Add new Linux 3.16 constants to netinet/udp.h.
[glibc.git] / inet / rcmd.c
blobacacaa0d8a78cd256589f3eed24690e2e8f1c03b
1 /*
2 * Copyright (C) 1998 WIDE Project.
3 * All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of the project nor the names of its contributors
14 * may be used to endorse or promote products derived from this software
15 * without specific prior written permission.
17 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
30 * Copyright (c) 1983, 1993, 1994
31 * The Regents of the University of California. All rights reserved.
33 * Redistribution and use in source and binary forms, with or without
34 * modification, are permitted provided that the following conditions
35 * are met:
36 * 1. Redistributions of source code must retain the above copyright
37 * notice, this list of conditions and the following disclaimer.
38 * 2. Redistributions in binary form must reproduce the above copyright
39 * notice, this list of conditions and the following disclaimer in the
40 * documentation and/or other materials provided with the distribution.
41 * 4. Neither the name of the University nor the names of its contributors
42 * may be used to endorse or promote products derived from this software
43 * without specific prior written permission.
45 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
46 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
47 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
48 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
49 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
50 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
51 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
52 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
53 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
54 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
55 * SUCH DAMAGE.
58 #if defined(LIBC_SCCS) && !defined(lint)
59 static char sccsid[] = "@(#)rcmd.c 8.3 (Berkeley) 3/26/94";
60 #endif /* LIBC_SCCS and not lint */
62 #include <sys/param.h>
63 #include <sys/poll.h>
64 #include <sys/socket.h>
65 #include <sys/stat.h>
67 #include <netinet/in.h>
68 #include <arpa/inet.h>
70 #include <alloca.h>
71 #include <signal.h>
72 #include <fcntl.h>
73 #include <netdb.h>
74 #include <unistd.h>
75 #include <pwd.h>
76 #include <errno.h>
77 #include <stdio.h>
78 #include <stdio_ext.h>
79 #include <ctype.h>
80 #include <string.h>
81 #include <libintl.h>
82 #include <stdlib.h>
83 #include <wchar.h>
84 #include <sys/uio.h>
87 int __ivaliduser (FILE *, u_int32_t, const char *, const char *);
88 static int __validuser2_sa (FILE *, struct sockaddr *, size_t,
89 const char *, const char *, const char *);
90 static int ruserok2_sa (struct sockaddr *ra, size_t ralen,
91 int superuser, const char *ruser,
92 const char *luser, const char *rhost);
93 static int ruserok_sa (struct sockaddr *ra, size_t ralen,
94 int superuser, const char *ruser,
95 const char *luser);
96 int iruserok_af (const void *raddr, int superuser, const char *ruser,
97 const char *luser, sa_family_t af);
98 int iruserok (u_int32_t raddr, int superuser, const char *ruser,
99 const char *luser);
101 libc_hidden_proto (iruserok_af)
103 libc_freeres_ptr(static char *ahostbuf);
106 rcmd_af(ahost, rport, locuser, remuser, cmd, fd2p, af)
107 char **ahost;
108 u_short rport;
109 const char *locuser, *remuser, *cmd;
110 int *fd2p;
111 sa_family_t af;
113 char paddr[INET6_ADDRSTRLEN];
114 struct addrinfo hints, *res, *ai;
115 union
117 struct sockaddr sa;
118 struct sockaddr_storage ss;
119 struct sockaddr_in sin;
120 struct sockaddr_in6 sin6;
121 } from;
122 struct pollfd pfd[2];
123 int32_t oldmask;
124 pid_t pid;
125 int s, lport, timo, error;
126 char c;
127 int refused;
128 char num[8];
129 ssize_t n;
131 if (af != AF_INET && af != AF_INET6 && af != AF_UNSPEC)
133 __set_errno (EAFNOSUPPORT);
134 return -1;
137 pid = __getpid();
139 memset(&hints, '\0', sizeof(hints));
140 hints.ai_flags = AI_CANONNAME;
141 hints.ai_family = af;
142 hints.ai_socktype = SOCK_STREAM;
143 (void)__snprintf(num, sizeof(num), "%d", ntohs(rport));
144 error = getaddrinfo(*ahost, num, &hints, &res);
145 if (error) {
146 if (error == EAI_NONAME && *ahost != NULL)
147 __fxprintf(NULL, "%s: Unknown host\n", *ahost);
148 else
149 __fxprintf(NULL, "rcmd: getaddrinfo: %s\n",
150 gai_strerror(error));
152 return -1;
155 pfd[0].events = POLLIN;
156 pfd[1].events = POLLIN;
158 if (res->ai_canonname){
159 free (ahostbuf);
160 ahostbuf = strdup (res->ai_canonname);
161 if (ahostbuf == NULL) {
162 __fxprintf(NULL, "%s",
163 _("rcmd: Cannot allocate memory\n"));
164 return -1;
166 *ahost = ahostbuf;
167 } else
168 *ahost = NULL;
169 ai = res;
170 refused = 0;
171 oldmask = __sigblock(sigmask(SIGURG));
172 for (timo = 1, lport = IPPORT_RESERVED - 1;;) {
173 char errbuf[200];
175 s = rresvport_af(&lport, ai->ai_family);
176 if (s < 0) {
177 if (errno == EAGAIN)
178 __fxprintf(NULL, "%s", _("\
179 rcmd: socket: All ports in use\n"));
180 else
181 __fxprintf(NULL, "rcmd: socket: %m\n");
183 __sigsetmask(oldmask);
184 freeaddrinfo(res);
185 return -1;
187 __fcntl(s, F_SETOWN, pid);
188 if (__connect(s, ai->ai_addr, ai->ai_addrlen) >= 0)
189 break;
190 (void)__close(s);
191 if (errno == EADDRINUSE) {
192 lport--;
193 continue;
195 if (errno == ECONNREFUSED)
196 refused = 1;
197 if (ai->ai_next != NULL) {
198 int oerrno = errno;
199 char *buf = NULL;
201 getnameinfo(ai->ai_addr, ai->ai_addrlen,
202 paddr, sizeof(paddr),
203 NULL, 0,
204 NI_NUMERICHOST);
206 if (__asprintf (&buf, _("connect to address %s: "),
207 paddr) >= 0)
209 __fxprintf(NULL, "%s", buf);
210 free (buf);
212 __set_errno (oerrno);
213 perror(0);
214 ai = ai->ai_next;
215 getnameinfo(ai->ai_addr, ai->ai_addrlen,
216 paddr, sizeof(paddr),
217 NULL, 0,
218 NI_NUMERICHOST);
219 if (__asprintf (&buf, _("Trying %s...\n"), paddr) >= 0)
221 __fxprintf (NULL, "%s", buf);
222 free (buf);
224 continue;
226 if (refused && timo <= 16) {
227 (void)__sleep(timo);
228 timo *= 2;
229 ai = res;
230 refused = 0;
231 continue;
233 freeaddrinfo(res);
234 (void)__fxprintf(NULL, "%s: %s\n", *ahost,
235 __strerror_r(errno, errbuf, sizeof (errbuf)));
236 __sigsetmask(oldmask);
237 return -1;
239 lport--;
240 if (fd2p == 0) {
241 __write(s, "", 1);
242 lport = 0;
243 } else {
244 char num[8];
245 int s2 = rresvport_af(&lport, ai->ai_family), s3;
246 socklen_t len = ai->ai_addrlen;
248 if (s2 < 0)
249 goto bad;
250 __listen(s2, 1);
251 (void)__snprintf(num, sizeof(num), "%d", lport);
252 if (__write(s, num, strlen(num)+1) != (ssize_t)strlen(num)+1) {
253 char *buf = NULL;
255 if (__asprintf (&buf, _("\
256 rcmd: write (setting up stderr): %m\n")) >= 0)
258 __fxprintf(NULL, "%s", buf);
259 free (buf);
261 (void)__close(s2);
262 goto bad;
264 pfd[0].fd = s;
265 pfd[1].fd = s2;
266 __set_errno (0);
267 if (__poll (pfd, 2, -1) < 1 || (pfd[1].revents & POLLIN) == 0){
268 char *buf = NULL;
270 if ((errno != 0
271 && __asprintf(&buf, _("\
272 rcmd: poll (setting up stderr): %m\n")) >= 0)
273 || (errno == 0
274 && __asprintf(&buf, _("\
275 poll: protocol failure in circuit setup\n")) >= 0))
277 __fxprintf (NULL, "%s", buf);
278 free (buf);
280 (void)__close(s2);
281 goto bad;
283 s3 = TEMP_FAILURE_RETRY (accept(s2, &from.sa, &len));
284 switch (from.sa.sa_family) {
285 case AF_INET:
286 rport = ntohs(from.sin.sin_port);
287 break;
288 case AF_INET6:
289 rport = ntohs(from.sin6.sin6_port);
290 break;
291 default:
292 rport = 0;
293 break;
295 (void)__close(s2);
296 if (s3 < 0) {
297 (void)__fxprintf(NULL, "rcmd: accept: %m\n");
298 lport = 0;
299 goto bad;
301 *fd2p = s3;
303 if (rport >= IPPORT_RESERVED || rport < IPPORT_RESERVED / 2){
304 char *buf = NULL;
306 if (__asprintf(&buf, _("\
307 socket: protocol failure in circuit setup\n")) >= 0)
309 __fxprintf (NULL, "%s", buf);
310 free (buf);
312 goto bad2;
315 struct iovec iov[3] =
317 [0] = { .iov_base = (void *) locuser,
318 .iov_len = strlen (locuser) + 1 },
319 [1] = { .iov_base = (void *) remuser,
320 .iov_len = strlen (remuser) + 1 },
321 [2] = { .iov_base = (void *) cmd,
322 .iov_len = strlen (cmd) + 1 }
324 (void) TEMP_FAILURE_RETRY (__writev (s, iov, 3));
325 n = TEMP_FAILURE_RETRY (__read(s, &c, 1));
326 if (n != 1) {
327 char *buf = NULL;
329 if ((n == 0
330 && __asprintf(&buf, _("rcmd: %s: short read"),
331 *ahost) >= 0)
332 || (n != 0
333 && __asprintf(&buf, "rcmd: %s: %m\n", *ahost) >= 0))
335 __fxprintf (NULL, "%s", buf);
336 free (buf);
338 goto bad2;
340 if (c != 0) {
341 while (__read(s, &c, 1) == 1) {
342 (void)__write(STDERR_FILENO, &c, 1);
343 if (c == '\n')
344 break;
346 goto bad2;
348 __sigsetmask(oldmask);
349 freeaddrinfo(res);
350 return s;
351 bad2:
352 if (lport)
353 (void)__close(*fd2p);
354 bad:
355 (void)__close(s);
356 __sigsetmask(oldmask);
357 freeaddrinfo(res);
358 return -1;
360 libc_hidden_def (rcmd_af)
363 rcmd(ahost, rport, locuser, remuser, cmd, fd2p)
364 char **ahost;
365 u_short rport;
366 const char *locuser, *remuser, *cmd;
367 int *fd2p;
369 return rcmd_af (ahost, rport, locuser, remuser, cmd, fd2p, AF_INET);
373 rresvport_af(alport, family)
374 int *alport;
375 sa_family_t family;
377 struct sockaddr_storage ss;
378 int s;
379 size_t len;
380 uint16_t *sport;
382 switch(family){
383 case AF_INET:
384 len = sizeof(struct sockaddr_in);
385 sport = &((struct sockaddr_in *)&ss)->sin_port;
386 break;
387 case AF_INET6:
388 len = sizeof(struct sockaddr_in6);
389 sport = &((struct sockaddr_in6 *)&ss)->sin6_port;
390 break;
391 default:
392 __set_errno (EAFNOSUPPORT);
393 return -1;
395 s = __socket(family, SOCK_STREAM, 0);
396 if (s < 0)
397 return -1;
399 memset (&ss, '\0', sizeof(ss));
400 #ifdef SALEN
401 ss.__ss_len = len;
402 #endif
403 ss.ss_family = family;
405 /* Ignore invalid values. */
406 if (*alport < IPPORT_RESERVED / 2)
407 *alport = IPPORT_RESERVED / 2;
408 else if (*alport >= IPPORT_RESERVED)
409 *alport = IPPORT_RESERVED - 1;
411 int start = *alport;
412 do {
413 *sport = htons((uint16_t) *alport);
414 if (__bind(s, (struct sockaddr *)&ss, len) >= 0)
415 return s;
416 if (errno != EADDRINUSE) {
417 (void)__close(s);
418 return -1;
420 if ((*alport)-- == IPPORT_RESERVED/2)
421 *alport = IPPORT_RESERVED - 1;
422 } while (*alport != start);
423 (void)__close(s);
424 __set_errno (EAGAIN);
425 return -1;
427 libc_hidden_def (rresvport_af)
430 rresvport(alport)
431 int *alport;
433 return rresvport_af(alport, AF_INET);
436 int __check_rhosts_file = 1;
437 char *__rcmd_errstr;
440 ruserok_af(rhost, superuser, ruser, luser, af)
441 const char *rhost, *ruser, *luser;
442 int superuser;
443 sa_family_t af;
445 struct addrinfo hints, *res, *res0;
446 int gai;
447 int ret;
449 memset (&hints, '\0', sizeof(hints));
450 hints.ai_family = af;
451 gai = getaddrinfo(rhost, NULL, &hints, &res0);
452 if (gai)
453 return -1;
454 ret = -1;
455 for (res=res0; res; res=res->ai_next)
456 if (ruserok2_sa(res->ai_addr, res->ai_addrlen,
457 superuser, ruser, luser, rhost) == 0){
458 ret = 0;
459 break;
461 freeaddrinfo(res0);
462 return (ret);
464 libc_hidden_def (ruserok_af)
467 ruserok(rhost, superuser, ruser, luser)
468 const char *rhost, *ruser, *luser;
469 int superuser;
471 return ruserok_af(rhost, superuser, ruser, luser, AF_INET);
474 /* Extremely paranoid file open function. */
475 static FILE *
476 iruserfopen (const char *file, uid_t okuser)
478 struct stat64 st;
479 char *cp = NULL;
480 FILE *res = NULL;
482 /* If not a regular file, if owned by someone other than user or
483 root, if writeable by anyone but the owner, or if hardlinked
484 anywhere, quit. */
485 if (__lxstat64 (_STAT_VER, file, &st))
486 cp = _("lstat failed");
487 else if (!S_ISREG (st.st_mode))
488 cp = _("not regular file");
489 else
491 res = fopen (file, "rce");
492 if (!res)
493 cp = _("cannot open");
494 else if (__fxstat64 (_STAT_VER, fileno (res), &st) < 0)
495 cp = _("fstat failed");
496 else if (st.st_uid && st.st_uid != okuser)
497 cp = _("bad owner");
498 else if (st.st_mode & (S_IWGRP|S_IWOTH))
499 cp = _("writeable by other than owner");
500 else if (st.st_nlink > 1)
501 cp = _("hard linked somewhere");
504 /* If there were any problems, quit. */
505 if (cp != NULL)
507 __rcmd_errstr = cp;
508 if (res)
509 fclose (res);
510 return NULL;
513 /* No threads use this stream. */
514 __fsetlocking (res, FSETLOCKING_BYCALLER);
516 return res;
520 * New .rhosts strategy: We are passed an ip address. We spin through
521 * hosts.equiv and .rhosts looking for a match. When the .rhosts only
522 * has ip addresses, we don't have to trust a nameserver. When it
523 * contains hostnames, we spin through the list of addresses the nameserver
524 * gives us and look for a match.
526 * Returns 0 if ok, -1 if not ok.
528 static int
529 ruserok2_sa (ra, ralen, superuser, ruser, luser, rhost)
530 struct sockaddr *ra;
531 size_t ralen;
532 int superuser;
533 const char *ruser, *luser, *rhost;
535 FILE *hostf = NULL;
536 int isbad = -1;
538 if (!superuser)
539 hostf = iruserfopen (_PATH_HEQUIV, 0);
541 if (hostf)
543 isbad = __validuser2_sa (hostf, ra, ralen, luser, ruser, rhost);
544 fclose (hostf);
546 if (!isbad)
547 return 0;
550 if (__check_rhosts_file || superuser)
552 char *pbuf;
553 struct passwd pwdbuf, *pwd;
554 size_t dirlen;
555 size_t buflen = __sysconf (_SC_GETPW_R_SIZE_MAX);
556 char *buffer = __alloca (buflen);
557 uid_t uid;
559 if (__getpwnam_r (luser, &pwdbuf, buffer, buflen, &pwd) != 0
560 || pwd == NULL)
561 return -1;
563 dirlen = strlen (pwd->pw_dir);
564 pbuf = alloca (dirlen + sizeof "/.rhosts");
565 __mempcpy (__mempcpy (pbuf, pwd->pw_dir, dirlen),
566 "/.rhosts", sizeof "/.rhosts");
568 /* Change effective uid while reading .rhosts. If root and
569 reading an NFS mounted file system, can't read files that
570 are protected read/write owner only. */
571 uid = __geteuid ();
572 seteuid (pwd->pw_uid);
573 hostf = iruserfopen (pbuf, pwd->pw_uid);
575 if (hostf != NULL)
577 isbad = __validuser2_sa (hostf, ra, ralen, luser, ruser, rhost);
578 fclose (hostf);
581 seteuid (uid);
582 return isbad;
584 return -1;
587 * ruserok_sa() is now discussed on ipng, so
588 * currently disabled for external use
590 static int ruserok_sa(ra, ralen, superuser, ruser, luser)
591 struct sockaddr *ra;
592 size_t ralen;
593 int superuser;
594 const char *ruser, *luser;
596 return ruserok2_sa(ra, ralen, superuser, ruser, luser, "-");
599 /* This is the exported version. */
601 iruserok_af (raddr, superuser, ruser, luser, af)
602 const void *raddr;
603 int superuser;
604 const char *ruser, *luser;
605 sa_family_t af;
607 struct sockaddr_storage ra;
608 size_t ralen;
610 memset (&ra, '\0', sizeof(ra));
611 switch (af){
612 case AF_INET:
613 ra.ss_family = AF_INET;
614 memcpy (&(((struct sockaddr_in *)&ra)->sin_addr), raddr,
615 sizeof(struct in_addr));
616 ralen = sizeof(struct sockaddr_in);
617 break;
618 case AF_INET6:
619 ra.ss_family = AF_INET6;
620 memcpy (&(((struct sockaddr_in6 *)&ra)->sin6_addr), raddr,
621 sizeof(struct in6_addr));
622 ralen = sizeof(struct sockaddr_in6);
623 break;
624 default:
625 return 0;
627 return ruserok_sa ((struct sockaddr *)&ra, ralen, superuser, ruser, luser);
629 libc_hidden_def (iruserok_af)
632 iruserok (raddr, superuser, ruser, luser)
633 u_int32_t raddr;
634 int superuser;
635 const char *ruser, *luser;
637 return iruserok_af (&raddr, superuser, ruser, luser, AF_INET);
641 * XXX
642 * Don't make static, used by lpd(8).
644 * This function is not used anymore. It is only present because lpd(8)
645 * calls it (!?!). We simply call __invaliduser2() with an illegal rhost
646 * argument. This means that netgroups won't work in .rhost/hosts.equiv
647 * files. If you want lpd to work with netgroups, fix lpd to use ruserok()
648 * or PAM.
649 * Returns 0 if ok, -1 if not ok.
652 __ivaliduser(hostf, raddr, luser, ruser)
653 FILE *hostf;
654 u_int32_t raddr;
655 const char *luser, *ruser;
657 struct sockaddr_in ra;
658 memset(&ra, '\0', sizeof(ra));
659 ra.sin_family = AF_INET;
660 ra.sin_addr.s_addr = raddr;
661 return __validuser2_sa(hostf, (struct sockaddr *)&ra, sizeof(ra),
662 luser, ruser, "-");
666 /* Returns 1 on positive match, 0 on no match, -1 on negative match. */
667 static int
668 internal_function
669 __checkhost_sa (struct sockaddr *ra, size_t ralen, char *lhost,
670 const char *rhost)
672 struct addrinfo hints, *res0, *res;
673 char raddr[INET6_ADDRSTRLEN];
674 int match;
675 int negate=1; /* Multiply return with this to get -1 instead of 1 */
677 /* Check nis netgroup. */
678 if (strncmp ("+@", lhost, 2) == 0)
679 return innetgr (&lhost[2], rhost, NULL, NULL);
681 if (strncmp ("-@", lhost, 2) == 0)
682 return -innetgr (&lhost[2], rhost, NULL, NULL);
684 /* -host */
685 if (strncmp ("-", lhost,1) == 0) {
686 negate = -1;
687 lhost++;
688 } else if (strcmp ("+",lhost) == 0) {
689 return 1; /* asking for trouble, but ok.. */
692 /* Try for raw ip address first. */
693 /* XXX */
694 if (getnameinfo(ra, ralen,
695 raddr, sizeof(raddr), NULL, 0,
696 NI_NUMERICHOST) == 0
697 && strcmp(raddr, lhost) == 0)
698 return negate;
700 /* Better be a hostname. */
701 match = 0;
702 memset(&hints, '\0', sizeof(hints));
703 hints.ai_family = ra->sa_family;
704 if (getaddrinfo(lhost, NULL, &hints, &res0) == 0){
705 /* Spin through ip addresses. */
706 for (res = res0; res; res = res->ai_next)
708 if (res->ai_family == ra->sa_family
709 && !memcmp(res->ai_addr, ra, res->ai_addrlen))
711 match = 1;
712 break;
715 freeaddrinfo (res0);
717 return negate * match;
720 /* Returns 1 on positive match, 0 on no match, -1 on negative match. */
721 static int
722 internal_function
723 __icheckuser (const char *luser, const char *ruser)
726 luser is user entry from .rhosts/hosts.equiv file
727 ruser is user id on remote host
730 /* [-+]@netgroup */
731 if (strncmp ("+@", luser, 2) == 0)
732 return innetgr (&luser[2], NULL, ruser, NULL);
734 if (strncmp ("-@", luser,2) == 0)
735 return -innetgr (&luser[2], NULL, ruser, NULL);
737 /* -user */
738 if (strncmp ("-", luser, 1) == 0)
739 return -(strcmp (&luser[1], ruser) == 0);
741 /* + */
742 if (strcmp ("+", luser) == 0)
743 return 1;
745 /* simple string match */
746 return strcmp (ruser, luser) == 0;
750 * Returns 1 for blank lines (or only comment lines) and 0 otherwise
752 static int
753 __isempty (char *p)
755 while (*p && isspace (*p)) {
756 ++p;
759 return (*p == '\0' || *p == '#') ? 1 : 0 ;
763 * Returns 0 if positive match, -1 if _not_ ok.
765 static int
766 __validuser2_sa(hostf, ra, ralen, luser, ruser, rhost)
767 FILE *hostf;
768 struct sockaddr *ra;
769 size_t ralen;
770 const char *luser, *ruser, *rhost;
772 const char *user;
773 char *p;
774 int hcheck, ucheck;
775 char *buf = NULL;
776 size_t bufsize = 0;
777 int retval = -1;
779 while (__getline (&buf, &bufsize, hostf) > 0) {
780 buf[bufsize - 1] = '\0'; /* Make sure it's terminated. */
781 p = buf;
783 /* Skip empty or comment lines */
784 if (__isempty (p)) {
785 continue;
788 for (;*p && !isspace(*p); ++p) {
789 *p = _tolower (*p);
792 /* Next we want to find the permitted name for the remote user. */
793 if (*p == ' ' || *p == '\t') {
794 /* <nul> terminate hostname and skip spaces */
795 for (*p++='\0'; *p && isspace (*p); ++p);
797 user = p; /* this is the user's name */
798 while (*p && !isspace (*p))
799 ++p; /* find end of user's name */
800 } else
801 user = p;
803 *p = '\0'; /* <nul> terminate username (+host?) */
805 /* buf -> host(?) ; user -> username(?) */
807 /* First check host part */
808 hcheck = __checkhost_sa (ra, ralen, buf, rhost);
810 if (hcheck < 0)
811 break;
813 if (hcheck) {
814 /* Then check user part */
815 if (! (*user))
816 user = luser;
818 ucheck = __icheckuser (user, ruser);
820 /* Positive 'host user' match? */
821 if (ucheck > 0) {
822 retval = 0;
823 break;
826 /* Negative 'host -user' match? */
827 if (ucheck < 0)
828 break;
830 /* Neither, go on looking for match */
834 free (buf);
836 return retval;