rshd.c revision 22041 
1/*-
2 * Copyright (c) 1988, 1989, 1992, 1993, 1994
3 *	The Regents of the University of California.  All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 *    notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 *    notice, this list of conditions and the following disclaimer in the
12 *    documentation and/or other materials provided with the distribution.
13 * 3. All advertising materials mentioning features or use of this software
14 *    must display the following acknowledgement:
15 *	This product includes software developed by the University of
16 *	California, Berkeley and its contributors.
17 * 4. Neither the name of the University nor the names of its contributors
18 *    may be used to endorse or promote products derived from this software
19 *    without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 *
33 *	$FreeBSD: head/libexec/rshd/rshd.c 22041 1997-01-27 15:38:46Z joerg $
34 */
35
36#ifndef lint
37static char copyright[] =
38"@(#) Copyright (c) 1988, 1989, 1992, 1993, 1994\n\
39	The Regents of the University of California.  All rights reserved.\n";
40#endif /* not lint */
41
42#ifndef lint
43static char sccsid[] = "@(#)rshd.c	8.2 (Berkeley) 4/6/94";
44#endif /* not lint */
45
46/*
47 * remote shell server:
48 *	[port]\0
49 *	remuser\0
50 *	locuser\0
51 *	command\0
52 *	data
53 */
54#include <sys/param.h>
55#include <sys/ioctl.h>
56#include <sys/time.h>
57#include <sys/socket.h>
58
59#include <netinet/in.h>
60#include <arpa/inet.h>
61#include <netdb.h>
62
63#include <errno.h>
64#include <fcntl.h>
65#include <paths.h>
66#include <pwd.h>
67#include <signal.h>
68#include <stdio.h>
69#include <stdlib.h>
70#include <string.h>
71#include <syslog.h>
72#include <unistd.h>
73
74int	keepalive = 1;
75int	check_all;
76int	log_success;		/* If TRUE, log all successful accesses */
77int	sent_null;
78
79void	 doit __P((struct sockaddr_in *));
80void	 error __P((const char *, ...));
81void	 getstr __P((char *, int, char *));
82int	 local_domain __P((char *));
83char	*topdomain __P((char *));
84void	 usage __P((void));
85
86#ifdef	KERBEROS
87#include <des.h>
88#include <kerberosIV/krb.h>
89#define	VERSION_SIZE	9
90#define SECURE_MESSAGE  "This rsh session is using DES encryption for all transmissions.\r\n"
91#define	OPTIONS		"alnkvxL"
92char	authbuf[sizeof(AUTH_DAT)];
93char	tickbuf[sizeof(KTEXT_ST)];
94int	doencrypt, use_kerberos, vacuous;
95Key_schedule	schedule;
96#else
97#define	OPTIONS	"alnL"
98#endif
99
100int
101main(argc, argv)
102	int argc;
103	char *argv[];
104{
105	extern int __check_rhosts_file;
106	struct linger linger;
107	int ch, on = 1, fromlen;
108	struct sockaddr_in from;
109
110	openlog("rshd", LOG_PID | LOG_ODELAY, LOG_DAEMON);
111
112	opterr = 0;
113	while ((ch = getopt(argc, argv, OPTIONS)) != EOF)
114		switch (ch) {
115		case 'a':
116			check_all = 1;
117			break;
118		case 'l':
119			__check_rhosts_file = 0;
120			break;
121		case 'n':
122			keepalive = 0;
123			break;
124#ifdef	KERBEROS
125		case 'k':
126			use_kerberos = 1;
127			break;
128
129		case 'v':
130			vacuous = 1;
131			break;
132
133#ifdef CRYPT
134		case 'x':
135			doencrypt = 1;
136			break;
137#endif
138#endif
139		case 'L':
140			log_success = 1;
141			break;
142		case '?':
143		default:
144			usage();
145			break;
146		}
147
148	argc -= optind;
149	argv += optind;
150
151#ifdef	KERBEROS
152	if (use_kerberos && vacuous) {
153		syslog(LOG_ERR, "only one of -k and -v allowed");
154		exit(2);
155	}
156#ifdef CRYPT
157	if (doencrypt && !use_kerberos) {
158		syslog(LOG_ERR, "-k is required for -x");
159		exit(2);
160	}
161#endif
162#endif
163
164	fromlen = sizeof (from);
165	if (getpeername(0, (struct sockaddr *)&from, &fromlen) < 0) {
166		syslog(LOG_ERR, "getpeername: %m");
167		_exit(1);
168	}
169	if (keepalive &&
170	    setsockopt(0, SOL_SOCKET, SO_KEEPALIVE, (char *)&on,
171	    sizeof(on)) < 0)
172		syslog(LOG_WARNING, "setsockopt (SO_KEEPALIVE): %m");
173	linger.l_onoff = 1;
174	linger.l_linger = 60;			/* XXX */
175	if (setsockopt(0, SOL_SOCKET, SO_LINGER, (char *)&linger,
176	    sizeof (linger)) < 0)
177		syslog(LOG_WARNING, "setsockopt (SO_LINGER): %m");
178	doit(&from);
179	/* NOTREACHED */
180}
181
182char	username[20] = "USER=";
183char	homedir[64] = "HOME=";
184char	shell[64] = "SHELL=";
185char	path[100] = "PATH=";
186char	*envinit[] =
187	    {homedir, shell, path, username, 0};
188char	**environ;
189
190void
191doit(fromp)
192	struct sockaddr_in *fromp;
193{
194	extern char *__rcmd_errstr;	/* syslog hook from libc/net/rcmd.c. */
195	struct hostent *hp;
196	struct passwd *pwd;
197	u_short port;
198	fd_set ready, readfrom;
199	int cc, nfd, pv[2], pid, s;
200	int one = 1;
201	char *hostname, *errorstr, *errorhost;
202	char *cp, sig, buf[BUFSIZ];
203	char cmdbuf[NCARGS+1], locuser[16], remuser[16];
204	char remotehost[2 * MAXHOSTNAMELEN + 1];
205	char fromhost[2 * MAXHOSTNAMELEN + 1];
206
207#ifdef	KERBEROS
208	AUTH_DAT	*kdata = (AUTH_DAT *) NULL;
209	KTEXT		ticket = (KTEXT) NULL;
210	char		instance[INST_SZ], version[VERSION_SIZE];
211	struct		sockaddr_in	fromaddr;
212	int		rc;
213	long		authopts;
214	int		pv1[2], pv2[2];
215	fd_set		wready, writeto;
216
217	fromaddr = *fromp;
218#endif
219
220	(void) signal(SIGINT, SIG_DFL);
221	(void) signal(SIGQUIT, SIG_DFL);
222	(void) signal(SIGTERM, SIG_DFL);
223#ifdef DEBUG
224	{ int t = open(_PATH_TTY, 2);
225	  if (t >= 0) {
226		ioctl(t, TIOCNOTTY, (char *)0);
227		(void) close(t);
228	  }
229	}
230#endif
231	fromp->sin_port = ntohs((u_short)fromp->sin_port);
232	if (fromp->sin_family != AF_INET) {
233		syslog(LOG_ERR, "malformed \"from\" address (af %d)\n",
234		    fromp->sin_family);
235		exit(1);
236	}
237#ifdef IP_OPTIONS
238      {
239	u_char optbuf[BUFSIZ/3], *cp;
240	char lbuf[BUFSIZ], *lp;
241	int optsize = sizeof(optbuf), ipproto;
242	struct protoent *ip;
243
244	if ((ip = getprotobyname("ip")) != NULL)
245		ipproto = ip->p_proto;
246	else
247		ipproto = IPPROTO_IP;
248	if (!getsockopt(0, ipproto, IP_OPTIONS, (char *)optbuf, &optsize) &&
249	    optsize != 0) {
250		lp = lbuf;
251		for (cp = optbuf; optsize > 0; cp++, optsize--, lp += 3)
252			sprintf(lp, " %2.2x", *cp);
253		syslog(LOG_NOTICE,
254		    "Connection received from %s using IP options (ignored):%s",
255		    inet_ntoa(fromp->sin_addr), lbuf);
256		if (setsockopt(0, ipproto, IP_OPTIONS,
257		    (char *)NULL, optsize) != 0) {
258			syslog(LOG_ERR, "setsockopt IP_OPTIONS NULL: %m");
259			exit(1);
260		}
261	}
262      }
263#endif
264
265#ifdef	KERBEROS
266	if (!use_kerberos)
267#endif
268		if (fromp->sin_port >= IPPORT_RESERVED ||
269		    fromp->sin_port < IPPORT_RESERVED/2) {
270			syslog(LOG_NOTICE|LOG_AUTH,
271			    "Connection from %s on illegal port %u",
272			    inet_ntoa(fromp->sin_addr),
273			    fromp->sin_port);
274			exit(1);
275		}
276
277	(void) alarm(60);
278	port = 0;
279	for (;;) {
280		char c;
281		if ((cc = read(STDIN_FILENO, &c, 1)) != 1) {
282			if (cc < 0)
283				syslog(LOG_NOTICE, "read: %m");
284			shutdown(0, 1+1);
285			exit(1);
286		}
287		if (c== 0)
288			break;
289		port = port * 10 + c - '0';
290	}
291
292	(void) alarm(0);
293	if (port != 0) {
294		int lport = IPPORT_RESERVED - 1;
295		s = rresvport(&lport);
296		if (s < 0) {
297			syslog(LOG_ERR, "can't get stderr port: %m");
298			exit(1);
299		}
300#ifdef	KERBEROS
301		if (!use_kerberos)
302#endif
303			if (port >= IPPORT_RESERVED) {
304				syslog(LOG_ERR, "2nd port not reserved\n");
305				exit(1);
306			}
307		fromp->sin_port = htons(port);
308		if (connect(s, (struct sockaddr *)fromp, sizeof (*fromp)) < 0) {
309			syslog(LOG_INFO, "connect second port %d: %m", port);
310			exit(1);
311		}
312	}
313
314#ifdef	KERBEROS
315	if (vacuous) {
316		error("rshd: remote host requires Kerberos authentication\n");
317		exit(1);
318	}
319#endif
320
321#ifdef notdef
322	/* from inetd, socket is already on 0, 1, 2 */
323	dup2(f, 0);
324	dup2(f, 1);
325	dup2(f, 2);
326#endif
327	errorstr = NULL;
328	hp = gethostbyaddr((char *)&fromp->sin_addr, sizeof (struct in_addr),
329		fromp->sin_family);
330	if (hp) {
331		/*
332		 * If name returned by gethostbyaddr is in our domain,
333		 * attempt to verify that we haven't been fooled by someone
334		 * in a remote net; look up the name and check that this
335		 * address corresponds to the name.
336		 */
337		strncpy(fromhost, hp->h_name, sizeof(fromhost) - 1);
338		fromhost[sizeof(fromhost) - 1] = 0;
339		hostname = fromhost;
340#ifdef	KERBEROS
341		if (!use_kerberos)
342#endif
343		if (check_all || local_domain(hp->h_name)) {
344			strncpy(remotehost, hp->h_name, sizeof(remotehost) - 1);
345			remotehost[sizeof(remotehost) - 1] = 0;
346			errorhost = remotehost;
347			hp = gethostbyname(remotehost);
348			if (hp == NULL) {
349				syslog(LOG_INFO,
350				    "Couldn't look up address for %s",
351				    remotehost);
352				errorstr =
353				"Couldn't look up address for your host (%s)\n";
354				strncpy(fromhost, inet_ntoa(fromp->sin_addr),
355					sizeof(fromhost) - 1);
356				fromhost[sizeof(fromhost) - 1] = 0;
357				hostname = fromhost;
358			} else for (; ; hp->h_addr_list++) {
359				if (hp->h_addr_list[0] == NULL) {
360					syslog(LOG_NOTICE,
361					  "Host addr %s not listed for host %s",
362					    inet_ntoa(fromp->sin_addr),
363					    hp->h_name);
364					errorstr =
365					    "Host address mismatch for %s\n";
366					strncpy(fromhost, inet_ntoa(fromp->sin_addr),
367						sizeof(fromhost) - 1);
368					fromhost[sizeof(fromhost) - 1] = 0;
369					hostname = fromhost;
370					break;
371				}
372				if (!bcmp(hp->h_addr_list[0],
373				    (caddr_t)&fromp->sin_addr,
374				    sizeof(fromp->sin_addr))) {
375					hostname = remotehost;
376					break;
377				}
378			}
379		}
380	} else {
381		strncpy(fromhost, inet_ntoa(fromp->sin_addr),
382			sizeof(fromhost) - 1);
383		fromhost[sizeof(fromhost) - 1] = 0;
384		errorhost = hostname = fromhost;
385	}
386
387#ifdef	KERBEROS
388	if (use_kerberos) {
389		kdata = (AUTH_DAT *) authbuf;
390		ticket = (KTEXT) tickbuf;
391		authopts = 0L;
392		strcpy(instance, "*");
393		version[VERSION_SIZE - 1] = '\0';
394#ifdef CRYPT
395		if (doencrypt) {
396			struct sockaddr_in local_addr;
397			rc = sizeof(local_addr);
398			if (getsockname(0, (struct sockaddr *)&local_addr,
399			    &rc) < 0) {
400				syslog(LOG_ERR, "getsockname: %m");
401				error("rlogind: getsockname: %m");
402				exit(1);
403			}
404			authopts = KOPT_DO_MUTUAL;
405			rc = krb_recvauth(authopts, 0, ticket,
406				"rcmd", instance, &fromaddr,
407				&local_addr, kdata, "", schedule,
408				version);
409			des_set_key_krb(&kdata->session, schedule);
410		} else
411#endif
412			rc = krb_recvauth(authopts, 0, ticket, "rcmd",
413				instance, &fromaddr,
414				(struct sockaddr_in *) 0,
415				kdata, "", NULL, version);
416		if (rc != KSUCCESS) {
417			error("Kerberos authentication failure: %s\n",
418				  krb_err_txt[rc]);
419			exit(1);
420		}
421	} else
422#endif
423		getstr(remuser, sizeof(remuser), "remuser");
424
425	getstr(locuser, sizeof(locuser), "locuser");
426	getstr(cmdbuf, sizeof(cmdbuf), "command");
427	setpwent();
428	pwd = getpwnam(locuser);
429	if (pwd == NULL) {
430		syslog(LOG_INFO|LOG_AUTH,
431		    "%s@%s as %s: unknown login. cmd='%.80s'",
432		    remuser, hostname, locuser, cmdbuf);
433		if (errorstr == NULL)
434			errorstr = "Login incorrect.\n";
435		goto fail;
436	}
437	if (chdir(pwd->pw_dir) < 0) {
438		(void) chdir("/");
439#ifdef notdef
440		syslog(LOG_INFO|LOG_AUTH,
441		    "%s@%s as %s: no home directory. cmd='%.80s'",
442		    remuser, hostname, locuser, cmdbuf);
443		error("No remote directory.\n");
444		exit(1);
445#endif
446	}
447
448#ifdef	KERBEROS
449	if (use_kerberos) {
450		if (pwd->pw_passwd != 0 && *pwd->pw_passwd != '\0') {
451			if (kuserok(kdata, locuser) != 0) {
452				syslog(LOG_INFO|LOG_AUTH,
453				    "Kerberos rsh denied to %s.%s@%s",
454				    kdata->pname, kdata->pinst, kdata->prealm);
455				error("Permission denied.\n");
456				exit(1);
457			}
458		}
459	} else
460#endif
461
462		if (errorstr ||
463		    (pwd->pw_expire && time(NULL) >= pwd->pw_expire) ||
464		    (pwd->pw_passwd != 0 && *pwd->pw_passwd != '\0' &&
465		    iruserok(fromp->sin_addr.s_addr, pwd->pw_uid == 0,
466		    remuser, locuser) < 0)) {
467			if (__rcmd_errstr)
468				syslog(LOG_INFO|LOG_AUTH,
469			    "%s@%s as %s: permission denied (%s). cmd='%.80s'",
470				    remuser, hostname, locuser, __rcmd_errstr,
471				    cmdbuf);
472			else
473				syslog(LOG_INFO|LOG_AUTH,
474			    "%s@%s as %s: permission denied. cmd='%.80s'",
475				    remuser, hostname, locuser, cmdbuf);
476fail:
477			if (errorstr == NULL)
478				errorstr = "Permission denied.\n";
479			error(errorstr, errorhost);
480			exit(1);
481		}
482
483	if (pwd->pw_uid && !access(_PATH_NOLOGIN, F_OK)) {
484		error("Logins currently disabled.\n");
485		exit(1);
486	}
487#if	BSD > 43
488	/* before fork, while we're session leader */
489	if (setlogin(pwd->pw_name) < 0)
490		syslog(LOG_ERR, "setlogin() failed: %m");
491#endif
492
493	(void) write(STDERR_FILENO, "\0", 1);
494	sent_null = 1;
495
496	if (port) {
497		if (pipe(pv) < 0) {
498			error("Can't make pipe.\n");
499			exit(1);
500		}
501#ifdef CRYPT
502#ifdef KERBEROS
503		if (doencrypt) {
504			if (pipe(pv1) < 0) {
505				error("Can't make 2nd pipe.\n");
506				exit(1);
507			}
508			if (pipe(pv2) < 0) {
509				error("Can't make 3rd pipe.\n");
510				exit(1);
511			}
512		}
513#endif
514#endif
515		pid = fork();
516		if (pid == -1)  {
517			error("Can't fork; try again.\n");
518			exit(1);
519		}
520		if (pid) {
521#ifdef CRYPT
522#ifdef KERBEROS
523			if (doencrypt) {
524				static char msg[] = SECURE_MESSAGE;
525				(void) close(pv1[1]);
526				(void) close(pv2[1]);
527				des_write(s, msg, sizeof(msg) - 1);
528
529			} else
530#endif
531#endif
532			{
533				(void) close(0);
534				(void) close(1);
535			}
536			(void) close(2);
537			(void) close(pv[1]);
538
539			FD_ZERO(&readfrom);
540			FD_SET(s, &readfrom);
541			FD_SET(pv[0], &readfrom);
542			if (pv[0] > s)
543				nfd = pv[0];
544			else
545				nfd = s;
546#ifdef CRYPT
547#ifdef KERBEROS
548			if (doencrypt) {
549				FD_ZERO(&writeto);
550				FD_SET(pv2[0], &writeto);
551				FD_SET(pv1[0], &readfrom);
552
553				nfd = MAX(nfd, pv2[0]);
554				nfd = MAX(nfd, pv1[0]);
555			} else
556#endif
557#endif
558				ioctl(pv[0], FIONBIO, (char *)&one);
559
560			/* should set s nbio! */
561			nfd++;
562			do {
563				ready = readfrom;
564#ifdef CRYPT
565#ifdef KERBEROS
566				if (doencrypt) {
567					wready = writeto;
568					if (select(nfd, &ready,
569					    &wready, (fd_set *) 0,
570					    (struct timeval *) 0) < 0)
571						break;
572				} else
573#endif
574#endif
575					if (select(nfd, &ready, (fd_set *)0,
576					  (fd_set *)0, (struct timeval *)0) < 0)
577						break;
578				if (FD_ISSET(s, &ready)) {
579					int	ret;
580#ifdef CRYPT
581#ifdef KERBEROS
582					if (doencrypt)
583						ret = des_read(s, &sig, 1);
584					else
585#endif
586#endif
587						ret = read(s, &sig, 1);
588					if (ret <= 0)
589						FD_CLR(s, &readfrom);
590					else
591						killpg(pid, sig);
592				}
593				if (FD_ISSET(pv[0], &ready)) {
594					errno = 0;
595					cc = read(pv[0], buf, sizeof(buf));
596					if (cc <= 0) {
597						shutdown(s, 1+1);
598						FD_CLR(pv[0], &readfrom);
599					} else {
600#ifdef CRYPT
601#ifdef KERBEROS
602						if (doencrypt)
603							(void)
604							  des_write(s, buf, cc);
605						else
606#endif
607#endif
608							(void)
609							  write(s, buf, cc);
610					}
611				}
612#ifdef CRYPT
613#ifdef KERBEROS
614				if (doencrypt && FD_ISSET(pv1[0], &ready)) {
615					errno = 0;
616					cc = read(pv1[0], buf, sizeof(buf));
617					if (cc <= 0) {
618						shutdown(pv1[0], 1+1);
619						FD_CLR(pv1[0], &readfrom);
620					} else
621						(void) des_write(STDOUT_FILENO,
622						    buf, cc);
623				}
624
625				if (doencrypt && FD_ISSET(pv2[0], &wready)) {
626					errno = 0;
627					cc = des_read(STDIN_FILENO,
628					    buf, sizeof(buf));
629					if (cc <= 0) {
630						shutdown(pv2[0], 1+1);
631						FD_CLR(pv2[0], &writeto);
632					} else
633						(void) write(pv2[0], buf, cc);
634				}
635#endif
636#endif
637
638			} while (FD_ISSET(s, &readfrom) ||
639#ifdef CRYPT
640#ifdef KERBEROS
641			    (doencrypt && FD_ISSET(pv1[0], &readfrom)) ||
642#endif
643#endif
644			    FD_ISSET(pv[0], &readfrom));
645			exit(0);
646		}
647		setpgrp(0, getpid());
648		(void) close(s);
649		(void) close(pv[0]);
650#ifdef CRYPT
651#ifdef KERBEROS
652		if (doencrypt) {
653			close(pv1[0]); close(pv2[0]);
654			dup2(pv1[1], 1);
655			dup2(pv2[1], 0);
656			close(pv1[1]);
657			close(pv2[1]);
658		}
659#endif
660#endif
661		dup2(pv[1], 2);
662		close(pv[1]);
663	}
664	if (*pwd->pw_shell == '\0')
665		pwd->pw_shell = _PATH_BSHELL;
666	(void) setgid((gid_t)pwd->pw_gid);
667	initgroups(pwd->pw_name, pwd->pw_gid);
668	(void) setuid((uid_t)pwd->pw_uid);
669	environ = envinit;
670	strncat(homedir, pwd->pw_dir, sizeof(homedir)-6);
671	strcat(path, _PATH_DEFPATH);
672	strncat(shell, pwd->pw_shell, sizeof(shell)-7);
673	strncat(username, pwd->pw_name, sizeof(username)-6);
674	cp = strrchr(pwd->pw_shell, '/');
675	if (cp)
676		cp++;
677	else
678		cp = pwd->pw_shell;
679	endpwent();
680	if (log_success || pwd->pw_uid == 0) {
681#ifdef	KERBEROS
682		if (use_kerberos)
683		    syslog(LOG_INFO|LOG_AUTH,
684			"Kerberos shell from %s.%s@%s on %s as %s, cmd='%.80s'",
685			kdata->pname, kdata->pinst, kdata->prealm,
686			hostname, locuser, cmdbuf);
687		else
688#endif
689		    syslog(LOG_INFO|LOG_AUTH, "%s@%s as %s: cmd='%.80s'",
690			remuser, hostname, locuser, cmdbuf);
691	}
692	execl(pwd->pw_shell, cp, "-c", cmdbuf, 0);
693	perror(pwd->pw_shell);
694	exit(1);
695}
696
697/*
698 * Report error to client.  Note: can't be used until second socket has
699 * connected to client, or older clients will hang waiting for that
700 * connection first.
701 */
702#if __STDC__
703#include <stdarg.h>
704#else
705#include <varargs.h>
706#endif
707
708void
709#if __STDC__
710error(const char *fmt, ...)
711#else
712error(fmt, va_alist)
713	char *fmt;
714        va_dcl
715#endif
716{
717	va_list ap;
718	int len;
719	char *bp, buf[BUFSIZ];
720#if __STDC__
721	va_start(ap, fmt);
722#else
723	va_start(ap);
724#endif
725	bp = buf;
726	if (sent_null == 0) {
727		*bp++ = 1;
728		len = 1;
729	} else
730		len = 0;
731	(void)vsnprintf(bp, sizeof(buf) - 1, fmt, ap);
732	(void)write(STDERR_FILENO, buf, len + strlen(bp));
733}
734
735void
736getstr(buf, cnt, err)
737	char *buf, *err;
738	int cnt;
739{
740	char c;
741
742	do {
743		if (read(STDIN_FILENO, &c, 1) != 1)
744			exit(1);
745		*buf++ = c;
746		if (--cnt == 0) {
747			error("%s too long\n", err);
748			exit(1);
749		}
750	} while (c != 0);
751}
752
753/*
754 * Check whether host h is in our local domain,
755 * defined as sharing the last two components of the domain part,
756 * or the entire domain part if the local domain has only one component.
757 * If either name is unqualified (contains no '.'),
758 * assume that the host is local, as it will be
759 * interpreted as such.
760 */
761int
762local_domain(h)
763	char *h;
764{
765	char localhost[MAXHOSTNAMELEN];
766	char *p1, *p2;
767
768	localhost[0] = 0;
769	(void) gethostname(localhost, sizeof(localhost));
770	p1 = topdomain(localhost);
771	p2 = topdomain(h);
772	if (p1 == NULL || p2 == NULL || !strcasecmp(p1, p2))
773		return (1);
774	return (0);
775}
776
777char *
778topdomain(h)
779	char *h;
780{
781	char *p, *maybe = NULL;
782	int dots = 0;
783
784	for (p = h + strlen(h); p >= h; p--) {
785		if (*p == '.') {
786			if (++dots == 2)
787				return (p);
788			maybe = p;
789		}
790	}
791	return (maybe);
792}
793
794void
795usage()
796{
797
798	syslog(LOG_ERR, "usage: rshd [-%s]", OPTIONS);
799	exit(2);
800}
801