1/* $FreeBSD$ */
2 /*
3  * Routines to parse an inetd.conf or tlid.conf file. This would be a great
4  * job for a PERL script.
5  *
6  * Author: Wietse Venema, Eindhoven University of Technology, The Netherlands.
7  */
8
9#ifndef lint
10static char sccsid[] = "@(#) inetcf.c 1.7 97/02/12 02:13:23";
11#endif
12
13#include <sys/types.h>
14#include <sys/stat.h>
15#include <stdio.h>
16#include <errno.h>
17#include <stdlib.h>
18#include <string.h>
19
20#include "tcpd.h"
21#include "inetcf.h"
22#include "scaffold.h"
23
24 /*
25  * Network configuration files may live in unusual places. Here are some
26  * guesses. Shorter names follow longer ones.
27  */
28char   *inet_files[] = {
29    "/private/etc/inetd.conf",		/* NEXT */
30    "/etc/inet/inetd.conf",		/* SYSV4 */
31    "/usr/etc/inetd.conf",		/* IRIX?? */
32    "/etc/inetd.conf",			/* BSD */
33    "/etc/net/tlid.conf",		/* SYSV4?? */
34    "/etc/saf/tlid.conf",		/* SYSV4?? */
35    "/etc/tlid.conf",			/* SYSV4?? */
36    0,
37};
38
39static void inet_chk(char *protocol, char *path, char *arg0, char *arg1);
40static char *base_name(char *path);
41extern char *percent_m(char *obuf, char *ibuf);
42
43 /*
44  * Structure with everything we know about a service.
45  */
46struct inet_ent {
47    struct inet_ent *next;
48    int     type;
49    char    name[1];
50};
51
52static struct inet_ent *inet_list = 0;
53
54static char whitespace[] = " \t\r\n";
55
56/* inet_conf - read in and examine inetd.conf (or tlid.conf) entries */
57
58char   *inet_cfg(char *conf)
59{
60    char    buf[BUFSIZ];
61    FILE   *fp;
62    char   *service;
63    char   *protocol;
64    char   *user;
65    char   *path;
66    char   *arg0;
67    char   *arg1;
68    struct tcpd_context saved_context;
69    int     i;
70    struct stat st;
71
72    saved_context = tcpd_context;
73
74    /*
75     * The inetd.conf (or tlid.conf) information is so useful that we insist
76     * on its availability. When no file is given run a series of educated
77     * guesses.
78     */
79    if (conf != 0) {
80	if ((fp = fopen(conf, "r")) == 0) {
81	    fprintf(stderr, percent_m(buf, "open %s: %m\n"), conf);
82	    exit(1);
83	}
84    } else {
85	for (i = 0; inet_files[i] && (fp = fopen(inet_files[i], "r")) == 0; i++)
86	     /* void */ ;
87	if (fp == 0) {
88	    fprintf(stderr, "Cannot find your inetd.conf or tlid.conf file.\n");
89	    fprintf(stderr, "Please specify its location.\n");
90	    exit(1);
91	}
92	conf = inet_files[i];
93	check_path(conf, &st);
94    }
95
96    /*
97     * Process the file. After the 7.0 wrapper release it became clear that
98     * there are many more inetd.conf formats than the 8 systems that I had
99     * studied. EP/IX uses a two-line specification for rpc services; HP-UX
100     * permits long lines to be broken with backslash-newline.
101     */
102    tcpd_context.file = conf;
103    tcpd_context.line = 0;
104    while (xgets(buf, sizeof(buf), fp)) {
105	service = strtok(buf, whitespace);	/* service */
106	if (service == 0 || *service == '#')
107	    continue;
108	if (STR_NE(service, "stream") && STR_NE(service, "dgram"))
109	    strtok((char *) 0, whitespace);	/* endpoint */
110	protocol = strtok((char *) 0, whitespace);
111	(void) strtok((char *) 0, whitespace);	/* wait */
112	if ((user = strtok((char *) 0, whitespace)) == 0)
113	    continue;
114	if (user[0] == '/') {			/* user */
115	    path = user;
116	} else {				/* path */
117	    if ((path = strtok((char *) 0, whitespace)) == 0)
118		continue;
119	}
120	if (path[0] == '?')			/* IRIX optional service */
121	    path++;
122	if (STR_EQ(path, "internal"))
123	    continue;
124	if (path[strspn(path, "-0123456789")] == 0) {
125
126	    /*
127	     * ConvexOS puts RPC version numbers before path names. Jukka
128	     * Ukkonen <ukkonen@csc.fi>.
129	     */
130	    if ((path = strtok((char *) 0, whitespace)) == 0)
131		continue;
132	}
133	if ((arg0 = strtok((char *) 0, whitespace)) == 0) {
134	    tcpd_warn("incomplete line");
135	    continue;
136	}
137	if (arg0[strspn(arg0, "0123456789")] == 0) {
138
139	    /*
140	     * We're reading a tlid.conf file, the format is:
141	     *
142	     * ...stuff... path arg_count arguments mod_count modules
143	     */
144	    if ((arg0 = strtok((char *) 0, whitespace)) == 0) {
145		tcpd_warn("incomplete line");
146		continue;
147	    }
148	}
149	if ((arg1 = strtok((char *) 0, whitespace)) == 0)
150	    arg1 = "";
151
152	inet_chk(protocol, path, arg0, arg1);
153    }
154    fclose(fp);
155    tcpd_context = saved_context;
156    return (conf);
157}
158
159/* inet_chk - examine one inetd.conf (tlid.conf?) entry */
160
161static void inet_chk(char *protocol, char *path, char *arg0, char *arg1)
162{
163    char    daemon[BUFSIZ];
164    struct stat st;
165    int     wrap_status = WR_MAYBE;
166    char   *base_name_path = base_name(path);
167    char   *tcpd_proc_name = (arg0[0] == '/' ? base_name(arg0) : arg0);
168
169    /*
170     * Always warn when the executable does not exist or when it is not
171     * executable.
172     */
173    if (check_path(path, &st) < 0) {
174	tcpd_warn("%s: not found: %m", path);
175    } else if ((st.st_mode & 0100) == 0) {
176	tcpd_warn("%s: not executable", path);
177    }
178
179    /*
180     * Cheat on the miscd tests, nobody uses it anymore.
181     */
182    if (STR_EQ(base_name_path, "miscd")) {
183	inet_set(arg0, WR_YES);
184	return;
185    }
186
187    /*
188     * While we are here...
189     */
190    if (STR_EQ(tcpd_proc_name, "rexd") || STR_EQ(tcpd_proc_name, "rpc.rexd"))
191	tcpd_warn("%s may be an insecure service", tcpd_proc_name);
192
193    /*
194     * The tcpd program gets most of the attention.
195     */
196    if (STR_EQ(base_name_path, "tcpd")) {
197
198	if (STR_EQ(tcpd_proc_name, "tcpd"))
199	    tcpd_warn("%s is recursively calling itself", tcpd_proc_name);
200
201	wrap_status = WR_YES;
202
203	/*
204	 * Check: some sites install the wrapper set-uid.
205	 */
206	if ((st.st_mode & 06000) != 0)
207	    tcpd_warn("%s: file is set-uid or set-gid", path);
208
209	/*
210	 * Check: some sites insert tcpd in inetd.conf, instead of replacing
211	 * the daemon pathname.
212	 */
213	if (arg0[0] == '/' && STR_EQ(tcpd_proc_name, base_name(arg1)))
214	    tcpd_warn("%s inserted before %s", path, arg0);
215
216	/*
217	 * Check: make sure files exist and are executable. On some systems
218	 * the network daemons are set-uid so we cannot complain. Note that
219	 * tcpd takes the basename only in case of absolute pathnames.
220	 */
221	if (arg0[0] == '/') {			/* absolute path */
222	    if (check_path(arg0, &st) < 0) {
223		tcpd_warn("%s: not found: %m", arg0);
224	    } else if ((st.st_mode & 0100) == 0) {
225		tcpd_warn("%s: not executable", arg0);
226	    }
227	} else {				/* look in REAL_DAEMON_DIR */
228	    sprintf(daemon, "%s/%s", REAL_DAEMON_DIR, arg0);
229	    if (check_path(daemon, &st) < 0) {
230		tcpd_warn("%s: not found in %s: %m",
231			  arg0, REAL_DAEMON_DIR);
232	    } else if ((st.st_mode & 0100) == 0) {
233		tcpd_warn("%s: not executable", daemon);
234	    }
235	}
236
237    } else {
238
239	/*
240	 * No tcpd program found. Perhaps they used the "simple installation"
241	 * recipe. Look for a file with the same basename in REAL_DAEMON_DIR.
242	 * Draw some conservative conclusions when a distinct file is found.
243	 */
244	sprintf(daemon, "%s/%s", REAL_DAEMON_DIR, arg0);
245	if (STR_EQ(path, daemon)) {
246#ifdef __FreeBSD__
247	    wrap_status = WR_MAYBE;
248#else
249	    wrap_status = WR_NOT;
250#endif
251	} else if (check_path(daemon, &st) >= 0) {
252	    wrap_status = WR_MAYBE;
253	} else if (errno == ENOENT) {
254	    wrap_status = WR_NOT;
255	} else {
256	    tcpd_warn("%s: file lookup: %m", daemon);
257	    wrap_status = WR_MAYBE;
258	}
259    }
260
261    /*
262     * Alas, we cannot wrap rpc/tcp services.
263     */
264    if (wrap_status == WR_YES && STR_EQ(protocol, "rpc/tcp"))
265	tcpd_warn("%s: cannot wrap rpc/tcp services", tcpd_proc_name);
266
267    inet_set(tcpd_proc_name, wrap_status);
268}
269
270/* inet_set - remember service status */
271
272void    inet_set(char *name, int type)
273{
274    struct inet_ent *ip =
275    (struct inet_ent *) malloc(sizeof(struct inet_ent) + strlen(name));
276
277    if (ip == 0) {
278	fprintf(stderr, "out of memory\n");
279	exit(1);
280    }
281    ip->next = inet_list;
282    strcpy(ip->name, name);
283    ip->type = type;
284    inet_list = ip;
285}
286
287/* inet_get - look up service status */
288
289int     inet_get(char *name)
290{
291    struct inet_ent *ip;
292
293    if (inet_list == 0)
294	return (WR_MAYBE);
295
296    for (ip = inet_list; ip; ip = ip->next)
297	if (STR_EQ(ip->name, name))
298	    return (ip->type);
299
300    return (-1);
301}
302
303/* base_name - compute last pathname component */
304
305static char *base_name(char *path)
306{
307    char   *cp;
308
309    if ((cp = strrchr(path, '/')) != 0)
310	path = cp + 1;
311    return (path);
312}
313