xref: /titanic_51/usr/src/cmd/cmd-inet/usr.lib/inetd/inetd.c (revision b3697b90e692e3e5d859fb77d285d4c056d99eda)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
23  */
24 
25 /*
26  * NOTES: To be expanded.
27  *
28  * The SMF inetd.
29  *
30  * Below are some high level notes of the operation of the SMF inetd. The
31  * notes don't go into any real detail, and the viewer of this file is
32  * encouraged to look at the code and its associated comments to better
33  * understand inetd's operation. This saves the potential for the code
34  * and these notes diverging over time.
35  *
36  * Inetd's major work is done from the context of event_loop(). Within this
37  * loop, inetd polls for events arriving from a number of different file
38  * descriptors, representing the following event types, and initiates
39  * any necessary event processing:
40  * - incoming network connections/datagrams.
41  * - notification of terminated processes (discovered via contract events).
42  * - instance specific events originating from the SMF master restarter.
43  * - stop/refresh requests from the inetd method processes (coming in on a
44  *   Unix Domain socket).
45  * There's also a timeout set for the poll, which is set to the nearest
46  * scheduled timer in a timer queue that inetd uses to perform delayed
47  * processing, such as bind retries.
48  * The SIGHUP and SIGINT signals can also interrupt the poll, and will
49  * result in inetd being refreshed or stopped respectively, as was the
50  * behavior with the old inetd.
51  *
52  * Inetd implements a state machine for each instance. The states within the
53  * machine are: offline, online, disabled, maintenance, uninitialized and
54  * specializations of the offline state for when an instance exceeds one of
55  * its DOS limits. The state of an instance can be changed as a
56  * result/side-effect of one of the above events occurring, or inetd being
57  * started up. The ongoing state of an instance is stored in the SMF
58  * repository, as required of SMF restarters. This enables an administrator
59  * to view the state of each instance, and, if inetd was to terminate
60  * unexpectedly, it could use the stored state to re-commence where it left off.
61  *
62  * Within the state machine a number of methods are run (if provided) as part
63  * of a state transition to aid/ effect a change in an instance's state. The
64  * supported methods are: offline, online, disable, refresh and start. The
65  * latter of these is the equivalent of the server program and its arguments
66  * in the old inetd.
67  *
68  * Events from the SMF master restarter come in on a number of threads
69  * created in the registration routine of librestart, the delegated restarter
70  * library. These threads call into the restart_event_proxy() function
71  * when an event arrives. To serialize the processing of instances, these events
72  * are then written down a pipe to the process's main thread, which listens
73  * for these events via a poll call, with the file descriptor of the other
74  * end of the pipe in its read set, and processes the event appropriately.
75  * When the event has been  processed (which may be delayed if the instance
76  * for which the event is for is in the process of executing one of its methods
77  * as part of a state transition) it writes an acknowledgement back down the
78  * pipe the event was received on. The thread in restart_event_proxy() that
79  * wrote the event will read the acknowledgement it was blocked upon, and will
80  * then be able to return to its caller, thus implicitly acknowledging the
81  * event, and allowing another event to be written down the pipe for the main
82  * thread to process.
83  */
84 
85 
86 #include <netdb.h>
87 #include <stdio.h>
88 #include <stdio_ext.h>
89 #include <stdlib.h>
90 #include <strings.h>
91 #include <unistd.h>
92 #include <assert.h>
93 #include <sys/types.h>
94 #include <sys/socket.h>
95 #include <netinet/in.h>
96 #include <fcntl.h>
97 #include <signal.h>
98 #include <errno.h>
99 #include <locale.h>
100 #include <syslog.h>
101 #include <libintl.h>
102 #include <librestart.h>
103 #include <pthread.h>
104 #include <sys/stat.h>
105 #include <time.h>
106 #include <limits.h>
107 #include <libgen.h>
108 #include <tcpd.h>
109 #include <libscf.h>
110 #include <libuutil.h>
111 #include <stddef.h>
112 #include <bsm/adt_event.h>
113 #include <ucred.h>
114 #include "inetd_impl.h"
115 
116 /* path to inetd's binary */
117 #define	INETD_PATH	"/usr/lib/inet/inetd"
118 
119 /*
120  * inetd's default configuration file paths. /etc/inetd/inetd.conf is set
121  * be be the primary file, so it is checked before /etc/inetd.conf.
122  */
123 #define	PRIMARY_DEFAULT_CONF_FILE	"/etc/inet/inetd.conf"
124 #define	SECONDARY_DEFAULT_CONF_FILE	"/etc/inetd.conf"
125 
126 /* Arguments passed to this binary to request which method to execute. */
127 #define	START_METHOD_ARG	"start"
128 #define	STOP_METHOD_ARG		"stop"
129 #define	REFRESH_METHOD_ARG	"refresh"
130 
131 /* connection backlog for unix domain socket */
132 #define	UDS_BACKLOG	2
133 
134 /* number of retries to recv() a request on the UDS socket before giving up */
135 #define	UDS_RECV_RETRIES	10
136 
137 /* enumeration of the different ends of a pipe */
138 enum pipe_end {
139 	PE_CONSUMER,
140 	PE_PRODUCER
141 };
142 
143 typedef struct {
144 	internal_inst_state_t		istate;
145 	const char			*name;
146 	restarter_instance_state_t	smf_state;
147 	instance_method_t		method_running;
148 } state_info_t;
149 
150 
151 /*
152  * Collection of information for each state.
153  * NOTE:  This table is indexed into using the internal_inst_state_t
154  * enumeration, so the ordering needs to be kept in synch.
155  */
156 static state_info_t states[] = {
157 	{IIS_UNINITIALIZED, "uninitialized", RESTARTER_STATE_UNINIT,
158 	    IM_NONE},
159 	{IIS_ONLINE, "online", RESTARTER_STATE_ONLINE, IM_START},
160 	{IIS_IN_ONLINE_METHOD, "online_method", RESTARTER_STATE_OFFLINE,
161 	    IM_ONLINE},
162 	{IIS_OFFLINE, "offline", RESTARTER_STATE_OFFLINE, IM_NONE},
163 	{IIS_IN_OFFLINE_METHOD, "offline_method", RESTARTER_STATE_OFFLINE,
164 	    IM_OFFLINE},
165 	{IIS_DISABLED, "disabled", RESTARTER_STATE_DISABLED, IM_NONE},
166 	{IIS_IN_DISABLE_METHOD, "disabled_method", RESTARTER_STATE_OFFLINE,
167 	    IM_DISABLE},
168 	{IIS_IN_REFRESH_METHOD, "refresh_method", RESTARTER_STATE_ONLINE,
169 	    IM_REFRESH},
170 	{IIS_MAINTENANCE, "maintenance", RESTARTER_STATE_MAINT, IM_NONE},
171 	{IIS_OFFLINE_CONRATE, "cr_offline", RESTARTER_STATE_OFFLINE, IM_NONE},
172 	{IIS_OFFLINE_BIND, "bind_offline", RESTARTER_STATE_OFFLINE, IM_NONE},
173 	{IIS_OFFLINE_COPIES, "copies_offline", RESTARTER_STATE_OFFLINE,
174 	    IM_NONE},
175 	{IIS_DEGRADED, "degraded", RESTARTER_STATE_DEGRADED, IM_NONE},
176 	{IIS_NONE, "none", RESTARTER_STATE_NONE, IM_NONE}
177 };
178 
179 /*
180  * Pipe used to send events from the threads created by restarter_bind_handle()
181  * to the main thread of control.
182  */
183 static int			rst_event_pipe[] = {-1, -1};
184 /*
185  * Used to protect the critical section of code in restarter_event_proxy() that
186  * involves writing an event down the event pipe and reading an acknowledgement.
187  */
188 static pthread_mutex_t		rst_event_pipe_mtx = PTHREAD_MUTEX_INITIALIZER;
189 
190 /* handle used in communication with the master restarter */
191 static restarter_event_handle_t *rst_event_handle = NULL;
192 
193 /* set to indicate a refresh of inetd is requested */
194 static boolean_t		refresh_inetd_requested = B_FALSE;
195 
196 /* set by the SIGTERM handler to flag we got a SIGTERM */
197 static boolean_t		got_sigterm = B_FALSE;
198 
199 /*
200  * Timer queue used to store timers for delayed event processing, such as
201  * bind retries.
202  */
203 iu_tq_t				*timer_queue = NULL;
204 
205 /*
206  * fd of Unix Domain socket used to communicate stop and refresh requests
207  * to the inetd start method process.
208  */
209 static int			uds_fd = -1;
210 
211 /*
212  * List of inetd's currently managed instances; each containing its state,
213  * and in certain states its configuration.
214  */
215 static uu_list_pool_t		*instance_pool = NULL;
216 uu_list_t			*instance_list = NULL;
217 
218 /* set to indicate we're being stopped */
219 boolean_t			inetd_stopping = B_FALSE;
220 
221 /* TCP wrappers syslog globals. Consumed by libwrap. */
222 int				allow_severity = LOG_INFO;
223 int				deny_severity = LOG_WARNING;
224 
225 /* path of the configuration file being monitored by check_conf_file() */
226 static char			*conf_file = NULL;
227 
228 /* Auditing session handle */
229 static adt_session_data_t	*audit_handle;
230 
231 /* Number of pending connections */
232 static size_t			tlx_pending_counter;
233 
234 static void uds_fini(void);
235 static int uds_init(void);
236 static int run_method(instance_t *, instance_method_t, const proto_info_t *);
237 static void create_bound_fds(instance_t *);
238 static void destroy_bound_fds(instance_t *);
239 static void destroy_instance(instance_t *);
240 static void inetd_stop(void);
241 static void
242 exec_method(instance_t *instance, instance_method_t method, method_info_t *mi,
243     struct method_context *mthd_ctxt, const proto_info_t *pi) __NORETURN;
244 
245 /*
246  * The following two functions are callbacks that libumem uses to determine
247  * inetd's desired debugging/logging levels. The interface they consume is
248  * exported by FMA and is consolidation private. The comments in the two
249  * functions give the environment variable that will effectively be set to
250  * their returned value, and thus whose behavior for this value, described in
251  * umem_debug(3MALLOC), will be followed.
252  */
253 
254 const char *
255 _umem_debug_init(void)
256 {
257 	return ("default,verbose");	/* UMEM_DEBUG setting */
258 }
259 
260 const char *
261 _umem_logging_init(void)
262 {
263 	return ("fail,contents");	/* UMEM_LOGGING setting */
264 }
265 
266 static void
267 log_invalid_cfg(const char *fmri)
268 {
269 	error_msg(gettext(
270 	    "Invalid configuration for instance %s, placing in maintenance"),
271 	    fmri);
272 }
273 
274 /*
275  * Returns B_TRUE if the instance is in a suitable state for inetd to stop.
276  */
277 static boolean_t
278 instance_stopped(const instance_t *inst)
279 {
280 	return ((inst->cur_istate == IIS_OFFLINE) ||
281 	    (inst->cur_istate == IIS_MAINTENANCE) ||
282 	    (inst->cur_istate == IIS_DISABLED) ||
283 	    (inst->cur_istate == IIS_UNINITIALIZED));
284 }
285 
286 /*
287  * Given the instance fmri, obtain the corresonding scf_instance.
288  * Caller is responsible for freeing the returned scf_instance and
289  * its scf_handle.
290  */
291 static int
292 fmri_to_instance(char *fmri, scf_instance_t **scf_instp)
293 {
294 	int retries, ret = 1;
295 	scf_handle_t	*h;
296 	scf_instance_t *scf_inst;
297 
298 	if ((h = scf_handle_create(SCF_VERSION)) == NULL) {
299 		error_msg(gettext("Failed to get instance for %s"), fmri);
300 		return (1);
301 	}
302 
303 	if ((scf_inst = scf_instance_create(h)) == NULL)
304 		goto out;
305 
306 	for (retries = 0; retries <= REP_OP_RETRIES; retries++) {
307 		if (make_handle_bound(h) == -1)
308 			break;
309 
310 		if (scf_handle_decode_fmri(h, fmri, NULL, NULL, scf_inst,
311 		    NULL, NULL, SCF_DECODE_FMRI_EXACT) == 0) {
312 			ret = 0;
313 			*scf_instp = scf_inst;
314 			break;
315 		}
316 
317 		if (scf_error() != SCF_ERROR_CONNECTION_BROKEN)
318 			break;
319 	}
320 
321 out:
322 	if (ret != 0) {
323 		error_msg(gettext("Failed to get instance for %s"), fmri);
324 		scf_instance_destroy(scf_inst);
325 		scf_handle_destroy(h);
326 	}
327 
328 	return (ret);
329 }
330 
331 /*
332  * Updates the current and next repository states of instance 'inst'. If
333  * any errors occur an error message is output.
334  */
335 static void
336 update_instance_states(instance_t *inst, internal_inst_state_t new_cur_state,
337     internal_inst_state_t new_next_state, restarter_error_t err)
338 {
339 	internal_inst_state_t	old_cur = inst->cur_istate;
340 	internal_inst_state_t	old_next = inst->next_istate;
341 	scf_instance_t		*scf_inst = NULL;
342 	scf_error_t		sret;
343 	int			ret;
344 	restarter_str_t		aux = restarter_str_none;
345 
346 	/* update the repository/cached internal state */
347 	inst->cur_istate = new_cur_state;
348 	inst->next_istate = new_next_state;
349 	(void) set_single_rep_val(inst->cur_istate_rep,
350 	    (int64_t)new_cur_state);
351 	(void) set_single_rep_val(inst->next_istate_rep,
352 	    (int64_t)new_next_state);
353 
354 	if (((sret = store_rep_vals(inst->cur_istate_rep, inst->fmri,
355 	    PR_NAME_CUR_INT_STATE)) != 0) ||
356 	    ((sret = store_rep_vals(inst->next_istate_rep, inst->fmri,
357 	    PR_NAME_NEXT_INT_STATE)) != 0))
358 		error_msg(gettext("Failed to update state of instance %s in "
359 		    "repository: %s"), inst->fmri, scf_strerror(sret));
360 
361 	if (fmri_to_instance(inst->fmri, &scf_inst) == 0) {
362 		/*
363 		 * If transitioning to maintenance, check auxiliary_tty set
364 		 * by svcadm and assign appropriate value to auxiliary_state.
365 		 * If the maintenance event comes from a service request,
366 		 * validate auxiliary_fmri and copy it to
367 		 * restarter/auxiliary_fmri.
368 		 */
369 		if (new_cur_state == IIS_MAINTENANCE) {
370 			if (restarter_inst_ractions_from_tty(scf_inst) == 0)
371 				aux = restarter_str_service_request;
372 			else
373 				aux = restarter_str_administrative_request;
374 		}
375 
376 		if (aux == restarter_str_service_request) {
377 			if (restarter_inst_validate_ractions_aux_fmri(
378 			    scf_inst) == 0) {
379 				if (restarter_inst_set_aux_fmri(scf_inst))
380 					error_msg(gettext("Could not set "
381 					    "auxiliary_fmri property for %s"),
382 					    inst->fmri);
383 			} else {
384 				if (restarter_inst_reset_aux_fmri(scf_inst))
385 					error_msg(gettext("Could not reset "
386 					    "auxiliary_fmri property for %s"),
387 					    inst->fmri);
388 			}
389 		}
390 		scf_handle_destroy(scf_instance_handle(scf_inst));
391 		scf_instance_destroy(scf_inst);
392 	}
393 
394 	/* update the repository SMF state */
395 	if ((ret = restarter_set_states(rst_event_handle, inst->fmri,
396 	    states[old_cur].smf_state, states[new_cur_state].smf_state,
397 	    states[old_next].smf_state, states[new_next_state].smf_state,
398 	    err, aux)) != 0)
399 		error_msg(gettext("Failed to update state of instance %s in "
400 		    "repository: %s"), inst->fmri, strerror(ret));
401 }
402 
403 void
404 update_state(instance_t *inst, internal_inst_state_t new_cur,
405     restarter_error_t err)
406 {
407 	update_instance_states(inst, new_cur, IIS_NONE, err);
408 }
409 
410 /*
411  * Sends a refresh event to the inetd start method process and returns
412  * SMF_EXIT_OK if it managed to send it. If it fails to send the request for
413  * some reason it returns SMF_EXIT_ERR_OTHER.
414  */
415 static int
416 refresh_method(void)
417 {
418 	uds_request_t   req = UR_REFRESH_INETD;
419 	int		fd;
420 
421 	if ((fd = connect_to_inetd()) < 0) {
422 		error_msg(gettext("Failed to connect to inetd: %s"),
423 		    strerror(errno));
424 		return (SMF_EXIT_ERR_OTHER);
425 	}
426 
427 	/* write the request and return success */
428 	if (safe_write(fd, &req, sizeof (req)) == -1) {
429 		error_msg(
430 		    gettext("Failed to send refresh request to inetd: %s"),
431 		    strerror(errno));
432 		(void) close(fd);
433 		return (SMF_EXIT_ERR_OTHER);
434 	}
435 
436 	(void) close(fd);
437 
438 	return (SMF_EXIT_OK);
439 }
440 
441 /*
442  * Sends a stop event to the inetd start method process and wait till it goes
443  * away. If inetd is determined to have stopped SMF_EXIT_OK is returned, else
444  * SMF_EXIT_ERR_OTHER is returned.
445  */
446 static int
447 stop_method(void)
448 {
449 	uds_request_t   req = UR_STOP_INETD;
450 	int		fd;
451 	char		c;
452 	ssize_t		ret;
453 
454 	if ((fd = connect_to_inetd()) == -1) {
455 		debug_msg(gettext("Failed to connect to inetd: %s"),
456 		    strerror(errno));
457 		/*
458 		 * Assume connect_to_inetd() failed because inetd was already
459 		 * stopped, and return success.
460 		 */
461 		return (SMF_EXIT_OK);
462 	}
463 
464 	/*
465 	 * This is safe to do since we're fired off in a separate process
466 	 * than inetd and in the case we get wedged, the stop method timeout
467 	 * will occur and we'd be killed by our restarter.
468 	 */
469 	enable_blocking(fd);
470 
471 	/* write the stop request to inetd and wait till it goes away */
472 	if (safe_write(fd, &req, sizeof (req)) != 0) {
473 		error_msg(gettext("Failed to send stop request to inetd"));
474 		(void) close(fd);
475 		return (SMF_EXIT_ERR_OTHER);
476 	}
477 
478 	/* wait until remote end of socket is closed */
479 	while (((ret = recv(fd, &c, sizeof (c), 0)) != 0) && (errno == EINTR))
480 		;
481 
482 	(void) close(fd);
483 
484 	if (ret != 0) {
485 		error_msg(gettext("Failed to determine whether inetd stopped"));
486 		return (SMF_EXIT_ERR_OTHER);
487 	}
488 
489 	return (SMF_EXIT_OK);
490 }
491 
492 
493 /*
494  * This function is called to handle restarter events coming in from the
495  * master restarter. It is registered with the master restarter via
496  * restarter_bind_handle() and simply passes a pointer to the event down
497  * the event pipe, which will be discovered by the poll in the event loop
498  * and processed there. It waits for an acknowledgement to be written back down
499  * the pipe before returning.
500  * Writing a pointer to the function's 'event' parameter down the pipe will
501  * be safe, as the thread in restarter_event_proxy() doesn't return until
502  * the main thread has finished its processing of the passed event, thus
503  * the referenced event will remain around until the function returns.
504  * To impose the limit of only one event being in the pipe and processed
505  * at once, a lock is taken on entry to this function and returned on exit.
506  * Always returns 0.
507  */
508 static int
509 restarter_event_proxy(restarter_event_t *event)
510 {
511 	boolean_t		processed;
512 
513 	(void) pthread_mutex_lock(&rst_event_pipe_mtx);
514 
515 	/* write the event to the main worker thread down the pipe */
516 	if (safe_write(rst_event_pipe[PE_PRODUCER], &event,
517 	    sizeof (event)) != 0)
518 		goto pipe_error;
519 
520 	/*
521 	 * Wait for an acknowledgement that the event has been processed from
522 	 * the same pipe. In the case that inetd is stopping, any thread in
523 	 * this function will simply block on this read until inetd eventually
524 	 * exits. This will result in this function not returning success to
525 	 * its caller, and the event that was being processed when the
526 	 * function exited will be re-sent when inetd is next started.
527 	 */
528 	if (safe_read(rst_event_pipe[PE_PRODUCER], &processed,
529 	    sizeof (processed)) != 0)
530 		goto pipe_error;
531 
532 	(void) pthread_mutex_unlock(&rst_event_pipe_mtx);
533 
534 	return (processed ? 0 : EAGAIN);
535 
536 pipe_error:
537 	/*
538 	 * Something's seriously wrong with the event pipe. Notify the
539 	 * worker thread by closing this end of the event pipe and pause till
540 	 * inetd exits.
541 	 */
542 	error_msg(gettext("Can't process restarter events: %s"),
543 	    strerror(errno));
544 	(void) close(rst_event_pipe[PE_PRODUCER]);
545 	for (;;)
546 		(void) pause();
547 
548 	/* NOTREACHED */
549 }
550 
551 /*
552  * Let restarter_event_proxy() know we're finished with the event it's blocked
553  * upon. The 'processed' argument denotes whether we successfully processed the
554  * event.
555  */
556 static void
557 ack_restarter_event(boolean_t processed)
558 {
559 	/*
560 	 * If safe_write returns -1 something's seriously wrong with the event
561 	 * pipe, so start the shutdown proceedings.
562 	 */
563 	if (safe_write(rst_event_pipe[PE_CONSUMER], &processed,
564 	    sizeof (processed)) == -1)
565 		inetd_stop();
566 }
567 
568 /*
569  * Switch the syslog identification string to 'ident'.
570  */
571 static void
572 change_syslog_ident(const char *ident)
573 {
574 	closelog();
575 	openlog(ident, LOG_PID|LOG_CONS, LOG_DAEMON);
576 }
577 
578 /*
579  * Perform TCP wrappers checks on this instance. Due to the fact that the
580  * current wrappers code used in Solaris is taken untouched from the open
581  * source version, we're stuck with using the daemon name for the checks, as
582  * opposed to making use of instance FMRIs. Sigh.
583  * Returns B_TRUE if the check passed, else B_FALSE.
584  */
585 static boolean_t
586 tcp_wrappers_ok(instance_t *instance)
587 {
588 	boolean_t		rval = B_TRUE;
589 	char			*daemon_name;
590 	basic_cfg_t		*cfg = instance->config->basic;
591 	struct request_info	req;
592 
593 	/*
594 	 * Wrap the service using libwrap functions. The code below implements
595 	 * the functionality of tcpd. This is done only for stream,nowait
596 	 * services, following the convention of other vendors.  udp/dgram and
597 	 * stream/wait can NOT be wrapped with this libwrap, so be wary of
598 	 * changing the test below.
599 	 */
600 	if (cfg->do_tcp_wrappers && !cfg->iswait && !cfg->istlx) {
601 
602 		daemon_name = instance->config->methods[
603 		    IM_START]->exec_args_we.we_wordv[0];
604 		if (*daemon_name == '/')
605 			daemon_name = strrchr(daemon_name, '/') + 1;
606 
607 		/*
608 		 * Change the syslog message identity to the name of the
609 		 * daemon being wrapped, as opposed to "inetd".
610 		 */
611 		change_syslog_ident(daemon_name);
612 
613 		(void) request_init(&req, RQ_DAEMON, daemon_name, RQ_FILE,
614 		    instance->conn_fd, NULL);
615 		fromhost(&req);
616 
617 		if (strcasecmp(eval_hostname(req.client), paranoid) == 0) {
618 			syslog(deny_severity,
619 			    "refused connect from %s (name/address mismatch)",
620 			    eval_client(&req));
621 			if (req.sink != NULL)
622 				req.sink(instance->conn_fd);
623 			rval = B_FALSE;
624 		} else if (!hosts_access(&req)) {
625 			syslog(deny_severity,
626 			    "refused connect from %s (access denied)",
627 			    eval_client(&req));
628 			if (req.sink != NULL)
629 				req.sink(instance->conn_fd);
630 			rval = B_FALSE;
631 		} else {
632 			syslog(allow_severity, "connect from %s",
633 			    eval_client(&req));
634 		}
635 
636 		/* Revert syslog identity back to "inetd". */
637 		change_syslog_ident(SYSLOG_IDENT);
638 	}
639 	return (rval);
640 }
641 
642 /*
643  * Handler registered with the timer queue code to remove an instance from
644  * the connection rate offline state when it has been there for its allotted
645  * time.
646  */
647 /* ARGSUSED */
648 static void
649 conn_rate_online(iu_tq_t *tq, void *arg)
650 {
651 	instance_t *instance = arg;
652 
653 	assert(instance->cur_istate == IIS_OFFLINE_CONRATE);
654 	instance->timer_id = -1;
655 	update_state(instance, IIS_OFFLINE, RERR_RESTART);
656 	process_offline_inst(instance);
657 }
658 
659 /*
660  * Check whether this instance in the offline state is in transition to
661  * another state and do the work to continue this transition.
662  */
663 void
664 process_offline_inst(instance_t *inst)
665 {
666 	if (inst->disable_req) {
667 		inst->disable_req = B_FALSE;
668 		(void) run_method(inst, IM_DISABLE, NULL);
669 	} else if (inst->maintenance_req) {
670 		inst->maintenance_req = B_FALSE;
671 		update_state(inst, IIS_MAINTENANCE, RERR_RESTART);
672 	/*
673 	 * If inetd is in the process of stopping, we don't want to enter
674 	 * any states but offline, disabled and maintenance.
675 	 */
676 	} else if (!inetd_stopping) {
677 		if (inst->conn_rate_exceeded) {
678 			basic_cfg_t *cfg = inst->config->basic;
679 
680 			inst->conn_rate_exceeded = B_FALSE;
681 			update_state(inst, IIS_OFFLINE_CONRATE, RERR_RESTART);
682 			/*
683 			 * Schedule a timer to bring the instance out of the
684 			 * connection rate offline state.
685 			 */
686 			inst->timer_id = iu_schedule_timer(timer_queue,
687 			    cfg->conn_rate_offline, conn_rate_online,
688 			    inst);
689 			if (inst->timer_id == -1) {
690 				error_msg(gettext("%s unable to set timer, "
691 				    "won't be brought on line after %d "
692 				    "seconds."), inst->fmri,
693 				    cfg->conn_rate_offline);
694 			}
695 
696 		} else if (copies_limit_exceeded(inst)) {
697 			update_state(inst, IIS_OFFLINE_COPIES, RERR_RESTART);
698 		}
699 	}
700 }
701 
702 /*
703  * Create a socket bound to the instance's configured address. If the
704  * bind fails, returns -1, else the fd of the bound socket.
705  */
706 static int
707 create_bound_socket(const instance_t *inst, socket_info_t *sock_info)
708 {
709 	int		fd;
710 	int		on = 1;
711 	const char	*fmri = inst->fmri;
712 	rpc_info_t	*rpc = sock_info->pr_info.ri;
713 	const char	*proto = sock_info->pr_info.proto;
714 
715 	fd = socket(sock_info->local_addr.ss_family, sock_info->type,
716 	    sock_info->protocol);
717 	if (fd < 0) {
718 		error_msg(gettext(
719 		    "Socket creation failure for instance %s, proto %s: %s"),
720 		    fmri, proto, strerror(errno));
721 		return (-1);
722 	}
723 
724 	if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &on, sizeof (on)) == -1) {
725 		error_msg(gettext("setsockopt SO_REUSEADDR failed for service "
726 		    "instance %s, proto %s: %s"), fmri, proto, strerror(errno));
727 		(void) close(fd);
728 		return (-1);
729 	}
730 	if (inst->config->basic->do_tcp_keepalive &&
731 	    !inst->config->basic->iswait && !inst->config->basic->istlx) {
732 		/* set the keepalive option */
733 		if (setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &on,
734 		    sizeof (on)) == -1) {
735 			error_msg(gettext("setsockopt SO_KEEPALIVE failed for "
736 			    "service instance %s, proto %s: %s"), fmri,
737 			    proto, strerror(errno));
738 			(void) close(fd);
739 			return (-1);
740 		}
741 	}
742 	if (sock_info->pr_info.v6only) {
743 		/* restrict socket to IPv6 communications only */
744 		if (setsockopt(fd, IPPROTO_IPV6, IPV6_V6ONLY, &on,
745 		    sizeof (on)) == -1) {
746 			error_msg(gettext("setsockopt IPV6_V6ONLY failed for "
747 			    "service instance %s, proto %s: %s"), fmri, proto,
748 			    strerror(errno));
749 			(void) close(fd);
750 			return (-1);
751 		}
752 	}
753 
754 	if (rpc != NULL)
755 		SS_SETPORT(sock_info->local_addr, 0);
756 
757 	if (bind(fd, (struct sockaddr *)&(sock_info->local_addr),
758 	    SS_ADDRLEN(sock_info->local_addr)) < 0) {
759 		error_msg(gettext(
760 		    "Failed to bind to the port of service instance %s, "
761 		    "proto %s: %s"), fmri, proto, strerror(errno));
762 		(void) close(fd);
763 		return (-1);
764 	}
765 
766 	/*
767 	 * Retrieve and store the address bound to for RPC services.
768 	 */
769 	if (rpc != NULL) {
770 		struct sockaddr_storage	ss;
771 		int			ss_size = sizeof (ss);
772 
773 		if (getsockname(fd, (struct sockaddr *)&ss, &ss_size) < 0) {
774 			error_msg(gettext("Failed getsockname for instance %s, "
775 			    "proto %s: %s"), fmri, proto, strerror(errno));
776 			(void) close(fd);
777 			return (-1);
778 		}
779 		(void) memcpy(rpc->netbuf.buf, &ss,
780 		    sizeof (struct sockaddr_storage));
781 		rpc->netbuf.len = SS_ADDRLEN(ss);
782 		rpc->netbuf.maxlen = SS_ADDRLEN(ss);
783 	}
784 
785 	if (sock_info->type == SOCK_STREAM) {
786 		int qlen = inst->config->basic->conn_backlog;
787 
788 		debug_msg("Listening for service %s with backlog queue"
789 		    " size %d", fmri, qlen);
790 		(void) listen(fd, qlen);
791 	}
792 
793 	return (fd);
794 }
795 
796 /*
797  * Handler registered with the timer queue code to retry the creation
798  * of a bound fd.
799  */
800 /* ARGSUSED */
801 static void
802 retry_bind(iu_tq_t *tq, void *arg)
803 {
804 	instance_t *instance = arg;
805 
806 	switch (instance->cur_istate) {
807 	case IIS_OFFLINE_BIND:
808 	case IIS_ONLINE:
809 	case IIS_DEGRADED:
810 	case IIS_IN_ONLINE_METHOD:
811 	case IIS_IN_REFRESH_METHOD:
812 		break;
813 	default:
814 #ifndef NDEBUG
815 		(void) fprintf(stderr, "%s:%d: Unknown instance state %d.\n",
816 		    __FILE__, __LINE__, instance->cur_istate);
817 #endif
818 		abort();
819 	}
820 
821 	instance->bind_timer_id = -1;
822 	create_bound_fds(instance);
823 }
824 
825 /*
826  * For each of the fds for the given instance that are bound, if 'listen' is
827  * set add them to the poll set, else remove them from it. If proto_name is
828  * not NULL then apply the change only to this specific protocol endpoint.
829  * If any additions fail, returns -1, else 0 on success.
830  */
831 int
832 poll_bound_fds(instance_t *instance, boolean_t listen, char *proto_name)
833 {
834 	basic_cfg_t	*cfg = instance->config->basic;
835 	proto_info_t	*pi;
836 	int		ret = 0;
837 
838 	for (pi = uu_list_first(cfg->proto_list); pi != NULL;
839 	    pi = uu_list_next(cfg->proto_list, pi)) {
840 		if (pi->listen_fd != -1) {	/* fd bound */
841 			if (proto_name == NULL ||
842 			    strcmp(pi->proto, proto_name) == 0) {
843 				if (listen == B_FALSE) {
844 					clear_pollfd(pi->listen_fd);
845 				} else if (set_pollfd(pi->listen_fd,
846 				    POLLIN) == -1) {
847 					ret = -1;
848 				}
849 			}
850 		}
851 	}
852 
853 	return (ret);
854 }
855 
856 /*
857  * Handle the case were we either fail to create a bound fd or we fail
858  * to add a bound fd to the poll set for the given instance.
859  */
860 static void
861 handle_bind_failure(instance_t *instance)
862 {
863 	basic_cfg_t *cfg = instance->config->basic;
864 
865 	/*
866 	 * We must be being called as a result of a failed poll_bound_fds()
867 	 * as a bind retry is already scheduled. Just return and let it do
868 	 * the work.
869 	 */
870 	if (instance->bind_timer_id != -1)
871 		return;
872 
873 	/*
874 	 * Check if the rebind retries limit is operative and if so,
875 	 * if it has been reached.
876 	 */
877 	if (((cfg->bind_fail_interval <= 0) ||		/* no retries */
878 	    ((cfg->bind_fail_max >= 0) &&		/* limit reached */
879 	    (++instance->bind_fail_count > cfg->bind_fail_max))) ||
880 	    ((instance->bind_timer_id = iu_schedule_timer(timer_queue,
881 	    cfg->bind_fail_interval, retry_bind, instance)) == -1)) {
882 		proto_info_t *pi;
883 
884 		instance->bind_fail_count = 0;
885 
886 		switch (instance->cur_istate) {
887 		case IIS_DEGRADED:
888 		case IIS_ONLINE:
889 			/* check if any of the fds are being poll'd upon */
890 			for (pi = uu_list_first(cfg->proto_list); pi != NULL;
891 			    pi = uu_list_next(cfg->proto_list, pi)) {
892 				if ((pi->listen_fd != -1) &&
893 				    (find_pollfd(pi->listen_fd) != NULL))
894 					break;
895 			}
896 			if (pi != NULL)	{	/* polling on > 0 fds */
897 				warn_msg(gettext("Failed to bind on "
898 				    "all protocols for instance %s, "
899 				    "transitioning to degraded"),
900 				    instance->fmri);
901 				update_state(instance, IIS_DEGRADED, RERR_NONE);
902 				instance->bind_retries_exceeded = B_TRUE;
903 				break;
904 			}
905 
906 			destroy_bound_fds(instance);
907 			/*
908 			 * In the case we failed the 'bind' because set_pollfd()
909 			 * failed on all bound fds, use the offline handling.
910 			 */
911 			/* FALLTHROUGH */
912 		case IIS_OFFLINE:
913 		case IIS_OFFLINE_BIND:
914 			error_msg(gettext("Too many bind failures for instance "
915 			"%s, transitioning to maintenance"), instance->fmri);
916 			update_state(instance, IIS_MAINTENANCE,
917 			    RERR_FAULT);
918 			break;
919 		case IIS_IN_ONLINE_METHOD:
920 		case IIS_IN_REFRESH_METHOD:
921 			warn_msg(gettext("Failed to bind on all "
922 			    "protocols for instance %s, instance will go to "
923 			    "degraded"), instance->fmri);
924 			/*
925 			 * Set the retries exceeded flag so when the method
926 			 * completes the instance goes to the degraded state.
927 			 */
928 			instance->bind_retries_exceeded = B_TRUE;
929 			break;
930 		default:
931 #ifndef NDEBUG
932 			(void) fprintf(stderr,
933 			    "%s:%d: Unknown instance state %d.\n",
934 			    __FILE__, __LINE__, instance->cur_istate);
935 #endif
936 			abort();
937 		}
938 	} else if (instance->cur_istate == IIS_OFFLINE) {
939 		/*
940 		 * bind re-scheduled, so if we're offline reflect this in the
941 		 * state.
942 		 */
943 		update_state(instance, IIS_OFFLINE_BIND, RERR_NONE);
944 	}
945 }
946 
947 
948 /*
949  * Check if two transport protocols for RPC conflict.
950  */
951 
952 boolean_t
953 is_rpc_proto_conflict(const char *proto0, const char *proto1) {
954 	if (strcmp(proto0, "tcp") == 0) {
955 		if (strcmp(proto1, "tcp") == 0)
956 			return (B_TRUE);
957 		if (strcmp(proto1, "tcp6") == 0)
958 			return (B_TRUE);
959 		return (B_FALSE);
960 	}
961 
962 	if (strcmp(proto0, "tcp6") == 0) {
963 		if (strcmp(proto1, "tcp") == 0)
964 			return (B_TRUE);
965 		if (strcmp(proto1, "tcp6only") == 0)
966 			return (B_TRUE);
967 		if (strcmp(proto1, "tcp6") == 0)
968 			return (B_TRUE);
969 		return (B_FALSE);
970 	}
971 
972 	if (strcmp(proto0, "tcp6only") == 0) {
973 		if (strcmp(proto1, "tcp6only") == 0)
974 			return (B_TRUE);
975 		if (strcmp(proto1, "tcp6") == 0)
976 			return (B_TRUE);
977 		return (B_FALSE);
978 	}
979 
980 	if (strcmp(proto0, "udp") == 0) {
981 		if (strcmp(proto1, "udp") == 0)
982 			return (B_TRUE);
983 		if (strcmp(proto1, "udp6") == 0)
984 			return (B_TRUE);
985 		return (B_FALSE);
986 	}
987 
988 	if (strcmp(proto0, "udp6") == 0) {
989 
990 		if (strcmp(proto1, "udp") == 0)
991 			return (B_TRUE);
992 		if (strcmp(proto1, "udp6only") == 0)
993 			return (B_TRUE);
994 		if (strcmp(proto1, "udp6") == 0)
995 			return (B_TRUE);
996 		return (B_FALSE);
997 	}
998 
999 	if (strcmp(proto0, "udp6only") == 0) {
1000 
1001 		if (strcmp(proto1, "udp6only") == 0)
1002 			return (B_TRUE);
1003 		if (strcmp(proto1, "udp6") == 0)
1004 			return (B_TRUE);
1005 		return (0);
1006 	}
1007 
1008 	/*
1009 	 * If the protocol isn't TCP/IP or UDP/IP assume that it has its own
1010 	 * port namepsace and that conflicts can be detected by literal string
1011 	 * comparison.
1012 	 */
1013 
1014 	if (strcmp(proto0, proto1))
1015 		return (FALSE);
1016 
1017 	return (B_TRUE);
1018 }
1019 
1020 
1021 /*
1022  * Check if inetd thinks this RPC program number is already registered.
1023  *
1024  * An RPC protocol conflict occurs if
1025  * 	a) the program numbers are the same and,
1026  * 	b) the version numbers overlap,
1027  * 	c) the protocols (TCP vs UDP vs tic*) are the same.
1028  */
1029 
1030 boolean_t
1031 is_rpc_num_in_use(int rpc_n, char *proto, int lowver, int highver) {
1032 	instance_t *i;
1033 	basic_cfg_t *cfg;
1034 	proto_info_t *pi;
1035 
1036 	for (i = uu_list_first(instance_list); i != NULL;
1037 	    i = uu_list_next(instance_list, i)) {
1038 
1039 		if (i->cur_istate != IIS_ONLINE)
1040 			continue;
1041 		cfg = i->config->basic;
1042 
1043 		for (pi = uu_list_first(cfg->proto_list); pi != NULL;
1044 		    pi = uu_list_next(cfg->proto_list, pi)) {
1045 
1046 			if (pi->ri == NULL)
1047 				continue;
1048 			if (pi->ri->prognum != rpc_n)
1049 				continue;
1050 			if (!is_rpc_proto_conflict(pi->proto, proto))
1051 				continue;
1052 			if ((lowver < pi->ri->lowver &&
1053 			    highver < pi->ri->lowver) ||
1054 			    (lowver > pi->ri->highver &&
1055 			    highver > pi->ri->highver))
1056 				continue;
1057 			return (B_TRUE);
1058 		}
1059 	}
1060 	return (B_FALSE);
1061 }
1062 
1063 
1064 /*
1065  * Independent of the transport, for each of the entries in the instance's
1066  * proto list this function first attempts to create an associated network fd;
1067  * for RPC services these are then bound to a kernel chosen port and the
1068  * fd is registered with rpcbind; for non-RPC services the fds are bound
1069  * to the port associated with the instance's service name. On any successful
1070  * binds the instance is taken online. Failed binds are handled by
1071  * handle_bind_failure().
1072  */
1073 void
1074 create_bound_fds(instance_t *instance)
1075 {
1076 	basic_cfg_t	*cfg = instance->config->basic;
1077 	boolean_t	failure = B_FALSE;
1078 	boolean_t	success = B_FALSE;
1079 	proto_info_t	*pi;
1080 
1081 	/*
1082 	 * Loop through and try and bind any unbound protos.
1083 	 */
1084 	for (pi = uu_list_first(cfg->proto_list); pi != NULL;
1085 	    pi = uu_list_next(cfg->proto_list, pi)) {
1086 		if (pi->listen_fd != -1)
1087 			continue;
1088 		if (cfg->istlx) {
1089 			pi->listen_fd = create_bound_endpoint(instance,
1090 			    (tlx_info_t *)pi);
1091 		} else {
1092 			/*
1093 			 * We cast pi to a void so we can then go on to cast
1094 			 * it to a socket_info_t without lint complaining
1095 			 * about alignment. This is done because the x86
1096 			 * version of lint thinks a lint suppression directive
1097 			 * is unnecessary and flags it as such, yet the sparc
1098 			 * version complains if it's absent.
1099 			 */
1100 			void *p = pi;
1101 			pi->listen_fd = create_bound_socket(instance,
1102 			    (socket_info_t *)p);
1103 		}
1104 		if (pi->listen_fd == -1) {
1105 			failure = B_TRUE;
1106 			continue;
1107 		}
1108 
1109 		if (pi->ri != NULL) {
1110 
1111 			/*
1112 			 * Don't register the same RPC program number twice.
1113 			 * Doing so silently discards the old service
1114 			 * without causing an error.
1115 			 */
1116 			if (is_rpc_num_in_use(pi->ri->prognum, pi->proto,
1117 			    pi->ri->lowver, pi->ri->highver)) {
1118 				failure = B_TRUE;
1119 				close_net_fd(instance, pi->listen_fd);
1120 				pi->listen_fd = -1;
1121 				continue;
1122 			}
1123 
1124 			unregister_rpc_service(instance->fmri, pi->ri);
1125 			if (register_rpc_service(instance->fmri, pi->ri) ==
1126 			    -1) {
1127 				close_net_fd(instance, pi->listen_fd);
1128 				pi->listen_fd = -1;
1129 				failure = B_TRUE;
1130 				continue;
1131 			}
1132 		}
1133 
1134 		success = B_TRUE;
1135 	}
1136 
1137 	switch (instance->cur_istate) {
1138 	case IIS_OFFLINE:
1139 	case IIS_OFFLINE_BIND:
1140 		/*
1141 		 * If we've managed to bind at least one proto lets run the
1142 		 * online method, so we can start listening for it.
1143 		 */
1144 		if (success && run_method(instance, IM_ONLINE, NULL) == -1)
1145 			return;	/* instance gone to maintenance */
1146 		break;
1147 	case IIS_ONLINE:
1148 	case IIS_IN_REFRESH_METHOD:
1149 		/*
1150 		 * We're 'online', so start polling on any bound fds we're
1151 		 * currently not.
1152 		 */
1153 		if (poll_bound_fds(instance, B_TRUE, NULL) != 0) {
1154 			failure = B_TRUE;
1155 		} else if (!failure) {
1156 			/*
1157 			 * We've successfully bound and poll'd upon all protos,
1158 			 * so reset the failure count.
1159 			 */
1160 			instance->bind_fail_count = 0;
1161 		}
1162 		break;
1163 	case IIS_IN_ONLINE_METHOD:
1164 		/*
1165 		 * Nothing to do here as the method completion code will start
1166 		 * listening for any successfully bound fds.
1167 		 */
1168 		break;
1169 	default:
1170 #ifndef NDEBUG
1171 		(void) fprintf(stderr, "%s:%d: Unknown instance state %d.\n",
1172 		    __FILE__, __LINE__, instance->cur_istate);
1173 #endif
1174 		abort();
1175 	}
1176 
1177 	if (failure)
1178 		handle_bind_failure(instance);
1179 }
1180 
1181 /*
1182  * Counter to create_bound_fds(), for each of the bound network fds this
1183  * function unregisters the instance from rpcbind if it's an RPC service,
1184  * stops listening for new connections for it and then closes the listening fd.
1185  */
1186 static void
1187 destroy_bound_fds(instance_t *instance)
1188 {
1189 	basic_cfg_t	*cfg = instance->config->basic;
1190 	proto_info_t	*pi;
1191 
1192 	for (pi = uu_list_first(cfg->proto_list); pi != NULL;
1193 	    pi = uu_list_next(cfg->proto_list, pi)) {
1194 		if (pi->listen_fd != -1) {
1195 			if (pi->ri != NULL)
1196 				unregister_rpc_service(instance->fmri, pi->ri);
1197 			clear_pollfd(pi->listen_fd);
1198 			close_net_fd(instance, pi->listen_fd);
1199 			pi->listen_fd = -1;
1200 		}
1201 	}
1202 
1203 	/* cancel any bind retries */
1204 	if (instance->bind_timer_id != -1)
1205 		cancel_bind_timer(instance);
1206 
1207 	instance->bind_retries_exceeded = B_FALSE;
1208 }
1209 
1210 /*
1211  * Perform %A address expansion and return a pointer to a static string
1212  * array containing crafted arguments. This expansion is provided for
1213  * compatibility with 4.2BSD daemons, and as such we've copied the logic of
1214  * the legacy inetd to maintain this compatibility as much as possible. This
1215  * logic is a bit scatty, but it dates back at least as far as SunOS 4.x.
1216  */
1217 static char **
1218 expand_address(instance_t *inst, const proto_info_t *pi)
1219 {
1220 	static char	addrbuf[sizeof ("ffffffff.65536")];
1221 	static char	*ret[3];
1222 	instance_cfg_t	*cfg = inst->config;
1223 	/*
1224 	 * We cast pi to a void so we can then go on to cast it to a
1225 	 * socket_info_t without lint complaining about alignment. This
1226 	 * is done because the x86 version of lint thinks a lint suppression
1227 	 * directive is unnecessary and flags it as such, yet the sparc
1228 	 * version complains if it's absent.
1229 	 */
1230 	const void	*p = pi;
1231 
1232 	/* set ret[0] to the basename of exec path */
1233 	if ((ret[0] = strrchr(cfg->methods[IM_START]->exec_path, '/'))
1234 	    != NULL) {
1235 		ret[0]++;
1236 	} else {
1237 		ret[0] = cfg->methods[IM_START]->exec_path;
1238 	}
1239 
1240 	if (!cfg->basic->istlx &&
1241 	    (((socket_info_t *)p)->type == SOCK_DGRAM)) {
1242 		ret[1] = NULL;
1243 	} else {
1244 		addrbuf[0] = '\0';
1245 		if (!cfg->basic->iswait &&
1246 		    (inst->remote_addr.ss_family == AF_INET)) {
1247 			struct sockaddr_in *sp;
1248 
1249 			sp = (struct sockaddr_in *)&(inst->remote_addr);
1250 			(void) snprintf(addrbuf, sizeof (addrbuf), "%x.%hu",
1251 			    ntohl(sp->sin_addr.s_addr), ntohs(sp->sin_port));
1252 		}
1253 		ret[1] = addrbuf;
1254 		ret[2] = NULL;
1255 	}
1256 
1257 	return (ret);
1258 }
1259 
1260 /*
1261  * Returns the state associated with the supplied method being run for an
1262  * instance.
1263  */
1264 static internal_inst_state_t
1265 get_method_state(instance_method_t method)
1266 {
1267 	state_info_t *sip;
1268 
1269 	for (sip = states; sip->istate != IIS_NONE; sip++) {
1270 		if (sip->method_running == method)
1271 			break;
1272 	}
1273 	assert(sip->istate != IIS_NONE);
1274 
1275 	return (sip->istate);
1276 }
1277 
1278 /*
1279  * Store the method's PID and CID in the repository. If the store fails
1280  * we ignore it and just drive on.
1281  */
1282 static void
1283 add_method_ids(instance_t *ins, pid_t pid, ctid_t cid, instance_method_t mthd)
1284 {
1285 	if (cid != -1)
1286 		(void) add_remove_contract(ins, B_TRUE, cid);
1287 
1288 	if (mthd == IM_START) {
1289 		if (add_rep_val(ins->start_pids, (int64_t)pid) == 0) {
1290 			(void) store_rep_vals(ins->start_pids, ins->fmri,
1291 			    PR_NAME_START_PIDS);
1292 		}
1293 	} else {
1294 		if (add_rep_val(ins->non_start_pid, (int64_t)pid) == 0) {
1295 			(void) store_rep_vals(ins->non_start_pid, ins->fmri,
1296 			    PR_NAME_NON_START_PID);
1297 		}
1298 	}
1299 }
1300 
1301 /*
1302  * Remove the method's PID and CID from the repository. If the removal
1303  * fails we ignore it and drive on.
1304  */
1305 void
1306 remove_method_ids(instance_t *inst, pid_t pid, ctid_t cid,
1307     instance_method_t mthd)
1308 {
1309 	if (cid != -1)
1310 		(void) add_remove_contract(inst, B_FALSE, cid);
1311 
1312 	if (mthd == IM_START) {
1313 		remove_rep_val(inst->start_pids, (int64_t)pid);
1314 		(void) store_rep_vals(inst->start_pids, inst->fmri,
1315 		    PR_NAME_START_PIDS);
1316 	} else {
1317 		remove_rep_val(inst->non_start_pid, (int64_t)pid);
1318 		(void) store_rep_vals(inst->non_start_pid, inst->fmri,
1319 		    PR_NAME_NON_START_PID);
1320 	}
1321 }
1322 
1323 static instance_t *
1324 create_instance(const char *fmri)
1325 {
1326 	instance_t *ret;
1327 
1328 	if (((ret = calloc(1, sizeof (instance_t))) == NULL) ||
1329 	    ((ret->fmri = strdup(fmri)) == NULL))
1330 		goto alloc_fail;
1331 
1332 	ret->conn_fd = -1;
1333 
1334 	ret->copies = 0;
1335 
1336 	ret->conn_rate_count = 0;
1337 	ret->fail_rate_count = 0;
1338 	ret->bind_fail_count = 0;
1339 
1340 	if (((ret->non_start_pid = create_rep_val_list()) == NULL) ||
1341 	    ((ret->start_pids = create_rep_val_list()) == NULL) ||
1342 	    ((ret->start_ctids = create_rep_val_list()) == NULL))
1343 		goto alloc_fail;
1344 
1345 	ret->cur_istate = IIS_NONE;
1346 	ret->next_istate = IIS_NONE;
1347 
1348 	if (((ret->cur_istate_rep = create_rep_val_list()) == NULL) ||
1349 	    ((ret->next_istate_rep = create_rep_val_list()) == NULL))
1350 		goto alloc_fail;
1351 
1352 	ret->config = NULL;
1353 	ret->new_config = NULL;
1354 
1355 	ret->timer_id = -1;
1356 	ret->bind_timer_id = -1;
1357 
1358 	ret->disable_req = B_FALSE;
1359 	ret->maintenance_req = B_FALSE;
1360 	ret->conn_rate_exceeded = B_FALSE;
1361 	ret->bind_retries_exceeded = B_FALSE;
1362 
1363 	ret->pending_rst_event = RESTARTER_EVENT_TYPE_INVALID;
1364 
1365 	return (ret);
1366 
1367 alloc_fail:
1368 	error_msg(strerror(errno));
1369 	destroy_instance(ret);
1370 	return (NULL);
1371 }
1372 
1373 static void
1374 destroy_instance(instance_t *inst)
1375 {
1376 	if (inst == NULL)
1377 		return;
1378 
1379 	destroy_instance_cfg(inst->config);
1380 	destroy_instance_cfg(inst->new_config);
1381 
1382 	destroy_rep_val_list(inst->cur_istate_rep);
1383 	destroy_rep_val_list(inst->next_istate_rep);
1384 
1385 	destroy_rep_val_list(inst->start_pids);
1386 	destroy_rep_val_list(inst->non_start_pid);
1387 	destroy_rep_val_list(inst->start_ctids);
1388 
1389 	free(inst->fmri);
1390 
1391 	free(inst);
1392 }
1393 
1394 /*
1395  * Retrieves the current and next states internal states. Returns 0 on success,
1396  * else returns one of the following on error:
1397  * SCF_ERROR_NO_MEMORY if memory allocation failed.
1398  * SCF_ERROR_CONNECTION_BROKEN if the connection to the repository was broken.
1399  * SCF_ERROR_TYPE_MISMATCH if the property was of an unexpected type.
1400  * SCF_ERROR_NO_RESOURCES if the server doesn't have adequate resources.
1401  * SCF_ERROR_NO_SERVER if the server isn't running.
1402  */
1403 static scf_error_t
1404 retrieve_instance_state(instance_t *inst)
1405 {
1406 	scf_error_t	ret;
1407 
1408 	/* retrieve internal states */
1409 	if (((ret = retrieve_rep_vals(inst->cur_istate_rep, inst->fmri,
1410 	    PR_NAME_CUR_INT_STATE)) != 0) ||
1411 	    ((ret = retrieve_rep_vals(inst->next_istate_rep, inst->fmri,
1412 	    PR_NAME_NEXT_INT_STATE)) != 0)) {
1413 		if (ret != SCF_ERROR_NOT_FOUND) {
1414 			error_msg(gettext(
1415 			    "Failed to read state of instance %s: %s"),
1416 			    inst->fmri, scf_strerror(scf_error()));
1417 			return (ret);
1418 		}
1419 
1420 		debug_msg("instance with no previous int state - "
1421 		    "setting state to uninitialized");
1422 
1423 		if ((set_single_rep_val(inst->cur_istate_rep,
1424 		    (int64_t)IIS_UNINITIALIZED) == -1) ||
1425 		    (set_single_rep_val(inst->next_istate_rep,
1426 		    (int64_t)IIS_NONE) == -1)) {
1427 			return (SCF_ERROR_NO_MEMORY);
1428 		}
1429 	}
1430 
1431 	/* update convenience states */
1432 	inst->cur_istate = get_single_rep_val(inst->cur_istate_rep);
1433 	inst->next_istate = get_single_rep_val(inst->next_istate_rep);
1434 	return (0);
1435 }
1436 
1437 /*
1438  * Retrieve stored process ids and register each of them so we process their
1439  * termination.
1440  */
1441 static int
1442 retrieve_method_pids(instance_t *inst)
1443 {
1444 	rep_val_t	*rv;
1445 
1446 	switch (retrieve_rep_vals(inst->start_pids, inst->fmri,
1447 	    PR_NAME_START_PIDS)) {
1448 	case 0:
1449 		break;
1450 	case SCF_ERROR_NOT_FOUND:
1451 		return (0);
1452 	default:
1453 		error_msg(gettext("Failed to retrieve the start pids of "
1454 		    "instance %s from repository: %s"), inst->fmri,
1455 		    scf_strerror(scf_error()));
1456 		return (-1);
1457 	}
1458 
1459 	rv = uu_list_first(inst->start_pids);
1460 	while (rv != NULL) {
1461 		if (register_method(inst, (pid_t)rv->val, (ctid_t)-1,
1462 		    IM_START, NULL) == 0) {
1463 			inst->copies++;
1464 			rv = uu_list_next(inst->start_pids, rv);
1465 		} else if (errno == ENOENT) {
1466 			pid_t pid = (pid_t)rv->val;
1467 
1468 			/*
1469 			 * The process must have already terminated. Remove
1470 			 * it from the list.
1471 			 */
1472 			rv = uu_list_next(inst->start_pids, rv);
1473 			remove_rep_val(inst->start_pids, pid);
1474 		} else {
1475 			error_msg(gettext("Failed to listen for the completion "
1476 			    "of %s method of instance %s"), START_METHOD_NAME,
1477 			    inst->fmri);
1478 			rv = uu_list_next(inst->start_pids, rv);
1479 		}
1480 	}
1481 
1482 	/* synch the repository pid list to remove any terminated pids */
1483 	(void) store_rep_vals(inst->start_pids, inst->fmri, PR_NAME_START_PIDS);
1484 
1485 	return (0);
1486 }
1487 
1488 /*
1489  * Remove the passed instance from inetd control.
1490  */
1491 static void
1492 remove_instance(instance_t *instance)
1493 {
1494 	switch (instance->cur_istate) {
1495 	case IIS_ONLINE:
1496 	case IIS_DEGRADED:
1497 		/* stop listening for network connections */
1498 		destroy_bound_fds(instance);
1499 		break;
1500 	case IIS_OFFLINE_BIND:
1501 		cancel_bind_timer(instance);
1502 		break;
1503 	case IIS_OFFLINE_CONRATE:
1504 		cancel_inst_timer(instance);
1505 		break;
1506 	}
1507 
1508 	/* stop listening for terminated methods */
1509 	unregister_instance_methods(instance);
1510 
1511 	uu_list_remove(instance_list, instance);
1512 	destroy_instance(instance);
1513 }
1514 
1515 /*
1516  * Refresh the configuration of instance 'inst'. This method gets called as
1517  * a result of a refresh event for the instance from the master restarter, so
1518  * we can rely upon the instance's running snapshot having been updated from
1519  * its configuration snapshot.
1520  */
1521 void
1522 refresh_instance(instance_t *inst)
1523 {
1524 	instance_cfg_t	*cfg;
1525 
1526 	switch (inst->cur_istate) {
1527 	case IIS_MAINTENANCE:
1528 	case IIS_DISABLED:
1529 	case IIS_UNINITIALIZED:
1530 		/*
1531 		 * Ignore any possible changes, we'll re-read the configuration
1532 		 * automatically when we exit these states.
1533 		 */
1534 		break;
1535 
1536 	case IIS_OFFLINE_COPIES:
1537 	case IIS_OFFLINE_BIND:
1538 	case IIS_OFFLINE:
1539 	case IIS_OFFLINE_CONRATE:
1540 		destroy_instance_cfg(inst->config);
1541 		if ((inst->config = read_instance_cfg(inst->fmri)) == NULL) {
1542 			log_invalid_cfg(inst->fmri);
1543 			if (inst->cur_istate == IIS_OFFLINE_BIND) {
1544 				cancel_bind_timer(inst);
1545 			} else if (inst->cur_istate == IIS_OFFLINE_CONRATE) {
1546 				cancel_inst_timer(inst);
1547 			}
1548 			update_state(inst, IIS_MAINTENANCE, RERR_FAULT);
1549 		} else {
1550 			switch (inst->cur_istate) {
1551 			case IIS_OFFLINE_BIND:
1552 				if (copies_limit_exceeded(inst)) {
1553 					/* Cancel scheduled bind retries. */
1554 					cancel_bind_timer(inst);
1555 
1556 					/*
1557 					 * Take the instance to the copies
1558 					 * offline state, via the offline
1559 					 * state.
1560 					 */
1561 					update_state(inst, IIS_OFFLINE,
1562 					    RERR_RESTART);
1563 					process_offline_inst(inst);
1564 				}
1565 				break;
1566 
1567 			case IIS_OFFLINE:
1568 				process_offline_inst(inst);
1569 				break;
1570 
1571 			case IIS_OFFLINE_CONRATE:
1572 				/*
1573 				 * Since we're already in a DOS state,
1574 				 * don't bother evaluating the copies
1575 				 * limit. This will be evaluated when
1576 				 * we leave this state in
1577 				 * process_offline_inst().
1578 				 */
1579 				break;
1580 
1581 			case IIS_OFFLINE_COPIES:
1582 				/*
1583 				 * Check if the copies limit has been increased
1584 				 * above the current count.
1585 				 */
1586 				if (!copies_limit_exceeded(inst)) {
1587 					update_state(inst, IIS_OFFLINE,
1588 					    RERR_RESTART);
1589 					process_offline_inst(inst);
1590 				}
1591 				break;
1592 
1593 			default:
1594 				assert(0);
1595 			}
1596 		}
1597 		break;
1598 
1599 	case IIS_DEGRADED:
1600 	case IIS_ONLINE:
1601 		if ((cfg = read_instance_cfg(inst->fmri)) != NULL) {
1602 			instance_cfg_t *ocfg = inst->config;
1603 
1604 			/*
1605 			 * Try to avoid the overhead of taking an instance
1606 			 * offline and back on again. We do this by limiting
1607 			 * this behavior to two eventualities:
1608 			 * - there needs to be a re-bind to listen on behalf
1609 			 *   of the instance with its new configuration. This
1610 			 *   could be because for example its service has been
1611 			 *   associated with a different port, or because the
1612 			 *   v6only protocol option has been newly applied to
1613 			 *   the instance.
1614 			 * - one or both of the start or online methods of the
1615 			 *   instance have changed in the new configuration.
1616 			 *   Without taking the instance offline when the
1617 			 *   start method changed the instance may be running
1618 			 *   with unwanted parameters (or event an unwanted
1619 			 *   binary); and without taking the instance offline
1620 			 *   if its online method was to change, some part of
1621 			 *   its running environment may have changed and would
1622 			 *   not be picked up until the instance next goes
1623 			 *   offline for another reason.
1624 			 */
1625 			if ((!bind_config_equal(ocfg->basic, cfg->basic)) ||
1626 			    !method_info_equal(ocfg->methods[IM_ONLINE],
1627 			    cfg->methods[IM_ONLINE]) ||
1628 			    !method_info_equal(ocfg->methods[IM_START],
1629 			    cfg->methods[IM_START])) {
1630 				destroy_bound_fds(inst);
1631 
1632 				assert(inst->new_config == NULL);
1633 				inst->new_config = cfg;
1634 
1635 				(void) run_method(inst, IM_OFFLINE, NULL);
1636 			} else {	/* no bind config / method changes */
1637 
1638 				/*
1639 				 * swap the proto list over from the old
1640 				 * configuration to the new, so we retain
1641 				 * our set of network fds.
1642 				 */
1643 				destroy_proto_list(cfg->basic);
1644 				cfg->basic->proto_list =
1645 				    ocfg->basic->proto_list;
1646 				ocfg->basic->proto_list = NULL;
1647 				destroy_instance_cfg(ocfg);
1648 				inst->config = cfg;
1649 
1650 				/* re-evaluate copies limits based on new cfg */
1651 				if (copies_limit_exceeded(inst)) {
1652 					destroy_bound_fds(inst);
1653 					(void) run_method(inst, IM_OFFLINE,
1654 					    NULL);
1655 				} else {
1656 					/*
1657 					 * Since the instance isn't being
1658 					 * taken offline, where we assume it
1659 					 * would pick-up any configuration
1660 					 * changes automatically when it goes
1661 					 * back online, run its refresh method
1662 					 * to allow it to pick-up any changes
1663 					 * whilst still online.
1664 					 */
1665 					(void) run_method(inst, IM_REFRESH,
1666 					    NULL);
1667 				}
1668 			}
1669 		} else {
1670 			log_invalid_cfg(inst->fmri);
1671 
1672 			destroy_bound_fds(inst);
1673 
1674 			inst->maintenance_req = B_TRUE;
1675 			(void) run_method(inst, IM_OFFLINE, NULL);
1676 		}
1677 		break;
1678 
1679 	default:
1680 		debug_msg("Unhandled current state %d for instance in "
1681 		    "refresh_instance", inst->cur_istate);
1682 		assert(0);
1683 	}
1684 }
1685 
1686 /*
1687  * Called by process_restarter_event() to handle a restarter event for an
1688  * instance.
1689  */
1690 static void
1691 handle_restarter_event(instance_t *instance, restarter_event_type_t event,
1692     boolean_t send_ack)
1693 {
1694 	switch (event) {
1695 	case RESTARTER_EVENT_TYPE_ADD_INSTANCE:
1696 		/*
1697 		 * When startd restarts, it sends _ADD_INSTANCE to delegated
1698 		 * restarters for all those services managed by them. We should
1699 		 * acknowledge this event, as startd's graph needs to be updated
1700 		 * about the current state of the service, when startd is
1701 		 * restarting.
1702 		 * update_state() is ok to be called here, as commands for
1703 		 * instances in transition are deferred by
1704 		 * process_restarter_event().
1705 		 */
1706 		update_state(instance, instance->cur_istate, RERR_NONE);
1707 		goto done;
1708 	case RESTARTER_EVENT_TYPE_ADMIN_REFRESH:
1709 		refresh_instance(instance);
1710 		goto done;
1711 	case RESTARTER_EVENT_TYPE_ADMIN_RESTART:
1712 		/*
1713 		 * We've got a restart event, so if the instance is online
1714 		 * in any way initiate taking it offline, and rely upon
1715 		 * our restarter to send us an online event to bring
1716 		 * it back online.
1717 		 */
1718 		switch (instance->cur_istate) {
1719 		case IIS_ONLINE:
1720 		case IIS_DEGRADED:
1721 			destroy_bound_fds(instance);
1722 			(void) run_method(instance, IM_OFFLINE, NULL);
1723 		}
1724 		goto done;
1725 	case RESTARTER_EVENT_TYPE_REMOVE_INSTANCE:
1726 		remove_instance(instance);
1727 		goto done;
1728 	case RESTARTER_EVENT_TYPE_STOP_RESET:
1729 	case RESTARTER_EVENT_TYPE_STOP:
1730 		switch (instance->cur_istate) {
1731 		case IIS_OFFLINE_CONRATE:
1732 		case IIS_OFFLINE_BIND:
1733 		case IIS_OFFLINE_COPIES:
1734 			/*
1735 			 * inetd must be closing down as we wouldn't get this
1736 			 * event in one of these states from the master
1737 			 * restarter. Take the instance to the offline resting
1738 			 * state.
1739 			 */
1740 			if (instance->cur_istate == IIS_OFFLINE_BIND) {
1741 				cancel_bind_timer(instance);
1742 			} else if (instance->cur_istate ==
1743 			    IIS_OFFLINE_CONRATE) {
1744 				cancel_inst_timer(instance);
1745 			}
1746 			update_state(instance, IIS_OFFLINE, RERR_RESTART);
1747 			goto done;
1748 		}
1749 		break;
1750 	}
1751 
1752 	switch (instance->cur_istate) {
1753 	case IIS_OFFLINE:
1754 		switch (event) {
1755 		case RESTARTER_EVENT_TYPE_START:
1756 			/*
1757 			 * Dependencies are met, let's take the service online.
1758 			 * Only try and bind for a wait type service if
1759 			 * no process is running on its behalf. Otherwise, just
1760 			 * mark the service online and binding will be attempted
1761 			 * when the process exits.
1762 			 */
1763 			if (!(instance->config->basic->iswait &&
1764 			    (uu_list_first(instance->start_pids) != NULL))) {
1765 				create_bound_fds(instance);
1766 			} else {
1767 				update_state(instance, IIS_ONLINE, RERR_NONE);
1768 			}
1769 			break;
1770 		case RESTARTER_EVENT_TYPE_DISABLE:
1771 		case RESTARTER_EVENT_TYPE_ADMIN_DISABLE:
1772 			/*
1773 			 * The instance should be disabled, so run the
1774 			 * instance's disabled method that will do the work
1775 			 * to take it there.
1776 			 */
1777 			(void) run_method(instance, IM_DISABLE, NULL);
1778 			break;
1779 		case RESTARTER_EVENT_TYPE_ADMIN_MAINT_ON:
1780 		case RESTARTER_EVENT_TYPE_DEPENDENCY_CYCLE:
1781 		case RESTARTER_EVENT_TYPE_INVALID_DEPENDENCY:
1782 			/*
1783 			 * The master restarter has requested the instance
1784 			 * go to maintenance; since we're already offline
1785 			 * just update the state to the maintenance state.
1786 			 */
1787 			update_state(instance, IIS_MAINTENANCE, RERR_RESTART);
1788 			break;
1789 		}
1790 		break;
1791 
1792 	case IIS_OFFLINE_BIND:
1793 		switch (event) {
1794 		case RESTARTER_EVENT_TYPE_DISABLE:
1795 		case RESTARTER_EVENT_TYPE_ADMIN_DISABLE:
1796 			/*
1797 			 * The instance should be disabled. Firstly, as for
1798 			 * the above dependencies unmet comment, cancel
1799 			 * the bind retry timer and update the state to
1800 			 * offline. Then, run the disable method to do the
1801 			 * work to take the instance from offline to
1802 			 * disabled.
1803 			 */
1804 			cancel_bind_timer(instance);
1805 			update_state(instance, IIS_OFFLINE, RERR_RESTART);
1806 			(void) run_method(instance, IM_DISABLE, NULL);
1807 			break;
1808 		case RESTARTER_EVENT_TYPE_ADMIN_MAINT_ON:
1809 		case RESTARTER_EVENT_TYPE_DEPENDENCY_CYCLE:
1810 		case RESTARTER_EVENT_TYPE_INVALID_DEPENDENCY:
1811 			/*
1812 			 * The master restarter has requested the instance
1813 			 * be placed in the maintenance state. Cancel the
1814 			 * outstanding retry timer, and since we're already
1815 			 * offline, update the state to maintenance.
1816 			 */
1817 			cancel_bind_timer(instance);
1818 			update_state(instance, IIS_MAINTENANCE, RERR_RESTART);
1819 			break;
1820 		}
1821 		break;
1822 
1823 	case IIS_DEGRADED:
1824 	case IIS_ONLINE:
1825 		switch (event) {
1826 		case RESTARTER_EVENT_TYPE_DISABLE:
1827 		case RESTARTER_EVENT_TYPE_ADMIN_DISABLE:
1828 			/*
1829 			 * The instance needs to be disabled. Do the same work
1830 			 * as for the dependencies unmet event below to
1831 			 * take the instance offline.
1832 			 */
1833 			destroy_bound_fds(instance);
1834 			/*
1835 			 * Indicate that the offline method is being run
1836 			 * as part of going to the disabled state, and to
1837 			 * carry on this transition.
1838 			 */
1839 			instance->disable_req = B_TRUE;
1840 			(void) run_method(instance, IM_OFFLINE, NULL);
1841 			break;
1842 		case RESTARTER_EVENT_TYPE_ADMIN_MAINT_ON:
1843 		case RESTARTER_EVENT_TYPE_DEPENDENCY_CYCLE:
1844 		case RESTARTER_EVENT_TYPE_INVALID_DEPENDENCY:
1845 			/*
1846 			 * The master restarter has requested the instance be
1847 			 * placed in the maintenance state. This involves
1848 			 * firstly taking the service offline, so do the
1849 			 * same work as for the dependencies unmet event
1850 			 * below. We set the maintenance_req flag to
1851 			 * indicate that when we get to the offline state
1852 			 * we should be placed directly into the maintenance
1853 			 * state.
1854 			 */
1855 			instance->maintenance_req = B_TRUE;
1856 			/* FALLTHROUGH */
1857 		case RESTARTER_EVENT_TYPE_STOP_RESET:
1858 		case RESTARTER_EVENT_TYPE_STOP:
1859 			/*
1860 			 * Dependencies have become unmet. Close and
1861 			 * stop listening on the instance's network file
1862 			 * descriptor, and run the offline method to do
1863 			 * any work required to take us to the offline state.
1864 			 */
1865 			destroy_bound_fds(instance);
1866 			(void) run_method(instance, IM_OFFLINE, NULL);
1867 		}
1868 		break;
1869 
1870 	case IIS_UNINITIALIZED:
1871 		if (event == RESTARTER_EVENT_TYPE_DISABLE ||
1872 		    event == RESTARTER_EVENT_TYPE_ADMIN_DISABLE) {
1873 			update_state(instance, IIS_DISABLED, RERR_NONE);
1874 			break;
1875 		} else if (event != RESTARTER_EVENT_TYPE_ENABLE) {
1876 			/*
1877 			 * Ignore other events until we know whether we're
1878 			 * enabled or not.
1879 			 */
1880 			break;
1881 		}
1882 
1883 		/*
1884 		 * We've got an enabled event; make use of the handling in the
1885 		 * disable case.
1886 		 */
1887 		/* FALLTHROUGH */
1888 
1889 	case IIS_DISABLED:
1890 		switch (event) {
1891 		case RESTARTER_EVENT_TYPE_ENABLE:
1892 			/*
1893 			 * The instance needs enabling. Commence reading its
1894 			 * configuration and if successful place the instance
1895 			 * in the offline state and let process_offline_inst()
1896 			 * take it from there.
1897 			 */
1898 			destroy_instance_cfg(instance->config);
1899 			instance->config = read_instance_cfg(instance->fmri);
1900 			if (instance->config != NULL) {
1901 				update_state(instance, IIS_OFFLINE,
1902 				    RERR_RESTART);
1903 				process_offline_inst(instance);
1904 			} else {
1905 				log_invalid_cfg(instance->fmri);
1906 				update_state(instance, IIS_MAINTENANCE,
1907 				    RERR_RESTART);
1908 			}
1909 
1910 			break;
1911 		case RESTARTER_EVENT_TYPE_ADMIN_MAINT_ON:
1912 		case RESTARTER_EVENT_TYPE_DEPENDENCY_CYCLE:
1913 		case RESTARTER_EVENT_TYPE_INVALID_DEPENDENCY:
1914 			/*
1915 			 * The master restarter has requested the instance be
1916 			 * placed in the maintenance state, so just update its
1917 			 * state to maintenance.
1918 			 */
1919 			update_state(instance, IIS_MAINTENANCE, RERR_RESTART);
1920 			break;
1921 		}
1922 		break;
1923 
1924 	case IIS_MAINTENANCE:
1925 		switch (event) {
1926 		case RESTARTER_EVENT_TYPE_ADMIN_MAINT_OFF:
1927 		case RESTARTER_EVENT_TYPE_ADMIN_DISABLE:
1928 			/*
1929 			 * The master restarter has requested that the instance
1930 			 * be taken out of maintenance. Read its configuration,
1931 			 * and if successful place the instance in the offline
1932 			 * state and call process_offline_inst() to take it
1933 			 * from there.
1934 			 */
1935 			destroy_instance_cfg(instance->config);
1936 			instance->config = read_instance_cfg(instance->fmri);
1937 			if (instance->config != NULL) {
1938 				update_state(instance, IIS_OFFLINE,
1939 				    RERR_RESTART);
1940 				process_offline_inst(instance);
1941 			} else {
1942 				boolean_t enabled;
1943 
1944 				/*
1945 				 * The configuration was invalid. If the
1946 				 * service has disabled requested, let's
1947 				 * just place the instance in disabled even
1948 				 * though we haven't been able to run its
1949 				 * disable method, as the slightly incorrect
1950 				 * state is likely to be less of an issue to
1951 				 * an administrator than refusing to move an
1952 				 * instance to disabled. If disable isn't
1953 				 * requested, re-mark the service's state
1954 				 * as maintenance, so the administrator can
1955 				 * see the request was processed.
1956 				 */
1957 				if ((read_enable_merged(instance->fmri,
1958 				    &enabled) == 0) && !enabled) {
1959 					update_state(instance, IIS_DISABLED,
1960 					    RERR_RESTART);
1961 				} else {
1962 					log_invalid_cfg(instance->fmri);
1963 					update_state(instance, IIS_MAINTENANCE,
1964 					    RERR_FAULT);
1965 				}
1966 			}
1967 			break;
1968 		}
1969 		break;
1970 
1971 	case IIS_OFFLINE_CONRATE:
1972 		switch (event) {
1973 		case RESTARTER_EVENT_TYPE_DISABLE:
1974 			/*
1975 			 * The instance wants disabling. Take the instance
1976 			 * offline as for the dependencies unmet event above,
1977 			 * and then from there run the disable method to do
1978 			 * the work to take the instance to the disabled state.
1979 			 */
1980 			cancel_inst_timer(instance);
1981 			update_state(instance, IIS_OFFLINE, RERR_RESTART);
1982 			(void) run_method(instance, IM_DISABLE, NULL);
1983 			break;
1984 		case RESTARTER_EVENT_TYPE_ADMIN_MAINT_ON:
1985 		case RESTARTER_EVENT_TYPE_DEPENDENCY_CYCLE:
1986 		case RESTARTER_EVENT_TYPE_INVALID_DEPENDENCY:
1987 			/*
1988 			 * The master restarter has requested the instance
1989 			 * be taken to maintenance. Cancel the timer setup
1990 			 * when we entered this state, and go directly to
1991 			 * maintenance.
1992 			 */
1993 			cancel_inst_timer(instance);
1994 			update_state(instance, IIS_MAINTENANCE, RERR_RESTART);
1995 			break;
1996 		}
1997 		break;
1998 
1999 	case IIS_OFFLINE_COPIES:
2000 		switch (event) {
2001 		case RESTARTER_EVENT_TYPE_DISABLE:
2002 			/*
2003 			 * The instance wants disabling. Update the state
2004 			 * to offline, and run the disable method to do the
2005 			 * work to take it to the disabled state.
2006 			 */
2007 			update_state(instance, IIS_OFFLINE, RERR_RESTART);
2008 			(void) run_method(instance, IM_DISABLE, NULL);
2009 			break;
2010 		case RESTARTER_EVENT_TYPE_ADMIN_MAINT_ON:
2011 		case RESTARTER_EVENT_TYPE_DEPENDENCY_CYCLE:
2012 		case RESTARTER_EVENT_TYPE_INVALID_DEPENDENCY:
2013 			/*
2014 			 * The master restarter has requested the instance be
2015 			 * placed in maintenance. Since it's already offline
2016 			 * simply update the state.
2017 			 */
2018 			update_state(instance, IIS_MAINTENANCE, RERR_RESTART);
2019 			break;
2020 		}
2021 		break;
2022 
2023 	default:
2024 		debug_msg("handle_restarter_event: instance in an "
2025 		    "unexpected state");
2026 		assert(0);
2027 	}
2028 
2029 done:
2030 	if (send_ack)
2031 		ack_restarter_event(B_TRUE);
2032 }
2033 
2034 /*
2035  * Tries to read and process an event from the event pipe. If there isn't one
2036  * or an error occurred processing the event it returns -1. Else, if the event
2037  * is for an instance we're not already managing we read its state, add it to
2038  * our list to manage, and if appropriate read its configuration. Whether it's
2039  * new to us or not, we then handle the specific event.
2040  * Returns 0 if an event was read and processed successfully, else -1.
2041  */
2042 static int
2043 process_restarter_event(void)
2044 {
2045 	char			*fmri;
2046 	size_t			fmri_size;
2047 	restarter_event_type_t  event_type;
2048 	instance_t		*instance;
2049 	restarter_event_t	*event;
2050 	ssize_t			sz;
2051 
2052 	/*
2053 	 * Try to read an event pointer from the event pipe.
2054 	 */
2055 	errno = 0;
2056 	switch (safe_read(rst_event_pipe[PE_CONSUMER], &event,
2057 	    sizeof (event))) {
2058 	case 0:
2059 		break;
2060 	case  1:
2061 		if (errno == EAGAIN)	/* no event to read */
2062 			return (-1);
2063 
2064 		/* other end of pipe closed */
2065 
2066 		/* FALLTHROUGH */
2067 	default:			/* unexpected read error */
2068 		/*
2069 		 * There's something wrong with the event pipe. Let's
2070 		 * shutdown and be restarted.
2071 		 */
2072 		inetd_stop();
2073 		return (-1);
2074 	}
2075 
2076 	/*
2077 	 * Check if we're currently managing the instance which the event
2078 	 * pertains to. If not, read its complete state and add it to our
2079 	 * list to manage.
2080 	 */
2081 
2082 	fmri_size = scf_limit(SCF_LIMIT_MAX_FMRI_LENGTH);
2083 	if ((fmri = malloc(fmri_size)) == NULL) {
2084 		error_msg(strerror(errno));
2085 		goto fail;
2086 	}
2087 	sz = restarter_event_get_instance(event, fmri, fmri_size);
2088 	if (sz >= fmri_size)
2089 		assert(0);
2090 
2091 	for (instance = uu_list_first(instance_list); instance != NULL;
2092 	    instance = uu_list_next(instance_list, instance)) {
2093 		if (strcmp(instance->fmri, fmri) == 0)
2094 			break;
2095 	}
2096 
2097 	if (instance == NULL) {
2098 		int err;
2099 
2100 		debug_msg("New instance to manage: %s", fmri);
2101 
2102 		if (((instance = create_instance(fmri)) == NULL) ||
2103 		    (retrieve_instance_state(instance) != 0) ||
2104 		    (retrieve_method_pids(instance) != 0)) {
2105 			destroy_instance(instance);
2106 			free(fmri);
2107 			goto fail;
2108 		}
2109 
2110 		if (((err = iterate_repository_contracts(instance, 0))
2111 		    != 0) && (err != ENOENT)) {
2112 			error_msg(gettext(
2113 			    "Failed to adopt contracts of instance %s: %s"),
2114 			    instance->fmri, strerror(err));
2115 			destroy_instance(instance);
2116 			free(fmri);
2117 			goto fail;
2118 		}
2119 
2120 		uu_list_node_init(instance, &instance->link, instance_pool);
2121 		(void) uu_list_insert_after(instance_list, NULL, instance);
2122 
2123 		/*
2124 		 * Only read configuration for instances that aren't in any of
2125 		 * the disabled, maintenance or uninitialized states, since
2126 		 * they'll read it on state exit.
2127 		 */
2128 		if ((instance->cur_istate != IIS_DISABLED) &&
2129 		    (instance->cur_istate != IIS_MAINTENANCE) &&
2130 		    (instance->cur_istate != IIS_UNINITIALIZED)) {
2131 			instance->config = read_instance_cfg(instance->fmri);
2132 			if (instance->config == NULL) {
2133 				log_invalid_cfg(instance->fmri);
2134 				update_state(instance, IIS_MAINTENANCE,
2135 				    RERR_FAULT);
2136 			}
2137 		}
2138 	}
2139 
2140 	free(fmri);
2141 
2142 	event_type = restarter_event_get_type(event);
2143 	debug_msg("Event type: %d for instance: %s", event_type,
2144 	    instance->fmri);
2145 
2146 	/*
2147 	 * If the instance is currently running a method, don't process the
2148 	 * event now, but attach it to the instance for processing when
2149 	 * the instance finishes its transition.
2150 	 */
2151 	if (INST_IN_TRANSITION(instance)) {
2152 		debug_msg("storing event %d for instance %s", event_type,
2153 		    instance->fmri);
2154 		instance->pending_rst_event = event_type;
2155 	} else {
2156 		handle_restarter_event(instance, event_type, B_TRUE);
2157 	}
2158 
2159 	return (0);
2160 
2161 fail:
2162 	ack_restarter_event(B_FALSE);
2163 	return (-1);
2164 }
2165 
2166 /*
2167  * Do the state machine processing associated with the termination of instance
2168  * 'inst''s start method for the 'proto_name' protocol if this parameter is not
2169  * NULL.
2170  */
2171 void
2172 process_start_term(instance_t *inst, char *proto_name)
2173 {
2174 	basic_cfg_t	*cfg;
2175 
2176 	inst->copies--;
2177 
2178 	if ((inst->cur_istate == IIS_MAINTENANCE) ||
2179 	    (inst->cur_istate == IIS_DISABLED)) {
2180 		/* do any further processing/checks when we exit these states */
2181 		return;
2182 	}
2183 
2184 	cfg = inst->config->basic;
2185 
2186 	if (cfg->iswait) {
2187 		proto_info_t	*pi;
2188 		boolean_t	listen;
2189 
2190 		switch (inst->cur_istate) {
2191 		case IIS_ONLINE:
2192 		case IIS_DEGRADED:
2193 		case IIS_IN_REFRESH_METHOD:
2194 			/*
2195 			 * A wait type service's start method has exited.
2196 			 * Check if the method was fired off in this inetd's
2197 			 * lifetime, or a previous one; if the former,
2198 			 * re-commence listening on the service's behalf; if
2199 			 * the latter, mark the service offline and let bind
2200 			 * attempts commence.
2201 			 */
2202 			listen = B_FALSE;
2203 			for (pi = uu_list_first(cfg->proto_list); pi != NULL;
2204 			    pi = uu_list_next(cfg->proto_list, pi)) {
2205 				/*
2206 				 * If a bound fd exists, the method was fired
2207 				 * off during this inetd's lifetime.
2208 				 */
2209 				if (pi->listen_fd != -1) {
2210 					listen = B_TRUE;
2211 					if (proto_name == NULL ||
2212 					    strcmp(pi->proto, proto_name) == 0)
2213 						break;
2214 				}
2215 			}
2216 			if (pi != NULL) {
2217 				if (poll_bound_fds(inst, B_TRUE, proto_name) !=
2218 				    0)
2219 					handle_bind_failure(inst);
2220 			} else if (listen == B_FALSE) {
2221 				update_state(inst, IIS_OFFLINE, RERR_RESTART);
2222 				create_bound_fds(inst);
2223 			}
2224 		}
2225 	} else {
2226 		/*
2227 		 * Check if a nowait service should be brought back online
2228 		 * after exceeding its copies limit.
2229 		 */
2230 		if ((inst->cur_istate == IIS_OFFLINE_COPIES) &&
2231 		    !copies_limit_exceeded(inst)) {
2232 			update_state(inst, IIS_OFFLINE, RERR_NONE);
2233 			process_offline_inst(inst);
2234 		}
2235 	}
2236 }
2237 
2238 /*
2239  * If the instance has a pending event process it and initiate the
2240  * acknowledgement.
2241  */
2242 static void
2243 process_pending_rst_event(instance_t *inst)
2244 {
2245 	if (inst->pending_rst_event != RESTARTER_EVENT_TYPE_INVALID) {
2246 		restarter_event_type_t re;
2247 
2248 		debug_msg("Injecting pending event %d for instance %s",
2249 		    inst->pending_rst_event, inst->fmri);
2250 		re = inst->pending_rst_event;
2251 		inst->pending_rst_event = RESTARTER_EVENT_TYPE_INVALID;
2252 		handle_restarter_event(inst, re, B_TRUE);
2253 	}
2254 }
2255 
2256 /*
2257  * Do the state machine processing associated with the termination
2258  * of the specified instance's non-start method with the specified status.
2259  * Once the processing of the termination is done, the function also picks up
2260  * any processing that was blocked on the method running.
2261  */
2262 void
2263 process_non_start_term(instance_t *inst, int status)
2264 {
2265 	boolean_t ran_online_method = B_FALSE;
2266 
2267 	if (status == IMRET_FAILURE) {
2268 		error_msg(gettext("The %s method of instance %s failed, "
2269 		    "transitioning to maintenance"),
2270 		    methods[states[inst->cur_istate].method_running].name,
2271 		    inst->fmri);
2272 
2273 		if ((inst->cur_istate == IIS_IN_ONLINE_METHOD) ||
2274 		    (inst->cur_istate == IIS_IN_REFRESH_METHOD))
2275 			destroy_bound_fds(inst);
2276 
2277 		update_state(inst, IIS_MAINTENANCE, RERR_FAULT);
2278 
2279 		inst->maintenance_req = B_FALSE;
2280 		inst->conn_rate_exceeded = B_FALSE;
2281 
2282 		if (inst->new_config != NULL) {
2283 			destroy_instance_cfg(inst->new_config);
2284 			inst->new_config = NULL;
2285 		}
2286 
2287 		if (!inetd_stopping)
2288 			process_pending_rst_event(inst);
2289 
2290 		return;
2291 	}
2292 
2293 	/* non-failure method return */
2294 
2295 	if (status != IMRET_SUCCESS) {
2296 		/*
2297 		 * An instance method never returned a supported return code.
2298 		 * We'll assume this means the method succeeded for now whilst
2299 		 * non-GL-cognizant methods are used - eg. pkill.
2300 		 */
2301 		debug_msg("The %s method of instance %s returned "
2302 		    "non-compliant exit code: %d, assuming success",
2303 		    methods[states[inst->cur_istate].method_running].name,
2304 		    inst->fmri, status);
2305 	}
2306 
2307 	/*
2308 	 * Update the state from the in-transition state.
2309 	 */
2310 	switch (inst->cur_istate) {
2311 	case IIS_IN_ONLINE_METHOD:
2312 		ran_online_method = B_TRUE;
2313 		/* FALLTHROUGH */
2314 	case IIS_IN_REFRESH_METHOD:
2315 		/*
2316 		 * If we've exhausted the bind retries, flag that by setting
2317 		 * the instance's state to degraded.
2318 		 */
2319 		if (inst->bind_retries_exceeded) {
2320 			update_state(inst, IIS_DEGRADED, RERR_NONE);
2321 			break;
2322 		}
2323 		/* FALLTHROUGH */
2324 	default:
2325 		update_state(inst,
2326 		    methods[states[inst->cur_istate].method_running].dst_state,
2327 		    RERR_NONE);
2328 	}
2329 
2330 	if (inst->cur_istate == IIS_OFFLINE) {
2331 		if (inst->new_config != NULL) {
2332 			/*
2333 			 * This instance was found during refresh to need
2334 			 * taking offline because its newly read configuration
2335 			 * was sufficiently different. Now we're offline,
2336 			 * activate this new configuration.
2337 			 */
2338 			destroy_instance_cfg(inst->config);
2339 			inst->config = inst->new_config;
2340 			inst->new_config = NULL;
2341 		}
2342 
2343 		/* continue/complete any transitions that are in progress */
2344 		process_offline_inst(inst);
2345 
2346 	} else if (ran_online_method) {
2347 		/*
2348 		 * We've just successfully executed the online method. We have
2349 		 * a set of bound network fds that were created before running
2350 		 * this method, so now we're online start listening for
2351 		 * connections on them.
2352 		 */
2353 		if (poll_bound_fds(inst, B_TRUE, NULL) != 0)
2354 			handle_bind_failure(inst);
2355 	}
2356 
2357 	/*
2358 	 * If we're now out of transition (process_offline_inst() could have
2359 	 * fired off another method), carry out any jobs that were blocked by
2360 	 * us being in transition.
2361 	 */
2362 	if (!INST_IN_TRANSITION(inst)) {
2363 		if (inetd_stopping) {
2364 			if (!instance_stopped(inst)) {
2365 				/*
2366 				 * inetd is stopping, and this instance hasn't
2367 				 * been stopped. Inject a stop event.
2368 				 */
2369 				handle_restarter_event(inst,
2370 				    RESTARTER_EVENT_TYPE_STOP, B_FALSE);
2371 			}
2372 		} else {
2373 			process_pending_rst_event(inst);
2374 		}
2375 	}
2376 }
2377 
2378 /*
2379  * Check if configuration file specified is readable. If not return B_FALSE,
2380  * else return B_TRUE.
2381  */
2382 static boolean_t
2383 can_read_file(const char *path)
2384 {
2385 	int	ret;
2386 	int	serrno;
2387 
2388 	do {
2389 		ret = access(path, R_OK);
2390 	} while ((ret < 0) && (errno == EINTR));
2391 	if (ret < 0) {
2392 		if (errno != ENOENT) {
2393 			serrno = errno;
2394 			error_msg(gettext("Failed to access configuration "
2395 			    "file %s for performing modification checks: %s"),
2396 			    path, strerror(errno));
2397 			errno = serrno;
2398 		}
2399 		return (B_FALSE);
2400 	}
2401 	return (B_TRUE);
2402 }
2403 
2404 /*
2405  * Check whether the configuration file has changed contents since inetd
2406  * was last started/refreshed, and if so, log a message indicating that
2407  * inetconv needs to be run.
2408  */
2409 static void
2410 check_conf_file(void)
2411 {
2412 	char		*new_hash;
2413 	char		*old_hash = NULL;
2414 	scf_error_t	ret;
2415 	const char	*file;
2416 
2417 	if (conf_file == NULL) {
2418 		/*
2419 		 * No explicit config file specified, so see if one of the
2420 		 * default two are readable, checking the primary one first
2421 		 * followed by the secondary.
2422 		 */
2423 		if (can_read_file(PRIMARY_DEFAULT_CONF_FILE)) {
2424 			file = PRIMARY_DEFAULT_CONF_FILE;
2425 		} else if ((errno == ENOENT) &&
2426 		    can_read_file(SECONDARY_DEFAULT_CONF_FILE)) {
2427 			file = SECONDARY_DEFAULT_CONF_FILE;
2428 		} else {
2429 			return;
2430 		}
2431 	} else {
2432 		file = conf_file;
2433 		if (!can_read_file(file))
2434 			return;
2435 	}
2436 
2437 	if (calculate_hash(file, &new_hash) == 0) {
2438 		ret = retrieve_inetd_hash(&old_hash);
2439 		if (((ret == SCF_ERROR_NONE) &&
2440 		    (strcmp(old_hash, new_hash) != 0))) {
2441 			/* modified config file */
2442 			warn_msg(gettext(
2443 			    "Configuration file %s has been modified since "
2444 			    "inetconv was last run. \"inetconv -i %s\" must be "
2445 			    "run to apply any changes to the SMF"), file, file);
2446 		} else if ((ret != SCF_ERROR_NOT_FOUND) &&
2447 		    (ret != SCF_ERROR_NONE)) {
2448 			/* No message if hash not yet computed */
2449 			error_msg(gettext("Failed to check whether "
2450 			    "configuration file %s has been modified: %s"),
2451 			    file, scf_strerror(ret));
2452 		}
2453 		free(old_hash);
2454 		free(new_hash);
2455 	} else {
2456 		error_msg(gettext("Failed to check whether configuration file "
2457 		    "%s has been modified: %s"), file, strerror(errno));
2458 	}
2459 }
2460 
2461 /*
2462  * Refresh all inetd's managed instances and check the configuration file
2463  * for any updates since inetconv was last run, logging a message if there
2464  * are. We call the SMF refresh function to refresh each instance so that
2465  * the refresh request goes through the framework, and thus results in the
2466  * running snapshot of each instance being updated from the configuration
2467  * snapshot.
2468  */
2469 static void
2470 inetd_refresh(void)
2471 {
2472 	instance_t	*inst;
2473 
2474 	refresh_debug_flag();
2475 
2476 	/* call libscf to send refresh requests for all managed instances */
2477 	for (inst = uu_list_first(instance_list); inst != NULL;
2478 	    inst = uu_list_next(instance_list, inst)) {
2479 		if (smf_refresh_instance(inst->fmri) < 0) {
2480 			error_msg(gettext("Failed to refresh instance %s: %s"),
2481 			    inst->fmri, scf_strerror(scf_error()));
2482 		}
2483 	}
2484 
2485 	/*
2486 	 * Log a message if the configuration file has changed since inetconv
2487 	 * was last run.
2488 	 */
2489 	check_conf_file();
2490 }
2491 
2492 /*
2493  * Initiate inetd's shutdown.
2494  */
2495 static void
2496 inetd_stop(void)
2497 {
2498 	instance_t *inst;
2499 
2500 	/* Block handling signals for stop and refresh */
2501 	(void) sighold(SIGHUP);
2502 	(void) sighold(SIGTERM);
2503 
2504 	/* Indicate inetd is coming down */
2505 	inetd_stopping = B_TRUE;
2506 
2507 	/* Stop polling on restarter events. */
2508 	clear_pollfd(rst_event_pipe[PE_CONSUMER]);
2509 
2510 	/* Stop polling for any more stop/refresh requests. */
2511 	clear_pollfd(uds_fd);
2512 
2513 	/*
2514 	 * Send a stop event to all currently unstopped instances that
2515 	 * aren't in transition. For those that are in transition, the
2516 	 * event will get sent when the transition completes.
2517 	 */
2518 	for (inst = uu_list_first(instance_list); inst != NULL;
2519 	    inst = uu_list_next(instance_list, inst)) {
2520 		if (!instance_stopped(inst) && !INST_IN_TRANSITION(inst))
2521 			handle_restarter_event(inst,
2522 			    RESTARTER_EVENT_TYPE_STOP, B_FALSE);
2523 	}
2524 }
2525 
2526 /*
2527  * Sets up the intra-inetd-process Unix Domain Socket.
2528  * Returns -1 on error, else 0.
2529  */
2530 static int
2531 uds_init(void)
2532 {
2533 	struct sockaddr_un addr;
2534 
2535 	if ((uds_fd = socket(AF_UNIX, SOCK_STREAM, 0)) < 0) {
2536 		error_msg("socket: %s", strerror(errno));
2537 		return (-1);
2538 	}
2539 
2540 	disable_blocking(uds_fd);
2541 
2542 	(void) unlink(INETD_UDS_PATH);  /* clean-up any stale files */
2543 
2544 	(void) memset(&addr, 0, sizeof (addr));
2545 	addr.sun_family = AF_UNIX;
2546 	/* CONSTCOND */
2547 	assert(sizeof (INETD_UDS_PATH) <= sizeof (addr.sun_path));
2548 	(void) strlcpy(addr.sun_path, INETD_UDS_PATH, sizeof (addr.sun_path));
2549 
2550 	if (bind(uds_fd, (struct sockaddr *)(&addr), sizeof (addr)) < 0) {
2551 		error_msg(gettext("Failed to bind socket to %s: %s"),
2552 		    INETD_UDS_PATH, strerror(errno));
2553 		(void) close(uds_fd);
2554 		return (-1);
2555 	}
2556 
2557 	(void) listen(uds_fd, UDS_BACKLOG);
2558 
2559 	if ((set_pollfd(uds_fd, POLLIN)) == -1) {
2560 		(void) close(uds_fd);
2561 		(void) unlink(INETD_UDS_PATH);
2562 		return (-1);
2563 	}
2564 
2565 	return (0);
2566 }
2567 
2568 static void
2569 uds_fini(void)
2570 {
2571 	if (uds_fd != -1)
2572 		(void) close(uds_fd);
2573 	(void) unlink(INETD_UDS_PATH);
2574 }
2575 
2576 /*
2577  * Handle an incoming request on the Unix Domain Socket. Returns -1 if there
2578  * was an error handling the event, else 0.
2579  */
2580 static int
2581 process_uds_event(void)
2582 {
2583 	uds_request_t		req;
2584 	int			fd;
2585 	struct sockaddr_un	addr;
2586 	socklen_t		len = sizeof (addr);
2587 	int			ret;
2588 	uint_t			retries = 0;
2589 	ucred_t			*ucred = NULL;
2590 	uid_t			euid;
2591 
2592 	do {
2593 		fd = accept(uds_fd, (struct sockaddr *)&addr, &len);
2594 	} while ((fd < 0) && (errno == EINTR));
2595 	if (fd < 0) {
2596 		if (errno != EWOULDBLOCK)
2597 			error_msg("accept failed: %s", strerror(errno));
2598 		return (-1);
2599 	}
2600 
2601 	if (getpeerucred(fd, &ucred) == -1) {
2602 		error_msg("getpeerucred failed: %s", strerror(errno));
2603 		(void) close(fd);
2604 		return (-1);
2605 	}
2606 
2607 	/* Check peer credentials before acting on the request */
2608 	euid = ucred_geteuid(ucred);
2609 	ucred_free(ucred);
2610 	if (euid != 0 && getuid() != euid) {
2611 		debug_msg("peer euid %u != uid %u",
2612 		    (uint_t)euid, (uint_t)getuid());
2613 		(void) close(fd);
2614 		return (-1);
2615 	}
2616 
2617 	for (retries = 0; retries < UDS_RECV_RETRIES; retries++) {
2618 		if (((ret = safe_read(fd, &req, sizeof (req))) != 1) ||
2619 		    (errno != EAGAIN))
2620 			break;
2621 
2622 		(void) poll(NULL, 0, 100);	/* 100ms pause */
2623 	}
2624 
2625 	if (ret != 0) {
2626 		error_msg(gettext("Failed read: %s"), strerror(errno));
2627 		(void) close(fd);
2628 		return (-1);
2629 	}
2630 
2631 	switch (req) {
2632 	case UR_REFRESH_INETD:
2633 		/* flag the request for event_loop() to process */
2634 		refresh_inetd_requested = B_TRUE;
2635 		(void) close(fd);
2636 		break;
2637 	case UR_STOP_INETD:
2638 		inetd_stop();
2639 		break;
2640 	default:
2641 		error_msg("unexpected UDS request");
2642 		(void) close(fd);
2643 		return (-1);
2644 	}
2645 
2646 	return (0);
2647 }
2648 
2649 /*
2650  * Perform checks for common exec string errors. We limit the checks to
2651  * whether the file exists, is a regular file, and has at least one execute
2652  * bit set. We leave the core security checks to exec() so as not to duplicate
2653  * and thus incur the associated drawbacks, but hope to catch the common
2654  * errors here.
2655  */
2656 static boolean_t
2657 passes_basic_exec_checks(const char *instance, const char *method,
2658     const char *path)
2659 {
2660 	struct stat	sbuf;
2661 
2662 	/* check the file exists */
2663 	while (stat(path, &sbuf) == -1) {
2664 		if (errno != EINTR) {
2665 			error_msg(gettext(
2666 			    "Can't stat the %s method of instance %s: %s"),
2667 			    method, instance, strerror(errno));
2668 			return (B_FALSE);
2669 		}
2670 	}
2671 
2672 	/*
2673 	 * Check if the file is a regular file and has at least one execute
2674 	 * bit set.
2675 	 */
2676 	if ((sbuf.st_mode & S_IFMT) != S_IFREG) {
2677 		error_msg(gettext(
2678 		    "The %s method of instance %s isn't a regular file"),
2679 		    method, instance);
2680 		return (B_FALSE);
2681 	} else if ((sbuf.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH)) == 0) {
2682 		error_msg(gettext("The %s method instance %s doesn't have "
2683 		    "any execute permissions set"), method, instance);
2684 		return (B_FALSE);
2685 	}
2686 
2687 	return (B_TRUE);
2688 }
2689 
2690 static void
2691 exec_method(instance_t *instance, instance_method_t method, method_info_t *mi,
2692     struct method_context *mthd_ctxt, const proto_info_t *pi)
2693 {
2694 	char		**args;
2695 	char 		**env;
2696 	const char	*errf;
2697 	int		serrno;
2698 	basic_cfg_t	*cfg = instance->config->basic;
2699 
2700 	if (method == IM_START) {
2701 		/*
2702 		 * If wrappers checks fail, pretend the method was exec'd and
2703 		 * failed.
2704 		 */
2705 		if (!tcp_wrappers_ok(instance))
2706 			exit(IMRET_FAILURE);
2707 	}
2708 
2709 	/*
2710 	 * Revert the disposition of handled signals and ignored signals to
2711 	 * their defaults, unblocking any blocked ones as a side effect.
2712 	 */
2713 	(void) sigset(SIGHUP, SIG_DFL);
2714 	(void) sigset(SIGTERM, SIG_DFL);
2715 	(void) sigset(SIGINT, SIG_DFL);
2716 
2717 	/*
2718 	 * Setup exec arguments. Do this before the fd setup below, so our
2719 	 * logging related file fd doesn't get taken over before we call
2720 	 * expand_address().
2721 	 */
2722 	if ((method == IM_START) &&
2723 	    (strcmp(mi->exec_args_we.we_wordv[0], "%A") == 0)) {
2724 		args = expand_address(instance, pi);
2725 	} else {
2726 		args = mi->exec_args_we.we_wordv;
2727 	}
2728 
2729 	/* Generate audit trail for start operations */
2730 	if (method == IM_START) {
2731 		adt_event_data_t *ae;
2732 		struct sockaddr_storage ss;
2733 		priv_set_t *privset;
2734 		socklen_t sslen = sizeof (ss);
2735 
2736 		if ((ae = adt_alloc_event(audit_handle, ADT_inetd_connect))
2737 		    == NULL) {
2738 			error_msg(gettext("Unable to allocate audit event for "
2739 			    "the %s method of instance %s"),
2740 			    methods[method].name, instance->fmri);
2741 			exit(IMRET_FAILURE);
2742 		}
2743 
2744 		/*
2745 		 * The inetd_connect audit record consists of:
2746 		 *	Service name
2747 		 *	Execution path
2748 		 *	Remote address and port
2749 		 *	Local port
2750 		 *	Process privileges
2751 		 */
2752 		ae->adt_inetd_connect.service_name = cfg->svc_name;
2753 		ae->adt_inetd_connect.cmd = mi->exec_path;
2754 
2755 		if (instance->remote_addr.ss_family == AF_INET) {
2756 			struct in_addr *in = SS_SINADDR(instance->remote_addr);
2757 			ae->adt_inetd_connect.ip_adr[0] = in->s_addr;
2758 			ae->adt_inetd_connect.ip_type = ADT_IPv4;
2759 		} else {
2760 			uint32_t *addr6;
2761 			int i;
2762 
2763 			ae->adt_inetd_connect.ip_type = ADT_IPv6;
2764 			addr6 = (uint32_t *)SS_SINADDR(instance->remote_addr);
2765 			for (i = 0; i < 4; ++i)
2766 				ae->adt_inetd_connect.ip_adr[i] = addr6[i];
2767 		}
2768 
2769 		ae->adt_inetd_connect.ip_remote_port =
2770 		    ntohs(SS_PORT(instance->remote_addr));
2771 
2772 		if (getsockname(instance->conn_fd, (struct sockaddr *)&ss,
2773 		    &sslen) == 0)
2774 			ae->adt_inetd_connect.ip_local_port =
2775 			    ntohs(SS_PORT(ss));
2776 
2777 		privset = mthd_ctxt->priv_set;
2778 		if (privset == NULL) {
2779 			privset = priv_allocset();
2780 			if (privset != NULL &&
2781 			    getppriv(PRIV_EFFECTIVE, privset) != 0) {
2782 				priv_freeset(privset);
2783 				privset = NULL;
2784 			}
2785 		}
2786 
2787 		ae->adt_inetd_connect.privileges = privset;
2788 
2789 		(void) adt_put_event(ae, ADT_SUCCESS, ADT_SUCCESS);
2790 		adt_free_event(ae);
2791 
2792 		if (privset != NULL && mthd_ctxt->priv_set == NULL)
2793 			priv_freeset(privset);
2794 	}
2795 
2796 	/*
2797 	 * Set method context before the fd setup below so we can output an
2798 	 * error message if it fails.
2799 	 */
2800 	if ((errno = restarter_set_method_context(mthd_ctxt, &errf)) != 0) {
2801 		const char *msg;
2802 
2803 		if (errno == -1) {
2804 			if (strcmp(errf, "core_set_process_path") == 0) {
2805 				msg = gettext("Failed to set the corefile path "
2806 				    "for the %s method of instance %s");
2807 			} else if (strcmp(errf, "setproject") == 0) {
2808 				msg = gettext("Failed to assign a resource "
2809 				    "control for the %s method of instance %s");
2810 			} else if (strcmp(errf, "pool_set_binding") == 0) {
2811 				msg = gettext("Failed to bind the %s method of "
2812 				    "instance %s to a pool due to a system "
2813 				    "error");
2814 			} else {
2815 				assert(0);
2816 				abort();
2817 			}
2818 
2819 			error_msg(msg, methods[method].name, instance->fmri);
2820 
2821 			exit(IMRET_FAILURE);
2822 		}
2823 
2824 		if (errf != NULL && strcmp(errf, "pool_set_binding") == 0) {
2825 			switch (errno) {
2826 			case ENOENT:
2827 				msg = gettext("Failed to find resource pool "
2828 				    "for the %s method of instance %s");
2829 				break;
2830 
2831 			case EBADF:
2832 				msg = gettext("Failed to bind the %s method of "
2833 				    "instance %s to a pool due to invalid "
2834 				    "configuration");
2835 				break;
2836 
2837 			case EINVAL:
2838 				msg = gettext("Failed to bind the %s method of "
2839 				    "instance %s to a pool due to invalid "
2840 				    "pool name");
2841 				break;
2842 
2843 			default:
2844 				assert(0);
2845 				abort();
2846 			}
2847 
2848 			exit(IMRET_FAILURE);
2849 		}
2850 
2851 		if (errf != NULL) {
2852 			error_msg(gettext("Failed to set credentials for the "
2853 			    "%s method of instance %s (%s: %s)"),
2854 			    methods[method].name, instance->fmri, errf,
2855 			    strerror(errno));
2856 			exit(IMRET_FAILURE);
2857 		}
2858 
2859 		switch (errno) {
2860 		case ENOMEM:
2861 			msg = gettext("Failed to set credentials for the %s "
2862 			    "method of instance %s (out of memory)");
2863 			break;
2864 
2865 		case ENOENT:
2866 			msg = gettext("Failed to set credentials for the %s "
2867 			    "method of instance %s (no passwd or shadow "
2868 			    "entry for user)");
2869 			break;
2870 
2871 		default:
2872 			assert(0);
2873 			abort();
2874 		}
2875 
2876 		error_msg(msg, methods[method].name, instance->fmri);
2877 		exit(IMRET_FAILURE);
2878 	}
2879 
2880 	/* let exec() free mthd_ctxt */
2881 
2882 	/* setup standard fds */
2883 	if (method == IM_START) {
2884 		(void) dup2(instance->conn_fd, STDIN_FILENO);
2885 	} else {
2886 		(void) close(STDIN_FILENO);
2887 		(void) open("/dev/null", O_RDONLY);
2888 	}
2889 	(void) dup2(STDIN_FILENO, STDOUT_FILENO);
2890 	(void) dup2(STDIN_FILENO, STDERR_FILENO);
2891 
2892 	closefrom(STDERR_FILENO + 1);
2893 
2894 	method_preexec();
2895 
2896 	env = set_smf_env(mthd_ctxt, instance, methods[method].name);
2897 
2898 	if (env != NULL) {
2899 		do {
2900 			(void) execve(mi->exec_path, args, env);
2901 		} while (errno == EINTR);
2902 	}
2903 
2904 	serrno = errno;
2905 	/* start up logging again to report the error */
2906 	msg_init();
2907 	errno = serrno;
2908 
2909 	error_msg(
2910 	    gettext("Failed to exec %s method of instance %s: %s"),
2911 	    methods[method].name, instance->fmri, strerror(errno));
2912 
2913 	if ((method == IM_START) && (instance->config->basic->iswait)) {
2914 		/*
2915 		 * We couldn't exec the start method for a wait type service.
2916 		 * Eat up data from the endpoint, so that hopefully the
2917 		 * service's fd won't wake poll up on the next time round
2918 		 * event_loop(). This behavior is carried over from the old
2919 		 * inetd, and it seems somewhat arbitrary that it isn't
2920 		 * also done in the case of fork failures; but I guess
2921 		 * it assumes an exec failure is less likely to be the result
2922 		 * of a resource shortage, and is thus not worth retrying.
2923 		 */
2924 		consume_wait_data(instance, 0);
2925 	}
2926 
2927 	exit(IMRET_FAILURE);
2928 }
2929 
2930 static restarter_error_t
2931 get_method_error_success(instance_method_t method)
2932 {
2933 	switch (method) {
2934 	case IM_OFFLINE:
2935 		return (RERR_RESTART);
2936 	case IM_ONLINE:
2937 		return (RERR_RESTART);
2938 	case IM_DISABLE:
2939 		return (RERR_RESTART);
2940 	case IM_REFRESH:
2941 		return (RERR_REFRESH);
2942 	case IM_START:
2943 		return (RERR_RESTART);
2944 	}
2945 	(void) fprintf(stderr, gettext("Internal fatal error in inetd.\n"));
2946 
2947 	abort();
2948 	/* NOTREACHED */
2949 }
2950 
2951 static int
2952 smf_kill_process(instance_t *instance, int sig)
2953 {
2954 	rep_val_t	*rv;
2955 	int		ret = IMRET_SUCCESS;
2956 
2957 	/* Carry out process assassination */
2958 	for (rv = uu_list_first(instance->start_pids);
2959 	    rv != NULL;
2960 	    rv = uu_list_next(instance->start_pids, rv)) {
2961 		if ((kill((pid_t)rv->val, sig) != 0) &&
2962 		    (errno != ESRCH)) {
2963 			ret = IMRET_FAILURE;
2964 			error_msg(gettext("Unable to kill "
2965 			    "start process (%ld) of instance %s: %s"),
2966 			    rv->val, instance->fmri, strerror(errno));
2967 		}
2968 	}
2969 	return (ret);
2970 }
2971 
2972 /*
2973  * Runs the specified method of the specified service instance.
2974  * If the method was never specified, we handle it the same as if the
2975  * method was called and returned success, carrying on any transition the
2976  * instance may be in the midst of.
2977  * If the method isn't executable in its specified profile or an error occurs
2978  * forking a process to run the method in the function returns -1.
2979  * If a method binary is successfully executed, the function switches the
2980  * instance's cur state to the method's associated 'run' state and the next
2981  * state to the methods associated next state.
2982  * Returns -1 if there's an error before forking, else 0.
2983  */
2984 int
2985 run_method(instance_t *instance, instance_method_t method,
2986     const proto_info_t *start_info)
2987 {
2988 	pid_t			child_pid;
2989 	method_info_t		*mi;
2990 	struct method_context	*mthd_ctxt = NULL;
2991 	int			sig = 0;
2992 	int			ret;
2993 	instance_cfg_t		*cfg = instance->config;
2994 	ctid_t			cid;
2995 	boolean_t		trans_failure = B_TRUE;
2996 	int			serrno;
2997 
2998 	/*
2999 	 * Don't bother updating the instance's state for the start method
3000 	 * as there isn't a separate start method state.
3001 	 */
3002 	if (method != IM_START)
3003 		update_instance_states(instance, get_method_state(method),
3004 		    methods[method].dst_state,
3005 		    get_method_error_success(method));
3006 
3007 	if ((mi = cfg->methods[method]) == NULL) {
3008 		/*
3009 		 * If the absent method is IM_OFFLINE, default action needs
3010 		 * to be taken to avoid lingering processes which can prevent
3011 		 * the upcoming rebinding from happening.
3012 		 */
3013 		if ((method == IM_OFFLINE) && instance->config->basic->iswait) {
3014 			warn_msg(gettext("inetd_offline method for instance %s "
3015 			    "is unspecified.  Taking default action: kill."),
3016 			    instance->fmri);
3017 			(void) str2sig("TERM", &sig);
3018 			ret = smf_kill_process(instance, sig);
3019 			process_non_start_term(instance, ret);
3020 			return (0);
3021 		} else {
3022 			process_non_start_term(instance, IMRET_SUCCESS);
3023 			return (0);
3024 		}
3025 	}
3026 
3027 	/* Handle special method tokens, not allowed on start */
3028 	if (method != IM_START) {
3029 		if (restarter_is_null_method(mi->exec_path)) {
3030 			/* :true means nothing should be done */
3031 			process_non_start_term(instance, IMRET_SUCCESS);
3032 			return (0);
3033 		}
3034 
3035 		if ((sig = restarter_is_kill_method(mi->exec_path)) >= 0) {
3036 			/* Carry out contract assassination */
3037 			ret = iterate_repository_contracts(instance, sig);
3038 			/* ENOENT means we didn't find any contracts */
3039 			if (ret != 0 && ret != ENOENT) {
3040 				error_msg(gettext("Failed to send signal %d "
3041 				    "to contracts of instance %s: %s"), sig,
3042 				    instance->fmri, strerror(ret));
3043 				goto prefork_failure;
3044 			} else {
3045 				process_non_start_term(instance, IMRET_SUCCESS);
3046 				return (0);
3047 			}
3048 		}
3049 
3050 		if ((sig = restarter_is_kill_proc_method(mi->exec_path)) >= 0) {
3051 			ret = smf_kill_process(instance, sig);
3052 			process_non_start_term(instance, ret);
3053 			return (0);
3054 		}
3055 	}
3056 
3057 	/*
3058 	 * Get the associated method context before the fork so we can
3059 	 * modify the instances state if things go wrong.
3060 	 */
3061 	if ((mthd_ctxt = read_method_context(instance->fmri,
3062 	    methods[method].name, mi->exec_path)) == NULL)
3063 		goto prefork_failure;
3064 
3065 	/*
3066 	 * Perform some basic checks before we fork to limit the possibility
3067 	 * of exec failures, so we can modify the instance state if necessary.
3068 	 */
3069 	if (!passes_basic_exec_checks(instance->fmri, methods[method].name,
3070 	    mi->exec_path)) {
3071 		trans_failure = B_FALSE;
3072 		goto prefork_failure;
3073 	}
3074 
3075 	if (contract_prefork(instance->fmri, method) == -1)
3076 		goto prefork_failure;
3077 	child_pid = fork();
3078 	serrno = errno;
3079 	contract_postfork();
3080 
3081 	switch (child_pid) {
3082 	case -1:
3083 		error_msg(gettext(
3084 		    "Unable to fork %s method of instance %s: %s"),
3085 		    methods[method].name, instance->fmri, strerror(serrno));
3086 		if ((serrno != EAGAIN) && (serrno != ENOMEM))
3087 			trans_failure = B_FALSE;
3088 		goto prefork_failure;
3089 	case 0:				/* child */
3090 		exec_method(instance, method, mi, mthd_ctxt, start_info);
3091 		/* NOTREACHED */
3092 	default:			/* parent */
3093 		restarter_free_method_context(mthd_ctxt);
3094 		mthd_ctxt = NULL;
3095 
3096 		if (get_latest_contract(&cid) < 0)
3097 			cid = -1;
3098 
3099 		/*
3100 		 * Register this method so its termination is noticed and
3101 		 * the state transition this method participates in is
3102 		 * continued.
3103 		 */
3104 		if (register_method(instance, child_pid, cid, method,
3105 		    start_info->proto) != 0) {
3106 			/*
3107 			 * Since we will never find out about the termination
3108 			 * of this method, if it's a non-start method treat
3109 			 * is as a failure so we don't block restarter event
3110 			 * processing on it whilst it languishes in a method
3111 			 * running state.
3112 			 */
3113 			error_msg(gettext("Failed to monitor status of "
3114 			    "%s method of instance %s"), methods[method].name,
3115 			    instance->fmri);
3116 			if (method != IM_START)
3117 				process_non_start_term(instance, IMRET_FAILURE);
3118 		}
3119 
3120 		add_method_ids(instance, child_pid, cid, method);
3121 
3122 		/* do tcp tracing for those nowait instances that request it */
3123 		if ((method == IM_START) && cfg->basic->do_tcp_trace &&
3124 		    !cfg->basic->iswait) {
3125 			char buf[INET6_ADDRSTRLEN];
3126 
3127 			syslog(LOG_NOTICE, "%s[%d] from %s %d",
3128 			    cfg->basic->svc_name, child_pid,
3129 			    inet_ntop_native(instance->remote_addr.ss_family,
3130 			    SS_SINADDR(instance->remote_addr), buf,
3131 			    sizeof (buf)),
3132 			    ntohs(SS_PORT(instance->remote_addr)));
3133 		}
3134 	}
3135 
3136 	return (0);
3137 
3138 prefork_failure:
3139 	if (mthd_ctxt != NULL) {
3140 		restarter_free_method_context(mthd_ctxt);
3141 		mthd_ctxt = NULL;
3142 	}
3143 
3144 	if (method == IM_START) {
3145 		/*
3146 		 * Only place a start method in maintenance if we're sure
3147 		 * that the failure was non-transient.
3148 		 */
3149 		if (!trans_failure) {
3150 			destroy_bound_fds(instance);
3151 			update_state(instance, IIS_MAINTENANCE, RERR_FAULT);
3152 		}
3153 	} else {
3154 		/* treat the failure as if the method ran and failed */
3155 		process_non_start_term(instance, IMRET_FAILURE);
3156 	}
3157 
3158 	return (-1);
3159 }
3160 
3161 static int
3162 pending_connections(instance_t *instance, proto_info_t *pi)
3163 {
3164 	if (instance->config->basic->istlx) {
3165 		tlx_info_t *tl = (tlx_info_t *)pi;
3166 
3167 		return (uu_list_numnodes(tl->conn_ind_queue) != 0);
3168 	} else {
3169 		return (0);
3170 	}
3171 }
3172 
3173 static int
3174 accept_connection(instance_t *instance, proto_info_t *pi)
3175 {
3176 	int		fd;
3177 	socklen_t	size;
3178 
3179 	if (instance->config->basic->istlx) {
3180 		tlx_info_t *tl = (tlx_info_t *)pi;
3181 		tlx_pending_counter = \
3182 		    tlx_pending_counter - uu_list_numnodes(tl->conn_ind_queue);
3183 
3184 		fd = tlx_accept(instance->fmri, (tlx_info_t *)pi,
3185 		    &(instance->remote_addr));
3186 
3187 		tlx_pending_counter = \
3188 		    tlx_pending_counter + uu_list_numnodes(tl->conn_ind_queue);
3189 	} else {
3190 		size = sizeof (instance->remote_addr);
3191 		fd = accept(pi->listen_fd,
3192 		    (struct sockaddr *)&(instance->remote_addr), &size);
3193 		if (fd < 0)
3194 			error_msg("accept: %s", strerror(errno));
3195 	}
3196 
3197 	return (fd);
3198 }
3199 
3200 /*
3201  * Handle an incoming connection request for a nowait service.
3202  * This involves accepting the incoming connection on a new fd. Connection
3203  * rate checks are then performed, transitioning the service to the
3204  * conrate offline state if these fail. Otherwise, the service's start method
3205  * is run (performing TCP wrappers checks if applicable as we do), and on
3206  * success concurrent copies checking is done, transitioning the service to the
3207  * copies offline state if this fails.
3208  */
3209 static void
3210 process_nowait_request(instance_t *instance, proto_info_t *pi)
3211 {
3212 	basic_cfg_t		*cfg = instance->config->basic;
3213 	int			ret;
3214 	adt_event_data_t	*ae;
3215 	char			buf[BUFSIZ];
3216 
3217 	/* accept nowait service connections on a new fd */
3218 	if ((instance->conn_fd = accept_connection(instance, pi)) == -1) {
3219 		/*
3220 		 * Failed accept. Return and allow the event loop to initiate
3221 		 * another attempt later if the request is still present.
3222 		 */
3223 		return;
3224 	}
3225 
3226 	/*
3227 	 * Limit connection rate of nowait services. If either conn_rate_max
3228 	 * or conn_rate_offline are <= 0, no connection rate limit checking
3229 	 * is done. If the configured rate is exceeded, the instance is taken
3230 	 * to the connrate_offline state and a timer scheduled to try and
3231 	 * bring the instance back online after the configured offline time.
3232 	 */
3233 	if ((cfg->conn_rate_max > 0) && (cfg->conn_rate_offline > 0)) {
3234 		if (instance->conn_rate_count++ == 0) {
3235 			instance->conn_rate_start = time(NULL);
3236 		} else if (instance->conn_rate_count >
3237 		    cfg->conn_rate_max) {
3238 			time_t now = time(NULL);
3239 
3240 			if ((now - instance->conn_rate_start) > 1) {
3241 				instance->conn_rate_start = now;
3242 				instance->conn_rate_count = 1;
3243 			} else {
3244 				/* Generate audit record */
3245 				if ((ae = adt_alloc_event(audit_handle,
3246 				    ADT_inetd_ratelimit)) == NULL) {
3247 					error_msg(gettext("Unable to allocate "
3248 					    "rate limit audit event"));
3249 				} else {
3250 					adt_inetd_ratelimit_t *rl =
3251 					    &ae->adt_inetd_ratelimit;
3252 					/*
3253 					 * The inetd_ratelimit audit
3254 					 * record consists of:
3255 					 * 	Service name
3256 					 *	Connection rate limit
3257 					 */
3258 					rl->service_name = cfg->svc_name;
3259 					(void) snprintf(buf, sizeof (buf),
3260 					    "limit=%lld", cfg->conn_rate_max);
3261 					rl->limit = buf;
3262 					(void) adt_put_event(ae, ADT_SUCCESS,
3263 					    ADT_SUCCESS);
3264 					adt_free_event(ae);
3265 				}
3266 
3267 				error_msg(gettext(
3268 				    "Instance %s has exceeded its configured "
3269 				    "connection rate, additional connections "
3270 				    "will not be accepted for %d seconds"),
3271 				    instance->fmri, cfg->conn_rate_offline);
3272 
3273 				close_net_fd(instance, instance->conn_fd);
3274 				instance->conn_fd = -1;
3275 
3276 				destroy_bound_fds(instance);
3277 
3278 				instance->conn_rate_count = 0;
3279 
3280 				instance->conn_rate_exceeded = B_TRUE;
3281 				(void) run_method(instance, IM_OFFLINE, NULL);
3282 
3283 				return;
3284 			}
3285 		}
3286 	}
3287 
3288 	ret = run_method(instance, IM_START, pi);
3289 
3290 	close_net_fd(instance, instance->conn_fd);
3291 	instance->conn_fd = -1;
3292 
3293 	if (ret == -1) /* the method wasn't forked  */
3294 		return;
3295 
3296 	instance->copies++;
3297 
3298 	/*
3299 	 * Limit concurrent connections of nowait services.
3300 	 */
3301 	if (copies_limit_exceeded(instance)) {
3302 		/* Generate audit record */
3303 		if ((ae = adt_alloc_event(audit_handle, ADT_inetd_copylimit))
3304 		    == NULL) {
3305 			error_msg(gettext("Unable to allocate copy limit "
3306 			    "audit event"));
3307 		} else {
3308 			/*
3309 			 * The inetd_copylimit audit record consists of:
3310 			 *	Service name
3311 			 * 	Copy limit
3312 			 */
3313 			ae->adt_inetd_copylimit.service_name = cfg->svc_name;
3314 			(void) snprintf(buf, sizeof (buf), "limit=%lld",
3315 			    cfg->max_copies);
3316 			ae->adt_inetd_copylimit.limit = buf;
3317 			(void) adt_put_event(ae, ADT_SUCCESS, ADT_SUCCESS);
3318 			adt_free_event(ae);
3319 		}
3320 
3321 		warn_msg(gettext("Instance %s has reached its maximum "
3322 		    "configured copies, no new connections will be accepted"),
3323 		    instance->fmri);
3324 		destroy_bound_fds(instance);
3325 		(void) run_method(instance, IM_OFFLINE, NULL);
3326 	}
3327 }
3328 
3329 /*
3330  * Handle an incoming request for a wait type service.
3331  * Failure rate checking is done first, taking the service to the maintenance
3332  * state if the checks fail. Following this, the service's start method is run,
3333  * and on success, we stop listening for new requests for this service.
3334  */
3335 static void
3336 process_wait_request(instance_t *instance, const proto_info_t *pi)
3337 {
3338 	basic_cfg_t		*cfg = instance->config->basic;
3339 	int			ret;
3340 	adt_event_data_t	*ae;
3341 	char			buf[BUFSIZ];
3342 
3343 	instance->conn_fd = pi->listen_fd;
3344 
3345 	/*
3346 	 * Detect broken servers and transition them to maintenance. If a
3347 	 * wait type service exits without accepting the connection or
3348 	 * consuming (reading) the datagram, that service's descriptor will
3349 	 * select readable again, and inetd will fork another instance of
3350 	 * the server. If either wait_fail_cnt or wait_fail_interval are <= 0,
3351 	 * no failure rate detection is done.
3352 	 */
3353 	if ((cfg->wait_fail_cnt > 0) && (cfg->wait_fail_interval > 0)) {
3354 		if (instance->fail_rate_count++ == 0) {
3355 			instance->fail_rate_start = time(NULL);
3356 		} else if (instance->fail_rate_count > cfg->wait_fail_cnt) {
3357 			time_t now = time(NULL);
3358 
3359 			if ((now - instance->fail_rate_start) >
3360 			    cfg->wait_fail_interval) {
3361 				instance->fail_rate_start = now;
3362 				instance->fail_rate_count = 1;
3363 			} else {
3364 				/* Generate audit record */
3365 				if ((ae = adt_alloc_event(audit_handle,
3366 				    ADT_inetd_failrate)) == NULL) {
3367 					error_msg(gettext("Unable to allocate "
3368 					    "failure rate audit event"));
3369 				} else {
3370 					adt_inetd_failrate_t *fr =
3371 					    &ae->adt_inetd_failrate;
3372 					/*
3373 					 * The inetd_failrate audit record
3374 					 * consists of:
3375 					 * 	Service name
3376 					 * 	Failure rate
3377 					 *	Interval
3378 					 * Last two are expressed as k=v pairs
3379 					 * in the values field.
3380 					 */
3381 					fr->service_name = cfg->svc_name;
3382 					(void) snprintf(buf, sizeof (buf),
3383 					    "limit=%lld,interval=%d",
3384 					    cfg->wait_fail_cnt,
3385 					    cfg->wait_fail_interval);
3386 					fr->values = buf;
3387 					(void) adt_put_event(ae, ADT_SUCCESS,
3388 					    ADT_SUCCESS);
3389 					adt_free_event(ae);
3390 				}
3391 
3392 				error_msg(gettext(
3393 				    "Instance %s has exceeded its configured "
3394 				    "failure rate, transitioning to "
3395 				    "maintenance"), instance->fmri);
3396 				instance->fail_rate_count = 0;
3397 
3398 				destroy_bound_fds(instance);
3399 
3400 				instance->maintenance_req = B_TRUE;
3401 				(void) run_method(instance, IM_OFFLINE, NULL);
3402 				return;
3403 			}
3404 		}
3405 	}
3406 
3407 	ret = run_method(instance, IM_START, pi);
3408 
3409 	instance->conn_fd = -1;
3410 
3411 	if (ret == 0) {
3412 		/*
3413 		 * Stop listening for connections now we've fired off the
3414 		 * server for a wait type instance.
3415 		 */
3416 		(void) poll_bound_fds(instance, B_FALSE, pi->proto);
3417 	}
3418 }
3419 
3420 /*
3421  * Process any networks requests for each proto for each instance.
3422  */
3423 void
3424 process_network_events(void)
3425 {
3426 	instance_t	*instance;
3427 
3428 	for (instance = uu_list_first(instance_list); instance != NULL;
3429 	    instance = uu_list_next(instance_list, instance)) {
3430 		basic_cfg_t	*cfg;
3431 		proto_info_t	*pi;
3432 
3433 		/*
3434 		 * Ignore instances in states that definitely don't have any
3435 		 * listening fds.
3436 		 */
3437 		switch (instance->cur_istate) {
3438 		case IIS_ONLINE:
3439 		case IIS_DEGRADED:
3440 		case IIS_IN_REFRESH_METHOD:
3441 			break;
3442 		default:
3443 			continue;
3444 		}
3445 
3446 		cfg = instance->config->basic;
3447 
3448 		for (pi = uu_list_first(cfg->proto_list); pi != NULL;
3449 		    pi = uu_list_next(cfg->proto_list, pi)) {
3450 			if (((pi->listen_fd != -1) &&
3451 			    isset_pollfd(pi->listen_fd)) ||
3452 			    pending_connections(instance, pi)) {
3453 				if (cfg->iswait) {
3454 					process_wait_request(instance, pi);
3455 				} else {
3456 					process_nowait_request(instance, pi);
3457 				}
3458 			}
3459 		}
3460 	}
3461 }
3462 
3463 /* ARGSUSED0 */
3464 static void
3465 sigterm_handler(int sig)
3466 {
3467 	got_sigterm = B_TRUE;
3468 }
3469 
3470 /* ARGSUSED0 */
3471 static void
3472 sighup_handler(int sig)
3473 {
3474 	refresh_inetd_requested = B_TRUE;
3475 }
3476 
3477 /*
3478  * inetd's major work loop. This function sits in poll waiting for events
3479  * to occur, processing them when they do. The possible events are
3480  * master restarter requests, expired timer queue timers, stop/refresh signal
3481  * requests, contract events indicating process termination, stop/refresh
3482  * requests originating from one of the stop/refresh inetd processes and
3483  * network events.
3484  * The loop is exited when a stop request is received and processed, and
3485  * all the instances have reached a suitable 'stopping' state.
3486  */
3487 static void
3488 event_loop(void)
3489 {
3490 	instance_t		*instance;
3491 	int			timeout;
3492 
3493 	for (;;) {
3494 		int	pret = -1;
3495 
3496 		if (tlx_pending_counter != 0)
3497 			timeout = 0;
3498 		else
3499 			timeout = iu_earliest_timer(timer_queue);
3500 
3501 		if (!got_sigterm && !refresh_inetd_requested) {
3502 			pret = poll(poll_fds, num_pollfds, timeout);
3503 			if ((pret == -1) && (errno != EINTR)) {
3504 				error_msg(gettext("poll failure: %s"),
3505 				    strerror(errno));
3506 				continue;
3507 			}
3508 		}
3509 
3510 		if (got_sigterm) {
3511 			msg_fini();
3512 			inetd_stop();
3513 			got_sigterm = B_FALSE;
3514 			goto check_if_stopped;
3515 		}
3516 
3517 		/*
3518 		 * Process any stop/refresh requests from the Unix Domain
3519 		 * Socket.
3520 		 */
3521 		if ((pret != -1) && isset_pollfd(uds_fd)) {
3522 			while (process_uds_event() == 0)
3523 				;
3524 		}
3525 
3526 		/*
3527 		 * Process refresh request. We do this check after the UDS
3528 		 * event check above, as it would be wasted processing if we
3529 		 * started refreshing inetd based on a SIGHUP, and then were
3530 		 * told to shut-down via a UDS event.
3531 		 */
3532 		if (refresh_inetd_requested) {
3533 			refresh_inetd_requested = B_FALSE;
3534 			if (!inetd_stopping)
3535 				inetd_refresh();
3536 		}
3537 
3538 		/*
3539 		 * We were interrupted by a signal. Don't waste any more
3540 		 * time processing a potentially inaccurate poll return.
3541 		 */
3542 		if (pret == -1)
3543 			continue;
3544 
3545 		/*
3546 		 * Process any instance restarter events.
3547 		 */
3548 		if (isset_pollfd(rst_event_pipe[PE_CONSUMER])) {
3549 			while (process_restarter_event() == 0)
3550 				;
3551 		}
3552 
3553 		/*
3554 		 * Process any expired timers (bind retry, con-rate offline,
3555 		 * method timeouts).
3556 		 */
3557 		(void) iu_expire_timers(timer_queue);
3558 
3559 		process_terminated_methods();
3560 
3561 		/*
3562 		 * If inetd is stopping, check whether all our managed
3563 		 * instances have been stopped and we can return.
3564 		 */
3565 		if (inetd_stopping) {
3566 check_if_stopped:
3567 			for (instance = uu_list_first(instance_list);
3568 			    instance != NULL;
3569 			    instance = uu_list_next(instance_list, instance)) {
3570 				if (!instance_stopped(instance)) {
3571 					debug_msg("%s not yet stopped",
3572 					    instance->fmri);
3573 					break;
3574 				}
3575 			}
3576 			/* if all instances are stopped, return */
3577 			if (instance == NULL)
3578 				return;
3579 		}
3580 
3581 		process_network_events();
3582 	}
3583 }
3584 
3585 static void
3586 fini(void)
3587 {
3588 	method_fini();
3589 	uds_fini();
3590 	if (timer_queue != NULL)
3591 		iu_tq_destroy(timer_queue);
3592 
3593 
3594 	/*
3595 	 * We don't bother to undo the restarter interface at all.
3596 	 * Because of quirks in the interface, there is no way to
3597 	 * disconnect from the channel and cause any new events to be
3598 	 * queued.  However, any events which are received and not
3599 	 * acknowledged will be re-sent when inetd restarts as long as inetd
3600 	 * uses the same subscriber ID, which it does.
3601 	 *
3602 	 * By keeping the event pipe open but ignoring it, any events which
3603 	 * occur will cause restarter_event_proxy to hang without breaking
3604 	 * anything.
3605 	 */
3606 
3607 	if (instance_list != NULL) {
3608 		void		*cookie = NULL;
3609 		instance_t	*inst;
3610 
3611 		while ((inst = uu_list_teardown(instance_list, &cookie)) !=
3612 		    NULL)
3613 			destroy_instance(inst);
3614 		uu_list_destroy(instance_list);
3615 	}
3616 	if (instance_pool != NULL)
3617 		uu_list_pool_destroy(instance_pool);
3618 	tlx_fini();
3619 	config_fini();
3620 	repval_fini();
3621 	poll_fini();
3622 
3623 	/* Close audit session */
3624 	(void) adt_end_session(audit_handle);
3625 }
3626 
3627 static int
3628 init(void)
3629 {
3630 	int err;
3631 
3632 	if (repval_init() < 0)
3633 		goto failed;
3634 
3635 	if (config_init() < 0)
3636 		goto failed;
3637 
3638 	refresh_debug_flag();
3639 
3640 	if (tlx_init() < 0)
3641 		goto failed;
3642 
3643 	/* Setup instance list. */
3644 	if ((instance_pool = uu_list_pool_create("instance_pool",
3645 	    sizeof (instance_t), offsetof(instance_t, link), NULL,
3646 	    UU_LIST_POOL_DEBUG)) == NULL) {
3647 		error_msg("%s: %s",
3648 		    gettext("Failed to create instance pool"),
3649 		    uu_strerror(uu_error()));
3650 		goto failed;
3651 	}
3652 	if ((instance_list = uu_list_create(instance_pool, NULL, 0)) == NULL) {
3653 		error_msg("%s: %s",
3654 		    gettext("Failed to create instance list"),
3655 		    uu_strerror(uu_error()));
3656 		goto failed;
3657 	}
3658 
3659 	/*
3660 	 * Create event pipe to communicate events with the main event
3661 	 * loop and add it to the event loop's fdset.
3662 	 */
3663 	if (pipe(rst_event_pipe) < 0) {
3664 		error_msg("pipe: %s", strerror(errno));
3665 		goto failed;
3666 	}
3667 	/*
3668 	 * We only leave the producer end to block on reads/writes as we
3669 	 * can't afford to block in the main thread, yet need to in
3670 	 * the restarter event thread, so it can sit and wait for an
3671 	 * acknowledgement to be written to the pipe.
3672 	 */
3673 	disable_blocking(rst_event_pipe[PE_CONSUMER]);
3674 	if ((set_pollfd(rst_event_pipe[PE_CONSUMER], POLLIN)) == -1)
3675 		goto failed;
3676 
3677 	/*
3678 	 * Register with master restarter for managed service events. This
3679 	 * will fail, amongst other reasons, if inetd is already running.
3680 	 */
3681 	if ((err = restarter_bind_handle(RESTARTER_EVENT_VERSION,
3682 	    INETD_INSTANCE_FMRI, restarter_event_proxy, 0,
3683 	    &rst_event_handle)) != 0) {
3684 		error_msg(gettext(
3685 		    "Failed to register for restarter events: %s"),
3686 		    strerror(err));
3687 		goto failed;
3688 	}
3689 
3690 	if (contract_init() < 0)
3691 		goto failed;
3692 
3693 	if ((timer_queue = iu_tq_create()) == NULL) {
3694 		error_msg(gettext("Failed to create timer queue."));
3695 		goto failed;
3696 	}
3697 
3698 	if (uds_init() < 0)
3699 		goto failed;
3700 
3701 	if (method_init() < 0)
3702 		goto failed;
3703 
3704 	/* Initialize auditing session */
3705 	if (adt_start_session(&audit_handle, NULL, ADT_USE_PROC_DATA) != 0) {
3706 		error_msg(gettext("Unable to start audit session"));
3707 	}
3708 
3709 	/*
3710 	 * Initialize signal dispositions/masks
3711 	 */
3712 	(void) sigset(SIGHUP, sighup_handler);
3713 	(void) sigset(SIGTERM, sigterm_handler);
3714 	(void) sigignore(SIGINT);
3715 
3716 	return (0);
3717 
3718 failed:
3719 	fini();
3720 	return (-1);
3721 }
3722 
3723 static int
3724 start_method(void)
3725 {
3726 	int	i;
3727 	int	pipe_fds[2];
3728 	int	child;
3729 
3730 	/* Create pipe for child to notify parent of initialization success. */
3731 	if (pipe(pipe_fds) < 0) {
3732 		error_msg("pipe: %s", strerror(errno));
3733 		return (SMF_EXIT_ERR_OTHER);
3734 	}
3735 
3736 	if ((child = fork()) == -1) {
3737 		error_msg("fork: %s", strerror(errno));
3738 		(void) close(pipe_fds[PE_CONSUMER]);
3739 		(void) close(pipe_fds[PE_PRODUCER]);
3740 		return (SMF_EXIT_ERR_OTHER);
3741 	} else if (child > 0) {			/* parent */
3742 
3743 		/* Wait on child to return success of initialization. */
3744 		(void) close(pipe_fds[PE_PRODUCER]);
3745 		if ((safe_read(pipe_fds[PE_CONSUMER], &i, sizeof (i)) != 0) ||
3746 		    (i < 0)) {
3747 			error_msg(gettext(
3748 			    "Initialization failed, unable to start"));
3749 			(void) close(pipe_fds[PE_CONSUMER]);
3750 			/*
3751 			 * Batch all initialization errors as 'other' errors,
3752 			 * resulting in retries being attempted.
3753 			 */
3754 			return (SMF_EXIT_ERR_OTHER);
3755 		} else {
3756 			(void) close(pipe_fds[PE_CONSUMER]);
3757 			return (SMF_EXIT_OK);
3758 		}
3759 	} else {				/* child */
3760 		/*
3761 		 * Perform initialization and return success code down
3762 		 * the pipe.
3763 		 */
3764 		(void) close(pipe_fds[PE_CONSUMER]);
3765 		i = init();
3766 		if ((safe_write(pipe_fds[PE_PRODUCER], &i, sizeof (i)) < 0) ||
3767 		    (i < 0)) {
3768 			error_msg(gettext("pipe write failure: %s"),
3769 			    strerror(errno));
3770 			exit(1);
3771 		}
3772 		(void) close(pipe_fds[PE_PRODUCER]);
3773 
3774 		(void) setsid();
3775 
3776 		/*
3777 		 * Log a message if the configuration file has changed since
3778 		 * inetconv was last run.
3779 		 */
3780 		check_conf_file();
3781 
3782 		event_loop();
3783 
3784 		fini();
3785 		debug_msg("inetd stopped");
3786 		msg_fini();
3787 		exit(0);
3788 	}
3789 	/* NOTREACHED */
3790 }
3791 
3792 /*
3793  * When inetd is run from outside the SMF, this message is output to provide
3794  * the person invoking inetd with further information that will help them
3795  * understand how to start and stop inetd, and to achieve the other
3796  * behaviors achievable with the legacy inetd command line interface, if
3797  * it is possible.
3798  */
3799 static void
3800 legacy_usage(void)
3801 {
3802 	(void) fprintf(stderr,
3803 	    "inetd is now an smf(5) managed service and can no longer be run "
3804 	    "from the\n"
3805 	    "command line. To enable or disable inetd refer to svcadm(1M) on\n"
3806 	    "how to enable \"%s\", the inetd instance.\n"
3807 	    "\n"
3808 	    "The traditional inetd command line option mappings are:\n"
3809 	    "\t-d : there is no supported debug output\n"
3810 	    "\t-s : inetd is only runnable from within the SMF\n"
3811 	    "\t-t : See inetadm(1M) on how to enable TCP tracing\n"
3812 	    "\t-r : See inetadm(1M) on how to set a failure rate\n"
3813 	    "\n"
3814 	    "To specify an alternative configuration file see svccfg(1M)\n"
3815 	    "for how to modify the \"%s/%s\" string type property of\n"
3816 	    "the inetd instance, and modify it according to the syntax:\n"
3817 	    "\"%s [alt_config_file] %%m\".\n"
3818 	    "\n"
3819 	    "For further information on inetd see inetd(1M).\n",
3820 	    INETD_INSTANCE_FMRI, START_METHOD_ARG, SCF_PROPERTY_EXEC,
3821 	    INETD_PATH);
3822 }
3823 
3824 /*
3825  * Usage message printed out for usage errors when running under the SMF.
3826  */
3827 static void
3828 smf_usage(const char *arg0)
3829 {
3830 	error_msg("Usage: %s [alt_conf_file] %s|%s|%s", arg0, START_METHOD_ARG,
3831 	    STOP_METHOD_ARG, REFRESH_METHOD_ARG);
3832 }
3833 
3834 /*
3835  * Returns B_TRUE if we're being run from within the SMF, else B_FALSE.
3836  */
3837 static boolean_t
3838 run_through_smf(void)
3839 {
3840 	char *fmri;
3841 
3842 	/*
3843 	 * check if the instance fmri environment variable has been set by
3844 	 * our restarter.
3845 	 */
3846 	return (((fmri = getenv("SMF_FMRI")) != NULL) &&
3847 	    (strcmp(fmri, INETD_INSTANCE_FMRI) == 0));
3848 }
3849 
3850 int
3851 main(int argc, char *argv[])
3852 {
3853 	char		*method;
3854 	int		ret;
3855 
3856 #if	!defined(TEXT_DOMAIN)
3857 #define	TEXT_DOMAIN "SYS_TEST"
3858 #endif
3859 	(void) textdomain(TEXT_DOMAIN);
3860 	(void) setlocale(LC_ALL, "");
3861 
3862 	if (!run_through_smf()) {
3863 		legacy_usage();
3864 		return (SMF_EXIT_ERR_NOSMF);
3865 	}
3866 
3867 	msg_init();	/* setup logging */
3868 
3869 	(void) enable_extended_FILE_stdio(-1, -1);
3870 
3871 	/* inetd invocation syntax is inetd [alt_conf_file] method_name */
3872 
3873 	switch (argc) {
3874 	case 2:
3875 		method = argv[1];
3876 		break;
3877 	case 3:
3878 		conf_file = argv[1];
3879 		method = argv[2];
3880 		break;
3881 	default:
3882 		smf_usage(argv[0]);
3883 		return (SMF_EXIT_ERR_CONFIG);
3884 
3885 	}
3886 
3887 	if (strcmp(method, START_METHOD_ARG) == 0) {
3888 		ret = start_method();
3889 	} else if (strcmp(method, STOP_METHOD_ARG) == 0) {
3890 		ret = stop_method();
3891 	} else if (strcmp(method, REFRESH_METHOD_ARG) == 0) {
3892 		ret = refresh_method();
3893 	} else {
3894 		smf_usage(argv[0]);
3895 		return (SMF_EXIT_ERR_CONFIG);
3896 	}
3897 
3898 	return (ret);
3899 }
3900