1/* $FreeBSD$ */
2 /*
3  * Routines to parse an inetd.conf or tlid.conf file. This would be a great
4  * job for a PERL script.
5  *
6  * Author: Wietse Venema, Eindhoven University of Technology, The Netherlands.
7  */
8
9#ifndef lint
10static char sccsid[] = "@(#) inetcf.c 1.7 97/02/12 02:13:23";
11#endif
12
13#include <sys/types.h>
14#include <sys/stat.h>
15#include <stdio.h>
16#include <errno.h>
17#include <string.h>
18
19extern int errno;
20extern void exit();
21extern char *malloc();
22
23#include "tcpd.h"
24#include "inetcf.h"
25
26 /*
27  * Network configuration files may live in unusual places. Here are some
28  * guesses. Shorter names follow longer ones.
29  */
30char   *inet_files[] = {
31    "/private/etc/inetd.conf",		/* NEXT */
32    "/etc/inet/inetd.conf",		/* SYSV4 */
33    "/usr/etc/inetd.conf",		/* IRIX?? */
34    "/etc/inetd.conf",			/* BSD */
35    "/etc/net/tlid.conf",		/* SYSV4?? */
36    "/etc/saf/tlid.conf",		/* SYSV4?? */
37    "/etc/tlid.conf",			/* SYSV4?? */
38    0,
39};
40
41static void inet_chk();
42static char *base_name();
43
44 /*
45  * Structure with everything we know about a service.
46  */
47struct inet_ent {
48    struct inet_ent *next;
49    int     type;
50    char    name[1];
51};
52
53static struct inet_ent *inet_list = 0;
54
55static char whitespace[] = " \t\r\n";
56
57/* inet_conf - read in and examine inetd.conf (or tlid.conf) entries */
58
59char   *inet_cfg(conf)
60char   *conf;
61{
62    char    buf[BUFSIZ];
63    FILE   *fp;
64    char   *service;
65    char   *protocol;
66    char   *user;
67    char   *path;
68    char   *arg0;
69    char   *arg1;
70    struct tcpd_context saved_context;
71    char   *percent_m();
72    int     i;
73    struct stat st;
74
75    saved_context = tcpd_context;
76
77    /*
78     * The inetd.conf (or tlid.conf) information is so useful that we insist
79     * on its availability. When no file is given run a series of educated
80     * guesses.
81     */
82    if (conf != 0) {
83	if ((fp = fopen(conf, "r")) == 0) {
84	    fprintf(stderr, percent_m(buf, "open %s: %m\n"), conf);
85	    exit(1);
86	}
87    } else {
88	for (i = 0; inet_files[i] && (fp = fopen(inet_files[i], "r")) == 0; i++)
89	     /* void */ ;
90	if (fp == 0) {
91	    fprintf(stderr, "Cannot find your inetd.conf or tlid.conf file.\n");
92	    fprintf(stderr, "Please specify its location.\n");
93	    exit(1);
94	}
95	conf = inet_files[i];
96	check_path(conf, &st);
97    }
98
99    /*
100     * Process the file. After the 7.0 wrapper release it became clear that
101     * there are many more inetd.conf formats than the 8 systems that I had
102     * studied. EP/IX uses a two-line specification for rpc services; HP-UX
103     * permits long lines to be broken with backslash-newline.
104     */
105    tcpd_context.file = conf;
106    tcpd_context.line = 0;
107    while (xgets(buf, sizeof(buf), fp)) {
108	service = strtok(buf, whitespace);	/* service */
109	if (service == 0 || *service == '#')
110	    continue;
111	if (STR_NE(service, "stream") && STR_NE(service, "dgram"))
112	    strtok((char *) 0, whitespace);	/* endpoint */
113	protocol = strtok((char *) 0, whitespace);
114	(void) strtok((char *) 0, whitespace);	/* wait */
115	if ((user = strtok((char *) 0, whitespace)) == 0)
116	    continue;
117	if (user[0] == '/') {			/* user */
118	    path = user;
119	} else {				/* path */
120	    if ((path = strtok((char *) 0, whitespace)) == 0)
121		continue;
122	}
123	if (path[0] == '?')			/* IRIX optional service */
124	    path++;
125	if (STR_EQ(path, "internal"))
126	    continue;
127	if (path[strspn(path, "-0123456789")] == 0) {
128
129	    /*
130	     * ConvexOS puts RPC version numbers before path names. Jukka
131	     * Ukkonen <ukkonen@csc.fi>.
132	     */
133	    if ((path = strtok((char *) 0, whitespace)) == 0)
134		continue;
135	}
136	if ((arg0 = strtok((char *) 0, whitespace)) == 0) {
137	    tcpd_warn("incomplete line");
138	    continue;
139	}
140	if (arg0[strspn(arg0, "0123456789")] == 0) {
141
142	    /*
143	     * We're reading a tlid.conf file, the format is:
144	     *
145	     * ...stuff... path arg_count arguments mod_count modules
146	     */
147	    if ((arg0 = strtok((char *) 0, whitespace)) == 0) {
148		tcpd_warn("incomplete line");
149		continue;
150	    }
151	}
152	if ((arg1 = strtok((char *) 0, whitespace)) == 0)
153	    arg1 = "";
154
155	inet_chk(protocol, path, arg0, arg1);
156    }
157    fclose(fp);
158    tcpd_context = saved_context;
159    return (conf);
160}
161
162/* inet_chk - examine one inetd.conf (tlid.conf?) entry */
163
164static void inet_chk(protocol, path, arg0, arg1)
165char   *protocol;
166char   *path;
167char   *arg0;
168char   *arg1;
169{
170    char    daemon[BUFSIZ];
171    struct stat st;
172    int     wrap_status = WR_MAYBE;
173    char   *base_name_path = base_name(path);
174    char   *tcpd_proc_name = (arg0[0] == '/' ? base_name(arg0) : arg0);
175
176    /*
177     * Always warn when the executable does not exist or when it is not
178     * executable.
179     */
180    if (check_path(path, &st) < 0) {
181	tcpd_warn("%s: not found: %m", path);
182    } else if ((st.st_mode & 0100) == 0) {
183	tcpd_warn("%s: not executable", path);
184    }
185
186    /*
187     * Cheat on the miscd tests, nobody uses it anymore.
188     */
189    if (STR_EQ(base_name_path, "miscd")) {
190	inet_set(arg0, WR_YES);
191	return;
192    }
193
194    /*
195     * While we are here...
196     */
197    if (STR_EQ(tcpd_proc_name, "rexd") || STR_EQ(tcpd_proc_name, "rpc.rexd"))
198	tcpd_warn("%s may be an insecure service", tcpd_proc_name);
199
200    /*
201     * The tcpd program gets most of the attention.
202     */
203    if (STR_EQ(base_name_path, "tcpd")) {
204
205	if (STR_EQ(tcpd_proc_name, "tcpd"))
206	    tcpd_warn("%s is recursively calling itself", tcpd_proc_name);
207
208	wrap_status = WR_YES;
209
210	/*
211	 * Check: some sites install the wrapper set-uid.
212	 */
213	if ((st.st_mode & 06000) != 0)
214	    tcpd_warn("%s: file is set-uid or set-gid", path);
215
216	/*
217	 * Check: some sites insert tcpd in inetd.conf, instead of replacing
218	 * the daemon pathname.
219	 */
220	if (arg0[0] == '/' && STR_EQ(tcpd_proc_name, base_name(arg1)))
221	    tcpd_warn("%s inserted before %s", path, arg0);
222
223	/*
224	 * Check: make sure files exist and are executable. On some systems
225	 * the network daemons are set-uid so we cannot complain. Note that
226	 * tcpd takes the basename only in case of absolute pathnames.
227	 */
228	if (arg0[0] == '/') {			/* absolute path */
229	    if (check_path(arg0, &st) < 0) {
230		tcpd_warn("%s: not found: %m", arg0);
231	    } else if ((st.st_mode & 0100) == 0) {
232		tcpd_warn("%s: not executable", arg0);
233	    }
234	} else {				/* look in REAL_DAEMON_DIR */
235	    sprintf(daemon, "%s/%s", REAL_DAEMON_DIR, arg0);
236	    if (check_path(daemon, &st) < 0) {
237		tcpd_warn("%s: not found in %s: %m",
238			  arg0, REAL_DAEMON_DIR);
239	    } else if ((st.st_mode & 0100) == 0) {
240		tcpd_warn("%s: not executable", daemon);
241	    }
242	}
243
244    } else {
245
246	/*
247	 * No tcpd program found. Perhaps they used the "simple installation"
248	 * recipe. Look for a file with the same basename in REAL_DAEMON_DIR.
249	 * Draw some conservative conclusions when a distinct file is found.
250	 */
251	sprintf(daemon, "%s/%s", REAL_DAEMON_DIR, arg0);
252	if (STR_EQ(path, daemon)) {
253#ifdef __FreeBSD__
254	    wrap_status = WR_MAYBE;
255#else
256	    wrap_status = WR_NOT;
257#endif
258	} else if (check_path(daemon, &st) >= 0) {
259	    wrap_status = WR_MAYBE;
260	} else if (errno == ENOENT) {
261	    wrap_status = WR_NOT;
262	} else {
263	    tcpd_warn("%s: file lookup: %m", daemon);
264	    wrap_status = WR_MAYBE;
265	}
266    }
267
268    /*
269     * Alas, we cannot wrap rpc/tcp services.
270     */
271    if (wrap_status == WR_YES && STR_EQ(protocol, "rpc/tcp"))
272	tcpd_warn("%s: cannot wrap rpc/tcp services", tcpd_proc_name);
273
274    inet_set(tcpd_proc_name, wrap_status);
275}
276
277/* inet_set - remember service status */
278
279void    inet_set(name, type)
280char   *name;
281int     type;
282{
283    struct inet_ent *ip =
284    (struct inet_ent *) malloc(sizeof(struct inet_ent) + strlen(name));
285
286    if (ip == 0) {
287	fprintf(stderr, "out of memory\n");
288	exit(1);
289    }
290    ip->next = inet_list;
291    strcpy(ip->name, name);
292    ip->type = type;
293    inet_list = ip;
294}
295
296/* inet_get - look up service status */
297
298int     inet_get(name)
299char   *name;
300{
301    struct inet_ent *ip;
302
303    if (inet_list == 0)
304	return (WR_MAYBE);
305
306    for (ip = inet_list; ip; ip = ip->next)
307	if (STR_EQ(ip->name, name))
308	    return (ip->type);
309
310    return (-1);
311}
312
313/* base_name - compute last pathname component */
314
315static char *base_name(path)
316char   *path;
317{
318    char   *cp;
319
320    if ((cp = strrchr(path, '/')) != 0)
321	path = cp + 1;
322    return (path);
323}
324