xref: /titanic_44/usr/src/cmd/cmd-inet/usr.lib/inetd/inetd.c (revision 7cd7ea0b4aaac4c9367bcb843d35cf139b59ec15)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #pragma ident	"%Z%%M%	%I%	%E% SMI"
27 
28 /*
29  * NOTES: To be expanded.
30  *
31  * The SMF inetd.
32  *
33  * Below are some high level notes of the operation of the SMF inetd. The
34  * notes don't go into any real detail, and the viewer of this file is
35  * encouraged to look at the code and its associated comments to better
36  * understand inetd's operation. This saves the potential for the code
37  * and these notes diverging over time.
38  *
39  * Inetd's major work is done from the context of event_loop(). Within this
40  * loop, inetd polls for events arriving from a number of different file
41  * descriptors, representing the following event types, and initiates
42  * any necessary event processing:
43  * - incoming network connections/datagrams.
44  * - notification of terminated processes (discovered via contract events).
45  * - instance specific events originating from the SMF master restarter.
46  * - stop/refresh requests from the inetd method processes (coming in on a
47  *   Unix Domain socket).
48  * There's also a timeout set for the poll, which is set to the nearest
49  * scheduled timer in a timer queue that inetd uses to perform delayed
50  * processing, such as bind retries.
51  * The SIGHUP and SIGINT signals can also interrupt the poll, and will
52  * result in inetd being refreshed or stopped respectively, as was the
53  * behavior with the old inetd.
54  *
55  * Inetd implements a state machine for each instance. The states within the
56  * machine are: offline, online, disabled, maintenance, uninitialized and
57  * specializations of the offline state for when an instance exceeds one of
58  * its DOS limits. The state of an instance can be changed as a
59  * result/side-effect of one of the above events occurring, or inetd being
60  * started up. The ongoing state of an instance is stored in the SMF
61  * repository, as required of SMF restarters. This enables an administrator
62  * to view the state of each instance, and, if inetd was to terminate
63  * unexpectedly, it could use the stored state to re-commence where it left off.
64  *
65  * Within the state machine a number of methods are run (if provided) as part
66  * of a state transition to aid/ effect a change in an instance's state. The
67  * supported methods are: offline, online, disable, refresh and start. The
68  * latter of these is the equivalent of the server program and its arguments
69  * in the old inetd.
70  *
71  * Events from the SMF master restarter come in on a number of threads
72  * created in the registration routine of librestart, the delegated restarter
73  * library. These threads call into the restart_event_proxy() function
74  * when an event arrives. To serialize the processing of instances, these events
75  * are then written down a pipe to the process's main thread, which listens
76  * for these events via a poll call, with the file descriptor of the other
77  * end of the pipe in its read set, and processes the event appropriately.
78  * When the event has been  processed (which may be delayed if the instance
79  * for which the event is for is in the process of executing one of its methods
80  * as part of a state transition) it writes an acknowledgement back down the
81  * pipe the event was received on. The thread in restart_event_proxy() that
82  * wrote the event will read the acknowledgement it was blocked upon, and will
83  * then be able to return to its caller, thus implicitly acknowledging the
84  * event, and allowing another event to be written down the pipe for the main
85  * thread to process.
86  */
87 
88 
89 #include <netdb.h>
90 #include <stdio.h>
91 #include <stdio_ext.h>
92 #include <stdlib.h>
93 #include <strings.h>
94 #include <unistd.h>
95 #include <assert.h>
96 #include <sys/types.h>
97 #include <sys/socket.h>
98 #include <netinet/in.h>
99 #include <fcntl.h>
100 #include <signal.h>
101 #include <errno.h>
102 #include <locale.h>
103 #include <syslog.h>
104 #include <libintl.h>
105 #include <librestart.h>
106 #include <pthread.h>
107 #include <sys/stat.h>
108 #include <time.h>
109 #include <limits.h>
110 #include <libgen.h>
111 #include <tcpd.h>
112 #include <libscf.h>
113 #include <libuutil.h>
114 #include <stddef.h>
115 #include <bsm/adt_event.h>
116 #include <ucred.h>
117 #include "inetd_impl.h"
118 
119 /* path to inetd's binary */
120 #define	INETD_PATH	"/usr/lib/inet/inetd"
121 
122 /*
123  * inetd's default configuration file paths. /etc/inetd/inetd.conf is set
124  * be be the primary file, so it is checked before /etc/inetd.conf.
125  */
126 #define	PRIMARY_DEFAULT_CONF_FILE	"/etc/inet/inetd.conf"
127 #define	SECONDARY_DEFAULT_CONF_FILE	"/etc/inetd.conf"
128 
129 /* Arguments passed to this binary to request which method to execute. */
130 #define	START_METHOD_ARG	"start"
131 #define	STOP_METHOD_ARG		"stop"
132 #define	REFRESH_METHOD_ARG	"refresh"
133 
134 /* connection backlog for unix domain socket */
135 #define	UDS_BACKLOG	2
136 
137 /* number of retries to recv() a request on the UDS socket before giving up */
138 #define	UDS_RECV_RETRIES	10
139 
140 /* enumeration of the different ends of a pipe */
141 enum pipe_end {
142 	PE_CONSUMER,
143 	PE_PRODUCER
144 };
145 
146 typedef struct {
147 	internal_inst_state_t		istate;
148 	const char			*name;
149 	restarter_instance_state_t	smf_state;
150 	instance_method_t		method_running;
151 } state_info_t;
152 
153 
154 /*
155  * Collection of information for each state.
156  * NOTE:  This table is indexed into using the internal_inst_state_t
157  * enumeration, so the ordering needs to be kept in synch.
158  */
159 static state_info_t states[] = {
160 	{IIS_UNINITIALIZED, "uninitialized", RESTARTER_STATE_UNINIT,
161 	    IM_NONE},
162 	{IIS_ONLINE, "online", RESTARTER_STATE_ONLINE, IM_START},
163 	{IIS_IN_ONLINE_METHOD, "online_method", RESTARTER_STATE_OFFLINE,
164 	    IM_ONLINE},
165 	{IIS_OFFLINE, "offline", RESTARTER_STATE_OFFLINE, IM_NONE},
166 	{IIS_IN_OFFLINE_METHOD, "offline_method", RESTARTER_STATE_OFFLINE,
167 	    IM_OFFLINE},
168 	{IIS_DISABLED, "disabled", RESTARTER_STATE_DISABLED, IM_NONE},
169 	{IIS_IN_DISABLE_METHOD, "disabled_method", RESTARTER_STATE_OFFLINE,
170 	    IM_DISABLE},
171 	{IIS_IN_REFRESH_METHOD, "refresh_method", RESTARTER_STATE_ONLINE,
172 	    IM_REFRESH},
173 	{IIS_MAINTENANCE, "maintenance", RESTARTER_STATE_MAINT, IM_NONE},
174 	{IIS_OFFLINE_CONRATE, "cr_offline", RESTARTER_STATE_OFFLINE, IM_NONE},
175 	{IIS_OFFLINE_BIND, "bind_offline", RESTARTER_STATE_OFFLINE, IM_NONE},
176 	{IIS_OFFLINE_COPIES, "copies_offline", RESTARTER_STATE_OFFLINE,
177 	    IM_NONE},
178 	{IIS_DEGRADED, "degraded", RESTARTER_STATE_DEGRADED, IM_NONE},
179 	{IIS_NONE, "none", RESTARTER_STATE_NONE, IM_NONE}
180 };
181 
182 /*
183  * Pipe used to send events from the threads created by restarter_bind_handle()
184  * to the main thread of control.
185  */
186 static int			rst_event_pipe[] = {-1, -1};
187 /*
188  * Used to protect the critical section of code in restarter_event_proxy() that
189  * involves writing an event down the event pipe and reading an acknowledgement.
190  */
191 static pthread_mutex_t		rst_event_pipe_mtx = PTHREAD_MUTEX_INITIALIZER;
192 
193 /* handle used in communication with the master restarter */
194 static restarter_event_handle_t *rst_event_handle = NULL;
195 
196 /* set to indicate a refresh of inetd is requested */
197 static boolean_t		refresh_inetd_requested = B_FALSE;
198 
199 /* set by the SIGTERM handler to flag we got a SIGTERM */
200 static boolean_t		got_sigterm = B_FALSE;
201 
202 /*
203  * Timer queue used to store timers for delayed event processing, such as
204  * bind retries.
205  */
206 iu_tq_t				*timer_queue = NULL;
207 
208 /*
209  * fd of Unix Domain socket used to communicate stop and refresh requests
210  * to the inetd start method process.
211  */
212 static int			uds_fd = -1;
213 
214 /*
215  * List of inetd's currently managed instances; each containing its state,
216  * and in certain states its configuration.
217  */
218 static uu_list_pool_t		*instance_pool = NULL;
219 uu_list_t			*instance_list = NULL;
220 
221 /* set to indicate we're being stopped */
222 boolean_t			inetd_stopping = B_FALSE;
223 
224 /* TCP wrappers syslog globals. Consumed by libwrap. */
225 int				allow_severity = LOG_INFO;
226 int				deny_severity = LOG_WARNING;
227 
228 /* path of the configuration file being monitored by check_conf_file() */
229 static char			*conf_file = NULL;
230 
231 /* Auditing session handle */
232 static adt_session_data_t	*audit_handle;
233 
234 static void uds_fini(void);
235 static int uds_init(void);
236 static int run_method(instance_t *, instance_method_t, const proto_info_t *);
237 static void create_bound_fds(instance_t *);
238 static void destroy_bound_fds(instance_t *);
239 static void destroy_instance(instance_t *);
240 static void inetd_stop(void);
241 static void
242 exec_method(instance_t *instance, instance_method_t method, method_info_t *mi,
243     struct method_context *mthd_ctxt, const proto_info_t *pi) __NORETURN;
244 
245 /*
246  * The following two functions are callbacks that libumem uses to determine
247  * inetd's desired debugging/logging levels. The interface they consume is
248  * exported by FMA and is consolidation private. The comments in the two
249  * functions give the environment variable that will effectively be set to
250  * their returned value, and thus whose behavior for this value, described in
251  * umem_debug(3MALLOC), will be followed.
252  */
253 
254 const char *
255 _umem_debug_init(void)
256 {
257 	return ("default,verbose");	/* UMEM_DEBUG setting */
258 }
259 
260 const char *
261 _umem_logging_init(void)
262 {
263 	return ("fail,contents");	/* UMEM_LOGGING setting */
264 }
265 
266 static void
267 log_invalid_cfg(const char *fmri)
268 {
269 	error_msg(gettext(
270 	    "Invalid configuration for instance %s, placing in maintenance"),
271 	    fmri);
272 }
273 
274 /*
275  * Returns B_TRUE if the instance is in a suitable state for inetd to stop.
276  */
277 static boolean_t
278 instance_stopped(const instance_t *inst)
279 {
280 	return ((inst->cur_istate == IIS_OFFLINE) ||
281 	    (inst->cur_istate == IIS_MAINTENANCE) ||
282 	    (inst->cur_istate == IIS_DISABLED) ||
283 	    (inst->cur_istate == IIS_UNINITIALIZED));
284 }
285 
286 /*
287  * Updates the current and next repository states of instance 'inst'. If
288  * any errors occur an error message is output.
289  */
290 static void
291 update_instance_states(instance_t *inst, internal_inst_state_t new_cur_state,
292     internal_inst_state_t new_next_state, restarter_error_t err)
293 {
294 	internal_inst_state_t	old_cur = inst->cur_istate;
295 	internal_inst_state_t	old_next = inst->next_istate;
296 	scf_error_t		sret;
297 	int			ret;
298 
299 	debug_msg("Entering update_instance_states: oldcur: %s, newcur: %s "
300 	    "oldnext: %s, newnext: %s", states[old_cur].name,
301 	    states[new_cur_state].name, states[old_next].name,
302 	    states[new_next_state].name);
303 
304 
305 	/* update the repository/cached internal state */
306 	inst->cur_istate = new_cur_state;
307 	inst->next_istate = new_next_state;
308 	(void) set_single_rep_val(inst->cur_istate_rep,
309 	    (int64_t)new_cur_state);
310 	(void) set_single_rep_val(inst->next_istate_rep,
311 	    (int64_t)new_next_state);
312 
313 	if (((sret = store_rep_vals(inst->cur_istate_rep, inst->fmri,
314 	    PR_NAME_CUR_INT_STATE)) != 0) ||
315 	    ((sret = store_rep_vals(inst->next_istate_rep, inst->fmri,
316 	    PR_NAME_NEXT_INT_STATE)) != 0))
317 		error_msg(gettext("Failed to update state of instance %s in "
318 		    "repository: %s"), inst->fmri, scf_strerror(sret));
319 
320 	/* update the repository SMF state */
321 	if ((ret = restarter_set_states(rst_event_handle, inst->fmri,
322 	    states[old_cur].smf_state, states[new_cur_state].smf_state,
323 	    states[old_next].smf_state, states[new_next_state].smf_state,
324 	    err, 0)) != 0)
325 		error_msg(gettext("Failed to update state of instance %s in "
326 		    "repository: %s"), inst->fmri, strerror(ret));
327 
328 }
329 
330 void
331 update_state(instance_t *inst, internal_inst_state_t new_cur,
332     restarter_error_t err)
333 {
334 	update_instance_states(inst, new_cur, IIS_NONE, err);
335 }
336 
337 /*
338  * Sends a refresh event to the inetd start method process and returns
339  * SMF_EXIT_OK if it managed to send it. If it fails to send the request for
340  * some reason it returns SMF_EXIT_ERR_OTHER.
341  */
342 static int
343 refresh_method(void)
344 {
345 	uds_request_t   req = UR_REFRESH_INETD;
346 	int		fd;
347 
348 	debug_msg("Entering refresh_method");
349 
350 	if ((fd = connect_to_inetd()) < 0) {
351 		error_msg(gettext("Failed to connect to inetd: %s"),
352 		    strerror(errno));
353 		return (SMF_EXIT_ERR_OTHER);
354 	}
355 
356 	/* write the request and return success */
357 	if (safe_write(fd, &req, sizeof (req)) == -1) {
358 		error_msg(
359 		    gettext("Failed to send refresh request to inetd: %s"),
360 		    strerror(errno));
361 		(void) close(fd);
362 		return (SMF_EXIT_ERR_OTHER);
363 	}
364 
365 	(void) close(fd);
366 
367 	return (SMF_EXIT_OK);
368 }
369 
370 /*
371  * Sends a stop event to the inetd start method process and wait till it goes
372  * away. If inetd is determined to have stopped SMF_EXIT_OK is returned, else
373  * SMF_EXIT_ERR_OTHER is returned.
374  */
375 static int
376 stop_method(void)
377 {
378 	uds_request_t   req = UR_STOP_INETD;
379 	int		fd;
380 	char		c;
381 	ssize_t		ret;
382 
383 	debug_msg("Entering stop_method");
384 
385 	if ((fd = connect_to_inetd()) == -1) {
386 		debug_msg(gettext("Failed to connect to inetd: %s"),
387 		    strerror(errno));
388 		/*
389 		 * Assume connect_to_inetd() failed because inetd was already
390 		 * stopped, and return success.
391 		 */
392 		return (SMF_EXIT_OK);
393 	}
394 
395 	/*
396 	 * This is safe to do since we're fired off in a separate process
397 	 * than inetd and in the case we get wedged, the stop method timeout
398 	 * will occur and we'd be killed by our restarter.
399 	 */
400 	enable_blocking(fd);
401 
402 	/* write the stop request to inetd and wait till it goes away */
403 	if (safe_write(fd, &req, sizeof (req)) != 0) {
404 		error_msg(gettext("Failed to send stop request to inetd"));
405 		(void) close(fd);
406 		return (SMF_EXIT_ERR_OTHER);
407 	}
408 
409 	/* wait until remote end of socket is closed */
410 	while (((ret = recv(fd, &c, sizeof (c), 0)) != 0) && (errno == EINTR))
411 		;
412 
413 	(void) close(fd);
414 
415 	if (ret != 0) {
416 		error_msg(gettext("Failed to determine whether inetd stopped"));
417 		return (SMF_EXIT_ERR_OTHER);
418 	}
419 
420 	return (SMF_EXIT_OK);
421 }
422 
423 
424 /*
425  * This function is called to handle restarter events coming in from the
426  * master restarter. It is registered with the master restarter via
427  * restarter_bind_handle() and simply passes a pointer to the event down
428  * the event pipe, which will be discovered by the poll in the event loop
429  * and processed there. It waits for an acknowledgement to be written back down
430  * the pipe before returning.
431  * Writing a pointer to the function's 'event' parameter down the pipe will
432  * be safe, as the thread in restarter_event_proxy() doesn't return until
433  * the main thread has finished its processing of the passed event, thus
434  * the referenced event will remain around until the function returns.
435  * To impose the limit of only one event being in the pipe and processed
436  * at once, a lock is taken on entry to this function and returned on exit.
437  * Always returns 0.
438  */
439 static int
440 restarter_event_proxy(restarter_event_t *event)
441 {
442 	restarter_event_type_t  ev_type;
443 	boolean_t		processed;
444 
445 	debug_msg("Entering restarter_event_proxy");
446 	ev_type = restarter_event_get_type(event);
447 	debug_msg("event: %x, event type: %d", event, ev_type);
448 
449 	(void) pthread_mutex_lock(&rst_event_pipe_mtx);
450 
451 	/* write the event to the main worker thread down the pipe */
452 	if (safe_write(rst_event_pipe[PE_PRODUCER], &event,
453 	    sizeof (event)) != 0)
454 		goto pipe_error;
455 
456 	/*
457 	 * Wait for an acknowledgement that the event has been processed from
458 	 * the same pipe. In the case that inetd is stopping, any thread in
459 	 * this function will simply block on this read until inetd eventually
460 	 * exits. This will result in this function not returning success to
461 	 * its caller, and the event that was being processed when the
462 	 * function exited will be re-sent when inetd is next started.
463 	 */
464 	if (safe_read(rst_event_pipe[PE_PRODUCER], &processed,
465 	    sizeof (processed)) != 0)
466 		goto pipe_error;
467 
468 	(void) pthread_mutex_unlock(&rst_event_pipe_mtx);
469 
470 	return (processed ? 0 : EAGAIN);
471 
472 pipe_error:
473 	/*
474 	 * Something's seriously wrong with the event pipe. Notify the
475 	 * worker thread by closing this end of the event pipe and pause till
476 	 * inetd exits.
477 	 */
478 	error_msg(gettext("Can't process restarter events: %s"),
479 	    strerror(errno));
480 	(void) close(rst_event_pipe[PE_PRODUCER]);
481 	for (;;)
482 		(void) pause();
483 
484 	/* NOTREACHED */
485 }
486 
487 /*
488  * Let restarter_event_proxy() know we're finished with the event it's blocked
489  * upon. The 'processed' argument denotes whether we successfully processed the
490  * event.
491  */
492 static void
493 ack_restarter_event(boolean_t processed)
494 {
495 	debug_msg("Entering ack_restarter_event");
496 
497 	/*
498 	 * If safe_write returns -1 something's seriously wrong with the event
499 	 * pipe, so start the shutdown proceedings.
500 	 */
501 	if (safe_write(rst_event_pipe[PE_CONSUMER], &processed,
502 	    sizeof (processed)) == -1)
503 		inetd_stop();
504 }
505 
506 /*
507  * Switch the syslog identification string to 'ident'.
508  */
509 static void
510 change_syslog_ident(const char *ident)
511 {
512 	debug_msg("Entering change_syslog_ident: ident: %s", ident);
513 
514 	closelog();
515 	openlog(ident, LOG_PID|LOG_CONS, LOG_DAEMON);
516 }
517 
518 /*
519  * Perform TCP wrappers checks on this instance. Due to the fact that the
520  * current wrappers code used in Solaris is taken untouched from the open
521  * source version, we're stuck with using the daemon name for the checks, as
522  * opposed to making use of instance FMRIs. Sigh.
523  * Returns B_TRUE if the check passed, else B_FALSE.
524  */
525 static boolean_t
526 tcp_wrappers_ok(instance_t *instance)
527 {
528 	boolean_t		rval = B_TRUE;
529 	char			*daemon_name;
530 	basic_cfg_t		*cfg = instance->config->basic;
531 	struct request_info	req;
532 
533 	debug_msg("Entering tcp_wrappers_ok, instance: %s", instance->fmri);
534 
535 	/*
536 	 * Wrap the service using libwrap functions. The code below implements
537 	 * the functionality of tcpd. This is done only for stream,nowait
538 	 * services, following the convention of other vendors.  udp/dgram and
539 	 * stream/wait can NOT be wrapped with this libwrap, so be wary of
540 	 * changing the test below.
541 	 */
542 	if (cfg->do_tcp_wrappers && !cfg->iswait && !cfg->istlx) {
543 
544 		daemon_name = instance->config->methods[
545 		    IM_START]->exec_args_we.we_wordv[0];
546 		if (*daemon_name == '/')
547 			daemon_name = strrchr(daemon_name, '/') + 1;
548 
549 		/*
550 		 * Change the syslog message identity to the name of the
551 		 * daemon being wrapped, as opposed to "inetd".
552 		 */
553 		change_syslog_ident(daemon_name);
554 
555 		(void) request_init(&req, RQ_DAEMON, daemon_name, RQ_FILE,
556 		    instance->conn_fd, NULL);
557 		fromhost(&req);
558 
559 		if (strcasecmp(eval_hostname(req.client), paranoid) == 0) {
560 			syslog(deny_severity,
561 			    "refused connect from %s (name/address mismatch)",
562 			    eval_client(&req));
563 			if (req.sink != NULL)
564 				req.sink(instance->conn_fd);
565 			rval = B_FALSE;
566 		} else if (!hosts_access(&req)) {
567 			syslog(deny_severity,
568 			    "refused connect from %s (access denied)",
569 			    eval_client(&req));
570 			if (req.sink != NULL)
571 				req.sink(instance->conn_fd);
572 			rval = B_FALSE;
573 		} else {
574 			syslog(allow_severity, "connect from %s",
575 			    eval_client(&req));
576 		}
577 
578 		/* Revert syslog identity back to "inetd". */
579 		change_syslog_ident(SYSLOG_IDENT);
580 	}
581 	return (rval);
582 }
583 
584 /*
585  * Handler registered with the timer queue code to remove an instance from
586  * the connection rate offline state when it has been there for its allotted
587  * time.
588  */
589 /* ARGSUSED */
590 static void
591 conn_rate_online(iu_tq_t *tq, void *arg)
592 {
593 	instance_t *instance = arg;
594 
595 	debug_msg("Entering conn_rate_online, instance: %s",
596 	    instance->fmri);
597 
598 	assert(instance->cur_istate == IIS_OFFLINE_CONRATE);
599 	instance->timer_id = -1;
600 	update_state(instance, IIS_OFFLINE, RERR_RESTART);
601 	process_offline_inst(instance);
602 }
603 
604 /*
605  * Check whether this instance in the offline state is in transition to
606  * another state and do the work to continue this transition.
607  */
608 void
609 process_offline_inst(instance_t *inst)
610 {
611 	debug_msg("Entering process_offline_inst");
612 
613 	if (inst->disable_req) {
614 		inst->disable_req = B_FALSE;
615 		(void) run_method(inst, IM_DISABLE, NULL);
616 	} else if (inst->maintenance_req) {
617 		inst->maintenance_req = B_FALSE;
618 		update_state(inst, IIS_MAINTENANCE, RERR_RESTART);
619 	/*
620 	 * If inetd is in the process of stopping, we don't want to enter
621 	 * any states but offline, disabled and maintenance.
622 	 */
623 	} else if (!inetd_stopping) {
624 		if (inst->conn_rate_exceeded) {
625 			basic_cfg_t *cfg = inst->config->basic;
626 
627 			inst->conn_rate_exceeded = B_FALSE;
628 			update_state(inst, IIS_OFFLINE_CONRATE, RERR_RESTART);
629 			/*
630 			 * Schedule a timer to bring the instance out of the
631 			 * connection rate offline state.
632 			 */
633 			inst->timer_id = iu_schedule_timer(timer_queue,
634 			    cfg->conn_rate_offline, conn_rate_online,
635 			    inst);
636 			if (inst->timer_id == -1) {
637 				error_msg(gettext("%s unable to set timer, "
638 				    "won't be brought on line after %d "
639 				    "seconds."), inst->fmri,
640 				    cfg->conn_rate_offline);
641 			}
642 
643 		} else if (copies_limit_exceeded(inst)) {
644 			update_state(inst, IIS_OFFLINE_COPIES, RERR_RESTART);
645 		}
646 	}
647 }
648 
649 /*
650  * Create a socket bound to the instance's configured address. If the
651  * bind fails, returns -1, else the fd of the bound socket.
652  */
653 static int
654 create_bound_socket(const char *fmri, socket_info_t *sock_info)
655 {
656 	int		fd;
657 	int		on = 1;
658 	rpc_info_t	*rpc = sock_info->pr_info.ri;
659 	const char	*proto = sock_info->pr_info.proto;
660 
661 	debug_msg("Entering create_bound_socket");
662 
663 	fd = socket(sock_info->local_addr.ss_family, sock_info->type,
664 	    sock_info->protocol);
665 	if (fd < 0) {
666 		error_msg(gettext(
667 		    "Socket creation failure for instance %s, proto %s: %s"),
668 		    fmri, proto, strerror(errno));
669 		return (-1);
670 	}
671 
672 	if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof (on)) == -1) {
673 		error_msg(gettext("setsockopt SO_REUSEADDR failed for service "
674 		    "instance %s, proto %s: %s"), fmri, proto, strerror(errno));
675 		(void) close(fd);
676 		return (-1);
677 	}
678 	if (sock_info->pr_info.v6only) {
679 		/* restrict socket to IPv6 communications only */
680 		if (setsockopt(fd, IPPROTO_IPV6, IPV6_V6ONLY, &on,
681 		    sizeof (on)) == -1) {
682 			error_msg(gettext("setsockopt IPV6_V6ONLY failed for "
683 			    "service instance %s, proto %s: %s"), fmri, proto,
684 			    strerror(errno));
685 			(void) close(fd);
686 			return (-1);
687 		}
688 	}
689 
690 	if (rpc != NULL)
691 		SS_SETPORT(sock_info->local_addr, 0);
692 
693 	if (bind(fd, (struct sockaddr *)&(sock_info->local_addr),
694 	    SS_ADDRLEN(sock_info->local_addr)) < 0) {
695 		error_msg(gettext(
696 		    "Failed to bind to the port of service instance %s, "
697 		    "proto %s: %s"), fmri, proto, strerror(errno));
698 		(void) close(fd);
699 		return (-1);
700 	}
701 
702 	/*
703 	 * Retrieve and store the address bound to for RPC services.
704 	 */
705 	if (rpc != NULL) {
706 		struct sockaddr_storage	ss;
707 		int			ss_size = sizeof (ss);
708 
709 		if (getsockname(fd, (struct sockaddr *)&ss, &ss_size) < 0) {
710 			error_msg(gettext("Failed getsockname for instance %s, "
711 			    "proto %s: %s"), fmri, proto, strerror(errno));
712 			(void) close(fd);
713 			return (-1);
714 		}
715 		(void) memcpy(rpc->netbuf.buf, &ss,
716 		    sizeof (struct sockaddr_storage));
717 		rpc->netbuf.len = SS_ADDRLEN(ss);
718 		rpc->netbuf.maxlen = SS_ADDRLEN(ss);
719 	}
720 
721 	if (sock_info->type == SOCK_STREAM)
722 		(void) listen(fd, CONNECTION_BACKLOG);
723 
724 	return (fd);
725 }
726 
727 /*
728  * Handler registered with the timer queue code to retry the creation
729  * of a bound fd.
730  */
731 /* ARGSUSED */
732 static void
733 retry_bind(iu_tq_t *tq, void *arg)
734 {
735 	instance_t *instance = arg;
736 
737 	debug_msg("Entering retry_bind, instance: %s", instance->fmri);
738 
739 	switch (instance->cur_istate) {
740 	case IIS_OFFLINE_BIND:
741 	case IIS_ONLINE:
742 	case IIS_DEGRADED:
743 	case IIS_IN_ONLINE_METHOD:
744 	case IIS_IN_REFRESH_METHOD:
745 		break;
746 	default:
747 #ifndef NDEBUG
748 		(void) fprintf(stderr, "%s:%d: Unknown instance state %d.\n",
749 		    __FILE__, __LINE__, instance->cur_istate);
750 #endif
751 		abort();
752 	}
753 
754 	instance->bind_timer_id = -1;
755 	create_bound_fds(instance);
756 }
757 
758 /*
759  * For each of the fds for the given instance that are bound, if 'listen' is
760  * set add them to the poll set, else remove them from it. If any additions
761  * fail, returns -1, else 0 on success.
762  */
763 int
764 poll_bound_fds(instance_t *instance, boolean_t listen)
765 {
766 	basic_cfg_t	*cfg = instance->config->basic;
767 	proto_info_t	*pi;
768 	int		ret = 0;
769 
770 	debug_msg("Entering poll_bound_fds: instance: %s, on: %d",
771 	    instance->fmri, listen);
772 
773 	for (pi = uu_list_first(cfg->proto_list); pi != NULL;
774 	    pi = uu_list_next(cfg->proto_list, pi)) {
775 		if (pi->listen_fd != -1) {	/* fd bound */
776 			if (!listen) {
777 				clear_pollfd(pi->listen_fd);
778 			} else if (set_pollfd(pi->listen_fd, POLLIN) == -1) {
779 				ret = -1;
780 			}
781 		}
782 	}
783 
784 	return (ret);
785 }
786 
787 /*
788  * Handle the case were we either fail to create a bound fd or we fail
789  * to add a bound fd to the poll set for the given instance.
790  */
791 static void
792 handle_bind_failure(instance_t *instance)
793 {
794 	basic_cfg_t *cfg = instance->config->basic;
795 
796 	debug_msg("Entering handle_bind_failure: instance: %s", instance);
797 
798 	/*
799 	 * We must be being called as a result of a failed poll_bound_fds()
800 	 * as a bind retry is already scheduled. Just return and let it do
801 	 * the work.
802 	 */
803 	if (instance->bind_timer_id != -1)
804 		return;
805 
806 	/*
807 	 * Check if the rebind retries limit is operative and if so,
808 	 * if it has been reached.
809 	 */
810 	if (((cfg->bind_fail_interval <= 0) ||		/* no retries */
811 	    ((cfg->bind_fail_max >= 0) &&		/* limit reached */
812 	    (++instance->bind_fail_count > cfg->bind_fail_max))) ||
813 	    ((instance->bind_timer_id = iu_schedule_timer(timer_queue,
814 	    cfg->bind_fail_interval, retry_bind, instance)) == -1)) {
815 		proto_info_t *pi;
816 
817 		instance->bind_fail_count = 0;
818 
819 		switch (instance->cur_istate) {
820 		case IIS_DEGRADED:
821 		case IIS_ONLINE:
822 			/* check if any of the fds are being poll'd upon */
823 			for (pi = uu_list_first(cfg->proto_list); pi != NULL;
824 			    pi = uu_list_next(cfg->proto_list, pi)) {
825 				if ((pi->listen_fd != -1) &&
826 				    (find_pollfd(pi->listen_fd) != NULL))
827 					break;
828 			}
829 			if (pi != NULL)	{	/* polling on > 0 fds */
830 				warn_msg(gettext("Failed to bind on "
831 				    "all protocols for instance %s, "
832 				    "transitioning to degraded"),
833 				    instance->fmri);
834 				update_state(instance, IIS_DEGRADED, RERR_NONE);
835 				instance->bind_retries_exceeded = B_TRUE;
836 				break;
837 			}
838 
839 			destroy_bound_fds(instance);
840 			/*
841 			 * In the case we failed the 'bind' because set_pollfd()
842 			 * failed on all bound fds, use the offline handling.
843 			 */
844 			/* FALLTHROUGH */
845 		case IIS_OFFLINE:
846 		case IIS_OFFLINE_BIND:
847 			error_msg(gettext("Too many bind failures for instance "
848 			"%s, transitioning to maintenance"), instance->fmri);
849 			update_state(instance, IIS_MAINTENANCE,
850 			    RERR_FAULT);
851 			break;
852 		case IIS_IN_ONLINE_METHOD:
853 		case IIS_IN_REFRESH_METHOD:
854 			warn_msg(gettext("Failed to bind on all "
855 			    "protocols for instance %s, instance will go to "
856 			    "degraded"), instance->fmri);
857 			/*
858 			 * Set the retries exceeded flag so when the method
859 			 * completes the instance goes to the degraded state.
860 			 */
861 			instance->bind_retries_exceeded = B_TRUE;
862 			break;
863 		default:
864 #ifndef NDEBUG
865 			(void) fprintf(stderr,
866 			    "%s:%d: Unknown instance state %d.\n",
867 			    __FILE__, __LINE__, instance->cur_istate);
868 #endif
869 			abort();
870 		}
871 	} else if (instance->cur_istate == IIS_OFFLINE) {
872 		/*
873 		 * bind re-scheduled, so if we're offline reflect this in the
874 		 * state.
875 		 */
876 		update_state(instance, IIS_OFFLINE_BIND, RERR_NONE);
877 	}
878 }
879 
880 
881 /*
882  * Check if two transport protocols for RPC conflict.
883  */
884 
885 boolean_t
886 is_rpc_proto_conflict(const char *proto0, const char *proto1) {
887 	if (strcmp(proto0, "tcp") == 0) {
888 		if (strcmp(proto1, "tcp") == 0)
889 			return (B_TRUE);
890 		if (strcmp(proto1, "tcp6") == 0)
891 			return (B_TRUE);
892 		return (B_FALSE);
893 	}
894 
895 	if (strcmp(proto0, "tcp6") == 0) {
896 		if (strcmp(proto1, "tcp") == 0)
897 			return (B_TRUE);
898 		if (strcmp(proto1, "tcp6only") == 0)
899 			return (B_TRUE);
900 		if (strcmp(proto1, "tcp6") == 0)
901 			return (B_TRUE);
902 		return (B_FALSE);
903 	}
904 
905 	if (strcmp(proto0, "tcp6only") == 0) {
906 		if (strcmp(proto1, "tcp6only") == 0)
907 			return (B_TRUE);
908 		if (strcmp(proto1, "tcp6") == 0)
909 			return (B_TRUE);
910 		return (B_FALSE);
911 	}
912 
913 	if (strcmp(proto0, "udp") == 0) {
914 		if (strcmp(proto1, "udp") == 0)
915 			return (B_TRUE);
916 		if (strcmp(proto1, "udp6") == 0)
917 			return (B_TRUE);
918 		return (B_FALSE);
919 	}
920 
921 	if (strcmp(proto0, "udp6") == 0) {
922 
923 		if (strcmp(proto1, "udp") == 0)
924 			return (B_TRUE);
925 		if (strcmp(proto1, "udp6only") == 0)
926 			return (B_TRUE);
927 		if (strcmp(proto1, "udp6") == 0)
928 			return (B_TRUE);
929 		return (B_FALSE);
930 	}
931 
932 	if (strcmp(proto0, "udp6only") == 0) {
933 
934 		if (strcmp(proto1, "udp6only") == 0)
935 			return (B_TRUE);
936 		if (strcmp(proto1, "udp6") == 0)
937 			return (B_TRUE);
938 		return (0);
939 	}
940 
941 	/*
942 	 * If the protocol isn't TCP/IP or UDP/IP assume that it has its own
943 	 * port namepsace and that conflicts can be detected by literal string
944 	 * comparison.
945 	 */
946 
947 	if (strcmp(proto0, proto1))
948 		return (FALSE);
949 
950 	return (B_TRUE);
951 }
952 
953 
954 /*
955  * Check if inetd thinks this RPC program number is already registered.
956  *
957  * An RPC protocol conflict occurs if
958  * 	a) the program numbers are the same and,
959  * 	b) the version numbers overlap,
960  * 	c) the protocols (TCP vs UDP vs tic*) are the same.
961  */
962 
963 boolean_t
964 is_rpc_num_in_use(int rpc_n, char *proto, int lowver, int highver) {
965 	instance_t *i;
966 	basic_cfg_t *cfg;
967 	proto_info_t *pi;
968 
969 	for (i = uu_list_first(instance_list); i != NULL;
970 	    i = uu_list_next(instance_list, i)) {
971 
972 		if (i->cur_istate != IIS_ONLINE)
973 			continue;
974 		cfg = i->config->basic;
975 
976 		for (pi = uu_list_first(cfg->proto_list); pi != NULL;
977 		    pi = uu_list_next(cfg->proto_list, pi)) {
978 
979 			if (pi->ri == NULL)
980 				continue;
981 			if (pi->ri->prognum != rpc_n)
982 				continue;
983 			if (!is_rpc_proto_conflict(pi->proto, proto))
984 				continue;
985 			if ((lowver < pi->ri->lowver &&
986 			    highver < pi->ri->lowver) ||
987 			    (lowver > pi->ri->highver &&
988 			    highver > pi->ri->highver))
989 				continue;
990 			return (B_TRUE);
991 		}
992 	}
993 	return (B_FALSE);
994 }
995 
996 
997 /*
998  * Independent of the transport, for each of the entries in the instance's
999  * proto list this function first attempts to create an associated network fd;
1000  * for RPC services these are then bound to a kernel chosen port and the
1001  * fd is registered with rpcbind; for non-RPC services the fds are bound
1002  * to the port associated with the instance's service name. On any successful
1003  * binds the instance is taken online. Failed binds are handled by
1004  * handle_bind_failure().
1005  */
1006 void
1007 create_bound_fds(instance_t *instance)
1008 {
1009 	basic_cfg_t	*cfg = instance->config->basic;
1010 	boolean_t	failure = B_FALSE;
1011 	boolean_t	success = B_FALSE;
1012 	proto_info_t	*pi;
1013 
1014 	debug_msg("Entering create_bound_fd: instance: %s", instance->fmri);
1015 
1016 	/*
1017 	 * Loop through and try and bind any unbound protos.
1018 	 */
1019 	for (pi = uu_list_first(cfg->proto_list); pi != NULL;
1020 	    pi = uu_list_next(cfg->proto_list, pi)) {
1021 		if (pi->listen_fd != -1)
1022 			continue;
1023 		if (cfg->istlx) {
1024 			pi->listen_fd = create_bound_endpoint(instance->fmri,
1025 			    (tlx_info_t *)pi);
1026 		} else {
1027 			/*
1028 			 * We cast pi to a void so we can then go on to cast
1029 			 * it to a socket_info_t without lint complaining
1030 			 * about alignment. This is done because the x86
1031 			 * version of lint thinks a lint suppression directive
1032 			 * is unnecessary and flags it as such, yet the sparc
1033 			 * version complains if it's absent.
1034 			 */
1035 			void *p = pi;
1036 			pi->listen_fd = create_bound_socket(instance->fmri,
1037 			    (socket_info_t *)p);
1038 		}
1039 		if (pi->listen_fd == -1) {
1040 			failure = B_TRUE;
1041 			continue;
1042 		}
1043 
1044 		if (pi->ri != NULL) {
1045 
1046 			/*
1047 			 * Don't register the same RPC program number twice.
1048 			 * Doing so silently discards the old service
1049 			 * without causing an error.
1050 			 */
1051 			if (is_rpc_num_in_use(pi->ri->prognum, pi->proto,
1052 			    pi->ri->lowver, pi->ri->highver)) {
1053 				failure = B_TRUE;
1054 				close_net_fd(instance, pi->listen_fd);
1055 				pi->listen_fd = -1;
1056 				continue;
1057 			}
1058 
1059 			unregister_rpc_service(instance->fmri, pi->ri);
1060 			if (register_rpc_service(instance->fmri, pi->ri) ==
1061 			    -1) {
1062 				close_net_fd(instance, pi->listen_fd);
1063 				pi->listen_fd = -1;
1064 				failure = B_TRUE;
1065 				continue;
1066 			}
1067 		}
1068 
1069 		success = B_TRUE;
1070 	}
1071 
1072 	switch (instance->cur_istate) {
1073 	case IIS_OFFLINE:
1074 	case IIS_OFFLINE_BIND:
1075 		/*
1076 		 * If we've managed to bind at least one proto lets run the
1077 		 * online method, so we can start listening for it.
1078 		 */
1079 		if (success && run_method(instance, IM_ONLINE, NULL) == -1)
1080 			return;	/* instance gone to maintenance */
1081 		break;
1082 	case IIS_ONLINE:
1083 	case IIS_IN_REFRESH_METHOD:
1084 		/*
1085 		 * We're 'online', so start polling on any bound fds we're
1086 		 * currently not.
1087 		 */
1088 		if (poll_bound_fds(instance, B_TRUE) != 0) {
1089 			failure = B_TRUE;
1090 		} else if (!failure) {
1091 			/*
1092 			 * We've successfully bound and poll'd upon all protos,
1093 			 * so reset the failure count.
1094 			 */
1095 			instance->bind_fail_count = 0;
1096 		}
1097 		break;
1098 	case IIS_IN_ONLINE_METHOD:
1099 		/*
1100 		 * Nothing to do here as the method completion code will start
1101 		 * listening for any successfully bound fds.
1102 		 */
1103 		break;
1104 	default:
1105 #ifndef NDEBUG
1106 		(void) fprintf(stderr, "%s:%d: Unknown instance state %d.\n",
1107 		    __FILE__, __LINE__, instance->cur_istate);
1108 #endif
1109 		abort();
1110 	}
1111 
1112 	if (failure)
1113 		handle_bind_failure(instance);
1114 }
1115 
1116 /*
1117  * Counter to create_bound_fds(), for each of the bound network fds this
1118  * function unregisters the instance from rpcbind if it's an RPC service,
1119  * stops listening for new connections for it and then closes the listening fd.
1120  */
1121 static void
1122 destroy_bound_fds(instance_t *instance)
1123 {
1124 	basic_cfg_t	*cfg = instance->config->basic;
1125 	proto_info_t	*pi;
1126 
1127 	debug_msg("Entering destroy_bound_fds: instance: %s", instance->fmri);
1128 
1129 	for (pi = uu_list_first(cfg->proto_list); pi != NULL;
1130 	    pi = uu_list_next(cfg->proto_list, pi)) {
1131 		if (pi->listen_fd != -1) {
1132 			if (pi->ri != NULL)
1133 				unregister_rpc_service(instance->fmri, pi->ri);
1134 			clear_pollfd(pi->listen_fd);
1135 			close_net_fd(instance, pi->listen_fd);
1136 			pi->listen_fd = -1;
1137 		}
1138 	}
1139 
1140 	/* cancel any bind retries */
1141 	if (instance->bind_timer_id != -1)
1142 		cancel_bind_timer(instance);
1143 
1144 	instance->bind_retries_exceeded = B_FALSE;
1145 }
1146 
1147 /*
1148  * Perform %A address expansion and return a pointer to a static string
1149  * array containing crafted arguments. This expansion is provided for
1150  * compatibility with 4.2BSD daemons, and as such we've copied the logic of
1151  * the legacy inetd to maintain this compatibility as much as possible. This
1152  * logic is a bit scatty, but it dates back at least as far as SunOS 4.x.
1153  */
1154 static char **
1155 expand_address(instance_t *inst, const proto_info_t *pi)
1156 {
1157 	static char	addrbuf[sizeof ("ffffffff.65536")];
1158 	static char	*ret[3];
1159 	instance_cfg_t	*cfg = inst->config;
1160 	/*
1161 	 * We cast pi to a void so we can then go on to cast it to a
1162 	 * socket_info_t without lint complaining about alignment. This
1163 	 * is done because the x86 version of lint thinks a lint suppression
1164 	 * directive is unnecessary and flags it as such, yet the sparc
1165 	 * version complains if it's absent.
1166 	 */
1167 	const void	*p = pi;
1168 
1169 	debug_msg("Entering expand_address");
1170 
1171 	/* set ret[0] to the basename of exec path */
1172 	if ((ret[0] = strrchr(cfg->methods[IM_START]->exec_path, '/'))
1173 	    != NULL) {
1174 		ret[0]++;
1175 	} else {
1176 		ret[0] = cfg->methods[IM_START]->exec_path;
1177 	}
1178 
1179 	if (!cfg->basic->istlx &&
1180 	    (((socket_info_t *)p)->type == SOCK_DGRAM)) {
1181 		ret[1] = NULL;
1182 	} else {
1183 		addrbuf[0] = '\0';
1184 		if (!cfg->basic->iswait &&
1185 		    (inst->remote_addr.ss_family == AF_INET)) {
1186 			struct sockaddr_in *sp;
1187 
1188 			sp = (struct sockaddr_in *)&(inst->remote_addr);
1189 			(void) snprintf(addrbuf, sizeof (addrbuf), "%x.%hu",
1190 			    ntohl(sp->sin_addr.s_addr), ntohs(sp->sin_port));
1191 		}
1192 		ret[1] = addrbuf;
1193 		ret[2] = NULL;
1194 	}
1195 
1196 	return (ret);
1197 }
1198 
1199 /*
1200  * Returns the state associated with the supplied method being run for an
1201  * instance.
1202  */
1203 static internal_inst_state_t
1204 get_method_state(instance_method_t method)
1205 {
1206 	state_info_t *sip;
1207 
1208 	for (sip = states; sip->istate != IIS_NONE; sip++) {
1209 		if (sip->method_running == method)
1210 			break;
1211 	}
1212 	assert(sip->istate != IIS_NONE);
1213 
1214 	return (sip->istate);
1215 }
1216 
1217 /*
1218  * Store the method's PID and CID in the repository. If the store fails
1219  * we ignore it and just drive on.
1220  */
1221 static void
1222 add_method_ids(instance_t *ins, pid_t pid, ctid_t cid, instance_method_t mthd)
1223 {
1224 	debug_msg("Entering add_method_ids");
1225 
1226 	if (cid != -1)
1227 		(void) add_remove_contract(ins, B_TRUE, cid);
1228 
1229 	if (mthd == IM_START) {
1230 		if (add_rep_val(ins->start_pids, (int64_t)pid) == 0) {
1231 			(void) store_rep_vals(ins->start_pids, ins->fmri,
1232 			    PR_NAME_START_PIDS);
1233 		}
1234 	} else {
1235 		if (add_rep_val(ins->non_start_pid, (int64_t)pid) == 0) {
1236 			(void) store_rep_vals(ins->non_start_pid, ins->fmri,
1237 			    PR_NAME_NON_START_PID);
1238 		}
1239 	}
1240 }
1241 
1242 /*
1243  * Remove the method's PID and CID from the repository. If the removal
1244  * fails we ignore it and drive on.
1245  */
1246 void
1247 remove_method_ids(instance_t *inst, pid_t pid, ctid_t cid,
1248     instance_method_t mthd)
1249 {
1250 	debug_msg("Entering remove_method_ids");
1251 
1252 	if (cid != -1)
1253 		(void) add_remove_contract(inst, B_FALSE, cid);
1254 
1255 	if (mthd == IM_START) {
1256 		remove_rep_val(inst->start_pids, (int64_t)pid);
1257 		(void) store_rep_vals(inst->start_pids, inst->fmri,
1258 		    PR_NAME_START_PIDS);
1259 	} else {
1260 		remove_rep_val(inst->non_start_pid, (int64_t)pid);
1261 		(void) store_rep_vals(inst->non_start_pid, inst->fmri,
1262 		    PR_NAME_NON_START_PID);
1263 	}
1264 }
1265 
1266 static instance_t *
1267 create_instance(const char *fmri)
1268 {
1269 	instance_t *ret;
1270 
1271 	debug_msg("Entering create_instance, instance: %s", fmri);
1272 
1273 	if (((ret = calloc(1, sizeof (instance_t))) == NULL) ||
1274 	    ((ret->fmri = strdup(fmri)) == NULL))
1275 		goto alloc_fail;
1276 
1277 	ret->conn_fd = -1;
1278 
1279 	ret->copies = 0;
1280 
1281 	ret->conn_rate_count = 0;
1282 	ret->fail_rate_count = 0;
1283 	ret->bind_fail_count = 0;
1284 
1285 	if (((ret->non_start_pid = create_rep_val_list()) == NULL) ||
1286 	    ((ret->start_pids = create_rep_val_list()) == NULL) ||
1287 	    ((ret->start_ctids = create_rep_val_list()) == NULL))
1288 		goto alloc_fail;
1289 
1290 	ret->cur_istate = IIS_NONE;
1291 	ret->next_istate = IIS_NONE;
1292 
1293 	if (((ret->cur_istate_rep = create_rep_val_list()) == NULL) ||
1294 	    ((ret->next_istate_rep = create_rep_val_list()) == NULL))
1295 		goto alloc_fail;
1296 
1297 	ret->config = NULL;
1298 	ret->new_config = NULL;
1299 
1300 	ret->timer_id = -1;
1301 	ret->bind_timer_id = -1;
1302 
1303 	ret->disable_req = B_FALSE;
1304 	ret->maintenance_req = B_FALSE;
1305 	ret->conn_rate_exceeded = B_FALSE;
1306 	ret->bind_retries_exceeded = B_FALSE;
1307 
1308 	ret->pending_rst_event = RESTARTER_EVENT_TYPE_INVALID;
1309 
1310 	return (ret);
1311 
1312 alloc_fail:
1313 	error_msg(strerror(errno));
1314 	destroy_instance(ret);
1315 	return (NULL);
1316 }
1317 
1318 static void
1319 destroy_instance(instance_t *inst)
1320 {
1321 	debug_msg("Entering destroy_instance");
1322 
1323 	if (inst == NULL)
1324 		return;
1325 
1326 	destroy_instance_cfg(inst->config);
1327 	destroy_instance_cfg(inst->new_config);
1328 
1329 	destroy_rep_val_list(inst->cur_istate_rep);
1330 	destroy_rep_val_list(inst->next_istate_rep);
1331 
1332 	destroy_rep_val_list(inst->start_pids);
1333 	destroy_rep_val_list(inst->non_start_pid);
1334 	destroy_rep_val_list(inst->start_ctids);
1335 
1336 	free(inst->fmri);
1337 
1338 	free(inst);
1339 }
1340 
1341 /*
1342  * Retrieves the current and next states internal states. Returns 0 on success,
1343  * else returns one of the following on error:
1344  * SCF_ERROR_NO_MEMORY if memory allocation failed.
1345  * SCF_ERROR_CONNECTION_BROKEN if the connection to the repository was broken.
1346  * SCF_ERROR_TYPE_MISMATCH if the property was of an unexpected type.
1347  * SCF_ERROR_NO_RESOURCES if the server doesn't have adequate resources.
1348  * SCF_ERROR_NO_SERVER if the server isn't running.
1349  */
1350 static scf_error_t
1351 retrieve_instance_state(instance_t *inst)
1352 {
1353 	scf_error_t	ret;
1354 
1355 	debug_msg("Entering retrieve_instance_state: instance: %s",
1356 	    inst->fmri);
1357 
1358 	/* retrieve internal states */
1359 	if (((ret = retrieve_rep_vals(inst->cur_istate_rep, inst->fmri,
1360 	    PR_NAME_CUR_INT_STATE)) != 0) ||
1361 	    ((ret = retrieve_rep_vals(inst->next_istate_rep, inst->fmri,
1362 	    PR_NAME_NEXT_INT_STATE)) != 0)) {
1363 		if (ret != SCF_ERROR_NOT_FOUND) {
1364 			error_msg(gettext(
1365 			    "Failed to read state of instance %s: %s"),
1366 			    inst->fmri, scf_strerror(scf_error()));
1367 			return (ret);
1368 		}
1369 
1370 		debug_msg("instance with no previous int state - "
1371 		    "setting state to uninitialized");
1372 
1373 		if ((set_single_rep_val(inst->cur_istate_rep,
1374 		    (int64_t)IIS_UNINITIALIZED) == -1) ||
1375 		    (set_single_rep_val(inst->next_istate_rep,
1376 		    (int64_t)IIS_NONE) == -1)) {
1377 			return (SCF_ERROR_NO_MEMORY);
1378 		}
1379 	}
1380 
1381 	/* update convenience states */
1382 	inst->cur_istate = get_single_rep_val(inst->cur_istate_rep);
1383 	inst->next_istate = get_single_rep_val(inst->next_istate_rep);
1384 	debug_msg("previous states: cur: %d, next: %d", inst->cur_istate,
1385 	    inst->next_istate);
1386 
1387 	return (0);
1388 }
1389 
1390 /*
1391  * Retrieve stored process ids and register each of them so we process their
1392  * termination.
1393  */
1394 static int
1395 retrieve_method_pids(instance_t *inst)
1396 {
1397 	rep_val_t	*rv;
1398 
1399 	debug_msg("Entering remove_method_pids");
1400 
1401 	switch (retrieve_rep_vals(inst->start_pids, inst->fmri,
1402 	    PR_NAME_START_PIDS)) {
1403 	case 0:
1404 		break;
1405 	case SCF_ERROR_NOT_FOUND:
1406 		return (0);
1407 	default:
1408 		error_msg(gettext("Failed to retrieve the start pids of "
1409 		    "instance %s from repository: %s"), inst->fmri,
1410 		    scf_strerror(scf_error()));
1411 		return (-1);
1412 	}
1413 
1414 	rv = uu_list_first(inst->start_pids);
1415 	while (rv != NULL) {
1416 		if (register_method(inst, (pid_t)rv->val, (ctid_t)-1,
1417 		    IM_START) == 0) {
1418 			inst->copies++;
1419 			rv = uu_list_next(inst->start_pids, rv);
1420 		} else if (errno == ENOENT) {
1421 			pid_t pid = (pid_t)rv->val;
1422 
1423 			/*
1424 			 * The process must have already terminated. Remove
1425 			 * it from the list.
1426 			 */
1427 			rv = uu_list_next(inst->start_pids, rv);
1428 			remove_rep_val(inst->start_pids, pid);
1429 		} else {
1430 			error_msg(gettext("Failed to listen for the completion "
1431 			    "of %s method of instance %s"), START_METHOD_NAME,
1432 			    inst->fmri);
1433 			rv = uu_list_next(inst->start_pids, rv);
1434 		}
1435 	}
1436 
1437 	/* synch the repository pid list to remove any terminated pids */
1438 	(void) store_rep_vals(inst->start_pids, inst->fmri, PR_NAME_START_PIDS);
1439 
1440 	return (0);
1441 }
1442 
1443 /*
1444  * Remove the passed instance from inetd control.
1445  */
1446 static void
1447 remove_instance(instance_t *instance)
1448 {
1449 	debug_msg("Entering remove_instance");
1450 
1451 	switch (instance->cur_istate) {
1452 	case IIS_ONLINE:
1453 	case IIS_DEGRADED:
1454 		/* stop listening for network connections */
1455 		destroy_bound_fds(instance);
1456 		break;
1457 	case IIS_OFFLINE_BIND:
1458 		cancel_bind_timer(instance);
1459 		break;
1460 	case IIS_OFFLINE_CONRATE:
1461 		cancel_inst_timer(instance);
1462 		break;
1463 	}
1464 
1465 	/* stop listening for terminated methods */
1466 	unregister_instance_methods(instance);
1467 
1468 	uu_list_remove(instance_list, instance);
1469 	destroy_instance(instance);
1470 }
1471 
1472 /*
1473  * Refresh the configuration of instance 'inst'. This method gets called as
1474  * a result of a refresh event for the instance from the master restarter, so
1475  * we can rely upon the instance's running snapshot having been updated from
1476  * its configuration snapshot.
1477  */
1478 void
1479 refresh_instance(instance_t *inst)
1480 {
1481 	instance_cfg_t	*cfg;
1482 
1483 	debug_msg("Entering refresh_instance: inst: %s", inst->fmri);
1484 
1485 	switch (inst->cur_istate) {
1486 	case IIS_MAINTENANCE:
1487 	case IIS_DISABLED:
1488 	case IIS_UNINITIALIZED:
1489 		/*
1490 		 * Ignore any possible changes, we'll re-read the configuration
1491 		 * automatically when we exit these states.
1492 		 */
1493 		break;
1494 
1495 	case IIS_OFFLINE_COPIES:
1496 	case IIS_OFFLINE_BIND:
1497 	case IIS_OFFLINE:
1498 	case IIS_OFFLINE_CONRATE:
1499 		destroy_instance_cfg(inst->config);
1500 		if ((inst->config = read_instance_cfg(inst->fmri)) == NULL) {
1501 			log_invalid_cfg(inst->fmri);
1502 			if (inst->cur_istate == IIS_OFFLINE_BIND) {
1503 				cancel_bind_timer(inst);
1504 			} else if (inst->cur_istate == IIS_OFFLINE_CONRATE) {
1505 				cancel_inst_timer(inst);
1506 			}
1507 			update_state(inst, IIS_MAINTENANCE, RERR_FAULT);
1508 		} else {
1509 			switch (inst->cur_istate) {
1510 			case IIS_OFFLINE_BIND:
1511 				if (copies_limit_exceeded(inst)) {
1512 					/* Cancel scheduled bind retries. */
1513 					cancel_bind_timer(inst);
1514 
1515 					/*
1516 					 * Take the instance to the copies
1517 					 * offline state, via the offline
1518 					 * state.
1519 					 */
1520 					update_state(inst, IIS_OFFLINE,
1521 					    RERR_RESTART);
1522 					process_offline_inst(inst);
1523 				}
1524 				break;
1525 
1526 			case IIS_OFFLINE:
1527 				process_offline_inst(inst);
1528 				break;
1529 
1530 			case IIS_OFFLINE_CONRATE:
1531 				/*
1532 				 * Since we're already in a DOS state,
1533 				 * don't bother evaluating the copies
1534 				 * limit. This will be evaluated when
1535 				 * we leave this state in
1536 				 * process_offline_inst().
1537 				 */
1538 				break;
1539 
1540 			case IIS_OFFLINE_COPIES:
1541 				/*
1542 				 * Check if the copies limit has been increased
1543 				 * above the current count.
1544 				 */
1545 				if (!copies_limit_exceeded(inst)) {
1546 					update_state(inst, IIS_OFFLINE,
1547 					    RERR_RESTART);
1548 					process_offline_inst(inst);
1549 				}
1550 				break;
1551 
1552 			default:
1553 				assert(0);
1554 			}
1555 		}
1556 		break;
1557 
1558 	case IIS_DEGRADED:
1559 	case IIS_ONLINE:
1560 		if ((cfg = read_instance_cfg(inst->fmri)) != NULL) {
1561 			instance_cfg_t *ocfg = inst->config;
1562 
1563 			/*
1564 			 * Try to avoid the overhead of taking an instance
1565 			 * offline and back on again. We do this by limiting
1566 			 * this behavior to two eventualities:
1567 			 * - there needs to be a re-bind to listen on behalf
1568 			 *   of the instance with its new configuration. This
1569 			 *   could be because for example its service has been
1570 			 *   associated with a different port, or because the
1571 			 *   v6only protocol option has been newly applied to
1572 			 *   the instance.
1573 			 * - one or both of the start or online methods of the
1574 			 *   instance have changed in the new configuration.
1575 			 *   Without taking the instance offline when the
1576 			 *   start method changed the instance may be running
1577 			 *   with unwanted parameters (or event an unwanted
1578 			 *   binary); and without taking the instance offline
1579 			 *   if its online method was to change, some part of
1580 			 *   its running environment may have changed and would
1581 			 *   not be picked up until the instance next goes
1582 			 *   offline for another reason.
1583 			 */
1584 			if ((!bind_config_equal(ocfg->basic, cfg->basic)) ||
1585 			    !method_info_equal(ocfg->methods[IM_ONLINE],
1586 			    cfg->methods[IM_ONLINE]) ||
1587 			    !method_info_equal(ocfg->methods[IM_START],
1588 			    cfg->methods[IM_START])) {
1589 				destroy_bound_fds(inst);
1590 
1591 				assert(inst->new_config == NULL);
1592 				inst->new_config = cfg;
1593 
1594 				(void) run_method(inst, IM_OFFLINE, NULL);
1595 			} else {	/* no bind config / method changes */
1596 
1597 				/*
1598 				 * swap the proto list over from the old
1599 				 * configuration to the new, so we retain
1600 				 * our set of network fds.
1601 				 */
1602 				destroy_proto_list(cfg->basic);
1603 				cfg->basic->proto_list =
1604 				    ocfg->basic->proto_list;
1605 				ocfg->basic->proto_list = NULL;
1606 				destroy_instance_cfg(ocfg);
1607 				inst->config = cfg;
1608 
1609 				/* re-evaluate copies limits based on new cfg */
1610 				if (copies_limit_exceeded(inst)) {
1611 					destroy_bound_fds(inst);
1612 					(void) run_method(inst, IM_OFFLINE,
1613 					    NULL);
1614 				} else {
1615 					/*
1616 					 * Since the instance isn't being
1617 					 * taken offline, where we assume it
1618 					 * would pick-up any configuration
1619 					 * changes automatically when it goes
1620 					 * back online, run its refresh method
1621 					 * to allow it to pick-up any changes
1622 					 * whilst still online.
1623 					 */
1624 					(void) run_method(inst, IM_REFRESH,
1625 					    NULL);
1626 				}
1627 			}
1628 		} else {
1629 			log_invalid_cfg(inst->fmri);
1630 
1631 			destroy_bound_fds(inst);
1632 
1633 			inst->maintenance_req = B_TRUE;
1634 			(void) run_method(inst, IM_OFFLINE, NULL);
1635 		}
1636 		break;
1637 
1638 	default:
1639 		debug_msg("Unhandled current state %d for instance in "
1640 		    "refresh_instance", inst->cur_istate);
1641 		assert(0);
1642 	}
1643 }
1644 
1645 /*
1646  * Called by process_restarter_event() to handle a restarter event for an
1647  * instance.
1648  */
1649 static void
1650 handle_restarter_event(instance_t *instance, restarter_event_type_t event,
1651     boolean_t send_ack)
1652 {
1653 	debug_msg("Entering handle_restarter_event: inst: %s, event: %d, "
1654 	    "curr state: %d", instance->fmri, event, instance->cur_istate);
1655 
1656 	switch (event) {
1657 	case RESTARTER_EVENT_TYPE_ADMIN_REFRESH:
1658 		refresh_instance(instance);
1659 		goto done;
1660 	case RESTARTER_EVENT_TYPE_REMOVE_INSTANCE:
1661 		remove_instance(instance);
1662 		goto done;
1663 	case RESTARTER_EVENT_TYPE_STOP:
1664 		switch (instance->cur_istate) {
1665 		case IIS_OFFLINE_CONRATE:
1666 		case IIS_OFFLINE_BIND:
1667 		case IIS_OFFLINE_COPIES:
1668 			/*
1669 			 * inetd must be closing down as we wouldn't get this
1670 			 * event in one of these states from the master
1671 			 * restarter. Take the instance to the offline resting
1672 			 * state.
1673 			 */
1674 			if (instance->cur_istate == IIS_OFFLINE_BIND) {
1675 				cancel_bind_timer(instance);
1676 			} else if (instance->cur_istate ==
1677 			    IIS_OFFLINE_CONRATE) {
1678 				cancel_inst_timer(instance);
1679 			}
1680 			update_state(instance, IIS_OFFLINE, RERR_RESTART);
1681 			goto done;
1682 		}
1683 		break;
1684 	case RESTARTER_EVENT_TYPE_ADMIN_RESTART:
1685 		/*
1686 		 * We've got a restart event, so if the instance is online
1687 		 * in any way initiate taking it offline, and rely upon
1688 		 * our restarter to send us an online event to bring
1689 		 * it back online.
1690 		 */
1691 		switch (instance->cur_istate) {
1692 		case IIS_ONLINE:
1693 		case IIS_DEGRADED:
1694 			destroy_bound_fds(instance);
1695 			(void) run_method(instance, IM_OFFLINE, NULL);
1696 		}
1697 		goto done;
1698 	}
1699 
1700 	switch (instance->cur_istate) {
1701 	case IIS_OFFLINE:
1702 		switch (event) {
1703 		case RESTARTER_EVENT_TYPE_START:
1704 			/*
1705 			 * Dependencies are met, let's take the service online.
1706 			 * Only try and bind for a wait type service if
1707 			 * no process is running on its behalf. Otherwise, just
1708 			 * mark the service online and binding will be attempted
1709 			 * when the process exits.
1710 			 */
1711 			if (!(instance->config->basic->iswait &&
1712 			    (uu_list_first(instance->start_pids) != NULL))) {
1713 				create_bound_fds(instance);
1714 			} else {
1715 				update_state(instance, IIS_ONLINE, RERR_NONE);
1716 			}
1717 			break;
1718 		case RESTARTER_EVENT_TYPE_DISABLE:
1719 		case RESTARTER_EVENT_TYPE_ADMIN_DISABLE:
1720 			/*
1721 			 * The instance should be disabled, so run the
1722 			 * instance's disabled method that will do the work
1723 			 * to take it there.
1724 			 */
1725 			(void) run_method(instance, IM_DISABLE, NULL);
1726 			break;
1727 		case RESTARTER_EVENT_TYPE_ADMIN_MAINT_ON:
1728 		case RESTARTER_EVENT_TYPE_DEPENDENCY_CYCLE:
1729 		case RESTARTER_EVENT_TYPE_INVALID_DEPENDENCY:
1730 			/*
1731 			 * The master restarter has requested the instance
1732 			 * go to maintenance; since we're already offline
1733 			 * just update the state to the maintenance state.
1734 			 */
1735 			update_state(instance, IIS_MAINTENANCE, RERR_RESTART);
1736 			break;
1737 		}
1738 		break;
1739 
1740 	case IIS_OFFLINE_BIND:
1741 		switch (event) {
1742 		case RESTARTER_EVENT_TYPE_DISABLE:
1743 		case RESTARTER_EVENT_TYPE_ADMIN_DISABLE:
1744 			/*
1745 			 * The instance should be disabled. Firstly, as for
1746 			 * the above dependencies unmet comment, cancel
1747 			 * the bind retry timer and update the state to
1748 			 * offline. Then, run the disable method to do the
1749 			 * work to take the instance from offline to
1750 			 * disabled.
1751 			 */
1752 			cancel_bind_timer(instance);
1753 			update_state(instance, IIS_OFFLINE, RERR_RESTART);
1754 			(void) run_method(instance, IM_DISABLE, NULL);
1755 			break;
1756 		case RESTARTER_EVENT_TYPE_ADMIN_MAINT_ON:
1757 		case RESTARTER_EVENT_TYPE_DEPENDENCY_CYCLE:
1758 		case RESTARTER_EVENT_TYPE_INVALID_DEPENDENCY:
1759 			/*
1760 			 * The master restarter has requested the instance
1761 			 * be placed in the maintenance state. Cancel the
1762 			 * outstanding retry timer, and since we're already
1763 			 * offline, update the state to maintenance.
1764 			 */
1765 			cancel_bind_timer(instance);
1766 			update_state(instance, IIS_MAINTENANCE, RERR_RESTART);
1767 			break;
1768 		}
1769 		break;
1770 
1771 	case IIS_DEGRADED:
1772 	case IIS_ONLINE:
1773 		switch (event) {
1774 		case RESTARTER_EVENT_TYPE_DISABLE:
1775 		case RESTARTER_EVENT_TYPE_ADMIN_DISABLE:
1776 			/*
1777 			 * The instance needs to be disabled. Do the same work
1778 			 * as for the dependencies unmet event below to
1779 			 * take the instance offline.
1780 			 */
1781 			destroy_bound_fds(instance);
1782 			/*
1783 			 * Indicate that the offline method is being run
1784 			 * as part of going to the disabled state, and to
1785 			 * carry on this transition.
1786 			 */
1787 			instance->disable_req = B_TRUE;
1788 			(void) run_method(instance, IM_OFFLINE, NULL);
1789 			break;
1790 		case RESTARTER_EVENT_TYPE_ADMIN_MAINT_ON:
1791 		case RESTARTER_EVENT_TYPE_DEPENDENCY_CYCLE:
1792 		case RESTARTER_EVENT_TYPE_INVALID_DEPENDENCY:
1793 			/*
1794 			 * The master restarter has requested the instance be
1795 			 * placed in the maintenance state. This involves
1796 			 * firstly taking the service offline, so do the
1797 			 * same work as for the dependencies unmet event
1798 			 * below. We set the maintenance_req flag to
1799 			 * indicate that when we get to the offline state
1800 			 * we should be placed directly into the maintenance
1801 			 * state.
1802 			 */
1803 			instance->maintenance_req = B_TRUE;
1804 			/* FALLTHROUGH */
1805 		case RESTARTER_EVENT_TYPE_STOP:
1806 			/*
1807 			 * Dependencies have become unmet. Close and
1808 			 * stop listening on the instance's network file
1809 			 * descriptor, and run the offline method to do
1810 			 * any work required to take us to the offline state.
1811 			 */
1812 			destroy_bound_fds(instance);
1813 			(void) run_method(instance, IM_OFFLINE, NULL);
1814 		}
1815 		break;
1816 
1817 	case IIS_UNINITIALIZED:
1818 		if (event == RESTARTER_EVENT_TYPE_DISABLE ||
1819 		    event == RESTARTER_EVENT_TYPE_ADMIN_DISABLE) {
1820 			update_state(instance, IIS_DISABLED, RERR_NONE);
1821 			break;
1822 		} else if (event != RESTARTER_EVENT_TYPE_ENABLE) {
1823 			/*
1824 			 * Ignore other events until we know whether we're
1825 			 * enabled or not.
1826 			 */
1827 			break;
1828 		}
1829 
1830 		/*
1831 		 * We've got an enabled event; make use of the handling in the
1832 		 * disable case.
1833 		 */
1834 		/* FALLTHROUGH */
1835 
1836 	case IIS_DISABLED:
1837 		switch (event) {
1838 		case RESTARTER_EVENT_TYPE_ENABLE:
1839 			/*
1840 			 * The instance needs enabling. Commence reading its
1841 			 * configuration and if successful place the instance
1842 			 * in the offline state and let process_offline_inst()
1843 			 * take it from there.
1844 			 */
1845 			destroy_instance_cfg(instance->config);
1846 			instance->config = read_instance_cfg(instance->fmri);
1847 			if (instance->config != NULL) {
1848 				update_state(instance, IIS_OFFLINE,
1849 				    RERR_RESTART);
1850 				process_offline_inst(instance);
1851 			} else {
1852 				log_invalid_cfg(instance->fmri);
1853 				update_state(instance, IIS_MAINTENANCE,
1854 				    RERR_RESTART);
1855 			}
1856 
1857 			break;
1858 		case RESTARTER_EVENT_TYPE_ADMIN_MAINT_ON:
1859 		case RESTARTER_EVENT_TYPE_DEPENDENCY_CYCLE:
1860 		case RESTARTER_EVENT_TYPE_INVALID_DEPENDENCY:
1861 			/*
1862 			 * The master restarter has requested the instance be
1863 			 * placed in the maintenance state, so just update its
1864 			 * state to maintenance.
1865 			 */
1866 			update_state(instance, IIS_MAINTENANCE, RERR_RESTART);
1867 			break;
1868 		}
1869 		break;
1870 
1871 	case IIS_MAINTENANCE:
1872 		switch (event) {
1873 		case RESTARTER_EVENT_TYPE_ADMIN_MAINT_OFF:
1874 		case RESTARTER_EVENT_TYPE_ADMIN_DISABLE:
1875 			/*
1876 			 * The master restarter has requested that the instance
1877 			 * be taken out of maintenance. Read its configuration,
1878 			 * and if successful place the instance in the offline
1879 			 * state and call process_offline_inst() to take it
1880 			 * from there.
1881 			 */
1882 			destroy_instance_cfg(instance->config);
1883 			instance->config = read_instance_cfg(instance->fmri);
1884 			if (instance->config != NULL) {
1885 				update_state(instance, IIS_OFFLINE,
1886 				    RERR_RESTART);
1887 				process_offline_inst(instance);
1888 			} else {
1889 				boolean_t enabled;
1890 
1891 				/*
1892 				 * The configuration was invalid. If the
1893 				 * service has disabled requested, let's
1894 				 * just place the instance in disabled even
1895 				 * though we haven't been able to run its
1896 				 * disable method, as the slightly incorrect
1897 				 * state is likely to be less of an issue to
1898 				 * an administrator than refusing to move an
1899 				 * instance to disabled. If disable isn't
1900 				 * requested, re-mark the service's state
1901 				 * as maintenance, so the administrator can
1902 				 * see the request was processed.
1903 				 */
1904 				if ((read_enable_merged(instance->fmri,
1905 				    &enabled) == 0) && !enabled) {
1906 					update_state(instance, IIS_DISABLED,
1907 					    RERR_RESTART);
1908 				} else {
1909 					log_invalid_cfg(instance->fmri);
1910 					update_state(instance, IIS_MAINTENANCE,
1911 					    RERR_FAULT);
1912 				}
1913 			}
1914 			break;
1915 		}
1916 		break;
1917 
1918 	case IIS_OFFLINE_CONRATE:
1919 		switch (event) {
1920 		case RESTARTER_EVENT_TYPE_DISABLE:
1921 			/*
1922 			 * The instance wants disabling. Take the instance
1923 			 * offline as for the dependencies unmet event above,
1924 			 * and then from there run the disable method to do
1925 			 * the work to take the instance to the disabled state.
1926 			 */
1927 			cancel_inst_timer(instance);
1928 			update_state(instance, IIS_OFFLINE, RERR_RESTART);
1929 			(void) run_method(instance, IM_DISABLE, NULL);
1930 			break;
1931 		case RESTARTER_EVENT_TYPE_ADMIN_MAINT_ON:
1932 		case RESTARTER_EVENT_TYPE_DEPENDENCY_CYCLE:
1933 		case RESTARTER_EVENT_TYPE_INVALID_DEPENDENCY:
1934 			/*
1935 			 * The master restarter has requested the instance
1936 			 * be taken to maintenance. Cancel the timer setup
1937 			 * when we entered this state, and go directly to
1938 			 * maintenance.
1939 			 */
1940 			cancel_inst_timer(instance);
1941 			update_state(instance, IIS_MAINTENANCE, RERR_RESTART);
1942 			break;
1943 		}
1944 		break;
1945 
1946 	case IIS_OFFLINE_COPIES:
1947 		switch (event) {
1948 		case RESTARTER_EVENT_TYPE_DISABLE:
1949 			/*
1950 			 * The instance wants disabling. Update the state
1951 			 * to offline, and run the disable method to do the
1952 			 * work to take it to the disabled state.
1953 			 */
1954 			update_state(instance, IIS_OFFLINE, RERR_RESTART);
1955 			(void) run_method(instance, IM_DISABLE, NULL);
1956 			break;
1957 		case RESTARTER_EVENT_TYPE_ADMIN_MAINT_ON:
1958 		case RESTARTER_EVENT_TYPE_DEPENDENCY_CYCLE:
1959 		case RESTARTER_EVENT_TYPE_INVALID_DEPENDENCY:
1960 			/*
1961 			 * The master restarter has requested the instance be
1962 			 * placed in maintenance. Since it's already offline
1963 			 * simply update the state.
1964 			 */
1965 			update_state(instance, IIS_MAINTENANCE, RERR_RESTART);
1966 			break;
1967 		}
1968 		break;
1969 
1970 	default:
1971 		debug_msg("handle_restarter_event: instance in an "
1972 		    "unexpected state");
1973 		assert(0);
1974 	}
1975 
1976 done:
1977 	if (send_ack)
1978 		ack_restarter_event(B_TRUE);
1979 }
1980 
1981 /*
1982  * Tries to read and process an event from the event pipe. If there isn't one
1983  * or an error occurred processing the event it returns -1. Else, if the event
1984  * is for an instance we're not already managing we read its state, add it to
1985  * our list to manage, and if appropriate read its configuration. Whether it's
1986  * new to us or not, we then handle the specific event.
1987  * Returns 0 if an event was read and processed successfully, else -1.
1988  */
1989 static int
1990 process_restarter_event(void)
1991 {
1992 	char			*fmri;
1993 	size_t			fmri_size;
1994 	restarter_event_type_t  event_type;
1995 	instance_t		*instance;
1996 	restarter_event_t	*event;
1997 	ssize_t			sz;
1998 
1999 	debug_msg("Entering process_restarter_event");
2000 
2001 	/*
2002 	 * Try to read an event pointer from the event pipe.
2003 	 */
2004 	errno = 0;
2005 	switch (safe_read(rst_event_pipe[PE_CONSUMER], &event,
2006 	    sizeof (event))) {
2007 	case 0:
2008 		break;
2009 	case  1:
2010 		if (errno == EAGAIN)	/* no event to read */
2011 			return (-1);
2012 
2013 		/* other end of pipe closed */
2014 
2015 		/* FALLTHROUGH */
2016 	default:			/* unexpected read error */
2017 		/*
2018 		 * There's something wrong with the event pipe. Let's
2019 		 * shutdown and be restarted.
2020 		 */
2021 		inetd_stop();
2022 		return (-1);
2023 	}
2024 
2025 	/*
2026 	 * Check if we're currently managing the instance which the event
2027 	 * pertains to. If not, read its complete state and add it to our
2028 	 * list to manage.
2029 	 */
2030 
2031 	fmri_size = scf_limit(SCF_LIMIT_MAX_FMRI_LENGTH);
2032 	if ((fmri = malloc(fmri_size)) == NULL) {
2033 		error_msg(strerror(errno));
2034 		goto fail;
2035 	}
2036 	sz = restarter_event_get_instance(event, fmri, fmri_size);
2037 	if (sz >= fmri_size)
2038 		assert(0);
2039 
2040 	for (instance = uu_list_first(instance_list); instance != NULL;
2041 	    instance = uu_list_next(instance_list, instance)) {
2042 		if (strcmp(instance->fmri, fmri) == 0)
2043 			break;
2044 	}
2045 
2046 	if (instance == NULL) {
2047 		int err;
2048 
2049 		debug_msg("New instance to manage: %s", fmri);
2050 
2051 		if (((instance = create_instance(fmri)) == NULL) ||
2052 		    (retrieve_instance_state(instance) != 0) ||
2053 		    (retrieve_method_pids(instance) != 0)) {
2054 			destroy_instance(instance);
2055 			free(fmri);
2056 			goto fail;
2057 		}
2058 
2059 		if (((err = iterate_repository_contracts(instance, 0))
2060 		    != 0) && (err != ENOENT)) {
2061 			error_msg(gettext(
2062 			    "Failed to adopt contracts of instance %s: %s"),
2063 			    instance->fmri, strerror(err));
2064 			destroy_instance(instance);
2065 			free(fmri);
2066 			goto fail;
2067 		}
2068 
2069 		uu_list_node_init(instance, &instance->link, instance_pool);
2070 		(void) uu_list_insert_after(instance_list, NULL, instance);
2071 
2072 		/*
2073 		 * Only read configuration for instances that aren't in any of
2074 		 * the disabled, maintenance or uninitialized states, since
2075 		 * they'll read it on state exit.
2076 		 */
2077 		if ((instance->cur_istate != IIS_DISABLED) &&
2078 		    (instance->cur_istate != IIS_MAINTENANCE) &&
2079 		    (instance->cur_istate != IIS_UNINITIALIZED)) {
2080 			instance->config = read_instance_cfg(instance->fmri);
2081 			if (instance->config == NULL) {
2082 				log_invalid_cfg(instance->fmri);
2083 				update_state(instance, IIS_MAINTENANCE,
2084 				    RERR_FAULT);
2085 			}
2086 		}
2087 	}
2088 
2089 	free(fmri);
2090 
2091 	event_type = restarter_event_get_type(event);
2092 	debug_msg("Event type: %d for instance: %s", event_type,
2093 	    instance->fmri);
2094 
2095 	/*
2096 	 * If the instance is currently running a method, don't process the
2097 	 * event now, but attach it to the instance for processing when
2098 	 * the instance finishes its transition.
2099 	 */
2100 	if (INST_IN_TRANSITION(instance)) {
2101 		debug_msg("storing event %d for instance %s", event_type,
2102 		    instance->fmri);
2103 		instance->pending_rst_event = event_type;
2104 	} else {
2105 		handle_restarter_event(instance, event_type, B_TRUE);
2106 	}
2107 
2108 	return (0);
2109 
2110 fail:
2111 	ack_restarter_event(B_FALSE);
2112 	return (-1);
2113 }
2114 
2115 /*
2116  * Do the state machine processing associated with the termination of instance
2117  * 'inst''s start method.
2118  */
2119 void
2120 process_start_term(instance_t *inst)
2121 {
2122 	basic_cfg_t	*cfg;
2123 
2124 	debug_msg("Entering process_start_term: inst: %s", inst->fmri);
2125 
2126 	inst->copies--;
2127 
2128 	if ((inst->cur_istate == IIS_MAINTENANCE) ||
2129 	    (inst->cur_istate == IIS_DISABLED)) {
2130 		/* do any further processing/checks when we exit these states */
2131 		return;
2132 	}
2133 
2134 	cfg = inst->config->basic;
2135 
2136 	if (cfg->iswait) {
2137 		proto_info_t	*pi;
2138 
2139 		switch (inst->cur_istate) {
2140 		case IIS_ONLINE:
2141 		case IIS_DEGRADED:
2142 		case IIS_IN_REFRESH_METHOD:
2143 			/*
2144 			 * A wait type service's start method has exited.
2145 			 * Check if the method was fired off in this inetd's
2146 			 * lifetime, or a previous one; if the former,
2147 			 * re-commence listening on the service's behalf; if
2148 			 * the latter, mark the service offline and let bind
2149 			 * attempts commence.
2150 			 */
2151 			for (pi = uu_list_first(cfg->proto_list); pi != NULL;
2152 			    pi = uu_list_next(cfg->proto_list, pi)) {
2153 				/*
2154 				 * If a bound fd exists, the method was fired
2155 				 * off during this inetd's lifetime.
2156 				 */
2157 				if (pi->listen_fd != -1)
2158 					break;
2159 			}
2160 			if (pi != NULL) {
2161 				if (poll_bound_fds(inst, B_TRUE) != 0)
2162 					handle_bind_failure(inst);
2163 			} else {
2164 				update_state(inst, IIS_OFFLINE, RERR_RESTART);
2165 				create_bound_fds(inst);
2166 			}
2167 		}
2168 	} else {
2169 		/*
2170 		 * Check if a nowait service should be brought back online
2171 		 * after exceeding its copies limit.
2172 		 */
2173 		if ((inst->cur_istate == IIS_OFFLINE_COPIES) &&
2174 		    !copies_limit_exceeded(inst)) {
2175 			update_state(inst, IIS_OFFLINE, RERR_NONE);
2176 			process_offline_inst(inst);
2177 		}
2178 	}
2179 }
2180 
2181 /*
2182  * If the instance has a pending event process it and initiate the
2183  * acknowledgement.
2184  */
2185 static void
2186 process_pending_rst_event(instance_t *inst)
2187 {
2188 	if (inst->pending_rst_event != RESTARTER_EVENT_TYPE_INVALID) {
2189 		restarter_event_type_t re;
2190 
2191 		debug_msg("Injecting pending event %d for instance %s",
2192 		    inst->pending_rst_event, inst->fmri);
2193 		re = inst->pending_rst_event;
2194 		inst->pending_rst_event = RESTARTER_EVENT_TYPE_INVALID;
2195 		handle_restarter_event(inst, re, B_TRUE);
2196 	}
2197 }
2198 
2199 /*
2200  * Do the state machine processing associated with the termination
2201  * of the specified instance's non-start method with the specified status.
2202  * Once the processing of the termination is done, the function also picks up
2203  * any processing that was blocked on the method running.
2204  */
2205 void
2206 process_non_start_term(instance_t *inst, int status)
2207 {
2208 	boolean_t ran_online_method = B_FALSE;
2209 
2210 	debug_msg("Entering process_non_start_term: inst: %s, method: %s",
2211 	    inst->fmri, methods[states[inst->cur_istate].method_running].name);
2212 
2213 	if (status == IMRET_FAILURE) {
2214 		error_msg(gettext("The %s method of instance %s failed, "
2215 		    "transitioning to maintenance"),
2216 		    methods[states[inst->cur_istate].method_running].name,
2217 		    inst->fmri);
2218 
2219 		if ((inst->cur_istate == IIS_IN_ONLINE_METHOD) ||
2220 		    (inst->cur_istate == IIS_IN_REFRESH_METHOD))
2221 			destroy_bound_fds(inst);
2222 
2223 		update_state(inst, IIS_MAINTENANCE, RERR_FAULT);
2224 
2225 		inst->maintenance_req = B_FALSE;
2226 		inst->conn_rate_exceeded = B_FALSE;
2227 
2228 		if (inst->new_config != NULL) {
2229 			destroy_instance_cfg(inst->new_config);
2230 			inst->new_config = NULL;
2231 		}
2232 
2233 		if (!inetd_stopping)
2234 			process_pending_rst_event(inst);
2235 
2236 		return;
2237 	}
2238 
2239 	/* non-failure method return */
2240 
2241 	if (status != IMRET_SUCCESS) {
2242 		/*
2243 		 * An instance method never returned a supported return code.
2244 		 * We'll assume this means the method succeeded for now whilst
2245 		 * non-GL-cognizant methods are used - eg. pkill.
2246 		 */
2247 		debug_msg("The %s method of instance %s returned "
2248 		    "non-compliant exit code: %d, assuming success",
2249 		    methods[states[inst->cur_istate].method_running].name,
2250 		    inst->fmri, status);
2251 	}
2252 
2253 	/*
2254 	 * Update the state from the in-transition state.
2255 	 */
2256 	switch (inst->cur_istate) {
2257 	case IIS_IN_ONLINE_METHOD:
2258 		ran_online_method = B_TRUE;
2259 		/* FALLTHROUGH */
2260 	case IIS_IN_REFRESH_METHOD:
2261 		/*
2262 		 * If we've exhausted the bind retries, flag that by setting
2263 		 * the instance's state to degraded.
2264 		 */
2265 		if (inst->bind_retries_exceeded) {
2266 			update_state(inst, IIS_DEGRADED, RERR_NONE);
2267 			break;
2268 		}
2269 		/* FALLTHROUGH */
2270 	default:
2271 		update_state(inst,
2272 		    methods[states[inst->cur_istate].method_running].dst_state,
2273 		    RERR_NONE);
2274 	}
2275 
2276 	if (inst->cur_istate == IIS_OFFLINE) {
2277 		if (inst->new_config != NULL) {
2278 			/*
2279 			 * This instance was found during refresh to need
2280 			 * taking offline because its newly read configuration
2281 			 * was sufficiently different. Now we're offline,
2282 			 * activate this new configuration.
2283 			 */
2284 			destroy_instance_cfg(inst->config);
2285 			inst->config = inst->new_config;
2286 			inst->new_config = NULL;
2287 		}
2288 
2289 		/* continue/complete any transitions that are in progress */
2290 		process_offline_inst(inst);
2291 
2292 	} else if (ran_online_method) {
2293 		/*
2294 		 * We've just successfully executed the online method. We have
2295 		 * a set of bound network fds that were created before running
2296 		 * this method, so now we're online start listening for
2297 		 * connections on them.
2298 		 */
2299 		if (poll_bound_fds(inst, B_TRUE) != 0)
2300 			handle_bind_failure(inst);
2301 	}
2302 
2303 	/*
2304 	 * If we're now out of transition (process_offline_inst() could have
2305 	 * fired off another method), carry out any jobs that were blocked by
2306 	 * us being in transition.
2307 	 */
2308 	if (!INST_IN_TRANSITION(inst)) {
2309 		if (inetd_stopping) {
2310 			if (!instance_stopped(inst)) {
2311 				/*
2312 				 * inetd is stopping, and this instance hasn't
2313 				 * been stopped. Inject a stop event.
2314 				 */
2315 				handle_restarter_event(inst,
2316 				    RESTARTER_EVENT_TYPE_STOP, B_FALSE);
2317 			}
2318 		} else {
2319 			process_pending_rst_event(inst);
2320 		}
2321 	}
2322 }
2323 
2324 /*
2325  * Check if configuration file specified is readable. If not return B_FALSE,
2326  * else return B_TRUE.
2327  */
2328 static boolean_t
2329 can_read_file(const char *path)
2330 {
2331 	int	ret;
2332 	int	serrno;
2333 
2334 	debug_msg("Entering can_read_file");
2335 	do {
2336 		ret = access(path, R_OK);
2337 	} while ((ret < 0) && (errno == EINTR));
2338 	if (ret < 0) {
2339 		if (errno != ENOENT) {
2340 			serrno = errno;
2341 			error_msg(gettext("Failed to access configuration "
2342 			    "file %s for performing modification checks: %s"),
2343 			    path, strerror(errno));
2344 			errno = serrno;
2345 		}
2346 		return (B_FALSE);
2347 	}
2348 	return (B_TRUE);
2349 }
2350 
2351 /*
2352  * Check whether the configuration file has changed contents since inetd
2353  * was last started/refreshed, and if so, log a message indicating that
2354  * inetconv needs to be run.
2355  */
2356 static void
2357 check_conf_file(void)
2358 {
2359 	char		*new_hash;
2360 	char		*old_hash = NULL;
2361 	scf_error_t	ret;
2362 	const char	*file;
2363 
2364 	debug_msg("Entering check_conf_file");
2365 
2366 	if (conf_file == NULL) {
2367 		/*
2368 		 * No explicit config file specified, so see if one of the
2369 		 * default two are readable, checking the primary one first
2370 		 * followed by the secondary.
2371 		 */
2372 		if (can_read_file(PRIMARY_DEFAULT_CONF_FILE)) {
2373 			file = PRIMARY_DEFAULT_CONF_FILE;
2374 		} else if ((errno == ENOENT) &&
2375 		    can_read_file(SECONDARY_DEFAULT_CONF_FILE)) {
2376 			file = SECONDARY_DEFAULT_CONF_FILE;
2377 		} else {
2378 			return;
2379 		}
2380 	} else {
2381 		file = conf_file;
2382 		if (!can_read_file(file))
2383 			return;
2384 	}
2385 
2386 	if (calculate_hash(file, &new_hash) == 0) {
2387 		ret = retrieve_inetd_hash(&old_hash);
2388 		if (((ret == SCF_ERROR_NONE) &&
2389 		    (strcmp(old_hash, new_hash) != 0))) {
2390 			/* modified config file */
2391 			warn_msg(gettext(
2392 			    "Configuration file %s has been modified since "
2393 			    "inetconv was last run. \"inetconv -i %s\" must be "
2394 			    "run to apply any changes to the SMF"), file, file);
2395 		} else if ((ret != SCF_ERROR_NOT_FOUND) &&
2396 		    (ret != SCF_ERROR_NONE)) {
2397 			/* No message if hash not yet computed */
2398 			error_msg(gettext("Failed to check whether "
2399 			    "configuration file %s has been modified: %s"),
2400 			    file, scf_strerror(ret));
2401 		}
2402 		free(old_hash);
2403 		free(new_hash);
2404 	} else {
2405 		error_msg(gettext("Failed to check whether configuration file "
2406 		    "%s has been modified: %s"), file, strerror(errno));
2407 	}
2408 }
2409 
2410 /*
2411  * Refresh all inetd's managed instances and check the configuration file
2412  * for any updates since inetconv was last run, logging a message if there
2413  * are. We call the SMF refresh function to refresh each instance so that
2414  * the refresh request goes through the framework, and thus results in the
2415  * running snapshot of each instance being updated from the configuration
2416  * snapshot.
2417  */
2418 static void
2419 inetd_refresh(void)
2420 {
2421 	instance_t	*inst;
2422 
2423 	debug_msg("Entering inetd_refresh");
2424 
2425 	/* call libscf to send refresh requests for all managed instances */
2426 	for (inst = uu_list_first(instance_list); inst != NULL;
2427 	    inst = uu_list_next(instance_list, inst)) {
2428 		if (smf_refresh_instance(inst->fmri) < 0) {
2429 			error_msg(gettext("Failed to refresh instance %s: %s"),
2430 			    inst->fmri, scf_strerror(scf_error()));
2431 		}
2432 	}
2433 
2434 	/*
2435 	 * Log a message if the configuration file has changed since inetconv
2436 	 * was last run.
2437 	 */
2438 	check_conf_file();
2439 }
2440 
2441 /*
2442  * Initiate inetd's shutdown.
2443  */
2444 static void
2445 inetd_stop(void)
2446 {
2447 	instance_t *inst;
2448 
2449 	debug_msg("Entering inetd_stop");
2450 
2451 	/* Block handling signals for stop and refresh */
2452 	(void) sighold(SIGHUP);
2453 	(void) sighold(SIGTERM);
2454 
2455 	/* Indicate inetd is coming down */
2456 	inetd_stopping = B_TRUE;
2457 
2458 	/* Stop polling on restarter events. */
2459 	clear_pollfd(rst_event_pipe[PE_CONSUMER]);
2460 
2461 	/* Stop polling for any more stop/refresh requests. */
2462 	clear_pollfd(uds_fd);
2463 
2464 	/*
2465 	 * Send a stop event to all currently unstopped instances that
2466 	 * aren't in transition. For those that are in transition, the
2467 	 * event will get sent when the transition completes.
2468 	 */
2469 	for (inst = uu_list_first(instance_list); inst != NULL;
2470 	    inst = uu_list_next(instance_list, inst)) {
2471 		if (!instance_stopped(inst) && !INST_IN_TRANSITION(inst))
2472 			handle_restarter_event(inst,
2473 			    RESTARTER_EVENT_TYPE_STOP, B_FALSE);
2474 	}
2475 }
2476 
2477 /*
2478  * Sets up the intra-inetd-process Unix Domain Socket.
2479  * Returns -1 on error, else 0.
2480  */
2481 static int
2482 uds_init(void)
2483 {
2484 	struct sockaddr_un addr;
2485 
2486 	debug_msg("Entering uds_init");
2487 
2488 	if ((uds_fd = socket(AF_UNIX, SOCK_STREAM, 0)) < 0) {
2489 		error_msg("socket: %s", strerror(errno));
2490 		return (-1);
2491 	}
2492 
2493 	disable_blocking(uds_fd);
2494 
2495 	(void) unlink(INETD_UDS_PATH);  /* clean-up any stale files */
2496 
2497 	(void) memset(&addr, 0, sizeof (addr));
2498 	addr.sun_family = AF_UNIX;
2499 	/* CONSTCOND */
2500 	assert(sizeof (INETD_UDS_PATH) <= sizeof (addr.sun_path));
2501 	(void) strlcpy(addr.sun_path, INETD_UDS_PATH, sizeof (addr.sun_path));
2502 
2503 	if (bind(uds_fd, (struct sockaddr *)(&addr), sizeof (addr)) < 0) {
2504 		error_msg(gettext("Failed to bind socket to %s: %s"),
2505 		    INETD_UDS_PATH, strerror(errno));
2506 		(void) close(uds_fd);
2507 		return (-1);
2508 	}
2509 
2510 	(void) listen(uds_fd, UDS_BACKLOG);
2511 
2512 	if ((set_pollfd(uds_fd, POLLIN)) == -1) {
2513 		(void) close(uds_fd);
2514 		(void) unlink(INETD_UDS_PATH);
2515 		return (-1);
2516 	}
2517 
2518 	return (0);
2519 }
2520 
2521 static void
2522 uds_fini(void)
2523 {
2524 	if (uds_fd != -1)
2525 		(void) close(uds_fd);
2526 	(void) unlink(INETD_UDS_PATH);
2527 }
2528 
2529 /*
2530  * Handle an incoming request on the Unix Domain Socket. Returns -1 if there
2531  * was an error handling the event, else 0.
2532  */
2533 static int
2534 process_uds_event(void)
2535 {
2536 	uds_request_t		req;
2537 	int			fd;
2538 	struct sockaddr_un	addr;
2539 	socklen_t		len = sizeof (addr);
2540 	int			ret;
2541 	uint_t			retries = 0;
2542 	ucred_t			*ucred = NULL;
2543 	uid_t			euid;
2544 
2545 	debug_msg("Entering process_uds_event");
2546 
2547 	do {
2548 		fd = accept(uds_fd, (struct sockaddr *)&addr, &len);
2549 	} while ((fd < 0) && (errno == EINTR));
2550 	if (fd < 0) {
2551 		if (errno != EWOULDBLOCK)
2552 			error_msg("accept failed: %s", strerror(errno));
2553 		return (-1);
2554 	}
2555 
2556 	if (getpeerucred(fd, &ucred) == -1) {
2557 		error_msg("getpeerucred failed: %s", strerror(errno));
2558 		(void) close(fd);
2559 		return (-1);
2560 	}
2561 
2562 	/* Check peer credentials before acting on the request */
2563 	euid = ucred_geteuid(ucred);
2564 	ucred_free(ucred);
2565 	if (euid != 0 && getuid() != euid) {
2566 		debug_msg("peer euid %u != uid %u",
2567 		    (uint_t)euid, (uint_t)getuid());
2568 		(void) close(fd);
2569 		return (-1);
2570 	}
2571 
2572 	for (retries = 0; retries < UDS_RECV_RETRIES; retries++) {
2573 		if (((ret = safe_read(fd, &req, sizeof (req))) != 1) ||
2574 		    (errno != EAGAIN))
2575 			break;
2576 
2577 		(void) poll(NULL, 0, 100);	/* 100ms pause */
2578 	}
2579 
2580 	if (ret != 0) {
2581 		error_msg(gettext("Failed read: %s"), strerror(errno));
2582 		(void) close(fd);
2583 		return (-1);
2584 	}
2585 
2586 	switch (req) {
2587 	case UR_REFRESH_INETD:
2588 		/* flag the request for event_loop() to process */
2589 		refresh_inetd_requested = B_TRUE;
2590 		(void) close(fd);
2591 		break;
2592 	case UR_STOP_INETD:
2593 		inetd_stop();
2594 		break;
2595 	default:
2596 		error_msg("unexpected UDS request");
2597 		(void) close(fd);
2598 		return (-1);
2599 	}
2600 
2601 	return (0);
2602 }
2603 
2604 /*
2605  * Perform checks for common exec string errors. We limit the checks to
2606  * whether the file exists, is a regular file, and has at least one execute
2607  * bit set. We leave the core security checks to exec() so as not to duplicate
2608  * and thus incur the associated drawbacks, but hope to catch the common
2609  * errors here.
2610  */
2611 static boolean_t
2612 passes_basic_exec_checks(const char *instance, const char *method,
2613     const char *path)
2614 {
2615 	struct stat	sbuf;
2616 
2617 	debug_msg("Entering passes_basic_exec_checks");
2618 
2619 	/* check the file exists */
2620 	while (stat(path, &sbuf) == -1) {
2621 		if (errno != EINTR) {
2622 			error_msg(gettext(
2623 			    "Can't stat the %s method of instance %s: %s"),
2624 			    method, instance, strerror(errno));
2625 			return (B_FALSE);
2626 		}
2627 	}
2628 
2629 	/*
2630 	 * Check if the file is a regular file and has at least one execute
2631 	 * bit set.
2632 	 */
2633 	if ((sbuf.st_mode & S_IFMT) != S_IFREG) {
2634 		error_msg(gettext(
2635 		    "The %s method of instance %s isn't a regular file"),
2636 		    method, instance);
2637 		return (B_FALSE);
2638 	} else if ((sbuf.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH)) == 0) {
2639 		error_msg(gettext("The %s method instance %s doesn't have "
2640 		    "any execute permissions set"), method, instance);
2641 		return (B_FALSE);
2642 	}
2643 
2644 	return (B_TRUE);
2645 }
2646 
2647 static void
2648 exec_method(instance_t *instance, instance_method_t method, method_info_t *mi,
2649     struct method_context *mthd_ctxt, const proto_info_t *pi)
2650 {
2651 	char		**args;
2652 	char 		**env;
2653 	const char	*errf;
2654 	int		serrno;
2655 	basic_cfg_t	*cfg = instance->config->basic;
2656 
2657 	if (method == IM_START) {
2658 		/*
2659 		 * If wrappers checks fail, pretend the method was exec'd and
2660 		 * failed.
2661 		 */
2662 		if (!tcp_wrappers_ok(instance))
2663 			exit(IMRET_FAILURE);
2664 	}
2665 
2666 	/*
2667 	 * Revert the disposition of handled signals and ignored signals to
2668 	 * their defaults, unblocking any blocked ones as a side effect.
2669 	 */
2670 	(void) sigset(SIGHUP, SIG_DFL);
2671 	(void) sigset(SIGTERM, SIG_DFL);
2672 	(void) sigset(SIGINT, SIG_DFL);
2673 
2674 	/*
2675 	 * Setup exec arguments. Do this before the fd setup below, so our
2676 	 * logging related file fd doesn't get taken over before we call
2677 	 * expand_address().
2678 	 */
2679 	if ((method == IM_START) &&
2680 	    (strcmp(mi->exec_args_we.we_wordv[0], "%A") == 0)) {
2681 		args = expand_address(instance, pi);
2682 	} else {
2683 		args = mi->exec_args_we.we_wordv;
2684 	}
2685 
2686 	/* Generate audit trail for start operations */
2687 	if (method == IM_START) {
2688 		adt_event_data_t *ae;
2689 		struct sockaddr_storage ss;
2690 		priv_set_t *privset;
2691 		socklen_t sslen = sizeof (ss);
2692 
2693 		if ((ae = adt_alloc_event(audit_handle, ADT_inetd_connect))
2694 		    == NULL) {
2695 			error_msg(gettext("Unable to allocate audit event for "
2696 			    "the %s method of instance %s"),
2697 			    methods[method].name, instance->fmri);
2698 			exit(IMRET_FAILURE);
2699 		}
2700 
2701 		/*
2702 		 * The inetd_connect audit record consists of:
2703 		 *	Service name
2704 		 *	Execution path
2705 		 *	Remote address and port
2706 		 *	Local port
2707 		 *	Process privileges
2708 		 */
2709 		ae->adt_inetd_connect.service_name = cfg->svc_name;
2710 		ae->adt_inetd_connect.cmd = mi->exec_path;
2711 
2712 		if (instance->remote_addr.ss_family == AF_INET) {
2713 			struct in_addr *in = SS_SINADDR(instance->remote_addr);
2714 			ae->adt_inetd_connect.ip_adr[0] = in->s_addr;
2715 			ae->adt_inetd_connect.ip_type = ADT_IPv4;
2716 		} else {
2717 			uint32_t *addr6;
2718 			int i;
2719 
2720 			ae->adt_inetd_connect.ip_type = ADT_IPv6;
2721 			addr6 = (uint32_t *)SS_SINADDR(instance->remote_addr);
2722 			for (i = 0; i < 4; ++i)
2723 				ae->adt_inetd_connect.ip_adr[i] = addr6[i];
2724 		}
2725 
2726 		ae->adt_inetd_connect.ip_remote_port =
2727 		    ntohs(SS_PORT(instance->remote_addr));
2728 
2729 		if (getsockname(instance->conn_fd, (struct sockaddr *)&ss,
2730 		    &sslen) == 0)
2731 			ae->adt_inetd_connect.ip_local_port =
2732 			    ntohs(SS_PORT(ss));
2733 
2734 		privset = mthd_ctxt->priv_set;
2735 		if (privset == NULL) {
2736 			privset = priv_allocset();
2737 			if (privset != NULL &&
2738 			    getppriv(PRIV_EFFECTIVE, privset) != 0) {
2739 				priv_freeset(privset);
2740 				privset = NULL;
2741 			}
2742 		}
2743 
2744 		ae->adt_inetd_connect.privileges = privset;
2745 
2746 		(void) adt_put_event(ae, ADT_SUCCESS, ADT_SUCCESS);
2747 		adt_free_event(ae);
2748 
2749 		if (privset != NULL && mthd_ctxt->priv_set == NULL)
2750 			priv_freeset(privset);
2751 	}
2752 
2753 	/*
2754 	 * Set method context before the fd setup below so we can output an
2755 	 * error message if it fails.
2756 	 */
2757 	if ((errno = restarter_set_method_context(mthd_ctxt, &errf)) != 0) {
2758 		const char *msg;
2759 
2760 		if (errno == -1) {
2761 			if (strcmp(errf, "core_set_process_path") == 0) {
2762 				msg = gettext("Failed to set the corefile path "
2763 				    "for the %s method of instance %s");
2764 			} else if (strcmp(errf, "setproject") == 0) {
2765 				msg = gettext("Failed to assign a resource "
2766 				    "control for the %s method of instance %s");
2767 			} else if (strcmp(errf, "pool_set_binding") == 0) {
2768 				msg = gettext("Failed to bind the %s method of "
2769 				    "instance %s to a pool due to a system "
2770 				    "error");
2771 			} else {
2772 				assert(0);
2773 				abort();
2774 			}
2775 
2776 			error_msg(msg, methods[method].name, instance->fmri);
2777 
2778 			exit(IMRET_FAILURE);
2779 		}
2780 
2781 		if (errf != NULL && strcmp(errf, "pool_set_binding") == 0) {
2782 			switch (errno) {
2783 			case ENOENT:
2784 				msg = gettext("Failed to find resource pool "
2785 				    "for the %s method of instance %s");
2786 				break;
2787 
2788 			case EBADF:
2789 				msg = gettext("Failed to bind the %s method of "
2790 				    "instance %s to a pool due to invalid "
2791 				    "configuration");
2792 				break;
2793 
2794 			case EINVAL:
2795 				msg = gettext("Failed to bind the %s method of "
2796 				    "instance %s to a pool due to invalid "
2797 				    "pool name");
2798 				break;
2799 
2800 			default:
2801 				assert(0);
2802 				abort();
2803 			}
2804 
2805 			exit(IMRET_FAILURE);
2806 		}
2807 
2808 		if (errf != NULL) {
2809 			error_msg(gettext("Failed to set credentials for the "
2810 			    "%s method of instance %s (%s: %s)"),
2811 			    methods[method].name, instance->fmri, errf,
2812 			    strerror(errno));
2813 			exit(IMRET_FAILURE);
2814 		}
2815 
2816 		switch (errno) {
2817 		case ENOMEM:
2818 			msg = gettext("Failed to set credentials for the %s "
2819 			    "method of instance %s (out of memory)");
2820 			break;
2821 
2822 		case ENOENT:
2823 			msg = gettext("Failed to set credentials for the %s "
2824 			    "method of instance %s (no passwd or shadow "
2825 			    "entry for user)");
2826 			break;
2827 
2828 		default:
2829 			assert(0);
2830 			abort();
2831 		}
2832 
2833 		error_msg(msg, methods[method].name, instance->fmri);
2834 		exit(IMRET_FAILURE);
2835 	}
2836 
2837 	/* let exec() free mthd_ctxt */
2838 
2839 	/* setup standard fds */
2840 	if (method == IM_START) {
2841 		(void) dup2(instance->conn_fd, STDIN_FILENO);
2842 	} else {
2843 		(void) close(STDIN_FILENO);
2844 		(void) open("/dev/null", O_RDONLY);
2845 	}
2846 	(void) dup2(STDIN_FILENO, STDOUT_FILENO);
2847 	(void) dup2(STDIN_FILENO, STDERR_FILENO);
2848 
2849 	closefrom(STDERR_FILENO + 1);
2850 
2851 	method_preexec();
2852 
2853 	env = set_smf_env(mthd_ctxt, instance, methods[method].name);
2854 
2855 	if (env != NULL) {
2856 		do {
2857 			(void) execve(mi->exec_path, args, env);
2858 		} while (errno == EINTR);
2859 	}
2860 
2861 	serrno = errno;
2862 	/* start up logging again to report the error */
2863 	msg_init();
2864 	errno = serrno;
2865 
2866 	error_msg(
2867 	    gettext("Failed to exec %s method of instance %s: %s"),
2868 	    methods[method].name, instance->fmri, strerror(errno));
2869 
2870 	if ((method == IM_START) && (instance->config->basic->iswait)) {
2871 		/*
2872 		 * We couldn't exec the start method for a wait type service.
2873 		 * Eat up data from the endpoint, so that hopefully the
2874 		 * service's fd won't wake poll up on the next time round
2875 		 * event_loop(). This behavior is carried over from the old
2876 		 * inetd, and it seems somewhat arbitrary that it isn't
2877 		 * also done in the case of fork failures; but I guess
2878 		 * it assumes an exec failure is less likely to be the result
2879 		 * of a resource shortage, and is thus not worth retrying.
2880 		 */
2881 		consume_wait_data(instance, 0);
2882 	}
2883 
2884 	exit(IMRET_FAILURE);
2885 }
2886 
2887 static restarter_error_t
2888 get_method_error_success(instance_method_t method)
2889 {
2890 	switch (method) {
2891 	case IM_OFFLINE:
2892 		return (RERR_RESTART);
2893 	case IM_ONLINE:
2894 		return (RERR_RESTART);
2895 	case IM_DISABLE:
2896 		return (RERR_RESTART);
2897 	case IM_REFRESH:
2898 		return (RERR_REFRESH);
2899 	case IM_START:
2900 		return (RERR_RESTART);
2901 	}
2902 	(void) fprintf(stderr, gettext("Internal fatal error in inetd.\n"));
2903 
2904 	abort();
2905 	/* NOTREACHED */
2906 }
2907 
2908 static int
2909 smf_kill_process(instance_t *instance, int sig)
2910 {
2911 	rep_val_t	*rv;
2912 	int		ret = IMRET_SUCCESS;
2913 
2914 	/* Carry out process assassination */
2915 	for (rv = uu_list_first(instance->start_pids);
2916 	    rv != NULL;
2917 	    rv = uu_list_next(instance->start_pids, rv)) {
2918 		if ((kill((pid_t)rv->val, sig) != 0) &&
2919 		    (errno != ESRCH)) {
2920 			ret = IMRET_FAILURE;
2921 			error_msg(gettext("Unable to kill "
2922 			    "start process (%ld) of instance %s: %s"),
2923 			    rv->val, instance->fmri, strerror(errno));
2924 		}
2925 	}
2926 	return (ret);
2927 }
2928 
2929 /*
2930  * Runs the specified method of the specified service instance.
2931  * If the method was never specified, we handle it the same as if the
2932  * method was called and returned success, carrying on any transition the
2933  * instance may be in the midst of.
2934  * If the method isn't executable in its specified profile or an error occurs
2935  * forking a process to run the method in the function returns -1.
2936  * If a method binary is successfully executed, the function switches the
2937  * instance's cur state to the method's associated 'run' state and the next
2938  * state to the methods associated next state.
2939  * Returns -1 if there's an error before forking, else 0.
2940  */
2941 int
2942 run_method(instance_t *instance, instance_method_t method,
2943     const proto_info_t *start_info)
2944 {
2945 	pid_t			child_pid;
2946 	method_info_t		*mi;
2947 	struct method_context	*mthd_ctxt = NULL;
2948 	const char		*errstr;
2949 	int			sig = 0;
2950 	int			ret;
2951 	instance_cfg_t		*cfg = instance->config;
2952 	ctid_t			cid;
2953 	boolean_t		trans_failure = B_TRUE;
2954 	int			serrno;
2955 
2956 	debug_msg("Entering run_method, instance: %s, method: %s",
2957 	    instance->fmri, methods[method].name);
2958 
2959 	/*
2960 	 * Don't bother updating the instance's state for the start method
2961 	 * as there isn't a separate start method state.
2962 	 */
2963 	if (method != IM_START)
2964 		update_instance_states(instance, get_method_state(method),
2965 		    methods[method].dst_state,
2966 		    get_method_error_success(method));
2967 
2968 	if ((mi = cfg->methods[method]) == NULL) {
2969 		/*
2970 		 * If the absent method is IM_OFFLINE, default action needs
2971 		 * to be taken to avoid lingering processes which can prevent
2972 		 * the upcoming rebinding from happening.
2973 		 */
2974 		if ((method == IM_OFFLINE) && instance->config->basic->iswait) {
2975 			warn_msg(gettext("inetd_offline method for instance %s "
2976 			    "is unspecified.  Taking default action: kill."),
2977 			    instance->fmri);
2978 			(void) str2sig("TERM", &sig);
2979 			ret = smf_kill_process(instance, sig);
2980 			process_non_start_term(instance, ret);
2981 			return (0);
2982 		} else {
2983 			process_non_start_term(instance, IMRET_SUCCESS);
2984 			return (0);
2985 		}
2986 	}
2987 
2988 	/* Handle special method tokens, not allowed on start */
2989 	if (method != IM_START) {
2990 		if (restarter_is_null_method(mi->exec_path)) {
2991 			/* :true means nothing should be done */
2992 			process_non_start_term(instance, IMRET_SUCCESS);
2993 			return (0);
2994 		}
2995 
2996 		if ((sig = restarter_is_kill_method(mi->exec_path)) >= 0) {
2997 			/* Carry out contract assassination */
2998 			ret = iterate_repository_contracts(instance, sig);
2999 			/* ENOENT means we didn't find any contracts */
3000 			if (ret != 0 && ret != ENOENT) {
3001 				error_msg(gettext("Failed to send signal %d "
3002 				    "to contracts of instance %s: %s"), sig,
3003 				    instance->fmri, strerror(ret));
3004 				goto prefork_failure;
3005 			} else {
3006 				process_non_start_term(instance, IMRET_SUCCESS);
3007 				return (0);
3008 			}
3009 		}
3010 
3011 		if ((sig = restarter_is_kill_proc_method(mi->exec_path)) >= 0) {
3012 			ret = smf_kill_process(instance, sig);
3013 			process_non_start_term(instance, ret);
3014 			return (0);
3015 		}
3016 	}
3017 
3018 	/*
3019 	 * Get the associated method context before the fork so we can
3020 	 * modify the instances state if things go wrong.
3021 	 */
3022 	if ((mthd_ctxt = read_method_context(instance->fmri,
3023 	    methods[method].name, mi->exec_path, &errstr)) == NULL) {
3024 		error_msg(gettext("Failed to retrieve method context for the "
3025 		    "%s method of instance %s: %s"), methods[method].name,
3026 		    instance->fmri, errstr);
3027 		goto prefork_failure;
3028 	}
3029 
3030 	/*
3031 	 * Perform some basic checks before we fork to limit the possibility
3032 	 * of exec failures, so we can modify the instance state if necessary.
3033 	 */
3034 	if (!passes_basic_exec_checks(instance->fmri, methods[method].name,
3035 	    mi->exec_path)) {
3036 		trans_failure = B_FALSE;
3037 		goto prefork_failure;
3038 	}
3039 
3040 	if (contract_prefork() == -1)
3041 		goto prefork_failure;
3042 	child_pid = fork();
3043 	serrno = errno;
3044 	contract_postfork();
3045 
3046 	switch (child_pid) {
3047 	case -1:
3048 		error_msg(gettext(
3049 		    "Unable to fork %s method of instance %s: %s"),
3050 		    methods[method].name, instance->fmri, strerror(serrno));
3051 		if ((serrno != EAGAIN) && (serrno != ENOMEM))
3052 			trans_failure = B_FALSE;
3053 		goto prefork_failure;
3054 	case 0:				/* child */
3055 		exec_method(instance, method, mi, mthd_ctxt, start_info);
3056 		/* NOTREACHED */
3057 	default:			/* parent */
3058 		restarter_free_method_context(mthd_ctxt);
3059 		mthd_ctxt = NULL;
3060 
3061 		if (get_latest_contract(&cid) < 0)
3062 			cid = -1;
3063 
3064 		/*
3065 		 * Register this method so its termination is noticed and
3066 		 * the state transition this method participates in is
3067 		 * continued.
3068 		 */
3069 		if (register_method(instance, child_pid, cid, method) != 0) {
3070 			/*
3071 			 * Since we will never find out about the termination
3072 			 * of this method, if it's a non-start method treat
3073 			 * is as a failure so we don't block restarter event
3074 			 * processing on it whilst it languishes in a method
3075 			 * running state.
3076 			 */
3077 			error_msg(gettext("Failed to monitor status of "
3078 			    "%s method of instance %s"), methods[method].name,
3079 			    instance->fmri);
3080 			if (method != IM_START)
3081 				process_non_start_term(instance, IMRET_FAILURE);
3082 		}
3083 
3084 		add_method_ids(instance, child_pid, cid, method);
3085 
3086 		/* do tcp tracing for those nowait instances that request it */
3087 		if ((method == IM_START) && cfg->basic->do_tcp_trace &&
3088 		    !cfg->basic->iswait) {
3089 			char buf[INET6_ADDRSTRLEN];
3090 
3091 			syslog(LOG_NOTICE, "%s[%d] from %s %d",
3092 			    cfg->basic->svc_name, child_pid,
3093 			    inet_ntop_native(instance->remote_addr.ss_family,
3094 			    SS_SINADDR(instance->remote_addr), buf,
3095 			    sizeof (buf)),
3096 			    ntohs(SS_PORT(instance->remote_addr)));
3097 		}
3098 	}
3099 
3100 	return (0);
3101 
3102 prefork_failure:
3103 	if (mthd_ctxt != NULL) {
3104 		restarter_free_method_context(mthd_ctxt);
3105 		mthd_ctxt = NULL;
3106 	}
3107 
3108 	if (method == IM_START) {
3109 		/*
3110 		 * Only place a start method in maintenance if we're sure
3111 		 * that the failure was non-transient.
3112 		 */
3113 		if (!trans_failure) {
3114 			destroy_bound_fds(instance);
3115 			update_state(instance, IIS_MAINTENANCE, RERR_FAULT);
3116 		}
3117 	} else {
3118 		/* treat the failure as if the method ran and failed */
3119 		process_non_start_term(instance, IMRET_FAILURE);
3120 	}
3121 
3122 	return (-1);
3123 }
3124 
3125 static int
3126 accept_connection(instance_t *instance, proto_info_t *pi)
3127 {
3128 	int		fd;
3129 	socklen_t	size;
3130 
3131 	debug_msg("Entering accept_connection");
3132 
3133 	if (instance->config->basic->istlx) {
3134 		fd = tlx_accept(instance->fmri, (tlx_info_t *)pi,
3135 		    &(instance->remote_addr));
3136 	} else {
3137 		size = sizeof (instance->remote_addr);
3138 		fd = accept(pi->listen_fd,
3139 		    (struct sockaddr *)&(instance->remote_addr), &size);
3140 		if (fd < 0)
3141 			error_msg("accept: %s", strerror(errno));
3142 	}
3143 
3144 	return (fd);
3145 }
3146 
3147 /*
3148  * Handle an incoming connection request for a nowait service.
3149  * This involves accepting the incoming connection on a new fd. Connection
3150  * rate checks are then performed, transitioning the service to the
3151  * conrate offline state if these fail. Otherwise, the service's start method
3152  * is run (performing TCP wrappers checks if applicable as we do), and on
3153  * success concurrent copies checking is done, transitioning the service to the
3154  * copies offline state if this fails.
3155  */
3156 static void
3157 process_nowait_request(instance_t *instance, proto_info_t *pi)
3158 {
3159 	basic_cfg_t		*cfg = instance->config->basic;
3160 	int			ret;
3161 	adt_event_data_t	*ae;
3162 	char			buf[BUFSIZ];
3163 
3164 	debug_msg("Entering process_nowait_req");
3165 
3166 	/* accept nowait service connections on a new fd */
3167 	if ((instance->conn_fd = accept_connection(instance, pi)) == -1) {
3168 		/*
3169 		 * Failed accept. Return and allow the event loop to initiate
3170 		 * another attempt later if the request is still present.
3171 		 */
3172 		return;
3173 	}
3174 
3175 	/*
3176 	 * Limit connection rate of nowait services. If either conn_rate_max
3177 	 * or conn_rate_offline are <= 0, no connection rate limit checking
3178 	 * is done. If the configured rate is exceeded, the instance is taken
3179 	 * to the connrate_offline state and a timer scheduled to try and
3180 	 * bring the instance back online after the configured offline time.
3181 	 */
3182 	if ((cfg->conn_rate_max > 0) && (cfg->conn_rate_offline > 0)) {
3183 		if (instance->conn_rate_count++ == 0) {
3184 			instance->conn_rate_start = time(NULL);
3185 		} else if (instance->conn_rate_count >
3186 		    cfg->conn_rate_max) {
3187 			time_t now = time(NULL);
3188 
3189 			if ((now - instance->conn_rate_start) > 1) {
3190 				instance->conn_rate_start = now;
3191 				instance->conn_rate_count = 1;
3192 			} else {
3193 				/* Generate audit record */
3194 				if ((ae = adt_alloc_event(audit_handle,
3195 				    ADT_inetd_ratelimit)) == NULL) {
3196 					error_msg(gettext("Unable to allocate "
3197 					    "rate limit audit event"));
3198 				} else {
3199 					adt_inetd_ratelimit_t *rl =
3200 					    &ae->adt_inetd_ratelimit;
3201 					/*
3202 					 * The inetd_ratelimit audit
3203 					 * record consists of:
3204 					 * 	Service name
3205 					 *	Connection rate limit
3206 					 */
3207 					rl->service_name = cfg->svc_name;
3208 					(void) snprintf(buf, sizeof (buf),
3209 					    "limit=%lld", cfg->conn_rate_max);
3210 					rl->limit = buf;
3211 					(void) adt_put_event(ae, ADT_SUCCESS,
3212 					    ADT_SUCCESS);
3213 					adt_free_event(ae);
3214 				}
3215 
3216 				error_msg(gettext(
3217 				    "Instance %s has exceeded its configured "
3218 				    "connection rate, additional connections "
3219 				    "will not be accepted for %d seconds"),
3220 				    instance->fmri, cfg->conn_rate_offline);
3221 
3222 				close_net_fd(instance, instance->conn_fd);
3223 				instance->conn_fd = -1;
3224 
3225 				destroy_bound_fds(instance);
3226 
3227 				instance->conn_rate_count = 0;
3228 
3229 				instance->conn_rate_exceeded = B_TRUE;
3230 				(void) run_method(instance, IM_OFFLINE, NULL);
3231 
3232 				return;
3233 			}
3234 		}
3235 	}
3236 
3237 	ret = run_method(instance, IM_START, pi);
3238 
3239 	close_net_fd(instance, instance->conn_fd);
3240 	instance->conn_fd = -1;
3241 
3242 	if (ret == -1) /* the method wasn't forked  */
3243 		return;
3244 
3245 	instance->copies++;
3246 
3247 	/*
3248 	 * Limit concurrent connections of nowait services.
3249 	 */
3250 	if (copies_limit_exceeded(instance)) {
3251 		/* Generate audit record */
3252 		if ((ae = adt_alloc_event(audit_handle, ADT_inetd_copylimit))
3253 		    == NULL) {
3254 			error_msg(gettext("Unable to allocate copy limit "
3255 			    "audit event"));
3256 		} else {
3257 			/*
3258 			 * The inetd_copylimit audit record consists of:
3259 			 *	Service name
3260 			 * 	Copy limit
3261 			 */
3262 			ae->adt_inetd_copylimit.service_name = cfg->svc_name;
3263 			(void) snprintf(buf, sizeof (buf), "limit=%lld",
3264 			    cfg->max_copies);
3265 			ae->adt_inetd_copylimit.limit = buf;
3266 			(void) adt_put_event(ae, ADT_SUCCESS, ADT_SUCCESS);
3267 			adt_free_event(ae);
3268 		}
3269 
3270 		warn_msg(gettext("Instance %s has reached its maximum "
3271 		    "configured copies, no new connections will be accepted"),
3272 		    instance->fmri);
3273 		destroy_bound_fds(instance);
3274 		(void) run_method(instance, IM_OFFLINE, NULL);
3275 	}
3276 }
3277 
3278 /*
3279  * Handle an incoming request for a wait type service.
3280  * Failure rate checking is done first, taking the service to the maintenance
3281  * state if the checks fail. Following this, the service's start method is run,
3282  * and on success, we stop listening for new requests for this service.
3283  */
3284 static void
3285 process_wait_request(instance_t *instance, const proto_info_t *pi)
3286 {
3287 	basic_cfg_t		*cfg = instance->config->basic;
3288 	int			ret;
3289 	adt_event_data_t	*ae;
3290 	char			buf[BUFSIZ];
3291 
3292 	debug_msg("Entering process_wait_request");
3293 
3294 	instance->conn_fd = pi->listen_fd;
3295 
3296 	/*
3297 	 * Detect broken servers and transition them to maintenance. If a
3298 	 * wait type service exits without accepting the connection or
3299 	 * consuming (reading) the datagram, that service's descriptor will
3300 	 * select readable again, and inetd will fork another instance of
3301 	 * the server. If either wait_fail_cnt or wait_fail_interval are <= 0,
3302 	 * no failure rate detection is done.
3303 	 */
3304 	if ((cfg->wait_fail_cnt > 0) && (cfg->wait_fail_interval > 0)) {
3305 		if (instance->fail_rate_count++ == 0) {
3306 			instance->fail_rate_start = time(NULL);
3307 		} else if (instance->fail_rate_count > cfg->wait_fail_cnt) {
3308 			time_t now = time(NULL);
3309 
3310 			if ((now - instance->fail_rate_start) >
3311 			    cfg->wait_fail_interval) {
3312 				instance->fail_rate_start = now;
3313 				instance->fail_rate_count = 1;
3314 			} else {
3315 				/* Generate audit record */
3316 				if ((ae = adt_alloc_event(audit_handle,
3317 				    ADT_inetd_failrate)) == NULL) {
3318 					error_msg(gettext("Unable to allocate "
3319 					    "failure rate audit event"));
3320 				} else {
3321 					adt_inetd_failrate_t *fr =
3322 					    &ae->adt_inetd_failrate;
3323 					/*
3324 					 * The inetd_failrate audit record
3325 					 * consists of:
3326 					 * 	Service name
3327 					 * 	Failure rate
3328 					 *	Interval
3329 					 * Last two are expressed as k=v pairs
3330 					 * in the values field.
3331 					 */
3332 					fr->service_name = cfg->svc_name;
3333 					(void) snprintf(buf, sizeof (buf),
3334 					    "limit=%lld,interval=%d",
3335 					    cfg->wait_fail_cnt,
3336 					    cfg->wait_fail_interval);
3337 					fr->values = buf;
3338 					(void) adt_put_event(ae, ADT_SUCCESS,
3339 					    ADT_SUCCESS);
3340 					adt_free_event(ae);
3341 				}
3342 
3343 				error_msg(gettext(
3344 				    "Instance %s has exceeded its configured "
3345 				    "failure rate, transitioning to "
3346 				    "maintenance"), instance->fmri);
3347 				instance->fail_rate_count = 0;
3348 
3349 				destroy_bound_fds(instance);
3350 
3351 				instance->maintenance_req = B_TRUE;
3352 				(void) run_method(instance, IM_OFFLINE, NULL);
3353 				return;
3354 			}
3355 		}
3356 	}
3357 
3358 	ret = run_method(instance, IM_START, pi);
3359 
3360 	instance->conn_fd = -1;
3361 
3362 	if (ret == 0) {
3363 		/*
3364 		 * Stop listening for connections now we've fired off the
3365 		 * server for a wait type instance.
3366 		 */
3367 		(void) poll_bound_fds(instance, B_FALSE);
3368 	}
3369 }
3370 
3371 /*
3372  * Process any networks requests for each proto for each instance.
3373  */
3374 void
3375 process_network_events(void)
3376 {
3377 	instance_t	*instance;
3378 
3379 	debug_msg("Entering process_network_events");
3380 
3381 	for (instance = uu_list_first(instance_list); instance != NULL;
3382 	    instance = uu_list_next(instance_list, instance)) {
3383 		basic_cfg_t	*cfg;
3384 		proto_info_t	*pi;
3385 
3386 		/*
3387 		 * Ignore instances in states that definitely don't have any
3388 		 * listening fds.
3389 		 */
3390 		switch (instance->cur_istate) {
3391 		case IIS_ONLINE:
3392 		case IIS_DEGRADED:
3393 		case IIS_IN_REFRESH_METHOD:
3394 			break;
3395 		default:
3396 			continue;
3397 		}
3398 
3399 		cfg = instance->config->basic;
3400 
3401 		for (pi = uu_list_first(cfg->proto_list); pi != NULL;
3402 		    pi = uu_list_next(cfg->proto_list, pi)) {
3403 			if ((pi->listen_fd != -1) &&
3404 			    isset_pollfd(pi->listen_fd)) {
3405 				if (cfg->iswait) {
3406 					process_wait_request(instance, pi);
3407 				} else {
3408 					process_nowait_request(instance, pi);
3409 				}
3410 			}
3411 		}
3412 	}
3413 }
3414 
3415 /* ARGSUSED0 */
3416 static void
3417 sigterm_handler(int sig)
3418 {
3419 	debug_msg("Entering sigterm_handler");
3420 
3421 	got_sigterm = B_TRUE;
3422 }
3423 
3424 /* ARGSUSED0 */
3425 static void
3426 sighup_handler(int sig)
3427 {
3428 	debug_msg("Entering sighup_handler");
3429 
3430 	refresh_inetd_requested = B_TRUE;
3431 }
3432 
3433 /*
3434  * inetd's major work loop. This function sits in poll waiting for events
3435  * to occur, processing them when they do. The possible events are
3436  * master restarter requests, expired timer queue timers, stop/refresh signal
3437  * requests, contract events indicating process termination, stop/refresh
3438  * requests originating from one of the stop/refresh inetd processes and
3439  * network events.
3440  * The loop is exited when a stop request is received and processed, and
3441  * all the instances have reached a suitable 'stopping' state.
3442  */
3443 static void
3444 event_loop(void)
3445 {
3446 	instance_t		*instance;
3447 	int			timeout;
3448 
3449 	debug_msg("Entering event_loop");
3450 
3451 	for (;;) {
3452 		int	pret = -1;
3453 
3454 		timeout = iu_earliest_timer(timer_queue);
3455 
3456 		debug_msg("Doing signal check/poll");
3457 		if (!got_sigterm && !refresh_inetd_requested) {
3458 			pret = poll(poll_fds, num_pollfds, timeout);
3459 			if ((pret == -1) && (errno != EINTR)) {
3460 				error_msg(gettext("poll failure: %s"),
3461 				    strerror(errno));
3462 				continue;
3463 			}
3464 			debug_msg("Exiting poll, returned: %d", pret);
3465 		}
3466 
3467 		if (got_sigterm) {
3468 			msg_fini();
3469 			inetd_stop();
3470 			got_sigterm = B_FALSE;
3471 			goto check_if_stopped;
3472 		}
3473 
3474 		/*
3475 		 * Process any stop/refresh requests from the Unix Domain
3476 		 * Socket.
3477 		 */
3478 		if ((pret != -1) && isset_pollfd(uds_fd)) {
3479 			while (process_uds_event() == 0)
3480 				;
3481 		}
3482 
3483 		/*
3484 		 * Process refresh request. We do this check after the UDS
3485 		 * event check above, as it would be wasted processing if we
3486 		 * started refreshing inetd based on a SIGHUP, and then were
3487 		 * told to shut-down via a UDS event.
3488 		 */
3489 		if (refresh_inetd_requested) {
3490 			refresh_inetd_requested = B_FALSE;
3491 			if (!inetd_stopping)
3492 				inetd_refresh();
3493 		}
3494 
3495 		/*
3496 		 * We were interrupted by a signal. Don't waste any more
3497 		 * time processing a potentially inaccurate poll return.
3498 		 */
3499 		if (pret == -1)
3500 			continue;
3501 
3502 		/*
3503 		 * Process any instance restarter events.
3504 		 */
3505 		if (isset_pollfd(rst_event_pipe[PE_CONSUMER])) {
3506 			while (process_restarter_event() == 0)
3507 				;
3508 		}
3509 
3510 		/*
3511 		 * Process any expired timers (bind retry, con-rate offline,
3512 		 * method timeouts).
3513 		 */
3514 		(void) iu_expire_timers(timer_queue);
3515 
3516 		process_terminated_methods();
3517 
3518 		/*
3519 		 * If inetd is stopping, check whether all our managed
3520 		 * instances have been stopped and we can return.
3521 		 */
3522 		if (inetd_stopping) {
3523 check_if_stopped:
3524 			for (instance = uu_list_first(instance_list);
3525 			    instance != NULL;
3526 			    instance = uu_list_next(instance_list, instance)) {
3527 				if (!instance_stopped(instance)) {
3528 					debug_msg("%s not yet stopped",
3529 					    instance->fmri);
3530 					break;
3531 				}
3532 			}
3533 			/* if all instances are stopped, return */
3534 			if (instance == NULL)
3535 				return;
3536 		}
3537 
3538 		process_network_events();
3539 	}
3540 }
3541 
3542 static void
3543 fini(void)
3544 {
3545 	debug_msg("Entering fini");
3546 
3547 	method_fini();
3548 	uds_fini();
3549 	if (timer_queue != NULL)
3550 		iu_tq_destroy(timer_queue);
3551 
3552 
3553 	/*
3554 	 * We don't bother to undo the restarter interface at all.
3555 	 * Because of quirks in the interface, there is no way to
3556 	 * disconnect from the channel and cause any new events to be
3557 	 * queued.  However, any events which are received and not
3558 	 * acknowledged will be re-sent when inetd restarts as long as inetd
3559 	 * uses the same subscriber ID, which it does.
3560 	 *
3561 	 * By keeping the event pipe open but ignoring it, any events which
3562 	 * occur will cause restarter_event_proxy to hang without breaking
3563 	 * anything.
3564 	 */
3565 
3566 	if (instance_list != NULL) {
3567 		void		*cookie = NULL;
3568 		instance_t	*inst;
3569 
3570 		while ((inst = uu_list_teardown(instance_list, &cookie)) !=
3571 		    NULL)
3572 			destroy_instance(inst);
3573 		uu_list_destroy(instance_list);
3574 	}
3575 	if (instance_pool != NULL)
3576 		uu_list_pool_destroy(instance_pool);
3577 	tlx_fini();
3578 	config_fini();
3579 	repval_fini();
3580 	poll_fini();
3581 
3582 	/* Close audit session */
3583 	(void) adt_end_session(audit_handle);
3584 }
3585 
3586 static int
3587 init(void)
3588 {
3589 	int err;
3590 
3591 	debug_msg("Entering init");
3592 
3593 	if (repval_init() < 0)
3594 		goto failed;
3595 
3596 	if (config_init() < 0)
3597 		goto failed;
3598 
3599 	if (tlx_init() < 0)
3600 		goto failed;
3601 
3602 	/* Setup instance list. */
3603 	if ((instance_pool = uu_list_pool_create("instance_pool",
3604 	    sizeof (instance_t), offsetof(instance_t, link), NULL,
3605 	    UU_LIST_POOL_DEBUG)) == NULL) {
3606 		error_msg("%s: %s",
3607 		    gettext("Failed to create instance pool"),
3608 		    uu_strerror(uu_error()));
3609 		goto failed;
3610 	}
3611 	if ((instance_list = uu_list_create(instance_pool, NULL, 0)) == NULL) {
3612 		error_msg("%s: %s",
3613 		    gettext("Failed to create instance list"),
3614 		    uu_strerror(uu_error()));
3615 		goto failed;
3616 	}
3617 
3618 	/*
3619 	 * Create event pipe to communicate events with the main event
3620 	 * loop and add it to the event loop's fdset.
3621 	 */
3622 	if (pipe(rst_event_pipe) < 0) {
3623 		error_msg("pipe: %s", strerror(errno));
3624 		goto failed;
3625 	}
3626 	/*
3627 	 * We only leave the producer end to block on reads/writes as we
3628 	 * can't afford to block in the main thread, yet need to in
3629 	 * the restarter event thread, so it can sit and wait for an
3630 	 * acknowledgement to be written to the pipe.
3631 	 */
3632 	disable_blocking(rst_event_pipe[PE_CONSUMER]);
3633 	if ((set_pollfd(rst_event_pipe[PE_CONSUMER], POLLIN)) == -1)
3634 		goto failed;
3635 
3636 	/*
3637 	 * Register with master restarter for managed service events. This
3638 	 * will fail, amongst other reasons, if inetd is already running.
3639 	 */
3640 	if ((err = restarter_bind_handle(RESTARTER_EVENT_VERSION,
3641 	    INETD_INSTANCE_FMRI, restarter_event_proxy, 0,
3642 	    &rst_event_handle)) != 0) {
3643 		error_msg(gettext(
3644 		    "Failed to register for restarter events: %s"),
3645 		    strerror(err));
3646 		goto failed;
3647 	}
3648 
3649 	if (contract_init() < 0)
3650 		goto failed;
3651 
3652 	if ((timer_queue = iu_tq_create()) == NULL) {
3653 		error_msg(gettext("Failed to create timer queue."));
3654 		goto failed;
3655 	}
3656 
3657 	if (uds_init() < 0)
3658 		goto failed;
3659 
3660 	if (method_init() < 0)
3661 		goto failed;
3662 
3663 	/* Initialize auditing session */
3664 	if (adt_start_session(&audit_handle, NULL, ADT_USE_PROC_DATA) != 0) {
3665 		error_msg(gettext("Unable to start audit session"));
3666 	}
3667 
3668 	/*
3669 	 * Initialize signal dispositions/masks
3670 	 */
3671 	(void) sigset(SIGHUP, sighup_handler);
3672 	(void) sigset(SIGTERM, sigterm_handler);
3673 	(void) sigignore(SIGINT);
3674 
3675 	return (0);
3676 
3677 failed:
3678 	fini();
3679 	return (-1);
3680 }
3681 
3682 static int
3683 start_method(void)
3684 {
3685 	int	i;
3686 	int	pipe_fds[2];
3687 	int	child;
3688 
3689 	debug_msg("ENTERING START_METHOD:");
3690 
3691 	/* Create pipe for child to notify parent of initialization success. */
3692 	if (pipe(pipe_fds) < 0) {
3693 		debug_msg("pipe: %s", strerror(errno));
3694 		return (SMF_EXIT_ERR_OTHER);
3695 	}
3696 
3697 	if ((child = fork()) == -1) {
3698 		debug_msg("fork: %s", strerror(errno));
3699 		(void) close(pipe_fds[PE_CONSUMER]);
3700 		(void) close(pipe_fds[PE_PRODUCER]);
3701 		return (SMF_EXIT_ERR_OTHER);
3702 	} else if (child > 0) {			/* parent */
3703 
3704 		/* Wait on child to return success of initialization. */
3705 		(void) close(pipe_fds[PE_PRODUCER]);
3706 		if ((safe_read(pipe_fds[PE_CONSUMER], &i, sizeof (i)) != 0) ||
3707 		    (i < 0)) {
3708 			error_msg(gettext(
3709 			    "Initialization failed, unable to start"));
3710 			(void) close(pipe_fds[PE_CONSUMER]);
3711 			/*
3712 			 * Batch all initialization errors as 'other' errors,
3713 			 * resulting in retries being attempted.
3714 			 */
3715 			return (SMF_EXIT_ERR_OTHER);
3716 		} else {
3717 			(void) close(pipe_fds[PE_CONSUMER]);
3718 			return (SMF_EXIT_OK);
3719 		}
3720 	} else {				/* child */
3721 		/*
3722 		 * Perform initialization and return success code down
3723 		 * the pipe.
3724 		 */
3725 		(void) close(pipe_fds[PE_CONSUMER]);
3726 		i = init();
3727 		if ((safe_write(pipe_fds[PE_PRODUCER], &i, sizeof (i)) < 0) ||
3728 		    (i < 0)) {
3729 			error_msg(gettext("pipe write failure: %s"),
3730 			    strerror(errno));
3731 			exit(1);
3732 		}
3733 		(void) close(pipe_fds[PE_PRODUCER]);
3734 
3735 		(void) setsid();
3736 
3737 		/*
3738 		 * Log a message if the configuration file has changed since
3739 		 * inetconv was last run.
3740 		 */
3741 		check_conf_file();
3742 
3743 		event_loop();
3744 
3745 		fini();
3746 		debug_msg("inetd stopped");
3747 		msg_fini();
3748 		exit(0);
3749 	}
3750 	/* NOTREACHED */
3751 }
3752 
3753 /*
3754  * When inetd is run from outside the SMF, this message is output to provide
3755  * the person invoking inetd with further information that will help them
3756  * understand how to start and stop inetd, and to achieve the other
3757  * behaviors achievable with the legacy inetd command line interface, if
3758  * it is possible.
3759  */
3760 static void
3761 legacy_usage(void)
3762 {
3763 	(void) fprintf(stderr,
3764 	    "inetd is now an smf(5) managed service and can no longer be run "
3765 	    "from the\n"
3766 	    "command line. To enable or disable inetd refer to svcadm(1M) on\n"
3767 	    "how to enable \"%s\", the inetd instance.\n"
3768 	    "\n"
3769 	    "The traditional inetd command line option mappings are:\n"
3770 	    "\t-d : there is no supported debug output\n"
3771 	    "\t-s : inetd is only runnable from within the SMF\n"
3772 	    "\t-t : See inetadm(1M) on how to enable TCP tracing\n"
3773 	    "\t-r : See inetadm(1M) on how to set a failure rate\n"
3774 	    "\n"
3775 	    "To specify an alternative configuration file see svccfg(1M)\n"
3776 	    "for how to modify the \"%s/%s\" string type property of\n"
3777 	    "the inetd instance, and modify it according to the syntax:\n"
3778 	    "\"%s [alt_config_file] %%m\".\n"
3779 	    "\n"
3780 	    "For further information on inetd see inetd(1M).\n",
3781 	    INETD_INSTANCE_FMRI, START_METHOD_ARG, SCF_PROPERTY_EXEC,
3782 	    INETD_PATH);
3783 }
3784 
3785 /*
3786  * Usage message printed out for usage errors when running under the SMF.
3787  */
3788 static void
3789 smf_usage(const char *arg0)
3790 {
3791 	error_msg("Usage: %s [alt_conf_file] %s|%s|%s", arg0, START_METHOD_ARG,
3792 	    STOP_METHOD_ARG, REFRESH_METHOD_ARG);
3793 }
3794 
3795 /*
3796  * Returns B_TRUE if we're being run from within the SMF, else B_FALSE.
3797  */
3798 static boolean_t
3799 run_through_smf(void)
3800 {
3801 	char *fmri;
3802 
3803 	/*
3804 	 * check if the instance fmri environment variable has been set by
3805 	 * our restarter.
3806 	 */
3807 	return (((fmri = getenv("SMF_FMRI")) != NULL) &&
3808 	    (strcmp(fmri, INETD_INSTANCE_FMRI) == 0));
3809 }
3810 
3811 int
3812 main(int argc, char *argv[])
3813 {
3814 	char		*method;
3815 	int		ret;
3816 
3817 #if	!defined(TEXT_DOMAIN)
3818 #define	TEXT_DOMAIN "SYS_TEST"
3819 #endif
3820 	(void) textdomain(TEXT_DOMAIN);
3821 	(void) setlocale(LC_ALL, "");
3822 
3823 	if (!run_through_smf()) {
3824 		legacy_usage();
3825 		return (SMF_EXIT_ERR_NOSMF);
3826 	}
3827 
3828 	msg_init();	/* setup logging */
3829 
3830 	(void) enable_extended_FILE_stdio(-1, -1);
3831 
3832 	/* inetd invocation syntax is inetd [alt_conf_file] method_name */
3833 
3834 	switch (argc) {
3835 	case 2:
3836 		method = argv[1];
3837 		break;
3838 	case 3:
3839 		conf_file = argv[1];
3840 		method = argv[2];
3841 		break;
3842 	default:
3843 		smf_usage(argv[0]);
3844 		return (SMF_EXIT_ERR_CONFIG);
3845 
3846 	}
3847 
3848 	if (strcmp(method, START_METHOD_ARG) == 0) {
3849 		ret = start_method();
3850 	} else if (strcmp(method, STOP_METHOD_ARG) == 0) {
3851 		ret = stop_method();
3852 	} else if (strcmp(method, REFRESH_METHOD_ARG) == 0) {
3853 		ret = refresh_method();
3854 	} else {
3855 		smf_usage(argv[0]);
3856 		return (SMF_EXIT_ERR_CONFIG);
3857 	}
3858 
3859 	return (ret);
3860 }
3861