xref: /titanic_41/usr/src/cmd/cmd-inet/usr.lib/inetd/inetd.c (revision cd997836b08639dc4d44a032cadd0c7d526f960c)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 /*
27  * NOTES: To be expanded.
28  *
29  * The SMF inetd.
30  *
31  * Below are some high level notes of the operation of the SMF inetd. The
32  * notes don't go into any real detail, and the viewer of this file is
33  * encouraged to look at the code and its associated comments to better
34  * understand inetd's operation. This saves the potential for the code
35  * and these notes diverging over time.
36  *
37  * Inetd's major work is done from the context of event_loop(). Within this
38  * loop, inetd polls for events arriving from a number of different file
39  * descriptors, representing the following event types, and initiates
40  * any necessary event processing:
41  * - incoming network connections/datagrams.
42  * - notification of terminated processes (discovered via contract events).
43  * - instance specific events originating from the SMF master restarter.
44  * - stop/refresh requests from the inetd method processes (coming in on a
45  *   Unix Domain socket).
46  * There's also a timeout set for the poll, which is set to the nearest
47  * scheduled timer in a timer queue that inetd uses to perform delayed
48  * processing, such as bind retries.
49  * The SIGHUP and SIGINT signals can also interrupt the poll, and will
50  * result in inetd being refreshed or stopped respectively, as was the
51  * behavior with the old inetd.
52  *
53  * Inetd implements a state machine for each instance. The states within the
54  * machine are: offline, online, disabled, maintenance, uninitialized and
55  * specializations of the offline state for when an instance exceeds one of
56  * its DOS limits. The state of an instance can be changed as a
57  * result/side-effect of one of the above events occurring, or inetd being
58  * started up. The ongoing state of an instance is stored in the SMF
59  * repository, as required of SMF restarters. This enables an administrator
60  * to view the state of each instance, and, if inetd was to terminate
61  * unexpectedly, it could use the stored state to re-commence where it left off.
62  *
63  * Within the state machine a number of methods are run (if provided) as part
64  * of a state transition to aid/ effect a change in an instance's state. The
65  * supported methods are: offline, online, disable, refresh and start. The
66  * latter of these is the equivalent of the server program and its arguments
67  * in the old inetd.
68  *
69  * Events from the SMF master restarter come in on a number of threads
70  * created in the registration routine of librestart, the delegated restarter
71  * library. These threads call into the restart_event_proxy() function
72  * when an event arrives. To serialize the processing of instances, these events
73  * are then written down a pipe to the process's main thread, which listens
74  * for these events via a poll call, with the file descriptor of the other
75  * end of the pipe in its read set, and processes the event appropriately.
76  * When the event has been  processed (which may be delayed if the instance
77  * for which the event is for is in the process of executing one of its methods
78  * as part of a state transition) it writes an acknowledgement back down the
79  * pipe the event was received on. The thread in restart_event_proxy() that
80  * wrote the event will read the acknowledgement it was blocked upon, and will
81  * then be able to return to its caller, thus implicitly acknowledging the
82  * event, and allowing another event to be written down the pipe for the main
83  * thread to process.
84  */
85 
86 
87 #include <netdb.h>
88 #include <stdio.h>
89 #include <stdio_ext.h>
90 #include <stdlib.h>
91 #include <strings.h>
92 #include <unistd.h>
93 #include <assert.h>
94 #include <sys/types.h>
95 #include <sys/socket.h>
96 #include <netinet/in.h>
97 #include <fcntl.h>
98 #include <signal.h>
99 #include <errno.h>
100 #include <locale.h>
101 #include <syslog.h>
102 #include <libintl.h>
103 #include <librestart.h>
104 #include <pthread.h>
105 #include <sys/stat.h>
106 #include <time.h>
107 #include <limits.h>
108 #include <libgen.h>
109 #include <tcpd.h>
110 #include <libscf.h>
111 #include <libuutil.h>
112 #include <stddef.h>
113 #include <bsm/adt_event.h>
114 #include <ucred.h>
115 #include "inetd_impl.h"
116 
117 /* path to inetd's binary */
118 #define	INETD_PATH	"/usr/lib/inet/inetd"
119 
120 /*
121  * inetd's default configuration file paths. /etc/inetd/inetd.conf is set
122  * be be the primary file, so it is checked before /etc/inetd.conf.
123  */
124 #define	PRIMARY_DEFAULT_CONF_FILE	"/etc/inet/inetd.conf"
125 #define	SECONDARY_DEFAULT_CONF_FILE	"/etc/inetd.conf"
126 
127 /* Arguments passed to this binary to request which method to execute. */
128 #define	START_METHOD_ARG	"start"
129 #define	STOP_METHOD_ARG		"stop"
130 #define	REFRESH_METHOD_ARG	"refresh"
131 
132 /* connection backlog for unix domain socket */
133 #define	UDS_BACKLOG	2
134 
135 /* number of retries to recv() a request on the UDS socket before giving up */
136 #define	UDS_RECV_RETRIES	10
137 
138 /* enumeration of the different ends of a pipe */
139 enum pipe_end {
140 	PE_CONSUMER,
141 	PE_PRODUCER
142 };
143 
144 typedef struct {
145 	internal_inst_state_t		istate;
146 	const char			*name;
147 	restarter_instance_state_t	smf_state;
148 	instance_method_t		method_running;
149 } state_info_t;
150 
151 
152 /*
153  * Collection of information for each state.
154  * NOTE:  This table is indexed into using the internal_inst_state_t
155  * enumeration, so the ordering needs to be kept in synch.
156  */
157 static state_info_t states[] = {
158 	{IIS_UNINITIALIZED, "uninitialized", RESTARTER_STATE_UNINIT,
159 	    IM_NONE},
160 	{IIS_ONLINE, "online", RESTARTER_STATE_ONLINE, IM_START},
161 	{IIS_IN_ONLINE_METHOD, "online_method", RESTARTER_STATE_OFFLINE,
162 	    IM_ONLINE},
163 	{IIS_OFFLINE, "offline", RESTARTER_STATE_OFFLINE, IM_NONE},
164 	{IIS_IN_OFFLINE_METHOD, "offline_method", RESTARTER_STATE_OFFLINE,
165 	    IM_OFFLINE},
166 	{IIS_DISABLED, "disabled", RESTARTER_STATE_DISABLED, IM_NONE},
167 	{IIS_IN_DISABLE_METHOD, "disabled_method", RESTARTER_STATE_OFFLINE,
168 	    IM_DISABLE},
169 	{IIS_IN_REFRESH_METHOD, "refresh_method", RESTARTER_STATE_ONLINE,
170 	    IM_REFRESH},
171 	{IIS_MAINTENANCE, "maintenance", RESTARTER_STATE_MAINT, IM_NONE},
172 	{IIS_OFFLINE_CONRATE, "cr_offline", RESTARTER_STATE_OFFLINE, IM_NONE},
173 	{IIS_OFFLINE_BIND, "bind_offline", RESTARTER_STATE_OFFLINE, IM_NONE},
174 	{IIS_OFFLINE_COPIES, "copies_offline", RESTARTER_STATE_OFFLINE,
175 	    IM_NONE},
176 	{IIS_DEGRADED, "degraded", RESTARTER_STATE_DEGRADED, IM_NONE},
177 	{IIS_NONE, "none", RESTARTER_STATE_NONE, IM_NONE}
178 };
179 
180 /*
181  * Pipe used to send events from the threads created by restarter_bind_handle()
182  * to the main thread of control.
183  */
184 static int			rst_event_pipe[] = {-1, -1};
185 /*
186  * Used to protect the critical section of code in restarter_event_proxy() that
187  * involves writing an event down the event pipe and reading an acknowledgement.
188  */
189 static pthread_mutex_t		rst_event_pipe_mtx = PTHREAD_MUTEX_INITIALIZER;
190 
191 /* handle used in communication with the master restarter */
192 static restarter_event_handle_t *rst_event_handle = NULL;
193 
194 /* set to indicate a refresh of inetd is requested */
195 static boolean_t		refresh_inetd_requested = B_FALSE;
196 
197 /* set by the SIGTERM handler to flag we got a SIGTERM */
198 static boolean_t		got_sigterm = B_FALSE;
199 
200 /*
201  * Timer queue used to store timers for delayed event processing, such as
202  * bind retries.
203  */
204 iu_tq_t				*timer_queue = NULL;
205 
206 /*
207  * fd of Unix Domain socket used to communicate stop and refresh requests
208  * to the inetd start method process.
209  */
210 static int			uds_fd = -1;
211 
212 /*
213  * List of inetd's currently managed instances; each containing its state,
214  * and in certain states its configuration.
215  */
216 static uu_list_pool_t		*instance_pool = NULL;
217 uu_list_t			*instance_list = NULL;
218 
219 /* set to indicate we're being stopped */
220 boolean_t			inetd_stopping = B_FALSE;
221 
222 /* TCP wrappers syslog globals. Consumed by libwrap. */
223 int				allow_severity = LOG_INFO;
224 int				deny_severity = LOG_WARNING;
225 
226 /* path of the configuration file being monitored by check_conf_file() */
227 static char			*conf_file = NULL;
228 
229 /* Auditing session handle */
230 static adt_session_data_t	*audit_handle;
231 
232 /* Number of pending connections */
233 static size_t			tlx_pending_counter;
234 
235 static void uds_fini(void);
236 static int uds_init(void);
237 static int run_method(instance_t *, instance_method_t, const proto_info_t *);
238 static void create_bound_fds(instance_t *);
239 static void destroy_bound_fds(instance_t *);
240 static void destroy_instance(instance_t *);
241 static void inetd_stop(void);
242 static void
243 exec_method(instance_t *instance, instance_method_t method, method_info_t *mi,
244     struct method_context *mthd_ctxt, const proto_info_t *pi) __NORETURN;
245 
246 /*
247  * The following two functions are callbacks that libumem uses to determine
248  * inetd's desired debugging/logging levels. The interface they consume is
249  * exported by FMA and is consolidation private. The comments in the two
250  * functions give the environment variable that will effectively be set to
251  * their returned value, and thus whose behavior for this value, described in
252  * umem_debug(3MALLOC), will be followed.
253  */
254 
255 const char *
256 _umem_debug_init(void)
257 {
258 	return ("default,verbose");	/* UMEM_DEBUG setting */
259 }
260 
261 const char *
262 _umem_logging_init(void)
263 {
264 	return ("fail,contents");	/* UMEM_LOGGING setting */
265 }
266 
267 static void
268 log_invalid_cfg(const char *fmri)
269 {
270 	error_msg(gettext(
271 	    "Invalid configuration for instance %s, placing in maintenance"),
272 	    fmri);
273 }
274 
275 /*
276  * Returns B_TRUE if the instance is in a suitable state for inetd to stop.
277  */
278 static boolean_t
279 instance_stopped(const instance_t *inst)
280 {
281 	return ((inst->cur_istate == IIS_OFFLINE) ||
282 	    (inst->cur_istate == IIS_MAINTENANCE) ||
283 	    (inst->cur_istate == IIS_DISABLED) ||
284 	    (inst->cur_istate == IIS_UNINITIALIZED));
285 }
286 
287 /*
288  * Given the instance fmri, obtain the corresonding scf_instance.
289  * Caller is responsible for freeing the returned scf_instance and
290  * its scf_handle.
291  */
292 static int
293 fmri_to_instance(char *fmri, scf_instance_t **scf_instp)
294 {
295 	int retries, ret = 1;
296 	scf_handle_t	*h;
297 	scf_instance_t *scf_inst;
298 
299 	if ((h = scf_handle_create(SCF_VERSION)) == NULL) {
300 		error_msg(gettext("Failed to get instance for %s"), fmri);
301 		return (1);
302 	}
303 
304 	if ((scf_inst = scf_instance_create(h)) == NULL)
305 		goto out;
306 
307 	for (retries = 0; retries <= REP_OP_RETRIES; retries++) {
308 		if (make_handle_bound(h) == -1)
309 			break;
310 
311 		if (scf_handle_decode_fmri(h, fmri, NULL, NULL, scf_inst,
312 		    NULL, NULL, SCF_DECODE_FMRI_EXACT) == 0) {
313 			ret = 0;
314 			*scf_instp = scf_inst;
315 			break;
316 		}
317 
318 		if (scf_error() != SCF_ERROR_CONNECTION_BROKEN)
319 			break;
320 	}
321 
322 out:
323 	if (ret != 0) {
324 		error_msg(gettext("Failed to get instance for %s"), fmri);
325 		scf_instance_destroy(scf_inst);
326 		scf_handle_destroy(h);
327 	}
328 
329 	return (ret);
330 }
331 
332 /*
333  * Updates the current and next repository states of instance 'inst'. If
334  * any errors occur an error message is output.
335  */
336 static void
337 update_instance_states(instance_t *inst, internal_inst_state_t new_cur_state,
338     internal_inst_state_t new_next_state, restarter_error_t err)
339 {
340 	internal_inst_state_t	old_cur = inst->cur_istate;
341 	internal_inst_state_t	old_next = inst->next_istate;
342 	scf_instance_t		*scf_inst = NULL;
343 	scf_error_t		sret;
344 	int			ret;
345 	char			*aux = "none";
346 
347 	/* update the repository/cached internal state */
348 	inst->cur_istate = new_cur_state;
349 	inst->next_istate = new_next_state;
350 	(void) set_single_rep_val(inst->cur_istate_rep,
351 	    (int64_t)new_cur_state);
352 	(void) set_single_rep_val(inst->next_istate_rep,
353 	    (int64_t)new_next_state);
354 
355 	if (((sret = store_rep_vals(inst->cur_istate_rep, inst->fmri,
356 	    PR_NAME_CUR_INT_STATE)) != 0) ||
357 	    ((sret = store_rep_vals(inst->next_istate_rep, inst->fmri,
358 	    PR_NAME_NEXT_INT_STATE)) != 0))
359 		error_msg(gettext("Failed to update state of instance %s in "
360 		    "repository: %s"), inst->fmri, scf_strerror(sret));
361 
362 	if (fmri_to_instance(inst->fmri, &scf_inst) == 0) {
363 		/*
364 		 * If transitioning to maintenance, check auxiliary_tty set
365 		 * by svcadm and assign appropriate value to auxiliary_state.
366 		 * If the maintenance event comes from a service request,
367 		 * validate auxiliary_fmri and copy it to
368 		 * restarter/auxiliary_fmri.
369 		 */
370 		if (new_cur_state == IIS_MAINTENANCE) {
371 			if (restarter_inst_ractions_from_tty(scf_inst) == 0)
372 				aux = "service_request";
373 			else
374 				aux = "administrative_request";
375 		}
376 
377 		if (strcmp(aux, "service_request") == 0) {
378 			if (restarter_inst_validate_ractions_aux_fmri(
379 			    scf_inst) == 0) {
380 				if (restarter_inst_set_aux_fmri(scf_inst))
381 					error_msg(gettext("Could not set "
382 					    "auxiliary_fmri property for %s"),
383 					    inst->fmri);
384 			} else {
385 				if (restarter_inst_reset_aux_fmri(scf_inst))
386 					error_msg(gettext("Could not reset "
387 					    "auxiliary_fmri property for %s"),
388 					    inst->fmri);
389 			}
390 		}
391 		scf_handle_destroy(scf_instance_handle(scf_inst));
392 		scf_instance_destroy(scf_inst);
393 	}
394 
395 	/* update the repository SMF state */
396 	if ((ret = restarter_set_states(rst_event_handle, inst->fmri,
397 	    states[old_cur].smf_state, states[new_cur_state].smf_state,
398 	    states[old_next].smf_state, states[new_next_state].smf_state,
399 	    err, aux)) != 0)
400 		error_msg(gettext("Failed to update state of instance %s in "
401 		    "repository: %s"), inst->fmri, strerror(ret));
402 }
403 
404 void
405 update_state(instance_t *inst, internal_inst_state_t new_cur,
406     restarter_error_t err)
407 {
408 	update_instance_states(inst, new_cur, IIS_NONE, err);
409 }
410 
411 /*
412  * Sends a refresh event to the inetd start method process and returns
413  * SMF_EXIT_OK if it managed to send it. If it fails to send the request for
414  * some reason it returns SMF_EXIT_ERR_OTHER.
415  */
416 static int
417 refresh_method(void)
418 {
419 	uds_request_t   req = UR_REFRESH_INETD;
420 	int		fd;
421 
422 	if ((fd = connect_to_inetd()) < 0) {
423 		error_msg(gettext("Failed to connect to inetd: %s"),
424 		    strerror(errno));
425 		return (SMF_EXIT_ERR_OTHER);
426 	}
427 
428 	/* write the request and return success */
429 	if (safe_write(fd, &req, sizeof (req)) == -1) {
430 		error_msg(
431 		    gettext("Failed to send refresh request to inetd: %s"),
432 		    strerror(errno));
433 		(void) close(fd);
434 		return (SMF_EXIT_ERR_OTHER);
435 	}
436 
437 	(void) close(fd);
438 
439 	return (SMF_EXIT_OK);
440 }
441 
442 /*
443  * Sends a stop event to the inetd start method process and wait till it goes
444  * away. If inetd is determined to have stopped SMF_EXIT_OK is returned, else
445  * SMF_EXIT_ERR_OTHER is returned.
446  */
447 static int
448 stop_method(void)
449 {
450 	uds_request_t   req = UR_STOP_INETD;
451 	int		fd;
452 	char		c;
453 	ssize_t		ret;
454 
455 	if ((fd = connect_to_inetd()) == -1) {
456 		debug_msg(gettext("Failed to connect to inetd: %s"),
457 		    strerror(errno));
458 		/*
459 		 * Assume connect_to_inetd() failed because inetd was already
460 		 * stopped, and return success.
461 		 */
462 		return (SMF_EXIT_OK);
463 	}
464 
465 	/*
466 	 * This is safe to do since we're fired off in a separate process
467 	 * than inetd and in the case we get wedged, the stop method timeout
468 	 * will occur and we'd be killed by our restarter.
469 	 */
470 	enable_blocking(fd);
471 
472 	/* write the stop request to inetd and wait till it goes away */
473 	if (safe_write(fd, &req, sizeof (req)) != 0) {
474 		error_msg(gettext("Failed to send stop request to inetd"));
475 		(void) close(fd);
476 		return (SMF_EXIT_ERR_OTHER);
477 	}
478 
479 	/* wait until remote end of socket is closed */
480 	while (((ret = recv(fd, &c, sizeof (c), 0)) != 0) && (errno == EINTR))
481 		;
482 
483 	(void) close(fd);
484 
485 	if (ret != 0) {
486 		error_msg(gettext("Failed to determine whether inetd stopped"));
487 		return (SMF_EXIT_ERR_OTHER);
488 	}
489 
490 	return (SMF_EXIT_OK);
491 }
492 
493 
494 /*
495  * This function is called to handle restarter events coming in from the
496  * master restarter. It is registered with the master restarter via
497  * restarter_bind_handle() and simply passes a pointer to the event down
498  * the event pipe, which will be discovered by the poll in the event loop
499  * and processed there. It waits for an acknowledgement to be written back down
500  * the pipe before returning.
501  * Writing a pointer to the function's 'event' parameter down the pipe will
502  * be safe, as the thread in restarter_event_proxy() doesn't return until
503  * the main thread has finished its processing of the passed event, thus
504  * the referenced event will remain around until the function returns.
505  * To impose the limit of only one event being in the pipe and processed
506  * at once, a lock is taken on entry to this function and returned on exit.
507  * Always returns 0.
508  */
509 static int
510 restarter_event_proxy(restarter_event_t *event)
511 {
512 	boolean_t		processed;
513 
514 	(void) pthread_mutex_lock(&rst_event_pipe_mtx);
515 
516 	/* write the event to the main worker thread down the pipe */
517 	if (safe_write(rst_event_pipe[PE_PRODUCER], &event,
518 	    sizeof (event)) != 0)
519 		goto pipe_error;
520 
521 	/*
522 	 * Wait for an acknowledgement that the event has been processed from
523 	 * the same pipe. In the case that inetd is stopping, any thread in
524 	 * this function will simply block on this read until inetd eventually
525 	 * exits. This will result in this function not returning success to
526 	 * its caller, and the event that was being processed when the
527 	 * function exited will be re-sent when inetd is next started.
528 	 */
529 	if (safe_read(rst_event_pipe[PE_PRODUCER], &processed,
530 	    sizeof (processed)) != 0)
531 		goto pipe_error;
532 
533 	(void) pthread_mutex_unlock(&rst_event_pipe_mtx);
534 
535 	return (processed ? 0 : EAGAIN);
536 
537 pipe_error:
538 	/*
539 	 * Something's seriously wrong with the event pipe. Notify the
540 	 * worker thread by closing this end of the event pipe and pause till
541 	 * inetd exits.
542 	 */
543 	error_msg(gettext("Can't process restarter events: %s"),
544 	    strerror(errno));
545 	(void) close(rst_event_pipe[PE_PRODUCER]);
546 	for (;;)
547 		(void) pause();
548 
549 	/* NOTREACHED */
550 }
551 
552 /*
553  * Let restarter_event_proxy() know we're finished with the event it's blocked
554  * upon. The 'processed' argument denotes whether we successfully processed the
555  * event.
556  */
557 static void
558 ack_restarter_event(boolean_t processed)
559 {
560 	/*
561 	 * If safe_write returns -1 something's seriously wrong with the event
562 	 * pipe, so start the shutdown proceedings.
563 	 */
564 	if (safe_write(rst_event_pipe[PE_CONSUMER], &processed,
565 	    sizeof (processed)) == -1)
566 		inetd_stop();
567 }
568 
569 /*
570  * Switch the syslog identification string to 'ident'.
571  */
572 static void
573 change_syslog_ident(const char *ident)
574 {
575 	closelog();
576 	openlog(ident, LOG_PID|LOG_CONS, LOG_DAEMON);
577 }
578 
579 /*
580  * Perform TCP wrappers checks on this instance. Due to the fact that the
581  * current wrappers code used in Solaris is taken untouched from the open
582  * source version, we're stuck with using the daemon name for the checks, as
583  * opposed to making use of instance FMRIs. Sigh.
584  * Returns B_TRUE if the check passed, else B_FALSE.
585  */
586 static boolean_t
587 tcp_wrappers_ok(instance_t *instance)
588 {
589 	boolean_t		rval = B_TRUE;
590 	char			*daemon_name;
591 	basic_cfg_t		*cfg = instance->config->basic;
592 	struct request_info	req;
593 
594 	/*
595 	 * Wrap the service using libwrap functions. The code below implements
596 	 * the functionality of tcpd. This is done only for stream,nowait
597 	 * services, following the convention of other vendors.  udp/dgram and
598 	 * stream/wait can NOT be wrapped with this libwrap, so be wary of
599 	 * changing the test below.
600 	 */
601 	if (cfg->do_tcp_wrappers && !cfg->iswait && !cfg->istlx) {
602 
603 		daemon_name = instance->config->methods[
604 		    IM_START]->exec_args_we.we_wordv[0];
605 		if (*daemon_name == '/')
606 			daemon_name = strrchr(daemon_name, '/') + 1;
607 
608 		/*
609 		 * Change the syslog message identity to the name of the
610 		 * daemon being wrapped, as opposed to "inetd".
611 		 */
612 		change_syslog_ident(daemon_name);
613 
614 		(void) request_init(&req, RQ_DAEMON, daemon_name, RQ_FILE,
615 		    instance->conn_fd, NULL);
616 		fromhost(&req);
617 
618 		if (strcasecmp(eval_hostname(req.client), paranoid) == 0) {
619 			syslog(deny_severity,
620 			    "refused connect from %s (name/address mismatch)",
621 			    eval_client(&req));
622 			if (req.sink != NULL)
623 				req.sink(instance->conn_fd);
624 			rval = B_FALSE;
625 		} else if (!hosts_access(&req)) {
626 			syslog(deny_severity,
627 			    "refused connect from %s (access denied)",
628 			    eval_client(&req));
629 			if (req.sink != NULL)
630 				req.sink(instance->conn_fd);
631 			rval = B_FALSE;
632 		} else {
633 			syslog(allow_severity, "connect from %s",
634 			    eval_client(&req));
635 		}
636 
637 		/* Revert syslog identity back to "inetd". */
638 		change_syslog_ident(SYSLOG_IDENT);
639 	}
640 	return (rval);
641 }
642 
643 /*
644  * Handler registered with the timer queue code to remove an instance from
645  * the connection rate offline state when it has been there for its allotted
646  * time.
647  */
648 /* ARGSUSED */
649 static void
650 conn_rate_online(iu_tq_t *tq, void *arg)
651 {
652 	instance_t *instance = arg;
653 
654 	assert(instance->cur_istate == IIS_OFFLINE_CONRATE);
655 	instance->timer_id = -1;
656 	update_state(instance, IIS_OFFLINE, RERR_RESTART);
657 	process_offline_inst(instance);
658 }
659 
660 /*
661  * Check whether this instance in the offline state is in transition to
662  * another state and do the work to continue this transition.
663  */
664 void
665 process_offline_inst(instance_t *inst)
666 {
667 	if (inst->disable_req) {
668 		inst->disable_req = B_FALSE;
669 		(void) run_method(inst, IM_DISABLE, NULL);
670 	} else if (inst->maintenance_req) {
671 		inst->maintenance_req = B_FALSE;
672 		update_state(inst, IIS_MAINTENANCE, RERR_RESTART);
673 	/*
674 	 * If inetd is in the process of stopping, we don't want to enter
675 	 * any states but offline, disabled and maintenance.
676 	 */
677 	} else if (!inetd_stopping) {
678 		if (inst->conn_rate_exceeded) {
679 			basic_cfg_t *cfg = inst->config->basic;
680 
681 			inst->conn_rate_exceeded = B_FALSE;
682 			update_state(inst, IIS_OFFLINE_CONRATE, RERR_RESTART);
683 			/*
684 			 * Schedule a timer to bring the instance out of the
685 			 * connection rate offline state.
686 			 */
687 			inst->timer_id = iu_schedule_timer(timer_queue,
688 			    cfg->conn_rate_offline, conn_rate_online,
689 			    inst);
690 			if (inst->timer_id == -1) {
691 				error_msg(gettext("%s unable to set timer, "
692 				    "won't be brought on line after %d "
693 				    "seconds."), inst->fmri,
694 				    cfg->conn_rate_offline);
695 			}
696 
697 		} else if (copies_limit_exceeded(inst)) {
698 			update_state(inst, IIS_OFFLINE_COPIES, RERR_RESTART);
699 		}
700 	}
701 }
702 
703 /*
704  * Create a socket bound to the instance's configured address. If the
705  * bind fails, returns -1, else the fd of the bound socket.
706  */
707 static int
708 create_bound_socket(const instance_t *inst, socket_info_t *sock_info)
709 {
710 	int		fd;
711 	int		on = 1;
712 	const char	*fmri = inst->fmri;
713 	rpc_info_t	*rpc = sock_info->pr_info.ri;
714 	const char	*proto = sock_info->pr_info.proto;
715 
716 	fd = socket(sock_info->local_addr.ss_family, sock_info->type,
717 	    sock_info->protocol);
718 	if (fd < 0) {
719 		error_msg(gettext(
720 		    "Socket creation failure for instance %s, proto %s: %s"),
721 		    fmri, proto, strerror(errno));
722 		return (-1);
723 	}
724 
725 	if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof (on)) == -1) {
726 		error_msg(gettext("setsockopt SO_REUSEADDR failed for service "
727 		    "instance %s, proto %s: %s"), fmri, proto, strerror(errno));
728 		(void) close(fd);
729 		return (-1);
730 	}
731 	if (sock_info->pr_info.v6only) {
732 		/* restrict socket to IPv6 communications only */
733 		if (setsockopt(fd, IPPROTO_IPV6, IPV6_V6ONLY, &on,
734 		    sizeof (on)) == -1) {
735 			error_msg(gettext("setsockopt IPV6_V6ONLY failed for "
736 			    "service instance %s, proto %s: %s"), fmri, proto,
737 			    strerror(errno));
738 			(void) close(fd);
739 			return (-1);
740 		}
741 	}
742 
743 	if (rpc != NULL)
744 		SS_SETPORT(sock_info->local_addr, 0);
745 
746 	if (bind(fd, (struct sockaddr *)&(sock_info->local_addr),
747 	    SS_ADDRLEN(sock_info->local_addr)) < 0) {
748 		error_msg(gettext(
749 		    "Failed to bind to the port of service instance %s, "
750 		    "proto %s: %s"), fmri, proto, strerror(errno));
751 		(void) close(fd);
752 		return (-1);
753 	}
754 
755 	/*
756 	 * Retrieve and store the address bound to for RPC services.
757 	 */
758 	if (rpc != NULL) {
759 		struct sockaddr_storage	ss;
760 		int			ss_size = sizeof (ss);
761 
762 		if (getsockname(fd, (struct sockaddr *)&ss, &ss_size) < 0) {
763 			error_msg(gettext("Failed getsockname for instance %s, "
764 			    "proto %s: %s"), fmri, proto, strerror(errno));
765 			(void) close(fd);
766 			return (-1);
767 		}
768 		(void) memcpy(rpc->netbuf.buf, &ss,
769 		    sizeof (struct sockaddr_storage));
770 		rpc->netbuf.len = SS_ADDRLEN(ss);
771 		rpc->netbuf.maxlen = SS_ADDRLEN(ss);
772 	}
773 
774 	if (sock_info->type == SOCK_STREAM) {
775 		int qlen = inst->config->basic->conn_backlog;
776 
777 		debug_msg("Listening for service %s with backlog queue"
778 		    " size %d", fmri, qlen);
779 		(void) listen(fd, qlen);
780 	}
781 
782 	return (fd);
783 }
784 
785 /*
786  * Handler registered with the timer queue code to retry the creation
787  * of a bound fd.
788  */
789 /* ARGSUSED */
790 static void
791 retry_bind(iu_tq_t *tq, void *arg)
792 {
793 	instance_t *instance = arg;
794 
795 	switch (instance->cur_istate) {
796 	case IIS_OFFLINE_BIND:
797 	case IIS_ONLINE:
798 	case IIS_DEGRADED:
799 	case IIS_IN_ONLINE_METHOD:
800 	case IIS_IN_REFRESH_METHOD:
801 		break;
802 	default:
803 #ifndef NDEBUG
804 		(void) fprintf(stderr, "%s:%d: Unknown instance state %d.\n",
805 		    __FILE__, __LINE__, instance->cur_istate);
806 #endif
807 		abort();
808 	}
809 
810 	instance->bind_timer_id = -1;
811 	create_bound_fds(instance);
812 }
813 
814 /*
815  * For each of the fds for the given instance that are bound, if 'listen' is
816  * set add them to the poll set, else remove them from it. If proto_name is
817  * not NULL then apply the change only to this specific protocol endpoint.
818  * If any additions fail, returns -1, else 0 on success.
819  */
820 int
821 poll_bound_fds(instance_t *instance, boolean_t listen, char *proto_name)
822 {
823 	basic_cfg_t	*cfg = instance->config->basic;
824 	proto_info_t	*pi;
825 	int		ret = 0;
826 
827 	for (pi = uu_list_first(cfg->proto_list); pi != NULL;
828 	    pi = uu_list_next(cfg->proto_list, pi)) {
829 		if (pi->listen_fd != -1) {	/* fd bound */
830 			if (proto_name == NULL ||
831 			    strcmp(pi->proto, proto_name) == 0) {
832 				if (listen == B_FALSE) {
833 					clear_pollfd(pi->listen_fd);
834 				} else if (set_pollfd(pi->listen_fd,
835 				    POLLIN) == -1) {
836 					ret = -1;
837 				}
838 			}
839 		}
840 	}
841 
842 	return (ret);
843 }
844 
845 /*
846  * Handle the case were we either fail to create a bound fd or we fail
847  * to add a bound fd to the poll set for the given instance.
848  */
849 static void
850 handle_bind_failure(instance_t *instance)
851 {
852 	basic_cfg_t *cfg = instance->config->basic;
853 
854 	/*
855 	 * We must be being called as a result of a failed poll_bound_fds()
856 	 * as a bind retry is already scheduled. Just return and let it do
857 	 * the work.
858 	 */
859 	if (instance->bind_timer_id != -1)
860 		return;
861 
862 	/*
863 	 * Check if the rebind retries limit is operative and if so,
864 	 * if it has been reached.
865 	 */
866 	if (((cfg->bind_fail_interval <= 0) ||		/* no retries */
867 	    ((cfg->bind_fail_max >= 0) &&		/* limit reached */
868 	    (++instance->bind_fail_count > cfg->bind_fail_max))) ||
869 	    ((instance->bind_timer_id = iu_schedule_timer(timer_queue,
870 	    cfg->bind_fail_interval, retry_bind, instance)) == -1)) {
871 		proto_info_t *pi;
872 
873 		instance->bind_fail_count = 0;
874 
875 		switch (instance->cur_istate) {
876 		case IIS_DEGRADED:
877 		case IIS_ONLINE:
878 			/* check if any of the fds are being poll'd upon */
879 			for (pi = uu_list_first(cfg->proto_list); pi != NULL;
880 			    pi = uu_list_next(cfg->proto_list, pi)) {
881 				if ((pi->listen_fd != -1) &&
882 				    (find_pollfd(pi->listen_fd) != NULL))
883 					break;
884 			}
885 			if (pi != NULL)	{	/* polling on > 0 fds */
886 				warn_msg(gettext("Failed to bind on "
887 				    "all protocols for instance %s, "
888 				    "transitioning to degraded"),
889 				    instance->fmri);
890 				update_state(instance, IIS_DEGRADED, RERR_NONE);
891 				instance->bind_retries_exceeded = B_TRUE;
892 				break;
893 			}
894 
895 			destroy_bound_fds(instance);
896 			/*
897 			 * In the case we failed the 'bind' because set_pollfd()
898 			 * failed on all bound fds, use the offline handling.
899 			 */
900 			/* FALLTHROUGH */
901 		case IIS_OFFLINE:
902 		case IIS_OFFLINE_BIND:
903 			error_msg(gettext("Too many bind failures for instance "
904 			"%s, transitioning to maintenance"), instance->fmri);
905 			update_state(instance, IIS_MAINTENANCE,
906 			    RERR_FAULT);
907 			break;
908 		case IIS_IN_ONLINE_METHOD:
909 		case IIS_IN_REFRESH_METHOD:
910 			warn_msg(gettext("Failed to bind on all "
911 			    "protocols for instance %s, instance will go to "
912 			    "degraded"), instance->fmri);
913 			/*
914 			 * Set the retries exceeded flag so when the method
915 			 * completes the instance goes to the degraded state.
916 			 */
917 			instance->bind_retries_exceeded = B_TRUE;
918 			break;
919 		default:
920 #ifndef NDEBUG
921 			(void) fprintf(stderr,
922 			    "%s:%d: Unknown instance state %d.\n",
923 			    __FILE__, __LINE__, instance->cur_istate);
924 #endif
925 			abort();
926 		}
927 	} else if (instance->cur_istate == IIS_OFFLINE) {
928 		/*
929 		 * bind re-scheduled, so if we're offline reflect this in the
930 		 * state.
931 		 */
932 		update_state(instance, IIS_OFFLINE_BIND, RERR_NONE);
933 	}
934 }
935 
936 
937 /*
938  * Check if two transport protocols for RPC conflict.
939  */
940 
941 boolean_t
942 is_rpc_proto_conflict(const char *proto0, const char *proto1) {
943 	if (strcmp(proto0, "tcp") == 0) {
944 		if (strcmp(proto1, "tcp") == 0)
945 			return (B_TRUE);
946 		if (strcmp(proto1, "tcp6") == 0)
947 			return (B_TRUE);
948 		return (B_FALSE);
949 	}
950 
951 	if (strcmp(proto0, "tcp6") == 0) {
952 		if (strcmp(proto1, "tcp") == 0)
953 			return (B_TRUE);
954 		if (strcmp(proto1, "tcp6only") == 0)
955 			return (B_TRUE);
956 		if (strcmp(proto1, "tcp6") == 0)
957 			return (B_TRUE);
958 		return (B_FALSE);
959 	}
960 
961 	if (strcmp(proto0, "tcp6only") == 0) {
962 		if (strcmp(proto1, "tcp6only") == 0)
963 			return (B_TRUE);
964 		if (strcmp(proto1, "tcp6") == 0)
965 			return (B_TRUE);
966 		return (B_FALSE);
967 	}
968 
969 	if (strcmp(proto0, "udp") == 0) {
970 		if (strcmp(proto1, "udp") == 0)
971 			return (B_TRUE);
972 		if (strcmp(proto1, "udp6") == 0)
973 			return (B_TRUE);
974 		return (B_FALSE);
975 	}
976 
977 	if (strcmp(proto0, "udp6") == 0) {
978 
979 		if (strcmp(proto1, "udp") == 0)
980 			return (B_TRUE);
981 		if (strcmp(proto1, "udp6only") == 0)
982 			return (B_TRUE);
983 		if (strcmp(proto1, "udp6") == 0)
984 			return (B_TRUE);
985 		return (B_FALSE);
986 	}
987 
988 	if (strcmp(proto0, "udp6only") == 0) {
989 
990 		if (strcmp(proto1, "udp6only") == 0)
991 			return (B_TRUE);
992 		if (strcmp(proto1, "udp6") == 0)
993 			return (B_TRUE);
994 		return (0);
995 	}
996 
997 	/*
998 	 * If the protocol isn't TCP/IP or UDP/IP assume that it has its own
999 	 * port namepsace and that conflicts can be detected by literal string
1000 	 * comparison.
1001 	 */
1002 
1003 	if (strcmp(proto0, proto1))
1004 		return (FALSE);
1005 
1006 	return (B_TRUE);
1007 }
1008 
1009 
1010 /*
1011  * Check if inetd thinks this RPC program number is already registered.
1012  *
1013  * An RPC protocol conflict occurs if
1014  * 	a) the program numbers are the same and,
1015  * 	b) the version numbers overlap,
1016  * 	c) the protocols (TCP vs UDP vs tic*) are the same.
1017  */
1018 
1019 boolean_t
1020 is_rpc_num_in_use(int rpc_n, char *proto, int lowver, int highver) {
1021 	instance_t *i;
1022 	basic_cfg_t *cfg;
1023 	proto_info_t *pi;
1024 
1025 	for (i = uu_list_first(instance_list); i != NULL;
1026 	    i = uu_list_next(instance_list, i)) {
1027 
1028 		if (i->cur_istate != IIS_ONLINE)
1029 			continue;
1030 		cfg = i->config->basic;
1031 
1032 		for (pi = uu_list_first(cfg->proto_list); pi != NULL;
1033 		    pi = uu_list_next(cfg->proto_list, pi)) {
1034 
1035 			if (pi->ri == NULL)
1036 				continue;
1037 			if (pi->ri->prognum != rpc_n)
1038 				continue;
1039 			if (!is_rpc_proto_conflict(pi->proto, proto))
1040 				continue;
1041 			if ((lowver < pi->ri->lowver &&
1042 			    highver < pi->ri->lowver) ||
1043 			    (lowver > pi->ri->highver &&
1044 			    highver > pi->ri->highver))
1045 				continue;
1046 			return (B_TRUE);
1047 		}
1048 	}
1049 	return (B_FALSE);
1050 }
1051 
1052 
1053 /*
1054  * Independent of the transport, for each of the entries in the instance's
1055  * proto list this function first attempts to create an associated network fd;
1056  * for RPC services these are then bound to a kernel chosen port and the
1057  * fd is registered with rpcbind; for non-RPC services the fds are bound
1058  * to the port associated with the instance's service name. On any successful
1059  * binds the instance is taken online. Failed binds are handled by
1060  * handle_bind_failure().
1061  */
1062 void
1063 create_bound_fds(instance_t *instance)
1064 {
1065 	basic_cfg_t	*cfg = instance->config->basic;
1066 	boolean_t	failure = B_FALSE;
1067 	boolean_t	success = B_FALSE;
1068 	proto_info_t	*pi;
1069 
1070 	/*
1071 	 * Loop through and try and bind any unbound protos.
1072 	 */
1073 	for (pi = uu_list_first(cfg->proto_list); pi != NULL;
1074 	    pi = uu_list_next(cfg->proto_list, pi)) {
1075 		if (pi->listen_fd != -1)
1076 			continue;
1077 		if (cfg->istlx) {
1078 			pi->listen_fd = create_bound_endpoint(instance,
1079 			    (tlx_info_t *)pi);
1080 		} else {
1081 			/*
1082 			 * We cast pi to a void so we can then go on to cast
1083 			 * it to a socket_info_t without lint complaining
1084 			 * about alignment. This is done because the x86
1085 			 * version of lint thinks a lint suppression directive
1086 			 * is unnecessary and flags it as such, yet the sparc
1087 			 * version complains if it's absent.
1088 			 */
1089 			void *p = pi;
1090 			pi->listen_fd = create_bound_socket(instance,
1091 			    (socket_info_t *)p);
1092 		}
1093 		if (pi->listen_fd == -1) {
1094 			failure = B_TRUE;
1095 			continue;
1096 		}
1097 
1098 		if (pi->ri != NULL) {
1099 
1100 			/*
1101 			 * Don't register the same RPC program number twice.
1102 			 * Doing so silently discards the old service
1103 			 * without causing an error.
1104 			 */
1105 			if (is_rpc_num_in_use(pi->ri->prognum, pi->proto,
1106 			    pi->ri->lowver, pi->ri->highver)) {
1107 				failure = B_TRUE;
1108 				close_net_fd(instance, pi->listen_fd);
1109 				pi->listen_fd = -1;
1110 				continue;
1111 			}
1112 
1113 			unregister_rpc_service(instance->fmri, pi->ri);
1114 			if (register_rpc_service(instance->fmri, pi->ri) ==
1115 			    -1) {
1116 				close_net_fd(instance, pi->listen_fd);
1117 				pi->listen_fd = -1;
1118 				failure = B_TRUE;
1119 				continue;
1120 			}
1121 		}
1122 
1123 		success = B_TRUE;
1124 	}
1125 
1126 	switch (instance->cur_istate) {
1127 	case IIS_OFFLINE:
1128 	case IIS_OFFLINE_BIND:
1129 		/*
1130 		 * If we've managed to bind at least one proto lets run the
1131 		 * online method, so we can start listening for it.
1132 		 */
1133 		if (success && run_method(instance, IM_ONLINE, NULL) == -1)
1134 			return;	/* instance gone to maintenance */
1135 		break;
1136 	case IIS_ONLINE:
1137 	case IIS_IN_REFRESH_METHOD:
1138 		/*
1139 		 * We're 'online', so start polling on any bound fds we're
1140 		 * currently not.
1141 		 */
1142 		if (poll_bound_fds(instance, B_TRUE, NULL) != 0) {
1143 			failure = B_TRUE;
1144 		} else if (!failure) {
1145 			/*
1146 			 * We've successfully bound and poll'd upon all protos,
1147 			 * so reset the failure count.
1148 			 */
1149 			instance->bind_fail_count = 0;
1150 		}
1151 		break;
1152 	case IIS_IN_ONLINE_METHOD:
1153 		/*
1154 		 * Nothing to do here as the method completion code will start
1155 		 * listening for any successfully bound fds.
1156 		 */
1157 		break;
1158 	default:
1159 #ifndef NDEBUG
1160 		(void) fprintf(stderr, "%s:%d: Unknown instance state %d.\n",
1161 		    __FILE__, __LINE__, instance->cur_istate);
1162 #endif
1163 		abort();
1164 	}
1165 
1166 	if (failure)
1167 		handle_bind_failure(instance);
1168 }
1169 
1170 /*
1171  * Counter to create_bound_fds(), for each of the bound network fds this
1172  * function unregisters the instance from rpcbind if it's an RPC service,
1173  * stops listening for new connections for it and then closes the listening fd.
1174  */
1175 static void
1176 destroy_bound_fds(instance_t *instance)
1177 {
1178 	basic_cfg_t	*cfg = instance->config->basic;
1179 	proto_info_t	*pi;
1180 
1181 	for (pi = uu_list_first(cfg->proto_list); pi != NULL;
1182 	    pi = uu_list_next(cfg->proto_list, pi)) {
1183 		if (pi->listen_fd != -1) {
1184 			if (pi->ri != NULL)
1185 				unregister_rpc_service(instance->fmri, pi->ri);
1186 			clear_pollfd(pi->listen_fd);
1187 			close_net_fd(instance, pi->listen_fd);
1188 			pi->listen_fd = -1;
1189 		}
1190 	}
1191 
1192 	/* cancel any bind retries */
1193 	if (instance->bind_timer_id != -1)
1194 		cancel_bind_timer(instance);
1195 
1196 	instance->bind_retries_exceeded = B_FALSE;
1197 }
1198 
1199 /*
1200  * Perform %A address expansion and return a pointer to a static string
1201  * array containing crafted arguments. This expansion is provided for
1202  * compatibility with 4.2BSD daemons, and as such we've copied the logic of
1203  * the legacy inetd to maintain this compatibility as much as possible. This
1204  * logic is a bit scatty, but it dates back at least as far as SunOS 4.x.
1205  */
1206 static char **
1207 expand_address(instance_t *inst, const proto_info_t *pi)
1208 {
1209 	static char	addrbuf[sizeof ("ffffffff.65536")];
1210 	static char	*ret[3];
1211 	instance_cfg_t	*cfg = inst->config;
1212 	/*
1213 	 * We cast pi to a void so we can then go on to cast it to a
1214 	 * socket_info_t without lint complaining about alignment. This
1215 	 * is done because the x86 version of lint thinks a lint suppression
1216 	 * directive is unnecessary and flags it as such, yet the sparc
1217 	 * version complains if it's absent.
1218 	 */
1219 	const void	*p = pi;
1220 
1221 	/* set ret[0] to the basename of exec path */
1222 	if ((ret[0] = strrchr(cfg->methods[IM_START]->exec_path, '/'))
1223 	    != NULL) {
1224 		ret[0]++;
1225 	} else {
1226 		ret[0] = cfg->methods[IM_START]->exec_path;
1227 	}
1228 
1229 	if (!cfg->basic->istlx &&
1230 	    (((socket_info_t *)p)->type == SOCK_DGRAM)) {
1231 		ret[1] = NULL;
1232 	} else {
1233 		addrbuf[0] = '\0';
1234 		if (!cfg->basic->iswait &&
1235 		    (inst->remote_addr.ss_family == AF_INET)) {
1236 			struct sockaddr_in *sp;
1237 
1238 			sp = (struct sockaddr_in *)&(inst->remote_addr);
1239 			(void) snprintf(addrbuf, sizeof (addrbuf), "%x.%hu",
1240 			    ntohl(sp->sin_addr.s_addr), ntohs(sp->sin_port));
1241 		}
1242 		ret[1] = addrbuf;
1243 		ret[2] = NULL;
1244 	}
1245 
1246 	return (ret);
1247 }
1248 
1249 /*
1250  * Returns the state associated with the supplied method being run for an
1251  * instance.
1252  */
1253 static internal_inst_state_t
1254 get_method_state(instance_method_t method)
1255 {
1256 	state_info_t *sip;
1257 
1258 	for (sip = states; sip->istate != IIS_NONE; sip++) {
1259 		if (sip->method_running == method)
1260 			break;
1261 	}
1262 	assert(sip->istate != IIS_NONE);
1263 
1264 	return (sip->istate);
1265 }
1266 
1267 /*
1268  * Store the method's PID and CID in the repository. If the store fails
1269  * we ignore it and just drive on.
1270  */
1271 static void
1272 add_method_ids(instance_t *ins, pid_t pid, ctid_t cid, instance_method_t mthd)
1273 {
1274 	if (cid != -1)
1275 		(void) add_remove_contract(ins, B_TRUE, cid);
1276 
1277 	if (mthd == IM_START) {
1278 		if (add_rep_val(ins->start_pids, (int64_t)pid) == 0) {
1279 			(void) store_rep_vals(ins->start_pids, ins->fmri,
1280 			    PR_NAME_START_PIDS);
1281 		}
1282 	} else {
1283 		if (add_rep_val(ins->non_start_pid, (int64_t)pid) == 0) {
1284 			(void) store_rep_vals(ins->non_start_pid, ins->fmri,
1285 			    PR_NAME_NON_START_PID);
1286 		}
1287 	}
1288 }
1289 
1290 /*
1291  * Remove the method's PID and CID from the repository. If the removal
1292  * fails we ignore it and drive on.
1293  */
1294 void
1295 remove_method_ids(instance_t *inst, pid_t pid, ctid_t cid,
1296     instance_method_t mthd)
1297 {
1298 	if (cid != -1)
1299 		(void) add_remove_contract(inst, B_FALSE, cid);
1300 
1301 	if (mthd == IM_START) {
1302 		remove_rep_val(inst->start_pids, (int64_t)pid);
1303 		(void) store_rep_vals(inst->start_pids, inst->fmri,
1304 		    PR_NAME_START_PIDS);
1305 	} else {
1306 		remove_rep_val(inst->non_start_pid, (int64_t)pid);
1307 		(void) store_rep_vals(inst->non_start_pid, inst->fmri,
1308 		    PR_NAME_NON_START_PID);
1309 	}
1310 }
1311 
1312 static instance_t *
1313 create_instance(const char *fmri)
1314 {
1315 	instance_t *ret;
1316 
1317 	if (((ret = calloc(1, sizeof (instance_t))) == NULL) ||
1318 	    ((ret->fmri = strdup(fmri)) == NULL))
1319 		goto alloc_fail;
1320 
1321 	ret->conn_fd = -1;
1322 
1323 	ret->copies = 0;
1324 
1325 	ret->conn_rate_count = 0;
1326 	ret->fail_rate_count = 0;
1327 	ret->bind_fail_count = 0;
1328 
1329 	if (((ret->non_start_pid = create_rep_val_list()) == NULL) ||
1330 	    ((ret->start_pids = create_rep_val_list()) == NULL) ||
1331 	    ((ret->start_ctids = create_rep_val_list()) == NULL))
1332 		goto alloc_fail;
1333 
1334 	ret->cur_istate = IIS_NONE;
1335 	ret->next_istate = IIS_NONE;
1336 
1337 	if (((ret->cur_istate_rep = create_rep_val_list()) == NULL) ||
1338 	    ((ret->next_istate_rep = create_rep_val_list()) == NULL))
1339 		goto alloc_fail;
1340 
1341 	ret->config = NULL;
1342 	ret->new_config = NULL;
1343 
1344 	ret->timer_id = -1;
1345 	ret->bind_timer_id = -1;
1346 
1347 	ret->disable_req = B_FALSE;
1348 	ret->maintenance_req = B_FALSE;
1349 	ret->conn_rate_exceeded = B_FALSE;
1350 	ret->bind_retries_exceeded = B_FALSE;
1351 
1352 	ret->pending_rst_event = RESTARTER_EVENT_TYPE_INVALID;
1353 
1354 	return (ret);
1355 
1356 alloc_fail:
1357 	error_msg(strerror(errno));
1358 	destroy_instance(ret);
1359 	return (NULL);
1360 }
1361 
1362 static void
1363 destroy_instance(instance_t *inst)
1364 {
1365 	if (inst == NULL)
1366 		return;
1367 
1368 	destroy_instance_cfg(inst->config);
1369 	destroy_instance_cfg(inst->new_config);
1370 
1371 	destroy_rep_val_list(inst->cur_istate_rep);
1372 	destroy_rep_val_list(inst->next_istate_rep);
1373 
1374 	destroy_rep_val_list(inst->start_pids);
1375 	destroy_rep_val_list(inst->non_start_pid);
1376 	destroy_rep_val_list(inst->start_ctids);
1377 
1378 	free(inst->fmri);
1379 
1380 	free(inst);
1381 }
1382 
1383 /*
1384  * Retrieves the current and next states internal states. Returns 0 on success,
1385  * else returns one of the following on error:
1386  * SCF_ERROR_NO_MEMORY if memory allocation failed.
1387  * SCF_ERROR_CONNECTION_BROKEN if the connection to the repository was broken.
1388  * SCF_ERROR_TYPE_MISMATCH if the property was of an unexpected type.
1389  * SCF_ERROR_NO_RESOURCES if the server doesn't have adequate resources.
1390  * SCF_ERROR_NO_SERVER if the server isn't running.
1391  */
1392 static scf_error_t
1393 retrieve_instance_state(instance_t *inst)
1394 {
1395 	scf_error_t	ret;
1396 
1397 	/* retrieve internal states */
1398 	if (((ret = retrieve_rep_vals(inst->cur_istate_rep, inst->fmri,
1399 	    PR_NAME_CUR_INT_STATE)) != 0) ||
1400 	    ((ret = retrieve_rep_vals(inst->next_istate_rep, inst->fmri,
1401 	    PR_NAME_NEXT_INT_STATE)) != 0)) {
1402 		if (ret != SCF_ERROR_NOT_FOUND) {
1403 			error_msg(gettext(
1404 			    "Failed to read state of instance %s: %s"),
1405 			    inst->fmri, scf_strerror(scf_error()));
1406 			return (ret);
1407 		}
1408 
1409 		debug_msg("instance with no previous int state - "
1410 		    "setting state to uninitialized");
1411 
1412 		if ((set_single_rep_val(inst->cur_istate_rep,
1413 		    (int64_t)IIS_UNINITIALIZED) == -1) ||
1414 		    (set_single_rep_val(inst->next_istate_rep,
1415 		    (int64_t)IIS_NONE) == -1)) {
1416 			return (SCF_ERROR_NO_MEMORY);
1417 		}
1418 	}
1419 
1420 	/* update convenience states */
1421 	inst->cur_istate = get_single_rep_val(inst->cur_istate_rep);
1422 	inst->next_istate = get_single_rep_val(inst->next_istate_rep);
1423 	return (0);
1424 }
1425 
1426 /*
1427  * Retrieve stored process ids and register each of them so we process their
1428  * termination.
1429  */
1430 static int
1431 retrieve_method_pids(instance_t *inst)
1432 {
1433 	rep_val_t	*rv;
1434 
1435 	switch (retrieve_rep_vals(inst->start_pids, inst->fmri,
1436 	    PR_NAME_START_PIDS)) {
1437 	case 0:
1438 		break;
1439 	case SCF_ERROR_NOT_FOUND:
1440 		return (0);
1441 	default:
1442 		error_msg(gettext("Failed to retrieve the start pids of "
1443 		    "instance %s from repository: %s"), inst->fmri,
1444 		    scf_strerror(scf_error()));
1445 		return (-1);
1446 	}
1447 
1448 	rv = uu_list_first(inst->start_pids);
1449 	while (rv != NULL) {
1450 		if (register_method(inst, (pid_t)rv->val, (ctid_t)-1,
1451 		    IM_START, NULL) == 0) {
1452 			inst->copies++;
1453 			rv = uu_list_next(inst->start_pids, rv);
1454 		} else if (errno == ENOENT) {
1455 			pid_t pid = (pid_t)rv->val;
1456 
1457 			/*
1458 			 * The process must have already terminated. Remove
1459 			 * it from the list.
1460 			 */
1461 			rv = uu_list_next(inst->start_pids, rv);
1462 			remove_rep_val(inst->start_pids, pid);
1463 		} else {
1464 			error_msg(gettext("Failed to listen for the completion "
1465 			    "of %s method of instance %s"), START_METHOD_NAME,
1466 			    inst->fmri);
1467 			rv = uu_list_next(inst->start_pids, rv);
1468 		}
1469 	}
1470 
1471 	/* synch the repository pid list to remove any terminated pids */
1472 	(void) store_rep_vals(inst->start_pids, inst->fmri, PR_NAME_START_PIDS);
1473 
1474 	return (0);
1475 }
1476 
1477 /*
1478  * Remove the passed instance from inetd control.
1479  */
1480 static void
1481 remove_instance(instance_t *instance)
1482 {
1483 	switch (instance->cur_istate) {
1484 	case IIS_ONLINE:
1485 	case IIS_DEGRADED:
1486 		/* stop listening for network connections */
1487 		destroy_bound_fds(instance);
1488 		break;
1489 	case IIS_OFFLINE_BIND:
1490 		cancel_bind_timer(instance);
1491 		break;
1492 	case IIS_OFFLINE_CONRATE:
1493 		cancel_inst_timer(instance);
1494 		break;
1495 	}
1496 
1497 	/* stop listening for terminated methods */
1498 	unregister_instance_methods(instance);
1499 
1500 	uu_list_remove(instance_list, instance);
1501 	destroy_instance(instance);
1502 }
1503 
1504 /*
1505  * Refresh the configuration of instance 'inst'. This method gets called as
1506  * a result of a refresh event for the instance from the master restarter, so
1507  * we can rely upon the instance's running snapshot having been updated from
1508  * its configuration snapshot.
1509  */
1510 void
1511 refresh_instance(instance_t *inst)
1512 {
1513 	instance_cfg_t	*cfg;
1514 
1515 	switch (inst->cur_istate) {
1516 	case IIS_MAINTENANCE:
1517 	case IIS_DISABLED:
1518 	case IIS_UNINITIALIZED:
1519 		/*
1520 		 * Ignore any possible changes, we'll re-read the configuration
1521 		 * automatically when we exit these states.
1522 		 */
1523 		break;
1524 
1525 	case IIS_OFFLINE_COPIES:
1526 	case IIS_OFFLINE_BIND:
1527 	case IIS_OFFLINE:
1528 	case IIS_OFFLINE_CONRATE:
1529 		destroy_instance_cfg(inst->config);
1530 		if ((inst->config = read_instance_cfg(inst->fmri)) == NULL) {
1531 			log_invalid_cfg(inst->fmri);
1532 			if (inst->cur_istate == IIS_OFFLINE_BIND) {
1533 				cancel_bind_timer(inst);
1534 			} else if (inst->cur_istate == IIS_OFFLINE_CONRATE) {
1535 				cancel_inst_timer(inst);
1536 			}
1537 			update_state(inst, IIS_MAINTENANCE, RERR_FAULT);
1538 		} else {
1539 			switch (inst->cur_istate) {
1540 			case IIS_OFFLINE_BIND:
1541 				if (copies_limit_exceeded(inst)) {
1542 					/* Cancel scheduled bind retries. */
1543 					cancel_bind_timer(inst);
1544 
1545 					/*
1546 					 * Take the instance to the copies
1547 					 * offline state, via the offline
1548 					 * state.
1549 					 */
1550 					update_state(inst, IIS_OFFLINE,
1551 					    RERR_RESTART);
1552 					process_offline_inst(inst);
1553 				}
1554 				break;
1555 
1556 			case IIS_OFFLINE:
1557 				process_offline_inst(inst);
1558 				break;
1559 
1560 			case IIS_OFFLINE_CONRATE:
1561 				/*
1562 				 * Since we're already in a DOS state,
1563 				 * don't bother evaluating the copies
1564 				 * limit. This will be evaluated when
1565 				 * we leave this state in
1566 				 * process_offline_inst().
1567 				 */
1568 				break;
1569 
1570 			case IIS_OFFLINE_COPIES:
1571 				/*
1572 				 * Check if the copies limit has been increased
1573 				 * above the current count.
1574 				 */
1575 				if (!copies_limit_exceeded(inst)) {
1576 					update_state(inst, IIS_OFFLINE,
1577 					    RERR_RESTART);
1578 					process_offline_inst(inst);
1579 				}
1580 				break;
1581 
1582 			default:
1583 				assert(0);
1584 			}
1585 		}
1586 		break;
1587 
1588 	case IIS_DEGRADED:
1589 	case IIS_ONLINE:
1590 		if ((cfg = read_instance_cfg(inst->fmri)) != NULL) {
1591 			instance_cfg_t *ocfg = inst->config;
1592 
1593 			/*
1594 			 * Try to avoid the overhead of taking an instance
1595 			 * offline and back on again. We do this by limiting
1596 			 * this behavior to two eventualities:
1597 			 * - there needs to be a re-bind to listen on behalf
1598 			 *   of the instance with its new configuration. This
1599 			 *   could be because for example its service has been
1600 			 *   associated with a different port, or because the
1601 			 *   v6only protocol option has been newly applied to
1602 			 *   the instance.
1603 			 * - one or both of the start or online methods of the
1604 			 *   instance have changed in the new configuration.
1605 			 *   Without taking the instance offline when the
1606 			 *   start method changed the instance may be running
1607 			 *   with unwanted parameters (or event an unwanted
1608 			 *   binary); and without taking the instance offline
1609 			 *   if its online method was to change, some part of
1610 			 *   its running environment may have changed and would
1611 			 *   not be picked up until the instance next goes
1612 			 *   offline for another reason.
1613 			 */
1614 			if ((!bind_config_equal(ocfg->basic, cfg->basic)) ||
1615 			    !method_info_equal(ocfg->methods[IM_ONLINE],
1616 			    cfg->methods[IM_ONLINE]) ||
1617 			    !method_info_equal(ocfg->methods[IM_START],
1618 			    cfg->methods[IM_START])) {
1619 				destroy_bound_fds(inst);
1620 
1621 				assert(inst->new_config == NULL);
1622 				inst->new_config = cfg;
1623 
1624 				(void) run_method(inst, IM_OFFLINE, NULL);
1625 			} else {	/* no bind config / method changes */
1626 
1627 				/*
1628 				 * swap the proto list over from the old
1629 				 * configuration to the new, so we retain
1630 				 * our set of network fds.
1631 				 */
1632 				destroy_proto_list(cfg->basic);
1633 				cfg->basic->proto_list =
1634 				    ocfg->basic->proto_list;
1635 				ocfg->basic->proto_list = NULL;
1636 				destroy_instance_cfg(ocfg);
1637 				inst->config = cfg;
1638 
1639 				/* re-evaluate copies limits based on new cfg */
1640 				if (copies_limit_exceeded(inst)) {
1641 					destroy_bound_fds(inst);
1642 					(void) run_method(inst, IM_OFFLINE,
1643 					    NULL);
1644 				} else {
1645 					/*
1646 					 * Since the instance isn't being
1647 					 * taken offline, where we assume it
1648 					 * would pick-up any configuration
1649 					 * changes automatically when it goes
1650 					 * back online, run its refresh method
1651 					 * to allow it to pick-up any changes
1652 					 * whilst still online.
1653 					 */
1654 					(void) run_method(inst, IM_REFRESH,
1655 					    NULL);
1656 				}
1657 			}
1658 		} else {
1659 			log_invalid_cfg(inst->fmri);
1660 
1661 			destroy_bound_fds(inst);
1662 
1663 			inst->maintenance_req = B_TRUE;
1664 			(void) run_method(inst, IM_OFFLINE, NULL);
1665 		}
1666 		break;
1667 
1668 	default:
1669 		debug_msg("Unhandled current state %d for instance in "
1670 		    "refresh_instance", inst->cur_istate);
1671 		assert(0);
1672 	}
1673 }
1674 
1675 /*
1676  * Called by process_restarter_event() to handle a restarter event for an
1677  * instance.
1678  */
1679 static void
1680 handle_restarter_event(instance_t *instance, restarter_event_type_t event,
1681     boolean_t send_ack)
1682 {
1683 	switch (event) {
1684 	case RESTARTER_EVENT_TYPE_ADD_INSTANCE:
1685 		/*
1686 		 * When startd restarts, it sends _ADD_INSTANCE to delegated
1687 		 * restarters for all those services managed by them. We should
1688 		 * acknowledge this event, as startd's graph needs to be updated
1689 		 * about the current state of the service, when startd is
1690 		 * restarting.
1691 		 * update_state() is ok to be called here, as commands for
1692 		 * instances in transition are deferred by
1693 		 * process_restarter_event().
1694 		 */
1695 		update_state(instance, instance->cur_istate, RERR_NONE);
1696 		goto done;
1697 	case RESTARTER_EVENT_TYPE_ADMIN_REFRESH:
1698 		refresh_instance(instance);
1699 		goto done;
1700 	case RESTARTER_EVENT_TYPE_ADMIN_RESTART:
1701 		/*
1702 		 * We've got a restart event, so if the instance is online
1703 		 * in any way initiate taking it offline, and rely upon
1704 		 * our restarter to send us an online event to bring
1705 		 * it back online.
1706 		 */
1707 		switch (instance->cur_istate) {
1708 		case IIS_ONLINE:
1709 		case IIS_DEGRADED:
1710 			destroy_bound_fds(instance);
1711 			(void) run_method(instance, IM_OFFLINE, NULL);
1712 		}
1713 		goto done;
1714 	case RESTARTER_EVENT_TYPE_REMOVE_INSTANCE:
1715 		remove_instance(instance);
1716 		goto done;
1717 	case RESTARTER_EVENT_TYPE_STOP:
1718 		switch (instance->cur_istate) {
1719 		case IIS_OFFLINE_CONRATE:
1720 		case IIS_OFFLINE_BIND:
1721 		case IIS_OFFLINE_COPIES:
1722 			/*
1723 			 * inetd must be closing down as we wouldn't get this
1724 			 * event in one of these states from the master
1725 			 * restarter. Take the instance to the offline resting
1726 			 * state.
1727 			 */
1728 			if (instance->cur_istate == IIS_OFFLINE_BIND) {
1729 				cancel_bind_timer(instance);
1730 			} else if (instance->cur_istate ==
1731 			    IIS_OFFLINE_CONRATE) {
1732 				cancel_inst_timer(instance);
1733 			}
1734 			update_state(instance, IIS_OFFLINE, RERR_RESTART);
1735 			goto done;
1736 		}
1737 		break;
1738 	}
1739 
1740 	switch (instance->cur_istate) {
1741 	case IIS_OFFLINE:
1742 		switch (event) {
1743 		case RESTARTER_EVENT_TYPE_START:
1744 			/*
1745 			 * Dependencies are met, let's take the service online.
1746 			 * Only try and bind for a wait type service if
1747 			 * no process is running on its behalf. Otherwise, just
1748 			 * mark the service online and binding will be attempted
1749 			 * when the process exits.
1750 			 */
1751 			if (!(instance->config->basic->iswait &&
1752 			    (uu_list_first(instance->start_pids) != NULL))) {
1753 				create_bound_fds(instance);
1754 			} else {
1755 				update_state(instance, IIS_ONLINE, RERR_NONE);
1756 			}
1757 			break;
1758 		case RESTARTER_EVENT_TYPE_DISABLE:
1759 		case RESTARTER_EVENT_TYPE_ADMIN_DISABLE:
1760 			/*
1761 			 * The instance should be disabled, so run the
1762 			 * instance's disabled method that will do the work
1763 			 * to take it there.
1764 			 */
1765 			(void) run_method(instance, IM_DISABLE, NULL);
1766 			break;
1767 		case RESTARTER_EVENT_TYPE_ADMIN_MAINT_ON:
1768 		case RESTARTER_EVENT_TYPE_DEPENDENCY_CYCLE:
1769 		case RESTARTER_EVENT_TYPE_INVALID_DEPENDENCY:
1770 			/*
1771 			 * The master restarter has requested the instance
1772 			 * go to maintenance; since we're already offline
1773 			 * just update the state to the maintenance state.
1774 			 */
1775 			update_state(instance, IIS_MAINTENANCE, RERR_RESTART);
1776 			break;
1777 		}
1778 		break;
1779 
1780 	case IIS_OFFLINE_BIND:
1781 		switch (event) {
1782 		case RESTARTER_EVENT_TYPE_DISABLE:
1783 		case RESTARTER_EVENT_TYPE_ADMIN_DISABLE:
1784 			/*
1785 			 * The instance should be disabled. Firstly, as for
1786 			 * the above dependencies unmet comment, cancel
1787 			 * the bind retry timer and update the state to
1788 			 * offline. Then, run the disable method to do the
1789 			 * work to take the instance from offline to
1790 			 * disabled.
1791 			 */
1792 			cancel_bind_timer(instance);
1793 			update_state(instance, IIS_OFFLINE, RERR_RESTART);
1794 			(void) run_method(instance, IM_DISABLE, NULL);
1795 			break;
1796 		case RESTARTER_EVENT_TYPE_ADMIN_MAINT_ON:
1797 		case RESTARTER_EVENT_TYPE_DEPENDENCY_CYCLE:
1798 		case RESTARTER_EVENT_TYPE_INVALID_DEPENDENCY:
1799 			/*
1800 			 * The master restarter has requested the instance
1801 			 * be placed in the maintenance state. Cancel the
1802 			 * outstanding retry timer, and since we're already
1803 			 * offline, update the state to maintenance.
1804 			 */
1805 			cancel_bind_timer(instance);
1806 			update_state(instance, IIS_MAINTENANCE, RERR_RESTART);
1807 			break;
1808 		}
1809 		break;
1810 
1811 	case IIS_DEGRADED:
1812 	case IIS_ONLINE:
1813 		switch (event) {
1814 		case RESTARTER_EVENT_TYPE_DISABLE:
1815 		case RESTARTER_EVENT_TYPE_ADMIN_DISABLE:
1816 			/*
1817 			 * The instance needs to be disabled. Do the same work
1818 			 * as for the dependencies unmet event below to
1819 			 * take the instance offline.
1820 			 */
1821 			destroy_bound_fds(instance);
1822 			/*
1823 			 * Indicate that the offline method is being run
1824 			 * as part of going to the disabled state, and to
1825 			 * carry on this transition.
1826 			 */
1827 			instance->disable_req = B_TRUE;
1828 			(void) run_method(instance, IM_OFFLINE, NULL);
1829 			break;
1830 		case RESTARTER_EVENT_TYPE_ADMIN_MAINT_ON:
1831 		case RESTARTER_EVENT_TYPE_DEPENDENCY_CYCLE:
1832 		case RESTARTER_EVENT_TYPE_INVALID_DEPENDENCY:
1833 			/*
1834 			 * The master restarter has requested the instance be
1835 			 * placed in the maintenance state. This involves
1836 			 * firstly taking the service offline, so do the
1837 			 * same work as for the dependencies unmet event
1838 			 * below. We set the maintenance_req flag to
1839 			 * indicate that when we get to the offline state
1840 			 * we should be placed directly into the maintenance
1841 			 * state.
1842 			 */
1843 			instance->maintenance_req = B_TRUE;
1844 			/* FALLTHROUGH */
1845 		case RESTARTER_EVENT_TYPE_STOP:
1846 			/*
1847 			 * Dependencies have become unmet. Close and
1848 			 * stop listening on the instance's network file
1849 			 * descriptor, and run the offline method to do
1850 			 * any work required to take us to the offline state.
1851 			 */
1852 			destroy_bound_fds(instance);
1853 			(void) run_method(instance, IM_OFFLINE, NULL);
1854 		}
1855 		break;
1856 
1857 	case IIS_UNINITIALIZED:
1858 		if (event == RESTARTER_EVENT_TYPE_DISABLE ||
1859 		    event == RESTARTER_EVENT_TYPE_ADMIN_DISABLE) {
1860 			update_state(instance, IIS_DISABLED, RERR_NONE);
1861 			break;
1862 		} else if (event != RESTARTER_EVENT_TYPE_ENABLE) {
1863 			/*
1864 			 * Ignore other events until we know whether we're
1865 			 * enabled or not.
1866 			 */
1867 			break;
1868 		}
1869 
1870 		/*
1871 		 * We've got an enabled event; make use of the handling in the
1872 		 * disable case.
1873 		 */
1874 		/* FALLTHROUGH */
1875 
1876 	case IIS_DISABLED:
1877 		switch (event) {
1878 		case RESTARTER_EVENT_TYPE_ENABLE:
1879 			/*
1880 			 * The instance needs enabling. Commence reading its
1881 			 * configuration and if successful place the instance
1882 			 * in the offline state and let process_offline_inst()
1883 			 * take it from there.
1884 			 */
1885 			destroy_instance_cfg(instance->config);
1886 			instance->config = read_instance_cfg(instance->fmri);
1887 			if (instance->config != NULL) {
1888 				update_state(instance, IIS_OFFLINE,
1889 				    RERR_RESTART);
1890 				process_offline_inst(instance);
1891 			} else {
1892 				log_invalid_cfg(instance->fmri);
1893 				update_state(instance, IIS_MAINTENANCE,
1894 				    RERR_RESTART);
1895 			}
1896 
1897 			break;
1898 		case RESTARTER_EVENT_TYPE_ADMIN_MAINT_ON:
1899 		case RESTARTER_EVENT_TYPE_DEPENDENCY_CYCLE:
1900 		case RESTARTER_EVENT_TYPE_INVALID_DEPENDENCY:
1901 			/*
1902 			 * The master restarter has requested the instance be
1903 			 * placed in the maintenance state, so just update its
1904 			 * state to maintenance.
1905 			 */
1906 			update_state(instance, IIS_MAINTENANCE, RERR_RESTART);
1907 			break;
1908 		}
1909 		break;
1910 
1911 	case IIS_MAINTENANCE:
1912 		switch (event) {
1913 		case RESTARTER_EVENT_TYPE_ADMIN_MAINT_OFF:
1914 		case RESTARTER_EVENT_TYPE_ADMIN_DISABLE:
1915 			/*
1916 			 * The master restarter has requested that the instance
1917 			 * be taken out of maintenance. Read its configuration,
1918 			 * and if successful place the instance in the offline
1919 			 * state and call process_offline_inst() to take it
1920 			 * from there.
1921 			 */
1922 			destroy_instance_cfg(instance->config);
1923 			instance->config = read_instance_cfg(instance->fmri);
1924 			if (instance->config != NULL) {
1925 				update_state(instance, IIS_OFFLINE,
1926 				    RERR_RESTART);
1927 				process_offline_inst(instance);
1928 			} else {
1929 				boolean_t enabled;
1930 
1931 				/*
1932 				 * The configuration was invalid. If the
1933 				 * service has disabled requested, let's
1934 				 * just place the instance in disabled even
1935 				 * though we haven't been able to run its
1936 				 * disable method, as the slightly incorrect
1937 				 * state is likely to be less of an issue to
1938 				 * an administrator than refusing to move an
1939 				 * instance to disabled. If disable isn't
1940 				 * requested, re-mark the service's state
1941 				 * as maintenance, so the administrator can
1942 				 * see the request was processed.
1943 				 */
1944 				if ((read_enable_merged(instance->fmri,
1945 				    &enabled) == 0) && !enabled) {
1946 					update_state(instance, IIS_DISABLED,
1947 					    RERR_RESTART);
1948 				} else {
1949 					log_invalid_cfg(instance->fmri);
1950 					update_state(instance, IIS_MAINTENANCE,
1951 					    RERR_FAULT);
1952 				}
1953 			}
1954 			break;
1955 		}
1956 		break;
1957 
1958 	case IIS_OFFLINE_CONRATE:
1959 		switch (event) {
1960 		case RESTARTER_EVENT_TYPE_DISABLE:
1961 			/*
1962 			 * The instance wants disabling. Take the instance
1963 			 * offline as for the dependencies unmet event above,
1964 			 * and then from there run the disable method to do
1965 			 * the work to take the instance to the disabled state.
1966 			 */
1967 			cancel_inst_timer(instance);
1968 			update_state(instance, IIS_OFFLINE, RERR_RESTART);
1969 			(void) run_method(instance, IM_DISABLE, NULL);
1970 			break;
1971 		case RESTARTER_EVENT_TYPE_ADMIN_MAINT_ON:
1972 		case RESTARTER_EVENT_TYPE_DEPENDENCY_CYCLE:
1973 		case RESTARTER_EVENT_TYPE_INVALID_DEPENDENCY:
1974 			/*
1975 			 * The master restarter has requested the instance
1976 			 * be taken to maintenance. Cancel the timer setup
1977 			 * when we entered this state, and go directly to
1978 			 * maintenance.
1979 			 */
1980 			cancel_inst_timer(instance);
1981 			update_state(instance, IIS_MAINTENANCE, RERR_RESTART);
1982 			break;
1983 		}
1984 		break;
1985 
1986 	case IIS_OFFLINE_COPIES:
1987 		switch (event) {
1988 		case RESTARTER_EVENT_TYPE_DISABLE:
1989 			/*
1990 			 * The instance wants disabling. Update the state
1991 			 * to offline, and run the disable method to do the
1992 			 * work to take it to the disabled state.
1993 			 */
1994 			update_state(instance, IIS_OFFLINE, RERR_RESTART);
1995 			(void) run_method(instance, IM_DISABLE, NULL);
1996 			break;
1997 		case RESTARTER_EVENT_TYPE_ADMIN_MAINT_ON:
1998 		case RESTARTER_EVENT_TYPE_DEPENDENCY_CYCLE:
1999 		case RESTARTER_EVENT_TYPE_INVALID_DEPENDENCY:
2000 			/*
2001 			 * The master restarter has requested the instance be
2002 			 * placed in maintenance. Since it's already offline
2003 			 * simply update the state.
2004 			 */
2005 			update_state(instance, IIS_MAINTENANCE, RERR_RESTART);
2006 			break;
2007 		}
2008 		break;
2009 
2010 	default:
2011 		debug_msg("handle_restarter_event: instance in an "
2012 		    "unexpected state");
2013 		assert(0);
2014 	}
2015 
2016 done:
2017 	if (send_ack)
2018 		ack_restarter_event(B_TRUE);
2019 }
2020 
2021 /*
2022  * Tries to read and process an event from the event pipe. If there isn't one
2023  * or an error occurred processing the event it returns -1. Else, if the event
2024  * is for an instance we're not already managing we read its state, add it to
2025  * our list to manage, and if appropriate read its configuration. Whether it's
2026  * new to us or not, we then handle the specific event.
2027  * Returns 0 if an event was read and processed successfully, else -1.
2028  */
2029 static int
2030 process_restarter_event(void)
2031 {
2032 	char			*fmri;
2033 	size_t			fmri_size;
2034 	restarter_event_type_t  event_type;
2035 	instance_t		*instance;
2036 	restarter_event_t	*event;
2037 	ssize_t			sz;
2038 
2039 	/*
2040 	 * Try to read an event pointer from the event pipe.
2041 	 */
2042 	errno = 0;
2043 	switch (safe_read(rst_event_pipe[PE_CONSUMER], &event,
2044 	    sizeof (event))) {
2045 	case 0:
2046 		break;
2047 	case  1:
2048 		if (errno == EAGAIN)	/* no event to read */
2049 			return (-1);
2050 
2051 		/* other end of pipe closed */
2052 
2053 		/* FALLTHROUGH */
2054 	default:			/* unexpected read error */
2055 		/*
2056 		 * There's something wrong with the event pipe. Let's
2057 		 * shutdown and be restarted.
2058 		 */
2059 		inetd_stop();
2060 		return (-1);
2061 	}
2062 
2063 	/*
2064 	 * Check if we're currently managing the instance which the event
2065 	 * pertains to. If not, read its complete state and add it to our
2066 	 * list to manage.
2067 	 */
2068 
2069 	fmri_size = scf_limit(SCF_LIMIT_MAX_FMRI_LENGTH);
2070 	if ((fmri = malloc(fmri_size)) == NULL) {
2071 		error_msg(strerror(errno));
2072 		goto fail;
2073 	}
2074 	sz = restarter_event_get_instance(event, fmri, fmri_size);
2075 	if (sz >= fmri_size)
2076 		assert(0);
2077 
2078 	for (instance = uu_list_first(instance_list); instance != NULL;
2079 	    instance = uu_list_next(instance_list, instance)) {
2080 		if (strcmp(instance->fmri, fmri) == 0)
2081 			break;
2082 	}
2083 
2084 	if (instance == NULL) {
2085 		int err;
2086 
2087 		debug_msg("New instance to manage: %s", fmri);
2088 
2089 		if (((instance = create_instance(fmri)) == NULL) ||
2090 		    (retrieve_instance_state(instance) != 0) ||
2091 		    (retrieve_method_pids(instance) != 0)) {
2092 			destroy_instance(instance);
2093 			free(fmri);
2094 			goto fail;
2095 		}
2096 
2097 		if (((err = iterate_repository_contracts(instance, 0))
2098 		    != 0) && (err != ENOENT)) {
2099 			error_msg(gettext(
2100 			    "Failed to adopt contracts of instance %s: %s"),
2101 			    instance->fmri, strerror(err));
2102 			destroy_instance(instance);
2103 			free(fmri);
2104 			goto fail;
2105 		}
2106 
2107 		uu_list_node_init(instance, &instance->link, instance_pool);
2108 		(void) uu_list_insert_after(instance_list, NULL, instance);
2109 
2110 		/*
2111 		 * Only read configuration for instances that aren't in any of
2112 		 * the disabled, maintenance or uninitialized states, since
2113 		 * they'll read it on state exit.
2114 		 */
2115 		if ((instance->cur_istate != IIS_DISABLED) &&
2116 		    (instance->cur_istate != IIS_MAINTENANCE) &&
2117 		    (instance->cur_istate != IIS_UNINITIALIZED)) {
2118 			instance->config = read_instance_cfg(instance->fmri);
2119 			if (instance->config == NULL) {
2120 				log_invalid_cfg(instance->fmri);
2121 				update_state(instance, IIS_MAINTENANCE,
2122 				    RERR_FAULT);
2123 			}
2124 		}
2125 	}
2126 
2127 	free(fmri);
2128 
2129 	event_type = restarter_event_get_type(event);
2130 	debug_msg("Event type: %d for instance: %s", event_type,
2131 	    instance->fmri);
2132 
2133 	/*
2134 	 * If the instance is currently running a method, don't process the
2135 	 * event now, but attach it to the instance for processing when
2136 	 * the instance finishes its transition.
2137 	 */
2138 	if (INST_IN_TRANSITION(instance)) {
2139 		debug_msg("storing event %d for instance %s", event_type,
2140 		    instance->fmri);
2141 		instance->pending_rst_event = event_type;
2142 	} else {
2143 		handle_restarter_event(instance, event_type, B_TRUE);
2144 	}
2145 
2146 	return (0);
2147 
2148 fail:
2149 	ack_restarter_event(B_FALSE);
2150 	return (-1);
2151 }
2152 
2153 /*
2154  * Do the state machine processing associated with the termination of instance
2155  * 'inst''s start method for the 'proto_name' protocol if this parameter is not
2156  * NULL.
2157  */
2158 void
2159 process_start_term(instance_t *inst, char *proto_name)
2160 {
2161 	basic_cfg_t	*cfg;
2162 
2163 	inst->copies--;
2164 
2165 	if ((inst->cur_istate == IIS_MAINTENANCE) ||
2166 	    (inst->cur_istate == IIS_DISABLED)) {
2167 		/* do any further processing/checks when we exit these states */
2168 		return;
2169 	}
2170 
2171 	cfg = inst->config->basic;
2172 
2173 	if (cfg->iswait) {
2174 		proto_info_t	*pi;
2175 		boolean_t	listen;
2176 
2177 		switch (inst->cur_istate) {
2178 		case IIS_ONLINE:
2179 		case IIS_DEGRADED:
2180 		case IIS_IN_REFRESH_METHOD:
2181 			/*
2182 			 * A wait type service's start method has exited.
2183 			 * Check if the method was fired off in this inetd's
2184 			 * lifetime, or a previous one; if the former,
2185 			 * re-commence listening on the service's behalf; if
2186 			 * the latter, mark the service offline and let bind
2187 			 * attempts commence.
2188 			 */
2189 			listen = B_FALSE;
2190 			for (pi = uu_list_first(cfg->proto_list); pi != NULL;
2191 			    pi = uu_list_next(cfg->proto_list, pi)) {
2192 				/*
2193 				 * If a bound fd exists, the method was fired
2194 				 * off during this inetd's lifetime.
2195 				 */
2196 				if (pi->listen_fd != -1) {
2197 					listen = B_TRUE;
2198 					if (proto_name == NULL ||
2199 					    strcmp(pi->proto, proto_name) == 0)
2200 						break;
2201 				}
2202 			}
2203 			if (pi != NULL) {
2204 				if (poll_bound_fds(inst, B_TRUE, proto_name) !=
2205 				    0)
2206 					handle_bind_failure(inst);
2207 			} else if (listen == B_FALSE) {
2208 				update_state(inst, IIS_OFFLINE, RERR_RESTART);
2209 				create_bound_fds(inst);
2210 			}
2211 		}
2212 	} else {
2213 		/*
2214 		 * Check if a nowait service should be brought back online
2215 		 * after exceeding its copies limit.
2216 		 */
2217 		if ((inst->cur_istate == IIS_OFFLINE_COPIES) &&
2218 		    !copies_limit_exceeded(inst)) {
2219 			update_state(inst, IIS_OFFLINE, RERR_NONE);
2220 			process_offline_inst(inst);
2221 		}
2222 	}
2223 }
2224 
2225 /*
2226  * If the instance has a pending event process it and initiate the
2227  * acknowledgement.
2228  */
2229 static void
2230 process_pending_rst_event(instance_t *inst)
2231 {
2232 	if (inst->pending_rst_event != RESTARTER_EVENT_TYPE_INVALID) {
2233 		restarter_event_type_t re;
2234 
2235 		debug_msg("Injecting pending event %d for instance %s",
2236 		    inst->pending_rst_event, inst->fmri);
2237 		re = inst->pending_rst_event;
2238 		inst->pending_rst_event = RESTARTER_EVENT_TYPE_INVALID;
2239 		handle_restarter_event(inst, re, B_TRUE);
2240 	}
2241 }
2242 
2243 /*
2244  * Do the state machine processing associated with the termination
2245  * of the specified instance's non-start method with the specified status.
2246  * Once the processing of the termination is done, the function also picks up
2247  * any processing that was blocked on the method running.
2248  */
2249 void
2250 process_non_start_term(instance_t *inst, int status)
2251 {
2252 	boolean_t ran_online_method = B_FALSE;
2253 
2254 	if (status == IMRET_FAILURE) {
2255 		error_msg(gettext("The %s method of instance %s failed, "
2256 		    "transitioning to maintenance"),
2257 		    methods[states[inst->cur_istate].method_running].name,
2258 		    inst->fmri);
2259 
2260 		if ((inst->cur_istate == IIS_IN_ONLINE_METHOD) ||
2261 		    (inst->cur_istate == IIS_IN_REFRESH_METHOD))
2262 			destroy_bound_fds(inst);
2263 
2264 		update_state(inst, IIS_MAINTENANCE, RERR_FAULT);
2265 
2266 		inst->maintenance_req = B_FALSE;
2267 		inst->conn_rate_exceeded = B_FALSE;
2268 
2269 		if (inst->new_config != NULL) {
2270 			destroy_instance_cfg(inst->new_config);
2271 			inst->new_config = NULL;
2272 		}
2273 
2274 		if (!inetd_stopping)
2275 			process_pending_rst_event(inst);
2276 
2277 		return;
2278 	}
2279 
2280 	/* non-failure method return */
2281 
2282 	if (status != IMRET_SUCCESS) {
2283 		/*
2284 		 * An instance method never returned a supported return code.
2285 		 * We'll assume this means the method succeeded for now whilst
2286 		 * non-GL-cognizant methods are used - eg. pkill.
2287 		 */
2288 		debug_msg("The %s method of instance %s returned "
2289 		    "non-compliant exit code: %d, assuming success",
2290 		    methods[states[inst->cur_istate].method_running].name,
2291 		    inst->fmri, status);
2292 	}
2293 
2294 	/*
2295 	 * Update the state from the in-transition state.
2296 	 */
2297 	switch (inst->cur_istate) {
2298 	case IIS_IN_ONLINE_METHOD:
2299 		ran_online_method = B_TRUE;
2300 		/* FALLTHROUGH */
2301 	case IIS_IN_REFRESH_METHOD:
2302 		/*
2303 		 * If we've exhausted the bind retries, flag that by setting
2304 		 * the instance's state to degraded.
2305 		 */
2306 		if (inst->bind_retries_exceeded) {
2307 			update_state(inst, IIS_DEGRADED, RERR_NONE);
2308 			break;
2309 		}
2310 		/* FALLTHROUGH */
2311 	default:
2312 		update_state(inst,
2313 		    methods[states[inst->cur_istate].method_running].dst_state,
2314 		    RERR_NONE);
2315 	}
2316 
2317 	if (inst->cur_istate == IIS_OFFLINE) {
2318 		if (inst->new_config != NULL) {
2319 			/*
2320 			 * This instance was found during refresh to need
2321 			 * taking offline because its newly read configuration
2322 			 * was sufficiently different. Now we're offline,
2323 			 * activate this new configuration.
2324 			 */
2325 			destroy_instance_cfg(inst->config);
2326 			inst->config = inst->new_config;
2327 			inst->new_config = NULL;
2328 		}
2329 
2330 		/* continue/complete any transitions that are in progress */
2331 		process_offline_inst(inst);
2332 
2333 	} else if (ran_online_method) {
2334 		/*
2335 		 * We've just successfully executed the online method. We have
2336 		 * a set of bound network fds that were created before running
2337 		 * this method, so now we're online start listening for
2338 		 * connections on them.
2339 		 */
2340 		if (poll_bound_fds(inst, B_TRUE, NULL) != 0)
2341 			handle_bind_failure(inst);
2342 	}
2343 
2344 	/*
2345 	 * If we're now out of transition (process_offline_inst() could have
2346 	 * fired off another method), carry out any jobs that were blocked by
2347 	 * us being in transition.
2348 	 */
2349 	if (!INST_IN_TRANSITION(inst)) {
2350 		if (inetd_stopping) {
2351 			if (!instance_stopped(inst)) {
2352 				/*
2353 				 * inetd is stopping, and this instance hasn't
2354 				 * been stopped. Inject a stop event.
2355 				 */
2356 				handle_restarter_event(inst,
2357 				    RESTARTER_EVENT_TYPE_STOP, B_FALSE);
2358 			}
2359 		} else {
2360 			process_pending_rst_event(inst);
2361 		}
2362 	}
2363 }
2364 
2365 /*
2366  * Check if configuration file specified is readable. If not return B_FALSE,
2367  * else return B_TRUE.
2368  */
2369 static boolean_t
2370 can_read_file(const char *path)
2371 {
2372 	int	ret;
2373 	int	serrno;
2374 
2375 	do {
2376 		ret = access(path, R_OK);
2377 	} while ((ret < 0) && (errno == EINTR));
2378 	if (ret < 0) {
2379 		if (errno != ENOENT) {
2380 			serrno = errno;
2381 			error_msg(gettext("Failed to access configuration "
2382 			    "file %s for performing modification checks: %s"),
2383 			    path, strerror(errno));
2384 			errno = serrno;
2385 		}
2386 		return (B_FALSE);
2387 	}
2388 	return (B_TRUE);
2389 }
2390 
2391 /*
2392  * Check whether the configuration file has changed contents since inetd
2393  * was last started/refreshed, and if so, log a message indicating that
2394  * inetconv needs to be run.
2395  */
2396 static void
2397 check_conf_file(void)
2398 {
2399 	char		*new_hash;
2400 	char		*old_hash = NULL;
2401 	scf_error_t	ret;
2402 	const char	*file;
2403 
2404 	if (conf_file == NULL) {
2405 		/*
2406 		 * No explicit config file specified, so see if one of the
2407 		 * default two are readable, checking the primary one first
2408 		 * followed by the secondary.
2409 		 */
2410 		if (can_read_file(PRIMARY_DEFAULT_CONF_FILE)) {
2411 			file = PRIMARY_DEFAULT_CONF_FILE;
2412 		} else if ((errno == ENOENT) &&
2413 		    can_read_file(SECONDARY_DEFAULT_CONF_FILE)) {
2414 			file = SECONDARY_DEFAULT_CONF_FILE;
2415 		} else {
2416 			return;
2417 		}
2418 	} else {
2419 		file = conf_file;
2420 		if (!can_read_file(file))
2421 			return;
2422 	}
2423 
2424 	if (calculate_hash(file, &new_hash) == 0) {
2425 		ret = retrieve_inetd_hash(&old_hash);
2426 		if (((ret == SCF_ERROR_NONE) &&
2427 		    (strcmp(old_hash, new_hash) != 0))) {
2428 			/* modified config file */
2429 			warn_msg(gettext(
2430 			    "Configuration file %s has been modified since "
2431 			    "inetconv was last run. \"inetconv -i %s\" must be "
2432 			    "run to apply any changes to the SMF"), file, file);
2433 		} else if ((ret != SCF_ERROR_NOT_FOUND) &&
2434 		    (ret != SCF_ERROR_NONE)) {
2435 			/* No message if hash not yet computed */
2436 			error_msg(gettext("Failed to check whether "
2437 			    "configuration file %s has been modified: %s"),
2438 			    file, scf_strerror(ret));
2439 		}
2440 		free(old_hash);
2441 		free(new_hash);
2442 	} else {
2443 		error_msg(gettext("Failed to check whether configuration file "
2444 		    "%s has been modified: %s"), file, strerror(errno));
2445 	}
2446 }
2447 
2448 /*
2449  * Refresh all inetd's managed instances and check the configuration file
2450  * for any updates since inetconv was last run, logging a message if there
2451  * are. We call the SMF refresh function to refresh each instance so that
2452  * the refresh request goes through the framework, and thus results in the
2453  * running snapshot of each instance being updated from the configuration
2454  * snapshot.
2455  */
2456 static void
2457 inetd_refresh(void)
2458 {
2459 	instance_t	*inst;
2460 
2461 	refresh_debug_flag();
2462 
2463 	/* call libscf to send refresh requests for all managed instances */
2464 	for (inst = uu_list_first(instance_list); inst != NULL;
2465 	    inst = uu_list_next(instance_list, inst)) {
2466 		if (smf_refresh_instance(inst->fmri) < 0) {
2467 			error_msg(gettext("Failed to refresh instance %s: %s"),
2468 			    inst->fmri, scf_strerror(scf_error()));
2469 		}
2470 	}
2471 
2472 	/*
2473 	 * Log a message if the configuration file has changed since inetconv
2474 	 * was last run.
2475 	 */
2476 	check_conf_file();
2477 }
2478 
2479 /*
2480  * Initiate inetd's shutdown.
2481  */
2482 static void
2483 inetd_stop(void)
2484 {
2485 	instance_t *inst;
2486 
2487 	/* Block handling signals for stop and refresh */
2488 	(void) sighold(SIGHUP);
2489 	(void) sighold(SIGTERM);
2490 
2491 	/* Indicate inetd is coming down */
2492 	inetd_stopping = B_TRUE;
2493 
2494 	/* Stop polling on restarter events. */
2495 	clear_pollfd(rst_event_pipe[PE_CONSUMER]);
2496 
2497 	/* Stop polling for any more stop/refresh requests. */
2498 	clear_pollfd(uds_fd);
2499 
2500 	/*
2501 	 * Send a stop event to all currently unstopped instances that
2502 	 * aren't in transition. For those that are in transition, the
2503 	 * event will get sent when the transition completes.
2504 	 */
2505 	for (inst = uu_list_first(instance_list); inst != NULL;
2506 	    inst = uu_list_next(instance_list, inst)) {
2507 		if (!instance_stopped(inst) && !INST_IN_TRANSITION(inst))
2508 			handle_restarter_event(inst,
2509 			    RESTARTER_EVENT_TYPE_STOP, B_FALSE);
2510 	}
2511 }
2512 
2513 /*
2514  * Sets up the intra-inetd-process Unix Domain Socket.
2515  * Returns -1 on error, else 0.
2516  */
2517 static int
2518 uds_init(void)
2519 {
2520 	struct sockaddr_un addr;
2521 
2522 	if ((uds_fd = socket(AF_UNIX, SOCK_STREAM, 0)) < 0) {
2523 		error_msg("socket: %s", strerror(errno));
2524 		return (-1);
2525 	}
2526 
2527 	disable_blocking(uds_fd);
2528 
2529 	(void) unlink(INETD_UDS_PATH);  /* clean-up any stale files */
2530 
2531 	(void) memset(&addr, 0, sizeof (addr));
2532 	addr.sun_family = AF_UNIX;
2533 	/* CONSTCOND */
2534 	assert(sizeof (INETD_UDS_PATH) <= sizeof (addr.sun_path));
2535 	(void) strlcpy(addr.sun_path, INETD_UDS_PATH, sizeof (addr.sun_path));
2536 
2537 	if (bind(uds_fd, (struct sockaddr *)(&addr), sizeof (addr)) < 0) {
2538 		error_msg(gettext("Failed to bind socket to %s: %s"),
2539 		    INETD_UDS_PATH, strerror(errno));
2540 		(void) close(uds_fd);
2541 		return (-1);
2542 	}
2543 
2544 	(void) listen(uds_fd, UDS_BACKLOG);
2545 
2546 	if ((set_pollfd(uds_fd, POLLIN)) == -1) {
2547 		(void) close(uds_fd);
2548 		(void) unlink(INETD_UDS_PATH);
2549 		return (-1);
2550 	}
2551 
2552 	return (0);
2553 }
2554 
2555 static void
2556 uds_fini(void)
2557 {
2558 	if (uds_fd != -1)
2559 		(void) close(uds_fd);
2560 	(void) unlink(INETD_UDS_PATH);
2561 }
2562 
2563 /*
2564  * Handle an incoming request on the Unix Domain Socket. Returns -1 if there
2565  * was an error handling the event, else 0.
2566  */
2567 static int
2568 process_uds_event(void)
2569 {
2570 	uds_request_t		req;
2571 	int			fd;
2572 	struct sockaddr_un	addr;
2573 	socklen_t		len = sizeof (addr);
2574 	int			ret;
2575 	uint_t			retries = 0;
2576 	ucred_t			*ucred = NULL;
2577 	uid_t			euid;
2578 
2579 	do {
2580 		fd = accept(uds_fd, (struct sockaddr *)&addr, &len);
2581 	} while ((fd < 0) && (errno == EINTR));
2582 	if (fd < 0) {
2583 		if (errno != EWOULDBLOCK)
2584 			error_msg("accept failed: %s", strerror(errno));
2585 		return (-1);
2586 	}
2587 
2588 	if (getpeerucred(fd, &ucred) == -1) {
2589 		error_msg("getpeerucred failed: %s", strerror(errno));
2590 		(void) close(fd);
2591 		return (-1);
2592 	}
2593 
2594 	/* Check peer credentials before acting on the request */
2595 	euid = ucred_geteuid(ucred);
2596 	ucred_free(ucred);
2597 	if (euid != 0 && getuid() != euid) {
2598 		debug_msg("peer euid %u != uid %u",
2599 		    (uint_t)euid, (uint_t)getuid());
2600 		(void) close(fd);
2601 		return (-1);
2602 	}
2603 
2604 	for (retries = 0; retries < UDS_RECV_RETRIES; retries++) {
2605 		if (((ret = safe_read(fd, &req, sizeof (req))) != 1) ||
2606 		    (errno != EAGAIN))
2607 			break;
2608 
2609 		(void) poll(NULL, 0, 100);	/* 100ms pause */
2610 	}
2611 
2612 	if (ret != 0) {
2613 		error_msg(gettext("Failed read: %s"), strerror(errno));
2614 		(void) close(fd);
2615 		return (-1);
2616 	}
2617 
2618 	switch (req) {
2619 	case UR_REFRESH_INETD:
2620 		/* flag the request for event_loop() to process */
2621 		refresh_inetd_requested = B_TRUE;
2622 		(void) close(fd);
2623 		break;
2624 	case UR_STOP_INETD:
2625 		inetd_stop();
2626 		break;
2627 	default:
2628 		error_msg("unexpected UDS request");
2629 		(void) close(fd);
2630 		return (-1);
2631 	}
2632 
2633 	return (0);
2634 }
2635 
2636 /*
2637  * Perform checks for common exec string errors. We limit the checks to
2638  * whether the file exists, is a regular file, and has at least one execute
2639  * bit set. We leave the core security checks to exec() so as not to duplicate
2640  * and thus incur the associated drawbacks, but hope to catch the common
2641  * errors here.
2642  */
2643 static boolean_t
2644 passes_basic_exec_checks(const char *instance, const char *method,
2645     const char *path)
2646 {
2647 	struct stat	sbuf;
2648 
2649 	/* check the file exists */
2650 	while (stat(path, &sbuf) == -1) {
2651 		if (errno != EINTR) {
2652 			error_msg(gettext(
2653 			    "Can't stat the %s method of instance %s: %s"),
2654 			    method, instance, strerror(errno));
2655 			return (B_FALSE);
2656 		}
2657 	}
2658 
2659 	/*
2660 	 * Check if the file is a regular file and has at least one execute
2661 	 * bit set.
2662 	 */
2663 	if ((sbuf.st_mode & S_IFMT) != S_IFREG) {
2664 		error_msg(gettext(
2665 		    "The %s method of instance %s isn't a regular file"),
2666 		    method, instance);
2667 		return (B_FALSE);
2668 	} else if ((sbuf.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH)) == 0) {
2669 		error_msg(gettext("The %s method instance %s doesn't have "
2670 		    "any execute permissions set"), method, instance);
2671 		return (B_FALSE);
2672 	}
2673 
2674 	return (B_TRUE);
2675 }
2676 
2677 static void
2678 exec_method(instance_t *instance, instance_method_t method, method_info_t *mi,
2679     struct method_context *mthd_ctxt, const proto_info_t *pi)
2680 {
2681 	char		**args;
2682 	char 		**env;
2683 	const char	*errf;
2684 	int		serrno;
2685 	basic_cfg_t	*cfg = instance->config->basic;
2686 
2687 	if (method == IM_START) {
2688 		/*
2689 		 * If wrappers checks fail, pretend the method was exec'd and
2690 		 * failed.
2691 		 */
2692 		if (!tcp_wrappers_ok(instance))
2693 			exit(IMRET_FAILURE);
2694 	}
2695 
2696 	/*
2697 	 * Revert the disposition of handled signals and ignored signals to
2698 	 * their defaults, unblocking any blocked ones as a side effect.
2699 	 */
2700 	(void) sigset(SIGHUP, SIG_DFL);
2701 	(void) sigset(SIGTERM, SIG_DFL);
2702 	(void) sigset(SIGINT, SIG_DFL);
2703 
2704 	/*
2705 	 * Setup exec arguments. Do this before the fd setup below, so our
2706 	 * logging related file fd doesn't get taken over before we call
2707 	 * expand_address().
2708 	 */
2709 	if ((method == IM_START) &&
2710 	    (strcmp(mi->exec_args_we.we_wordv[0], "%A") == 0)) {
2711 		args = expand_address(instance, pi);
2712 	} else {
2713 		args = mi->exec_args_we.we_wordv;
2714 	}
2715 
2716 	/* Generate audit trail for start operations */
2717 	if (method == IM_START) {
2718 		adt_event_data_t *ae;
2719 		struct sockaddr_storage ss;
2720 		priv_set_t *privset;
2721 		socklen_t sslen = sizeof (ss);
2722 
2723 		if ((ae = adt_alloc_event(audit_handle, ADT_inetd_connect))
2724 		    == NULL) {
2725 			error_msg(gettext("Unable to allocate audit event for "
2726 			    "the %s method of instance %s"),
2727 			    methods[method].name, instance->fmri);
2728 			exit(IMRET_FAILURE);
2729 		}
2730 
2731 		/*
2732 		 * The inetd_connect audit record consists of:
2733 		 *	Service name
2734 		 *	Execution path
2735 		 *	Remote address and port
2736 		 *	Local port
2737 		 *	Process privileges
2738 		 */
2739 		ae->adt_inetd_connect.service_name = cfg->svc_name;
2740 		ae->adt_inetd_connect.cmd = mi->exec_path;
2741 
2742 		if (instance->remote_addr.ss_family == AF_INET) {
2743 			struct in_addr *in = SS_SINADDR(instance->remote_addr);
2744 			ae->adt_inetd_connect.ip_adr[0] = in->s_addr;
2745 			ae->adt_inetd_connect.ip_type = ADT_IPv4;
2746 		} else {
2747 			uint32_t *addr6;
2748 			int i;
2749 
2750 			ae->adt_inetd_connect.ip_type = ADT_IPv6;
2751 			addr6 = (uint32_t *)SS_SINADDR(instance->remote_addr);
2752 			for (i = 0; i < 4; ++i)
2753 				ae->adt_inetd_connect.ip_adr[i] = addr6[i];
2754 		}
2755 
2756 		ae->adt_inetd_connect.ip_remote_port =
2757 		    ntohs(SS_PORT(instance->remote_addr));
2758 
2759 		if (getsockname(instance->conn_fd, (struct sockaddr *)&ss,
2760 		    &sslen) == 0)
2761 			ae->adt_inetd_connect.ip_local_port =
2762 			    ntohs(SS_PORT(ss));
2763 
2764 		privset = mthd_ctxt->priv_set;
2765 		if (privset == NULL) {
2766 			privset = priv_allocset();
2767 			if (privset != NULL &&
2768 			    getppriv(PRIV_EFFECTIVE, privset) != 0) {
2769 				priv_freeset(privset);
2770 				privset = NULL;
2771 			}
2772 		}
2773 
2774 		ae->adt_inetd_connect.privileges = privset;
2775 
2776 		(void) adt_put_event(ae, ADT_SUCCESS, ADT_SUCCESS);
2777 		adt_free_event(ae);
2778 
2779 		if (privset != NULL && mthd_ctxt->priv_set == NULL)
2780 			priv_freeset(privset);
2781 	}
2782 
2783 	/*
2784 	 * Set method context before the fd setup below so we can output an
2785 	 * error message if it fails.
2786 	 */
2787 	if ((errno = restarter_set_method_context(mthd_ctxt, &errf)) != 0) {
2788 		const char *msg;
2789 
2790 		if (errno == -1) {
2791 			if (strcmp(errf, "core_set_process_path") == 0) {
2792 				msg = gettext("Failed to set the corefile path "
2793 				    "for the %s method of instance %s");
2794 			} else if (strcmp(errf, "setproject") == 0) {
2795 				msg = gettext("Failed to assign a resource "
2796 				    "control for the %s method of instance %s");
2797 			} else if (strcmp(errf, "pool_set_binding") == 0) {
2798 				msg = gettext("Failed to bind the %s method of "
2799 				    "instance %s to a pool due to a system "
2800 				    "error");
2801 			} else {
2802 				assert(0);
2803 				abort();
2804 			}
2805 
2806 			error_msg(msg, methods[method].name, instance->fmri);
2807 
2808 			exit(IMRET_FAILURE);
2809 		}
2810 
2811 		if (errf != NULL && strcmp(errf, "pool_set_binding") == 0) {
2812 			switch (errno) {
2813 			case ENOENT:
2814 				msg = gettext("Failed to find resource pool "
2815 				    "for the %s method of instance %s");
2816 				break;
2817 
2818 			case EBADF:
2819 				msg = gettext("Failed to bind the %s method of "
2820 				    "instance %s to a pool due to invalid "
2821 				    "configuration");
2822 				break;
2823 
2824 			case EINVAL:
2825 				msg = gettext("Failed to bind the %s method of "
2826 				    "instance %s to a pool due to invalid "
2827 				    "pool name");
2828 				break;
2829 
2830 			default:
2831 				assert(0);
2832 				abort();
2833 			}
2834 
2835 			exit(IMRET_FAILURE);
2836 		}
2837 
2838 		if (errf != NULL) {
2839 			error_msg(gettext("Failed to set credentials for the "
2840 			    "%s method of instance %s (%s: %s)"),
2841 			    methods[method].name, instance->fmri, errf,
2842 			    strerror(errno));
2843 			exit(IMRET_FAILURE);
2844 		}
2845 
2846 		switch (errno) {
2847 		case ENOMEM:
2848 			msg = gettext("Failed to set credentials for the %s "
2849 			    "method of instance %s (out of memory)");
2850 			break;
2851 
2852 		case ENOENT:
2853 			msg = gettext("Failed to set credentials for the %s "
2854 			    "method of instance %s (no passwd or shadow "
2855 			    "entry for user)");
2856 			break;
2857 
2858 		default:
2859 			assert(0);
2860 			abort();
2861 		}
2862 
2863 		error_msg(msg, methods[method].name, instance->fmri);
2864 		exit(IMRET_FAILURE);
2865 	}
2866 
2867 	/* let exec() free mthd_ctxt */
2868 
2869 	/* setup standard fds */
2870 	if (method == IM_START) {
2871 		(void) dup2(instance->conn_fd, STDIN_FILENO);
2872 	} else {
2873 		(void) close(STDIN_FILENO);
2874 		(void) open("/dev/null", O_RDONLY);
2875 	}
2876 	(void) dup2(STDIN_FILENO, STDOUT_FILENO);
2877 	(void) dup2(STDIN_FILENO, STDERR_FILENO);
2878 
2879 	closefrom(STDERR_FILENO + 1);
2880 
2881 	method_preexec();
2882 
2883 	env = set_smf_env(mthd_ctxt, instance, methods[method].name);
2884 
2885 	if (env != NULL) {
2886 		do {
2887 			(void) execve(mi->exec_path, args, env);
2888 		} while (errno == EINTR);
2889 	}
2890 
2891 	serrno = errno;
2892 	/* start up logging again to report the error */
2893 	msg_init();
2894 	errno = serrno;
2895 
2896 	error_msg(
2897 	    gettext("Failed to exec %s method of instance %s: %s"),
2898 	    methods[method].name, instance->fmri, strerror(errno));
2899 
2900 	if ((method == IM_START) && (instance->config->basic->iswait)) {
2901 		/*
2902 		 * We couldn't exec the start method for a wait type service.
2903 		 * Eat up data from the endpoint, so that hopefully the
2904 		 * service's fd won't wake poll up on the next time round
2905 		 * event_loop(). This behavior is carried over from the old
2906 		 * inetd, and it seems somewhat arbitrary that it isn't
2907 		 * also done in the case of fork failures; but I guess
2908 		 * it assumes an exec failure is less likely to be the result
2909 		 * of a resource shortage, and is thus not worth retrying.
2910 		 */
2911 		consume_wait_data(instance, 0);
2912 	}
2913 
2914 	exit(IMRET_FAILURE);
2915 }
2916 
2917 static restarter_error_t
2918 get_method_error_success(instance_method_t method)
2919 {
2920 	switch (method) {
2921 	case IM_OFFLINE:
2922 		return (RERR_RESTART);
2923 	case IM_ONLINE:
2924 		return (RERR_RESTART);
2925 	case IM_DISABLE:
2926 		return (RERR_RESTART);
2927 	case IM_REFRESH:
2928 		return (RERR_REFRESH);
2929 	case IM_START:
2930 		return (RERR_RESTART);
2931 	}
2932 	(void) fprintf(stderr, gettext("Internal fatal error in inetd.\n"));
2933 
2934 	abort();
2935 	/* NOTREACHED */
2936 }
2937 
2938 static int
2939 smf_kill_process(instance_t *instance, int sig)
2940 {
2941 	rep_val_t	*rv;
2942 	int		ret = IMRET_SUCCESS;
2943 
2944 	/* Carry out process assassination */
2945 	for (rv = uu_list_first(instance->start_pids);
2946 	    rv != NULL;
2947 	    rv = uu_list_next(instance->start_pids, rv)) {
2948 		if ((kill((pid_t)rv->val, sig) != 0) &&
2949 		    (errno != ESRCH)) {
2950 			ret = IMRET_FAILURE;
2951 			error_msg(gettext("Unable to kill "
2952 			    "start process (%ld) of instance %s: %s"),
2953 			    rv->val, instance->fmri, strerror(errno));
2954 		}
2955 	}
2956 	return (ret);
2957 }
2958 
2959 /*
2960  * Runs the specified method of the specified service instance.
2961  * If the method was never specified, we handle it the same as if the
2962  * method was called and returned success, carrying on any transition the
2963  * instance may be in the midst of.
2964  * If the method isn't executable in its specified profile or an error occurs
2965  * forking a process to run the method in the function returns -1.
2966  * If a method binary is successfully executed, the function switches the
2967  * instance's cur state to the method's associated 'run' state and the next
2968  * state to the methods associated next state.
2969  * Returns -1 if there's an error before forking, else 0.
2970  */
2971 int
2972 run_method(instance_t *instance, instance_method_t method,
2973     const proto_info_t *start_info)
2974 {
2975 	pid_t			child_pid;
2976 	method_info_t		*mi;
2977 	struct method_context	*mthd_ctxt = NULL;
2978 	int			sig = 0;
2979 	int			ret;
2980 	instance_cfg_t		*cfg = instance->config;
2981 	ctid_t			cid;
2982 	boolean_t		trans_failure = B_TRUE;
2983 	int			serrno;
2984 
2985 	/*
2986 	 * Don't bother updating the instance's state for the start method
2987 	 * as there isn't a separate start method state.
2988 	 */
2989 	if (method != IM_START)
2990 		update_instance_states(instance, get_method_state(method),
2991 		    methods[method].dst_state,
2992 		    get_method_error_success(method));
2993 
2994 	if ((mi = cfg->methods[method]) == NULL) {
2995 		/*
2996 		 * If the absent method is IM_OFFLINE, default action needs
2997 		 * to be taken to avoid lingering processes which can prevent
2998 		 * the upcoming rebinding from happening.
2999 		 */
3000 		if ((method == IM_OFFLINE) && instance->config->basic->iswait) {
3001 			warn_msg(gettext("inetd_offline method for instance %s "
3002 			    "is unspecified.  Taking default action: kill."),
3003 			    instance->fmri);
3004 			(void) str2sig("TERM", &sig);
3005 			ret = smf_kill_process(instance, sig);
3006 			process_non_start_term(instance, ret);
3007 			return (0);
3008 		} else {
3009 			process_non_start_term(instance, IMRET_SUCCESS);
3010 			return (0);
3011 		}
3012 	}
3013 
3014 	/* Handle special method tokens, not allowed on start */
3015 	if (method != IM_START) {
3016 		if (restarter_is_null_method(mi->exec_path)) {
3017 			/* :true means nothing should be done */
3018 			process_non_start_term(instance, IMRET_SUCCESS);
3019 			return (0);
3020 		}
3021 
3022 		if ((sig = restarter_is_kill_method(mi->exec_path)) >= 0) {
3023 			/* Carry out contract assassination */
3024 			ret = iterate_repository_contracts(instance, sig);
3025 			/* ENOENT means we didn't find any contracts */
3026 			if (ret != 0 && ret != ENOENT) {
3027 				error_msg(gettext("Failed to send signal %d "
3028 				    "to contracts of instance %s: %s"), sig,
3029 				    instance->fmri, strerror(ret));
3030 				goto prefork_failure;
3031 			} else {
3032 				process_non_start_term(instance, IMRET_SUCCESS);
3033 				return (0);
3034 			}
3035 		}
3036 
3037 		if ((sig = restarter_is_kill_proc_method(mi->exec_path)) >= 0) {
3038 			ret = smf_kill_process(instance, sig);
3039 			process_non_start_term(instance, ret);
3040 			return (0);
3041 		}
3042 	}
3043 
3044 	/*
3045 	 * Get the associated method context before the fork so we can
3046 	 * modify the instances state if things go wrong.
3047 	 */
3048 	if ((mthd_ctxt = read_method_context(instance->fmri,
3049 	    methods[method].name, mi->exec_path)) == NULL)
3050 		goto prefork_failure;
3051 
3052 	/*
3053 	 * Perform some basic checks before we fork to limit the possibility
3054 	 * of exec failures, so we can modify the instance state if necessary.
3055 	 */
3056 	if (!passes_basic_exec_checks(instance->fmri, methods[method].name,
3057 	    mi->exec_path)) {
3058 		trans_failure = B_FALSE;
3059 		goto prefork_failure;
3060 	}
3061 
3062 	if (contract_prefork(instance->fmri, method) == -1)
3063 		goto prefork_failure;
3064 	child_pid = fork();
3065 	serrno = errno;
3066 	contract_postfork();
3067 
3068 	switch (child_pid) {
3069 	case -1:
3070 		error_msg(gettext(
3071 		    "Unable to fork %s method of instance %s: %s"),
3072 		    methods[method].name, instance->fmri, strerror(serrno));
3073 		if ((serrno != EAGAIN) && (serrno != ENOMEM))
3074 			trans_failure = B_FALSE;
3075 		goto prefork_failure;
3076 	case 0:				/* child */
3077 		exec_method(instance, method, mi, mthd_ctxt, start_info);
3078 		/* NOTREACHED */
3079 	default:			/* parent */
3080 		restarter_free_method_context(mthd_ctxt);
3081 		mthd_ctxt = NULL;
3082 
3083 		if (get_latest_contract(&cid) < 0)
3084 			cid = -1;
3085 
3086 		/*
3087 		 * Register this method so its termination is noticed and
3088 		 * the state transition this method participates in is
3089 		 * continued.
3090 		 */
3091 		if (register_method(instance, child_pid, cid, method,
3092 		    start_info->proto) != 0) {
3093 			/*
3094 			 * Since we will never find out about the termination
3095 			 * of this method, if it's a non-start method treat
3096 			 * is as a failure so we don't block restarter event
3097 			 * processing on it whilst it languishes in a method
3098 			 * running state.
3099 			 */
3100 			error_msg(gettext("Failed to monitor status of "
3101 			    "%s method of instance %s"), methods[method].name,
3102 			    instance->fmri);
3103 			if (method != IM_START)
3104 				process_non_start_term(instance, IMRET_FAILURE);
3105 		}
3106 
3107 		add_method_ids(instance, child_pid, cid, method);
3108 
3109 		/* do tcp tracing for those nowait instances that request it */
3110 		if ((method == IM_START) && cfg->basic->do_tcp_trace &&
3111 		    !cfg->basic->iswait) {
3112 			char buf[INET6_ADDRSTRLEN];
3113 
3114 			syslog(LOG_NOTICE, "%s[%d] from %s %d",
3115 			    cfg->basic->svc_name, child_pid,
3116 			    inet_ntop_native(instance->remote_addr.ss_family,
3117 			    SS_SINADDR(instance->remote_addr), buf,
3118 			    sizeof (buf)),
3119 			    ntohs(SS_PORT(instance->remote_addr)));
3120 		}
3121 	}
3122 
3123 	return (0);
3124 
3125 prefork_failure:
3126 	if (mthd_ctxt != NULL) {
3127 		restarter_free_method_context(mthd_ctxt);
3128 		mthd_ctxt = NULL;
3129 	}
3130 
3131 	if (method == IM_START) {
3132 		/*
3133 		 * Only place a start method in maintenance if we're sure
3134 		 * that the failure was non-transient.
3135 		 */
3136 		if (!trans_failure) {
3137 			destroy_bound_fds(instance);
3138 			update_state(instance, IIS_MAINTENANCE, RERR_FAULT);
3139 		}
3140 	} else {
3141 		/* treat the failure as if the method ran and failed */
3142 		process_non_start_term(instance, IMRET_FAILURE);
3143 	}
3144 
3145 	return (-1);
3146 }
3147 
3148 static int
3149 pending_connections(instance_t *instance, proto_info_t *pi)
3150 {
3151 	if (instance->config->basic->istlx) {
3152 		tlx_info_t *tl = (tlx_info_t *)pi;
3153 
3154 		return (uu_list_numnodes(tl->conn_ind_queue) != 0);
3155 	} else {
3156 		return (0);
3157 	}
3158 }
3159 
3160 static int
3161 accept_connection(instance_t *instance, proto_info_t *pi)
3162 {
3163 	int		fd;
3164 	socklen_t	size;
3165 
3166 	if (instance->config->basic->istlx) {
3167 		tlx_info_t *tl = (tlx_info_t *)pi;
3168 		tlx_pending_counter = \
3169 		    tlx_pending_counter - uu_list_numnodes(tl->conn_ind_queue);
3170 
3171 		fd = tlx_accept(instance->fmri, (tlx_info_t *)pi,
3172 		    &(instance->remote_addr));
3173 
3174 		tlx_pending_counter = \
3175 		    tlx_pending_counter + uu_list_numnodes(tl->conn_ind_queue);
3176 	} else {
3177 		size = sizeof (instance->remote_addr);
3178 		fd = accept(pi->listen_fd,
3179 		    (struct sockaddr *)&(instance->remote_addr), &size);
3180 		if (fd < 0)
3181 			error_msg("accept: %s", strerror(errno));
3182 	}
3183 
3184 	return (fd);
3185 }
3186 
3187 /*
3188  * Handle an incoming connection request for a nowait service.
3189  * This involves accepting the incoming connection on a new fd. Connection
3190  * rate checks are then performed, transitioning the service to the
3191  * conrate offline state if these fail. Otherwise, the service's start method
3192  * is run (performing TCP wrappers checks if applicable as we do), and on
3193  * success concurrent copies checking is done, transitioning the service to the
3194  * copies offline state if this fails.
3195  */
3196 static void
3197 process_nowait_request(instance_t *instance, proto_info_t *pi)
3198 {
3199 	basic_cfg_t		*cfg = instance->config->basic;
3200 	int			ret;
3201 	adt_event_data_t	*ae;
3202 	char			buf[BUFSIZ];
3203 
3204 	/* accept nowait service connections on a new fd */
3205 	if ((instance->conn_fd = accept_connection(instance, pi)) == -1) {
3206 		/*
3207 		 * Failed accept. Return and allow the event loop to initiate
3208 		 * another attempt later if the request is still present.
3209 		 */
3210 		return;
3211 	}
3212 
3213 	/*
3214 	 * Limit connection rate of nowait services. If either conn_rate_max
3215 	 * or conn_rate_offline are <= 0, no connection rate limit checking
3216 	 * is done. If the configured rate is exceeded, the instance is taken
3217 	 * to the connrate_offline state and a timer scheduled to try and
3218 	 * bring the instance back online after the configured offline time.
3219 	 */
3220 	if ((cfg->conn_rate_max > 0) && (cfg->conn_rate_offline > 0)) {
3221 		if (instance->conn_rate_count++ == 0) {
3222 			instance->conn_rate_start = time(NULL);
3223 		} else if (instance->conn_rate_count >
3224 		    cfg->conn_rate_max) {
3225 			time_t now = time(NULL);
3226 
3227 			if ((now - instance->conn_rate_start) > 1) {
3228 				instance->conn_rate_start = now;
3229 				instance->conn_rate_count = 1;
3230 			} else {
3231 				/* Generate audit record */
3232 				if ((ae = adt_alloc_event(audit_handle,
3233 				    ADT_inetd_ratelimit)) == NULL) {
3234 					error_msg(gettext("Unable to allocate "
3235 					    "rate limit audit event"));
3236 				} else {
3237 					adt_inetd_ratelimit_t *rl =
3238 					    &ae->adt_inetd_ratelimit;
3239 					/*
3240 					 * The inetd_ratelimit audit
3241 					 * record consists of:
3242 					 * 	Service name
3243 					 *	Connection rate limit
3244 					 */
3245 					rl->service_name = cfg->svc_name;
3246 					(void) snprintf(buf, sizeof (buf),
3247 					    "limit=%lld", cfg->conn_rate_max);
3248 					rl->limit = buf;
3249 					(void) adt_put_event(ae, ADT_SUCCESS,
3250 					    ADT_SUCCESS);
3251 					adt_free_event(ae);
3252 				}
3253 
3254 				error_msg(gettext(
3255 				    "Instance %s has exceeded its configured "
3256 				    "connection rate, additional connections "
3257 				    "will not be accepted for %d seconds"),
3258 				    instance->fmri, cfg->conn_rate_offline);
3259 
3260 				close_net_fd(instance, instance->conn_fd);
3261 				instance->conn_fd = -1;
3262 
3263 				destroy_bound_fds(instance);
3264 
3265 				instance->conn_rate_count = 0;
3266 
3267 				instance->conn_rate_exceeded = B_TRUE;
3268 				(void) run_method(instance, IM_OFFLINE, NULL);
3269 
3270 				return;
3271 			}
3272 		}
3273 	}
3274 
3275 	ret = run_method(instance, IM_START, pi);
3276 
3277 	close_net_fd(instance, instance->conn_fd);
3278 	instance->conn_fd = -1;
3279 
3280 	if (ret == -1) /* the method wasn't forked  */
3281 		return;
3282 
3283 	instance->copies++;
3284 
3285 	/*
3286 	 * Limit concurrent connections of nowait services.
3287 	 */
3288 	if (copies_limit_exceeded(instance)) {
3289 		/* Generate audit record */
3290 		if ((ae = adt_alloc_event(audit_handle, ADT_inetd_copylimit))
3291 		    == NULL) {
3292 			error_msg(gettext("Unable to allocate copy limit "
3293 			    "audit event"));
3294 		} else {
3295 			/*
3296 			 * The inetd_copylimit audit record consists of:
3297 			 *	Service name
3298 			 * 	Copy limit
3299 			 */
3300 			ae->adt_inetd_copylimit.service_name = cfg->svc_name;
3301 			(void) snprintf(buf, sizeof (buf), "limit=%lld",
3302 			    cfg->max_copies);
3303 			ae->adt_inetd_copylimit.limit = buf;
3304 			(void) adt_put_event(ae, ADT_SUCCESS, ADT_SUCCESS);
3305 			adt_free_event(ae);
3306 		}
3307 
3308 		warn_msg(gettext("Instance %s has reached its maximum "
3309 		    "configured copies, no new connections will be accepted"),
3310 		    instance->fmri);
3311 		destroy_bound_fds(instance);
3312 		(void) run_method(instance, IM_OFFLINE, NULL);
3313 	}
3314 }
3315 
3316 /*
3317  * Handle an incoming request for a wait type service.
3318  * Failure rate checking is done first, taking the service to the maintenance
3319  * state if the checks fail. Following this, the service's start method is run,
3320  * and on success, we stop listening for new requests for this service.
3321  */
3322 static void
3323 process_wait_request(instance_t *instance, const proto_info_t *pi)
3324 {
3325 	basic_cfg_t		*cfg = instance->config->basic;
3326 	int			ret;
3327 	adt_event_data_t	*ae;
3328 	char			buf[BUFSIZ];
3329 
3330 	instance->conn_fd = pi->listen_fd;
3331 
3332 	/*
3333 	 * Detect broken servers and transition them to maintenance. If a
3334 	 * wait type service exits without accepting the connection or
3335 	 * consuming (reading) the datagram, that service's descriptor will
3336 	 * select readable again, and inetd will fork another instance of
3337 	 * the server. If either wait_fail_cnt or wait_fail_interval are <= 0,
3338 	 * no failure rate detection is done.
3339 	 */
3340 	if ((cfg->wait_fail_cnt > 0) && (cfg->wait_fail_interval > 0)) {
3341 		if (instance->fail_rate_count++ == 0) {
3342 			instance->fail_rate_start = time(NULL);
3343 		} else if (instance->fail_rate_count > cfg->wait_fail_cnt) {
3344 			time_t now = time(NULL);
3345 
3346 			if ((now - instance->fail_rate_start) >
3347 			    cfg->wait_fail_interval) {
3348 				instance->fail_rate_start = now;
3349 				instance->fail_rate_count = 1;
3350 			} else {
3351 				/* Generate audit record */
3352 				if ((ae = adt_alloc_event(audit_handle,
3353 				    ADT_inetd_failrate)) == NULL) {
3354 					error_msg(gettext("Unable to allocate "
3355 					    "failure rate audit event"));
3356 				} else {
3357 					adt_inetd_failrate_t *fr =
3358 					    &ae->adt_inetd_failrate;
3359 					/*
3360 					 * The inetd_failrate audit record
3361 					 * consists of:
3362 					 * 	Service name
3363 					 * 	Failure rate
3364 					 *	Interval
3365 					 * Last two are expressed as k=v pairs
3366 					 * in the values field.
3367 					 */
3368 					fr->service_name = cfg->svc_name;
3369 					(void) snprintf(buf, sizeof (buf),
3370 					    "limit=%lld,interval=%d",
3371 					    cfg->wait_fail_cnt,
3372 					    cfg->wait_fail_interval);
3373 					fr->values = buf;
3374 					(void) adt_put_event(ae, ADT_SUCCESS,
3375 					    ADT_SUCCESS);
3376 					adt_free_event(ae);
3377 				}
3378 
3379 				error_msg(gettext(
3380 				    "Instance %s has exceeded its configured "
3381 				    "failure rate, transitioning to "
3382 				    "maintenance"), instance->fmri);
3383 				instance->fail_rate_count = 0;
3384 
3385 				destroy_bound_fds(instance);
3386 
3387 				instance->maintenance_req = B_TRUE;
3388 				(void) run_method(instance, IM_OFFLINE, NULL);
3389 				return;
3390 			}
3391 		}
3392 	}
3393 
3394 	ret = run_method(instance, IM_START, pi);
3395 
3396 	instance->conn_fd = -1;
3397 
3398 	if (ret == 0) {
3399 		/*
3400 		 * Stop listening for connections now we've fired off the
3401 		 * server for a wait type instance.
3402 		 */
3403 		(void) poll_bound_fds(instance, B_FALSE, pi->proto);
3404 	}
3405 }
3406 
3407 /*
3408  * Process any networks requests for each proto for each instance.
3409  */
3410 void
3411 process_network_events(void)
3412 {
3413 	instance_t	*instance;
3414 
3415 	for (instance = uu_list_first(instance_list); instance != NULL;
3416 	    instance = uu_list_next(instance_list, instance)) {
3417 		basic_cfg_t	*cfg;
3418 		proto_info_t	*pi;
3419 
3420 		/*
3421 		 * Ignore instances in states that definitely don't have any
3422 		 * listening fds.
3423 		 */
3424 		switch (instance->cur_istate) {
3425 		case IIS_ONLINE:
3426 		case IIS_DEGRADED:
3427 		case IIS_IN_REFRESH_METHOD:
3428 			break;
3429 		default:
3430 			continue;
3431 		}
3432 
3433 		cfg = instance->config->basic;
3434 
3435 		for (pi = uu_list_first(cfg->proto_list); pi != NULL;
3436 		    pi = uu_list_next(cfg->proto_list, pi)) {
3437 			if (((pi->listen_fd != -1) &&
3438 			    isset_pollfd(pi->listen_fd)) ||
3439 			    pending_connections(instance, pi)) {
3440 				if (cfg->iswait) {
3441 					process_wait_request(instance, pi);
3442 				} else {
3443 					process_nowait_request(instance, pi);
3444 				}
3445 			}
3446 		}
3447 	}
3448 }
3449 
3450 /* ARGSUSED0 */
3451 static void
3452 sigterm_handler(int sig)
3453 {
3454 	got_sigterm = B_TRUE;
3455 }
3456 
3457 /* ARGSUSED0 */
3458 static void
3459 sighup_handler(int sig)
3460 {
3461 	refresh_inetd_requested = B_TRUE;
3462 }
3463 
3464 /*
3465  * inetd's major work loop. This function sits in poll waiting for events
3466  * to occur, processing them when they do. The possible events are
3467  * master restarter requests, expired timer queue timers, stop/refresh signal
3468  * requests, contract events indicating process termination, stop/refresh
3469  * requests originating from one of the stop/refresh inetd processes and
3470  * network events.
3471  * The loop is exited when a stop request is received and processed, and
3472  * all the instances have reached a suitable 'stopping' state.
3473  */
3474 static void
3475 event_loop(void)
3476 {
3477 	instance_t		*instance;
3478 	int			timeout;
3479 
3480 	for (;;) {
3481 		int	pret = -1;
3482 
3483 		if (tlx_pending_counter != 0)
3484 			timeout = 0;
3485 		else
3486 			timeout = iu_earliest_timer(timer_queue);
3487 
3488 		if (!got_sigterm && !refresh_inetd_requested) {
3489 			pret = poll(poll_fds, num_pollfds, timeout);
3490 			if ((pret == -1) && (errno != EINTR)) {
3491 				error_msg(gettext("poll failure: %s"),
3492 				    strerror(errno));
3493 				continue;
3494 			}
3495 		}
3496 
3497 		if (got_sigterm) {
3498 			msg_fini();
3499 			inetd_stop();
3500 			got_sigterm = B_FALSE;
3501 			goto check_if_stopped;
3502 		}
3503 
3504 		/*
3505 		 * Process any stop/refresh requests from the Unix Domain
3506 		 * Socket.
3507 		 */
3508 		if ((pret != -1) && isset_pollfd(uds_fd)) {
3509 			while (process_uds_event() == 0)
3510 				;
3511 		}
3512 
3513 		/*
3514 		 * Process refresh request. We do this check after the UDS
3515 		 * event check above, as it would be wasted processing if we
3516 		 * started refreshing inetd based on a SIGHUP, and then were
3517 		 * told to shut-down via a UDS event.
3518 		 */
3519 		if (refresh_inetd_requested) {
3520 			refresh_inetd_requested = B_FALSE;
3521 			if (!inetd_stopping)
3522 				inetd_refresh();
3523 		}
3524 
3525 		/*
3526 		 * We were interrupted by a signal. Don't waste any more
3527 		 * time processing a potentially inaccurate poll return.
3528 		 */
3529 		if (pret == -1)
3530 			continue;
3531 
3532 		/*
3533 		 * Process any instance restarter events.
3534 		 */
3535 		if (isset_pollfd(rst_event_pipe[PE_CONSUMER])) {
3536 			while (process_restarter_event() == 0)
3537 				;
3538 		}
3539 
3540 		/*
3541 		 * Process any expired timers (bind retry, con-rate offline,
3542 		 * method timeouts).
3543 		 */
3544 		(void) iu_expire_timers(timer_queue);
3545 
3546 		process_terminated_methods();
3547 
3548 		/*
3549 		 * If inetd is stopping, check whether all our managed
3550 		 * instances have been stopped and we can return.
3551 		 */
3552 		if (inetd_stopping) {
3553 check_if_stopped:
3554 			for (instance = uu_list_first(instance_list);
3555 			    instance != NULL;
3556 			    instance = uu_list_next(instance_list, instance)) {
3557 				if (!instance_stopped(instance)) {
3558 					debug_msg("%s not yet stopped",
3559 					    instance->fmri);
3560 					break;
3561 				}
3562 			}
3563 			/* if all instances are stopped, return */
3564 			if (instance == NULL)
3565 				return;
3566 		}
3567 
3568 		process_network_events();
3569 	}
3570 }
3571 
3572 static void
3573 fini(void)
3574 {
3575 	method_fini();
3576 	uds_fini();
3577 	if (timer_queue != NULL)
3578 		iu_tq_destroy(timer_queue);
3579 
3580 
3581 	/*
3582 	 * We don't bother to undo the restarter interface at all.
3583 	 * Because of quirks in the interface, there is no way to
3584 	 * disconnect from the channel and cause any new events to be
3585 	 * queued.  However, any events which are received and not
3586 	 * acknowledged will be re-sent when inetd restarts as long as inetd
3587 	 * uses the same subscriber ID, which it does.
3588 	 *
3589 	 * By keeping the event pipe open but ignoring it, any events which
3590 	 * occur will cause restarter_event_proxy to hang without breaking
3591 	 * anything.
3592 	 */
3593 
3594 	if (instance_list != NULL) {
3595 		void		*cookie = NULL;
3596 		instance_t	*inst;
3597 
3598 		while ((inst = uu_list_teardown(instance_list, &cookie)) !=
3599 		    NULL)
3600 			destroy_instance(inst);
3601 		uu_list_destroy(instance_list);
3602 	}
3603 	if (instance_pool != NULL)
3604 		uu_list_pool_destroy(instance_pool);
3605 	tlx_fini();
3606 	config_fini();
3607 	repval_fini();
3608 	poll_fini();
3609 
3610 	/* Close audit session */
3611 	(void) adt_end_session(audit_handle);
3612 }
3613 
3614 static int
3615 init(void)
3616 {
3617 	int err;
3618 
3619 	if (repval_init() < 0)
3620 		goto failed;
3621 
3622 	if (config_init() < 0)
3623 		goto failed;
3624 
3625 	refresh_debug_flag();
3626 
3627 	if (tlx_init() < 0)
3628 		goto failed;
3629 
3630 	/* Setup instance list. */
3631 	if ((instance_pool = uu_list_pool_create("instance_pool",
3632 	    sizeof (instance_t), offsetof(instance_t, link), NULL,
3633 	    UU_LIST_POOL_DEBUG)) == NULL) {
3634 		error_msg("%s: %s",
3635 		    gettext("Failed to create instance pool"),
3636 		    uu_strerror(uu_error()));
3637 		goto failed;
3638 	}
3639 	if ((instance_list = uu_list_create(instance_pool, NULL, 0)) == NULL) {
3640 		error_msg("%s: %s",
3641 		    gettext("Failed to create instance list"),
3642 		    uu_strerror(uu_error()));
3643 		goto failed;
3644 	}
3645 
3646 	/*
3647 	 * Create event pipe to communicate events with the main event
3648 	 * loop and add it to the event loop's fdset.
3649 	 */
3650 	if (pipe(rst_event_pipe) < 0) {
3651 		error_msg("pipe: %s", strerror(errno));
3652 		goto failed;
3653 	}
3654 	/*
3655 	 * We only leave the producer end to block on reads/writes as we
3656 	 * can't afford to block in the main thread, yet need to in
3657 	 * the restarter event thread, so it can sit and wait for an
3658 	 * acknowledgement to be written to the pipe.
3659 	 */
3660 	disable_blocking(rst_event_pipe[PE_CONSUMER]);
3661 	if ((set_pollfd(rst_event_pipe[PE_CONSUMER], POLLIN)) == -1)
3662 		goto failed;
3663 
3664 	/*
3665 	 * Register with master restarter for managed service events. This
3666 	 * will fail, amongst other reasons, if inetd is already running.
3667 	 */
3668 	if ((err = restarter_bind_handle(RESTARTER_EVENT_VERSION,
3669 	    INETD_INSTANCE_FMRI, restarter_event_proxy, 0,
3670 	    &rst_event_handle)) != 0) {
3671 		error_msg(gettext(
3672 		    "Failed to register for restarter events: %s"),
3673 		    strerror(err));
3674 		goto failed;
3675 	}
3676 
3677 	if (contract_init() < 0)
3678 		goto failed;
3679 
3680 	if ((timer_queue = iu_tq_create()) == NULL) {
3681 		error_msg(gettext("Failed to create timer queue."));
3682 		goto failed;
3683 	}
3684 
3685 	if (uds_init() < 0)
3686 		goto failed;
3687 
3688 	if (method_init() < 0)
3689 		goto failed;
3690 
3691 	/* Initialize auditing session */
3692 	if (adt_start_session(&audit_handle, NULL, ADT_USE_PROC_DATA) != 0) {
3693 		error_msg(gettext("Unable to start audit session"));
3694 	}
3695 
3696 	/*
3697 	 * Initialize signal dispositions/masks
3698 	 */
3699 	(void) sigset(SIGHUP, sighup_handler);
3700 	(void) sigset(SIGTERM, sigterm_handler);
3701 	(void) sigignore(SIGINT);
3702 
3703 	return (0);
3704 
3705 failed:
3706 	fini();
3707 	return (-1);
3708 }
3709 
3710 static int
3711 start_method(void)
3712 {
3713 	int	i;
3714 	int	pipe_fds[2];
3715 	int	child;
3716 
3717 	/* Create pipe for child to notify parent of initialization success. */
3718 	if (pipe(pipe_fds) < 0) {
3719 		error_msg("pipe: %s", strerror(errno));
3720 		return (SMF_EXIT_ERR_OTHER);
3721 	}
3722 
3723 	if ((child = fork()) == -1) {
3724 		error_msg("fork: %s", strerror(errno));
3725 		(void) close(pipe_fds[PE_CONSUMER]);
3726 		(void) close(pipe_fds[PE_PRODUCER]);
3727 		return (SMF_EXIT_ERR_OTHER);
3728 	} else if (child > 0) {			/* parent */
3729 
3730 		/* Wait on child to return success of initialization. */
3731 		(void) close(pipe_fds[PE_PRODUCER]);
3732 		if ((safe_read(pipe_fds[PE_CONSUMER], &i, sizeof (i)) != 0) ||
3733 		    (i < 0)) {
3734 			error_msg(gettext(
3735 			    "Initialization failed, unable to start"));
3736 			(void) close(pipe_fds[PE_CONSUMER]);
3737 			/*
3738 			 * Batch all initialization errors as 'other' errors,
3739 			 * resulting in retries being attempted.
3740 			 */
3741 			return (SMF_EXIT_ERR_OTHER);
3742 		} else {
3743 			(void) close(pipe_fds[PE_CONSUMER]);
3744 			return (SMF_EXIT_OK);
3745 		}
3746 	} else {				/* child */
3747 		/*
3748 		 * Perform initialization and return success code down
3749 		 * the pipe.
3750 		 */
3751 		(void) close(pipe_fds[PE_CONSUMER]);
3752 		i = init();
3753 		if ((safe_write(pipe_fds[PE_PRODUCER], &i, sizeof (i)) < 0) ||
3754 		    (i < 0)) {
3755 			error_msg(gettext("pipe write failure: %s"),
3756 			    strerror(errno));
3757 			exit(1);
3758 		}
3759 		(void) close(pipe_fds[PE_PRODUCER]);
3760 
3761 		(void) setsid();
3762 
3763 		/*
3764 		 * Log a message if the configuration file has changed since
3765 		 * inetconv was last run.
3766 		 */
3767 		check_conf_file();
3768 
3769 		event_loop();
3770 
3771 		fini();
3772 		debug_msg("inetd stopped");
3773 		msg_fini();
3774 		exit(0);
3775 	}
3776 	/* NOTREACHED */
3777 }
3778 
3779 /*
3780  * When inetd is run from outside the SMF, this message is output to provide
3781  * the person invoking inetd with further information that will help them
3782  * understand how to start and stop inetd, and to achieve the other
3783  * behaviors achievable with the legacy inetd command line interface, if
3784  * it is possible.
3785  */
3786 static void
3787 legacy_usage(void)
3788 {
3789 	(void) fprintf(stderr,
3790 	    "inetd is now an smf(5) managed service and can no longer be run "
3791 	    "from the\n"
3792 	    "command line. To enable or disable inetd refer to svcadm(1M) on\n"
3793 	    "how to enable \"%s\", the inetd instance.\n"
3794 	    "\n"
3795 	    "The traditional inetd command line option mappings are:\n"
3796 	    "\t-d : there is no supported debug output\n"
3797 	    "\t-s : inetd is only runnable from within the SMF\n"
3798 	    "\t-t : See inetadm(1M) on how to enable TCP tracing\n"
3799 	    "\t-r : See inetadm(1M) on how to set a failure rate\n"
3800 	    "\n"
3801 	    "To specify an alternative configuration file see svccfg(1M)\n"
3802 	    "for how to modify the \"%s/%s\" string type property of\n"
3803 	    "the inetd instance, and modify it according to the syntax:\n"
3804 	    "\"%s [alt_config_file] %%m\".\n"
3805 	    "\n"
3806 	    "For further information on inetd see inetd(1M).\n",
3807 	    INETD_INSTANCE_FMRI, START_METHOD_ARG, SCF_PROPERTY_EXEC,
3808 	    INETD_PATH);
3809 }
3810 
3811 /*
3812  * Usage message printed out for usage errors when running under the SMF.
3813  */
3814 static void
3815 smf_usage(const char *arg0)
3816 {
3817 	error_msg("Usage: %s [alt_conf_file] %s|%s|%s", arg0, START_METHOD_ARG,
3818 	    STOP_METHOD_ARG, REFRESH_METHOD_ARG);
3819 }
3820 
3821 /*
3822  * Returns B_TRUE if we're being run from within the SMF, else B_FALSE.
3823  */
3824 static boolean_t
3825 run_through_smf(void)
3826 {
3827 	char *fmri;
3828 
3829 	/*
3830 	 * check if the instance fmri environment variable has been set by
3831 	 * our restarter.
3832 	 */
3833 	return (((fmri = getenv("SMF_FMRI")) != NULL) &&
3834 	    (strcmp(fmri, INETD_INSTANCE_FMRI) == 0));
3835 }
3836 
3837 int
3838 main(int argc, char *argv[])
3839 {
3840 	char		*method;
3841 	int		ret;
3842 
3843 #if	!defined(TEXT_DOMAIN)
3844 #define	TEXT_DOMAIN "SYS_TEST"
3845 #endif
3846 	(void) textdomain(TEXT_DOMAIN);
3847 	(void) setlocale(LC_ALL, "");
3848 
3849 	if (!run_through_smf()) {
3850 		legacy_usage();
3851 		return (SMF_EXIT_ERR_NOSMF);
3852 	}
3853 
3854 	msg_init();	/* setup logging */
3855 
3856 	(void) enable_extended_FILE_stdio(-1, -1);
3857 
3858 	/* inetd invocation syntax is inetd [alt_conf_file] method_name */
3859 
3860 	switch (argc) {
3861 	case 2:
3862 		method = argv[1];
3863 		break;
3864 	case 3:
3865 		conf_file = argv[1];
3866 		method = argv[2];
3867 		break;
3868 	default:
3869 		smf_usage(argv[0]);
3870 		return (SMF_EXIT_ERR_CONFIG);
3871 
3872 	}
3873 
3874 	if (strcmp(method, START_METHOD_ARG) == 0) {
3875 		ret = start_method();
3876 	} else if (strcmp(method, STOP_METHOD_ARG) == 0) {
3877 		ret = stop_method();
3878 	} else if (strcmp(method, REFRESH_METHOD_ARG) == 0) {
3879 		ret = refresh_method();
3880 	} else {
3881 		smf_usage(argv[0]);
3882 		return (SMF_EXIT_ERR_CONFIG);
3883 	}
3884 
3885 	return (ret);
3886 }
3887