rshd.c revision 12240
1/*- 2 * Copyright (c) 1988, 1989, 1992, 1993, 1994 3 * The Regents of the University of California. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 3. All advertising materials mentioning features or use of this software 14 * must display the following acknowledgement: 15 * This product includes software developed by the University of 16 * California, Berkeley and its contributors. 17 * 4. Neither the name of the University nor the names of its contributors 18 * may be used to endorse or promote products derived from this software 19 * without specific prior written permission. 20 * 21 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 24 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 31 * SUCH DAMAGE. 32 */ 33 34#ifndef lint 35static char copyright[] = 36"@(#) Copyright (c) 1988, 1989, 1992, 1993, 1994\n\ 37 The Regents of the University of California. All rights reserved.\n"; 38#endif /* not lint */ 39 40#ifndef lint 41static char sccsid[] = "@(#)rshd.c 8.2 (Berkeley) 4/6/94"; 42#endif /* not lint */ 43 44/* 45 * remote shell server: 46 * [port]\0 47 * remuser\0 48 * locuser\0 49 * command\0 50 * data 51 */ 52#include <sys/param.h> 53#include <sys/ioctl.h> 54#include <sys/time.h> 55#include <sys/socket.h> 56 57#include <netinet/in.h> 58#include <arpa/inet.h> 59#include <netdb.h> 60 61#include <errno.h> 62#include <fcntl.h> 63#include <paths.h> 64#include <pwd.h> 65#include <signal.h> 66#include <stdio.h> 67#include <stdlib.h> 68#include <string.h> 69#include <syslog.h> 70#include <unistd.h> 71 72int keepalive = 1; 73int check_all; 74int log_success; /* If TRUE, log all successful accesses */ 75int sent_null; 76 77void doit __P((struct sockaddr_in *)); 78void error __P((const char *, ...)); 79void getstr __P((char *, int, char *)); 80int local_domain __P((char *)); 81char *topdomain __P((char *)); 82void usage __P((void)); 83 84#ifdef KERBEROS 85#include <kerberosIV/des.h> 86#include <kerberosIV/krb.h> 87#define VERSION_SIZE 9 88#define SECURE_MESSAGE "This rsh session is using DES encryption for all transmissions.\r\n" 89#define OPTIONS "alnkvxL" 90char authbuf[sizeof(AUTH_DAT)]; 91char tickbuf[sizeof(KTEXT_ST)]; 92int doencrypt, use_kerberos, vacuous; 93Key_schedule schedule; 94#else 95#define OPTIONS "alnL" 96#endif 97 98int 99main(argc, argv) 100 int argc; 101 char *argv[]; 102{ 103 extern int __check_rhosts_file; 104 struct linger linger; 105 int ch, on = 1, fromlen; 106 struct sockaddr_in from; 107 108 openlog("rshd", LOG_PID | LOG_ODELAY, LOG_DAEMON); 109 110 opterr = 0; 111 while ((ch = getopt(argc, argv, OPTIONS)) != EOF) 112 switch (ch) { 113 case 'a': 114 check_all = 1; 115 break; 116 case 'l': 117 __check_rhosts_file = 0; 118 break; 119 case 'n': 120 keepalive = 0; 121 break; 122#ifdef KERBEROS 123 case 'k': 124 use_kerberos = 1; 125 break; 126 127 case 'v': 128 vacuous = 1; 129 break; 130 131#ifdef CRYPT 132 case 'x': 133 doencrypt = 1; 134 break; 135#endif 136#endif 137 case 'L': 138 log_success = 1; 139 break; 140 case '?': 141 default: 142 usage(); 143 break; 144 } 145 146 argc -= optind; 147 argv += optind; 148 149#ifdef KERBEROS 150 if (use_kerberos && vacuous) { 151 syslog(LOG_ERR, "only one of -k and -v allowed"); 152 exit(2); 153 } 154#ifdef CRYPT 155 if (doencrypt && !use_kerberos) { 156 syslog(LOG_ERR, "-k is required for -x"); 157 exit(2); 158 } 159#endif 160#endif 161 162 fromlen = sizeof (from); 163 if (getpeername(0, (struct sockaddr *)&from, &fromlen) < 0) { 164 syslog(LOG_ERR, "getpeername: %m"); 165 _exit(1); 166 } 167 if (keepalive && 168 setsockopt(0, SOL_SOCKET, SO_KEEPALIVE, (char *)&on, 169 sizeof(on)) < 0) 170 syslog(LOG_WARNING, "setsockopt (SO_KEEPALIVE): %m"); 171 linger.l_onoff = 1; 172 linger.l_linger = 60; /* XXX */ 173 if (setsockopt(0, SOL_SOCKET, SO_LINGER, (char *)&linger, 174 sizeof (linger)) < 0) 175 syslog(LOG_WARNING, "setsockopt (SO_LINGER): %m"); 176 doit(&from); 177 /* NOTREACHED */ 178} 179 180char username[20] = "USER="; 181char homedir[64] = "HOME="; 182char shell[64] = "SHELL="; 183char path[100] = "PATH="; 184char *envinit[] = 185 {homedir, shell, path, username, 0}; 186char **environ; 187 188void 189doit(fromp) 190 struct sockaddr_in *fromp; 191{ 192 extern char *__rcmd_errstr; /* syslog hook from libc/net/rcmd.c. */ 193 struct hostent *hp; 194 struct passwd *pwd; 195 u_short port; 196 fd_set ready, readfrom; 197 int cc, nfd, pv[2], pid, s; 198 int one = 1; 199 char *hostname, *errorstr, *errorhost; 200 char *cp, sig, buf[BUFSIZ]; 201 char cmdbuf[NCARGS+1], locuser[16], remuser[16]; 202 char remotehost[2 * MAXHOSTNAMELEN + 1]; 203 204#ifdef KERBEROS 205 AUTH_DAT *kdata = (AUTH_DAT *) NULL; 206 KTEXT ticket = (KTEXT) NULL; 207 char instance[INST_SZ], version[VERSION_SIZE]; 208 struct sockaddr_in fromaddr; 209 int rc; 210 long authopts; 211 int pv1[2], pv2[2]; 212 fd_set wready, writeto; 213 214 fromaddr = *fromp; 215#endif 216 217 (void) signal(SIGINT, SIG_DFL); 218 (void) signal(SIGQUIT, SIG_DFL); 219 (void) signal(SIGTERM, SIG_DFL); 220#ifdef DEBUG 221 { int t = open(_PATH_TTY, 2); 222 if (t >= 0) { 223 ioctl(t, TIOCNOTTY, (char *)0); 224 (void) close(t); 225 } 226 } 227#endif 228 fromp->sin_port = ntohs((u_short)fromp->sin_port); 229 if (fromp->sin_family != AF_INET) { 230 syslog(LOG_ERR, "malformed \"from\" address (af %d)\n", 231 fromp->sin_family); 232 exit(1); 233 } 234#ifdef IP_OPTIONS 235 { 236 u_char optbuf[BUFSIZ/3], *cp; 237 char lbuf[BUFSIZ], *lp; 238 int optsize = sizeof(optbuf), ipproto; 239 struct protoent *ip; 240 241 if ((ip = getprotobyname("ip")) != NULL) 242 ipproto = ip->p_proto; 243 else 244 ipproto = IPPROTO_IP; 245 if (!getsockopt(0, ipproto, IP_OPTIONS, (char *)optbuf, &optsize) && 246 optsize != 0) { 247 lp = lbuf; 248 for (cp = optbuf; optsize > 0; cp++, optsize--, lp += 3) 249 sprintf(lp, " %2.2x", *cp); 250 syslog(LOG_NOTICE, 251 "Connection received from %s using IP options (ignored):%s", 252 inet_ntoa(fromp->sin_addr), lbuf); 253 if (setsockopt(0, ipproto, IP_OPTIONS, 254 (char *)NULL, optsize) != 0) { 255 syslog(LOG_ERR, "setsockopt IP_OPTIONS NULL: %m"); 256 exit(1); 257 } 258 } 259 } 260#endif 261 262#ifdef KERBEROS 263 if (!use_kerberos) 264#endif 265 if (fromp->sin_port >= IPPORT_RESERVED || 266 fromp->sin_port < IPPORT_RESERVED/2) { 267 syslog(LOG_NOTICE|LOG_AUTH, 268 "Connection from %s on illegal port %u", 269 inet_ntoa(fromp->sin_addr), 270 fromp->sin_port); 271 exit(1); 272 } 273 274 (void) alarm(60); 275 port = 0; 276 for (;;) { 277 char c; 278 if ((cc = read(STDIN_FILENO, &c, 1)) != 1) { 279 if (cc < 0) 280 syslog(LOG_NOTICE, "read: %m"); 281 shutdown(0, 1+1); 282 exit(1); 283 } 284 if (c== 0) 285 break; 286 port = port * 10 + c - '0'; 287 } 288 289 (void) alarm(0); 290 if (port != 0) { 291 int lport = IPPORT_RESERVED - 1; 292 s = rresvport(&lport); 293 if (s < 0) { 294 syslog(LOG_ERR, "can't get stderr port: %m"); 295 exit(1); 296 } 297#ifdef KERBEROS 298 if (!use_kerberos) 299#endif 300 if (port >= IPPORT_RESERVED) { 301 syslog(LOG_ERR, "2nd port not reserved\n"); 302 exit(1); 303 } 304 fromp->sin_port = htons(port); 305 if (connect(s, (struct sockaddr *)fromp, sizeof (*fromp)) < 0) { 306 syslog(LOG_INFO, "connect second port %d: %m", port); 307 exit(1); 308 } 309 } 310 311#ifdef KERBEROS 312 if (vacuous) { 313 error("rshd: remote host requires Kerberos authentication\n"); 314 exit(1); 315 } 316#endif 317 318#ifdef notdef 319 /* from inetd, socket is already on 0, 1, 2 */ 320 dup2(f, 0); 321 dup2(f, 1); 322 dup2(f, 2); 323#endif 324 errorstr = NULL; 325 hp = gethostbyaddr((char *)&fromp->sin_addr, sizeof (struct in_addr), 326 fromp->sin_family); 327 if (hp) { 328 /* 329 * If name returned by gethostbyaddr is in our domain, 330 * attempt to verify that we haven't been fooled by someone 331 * in a remote net; look up the name and check that this 332 * address corresponds to the name. 333 */ 334 hostname = hp->h_name; 335#ifdef KERBEROS 336 if (!use_kerberos) 337#endif 338 if (check_all || local_domain(hp->h_name)) { 339 strncpy(remotehost, hp->h_name, sizeof(remotehost) - 1); 340 remotehost[sizeof(remotehost) - 1] = 0; 341 errorhost = remotehost; 342 hp = gethostbyname(remotehost); 343 if (hp == NULL) { 344 syslog(LOG_INFO, 345 "Couldn't look up address for %s", 346 remotehost); 347 errorstr = 348 "Couldn't look up address for your host (%s)\n"; 349 hostname = inet_ntoa(fromp->sin_addr); 350 } else for (; ; hp->h_addr_list++) { 351 if (hp->h_addr_list[0] == NULL) { 352 syslog(LOG_NOTICE, 353 "Host addr %s not listed for host %s", 354 inet_ntoa(fromp->sin_addr), 355 hp->h_name); 356 errorstr = 357 "Host address mismatch for %s\n"; 358 hostname = inet_ntoa(fromp->sin_addr); 359 break; 360 } 361 if (!bcmp(hp->h_addr_list[0], 362 (caddr_t)&fromp->sin_addr, 363 sizeof(fromp->sin_addr))) { 364 hostname = hp->h_name; 365 break; 366 } 367 } 368 } 369 } else 370 errorhost = hostname = inet_ntoa(fromp->sin_addr); 371 372#ifdef KERBEROS 373 if (use_kerberos) { 374 kdata = (AUTH_DAT *) authbuf; 375 ticket = (KTEXT) tickbuf; 376 authopts = 0L; 377 strcpy(instance, "*"); 378 version[VERSION_SIZE - 1] = '\0'; 379#ifdef CRYPT 380 if (doencrypt) { 381 struct sockaddr_in local_addr; 382 rc = sizeof(local_addr); 383 if (getsockname(0, (struct sockaddr *)&local_addr, 384 &rc) < 0) { 385 syslog(LOG_ERR, "getsockname: %m"); 386 error("rlogind: getsockname: %m"); 387 exit(1); 388 } 389 authopts = KOPT_DO_MUTUAL; 390 rc = krb_recvauth(authopts, 0, ticket, 391 "rcmd", instance, &fromaddr, 392 &local_addr, kdata, "", schedule, 393 version); 394 des_set_key(kdata->session, schedule); 395 } else 396#endif 397 rc = krb_recvauth(authopts, 0, ticket, "rcmd", 398 instance, &fromaddr, 399 (struct sockaddr_in *) 0, 400 kdata, "", (bit_64 *) 0, version); 401 if (rc != KSUCCESS) { 402 error("Kerberos authentication failure: %s\n", 403 krb_err_txt[rc]); 404 exit(1); 405 } 406 } else 407#endif 408 getstr(remuser, sizeof(remuser), "remuser"); 409 410 getstr(locuser, sizeof(locuser), "locuser"); 411 getstr(cmdbuf, sizeof(cmdbuf), "command"); 412 setpwent(); 413 pwd = getpwnam(locuser); 414 if (pwd == NULL) { 415 syslog(LOG_INFO|LOG_AUTH, 416 "%s@%s as %s: unknown login. cmd='%.80s'", 417 remuser, hostname, locuser, cmdbuf); 418 if (errorstr == NULL) 419 errorstr = "Login incorrect.\n"; 420 goto fail; 421 } 422 if (chdir(pwd->pw_dir) < 0) { 423 (void) chdir("/"); 424#ifdef notdef 425 syslog(LOG_INFO|LOG_AUTH, 426 "%s@%s as %s: no home directory. cmd='%.80s'", 427 remuser, hostname, locuser, cmdbuf); 428 error("No remote directory.\n"); 429 exit(1); 430#endif 431 } 432 433#ifdef KERBEROS 434 if (use_kerberos) { 435 if (pwd->pw_passwd != 0 && *pwd->pw_passwd != '\0') { 436 if (kuserok(kdata, locuser) != 0) { 437 syslog(LOG_INFO|LOG_AUTH, 438 "Kerberos rsh denied to %s.%s@%s", 439 kdata->pname, kdata->pinst, kdata->prealm); 440 error("Permission denied.\n"); 441 exit(1); 442 } 443 } 444 } else 445#endif 446 447 if (errorstr || 448 (pwd->pw_expire && time(NULL) >= pwd->pw_expire) || 449 (pwd->pw_passwd != 0 && *pwd->pw_passwd != '\0' && 450 iruserok(fromp->sin_addr.s_addr, pwd->pw_uid == 0, 451 remuser, locuser) < 0)) { 452 if (__rcmd_errstr) 453 syslog(LOG_INFO|LOG_AUTH, 454 "%s@%s as %s: permission denied (%s). cmd='%.80s'", 455 remuser, hostname, locuser, __rcmd_errstr, 456 cmdbuf); 457 else 458 syslog(LOG_INFO|LOG_AUTH, 459 "%s@%s as %s: permission denied. cmd='%.80s'", 460 remuser, hostname, locuser, cmdbuf); 461fail: 462 if (errorstr == NULL) 463 errorstr = "Permission denied.\n"; 464 error(errorstr, errorhost); 465 exit(1); 466 } 467 468 if (pwd->pw_uid && !access(_PATH_NOLOGIN, F_OK)) { 469 error("Logins currently disabled.\n"); 470 exit(1); 471 } 472#if BSD > 43 473 /* before fork, while we're session leader */ 474 if (setlogin(pwd->pw_name) < 0) 475 syslog(LOG_ERR, "setlogin() failed: %m"); 476#endif 477 478 (void) write(STDERR_FILENO, "\0", 1); 479 sent_null = 1; 480 481 if (port) { 482 if (pipe(pv) < 0) { 483 error("Can't make pipe.\n"); 484 exit(1); 485 } 486#ifdef CRYPT 487#ifdef KERBEROS 488 if (doencrypt) { 489 if (pipe(pv1) < 0) { 490 error("Can't make 2nd pipe.\n"); 491 exit(1); 492 } 493 if (pipe(pv2) < 0) { 494 error("Can't make 3rd pipe.\n"); 495 exit(1); 496 } 497 } 498#endif 499#endif 500 pid = fork(); 501 if (pid == -1) { 502 error("Can't fork; try again.\n"); 503 exit(1); 504 } 505 if (pid) { 506#ifdef CRYPT 507#ifdef KERBEROS 508 if (doencrypt) { 509 static char msg[] = SECURE_MESSAGE; 510 (void) close(pv1[1]); 511 (void) close(pv2[1]); 512 des_write(s, msg, sizeof(msg) - 1); 513 514 } else 515#endif 516#endif 517 { 518 (void) close(0); 519 (void) close(1); 520 } 521 (void) close(2); 522 (void) close(pv[1]); 523 524 FD_ZERO(&readfrom); 525 FD_SET(s, &readfrom); 526 FD_SET(pv[0], &readfrom); 527 if (pv[0] > s) 528 nfd = pv[0]; 529 else 530 nfd = s; 531#ifdef CRYPT 532#ifdef KERBEROS 533 if (doencrypt) { 534 FD_ZERO(&writeto); 535 FD_SET(pv2[0], &writeto); 536 FD_SET(pv1[0], &readfrom); 537 538 nfd = MAX(nfd, pv2[0]); 539 nfd = MAX(nfd, pv1[0]); 540 } else 541#endif 542#endif 543 ioctl(pv[0], FIONBIO, (char *)&one); 544 545 /* should set s nbio! */ 546 nfd++; 547 do { 548 ready = readfrom; 549#ifdef CRYPT 550#ifdef KERBEROS 551 if (doencrypt) { 552 wready = writeto; 553 if (select(nfd, &ready, 554 &wready, (fd_set *) 0, 555 (struct timeval *) 0) < 0) 556 break; 557 } else 558#endif 559#endif 560 if (select(nfd, &ready, (fd_set *)0, 561 (fd_set *)0, (struct timeval *)0) < 0) 562 break; 563 if (FD_ISSET(s, &ready)) { 564 int ret; 565#ifdef CRYPT 566#ifdef KERBEROS 567 if (doencrypt) 568 ret = des_read(s, &sig, 1); 569 else 570#endif 571#endif 572 ret = read(s, &sig, 1); 573 if (ret <= 0) 574 FD_CLR(s, &readfrom); 575 else 576 killpg(pid, sig); 577 } 578 if (FD_ISSET(pv[0], &ready)) { 579 errno = 0; 580 cc = read(pv[0], buf, sizeof(buf)); 581 if (cc <= 0) { 582 shutdown(s, 1+1); 583 FD_CLR(pv[0], &readfrom); 584 } else { 585#ifdef CRYPT 586#ifdef KERBEROS 587 if (doencrypt) 588 (void) 589 des_write(s, buf, cc); 590 else 591#endif 592#endif 593 (void) 594 write(s, buf, cc); 595 } 596 } 597#ifdef CRYPT 598#ifdef KERBEROS 599 if (doencrypt && FD_ISSET(pv1[0], &ready)) { 600 errno = 0; 601 cc = read(pv1[0], buf, sizeof(buf)); 602 if (cc <= 0) { 603 shutdown(pv1[0], 1+1); 604 FD_CLR(pv1[0], &readfrom); 605 } else 606 (void) des_write(STDOUT_FILENO, 607 buf, cc); 608 } 609 610 if (doencrypt && FD_ISSET(pv2[0], &wready)) { 611 errno = 0; 612 cc = des_read(STDIN_FILENO, 613 buf, sizeof(buf)); 614 if (cc <= 0) { 615 shutdown(pv2[0], 1+1); 616 FD_CLR(pv2[0], &writeto); 617 } else 618 (void) write(pv2[0], buf, cc); 619 } 620#endif 621#endif 622 623 } while (FD_ISSET(s, &readfrom) || 624#ifdef CRYPT 625#ifdef KERBEROS 626 (doencrypt && FD_ISSET(pv1[0], &readfrom)) || 627#endif 628#endif 629 FD_ISSET(pv[0], &readfrom)); 630 exit(0); 631 } 632 setpgrp(0, getpid()); 633 (void) close(s); 634 (void) close(pv[0]); 635#ifdef CRYPT 636#ifdef KERBEROS 637 if (doencrypt) { 638 close(pv1[0]); close(pv2[0]); 639 dup2(pv1[1], 1); 640 dup2(pv2[1], 0); 641 close(pv1[1]); 642 close(pv2[1]); 643 } 644#endif 645#endif 646 dup2(pv[1], 2); 647 close(pv[1]); 648 } 649 if (*pwd->pw_shell == '\0') 650 pwd->pw_shell = _PATH_BSHELL; 651 (void) setgid((gid_t)pwd->pw_gid); 652 initgroups(pwd->pw_name, pwd->pw_gid); 653 (void) setuid((uid_t)pwd->pw_uid); 654 environ = envinit; 655 strncat(homedir, pwd->pw_dir, sizeof(homedir)-6); 656 strcat(path, _PATH_DEFPATH); 657 strncat(shell, pwd->pw_shell, sizeof(shell)-7); 658 strncat(username, pwd->pw_name, sizeof(username)-6); 659 cp = strrchr(pwd->pw_shell, '/'); 660 if (cp) 661 cp++; 662 else 663 cp = pwd->pw_shell; 664 endpwent(); 665 if (log_success || pwd->pw_uid == 0) { 666#ifdef KERBEROS 667 if (use_kerberos) 668 syslog(LOG_INFO|LOG_AUTH, 669 "Kerberos shell from %s.%s@%s on %s as %s, cmd='%.80s'", 670 kdata->pname, kdata->pinst, kdata->prealm, 671 hostname, locuser, cmdbuf); 672 else 673#endif 674 syslog(LOG_INFO|LOG_AUTH, "%s@%s as %s: cmd='%.80s'", 675 remuser, hostname, locuser, cmdbuf); 676 } 677 execl(pwd->pw_shell, cp, "-c", cmdbuf, 0); 678 perror(pwd->pw_shell); 679 exit(1); 680} 681 682/* 683 * Report error to client. Note: can't be used until second socket has 684 * connected to client, or older clients will hang waiting for that 685 * connection first. 686 */ 687#if __STDC__ 688#include <stdarg.h> 689#else 690#include <varargs.h> 691#endif 692 693void 694#if __STDC__ 695error(const char *fmt, ...) 696#else 697error(fmt, va_alist) 698 char *fmt; 699 va_dcl 700#endif 701{ 702 va_list ap; 703 int len; 704 char *bp, buf[BUFSIZ]; 705#if __STDC__ 706 va_start(ap, fmt); 707#else 708 va_start(ap); 709#endif 710 bp = buf; 711 if (sent_null == 0) { 712 *bp++ = 1; 713 len = 1; 714 } else 715 len = 0; 716 (void)vsnprintf(bp, sizeof(buf) - 1, fmt, ap); 717 (void)write(STDERR_FILENO, buf, len + strlen(bp)); 718} 719 720void 721getstr(buf, cnt, err) 722 char *buf, *err; 723 int cnt; 724{ 725 char c; 726 727 do { 728 if (read(STDIN_FILENO, &c, 1) != 1) 729 exit(1); 730 *buf++ = c; 731 if (--cnt == 0) { 732 error("%s too long\n", err); 733 exit(1); 734 } 735 } while (c != 0); 736} 737 738/* 739 * Check whether host h is in our local domain, 740 * defined as sharing the last two components of the domain part, 741 * or the entire domain part if the local domain has only one component. 742 * If either name is unqualified (contains no '.'), 743 * assume that the host is local, as it will be 744 * interpreted as such. 745 */ 746int 747local_domain(h) 748 char *h; 749{ 750 char localhost[MAXHOSTNAMELEN]; 751 char *p1, *p2; 752 753 localhost[0] = 0; 754 (void) gethostname(localhost, sizeof(localhost)); 755 p1 = topdomain(localhost); 756 p2 = topdomain(h); 757 if (p1 == NULL || p2 == NULL || !strcasecmp(p1, p2)) 758 return (1); 759 return (0); 760} 761 762char * 763topdomain(h) 764 char *h; 765{ 766 char *p, *maybe = NULL; 767 int dots = 0; 768 769 for (p = h + strlen(h); p >= h; p--) { 770 if (*p == '.') { 771 if (++dots == 2) 772 return (p); 773 maybe = p; 774 } 775 } 776 return (maybe); 777} 778 779void 780usage() 781{ 782 783 syslog(LOG_ERR, "usage: rshd [-%s]", OPTIONS); 784 exit(2); 785} 786