2 * Copyright 2004 Sun Microsystems, Inc. All rights reserved.
3 * Use is subject to license terms.
6 #pragma ident "%Z%%M% %I% %E% SMI"
9 * This module determines the type of socket (datagram, stream), the client
10 * socket address and port, the server socket address and port. In addition,
11 * it provides methods to map a transport address to a printable host name
12 * or address. Socket address information results are in static memory.
14 * The result from the hostname lookup method is STRING_PARANOID when a host
15 * pretends to have someone elses name, or when a host name is available but
16 * could not be verified.
18 * When lookup or conversion fails the result is set to STRING_UNKNOWN.
20 * Diagnostics are reported through syslog(3).
22 * Author: Wietse Venema, Eindhoven University of Technology, The Netherlands.
25 static char sccsid
[] = "@(#) socket.c 1.15 97/03/21 19:27:24";
27 /* System libraries. */
29 #include <sys/types.h>
30 #include <sys/param.h>
31 #include <sys/socket.h>
32 #include <netinet/in.h>
33 #include <arpa/inet.h>
39 extern char *inet_ntoa();
45 /* Forward declarations. */
47 static void sock_sink();
52 * Speed up DNS lookups by terminating the host name with a dot. Should be
53 * done with care. The speedup can give problems with lookups from sources
54 * that lack DNS-style trailing dot magic, such as local files or NIS maps.
57 static struct hostent
*tcpd_gethostbyname_dot(name
, af
)
61 char dot_name
[MAXHOSTNAMELEN
+ 1];
64 * Don't append dots to unqualified names. Such names are likely to come
65 * from local hosts files or from NIS.
68 if (strchr(name
, '.') == 0 || strlen(name
) >= MAXHOSTNAMELEN
- 1) {
69 return (tcpd_gethostbyname(name
, af
));
71 sprintf(dot_name
, "%s.", name
);
72 return (tcpd_gethostbyname(dot_name
, af
));
76 #define tcpd_gethostbyname tcpd_gethostbyname_dot
79 /* sock_host - look up endpoint addresses and install conversion methods */
81 void sock_host(request
)
82 struct request_info
*request
;
84 static struct sockaddr_gen client
;
85 static struct sockaddr_gen server
;
90 sock_methods(request
);
93 * Look up the client host address. Hal R. Brand <BRAND@addvax.llnl.gov>
94 * suggested how to get the client host info in case of UDP connections:
95 * peek at the first message without actually looking at its contents. We
96 * really should verify that client.sin_family gets the value AF_INET,
97 * but this program has already caused too much grief on systems with
98 * broken library code.
101 len
= sizeof(client
);
102 if (getpeername(fd
, (struct sockaddr
*) & client
, &len
) < 0) {
103 request
->sink
= sock_sink
;
104 len
= sizeof(client
);
105 if (recvfrom(fd
, buf
, sizeof(buf
), MSG_PEEK
,
106 (struct sockaddr
*) & client
, &len
) < 0) {
107 tcpd_warn("can't get client address: %m");
108 return; /* give up */
110 #ifdef really_paranoid
111 memset(buf
, 0 sizeof(buf
));
114 sockgen_simplify(&client
);
115 request
->client
->sin
= &client
;
118 * Determine the server binding. This is used for client username
119 * lookups, and for access control rules that trigger on the server
123 len
= sizeof(server
);
124 if (getsockname(fd
, (struct sockaddr
*) & server
, &len
) < 0) {
125 tcpd_warn("getsockname: %m");
128 sockgen_simplify(&server
);
129 request
->server
->sin
= &server
;
132 /* sock_hostaddr - map endpoint address to printable form */
134 void sock_hostaddr(host
)
135 struct host_info
*host
;
137 struct sockaddr_gen
*sin
= host
->sin
;
142 (void) inet_ntop(SGFAM(sin
), SGADDRP(sin
), host
->addr
, sizeof(host
->addr
));
144 STRN_CPY(host
->addr
, inet_ntoa(sin
->sg_sin
.sin_addr
), sizeof(host
->addr
));
148 /* sock_hostname - map endpoint address to host name */
150 void sock_hostname(host
)
151 struct host_info
*host
;
153 struct sockaddr_gen
*sin
= host
->sin
;
159 * On some systems, for example Solaris 2.3, gethostbyaddr(0.0.0.0) does
160 * not fail. Instead it returns "INADDR_ANY". Unfortunately, this does
161 * not work the other way around: gethostbyname("INADDR_ANY") fails. We
162 * have to special-case 0.0.0.0, in order to avoid false alerts from the
163 * host name/address checking code below.
166 && !SG_IS_UNSPECIFIED(sin
)
167 && (hp
= gethostbyaddr(SGADDRP(sin
), SGADDRSZ(sin
), SGFAM(sin
))) != 0) {
169 STRN_CPY(host
->name
, hp
->h_name
, sizeof(host
->name
));
172 * Verify that the address is a member of the address list returned
173 * by gethostbyname(hostname).
175 * Verify also that gethostbyaddr() and gethostbyname() return the same
176 * hostname, or rshd and rlogind may still end up being spoofed.
178 * On some sites, gethostbyname("localhost") returns "localhost.domain".
179 * This is a DNS artefact. We treat it as a special case. When we
180 * can't believe the address list from gethostbyname("localhost")
181 * we're in big trouble anyway.
184 if ((hp
= tcpd_gethostbyname(host
->name
, SGFAM(sin
))) == 0) {
187 * Unable to verify that the host name matches the address. This
188 * may be a transient problem or a botched name server setup.
191 tcpd_warn("can't verify hostname: gethostbyname(%s) failed",
194 } else if (STR_NE(host
->name
, hp
->h_name
)
195 && STR_NE(host
->name
, "localhost")) {
198 * The gethostbyaddr() and gethostbyname() calls did not return
199 * the same hostname. This could be a nameserver configuration
200 * problem. It could also be that someone is trying to spoof us.
203 tcpd_warn("host name/name mismatch: %s != %.*s",
204 host
->name
, STRING_LENGTH
, hp
->h_name
);
208 char buf
[INET6_ADDRSTRLEN
];
212 * The address should be a member of the address list returned by
213 * gethostbyname(). We should first verify that the h_addrtype
214 * field is AF_INET, but this program has already caused too much
215 * grief on systems with broken library code.
218 for (i
= 0; hp
->h_addr_list
[i
]; i
++) {
219 if (memcmp(hp
->h_addr_list
[i
],
220 (char *) SGADDRP(sin
),
221 SGADDRSZ(sin
)) == 0) {
222 return; /* name is good, keep it */
227 * The host name does not map to the initial address. Perhaps
228 * someone has messed up. Perhaps someone compromised a name
231 tcpd_warn("host name/address mismatch: %s != %.*s",
233 inet_ntop(SGFAM(sin
), SGADDRP(sin
), buf
, sizeof(buf
)),
235 inet_ntoa(sin
->sg_sin
.sin_addr
),
237 STRING_LENGTH
, hp
->h_name
);
239 strcpy(host
->name
, paranoid
); /* name is bad, clobber it */
243 /* sock_sink - absorb unreceived IP datagram */
245 static void sock_sink(fd
)
249 struct sockaddr_in sin
;
250 socklen_t size
= sizeof(sin
);
253 * Eat up the not-yet received datagram. Some systems insist on a
254 * non-zero source address argument in the recvfrom() call below.
257 (void) recvfrom(fd
, buf
, sizeof(buf
), 0, (struct sockaddr
*) & sin
, &size
);
261 * If we receive a V4 connection on a V6 socket, we pretend we really
262 * got a V4 connection.
264 void sockgen_simplify(sg
)
268 if (sg
->sg_family
== AF_INET6
&&
269 IN6_IS_ADDR_V4MAPPED(&sg
->sg_sin6
.sin6_addr
)) {
270 struct sockaddr_in v4_addr
;
272 #ifdef IN6_V4MAPPED_TO_INADDR /* Solaris 8 */
273 IN6_V4MAPPED_TO_INADDR(&sg
->sg_sin6
.sin6_addr
, &v4_addr
.sin_addr
);
274 #elif defined(IN6_MAPPED_TO_V4) /* Solaris 8 Beta only? */
275 IN6_MAPPED_TO_V4(&sg
->sg_sin6
.sin6_addr
, &v4_addr
.sin_addr
);
276 #else /* Do it the hard way */
277 memcpy(&v4_addr
.sin_addr
, ((char*) &sg
->sg_sin6
.sin6_addr
) + 12, 4);
279 v4_addr
.sin_port
= sg
->sg_sin6
.sin6_port
;
280 v4_addr
.sin_family
= AF_INET
;
281 memcpy(&sg
->sg_sin
, &v4_addr
, sizeof(v4_addr
));
285 #endif /* HAVE_IPV6 */