (B_FALSE);
8097c478bd9Sstevel@tonic-gate }
8107c478bd9Sstevel@tonic-gate } else {
8117c478bd9Sstevel@tonic-gate sp = getservbyname("shell", "tcp");
8127c478bd9Sstevel@tonic-gate if (sp == NULL) {
8137c478bd9Sstevel@tonic-gate portnumber = htons(IPPORT_CMDSERVER);
8147c478bd9Sstevel@tonic-gate return (B_TRUE);
8157c478bd9Sstevel@tonic-gate }
8167c478bd9Sstevel@tonic-gate }
8177c478bd9Sstevel@tonic-gate
8187c478bd9Sstevel@tonic-gate portnumber = sp->s_port;
8197c478bd9Sstevel@tonic-gate return (B_TRUE);
8207c478bd9Sstevel@tonic-gate }
8217c478bd9Sstevel@tonic-gate
8227c478bd9Sstevel@tonic-gate static int
desrshread(int fd,char * buf,int len)8237c478bd9Sstevel@tonic-gate desrshread(int fd, char *buf, int len)
8247c478bd9Sstevel@tonic-gate {
8257c478bd9Sstevel@tonic-gate return (desread(fd, buf, len, readiv ? 1 : 0));
8267c478bd9Sstevel@tonic-gate }
8277c478bd9Sstevel@tonic-gate
8287c478bd9Sstevel@tonic-gate static int
desrshwrite(int fd,char * buf,int len)8297c478bd9Sstevel@tonic-gate desrshwrite(int fd, char *buf, int len)
8307c478bd9Sstevel@tonic-gate {
8317c478bd9Sstevel@tonic-gate return (deswrite(fd, buf, len, writeiv ? 1 : 0));
8327c478bd9Sstevel@tonic-gate }
833