MFC r320494: Fix double free by reverting r300385 and r300624 which was
false positive reported by cppcheck.

MFC r320216: Fix use-after-free introduced in r300388.

In r300388, endnetconfig() was called on nc_handle which would release
the associated netconfig structure, which means tmpnconf->nc_netid
would be a use-after-free.

Solve this by doing endnetconfig() in return paths instead.

Reported by: jemalloc via kevlo
Reviewed by: cem, ngie (earlier version)

MFC r319369:

* limit size of buffers to RPC_MAXDATASIZE
* don't leak memory
* be more picky about bad parameters

From:

https://raw.githubusercontent.com/guidovranken/rpcbomb/master/libtirpc_patch.txt
https://github.com/guidovranken/rpcbomb/blob/master/rpcbind_patch.txt

via NetBSD.

MFC r317660, r317710

r317660:
Support clnt_raw's use of FD_SETSIZE as a fake file descriptor.

Accomplish this by allocating space for it in __svc_xports and allowing
it to be registered. The failure to allocate space was causing an
out-of-bounds read in svc_getreq_common(). The failure to register
caused PR 211804.

The bug was found with CHERI bounds checking.

PR: 211804
Obtained from: CheriBSD
Sponsored by: DARPA, AFRL
Reviewed by: ngie
Differential Revision: https://reviews.freebsd.org/D10528

r317710:
Remove expected failure now that it was fixed in r317660.

PR: 211804
Reviewed by: ngie
Obtained from: CheriBSD
Sponsored by: DARPA, AFRL
Differential Revision: https://reviews.freebsd.org/D10576

MFC r264196:
r264196 (by theraven):

Move definitions out of rpc_com so that the linker doesn't complain about
multiple definitions.

MFC r296133:
r296133 (by pfg):

RPC: update the getrpcbyname() definition to include a const qualifier.

Add const qualifier making getrpcbyname() and getrpcbyname_r()
prototypes match those used in latest Sun RPC code (TI-RPC 2.3).

Obtained from: NetBSD

MFC r301734:
r301734 (by kevlo):

Fix the rpcb_getaddr() definition to match its declaration.

MFC r296404:
r296404 (by pfg):

Stray tabs and spaces.

No functional change.

MFC r287353:
r287353 (by rodrigc):

Use unsigned variable.

Eliminates gcc 4.9 compiler warning.

MFC r296386:
r296386 (by pfg):

Work around aliasing issues detected in modern GCC.

Avoid casting gymnastics that lead to pointer aliasing by introducing an
inline function as done in NetBSD (but without #if0'd WIP code).

Obtained from: NetBSD (CVS Rev. 1.24, 1.25)

MFC r278039:
r278039 (by pfg):

Resource leak

CID: 1016703

MFC r288017:
r288017 (by rodrigc):

Use ANSI C prototypes.

Eliminates gcc 4.9 warnings.

MFC r288995:
r288995 (by rodrigc):

Use proper function prototypes.
Eliminates -Wstrict-prototypes warning

MFC r287347:
r287347 (by rodrigc):

Use ANSI C prototypes.

Eliminates gcc 4.9 warnings.

MFC r301754,r301769:

r301754 (by pfg):

libc/rpc: Make use of some xdr_* macros.

xdr_rpcprog and xdr_rpcvers were broken in older versions of FreeBSD
but were fixed in r296394. Give them some use hoping they help make
the code somewhat more readable.

r301769 (by pfg):

libc/rpc: Make use of some xdr_* macros. (part 2)

xdr_rpcproc, xdr_rpcprog and xdr_rpcvers were broken in older
versions of FreeBSD but fixed in r296394. Give them some use
hoping they help make the code somewhat more readable.

MFC r278041:
r278041 (by pfg):

rpc: Uninitialized pointer read

Initialize *xprt to avoid exposing a random value
in cleanup_svc_vc_create.

CID: 1018723
Phabric: D1749

MFC r287341,r287342,r287348:

r287341 (by rodrigc):

Use ANSI C prototypes.

Eliminates gcc 4.9 warnings.

r287342 (by rodrigc):

Mark unused parameters to reduce gcc 4.9 warnings.

r287348 (by rodrigc):

Use correct function prototype for signal handler.

Eliminates gcc 4.9 warning.

MFC r288113:
r288113 (by rodrigc):

Use ANSI C prototypes. Eliminates -Wold-style-definition warnings.

MFC r297790:
r297790 (by pfg):

libc: replace 0 with NULL for pointers.

While here also cleanup some surrounding code; particularly
drop some malloc() casts.

Found with devel/coccinelle.

MFC r287350:
r287350 (by rodrigc):

Use ANSI C prototypes.

Eliminates gcc 4.9 warnings.

MFC r303889:
libc/rpc: replace comma with semicolon when pertinent.

Uses of commas instead of a semicolons can easily go undetected. The comma
can serve as a statement separator but this shouldn't be abused when
statements are meant to be standalone.

MFC r301704:

Test for strchr(3) returning NULL, not 0

MFC r300624:

Fix up r300385

I accidentally glossed over the fact that tmp is manipulated via strchr, so
if we tried to free `tmp` after r300385, it would have crashed.

Create a separate pointer (tmp2) to track the original allocation of `tmp`,
and free `tmp2` if `p->nc_lookups` can't be malloced

CID: 1356026

MFC r300385:

Don't leak `tmp` if `p->nc_lookups` can't be malloced

MFC r300386:

Don't leak `handle` if svc_tp_create(..) succeeds and allocating a new
struct xlist object fails

CID: 978277

MFC r300387,r300388,r300389:

r300387:

getnetid(..): consistently fclose fd at the end of the function

This mutes a false positive with cppcheck, but also helps eliminate future
potential issues with this variable

r300388:

Call endnetconfig on nc_handle sooner to avoid leaking nc_handle if tmpnconf
was NULL

This would theoretically happen if the netconfig protocol family and protocol
semantics were never matched.

CID: 978179

r300389:

nis_rpcent: don't leak resultbuf from yp_first(..)/yp_next(..)

If the buffer couldn't be adequately resized to accomodate an additional "\n",
it would leak resultbuf by breaking from the loop early

CID: 1016702

MFC r300620,r300621:

r300620:

Use reallocf instead of malloc to fix leak with outbuf_pmap

The previous code overwrote outbuf_pmap's memory with malloc once per
loop iteration, which leaked its memory; use reallocf instead to ensure
that memory is properly free'd each loop iteration.

Add a outbuf_pmap = NULL in the failure case to avoid a double-free
at the bottom of the function.

CID: 1038776

r300621:

Remove redundant NULLing of outbuf_pmap

If reallocf ever failed, outbuf_pmap would already be NULL

MFC r296095:
rpc: fix failure to clear string by passing the wrong size to memset.

Noted by NetBSD's PR/21014

Obtained from: NetBSD (CVS Rev. 1.24, 1.25)

MFC r293715:

Fix a mismerge from NetBSD in r162194 with `xdr_rpcb_entry_list_ptr(..)`

This fixes the potential NULL pointer dereference properly, and also fixes
memory leaks encountered in the process of iterating through `*rp`.

Found by: Valgrind
Submitted by: Miles Ohlrich <miles.ohlrich@isilon.com>

MFC r293705:

Similar to r293704, fix theoretical leak of netconfig(3) resources in
__rpcbind_is_up(..) if getnetconfig(3) is partly successful in allocating
resources, but not completely successful by moving the endnetconfig(3) call
up before we return from the function if nconf == NULL.

Submitted by: Miles Ohlrich <miles.ohlrich@isilon.com>

MFC r293704:

Fix theoretical leak of netconfig(3) resources in svcunix_create(..)

In the event that the getconfig(3) call in svcunix_create is partly successful,
some of the netconfig(3) resources allocated might be leaked if the call returns
NULL as endnetconfig(3) wasn't called explicitly in that case. Ensure that the
resources are fully cleaned up by going to the `done` label, which will call
endnetconfig(3) for us.

Submitted by: Miles Ohlrich <miles.ohlrich@isilon.com>

MFC r292047: RPC: populate local address for rendezvous transporter.

MFC r278932:
r278932 (by pfg):

libc: clean some set-but-not-used errors.

These were found by gcc 5.0 on Dragonfly BSD, however I
made no attempt to silence the false positives.

Obtained from: DragonFly (cf515c3a6f3a8964ad592e524442bc628f8ed63b)

MFC r290253:

Remove unnecessary `if (x)` tests before calling `free(x)`; free(3)
already employs this check

Sponsored by: EMC / Isilon Storage Division

MFC r258580:
Replace Sun RPC license in TI-RPC library with a 3-clause BSD license,
with the explicit permission of Sun Microsystems in 2009.

MFC r258581, 258582:
Replace Sun Industry Standards Source License for Sun RPC code with a
3-clause BSD license as specified by Oracle America, Inc. in 2010.
This license change was approved by Wim Coekaerts, Senior Vice
President, Linux and Virtualization at Oracle Corporation.

MFC r259117, 259118:
Replace Sun RPC license with a 3-clause BSD license. This license change
was approved in 2010 by Wim Coekaerts, Senior Vice President, Linux and
Virtualization at Oracle Corporation.

MFC r259417:
Replace Sun RPC license for TI-RPC library with a 3-clause BSD license,
with the explicit permission of Sun Microsystems in 2009.
The code in question in this file was copied from lib/libc/rpc/pmap_getport.c.

MFC: r265238, r265240

Properly free resources in case of error.

CID: 1007032
Found with: Coverity Prevent(tm)

MFC r258578, r258580, r258581 (by hrs):
Replace Sun RPC license in TI-RPC library with a 3-clause BSD license
with the explicit permissions.

Copy head (r256279) to stable/10 as part of the 10.0-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Assign the len field of the netbuf structure to the current length of
a sockaddr.

Obtained from: NetBSD

rpc: convert all uid and gid variables to u_int.

After further discussion, instead of pretending to use
uid_t and gid_t as upstream Solaris and linux try to, we
are better using u_int, which is in fact what the code
can handle and best approaches the range of values used
by uid and gid.

Discussed with: bde
Reviewed by: bde

rpc: convert all uid and gid variables of the type uid_t and gid_t.

The previous change (based on Solaris) doesn't work properly either
as the casting only has the effect of quieting the compiler.

Move back to the previous solution but adjust the sizeof()
type in xdr_array(). This should mostly work (by accident).

Reported by: bde

rpc: convert all uid and gid variables of the type uid_t and gid_t.

As part of the previous commit, uses of xdr_int() were replaced
with xdr_u_int(). This has undesired effects as the second
argument doesn't match exactly uid_t or gid_t. It also breaks
assumptions in the size of the provided types.

To work around those issues we revert back to the use of xdr_int()
but provide proper casting so the behaviour doesn't change.

While here fix a style issue in the affected lines.

Reported by: bde

libtirpc: be sure to free cl_netid and cl_tp

When creating a client with clnt_tli_create, it uses strdup to copy
strings for these fields if nconf is passed in. clnt_dg_destroy frees
these strings already. Make sure clnt_vc_destroy frees them in the same
way.

This change matches the reference (OpenSolaris) implementation.

Tested by: David Wolfskill
Obtained from: Bull GNU/Linux NFSv4 Project (libtirpc)
MFC after: 2 weeks

Fix __rpc_getconfip

__rpc_getconfip is supposed to return the first netconf
entry supporting tcp or udp, respectively. The code will
currently return the *last* entry, plus it will leak
memory when there is more than one such entry.

This change matches the reference (OpenSolaris)
implementation.

Tested by: David Wolfskill
Obtained from: Bull GNU/linux NFSv4 Project (libtirpc)
MFC after: 1 week

RPC: Convert all uid and gid variables of the type uid_t and gid_t.

This matches what upstream (OpenSolaris) does.

Tested by: David Wolfskill
Obtained from: Bull GNU/Linux NFSv4 project (libtirpc)
MFC after: 3 days

Complete revert of r239963:

The attempt to merge changes from the linux libtirpc caused
rpc.lockd to exit after startup under unclear conditions.

After many hours of selective experiments and inconsistent results
the conclusion is that it's better to just revert everything and
restart in a future time with a much smaller subset of the
changes.
____

MFC after: 3 days
Reported by: David Wolfskill
Tested by: David Wolfskill

Partial revert of r239963:

The following change caused rpc.lockd to exit after startup:
____

libtirpc: be sure to free cl_netid and cl_tp

When creating a client with clnt_tli_create, it uses strdup to copy
strings for these fields if nconf is passed in. clnt_dg_destroy frees
these strings already. Make sure clnt_vc_destroy frees them in the
same way.
____

MFC after: 3 days
Reported by: David Wolfskill
Tested by: David Wolfskill

Rework all non-contributed files that use `struct timezone'.

This structure is not part of POSIX. According to POSIX, gettimeofday()
has the following prototype:

int gettimeofday(struct timeval *restrict tp, void *restrict tzp);

Also, POSIX states that gettimeofday() shall return 0 (as long as tzp is
not used). Remove dead error handling code. Also use NULL for a
nul-pointer instead of integer 0.

While there, change all pieces of code that only use tv_sec to use
time(3), as this provides less overhead.

Bring some changes from Bull's NFSv4 libtirpc implementation.

We especifically ignored the glibc compatibility changes
but this should help interaction with Solaris and Linux.
____

Fixed infinite loop in svc_run()
author Steve Dickson
Tue, 10 Jun 2008 12:35:52 -0500 (13:35 -0400)
Fixed infinite loop in svc_run()
____

__rpc_taddr2uaddr_af() assumes the netbuf to always have a
non-zero data. This is a bad assumption and can lead to a
seg-fault. This patch adds a check for zero length and returns
NULL when found.
author Steve Dickson
Mon, 27 Oct 2008 11:46:54 -0500 (12:46 -0400)
____

Changed clnt_spcreateerror() to return clearer
and more concise error messages.
author Steve Dickson
Thu, 20 Nov 2008 08:55:31 -0500 (08:55 -0500)
____

Converted all uid and gid variables of the type uid_t and gid_t.
author Steve Dickson
Wed, 28 Jan 2009 12:44:46 -0500 (12:44 -0500)
____

libtirpc: set r_netid and r_owner in __rpcb_findaddr_timed

These fields in the rpcbind GETADDR call are being passed uninitialized
to CLNT_CALL. In the case of x86_64 at least, this usually leads to a
segfault. On x86, it sometimes causes segfaults and other times causes
garbage to be sent on the wire.

rpcbind generally ignores the r_owner field for calls that come in over
the wire, so it really doesn't matter what we send in that slot. We just
need to send something. The reference implementation from Sun seems to
send a blank string. Have ours follow suit.
author Jeff Layton
Fri, 13 Mar 2009 11:44:16 -0500 (12:44 -0400)
____

libtirpc: be sure to free cl_netid and cl_tp

When creating a client with clnt_tli_create, it uses strdup to copy
strings for these fields if nconf is passed in. clnt_dg_destroy frees
these strings already. Make sure clnt_vc_destroy frees them in the same
way.

author Jeff Layton
Fri, 13 Mar 2009 11:47:36 -0500 (12:47 -0400)

Obtained from: Bull GNU/Linux NFSv4 Project
MFC after: 3 weeks

Jump to the failed label instead of doing cleanup ourselves.

Obtained from: DragonFly BSD
MFC after: 2 weeks

General mdoc(7) and typo fixes.

PR: 167734
Submitted by: Nobuyuki Koganemaru (kogane!jp.freebsd.org)
MFC after: 3 days

Plug a leak.

Submitted by: Greg Bednarek <gbednarek averesystems com>
MFC after: 1 week

Fix several memory and lock leaks on the out of memory condition.

Reported by: Matt Miller <matt matthewjmiller net>
MFC after: 1 week

Remove unnecessary Xo/Xc.

Reviewed by: brueffer

Minor mdoc nit.

Globally replace u_int*_t from (non-contributed) man pages.

The reasoning behind this, is that if we are consistent in our
documentation about the uint*_t stuff, people will be less tempted to
write new code that uses the non-standard types.

I am not going to bump the man page dates, as these changes can be
considered style nits. The meaning of the man pages is unaffected.

MFC after: 1 month

Consistently set RPCGEN_CPP when running rpcgen, so the C preprocessor
set via ${CPP} is used, instead of always using hardcoded /usr/bin/cpp.

MFC after: 1 week

In lib/libc/rpc/crypt_client.c, fix a clang warning about an implicit
conversion between enum desdir/desmode from include/rpc/des.h, and enum
desdir/desmode from include/rpcsvc/crypt.x. These are actually
different enums, with different value names, but by accident the integer
representation of the enum values happened to be the same.

MFC after: 1 week

Fix a bug in the userland rpc library, where it would use a
negative return value from write to update its position in
a buffer. The patch, courtesy of Andrey Simonenko, also simplifies
a conditional by removing the "i != cnt" clause, since it is
always true at this point in the code. The bug caused problems
for mountd, when it generated a large reply to an exports RPC
request.

Submitted by: simon at comsys.ntu-kpi.kiev.ua
MFC after: 2 weeks

Revert most of r210764, now that mdocml does the right
thing with empty quotation macros.

Requested by: Alex Kozlov

Move most of the remaining USD/PSD/SMM papers into share/doc

mdoc: make sure to pass at least one argument to quotation macros

Fix a bug in the previous change: remove function-local definition of
tcp_key and udp_key that shadows the global definition.

PR: threads/144558
Submitted by: Sam Robb

Use thr_once() with once_t controls to initialize various thread_key_t
objects used to provide per-thread storage in the RPC code. Almost all
of these used double-checking with a dedicated mutex (tsd_lock) to do this
before. However, that is not always safe with more relaxed memory orders.
There were also other bugs, such as one in __rpc_createrr() that caused a
new key to be allocated each time __rpc_createrr() was invoked.

PR: threads/144558
Reported by: Sam Robb samrobb of averesystems com (key leak)
MFC after: 1 week

Use the correct types to store uids and gids in the credential cache.

Fix a double free().

PR: 142339
Submitted by: Henning Petersen <henning.petersen@t-online.de>
MFC after: 2 weeks

The fd_mask type is an unsigned long, not an int, so treat the mask as a
long instead of an int when examining the results of select() to look for
RPC requests. Previously this routine would ignore RPC requests to sockets
whose file descriptor mod 64 was greater than 31 on a 64-bit platform.

PR: amd64/141130
Submitted by: liujb of array networks
MFC after: 3 days

Style: use structure assignment rather than memcpy() to copy a
structure.

In clnt_raw_create(), avoid minor race condition initializing the
file-scope variable clntraw_private.

Found by: Clang static analyzer
MFC after: 7 days

In svc_raw_reply(), don't leave stat uninitialized if the MSG_ACCEPTED
&& SUCCESS case succeeds. The stack garbage might be zero.

Found by: Clang static analyzer
MFC after: 7 days

Eliminate more dead stores.

Found by: Clang static analyzer
MFC after: 7 days

Lock around access to nc_file and netconfig_info ("ni"). The RPC
part of libc is still not thread safe but this would at least
reduce the problems we have.

PR: threads/118544
Submitted by: Changming Sun <snnn119 gmail com>
MFC after: 2 weeks

Rework the credential code to support larger values of NGROUPS and
NGROUPS_MAX, eliminate ABI dependencies on them, and raise the to 1024
and 1023 respectively. (Previously they were equal, but under a close
reading of POSIX, NGROUPS_MAX was defined to be too large by 1 since it
is the number of supplemental groups, not total number of groups.)

The bulk of the change consists of converting the struct ucred member
cr_groups from a static array to a pointer. Do the equivalent in
kinfo_proc.

Introduce new interfaces crcopysafe() and crsetgroups() for duplicating
a process credential before modifying it and for setting group lists
respectively. Both interfaces take care for the details of allocating
groups array. crsetgroups() takes care of truncating the group list
to the current maximum (NGROUPS) if necessary. In the future,
crsetgroups() may be responsible for insuring invariants such as sorting
the supplemental groups to allow groupmember() to be implemented as a
binary search.

Because we can not change struct xucred without breaking application
ABIs, we leave it alone and introduce a new XU_NGROUPS value which is
always 16 and is to be used or NGRPS as appropriate for things such as
NFS which need to use no more than 16 groups. When feasible, truncate
the group list rather than generating an error.

Minor changes:
- Reduce the number of hand rolled versions of groupmember().
- Do not assign to both cr_gid and cr_groups[0].
- Modify ipfw to cache ucreds instead of part of their contents since
they are immutable once referenced by more than one entity.

Submitted by: Isilon Systems (initial implementation)
X-MFC after: never
PR: bin/113398 kern/133867

In preparation for raising NGROUPS and NGROUPS_MAX, change base
system callers of getgroups(), getgrouplist(), and setgroups() to
allocate buffers dynamically. Specifically, allocate a buffer of size
sysconf(_SC_NGROUPS_MAX)+1 (+2 in a few cases to allow for overflow).

This (or similar gymnastics) is required for the code to actually follow
the POSIX.1-2008 specification where {NGROUPS_MAX} may differ at runtime
and where getgroups may return {NGROUPS_MAX}+1 results on systems like
FreeBSD which include the primary group.

In id(1), don't pointlessly add the primary group to the list of all
groups, it is always the first result from getgroups(). In principle
the old code was more portable, but this was only done in one of the two
places where getgroups() was called to the overall effect was pointless.

Document the actual POSIX requirements in the getgroups(2) and
setgroups(2) manpages. We do not yet support a dynamic NGROUPS, but we
may in the future.

MFC after: 2 weeks

Re-do r192913 in less intrusive way. Only do IP_RECVDSTADDR/IP_SENDSRCADDR
dace for UPDv4 sockets bound to INADDR_ANY. Move the code to set
IP_RECVDSTADDR/IP_SENDSRCADDR into svc_dg.c, so that both TLI and non-TLI
users will be using it.

Back out my previous commit to mountd. Turns out the problem was affecting
more than one binary so it needs to me addressed in generic rpc code in
libc in order to fix them all.

Reported by: lstewart
Tested by: lstewart

Do not attempt to set source address on outgoing messages
on UDP socket if we do not have a valid IP address.

Match type for socket option (in practice, unnecessary, but stylistically it's a little nicer).

Suggested by: jilles
Approved by: dfr (mentor)

Handle UDP RPC replies correctly on a multi-homed system, in userland RPC. Corrects an issue with mountd replies to OS X.

Approved by: dfr (mentor)

Include a space between "send" and "broadcast".

Remove a warning which is supposed to have been removed on 20030301.

Fix async mode (required for ypbind in manycast mode).

Initialise the SVCAUTH field for new transport structures when they are
allocated instead of waiting for the first request. This fixes an issue with
rpcbind's support for PMAPPROC_CALLIT.

Reviewed by: markm

Add an implementation of the RPCSEC_GSS authentication protocol for RPC. This
is based on an old implementation from the University of Michigan with lots of
changes and fixes by me and the addition of a Solaris-compatible API.

Sponsored by: Isilon Systems
Reviewed by: alfred

Don't call xdrrec_skiprecord in the non-blocking case. If
__xdrrec_getrec has returned TRUE, then we have a complete request in
the buffer - calling xdrrec_skiprecord is not necessary. In particular,
if there is another record already buffered on the stream,
xdrrec_skiprecord will discard both this request and the next
one, causing the call to xdr_callmsg to fail and the stream to be
closed.

Sponsored by: Isilon Systems

Use intermediate pointers to avoid strict alias type check failures
using gcc 4.2. This is required for tinderbox which doesn't have
-fno-strict-aliasing in it's custom CFLAGS.

Fix some improper handling of malloc failures

PR: bin/83344 , kern/81987
Reviewed by: alfred
Approved by: re (kensmith)
MFC after: 1 week

Use an array of size NGROUP_MAX for the getgroups() call instead of NGRP.
When NGROUP_MAX is larger than NGRP the call used to fail. Now the call
succeedes, but only the first NGRP groups are actually used for authentication.

Some libc symbol map cleanups.

net: endhostdnsent is named _endhostdnsent and is
private to netdb family of functions.

posix1e: acl_size.c has been never compiled in,
so there's no "acl_size".

rpc: "getnetid" is a static function.

stdtime: "gtime" is #ifdef'ed out in the source.

some symbols are specific only to some architectures,
e.g., ___tls_get_addr is only defined on i386.

__htonl, __htons, __ntohl and __ntohs are no longer
functions, they are now (internal) defines in
<machine/endian.h>.

Submitted by: ru

endrpcent belongs with rpc name service db, not services.

MFC after: 1 week

Use C comments since we now preprocess these files with CPP.

Disable RPC exponential back-off for FreeBSD.org systems (IE. hidden
behind _FREEFALL_CONFIG). This is done mainly to make NIS even more
resistant to packet loss.

This is not enabled by default for "normal" FreeBSD since it might cause
the server providing the RPC service to be hit heavily with RPC traffic
in case of problems. freefall.FreeBSD.org and hub.FreeBSD.org have been
running with a patch similar to this for a couple of weeks.

MFC after: 1 week
Discussed with: peter

o Remove duplicate includes.

Obtained from: Slava Semushin via NetBSD

Markup fixes.

Sync with NetBSD rev. 1.16 + 1.17

Coverity CID 2292: Plug memory leak.
Coverity CID 2291: Move function call before allocating storage to prevent
memory leak on error.

MFC after: 1 month

Sync with NetBSD rev. 1.29

Coverity CID 2293: Fix memory leak.

MFC after: 1 month

Sync with NetBSD rev. 1.6 + 1.7

Coverity CID 779 + 780: Avoid NULL pointer dereference.

MFC after: 1 month

Sync with NetBSD rev. 1.20 + 1.21

Coverity CID 2284: Fix multiple memory leaks.
Coverity CID 710: Remove unreachable code.

MFC after: 1 month

Sync with NetBSD rev. 1.10

Coverity CID 2276: Don't leak memory on error.

MFC after: 1 month

Sync with NetBSD rev. 1.15

Coverity CID 2275: Avoid memory leak on error.

MFC after: 1 month

Sync part of NetBSD rev. 1.14

Fix unpaired sigblock which possibly leaves the process with all
signals blocked.

MFC after: 2 weeks

Sync with NetBSD rev. 1.16 + 1.17

Coverity CID 3651: Don't leak ifaddrs on getaddrinfo failure.
Coverity CID 2283: Don't leak sys_auth on error.

MFC after: 1 month

- Extend the nsswitch to support Services, Protocols and Rpc
databases.
- Make nsswitch support caching.

Submitted by: Michael Bushkov <bushman__at__rsu.ru>
Sponsored by: Google Summer of Code 2005

Add each directory's symbol map file to SYM_MAPS.

Add symbol maps and initial symbol version definitions to libc.

Reviewed by: davidxu

Const'ify arguments to a couple of functions to fix breakage
with -O2.

Don't do a time travel to 12006...

Staticize a couple of functions.

Remove a few unused locks.

Remove locks from application namespace.

I wrote getnetconfig where I meant getnetpath in the previous revision.

o Document the possibility of putting 'b' in the flag field.
While we don't use the NC_BROADCAST value of nc_flag anywhere in the
RPC code, it is parseable by getnetconfigent(3) from /etc/netconfig.

o Clean up some "see below"'s that were cut and pasted from netconfig.h.

Fix prototypes.

Add a couple of missing MLINKS.

Avoid pointer arithmetics on void *.

Approved by: alfred

Remove an superfluous assignment.

Approved by: alfred

Use socklen_t where appropriate.

Approved by: alfred

Expand *n't contractions.

Fixed the misplaced $FreeBSD$.

Sort sections.

Add knob NO_NIS (fka NO_YP_LIBC) and make world compileable when set.
If turned on no NIS support and related programs will be built.

Lost parts rediscovered by: Danny Braniss <danny at cs.huji.ac.il>
PR: bin/68303
No objections: des, gshapiro, nectar
Reviewed by: ru
Approved by: rwatson (mentor)
MFC after: 2 weeks

Try to bring some sanity to the SCM ID's.
+ spell LIBC_SCCS consistently
+ enable builds with LIBC_SCCS defined to not syntax error
+ minor SCM reformatting to try to have some consistency

Avoid using void pointers in additive expressions.

PR: 56653 (libc/rpc bits)
Approved by: alfred

Eliminate double whitespace.

Mechanically kill hard sentence breaks.

Make NULL a (void*)0 whereever possible, and fix the warnings(-Werror)
that this provokes. "Wherever possible" means "In the kernel OR NOT
C++" (implying C).

There are places where (void *) pointers are not valid, such as for
function pointers, but in the special case of (void *)0, agreement
settles on it being OK.

Most of the fixes were NULL where an integer zero was needed; many
of the fixes were NULL where ascii <nul> ('\0') was needed, and a
few were just "other".

Tested on: i386 sparc64

style cleanup: Remove duplicate $FreeBSD$ tags.

These files had tags at the start of the file
(incorrect, removed), and after the copyright
notices (correct).

Approved by: rwatson (mentor)

XDR sources are handled by ../xdr/Makefile.inc.

Add missing declaration.

Make this part identical with NetBSD: Use recvlen instead of inlen.
No functionality change.

Obtained from: NetBSD

Don't compare NULL against a character.

Obtained from: NetBSD

Don't use NULL to compare against a char.

Obtained from: NetBSD

Don't use NULL to compare against a character.

Obtained from: NetBSD

Get rid of duplicates.

mdoc(7): Use the new feature of the .In macro.

Clarify text

Kill prototype for __msgwrite too. It is not needed anymore.

Replace the old SCM_CREDS cred procedures. They can now be
replaced just fine with getpeereid() and the whole code
gets a lot simpler. We don't break the ABI, since all server
programms use __rpc_get_local_uid(), and we just change library
internals.

Reviewed by: des

Don't return -1 and abort if msg.msg_controllen is 0. For
some strange reason recvmsg() never sets errno to EAGAIN
on a non-blocking socket and just returns 0.

Reviewed by: jhb
Approved by: re

Fix a problem introduced in the last commit. sa and cm
are not initialized at this place. Move the initializing
before the non-blocking check.

Submitted by: Marius Strobl <marius@alchemy.franken.de>
Reviewed by: jhb
Approved by: re

If AF_LOCAL is used, we need to use __msgread_withcred() instead of
just read() in non-blocking mode too. The reason is obvious. NetBSD
uses a complete different way to get the credentials so this patch
only applies to FreeBSD.

Reviewed by: rwatson
Approved by: re

Fix a simple bug that prevents svc_tli_create to bind to the address
specified by caller.

NetBSD rev. 1.6

Reviewed by: rwatson
Approved by: rwatson (re)
Obtained from: NetBSD

Back out the `hiding' of strlcpy and strlcat. Several people
vocally objected to this safety belt.

`Hide' strlcpy and strlcat (using the namespace.h / __weak_reference
technique) so that we don't wind up calling into an application's
version if the application defines them.

Inspired by: qpopper's interfering and buggy version of strlcpy

Clean up some signed/unsigned issues in the XDR code.

Obtained from: OpenBSD

Eliminate 19 warnings in libc (at level WARNS=2) of the
`implicit declaration of function' variety.

Eliminate 61 warnings emitted at WARNS=2 (leaving 53 to go).
Only warnings that could be fixed without changing the generated object
code and without restructuring the source code have been handled.

Reviewed by: /sbin/md5

The .Fn function

Fix signed/unsigned comparison warnings.

Reviewed by: phk
Obtained from: NetBSD

Fix signed/unsigned comparison warnings. Fix spelling error in
comment.

NetBSD Rev. 1.9 and 1.7

Reviewed by: phk
Obtained from: NetBSD

Make this work in the !INET6 case -- if we mismatch the AF, don't return a
bogus (uninitialized) structure. Also, ignore v4 ifa's with no broadcast
address (rather than core dumping).

NetBSD Rev 1.8

Reviewed by: phk
Obtained from: NetBSD

Check pmap_flag before sendto.

NetBSD r 1.5

Reviewed by: phk
Obtained from: NetBSD

Make sure we don't look before the beginning of the string.

NetBSD Rev 1.5

Reviewed by: phk
Obtained from: NetBSD

Add missing __rpc_fixup_addr. This is needed to make
mount_nfs -T work for scoped addresses.

NetBSD Rev 1.11

Reviewed by: phk
Obtained from: NetBSD

Free the correct buffer in error handling.
Handle that malloc may return NULL.

NetBSD Rev. 1.8

Reviewed by: phk
Obtained from: NetBSD

Fix namespace pollution introduced in previous commit.

Reviewed by: phk

Fix memleak.

Reviewed by: rwatson
MFC after: 2 weeks

Implement non-blocking tcp-connections.

Reviewed by: rwatson
Obtained from: NetBSD
MFC after: 1 day

Correct typos, mostly s/ a / an / where appropriate. Some whitespace cleanup,
especially in troff files.

english(4) police.

mdoc(7) police: "The .Fa argument.".

mdoc(7) police: "The .Fn function".

Change the name for the local unix-socket based protocol
from "unix" back to "local". Add some compat stuff so both
ways work for some time.

Reviewed by: phk
Approved by: imp (UPDATING)
Requested by: iedowse, lukem@netbsd.org

Uniformly refer to a file system as "file system".

Approved by: re

libc_r wasn't so tied to libc for 22 months.

Cosmetics.

bsd.doc.mk changes:

Don't gratuitously pipe thru a cat(1) if NODOCCOMPRESS.

Only create _stamp.extra when necessary.

Get rid of SOELIMPP and OBJS.

Use Groff version of soelim(1); we need its -I option
for the following to work.

Don't needlessly chdir to SRCDIR. Only a few documents
need CD_HACK, and those that need it either use refer(1)
or .PSPIC macro which internally uses the .psbb call.

Use kqueue(2) instead of poll(2) to wait for replies and timeouts
in the UDP RPC client code. As a side-effect, this fixes some bugs
that might prevent the RPC call from ever timing out for example
if the server keeps responding with the wrong xid. This could
probably be simplified further by using the EVFILT_TIMER filter.

Fix documentation of clnt_control()'s CL{GET|SET}_{VERS|XID} to
reflect that they actually require a u_int32_t *, which is not
necessarily the same as an unsigned long *.

xdr.3 is added to MAN in ../xdr/Makefile.inc where it belongs, so don't
add it here.

mdoc(7) police: whitespace nits.

Revert part of revision 1.10, as it broke portmap lookups for IPv4
TCP clients. The problem was that a struct netconfig returned by
getnetconfigent() was being treated as a handle for __rpc_getconf(),
which certainly isn't right.

The tirpc-99 code uses __rpc_setconf("udp")/__rpc_getconf() to find
the IPv4 udp netconfig, but our implementation of these functions
seem happy to return IPv6 entries, so we can't use them. By reverting
to the old version, we are hard-coding the name of the udp4 netid.

Tracked down by: Bakul Shah <bakul@bitblocks.com>

Fix "rpcinfo -m" when talking to other implementations of rpcbind.

Submitted by: mbr (NetBSD PR#15802)

clnt_vc_create() has const scalar arguments that wind up being modified,
fix it (make them non-const) and update the associated documentation.

Submitted by: mbr

Cast function args to silence warning.

Submitted by: mbr

Add a prototype for __rpcb_findaddr_timed to silence a warning.

Silence several warnings due to functions that needed to take a void *
having a char * as an argument instead. clnt_dg_control(), clnt_raw_control(),
clnt_vc_control().

Update manpages to reference 'timed' rpc functions

Add functions allowing for the user to specify a timeout for rpc functions.

Update copyrights to reflect where this code was lifted from. (tirpc '99)

Submitted by: mbr

s/demon/daemon/

Spell void * as void * rather than caddr_t. This is complicated by the
fact that caddr_t is often misspelled as char *.

Sponsored by: DARPA, NAI Labs

Fix the style of the SCM ID's.
I believe have made all of libc .c's as consistent as possible.

Fix the style of the SCM ID's.
I believe have made all of libc .h's as consistent as possible.

Constify the first arg to callrpc(3).

Remove multi-line __P() usage.

Remove __P() usage.

Remove 'register' keyword.

o Move NTOHL() and associated macros into <sys/param.h>. These are
deprecated in favor of the POSIX-defined lowercase variants.
o Change all occurrences of NTOHL() and associated marcros in the
source tree to use the lowercase function variants.
o Add missing license bits to sparc64's <machine/endian.h>.
Approved by: jake
o Clean up <machine/endian.h> files.
o Remove unused __uint16_swap_uint32() from i386's <machine/endian.h>.
o Remove prototypes for non-existent bswapXX() functions.
o Include <machine/endian.h> in <arpa/inet.h> to define the
POSIX-required ntohl() family of functions.
o Do similar things to expose the ntohl() family in libstand, <netinet/in.h>,
and <sys/param.h>.
o Prepend underscores to the ntohl() family to help deal with
complexities associated with having MD (asm and inline) versions, and
having to prevent exposure of these functions in other headers that
happen to make use of endian-specific defines.
o Create weak aliases to the canonical function name to help deal with
third-party software forgetting to include an appropriate header.
o Remove some now unneeded pollution from <sys/types.h>.
o Add missing <arpa/inet.h> includes in userland.

Tested on: alpha, i386
Reviewed by: bde, jake, tmm

Fix two file descriptor leaks in the internal function local_rpcb()
that is used by a number of rpcbind-related library functions. Also
fix a rpc client leak in rpcb_set().

Submitted by: mbr
Obtained from: NetBSD

Move the AF_LOCAL check to the AF_INET check since portmap protocol
v. 2 only needs this. That also makes it shorter and simpler.

Submitted by: mbr

For RPC v2 we need to fill in ret->xp_raddr too. INET_6
is not supported in portmap, so we don't have to care about it.

Submitted by: mbr

Fix cc -Wall, fix rcsid warnings, add missing prototypes,
change prototypes to be the same as in the original sun tirpc code.
Remove ()P macro in a file where the mayority had ()P already removed.
Add them if the mayority use ()P macros.

Submitted by: mbr
Requested by: bde

Do not call addrinfo on local transport adresses, if returning a
server handle (for reuse or whatever). We just return now a handle
connected to the local rpcbind.

Do not try to call checkcache, if host = NULL;

Submitted by: mbr

style: return(x) -> return (x)

Submitted by: mbr

Fix the credential handling code.

In NetBSD, Solaris, xprt->xp_p2 pointed directly to the credentials,
in FreeBSD xprt->xp_verf.oa_base was a pointer to a struct cmessage,
which is defined as follow:

struct cmessage {
struct cmsghdr cmsg;
struct cmsgcred cmcred;
};

The credentials were submitted the right way and xprt->xp_p2 pointed to them.
But cb_verf.oa_flavor was still empty. There was an assignment missing
in svc_recv() in svc_vc.c:

msg->rm_call.cb_verf.oa_flavor = AUTH_UNIX;

Also

+ if (addr.ss_family == AF_LOCAL) {
+ xprt->xp_raddr = *(struct sockaddr_in *)xprt->xp_rtaddr.buf;
+ xprt->xp_addrlen = sizeof (struct sockaddr_in);
+ }

was missing. But the first seems not to be needed:

I guess in rpc.yppasswdd there was a typo:

- transp>xp_verf.oa_flavor != AUTH_UNIX) {
+ rqstp->rq_cred.oa_flavor != AUTH_UNIX) {

This little fix does fix the breakage in rpc.yppasswdd :-)

+ if (msg.msg_controllen == 0 ||
+ (msg.msg_flags & MSG_CTRUNC) != 0)
+ return (-1);

We cannot set the cb_verf.oa_length in svc_recv() of svc_vc.c,
the credentials get overwritten then, and that's bad.

Submitted by: mbr

The clnt_create(KEYSERVSOCK, CRYPT_PROG, CRYPT_VERS, "unix") hacks
were removed and replaced them with clnt_tp_create, now the af_local
support is fixed.

I also removed the hack how rpcinfo contacted rpcbind, now we can
relay on clnt_tp_create create the client-handle for us. Only
rpcbind itself needs a hardcoded socket-path.

Submitted by: mbr

Also add $FreeBSD

clnt_bcast.c:420:33: warning: extra tokens at end of #endif directive

mdoc(7) police: consistently use the .Ux macro.

s/kernal/kernel

Add compatibility functions for the AF_LOCAL RPC transport stuff
that used to live in RPC 4.0. This is needed for yppasswd and
rpc.yppasswdd to work correctly. Patch supplied by Martin Blapp.

Hopefully improve control message passing over Unix domain sockets.

1) Allow the sending of more than one control message at a time
over a unix domain socket. This should cover the PR 29499.

2) This requires that unp_{ex,in}ternalize and unp_scan understand
mbufs with more than one control message at a time.

3) Internalize and externalize used to work on the mbuf in-place.
This made life quite complicated and the code for sizeof(int) <
sizeof(file *) could end up doing the wrong thing. The patch always
create a new mbuf/cluster now. This resulted in the change of the
prototype for the domain externalise function.

4) You can now send SCM_TIMESTAMP messages.

5) Always use CMSG_DATA(cm) to determine the start where the data
in unp_{ex,in}ternalize. It was using ((struct cmsghdr *)cm + 1)
in some places, which gives the wrong alignment on the alpha.
(NetBSD made this fix some time ago).

This results in an ABI change for discriptor passing and creds
passing on the alpha. (Probably on the IA64 and Spare ports too).

6) Fix userland programs to use CMSG_* macros too.

7) Be more careful about freeing mbufs containing (file *)s.
This is made possible by the prototype change of externalise.

PR: 29499
MFC after: 6 weeks

Fixed bitrot in synopsis. The TI-RPC changes gave mounds of it, mainly
inconsistently weird const poisoning in the man pages relative to the
headers.

mdoc(7) police: Use the new .In macro for #include statements.

Fixed namespace pollution related to `warn' in libc (but not in other
libraries or for other members of the err() family).

This fixes world breakage in bc and rcs/* for NOSHARED worlds.

Handle snrintf() returning -1.

MFC after: 2 weeks

mdoc(7) police: join split punctuation to macro calls.

In getclnthandle(), if the address is found in the cache we need
to strdup() the address string before returning it via *targaddr
because the caller will free the string.

Change the comment at the top of getclnthandle() to clarify that
the caller is responsible for freeing *targaddr.

Noticed by: sobomax

Finish the sweep of changes that fix doubled 'the'.

Remove whitespace at EOL.

Fix a memory leak in __rpcb_findaddr(), avoid compiler warnings.

Submitted by: Martin Blapp <mb@imp.ch>

mdoc(7) police: sort SEE ALSO xrefs (sort -b -f +2 -3 +1 -2).

mdoc(7) police: sort xrefs.

Remove duplicate words.

Add a new clnt_control() request `CLSET_CONNECT' that controls
whether or not connect(2) is used for UDP client sockets. The default
is not to connect(), so existing clients will see no change in
behaviour.

The use of connect(2) for UDP clients has a number of advantages:
only replies from the intended address are received, and ICMP errors
pertaining to the connection are reported back to the application.

Fix typo: clnt_destroy() only takes one arg.

MFC after: 2 weeks

Correct cross-reference:
portmap.8 --> rpcbind.8

Submitted by: .Xr testing script

Fix cross-references:
ipnat.8 --> ipnat.1
environ.5 --> environ.7
isssetugid.2 --> issetugid.2

MFC after: 1 week

Copy the sockaddr from the netbuf data area, not from the netbuf
data pointer. This bug has been here since the ti-rpc import; it
apparently broke the clnt_control CLGET_SVC_ADDR options.

PR: misc/27813
Submitted by: Jean-Luc Richier <Jean-Luc.Richier@imag.fr>

The function clnt_dg_call(), which is used for UDP RPC calls, could
accidentally clobber the server address if a stray packet arrived
at the client port. This would result in any further retransmits
going to the wrong address.

For now, fix this by not saving the source address of the reply; this
matches the pre-tirpc behaviour.

Extract the path from an AF_LOCAL sockaddr_un in a way that correctly
terminates the string in all cases, based on code from netstat(1).
The path in a sockaddr_un is terminated either by a '\0', or by
the end of the sockaddr as defined by sun_len.

Previously, the code could write the "safety" '\0' beyond the end
of the sockaddr (sockaddr_un's need only be large enough to store
sun_len bytes), and writing into the the supplied sockaddr is bad
anyway.

The function __rpc_uaddr2taddr_af() converts an RPC "universal
address" string to a netbuf/sockaddr "transport address". In the
case of an AF_LOCAL address, it was missing the code to actually
point the netbuf at the newly allocated sockaddr_un, so the caller
ended up with a netbuf containing junk.

Submitted by: Martin Blapp <mb@imp.ch>

The maximum RPC message size was set at 8k for UDP. This is lower
than the default buffer size in the old RPC code (8800 bytes), and
it could not be overriden by the application. This caused problems
with CFS (/usr/port/security/cfs).

Change this default back to UDPMSGSIZE (8800 bytes), but more
importantly, allow applications to use larger message sizes for
all protocols if desired. Choose an arbitrary maximum message size
of 256k instead of using the default as the maximum (which is
silly).

Reported by: ache
Reviewed by: alfred, Martin Blapp <mb@imp.ch>

Fix some very broken code in __nc_error() that implements per-thread
`nc_error' variables. Move the nc_lock mutex from mt_misc.c to a
static variable within this function, since it is only used here.

Add a new getnetconfigent() error code `NC_NOTFOUND' to report the
case where the specified netid was not found. Set nc_error in all
error cases in getnetconfigent() so that the error messages returned
by nc_(s)perror are always meaningful.

Add a terminating \n to the output of nc_perror() to match both
our manpage and other implementations of this function.

Reviewed by: deischen, alfred, Martin Blapp <mb@imp.ch>

Remove some hacks that were apparently added to avoid problems with
RPC clients hanging. The real problem turned out to be missing
cleanup code; this was fixed in clnt_vc.c r1.5 and clnt_dg.c r1.4.

Submitted by: Martin Blapp <mb@imp.ch>

There were a few error cases where the RPC code would return with
all signals masked (whoops). Add the missing cleanup code.

Reviewed by: Martin Blapp <mb@imp.ch>, alfred

Move the #includes of reentrant.h to after the `#include "namespace.h"',
so that the underscored versions of the pthread functions get
declared. This removes around 300 lines of 'implicit declaration
of XXX' warnings from the output of a libc build with -Wall.

Reviewed by: Martin Blapp <mb@imp.ch>, alfred

Add a CLSET_ASYNC command, which allows us to (ab)use the clnt_dg transport
to make asynchronous RPCs. This is needed to help fix ypbind, which can no
longer override the clnt_dg_call() method (formerly the clntudp_call()
method) due to all the internal descriptor locking code in TI-RPC. Turning
on this flag allows us to send an RPC request, then return immediately,
and handle a reply later, rather than being forced to do the request
and reply in a single function call.

Also fix a byte ordering bug: when clnt_dg_call() increments the XID
prior to transmitting a request, it uses the raw value, which is wrong.
The XID is stored in network byte order, i.e. big-endian. The CLSET_XID
and CLGET_XID commands in clnt_dg_control() use ntohl()/htonl() to get
the byte ordering right, but because clnt_dg_call() does not do this,
using CLSET_XID/CLGET_XID doesn't actually work, unless you're on a
big endian host, which we aren't (yet). Fix clnt_dg_call() to byte swap
properly when doing the increment.

MAN[1-9] -> MAN.

const'ify

Fix rcsid/$FreeBSD$.
Reduce diff from what I think is the original sources.

fix Alpha support

change callrpc() from taking "char *" args, I'm quite sure they really meant
to use "void *".

remove a duplicate prototype for callrpc() from libexec/ypxfr/ypxfr_extern.h

Remove struct cmessage from sys/socket.h and reintroduce the private
definitions.

Requested by: wollman

Hopefully fix some of the bugs in passing credentials over UNIX domain sockets.

Make struct cmessage visible from socket.h (about 4 places were
defining it for themselves which wasn't good)

Make __rpc_get_local_uid() useable and give it prototype that's
visible.

Fix some issues with printing out usernames from rpcbind and keyserv.

whitespace cleanup

Fixed some typos.

This manpage is heavily based on the old rpc.3 manpage, and
should have been repo-copied from it in the first place.

Apply all of our fixes up to and including revision 1.14 to
the original rpc.3 manpage, including conversion to mdoc(7).

Removed the second copy of the manual page!

Removed duplicate $FreeBSD$.

Bring in a hybrid of SunSoft's transport-independent RPC (TI-RPC) and
associated changes that had to happen to make this possible as well as
bugs fixed along the way.

Bring in required TLI library routines to support this.

Since we don't support TLI we've essentially copied what NetBSD
has done, adding a thin layer to emulate direct the TLI calls
into BSD socket calls.

This is mostly from Sun's tirpc release that was made in 1994,
however some fixes were backported from the 1999 release (supposedly
only made available after this porting effort was underway).

The submitter has agreed to continue on and bring us up to the
1999 release.

Several key features are introduced with this update:
Client calls are thread safe. (1999 code has server side thread
safe)
Updated, a more modern interface.

Many userland updates were done to bring the code up to par with
the recent RPC API.

There is an update to the pthreads library, a function
pthread_main_np() was added to emulate a function of Sun's threads
library.

While we're at it, bring in NetBSD's lockd, it's been far too
long of a wait.

New rpcbind(8) replaces portmap(8) (supporting communication over
an authenticated Unix-domain socket, and by default only allowing
set and unset requests over that channel). It's much more secure
than the old portmapper.

Umount(8), mountd(8), mount_nfs(8), nfsd(8) have also been upgraded
to support TI-RPC and to support IPV6.

Umount(8) is also fixed to unmount pathnames longer than 80 chars,
which are currently truncated by the Kernel statfs structure.

Submitted by: Martin Blapp <mb@imp.ch>
Manpage review: ru
Secure RPC implemented by: wpaul

Submitted by: Ian Dowse <iedowse@maths.tcd.ie>, David Cross <dec@freebsd.org>
Reviewed by: David Cross <dec@freebsd.org>, jkh <jkh@freebsd.org>
Approved by: jkh <jkh@freebsd.org>
Obtained from: Ian Dowse <iedowse@maths.tcd.ie>, David Cross <dec@freebsd.org>
We have been running this patch on a production NIS server for 2.5 weeks now.
Normally we would have ypserv die at least once a week, and often many times
a day.

This patch treats and error from select as zeroing out the FD_SET to indicate
that no fds are ready for reading. This is safe because the rpc code
always re-inits the FDSET before calling select.

mdoc(7) police: C types should be declared with either .Ft or .Vt.

Fixed errors in prototypes. Many were hiding under mdoc errors.

Remove _THREAD_SAFE and make libc thread-safe by default by
adding (weak definitions to) stubs for some of the pthread
functions. If the threads library is linked in, the real
pthread functions will pulled in.

Use the following convention for system calls wrapped by the
threads library:
__sys_foo - actual system call
_foo - weak definition to __sys_foo
foo - weak definition to __sys_foo

Change all libc uses of system calls wrapped by the threads
library from foo to _foo. In order to define the prototypes
for _foo(), we introduce namespace.h and un-namespace.h
(suggested by bde). All files that need to reference these
system calls, should include namespace.h before any standard
includes, then include un-namespace.h after the standard
includes and before any local includes. <db.h> is an exception
and shouldn't be included in between namespace.h and
un-namespace.h namespace.h will define foo to _foo, and
un-namespace.h will undefine foo.

Try to eliminate some of the recursive calls to MT-safe
functions in libc/stdio in preparation for adding a mutex
to FILE. We have recursive mutexes, but would like to avoid
using them if possible.

Remove uneeded includes of <errno.h> from a few files.

Add $FreeBSD$ to a few files in order to pass commitprep.

Approved by: -arch

man(7) -> mdoc(7).

rstat(1) and rstat_svc(8) are the early versions of
the rup(1) and rpc.rstatd(8) manpages respectively.

Prepare for mdoc(7)NG.

mdoc(7) police: added missing .Os call.

Upgrade to groff 1.16.1.

Eliminate groff(1) warnings.

mdoc(7) police: fixed warning.

mdoc(7) police: Nm -> Fn where appropriate.

strtok() -> strsep() (no strtok() in libraries allowed)
small cleanup in nearby area:
pointer 0 -> NULL, according to manpages
hardcoded constant -> sizeof(buf)

Calculate the string length of a u_long at compile-time, instead of using a
hardcoded value.

Correct string length bounds checking.

Don't overflow the internal buffer in clnt_sperror()

Replace structure copy form ifreq obtained by SIOCGIFADDR
to memcpy(), to avoid unaligned access trap on alpha.

Approved by: jkh

Remove single-space hard sentence breaks. These degrade the quality
of the typeset output, tend to make diffs harder to read and provide
bad examples for new-comers to mdoc.

Grammar fix: ``Different than'' should really be ``different from''.

Simplify sytem call renaming. Instead of _foo() <-- _libc_foo <-- foo(),
just use _foo() <-- foo(). In the case of a libpthread that doesn't do
call conversion (such as linuxthreads and our upcoming libpthread), this
is adequate. In the case of libc_r, we still need three names, which are
now _thread_sys_foo() <-- _foo() <-- foo().

Convert all internal libc usage of: aio_suspend(), close(), fsync(), msync(),
nanosleep(), open(), fcntl(), read(), and write() to _foo() instead of foo().

Remove all internal libc usage of: creat(), pause(), sleep(), system(),
tcdrain(), wait(), and waitpid().

Make thread cancellation fully POSIX-compliant.

Suggested by: deischen

Fixed wrong includes in synopsis.

Updated date. 1987 was a while ago.

Removed trailing comma in NAME section.

Uncapitalised Bindresvport and Bindresvport_sa in DESCRIPTION section.
Don't use .Nm there either.

Added bindresvport_sa() to the RETURN VALUES and ERROR sections.

bindresvport related changes
-changed bindresvport2 to bindresvport_sa
-merged the man into bindresvport.3

All discussion between Jean-Luc Richier <Jean-Luc.Richier@imag.fr>,
Theo de Raadt <deraadt@cvs.openbsd.org>, itojun, is reflected to
this code. (Actually Theo de Raadt write the code simultaneously as the
discussion change.)

libc rcmd update for IPv6.
A new function bindresvport2(), AF independent version of bindresvport()
is also added.

Reviewed by: sumikawa
Obtained from: KAME project

Add three-tier symbol naming in support of POSIX thread cancellation
points. For library functions, the pattern is __sleep() <--
_libc_sleep() <-- sleep(). The arrows represent weak aliases. For
system calls, the pattern is _read() <-- _libc_read() <-- read().

Change #ifdef KERNEL to #ifdef _KERNEL in the public headers. "KERNEL"
is an application space macro and the applications are supposed to be free
to use it as they please (but cannot). This is consistant with the other
BSD's who made this change quite some time ago. More commits to come.

Commented out

MAN8+= rstat_svc.8

The file it talks about doesn't exist on FreeBSD, so there's no point in
installing the manual page. There was already a comment to this effect in
this file, but the entry hadn't been commented out.

rstat.1 and rstat_svc.8 can probably actually be removed.

PR: docs/13767
Submitted by: Seth <seth@freebie.dp.ny.frb.org>

For the TCP transport, put the listening socket in non-blocking
mode. This addresses a well-known race condition that can cause
servers to hang in accept(). The relevant case is when somebody
connects to the server and then immediately kills the connection
by sending a TCP reset. On the server this causes select to report
a ready condition on the socket, after which the accept call blocks
because there is no longer any pending connection to accept.

In -current there is already a work-around for this in the kernel.
It was merged into -stable some time ago, but then David Greenman
reverted it because it seemed to be causing a socket leak in some
cases. (See uipc_socket.c revision 1.51.2.3.) Hence this userland
fix is needed in -stable, and I plan to merge it into that branch
soon because it fixes a potential DoS attack. It may also be needed
in -current if the suspected socket leak turns out to be real. In
any case, after thinking it over I believe the fix belongs in
userland. An application shouldn't assume that a ready return from
select guarantees that the subsequent I/O operation cannot block.
A lot can happen between the select and the accept.

A similar fix should most likely be applied to the Unix domain
socket transport too.

Submitted by: peter
Reviewed by: jdp

Fix a bug in the hack that protects against FTP bounce attacks.
It used to loop back up to the accept() call and block there,
shutting out all other transports until a new connection came in.
Now it returns instead after dropping the connection. That will
take it back to the select() loop where all transports can be
serviced. I intend to MFC this within a day or two since it
fixes a DoS vulnerability.

$Id$ -> $FreeBSD$

Add $Id$, to make it simpler for members of the translation teams to
track.

The $Id$ line is normally at the bottom of the main comment block in the
man page, separated from the rest of the manpage by an empty comment,
like so;

.\" $Id$
.\"

If the immediately preceding comment is a @(#) format ID marker than the
the $Id$ will line up underneath it with no intervening blank lines.
Otherwise, an additional blank line is inserted.

Approved by: bde

Document type for 'req' argument to clnt_control.

s/yellow pages/NIS/
PR: 7949
Reviewed by: phk
Submitted by: Norihiro Kumagai <kuma@jp.freebsd.org>

Fixed printf format errors.

Fixed scanf format errors. The error handling is not quite bug for bug
compatible. I think small negative uids are handled compatibly but
other out of bounds ones are truncated differently for certain sizes of
uid_t.

Fix potential resource leak: when call to des_crypt_1() fails, remember
to destroy the RPC CLIENT handle before returning.

The incorrect select() timeout calculation that I fixed in svc_tcp.c
also exists here (the timeout can expire much sooner than it's supposed
to).

Replace the getpublickey() stub with the real thing.

Improve DoS avoidance in RPC stream oriented transports. The TCP transport
uses readtcp() to gather data from the network; readtcp() uses select(),
with a timeout of 35 seconds. The problem with this is that if you
connect to a TCP server, send two bytes of data, then just pause, the
server will remain blocked in readtcp() for up to 35 seconds, which is
sort of a long time. If you keep doing this every 35 seconds, you can
keep the server occupied indefinitely.

To fix this, I modified readtcp() (and its cousin, readunix() in svc_unix.c)
to monitor all service transport handles instead of just the current socket.
This allows the server to keep handling new connections that arrive while
readtcp() is running. This prevents one client from potentially monopolizing
a server.

Also, while I was here, I fixed a bug in the timeout calculations. Someone
attempted to adjust the timeout so that if select() returned EINTR and the
loop was restarted, the timeout would be reduced so that rather than waiting
for another 35 seconds, you could never wait for more than 35 seconds total.
Unfortunately, the calculation was wrong, and the timeout could expire much
sooner than 35 seconds.

Patch RPC library to avoid possible denial of service attacks as described
recently in BUGTRAQ. If a stream oriented transport fails to properly decode
an RPC message header structure where there should be one, it should mark
the stream as dead so that the connection will be dropped.

Fixed the usual missing dependencies on headers generated by rpcgen.

Fixed wrong prototypes. Most of the prototypes had missing return types,
or missing const's or `short *' instead of `[ug]id_t *' in argument types.

Convert to mdoc format.

In clntudp_call(), it is possible that xdr_replymsg() might fail
partway through its attempt to decode the result structure sent by
the server. If this happens, it can leave the result partially
populated with dynamically allocated memory. In this event, the
xdr_replymsg() failure is detected and RPC_CANTDECODERES is returned,
but the memory in the partially populated result struct is not
free()d.

The end result is that memory is leaked when an RPC_CANTDECODERES
error occurs. (This condition can occur if a CLIENT * handle is created
using clntudp_bufcreate() with a receive buffer size that is too small
to handle the result sent by the server.)

Fixed by setting reply_xdrs.x_op to XDR_FREE and calling
xdr_replymsg() again to free the memory if an RPC_CANTDECODERES error
is detected.

I suspect that the clnt_tcp.c, clnt_unix.c and clnt_raw.c modules
may ha a similar problem, but I haven't duplicated the condition with
those yet.

Found by: dbmalloc

Sorted lists.

Fix two bugs which caused various RPC programs (mountd, nfsd, ...)
to fail under certain circumstances.

1. In one spot, the ifr_flags member was being examined in the
wrong structure, thus it contained garbage. On a machine in which
only the loopback interface was up, this caused everything that
wanted to talk to the portmapper to fail -- a particular problem
with laptops, where the pccard ethernet interface is likely to come
up long after the attempt to start mountd, nfsd, amd, etc.

2. Compounding the above problem, get_myaddress() returned a
successful status even though it failed to find an address that it
considered good enough.

Removed the subdirectory paths from the definitions of MAN[1-9]. They
were a workaround for limitations in bsd.man.mk that were fixed about
2 years ago.

Correct a bug in the 'allow arbitrary number of socket descriptors' changes
made to the RPC code some months ago. The value of __svc_fdsetsize is being
calculated incorrectly.

Logically, one would assume that __svc_fdsetsize is being used as a
substitute for FD_SETSIZE, with the difference being that __svc_fdsetsize
can be expanded on the fly to accomodate more descriptors if need be.
There are two problems: first, __svc_fdsetsize is not initialized to 0.
Second, __svc_fdsetsize is being calculated in svc.c:xprt_registere() as:

__svc_fdsetsize = howmany(sock+1, NFDBITS);

This is wrong. If we are adding a socket with index value 4 to the
descriptor set, then __svc_fdsetsize will be 1 (since fds_bits is
an unsigned long, it can support any descriptor from 0 to 31, so we
only need one of them). In order for this to make sense with the
rest of the code though, it should be:

__svc_fdsetsize = howmany(sock+1, NFDBITS) * NFDBITS;

Now if sock == 4, __svc_fdsetsize will be 32.

This bug causes 2 errors to occur. First, in xprt_register(), it
causes the __svc_fdset descriptor array to be freed and reallocated
unnecessarily. The code checks if it needs to expand the array using
the test: if (sock + 1 > __svc_fdsetsize). The very first time through,
__svc_fdsetsize is 0, which is fine: an array has to be allocated the
first time out. However __svc_fdsetsize is incorrectly set to 1, so
on the second time through, the test (sock + 1 > __svc_fdsetsize)
will still succeed, and the __svc_fdset array will be destroyed and
reallocated for no reason.

Second, the code in svc_run.c:svc_run() can become hopelessly confused.
The svc_run() routine malloc()s its own fd_set array using the value
of __svc_fdsetsize to decide how much memory to allocate. Once the
xprt_register() function expands the __svc_fdset array the first time,
the value for __svc_fdsetsize becomes 2, which is too small: the resulting
calculation causes the code to allocate an array that's only 32 bits wide
when it actually needs 64 bits. It also uses the valuse of __svc_fdsetsize
when copying the contents of the __svc_fdset array into the new array.
The end result is that all but the first 32 file descriptors get lost.

Note: from what I can tell, this bug originated in OpenBSD and was
brought over to us when the code was merged. The bug is still there
in the OpenBSD source.

Total nervous breakdown averted by: Electric Fence 2.0.5

Make selection logic more strict. Only select AF_INET loopback interfaces
that are up on second (loopback only) pass, and only select non-loopback
AF_INET interfaces that are up on first pass.

Add a stub version of getpublickey(), in order to eliminate an
undefined symbol referenced from libc. Without the stub, it is
impossible to execute any program using the shared library if
LD_BIND_NOW=1 is in the environment. The stub always returns
failure, but it can be overridden outside the library when necessary.

I don't know whether this is the "correct" fix, but it is intolerable
to have any undefined symbols referenced from libc.

Add to CLEANFILES instead of setting it absolutely. Cleaning of *.S and
tags was broken.

Show the real revision date and not the date that this
manpage is being viewed.

Hm... wonder how long this has been here.

The logic in get_myaddress() is broken: it always returns the loopback
address due to the following rule:

if ((ifreq.ifr_flags & IFF_UP) &&
ifr->ifr_addr.sa_family == AF_INET &&
(loopback == 1 && (ifreq.ifr_flags & IFF_LOOPBACK))) {

The idea is that we want to select the interface address only if it's
up and it's in the AF_INET family. If it turns uout we don't have
such an interface available, we make a second pass through the loop,
this time settling for the loopback interface. But the logic inadvertently
locks out all cases when loopback == 0, so nothing is ever selected until
the second pass (when loopback == 1).

This is changed to:

if (((ifreq.ifr_flags & IFF_UP) &&
ifr->ifr_addr.sa_family == AF_INET) ||
(loopback == 1 && (ifreq.ifr_flags & IFF_LOOPBACK))) {

which I think does the right thing.

This is yet another bogon I discovered during NIS+ testing; I need
get_myaddress() to work correctly so that the callback code in the
client library will work.

Remember to zero sockaddr_in struct before calling uaddr_to_sockaddr() to
populate it. Not doing this can result in a garbage sockaddr_in, which
will cause connect() to block inside clnttcp_create().

getnetid() crashes if no /etc/netid file is present (it tries to fclose()
a FILE * handle that wasn't really open).

Fix other small things that got lost in the merge:

- bde's change to includes section in getrpcent.3
- Lost comment in svc_run.c (the code here was actually the same since
I had fixed the 'fds + 1' bug in my stuff at home before mailing
Peter about it, but I didn't notce that he'd made a change to the
comment right above the changed line).

Also pointed out by the ever vigilant: bde

Resolve conflicts.

This concludes tonight's entertainment. Once I'm sure I haven't destroyed
the world with all these changes, I'll import the utilities. Everything
should continue to work as before. If it doesn't let me know.

Special thanks to Mark Murray for running a test 'make world' for me to
shake out the bugs, which, hopefully, I have fixed.

(And there was much rejoicing.)

This commit was generated by cvs2svn to compensate for changes in r26219,
which included commits to RCS files with non-trunk default branches.

Changed all paths to be relative to src/lib instead of src/lib/libc
so that all these makefiles can be used to build libc_r too.

Added .if ${LIB} == "c" tests to restrict man page builds to libc
to avoid needlessly building them with libc_r too.

Split libc Makefile into Makefile and Makefile.inc to allow the
libc_r Makefile to include Makefile.inc too.

Fixed wrong #include in synopsis.

Revert $FreeBSD$ to $Id$

Make the long-awaited change from $Id$ to $FreeBSD$

This will make a number of things easier in the future, as well as (finally!)
avoiding the Id-smashing problem which has plagued developers for so long.

Boy, I'm glad we're not using sup anymore. This update would have been
insane otherwise.

Correct logic braino when attempting to exclude loopback addresses on
the first pass.

Submitted by: Greg Lehey <grog@lemis.de>

Two minor changes to try and make it more robust in the face of many
interfaces, until it's redone to use sysctl().
- bump the SIOCGIFCONF buffer size from 1K to 8K
- if we didn't find a suitable address, return a failure. Previously
if it didn't find anything it left the return address uninitialised.
Perhaps it would be better to return AF_INET/111/127.0.0.1 rather than
failing?

Eliminate unnecessary warning introduced by a missing forward declaration.

prototype of shared function now in include file

use svc_maxfd + 1 in the select() call.

(There may be a behavior difference between the 2.1 and 2.2/3.0 kernels
in this area, it seemed to work for me but I have a horribly hacked
select() that might have a bug in the handling of this)

Submitted by: wpaul

Oops! Bad Idea! (TM)

Restore the clamp on the return value from rpc_dtablesize().. Some programs
(eg: ypserv) use this as an indication of how large svc_fdset is in their
hand-rolled svc_run() loops. The svc_fdset table is maintained by the
rpc library explicitly for compatability with such programs. (It uses
a different variable-sized bitmap itself internally)

- make wire protocol 64 bit type safe
- extern prototypes now in include file
- fix local prototypes
- use standard functions

Obtained from: a diff of FreeBSD vs. OpenBSD/NetBSD rpc code.

- prototypes now in include file
- overhaul for unlimited fd's
- OpenBSD's ftp port bounce attack fix
- fix timeouts

Obtained from: a diff of FreeBSD vs. OpenBSD/NetBSD rpc code.

- canonical function declaration
- prototypes now in common include file
- use standard functions

Obtained from: a diff of FreeBSD vs. OpenBSD/NetBSD rpc code.

- overhaul for unlimited file descriptors
- prototypes now in include files

Obtained from: a diff of FreeBSD vs. OpenBSD/NetBSD rpc code.

Note: potential bug here, It looks like there could be a null pointer
dereference depending on what has already been called to initialise some
shared data.

- make wire protocol 64 bit type safe
- use standard functions

Obtained from: a diff of FreeBSD vs. OpenBSD/NetBSD rpc code.

- major overhaul to make this deal with unlimited fd's.
- kill non-FD_SETSIZE code

Obtained from: a diff of FreeBSD vs. OpenBSD/NetBSD rpc code.

Note, there was a nasty bug with our old code here. It would trash the
stack if a fd > 31 was passed in. It was using a "long" as though it
was an "fd_set", ie: it was assuming that a long was 256 bits wide. :-(
This has been lurking here for a while, since the FD_SETSIZE #ifdef's
were first implemented.

- make wire protocol 64 bit type safe

Obtained from: a diff of FreeBSD vs. OpenBSD/NetBSD rpc code.

Remove our code that clamped the max select() fd number to FD_SETSIZE (256)
This function is now unused.

- kill non-FD_SETSIZE code

Obtained from: a diff of FreeBSD vs. OpenBSD/NetBSD rpc code.

- 64 bit type safe on-the-wire protocol
- use standard functions
- prototype now in include file

Obtained from: a diff of FreeBSD vs. OpenBSD/NetBSD rpc code.

- prototype now in include file, plus no longer needed anyway
- fix timeout code
- better sequence number generation (for long running daemons)
- dont close an unopen socket
- use standard functions
- 64 bit type safe for wire protocols
- unlimited file descriptors

Obtained from: a diff of FreeBSD vs. OpenBSD/NetBSD rpc code.

- dont close an unopen socket

Obtained from: a diff of FreeBSD vs. OpenBSD/NetBSD rpc code.

- Don't close an unopened socket

Obtained from: a diff of FreeBSD vs. OpenBSD/NetBSD rpc code.

- don't close unopen socket
- ensure we're not spoofed/confused while trying to talk to the portmapper
- handle new get_myaddress failure cases
- prototype now in include file

Obtained from: a diff of FreeBSD vs. OpenBSD/NetBSD rpc code.

- missing prototype from include file
- canconical function declaration (ctags safe)
- use standard functions

Obtained from: a diff of FreeBSD vs. OpenBSD/NetBSD rpc code.

- OpenBSD's strncpy fixes to ensure NULL termination
- missed endrpcent() in some cases.

Obtained from: a diff of FreeBSD vs. OpenBSD/NetBSD rpc code.

- prototypes now in include file
- fix timeout code
- better "random" initial transaction id for long running daemons
- unlimited number of file descriptors to select().
- 64 bit type safe wire protocol
Obtained from: a diff of FreeBSD vs. OpenBSD/NetBSD rpc code.

- typo (spelling police :-)
- dont die on select() that returns time remaining (on my systems)

- prototypes now in standard include file
- improve initial "random" sequence number, to make it harder to guess
in long running daemons.
- fix timeout code.
- unlimited number of fd's in select.
Obtained from: a diff of FreeBSD vs. OpenBSD/NetBSD rpc code.

- Protect against select() that returns time remaining (on my systems).

- update return type of an "internal but documented" function
- warn about FD_SETSIZE in certain internal functions

Obtained from: a diff of FreeBSD vs. OpenBSD/NetBSD rpc code.

- tags in correct order
- list missing functions
- list missing args

Obtained from: a diff of FreeBSD vs. OpenBSD/NetBSD rpc code.

- canonical function declaration
- don't exit. It's bad form for libc to exit() or abort() instead of
returning an error.
- only use loopback addresses after checking the real interfaces.

Obtained from: a diff of FreeBSD vs. OpenBSD/NetBSD rpc code.

- don't close an unopen socket
- canonical function declaration
- use constants from includes, not magic numbers
- use standard functions

Obtained from: a diff of FreeBSD vs. OpenBSD/NetBSD rpc code.

- prototype moved to include file

Obtained from: a diff of FreeBSD vs. OpenBSD/NetBSD rpc code.

- buffer overflow fix, from OpenBSD
- optimise the error number -> string mapping code

Obtained from: a diff of FreeBSD vs. OpenBSD/NetBSD rpc code.

- use standard function
- timeout code repaired elsewhere, remove unneeded workaround

Obtained from: a diff of FreeBSD vs. OpenBSD/NetBSD rpc code.

- prototype now in common include file
- standard function name

Obtained from: a diff of FreeBSD vs. OpenBSD/NetBSD rpc code.

- prototype now in include file, not here

Obtained from: a diff of FreeBSD vs. OpenBSD/NetBSD rpc code.

- Man page fix, updates.
- minor cosmetic tweaks

Obtained from: a diff of FreeBSD vs. OpenBSD/NetBSD rpc code.

Add manpage links for rpc functions

Obtained from: a diff of FreeBSD vs. OpenBSD/NetBSD rpc code.

Convert to mdoc format.

get_myaddress() wasn't following the interface array properly

Cannidate for: 2.2

Use the more robust and more efficient reserved port allocation mechanism
now built into bind(2).

Obtained from: OpenBSD / Jason Downs / Theo de Raadt

clear various struct sockaddr_in's on stack, set sin_len.

(Noticed when comparing to OpenBSD source)

Code cleanup:

Fixed a couple of nitpick warnings, plus one that slipped through the
net earlier.

This directory now compiles without any warnings with -Wall! (Until
the next gcc upgrade...)

Code cleanup:

1. Added missing function prototypes.
2. Added missing function return types.
3. Added missing function argument types.
4. Added missing headers for system function prototypes.
5. Corrected format specifier in printf().
6. Added extra parentheses around assignment used as truth value.
7. Added missing "default" cases in switch statements.
8. Added casts for function pointers.
9. Did *not* change int declarations of uid and gid to uid_t/gid_t
because I don't know if that would affect the protocol. Put in
explicit casts to int instead, to make things more obvious.
10. Moved declarations of variables that are only used if YP is
defined inside the '#ifdef YP' conditionals.

Remove extraneous '+' that looks like it was left in by mistake. This
module compiles now.

Reported by: Stephen Hocking

Code cleanup (part two):

1. Added missing function prototypes.
2. Added missing function return types.
3. Added missing function argument types.
4. Added missing headers for system function prototypes.
5. Corrected casts in select() args.
6. Got rid of more "extern int errno" rubbish.
7. Added extra parentheses around assignment used as truth value.
8. Fixed bug in clnt_{tcp, udp}create() where pointers could be free'd
even if they hadn't been successfully malloc()'d.

Code cleanup (part one):

1. Added missing function prototypes.

2. Added missing function return types.

3. Added missing function argument types.

4. Added missing headers for system function prototypes.

5. Got rid of "extern int errno" rubbish.

Work around a bug in the Sun rpc code. This fixes a problem where
a machine with aliase ip addresses on the same subnet of an
interfaces' `real' ip addresses would generate <n> duplicate
broadcasts in clnt_broadcast().
Basically, this fix does a purge on the list of bradcast addresses.

Another round of man page cleanups.

Down to only about 100 items left to cleanup! :-)

Minor cleanup of the rpc man pages to silence manck.

Add some missing manual page links.

Fix even more spelling errors in some more man pages.

Fix minor annoyance: have clnt_perror(), clnt_perrno() and
clnt_pcreateerror() emit strings with newlines appended like other
platforms do.

Fixed type mismatches.

misc typos

Well, cvs commit core'ed on me, I belive I have got all the locks out,
but a commit mail got lost, it's the same as for this commit:

lib/libc/gen confstr.c crypt.c disklabel.c fstab.c getcap.c
getgrent.c getgrouplist.c getpass.c getpwent.c
initgroups.c nlist.c psignal.c pwcache.c setmode.c
sleep.c sysconf.c sysctl.c syslog.c usleep.c
lib/libc/locale none.c read_runemagi.c setlocale.c
lib/libc/net gethostbydns.c getnetbydns.c getnetbynis.c
lib/libc/nls msgcat.c
lib/libc/quad Makefile.inc
lib/libc/regex engine.c regcomp.c regerror.c

Minor cleanup, mostly unused vars and missing #includes.
Limit the number of quad functions we pull in for 'i386'.
I still belive the quad stuff should go back into gcc.
Add compile-time warnings about crypt functions.

Reviewed by: David Greenman

Back out the 'help NIS rebind faster' hack. This change used a
connect()/send() pair rather than the original sendto() to allow
RPC to pass ICMP host unreachable and similar errors up to RPC
programs that use UDP. This is not a terrible thing by itself, but it can
cause trouble in environments with multi-homed hosts: if the portmapper
on the multi-homed machine sends a reply with a source address
that's different than the one associated with the connection by
connect(), the kernel will send a port unreachable message and
drop the reply. For the sake of compatibility with everybody else
on the planet, it's best to revert to the old behavior.

*long, heavy sigh*

Remove trailing whitespace.

'Fix' for esoteric misfeature discovered while searching for another bug:
select() returns EINVAL if you try to feed it a value of FD_SETSIZE greater
that 256. You can apparently adjust this by specifying a larger value of
FD_SETSIZE when configuring your kernel. However, if you set the maximum
number of open file descriptors per process to some value greater than
the FD_SETSIZE value that select() expects, many selects() within the RPC
library code will be botched because _rpc_dtablesize() will return
invalid numbers. This is to say that it will return the upper descriptor
table size limit which can be much higher than 256. Unless select() is
prepared to expect this 'unusually' high value, it will fail. (A good
example of this can be seen with NIS enabled: if you type 'unlimit' at
the shell prompt and then run any command that does NIS calls, you'll
be bombarded with errors from clnttcp_create().)

A temporary fix for this is to clamp the value returned by _rpc_dtablesize()
at FD_SETSIZE (as defined in <sys/types.h> (256)). I suppose the Right
Thing would be to provide some mechanism for select() to dynamically
adjust itself to handle FD_SETSIZE values larger than 256, but it's a
bit late in the game for that. Hopefully 256 file descriptors will be enough
to keep RPC happy for now.

Submitted by: Sebastian Strollow
Obtained from: Casper H. Dik (by vay of Usenet)

Small patch to help improve NIS rebinding times (among other things):


>From: casper@fwi.uva.nl (Casper H.S. Dik)
>Newsgroups: comp.sys.sun.misc,comp.sys.sun.admin
>Subject: FIX for slow rebinding of NIS.
>Summary: a small change in libc makes life with NIS a lot easier.
>Message-ID: <1992Jan17.173905.11727@fwi.uva.nl>
>Date: 17 Jan 92 17:39:05 GMT
>Sender: news@fwi.uva.nl
>Organization: FWI, University of Amsterdam
>Lines: 138
>Nntp-Posting-Host: halo.fwi.uva.nl

Have you been plagued by long waits when your NIS server is rebooted?
READ ON!

Sun has a patch, but the README says:

********************* WARNING ******************************

This is a new version of ypbind that never uses the NIS
binding file to cache the servers binding. This will have
the effect of fixing the current symptom. However, it might
degrade the overall performance of the system when the
server is available. This is most likely to happen on an
overloaded server, which will cause the network to produce
a broadcast storm.

*************************************************************

Therefor, I have produced another fix.

o What goes wrong.

When the NIS server is rebooted, ypserv will obtain different ports
to listen for RPC requests. All clients will continue to use the old
binding they obtained earlier. The NIS server will send ICMP dst unreachable
messages for the RPC requests that arrive at the old port. These ICMPs
are dropped on the floor and the client code will continue sending the
requests until the timer has expired. The small fix at the end of this
message will pick up these ICMP messages and deliver them to the RPC layer.

o Before and after.

I've tested this on some machines and this is the result:

(kill and restart ypserv on the server)

original% time ypmatch user passwd
user:....
0.040u 0.090s 2:35.64 0.0% 0+126k 0+0io 0pf+0w (155 seconds elapsed time)

fixedhost% time ypmatch user passwd
user:....
0.050u 0.050s 0:10.20 0.9% 0+136k 0+0io 0pf+0w (10 seconds elapsed time)

Rebinding is almost instantaneous.

o Other benefits.
RPC calls that use UDP as transport will no longer time out but
will abort much sooner. (E.g., the remote host is unreachable or
111/udp is filtered by an intermediate router)

Fix authunix_maxgrouplist test
Submitted by: Scott Hazen Mueller <scott@zorch.sf-bay.org>

Comment out the man page of rstat.1 from Makefile.inc. There is no rstat
command available yet.
Changed an entry in getprcent.3 from rpcinfo(8C) to rpcinfo(8).
Changed an entry in getrpcport.3 from 3R to 3.
Changed two entries in rpc.3 from 3N to 3.

Fix comparison of int against unsigned when checking error return
from recvfrom()
(This bug is also present in FreeBSD 1.1.5.1.)
Bug Reported by : Thomas.Koenig@ciw.uni-karlsruhe.de
Reviewed by: geoff.

Add back set_rpc_grouplistsize(), so mount_nfs compiles again. Also
fixed incipient bug wrt gid_t versus int.

More directory cleanup after YP merge.

Add Sun RPC documentation, which should eventually go into our PSD.
(I think I'm up to part 6.)

Moving Sun RPC code into libc, part 1. Based on work done by a number of
people, including J.T. Conklin, Theo de Raadt, Paul Richards, and probably
someone else who's going to flame me as soon as they see this message.