/usr/src/usr.sbin/inetd/inetd.c

Bug Summary

File:	src/usr.sbin/inetd/inetd.c
Warning:	line 1561, column 3 Null pointer passed as 2nd argument to memory copy function
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name inetd.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.sbin/inetd/obj -resource-dir /usr/local/llvm16/lib/clang/16 -internal-isystem /usr/local/llvm16/lib/clang/16/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.sbin/inetd/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fno-jump-tables -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c /usr/src/usr.sbin/inetd/inetd.c
1/*	$OpenBSD: inetd.c,v 1.165 2023/09/03 22:01:00 bluhm Exp $	*/

3/*
* Copyright (c) 1983,1991 The Regents of the University of California.
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
* 3. Neither the name of the University nor the names of its contributors
*    may be used to endorse or promote products derived from this software
*    without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/

32/*
* Inetd - Internet super-server
*
* This program invokes all internet services as needed.
* connection-oriented services are invoked each time a
* connection is made, by creating a process.  This process
* is passed the connection as file descriptor 0 and is
* expected to do a getpeername to find out the source host
* and port.
*
* Datagram oriented services are invoked when a datagram
* arrives; a process is created and passed a pending message
* on file descriptor 0.  Datagram servers may either connect
* to their peer, freeing up the original socket for inetd
* to receive further messages on, or ``take over the socket'',
* processing all arriving datagrams and, eventually, timing
* out.	 The first type of server is said to be ``multi-threaded'';
* the second type of server ``single-threaded''.
*
* Inetd uses a configuration file which is read at startup
* and, possibly, at some later time in response to a hangup signal.
* The configuration file is ``free format'' with fields given in the
* order shown below.  Continuation lines for an entry must begin with
* a space or tab.  All fields must be present in each entry.
*
*	service name			must be in /etc/services
*	socket type			stream/dgram
*	protocol			must be in /etc/protocols
*	wait/nowait[.max]		single-threaded/multi-threaded, max #
*	user[.group] or user[:group]	user/group to run daemon as
*	server program			full path name
*	server program arguments	maximum of MAXARGS (20)
*
* For RPC services
*      service name/version            must be in /etc/rpc
*	socket type			stream/dgram
*	protocol			must be in /etc/protocols
*	wait/nowait[.max]		single-threaded/multi-threaded
*	user[.group] or user[:group]	user to run daemon as
*	server program			full path name
*	server program arguments	maximum of MAXARGS (20)
*
* For non-RPC services, the "service name" can be of the form
* hostaddress:servicename, in which case the hostaddress is used
* as the host portion of the address to listen on.  If hostaddress
* consists of a single `*' character, INADDR_ANY is used.
*
* A line can also consist of just
*      hostaddress:
* where hostaddress is as in the preceding paragraph.  Such a line must
* have no further fields; the specified hostaddress is remembered and
* used for all further lines that have no hostaddress specified,
* until the next such line (or EOF).  (This is why * is provided to
* allow explicit specification of INADDR_ANY.)  A line
*      *:
* is implicitly in effect at the beginning of the file.
*
* The hostaddress specifier may (and often will) contain dots;
* the service name must not.
*
* For RPC services, host-address specifiers are accepted and will
* work to some extent; however, because of limitations in the
* portmapper interface, it will not work to try to give more than
* one line for any given RPC service, even if the host-address
* specifiers are different.
*
* Comment lines are indicated by a `#' in column 1.
*/

101/*
* Here's the scoop concerning the user[.:]group feature:
*
* 1) set-group-option off.
*
*	a) user = root:	NO setuid() or setgid() is done
*
*	b) other:	setgid(primary group as found in passwd)
*			initgroups(name, primary group)
*			setuid()
*
* 2) set-group-option on.
*
*	a) user = root:	setgid(specified group)
*			NO initgroups()
*			NO setuid()
*
*	b) other:	setgid(specified group)
*			initgroups(name, specified group)
*			setuid()
*
*/

124#include <sys/stat.h>
125#include <sys/socket.h>
126#include <sys/un.h>
127#include <sys/wait.h>
128#include <sys/time.h>
129#include <sys/resource.h>

131#include <net/if.h>
132#include <netinet/in.h>
133#include <arpa/inet.h>

135#include <err.h>
136#include <errno(*__errno()).h>
137#include <ctype.h>
138#include <signal.h>
139#include <netdb.h>
140#include <syslog.h>
141#include <pwd.h>
142#include <grp.h>
143#include <stdio.h>
144#include <stdlib.h>
145#include <unistd.h>
146#include <limits.h>
147#include <string.h>
148#include <login_cap.h>
149#include <ifaddrs.h>
150#include <rpc/rpc.h>
151#include <rpc/pmap_clnt.h>
152#include <rpcsvc/nfs_prot.h>
153#include <event.h>
154#include "pathnames.h"

156#define MINIMUM(a, b)(((a) < (b)) ? (a) : (b))	(((a) < (b)) ? (a) : (b))

158#define	TOOMANY256		256		/* don't start more than TOOMANY */
159#define	CNT_INTVL60	60		/* servers in CNT_INTVL sec. */
160#define	RETRYTIME(60*10)	(60*10)		/* retry after bind or server fail */

162int	 debug = 0;
163int	 maxsock;
164int	 toomany = TOOMANY256;
165int	 timingout;
166struct	 servent *sp;
167uid_t	 uid;

169#ifndef OPEN_MAX64
170#define OPEN_MAX64	64
171#endif

173/* Reserve some descriptors, 3 stdio + at least: 1 log, 1 conf. file */
174#define FD_MARGIN(8)	(8)
175rlim_t	rlim_nofile_cur = OPEN_MAX64;

177struct rlimit	rlim_nofile;

179struct	servtab {
char	*se_hostaddr;		/* host address to listen on */
char	*se_service;		/* name of service */
int	se_socktype;		/* type of socket to use */
int	se_family;		/* address family */
char	*se_proto;		/* protocol used */
int	se_rpcprog;		/* rpc program number */
int	se_rpcversl;		/* rpc program lowest version */
int	se_rpcversh;		/* rpc program highest version */
188#define isrpcservice(sep)((sep)->se_rpcversl != 0)	((sep)->se_rpcversl != 0)
pid_t	se_wait;		/* single threaded server */
short	se_checked;		/* looked at during merge */
char	*se_user;		/* user name to run as */
char	*se_group;		/* group name to run as */
struct	biltin *se_bi;		/* if built-in, description */
char	*se_server;		/* server program */
195#define	MAXARGV20 20
char	*se_argv[MAXARGV20+1];	/* program arguments */
int	se_fd;			/* open descriptor */
union {
struct	sockaddr se_un_ctrladdr;
struct	sockaddr_in se_un_ctrladdr_in;
struct	sockaddr_in6 se_un_ctrladdr_in6;
struct	sockaddr_un se_un_ctrladdr_un;
struct	sockaddr_storage se_un_ctrladdr_storage;
} se_un;			/* bound address */
205#define se_ctrladdrse_un.se_un_ctrladdr	se_un.se_un_ctrladdr
206#define se_ctrladdr_inse_un.se_un_ctrladdr_in	se_un.se_un_ctrladdr_in
207#define se_ctrladdr_in6se_un.se_un_ctrladdr_in6	se_un.se_un_ctrladdr_in6
208#define se_ctrladdr_unse_un.se_un_ctrladdr_un	se_un.se_un_ctrladdr_un
209#define se_ctrladdr_storagese_un.se_un_ctrladdr_storage	se_un.se_un_ctrladdr_storage
int	se_ctrladdr_size;
int	se_max;			/* max # of instances of this service */
int	se_count;		/* number started since se_time */
struct	timeval se_time;	/* start of se_count */
struct	servtab *se_next;
struct	event se_event;
216} *servtab;

218void echo_stream(int, struct servtab *);
219void discard_stream(int, struct servtab *);
220void machtime_stream(int, struct servtab *);
221void daytime_stream(int, struct servtab *);
222void chargen_stream(int, struct servtab *);
223void echo_dg(int, struct servtab *);
224void discard_dg(int, struct servtab *);
225void machtime_dg(int, struct servtab *);
226void daytime_dg(int, struct servtab *);
227void chargen_dg(int, struct servtab *);

229struct biltin {
char	*bi_service;		/* internally provided service name */
int	bi_socktype;		/* type of socket supported */
short	bi_fork;		/* 1 if should fork before call */
short	bi_wait;		/* 1 if should wait for child */
void	(*bi_fn)(int, struct servtab *);
235} biltins[] = {
/* Echo received data */
{ "echo",	SOCK_STREAM1,	1, 0,	echo_stream },
{ "echo",	SOCK_DGRAM2,	0, 0,	echo_dg },

/* Internet /dev/null */
{ "discard",	SOCK_STREAM1,	1, 0,	discard_stream },
{ "discard",	SOCK_DGRAM2,	0, 0,	discard_dg },

/* Return 32 bit time since 1900 */
{ "time",	SOCK_STREAM1,	0, 0,	machtime_stream },
{ "time",	SOCK_DGRAM2,	0, 0,	machtime_dg },

/* Return human-readable time */
{ "daytime",	SOCK_STREAM1,	0, 0,	daytime_stream },
{ "daytime",	SOCK_DGRAM2,	0, 0,	daytime_dg },

/* Familiar character generator */
{ "chargen",	SOCK_STREAM1,	1, 0,	chargen_stream },
{ "chargen",	SOCK_DGRAM2,	0, 0,	chargen_dg },

{ 0 }
257};

259struct event evsig_alrm;
260struct event evsig_hup;
261struct event evsig_chld;
262struct event evsig_term;
263struct event evsig_int;

265void	config(int, short, void *);
266void	reap(int, short, void *);
267void	retry(int, short, void *);
268void	die(int, short, void *);

270void	spawn(int, short, void *);
271void	gettcp(int, short, void *);
272int	setconfig(void);
273void	endconfig(void);
274void	register_rpc(struct servtab *);
275void	unregister_rpc(struct servtab *);
276void	freeconfig(struct servtab *);
277void	print_service(char *, struct servtab *);
278void	setup(struct servtab *);
279struct servtab *getconfigent(void);
280int	bump_nofile(void);
281struct servtab *enter(struct servtab *);
282int	matchconf(struct servtab *, struct servtab *);
283int	dg_broadcast(struct in_addr *in);

285#define NUMINT(sizeof(intab) / sizeof(struct inent))	(sizeof(intab) / sizeof(struct inent))
286char	*CONFIG = _PATH_INETDCONF"/etc/inetd.conf";

288int		dg_badinput(struct sockaddr *sa);
289void		inetd_setproctitle(char *a, int s);
290void		initring(void);
291u_int32_t	machtime(void);

293int
294main(int argc, char *argv[])
295{
int ch;

while ((ch = getopt(argc, argv, "dR:")) != -1)
switch (ch) {
case 'd':
	debug = 1;
	break;
case 'R': {	/* invocation rate */
	char *p;
	int val;

	val = strtoul(optarg, &p, 0);
	if (val >= 1 && *p == '\0') {
		toomany = val;
		break;
	}
	syslog(LOG_ERR3,
	    "-R %s: bad value for service invocation rate",
	    optarg);
	break;
}
default:
	fprintf(stderr(&__sF[2]),
	    "usage: inetd [-d] [-R rate] [configuration_file]\n");
	exit(1);
}
argc -= optind;
argv += optind;

uid = getuid();
if (uid != 0)
CONFIG = NULL((void *)0);
if (argc > 0)
CONFIG = argv[0];
if (CONFIG == NULL((void *)0)) {
fprintf(stderr(&__sF[2]), "inetd: non-root must specify a config file\n");
exit(1);
}
if (argc > 1) {
fprintf(stderr(&__sF[2]), "inetd: more than one argument specified\n");
exit(1);
}

umask(022);
if (debug == 0) {
daemon(0, 0);
if (uid == 0)
	(void) setlogin("");
}

if (pledge("stdio rpath cpath getpw dns inet unix proc exec id", NULL((void *)0)) == -1)
err(1, "pledge");

if (uid == 0) {
gid_t gid = getgid();

/* If run by hand, ensure groups vector gets trashed */
setgroups(1, &gid);
}

openlog("inetd", LOG_PID0x01 | LOG_NOWAIT0x10, LOG_DAEMON(3<<3));

if (getrlimit(RLIMIT_NOFILE8, &rlim_nofile) == -1) {
syslog(LOG_ERR3, "getrlimit: %m");
} else {
rlim_nofile_cur = rlim_nofile.rlim_cur;
if (rlim_nofile_cur == RLIM_INFINITY(((rlim_t)1 << 63) - 1))	/* ! */
	rlim_nofile_cur = OPEN_MAX64;
}

event_init();

signal_set(&evsig_alrm, SIGALRM, retry, NULL)event_set(&evsig_alrm, 14, 0x08|0x10, retry, ((void *)0));
signal_add(&evsig_alrm, NULL)event_add(&evsig_alrm, ((void *)0));

config(0, 0, NULL((void *)0));

signal_set(&evsig_hup, SIGHUP, config, NULL)event_set(&evsig_hup, 1, 0x08|0x10, config, ((void *)0));
signal_add(&evsig_hup, NULL)event_add(&evsig_hup, ((void *)0));
signal_set(&evsig_chld, SIGCHLD, reap, NULL)event_set(&evsig_chld, 20, 0x08|0x10, reap, ((void *)0));
signal_add(&evsig_chld, NULL)event_add(&evsig_chld, ((void *)0));
signal_set(&evsig_term, SIGTERM, die, NULL)event_set(&evsig_term, 15, 0x08|0x10, die, ((void *)0));
signal_add(&evsig_term, NULL)event_add(&evsig_term, ((void *)0));
signal_set(&evsig_int, SIGINT, die, NULL)event_set(&evsig_int, 2, 0x08|0x10, die, ((void *)0));
signal_add(&evsig_int, NULL)event_add(&evsig_int, ((void *)0));

signal(SIGPIPE13, SIG_IGN(void (*)(int))1);

event_dispatch();

return (0);
387}

389void
390gettcp(int fd, short events, void *xsep)
391{
struct servtab *sep = xsep;
int ctrl;

if (debug)
fprintf(stderr(&__sF[2]), "someone wants %s\n", sep->se_service);

ctrl = accept(sep->se_fd, NULL((void *)0), NULL((void *)0));
if (debug)
fprintf(stderr(&__sF[2]), "accept, ctrl %d\n", ctrl);
if (ctrl == -1) {
if (errno(*__errno()) != EWOULDBLOCK35 && errno(*__errno()) != EINTR4 &&
    errno(*__errno()) != ECONNABORTED53)
	syslog(LOG_WARNING4, "accept (for %s): %m",
	    sep->se_service);
return;
}
if ((sep->se_family == AF_INET2 || sep->se_family == AF_INET624) &&
   sep->se_socktype == SOCK_STREAM1) {
struct sockaddr_storage peer;
socklen_t plen = sizeof(peer);
char sbuf[NI_MAXSERV32];

if (getpeername(ctrl, (struct sockaddr *)&peer, &plen) == -1) {
	syslog(LOG_WARNING4, "could not getpeername");
	close(ctrl);
	return;
}
if (getnameinfo((struct sockaddr *)&peer, plen, NULL((void *)0), 0,
    sbuf, sizeof(sbuf), NI_NUMERICSERV2) == 0 &&
    strtonum(sbuf, 1, USHRT_MAX0xffff, NULL((void *)0)) == 20) {
	/*
	 * ignore things that look like ftp bounce
	 */
	close(ctrl);
	return;
}
}

spawn(ctrl, 0, sep);
431}

433int
434dg_badinput(struct sockaddr *sa)
435{
struct in_addr in;
struct in6_addr *in6;
u_int16_t port;

switch (sa->sa_family) {
case AF_INET2:
in.s_addr = ntohl(((struct sockaddr_in *)sa)->sin_addr.s_addr)(__uint32_t)(__builtin_constant_p(((struct sockaddr_in *)sa)->
sin_addr.s_addr) ? (__uint32_t)(((__uint32_t)(((struct sockaddr_in
 *)sa)->sin_addr.s_addr) & 0xff) << 24 | ((__uint32_t
)(((struct sockaddr_in *)sa)->sin_addr.s_addr) & 0xff00
) << 8 | ((__uint32_t)(((struct sockaddr_in *)sa)->sin_addr
.s_addr) & 0xff0000) >> 8 | ((__uint32_t)(((struct sockaddr_in
 *)sa)->sin_addr.s_addr) & 0xff000000) >> 24) : __swap32md
(((struct sockaddr_in *)sa)->sin_addr.s_addr));
port = ntohs(((struct sockaddr_in *)sa)->sin_port)(__uint16_t)(__builtin_constant_p(((struct sockaddr_in *)sa)->
sin_port) ? (__uint16_t)(((__uint16_t)(((struct sockaddr_in *
)sa)->sin_port) & 0xffU) << 8 | ((__uint16_t)(((
struct sockaddr_in *)sa)->sin_port) & 0xff00U) >>
 8) : __swap16md(((struct sockaddr_in *)sa)->sin_port));
if (IN_MULTICAST(in.s_addr)(((u_int32_t)(in.s_addr) & ((u_int32_t)(0xf0000000))) == (
(u_int32_t)(0xe0000000))))
	goto bad;
switch ((in.s_addr & 0xff000000) >> 24) {
case 0: case 255:
	goto bad;
}
if (dg_broadcast(&in))
	goto bad;
break;
case AF_INET624:
in6 = &((struct sockaddr_in6 *)sa)->sin6_addr;
port = ntohs(((struct sockaddr_in6 *)sa)->sin6_port)(__uint16_t)(__builtin_constant_p(((struct sockaddr_in6 *)sa)
->sin6_port) ? (__uint16_t)(((__uint16_t)(((struct sockaddr_in6
 *)sa)->sin6_port) & 0xffU) << 8 | ((__uint16_t)
(((struct sockaddr_in6 *)sa)->sin6_port) & 0xff00U) >>
 8) : __swap16md(((struct sockaddr_in6 *)sa)->sin6_port));
if (IN6_IS_ADDR_MULTICAST(in6)((in6)->__u6_addr.__u6_addr8[0] == 0xff) || IN6_IS_ADDR_UNSPECIFIED(in6)((*(const u_int32_t *)(const void *)(&(in6)->__u6_addr
.__u6_addr8[0]) == 0) && (*(const u_int32_t *)(const void
 *)(&(in6)->__u6_addr.__u6_addr8[4]) == 0) && (
*(const u_int32_t *)(const void *)(&(in6)->__u6_addr.__u6_addr8
[8]) == 0) && (*(const u_int32_t *)(const void *)(&
(in6)->__u6_addr.__u6_addr8[12]) == 0)))
	goto bad;
/*
 * OpenBSD does not support IPv4-mapped and
 * IPv4-compatible IPv6 addresses (RFC2553). We should
 * drop the packet.
 */
if (IN6_IS_ADDR_V4MAPPED(in6)((*(const u_int32_t *)(const void *)(&(in6)->__u6_addr
.__u6_addr8[0]) == 0) && (*(const u_int32_t *)(const void
 *)(&(in6)->__u6_addr.__u6_addr8[4]) == 0) && (
*(const u_int32_t *)(const void *)(&(in6)->__u6_addr.__u6_addr8
[8]) == (__uint32_t)(__builtin_constant_p(0x0000ffff) ? (__uint32_t
)(((__uint32_t)(0x0000ffff) & 0xff) << 24 | ((__uint32_t
)(0x0000ffff) & 0xff00) << 8 | ((__uint32_t)(0x0000ffff
) & 0xff0000) >> 8 | ((__uint32_t)(0x0000ffff) &
 0xff000000) >> 24) : __swap32md(0x0000ffff)))) || IN6_IS_ADDR_V4COMPAT(in6)((*(const u_int32_t *)(const void *)(&(in6)->__u6_addr
.__u6_addr8[0]) == 0) && (*(const u_int32_t *)(const void
 *)(&(in6)->__u6_addr.__u6_addr8[4]) == 0) && (
*(const u_int32_t *)(const void *)(&(in6)->__u6_addr.__u6_addr8
[8]) == 0) && (*(const u_int32_t *)(const void *)(&
(in6)->__u6_addr.__u6_addr8[12]) != 0) && (*(const
 u_int32_t *)(const void *)(&(in6)->__u6_addr.__u6_addr8
[12]) != (__uint32_t)(__builtin_constant_p(1) ? (__uint32_t)(
((__uint32_t)(1) & 0xff) << 24 | ((__uint32_t)(1) &
 0xff00) << 8 | ((__uint32_t)(1) & 0xff0000) >>
| ((__uint32_t)(1) & 0xff000000) >> 24) : __swap32md
(1)))))
	goto bad;
break;
default:
/* Unsupported AF */
goto bad;
}

if (port < IPPORT_RESERVED1024 || port == NFS_PORT2049)
goto bad;

return (0);

476bad:
return (1);
478}

480int
481dg_broadcast(struct in_addr *in)
482{
struct ifaddrs *ifa, *ifap;
struct sockaddr_in *sin;

if (getifaddrs(&ifap) == -1)
return (0);
for (ifa = ifap; ifa; ifa = ifa->ifa_next) {
if (ifa->ifa_addr == NULL((void *)0) ||
    ifa->ifa_addr->sa_family != AF_INET2 ||
    (ifa->ifa_flags & IFF_BROADCAST0x2) == 0)
	continue;
sin = (struct sockaddr_in *)ifa->ifa_broadaddrifa_dstaddr;
if (sin->sin_addr.s_addr == in->s_addr) {
	freeifaddrs(ifap);
	return (1);
}
}
freeifaddrs(ifap);
return (0);
501}

503void
504reap(int sig, short event, void *arg)
505{
struct servtab *sep;
int status;
pid_t pid;

if (debug)
fprintf(stderr(&__sF[2]), "reaping asked for\n");

for (;;) {
if ((pid = wait3(&status, WNOHANG0x01, NULL((void *)0))) <= 0) {
	if (pid == -1 && errno(*__errno()) == EINTR4)
		continue;
	break;
}
if (debug)
	fprintf(stderr(&__sF[2]), "%ld reaped, status %x\n",
	    (long)pid, status);
for (sep = servtab; sep; sep = sep->se_next)
	if (sep->se_wait == pid) {
		if (WIFEXITED(status)(((status) & 0177) == 0) && WEXITSTATUS(status)(int)(((unsigned)(status) >> 8) & 0xff))
			syslog(LOG_WARNING4,
			    "%s: exit status %d",
			    sep->se_server, WEXITSTATUS(status)(int)(((unsigned)(status) >> 8) & 0xff));
		else if (WIFSIGNALED(status)(((status) & 0177) != 0177 && ((status) & 0177
) != 0))
			syslog(LOG_WARNING4,
			    "%s: exit signal %d",
			    sep->se_server, WTERMSIG(status)(((status) & 0177)));
		sep->se_wait = 1;
		event_add(&sep->se_event, NULL((void *)0));
		if (debug)
			fprintf(stderr(&__sF[2]), "restored %s, fd %d\n",
			    sep->se_service, sep->se_fd);
	}
}
539}

541void
542config(int sig, short event, void *arg)
543{
struct servtab *sep, *cp, **sepp;
int add;
char protoname[11];

if (!setconfig()) {
syslog(LOG_ERR3, "%s: %m", CONFIG);
exit(1);
}
for (sep = servtab; sep; sep = sep->se_next)
sep->se_checked = 0;
cp = getconfigent();
while (cp != NULL((void *)0)) {
for (sep = servtab; sep; sep = sep->se_next)
	if (matchconf(sep, cp))
		break;
add = 0;
if (sep != NULL((void *)0)) {
	int i;

563#define SWAP(type, a, b) {type c=(type)a; a=(type)b; b=(type)c;}

	/*
	 * sep->se_wait may be holding the pid of a daemon
	 * that we're waiting for.  If so, don't overwrite
	 * it unless the config file explicitly says don't
	 * wait.
	 */
	if (cp->se_bi == 0 &&
	    (sep->se_wait == 1 || cp->se_wait == 0))
		sep->se_wait = cp->se_wait;
	SWAP(int, cp->se_max, sep->se_max);
	SWAP(char *, sep->se_user, cp->se_user);
	SWAP(char *, sep->se_group, cp->se_group);
	SWAP(char *, sep->se_server, cp->se_server);
	for (i = 0; i < MAXARGV20; i++)
		SWAP(char *, sep->se_argv[i], cp->se_argv[i]);
580#undef SWAP
	if (isrpcservice(sep)((sep)->se_rpcversl != 0))
		unregister_rpc(sep);
	sep->se_rpcversl = cp->se_rpcversl;
	sep->se_rpcversh = cp->se_rpcversh;
	freeconfig(cp);
	add = 1;
} else {
	sep = enter(cp);
}
sep->se_checked = 1;

switch (sep->se_family) {
case AF_UNIX1:
	if (sep->se_fd != -1)
		break;
	sep->se_ctrladdr_size =
	    strlcpy(sep->se_ctrladdr_unse_un.se_un_ctrladdr_un.sun_path,
	    sep->se_service,
	    sizeof sep->se_ctrladdr_unse_un.se_un_ctrladdr_un.sun_path);
	if (sep->se_ctrladdr_size >=
	    sizeof sep->se_ctrladdr_unse_un.se_un_ctrladdr_un.sun_path) {
		syslog(LOG_WARNING4, "%s/%s: UNIX domain socket "
		    "path too long", sep->se_service,
		    sep->se_proto);
		goto serv_unknown;
	}
	sep->se_ctrladdr_unse_un.se_un_ctrladdr_un.sun_family = AF_UNIX1;
	sep->se_ctrladdr_size +=
	    1 + sizeof sep->se_ctrladdr_unse_un.se_un_ctrladdr_un.sun_family;
	(void)unlink(sep->se_service);
	setup(sep);
	break;
case AF_INET2:
	sep->se_ctrladdr_inse_un.se_un_ctrladdr_in.sin_family = AF_INET2;
	/* se_ctrladdr_in was set in getconfigent */
	sep->se_ctrladdr_size = sizeof sep->se_ctrladdr_inse_un.se_un_ctrladdr_in;

	if (isrpcservice(sep)((sep)->se_rpcversl != 0)) {
		struct rpcent *rp;

		sep->se_rpcprog = strtonum(sep->se_service,
		    1, USHRT_MAX0xffff, NULL((void *)0));
		if (sep->se_rpcprog == 0) {
			rp = getrpcbyname(sep->se_service);
			if (rp == 0) {
				syslog(LOG_ERR3,
				    "%s: unknown rpc service",
				    sep->se_service);
				goto serv_unknown;
			}
			sep->se_rpcprog = rp->r_number;
		}
		if (sep->se_fd == -1)
			setup(sep);
		if (sep->se_fd != -1)
			register_rpc(sep);
	} else {
		u_short port = htons(strtonum(sep->se_service,(__uint16_t)(__builtin_constant_p(strtonum(sep->se_service
, 1, 0xffff, ((void *)0))) ? (__uint16_t)(((__uint16_t)(strtonum
(sep->se_service, 1, 0xffff, ((void *)0))) & 0xffU) <<
| ((__uint16_t)(strtonum(sep->se_service, 1, 0xffff, ((
void *)0))) & 0xff00U) >> 8) : __swap16md(strtonum(
sep->se_service, 1, 0xffff, ((void *)0))))
		    1, USHRT_MAX, NULL))(__uint16_t)(__builtin_constant_p(strtonum(sep->se_service
, 1, 0xffff, ((void *)0))) ? (__uint16_t)(((__uint16_t)(strtonum
(sep->se_service, 1, 0xffff, ((void *)0))) & 0xffU) <<
| ((__uint16_t)(strtonum(sep->se_service, 1, 0xffff, ((
void *)0))) & 0xff00U) >> 8) : __swap16md(strtonum(
sep->se_service, 1, 0xffff, ((void *)0))));

		if (!port) {
			(void)strlcpy(protoname, sep->se_proto,
			    sizeof(protoname));
			if (isdigit((unsigned char)
			    protoname[strlen(protoname) - 1]))
				protoname[strlen(protoname) - 1] = '\0';
			sp = getservbyname(sep->se_service,
			    protoname);
			if (sp == 0) {
				syslog(LOG_ERR3,
				    "%s/%s: unknown service",
				    sep->se_service, sep->se_proto);
				goto serv_unknown;
			}
			port = sp->s_port;
		}
		if (port != sep->se_ctrladdr_inse_un.se_un_ctrladdr_in.sin_port) {
			sep->se_ctrladdr_inse_un.se_un_ctrladdr_in.sin_port = port;
			if (sep->se_fd != -1) {
				event_del(&sep->se_event);
				(void) close(sep->se_fd);
			}
			sep->se_fd = -1;
		}
		if (sep->se_fd == -1)
			setup(sep);
	}
	break;
case AF_INET624:
	sep->se_ctrladdr_in6se_un.se_un_ctrladdr_in6.sin6_family = AF_INET624;
	/* se_ctrladdr_in was set in getconfigent */
	sep->se_ctrladdr_size = sizeof sep->se_ctrladdr_in6se_un.se_un_ctrladdr_in6;

	if (isrpcservice(sep)((sep)->se_rpcversl != 0)) {
		struct rpcent *rp;

		sep->se_rpcprog = strtonum(sep->se_service,
		    1, USHRT_MAX0xffff, NULL((void *)0));
		if (sep->se_rpcprog == 0) {
			rp = getrpcbyname(sep->se_service);
			if (rp == 0) {
				syslog(LOG_ERR3,
				    "%s: unknown rpc service",
				    sep->se_service);
				goto serv_unknown;
			}
			sep->se_rpcprog = rp->r_number;
		}
		if (sep->se_fd == -1)
			setup(sep);
		if (sep->se_fd != -1)
			register_rpc(sep);
	} else {
		u_short port = htons(strtonum(sep->se_service,(__uint16_t)(__builtin_constant_p(strtonum(sep->se_service
, 1, 0xffff, ((void *)0))) ? (__uint16_t)(((__uint16_t)(strtonum
(sep->se_service, 1, 0xffff, ((void *)0))) & 0xffU) <<
| ((__uint16_t)(strtonum(sep->se_service, 1, 0xffff, ((
void *)0))) & 0xff00U) >> 8) : __swap16md(strtonum(
sep->se_service, 1, 0xffff, ((void *)0))))
		    1, USHRT_MAX, NULL))(__uint16_t)(__builtin_constant_p(strtonum(sep->se_service
, 1, 0xffff, ((void *)0))) ? (__uint16_t)(((__uint16_t)(strtonum
(sep->se_service, 1, 0xffff, ((void *)0))) & 0xffU) <<
| ((__uint16_t)(strtonum(sep->se_service, 1, 0xffff, ((
void *)0))) & 0xff00U) >> 8) : __swap16md(strtonum(
sep->se_service, 1, 0xffff, ((void *)0))));

		if (!port) {
			(void)strlcpy(protoname, sep->se_proto,
			    sizeof(protoname));
			if (isdigit((unsigned char)
			    protoname[strlen(protoname) - 1]))
				protoname[strlen(protoname) - 1] = '\0';
			sp = getservbyname(sep->se_service,
			    protoname);
			if (sp == 0) {
				syslog(LOG_ERR3,
				    "%s/%s: unknown service",
				    sep->se_service, sep->se_proto);
				goto serv_unknown;
			}
			port = sp->s_port;
		}
		if (port != sep->se_ctrladdr_in6se_un.se_un_ctrladdr_in6.sin6_port) {
			sep->se_ctrladdr_in6se_un.se_un_ctrladdr_in6.sin6_port = port;
			if (sep->se_fd != -1) {
				event_del(&sep->se_event);
				(void) close(sep->se_fd);
			}
			sep->se_fd = -1;
		}
		if (sep->se_fd == -1)
			setup(sep);
	}
	break;
}
serv_unknown:
if (cp->se_next != NULL((void *)0)) {
	struct servtab *tmp = cp;

	cp = cp->se_next;
	free(tmp);
} else {
	free(cp);
	cp = getconfigent();
}
if (debug)
	print_service(add ? "REDO" : "ADD", sep);
}
endconfig();
/*
* Purge anything not looked at above.
*/
sepp = &servtab;
while ((sep = *sepp)) {
if (sep->se_checked) {
	sepp = &sep->se_next;
	continue;
}
*sepp = sep->se_next;
if (sep->se_fd != -1) {
	event_del(&sep->se_event);
	(void) close(sep->se_fd);
}
if (isrpcservice(sep)((sep)->se_rpcversl != 0))
	unregister_rpc(sep);
if (sep->se_family == AF_UNIX1)
	(void)unlink(sep->se_service);
if (debug)
	print_service("FREE", sep);
freeconfig(sep);
free(sep);
}
763}

765void
766retry(int sig, short events, void *arg)
767{
struct servtab *sep;

timingout = 0;
for (sep = servtab; sep; sep = sep->se_next) {
if (sep->se_fd == -1) {
	switch (sep->se_family) {
	case AF_UNIX1:
	case AF_INET2:
	case AF_INET624:
		setup(sep);
		if (sep->se_fd != -1 && isrpcservice(sep)((sep)->se_rpcversl != 0))
			register_rpc(sep);
		break;
	}
}
}
784}

786void
787die(int sig, short events, void *arg)
788{
struct servtab *sep;

for (sep = servtab; sep; sep = sep->se_next) {
if (sep->se_fd == -1)
	continue;

switch (sep->se_family) {
case AF_UNIX1:
	(void)unlink(sep->se_service);
	break;
case AF_INET2:
case AF_INET624:
	if (sep->se_wait == 1 && isrpcservice(sep)((sep)->se_rpcversl != 0))
		unregister_rpc(sep);
	break;
}
(void)close(sep->se_fd);
}
exit(0);
808}

810void
811setup(struct servtab *sep)
812{
int on = 1;
int r;
mode_t mask = 0;

if ((sep->se_fd = socket(sep->se_family, sep->se_socktype, 0)) == -1) {
syslog(LOG_ERR3, "%s/%s: socket: %m",
    sep->se_service, sep->se_proto);
return;
}
822#define	turnon(fd, opt) \
823setsockopt(fd, SOL_SOCKET0xffff, opt, &on, sizeof (on))
if (strncmp(sep->se_proto, "tcp", 3) == 0 && debug &&
   turnon(sep->se_fd, SO_DEBUG0x0001) < 0)
syslog(LOG_ERR3, "setsockopt (SO_DEBUG): %m");
if (turnon(sep->se_fd, SO_REUSEADDR0x0004) < 0)
syslog(LOG_ERR3, "setsockopt (SO_REUSEADDR): %m");
829#undef turnon
if (isrpcservice(sep)((sep)->se_rpcversl != 0)) {
struct passwd *pwd;

/*
 * for RPC services, attempt to use a reserved port
 * if they are going to be running as root.
 *
 * Also, zero out the port for all RPC services; let bind()
 * find one.
 */
sep->se_ctrladdr_inse_un.se_un_ctrladdr_in.sin_port = 0;
if (sep->se_user && (pwd = getpwnam(sep->se_user)) &&
    pwd->pw_uid == 0 && uid == 0)
	r = bindresvport(sep->se_fd, &sep->se_ctrladdr_inse_un.se_un_ctrladdr_in);
else {
	r = bind(sep->se_fd, &sep->se_ctrladdrse_un.se_un_ctrladdr,
	    sep->se_ctrladdr_size);
	if (r == 0) {
		socklen_t len = sep->se_ctrladdr_size;
		int saveerrno = errno(*__errno());

		/* update se_ctrladdr_in.sin_port */
		r = getsockname(sep->se_fd, &sep->se_ctrladdrse_un.se_un_ctrladdr,
		    &len);
		if (r <= 0)
			errno(*__errno()) = saveerrno;
	}
}
} else {
if (sep->se_family == AF_UNIX1)
	mask = umask(0111);
r = bind(sep->se_fd, &sep->se_ctrladdrse_un.se_un_ctrladdr, sep->se_ctrladdr_size);
if (sep->se_family == AF_UNIX1)
	umask(mask);
}
if (r == -1) {
syslog(LOG_ERR3, "%s/%s: bind: %m",
    sep->se_service, sep->se_proto);
(void) close(sep->se_fd);
sep->se_fd = -1;
if (!timingout) {
	timingout = 1;
	alarm(RETRYTIME(60*10));
}
return;
}
if (sep->se_socktype == SOCK_STREAM1)
listen(sep->se_fd, 10);

if (!sep->se_wait && sep->se_socktype == SOCK_STREAM1) {
event_set(&sep->se_event, sep->se_fd, EV_READ0x02|EV_PERSIST0x10,
    gettcp, sep);
} else {
event_set(&sep->se_event, sep->se_fd, EV_READ0x02|EV_PERSIST0x10,
    spawn, sep);
}

event_add(&sep->se_event, NULL((void *)0));

if (sep->se_fd > maxsock) {
maxsock = sep->se_fd;
if (maxsock > rlim_nofile_cur - FD_MARGIN(8))
	bump_nofile();
}
894}

896void
897register_rpc(struct servtab *sep)
898{
socklen_t n;
struct sockaddr_in sin;
struct protoent *pp;

if ((pp = getprotobyname(sep->se_proto+4)) == NULL((void *)0)) {
syslog(LOG_ERR3, "%s: getproto: %m",
    sep->se_proto);
return;
}
n = sizeof sin;
if (getsockname(sep->se_fd, (struct sockaddr *)&sin, &n) == -1) {
syslog(LOG_ERR3, "%s/%s: getsockname: %m",
    sep->se_service, sep->se_proto);
return;
}

for (n = sep->se_rpcversl; n <= sep->se_rpcversh; n++) {
if (debug)
	fprintf(stderr(&__sF[2]), "pmap_set: %u %u %u %u\n",
	    sep->se_rpcprog, n, pp->p_proto,
	    ntohs(sin.sin_port)(__uint16_t)(__builtin_constant_p(sin.sin_port) ? (__uint16_t
)(((__uint16_t)(sin.sin_port) & 0xffU) << 8 | ((__uint16_t
)(sin.sin_port) & 0xff00U) >> 8) : __swap16md(sin.sin_port
)));
(void)pmap_unset(sep->se_rpcprog, n);
if (!pmap_set(sep->se_rpcprog, n, pp->p_proto, ntohs(sin.sin_port)(__uint16_t)(__builtin_constant_p(sin.sin_port) ? (__uint16_t
)(((__uint16_t)(sin.sin_port) & 0xffU) << 8 | ((__uint16_t
)(sin.sin_port) & 0xff00U) >> 8) : __swap16md(sin.sin_port
))))
	syslog(LOG_ERR3, "%s %s: pmap_set: %u %u %u %u: %m",
	    sep->se_service, sep->se_proto,
	    sep->se_rpcprog, n, pp->p_proto,
	    ntohs(sin.sin_port)(__uint16_t)(__builtin_constant_p(sin.sin_port) ? (__uint16_t
)(((__uint16_t)(sin.sin_port) & 0xffU) << 8 | ((__uint16_t
)(sin.sin_port) & 0xff00U) >> 8) : __swap16md(sin.sin_port
)));
}
927}

929void
930unregister_rpc(struct servtab *sep)
931{
int n;

for (n = sep->se_rpcversl; n <= sep->se_rpcversh; n++) {
if (debug)
	fprintf(stderr(&__sF[2]), "pmap_unset(%u, %u)\n",
	    sep->se_rpcprog, n);
if (!pmap_unset(sep->se_rpcprog, n))
	syslog(LOG_ERR3, "pmap_unset(%u, %u)",
	    sep->se_rpcprog, n);
}
942}


945struct servtab *
946enter(struct servtab *cp)
947{
struct servtab *sep;

sep = malloc(sizeof (*sep));
if (sep == NULL((void *)0)) {
syslog(LOG_ERR3, "Out of memory.");
exit(1);
}
*sep = *cp;
sep->se_fd = -1;
sep->se_rpcprog = -1;
sep->se_next = servtab;
servtab = sep;
return (sep);
961}

963int
964matchconf(struct servtab *old, struct servtab *new)
965{
if (strcmp(old->se_service, new->se_service) != 0)
return (0);

if (strcmp(old->se_hostaddr, new->se_hostaddr) != 0)
return (0);

if (strcmp(old->se_proto, new->se_proto) != 0)
return (0);

/*
* If the new servtab is bound to a specific address, check that the
* old servtab is bound to the same entry. If the new service is not
* bound to a specific address then the check of se_hostaddr above
* is sufficient.
*/

if (old->se_family == AF_INET2 && new->se_family == AF_INET2 &&
   bcmp(&old->se_ctrladdr_inse_un.se_un_ctrladdr_in.sin_addr,
   &new->se_ctrladdr_inse_un.se_un_ctrladdr_in.sin_addr,
   sizeof(new->se_ctrladdr_inse_un.se_un_ctrladdr_in.sin_addr)) != 0)
return (0);

if (old->se_family == AF_INET624 && new->se_family == AF_INET624 &&
   bcmp(&old->se_ctrladdr_in6se_un.se_un_ctrladdr_in6.sin6_addr,
   &new->se_ctrladdr_in6se_un.se_un_ctrladdr_in6.sin6_addr,
   sizeof(new->se_ctrladdr_in6se_un.se_un_ctrladdr_in6.sin6_addr)) != 0)
return (0);
if (old->se_family == AF_INET624 && new->se_family == AF_INET624 &&
   old->se_ctrladdr_in6se_un.se_un_ctrladdr_in6.sin6_scope_id !=
   new->se_ctrladdr_in6se_un.se_un_ctrladdr_in6.sin6_scope_id)
return (0);

return (1);
999}

1001FILE		*fconfig = NULL((void *)0);
1002char		line[1024];
1003char		*defhost;
1004char		*skip(char **, int);
1005char		*nextline(FILE *);
1006char		*newstr(char *);
1007struct servtab	*dupconfig(struct servtab *);

1009int
1010setconfig(void)
1011{
free(defhost);
defhost = newstr("*");
if (fconfig != NULL((void *)0)) {
fseek(fconfig, 0L, SEEK_SET0);
return (1);
}
fconfig = fopen(CONFIG, "r");
return (fconfig != NULL((void *)0));
1020}

1022void
1023endconfig(void)
1024{
if (fconfig) {
(void) fclose(fconfig);
fconfig = NULL((void *)0);
}
if (defhost) {
free(defhost);
defhost = 0;
}
1033}

1035struct servtab *
1036getconfigent(void)
1037{
struct servtab *sep, *tsep;
char *arg, *cp, *hostdelim, *s;
int argc;

sep = calloc(1, sizeof(struct servtab));
if (sep == NULL((void *)0)) {
syslog(LOG_ERR3, "calloc: %m");
exit(1);
}
1047more:
freeconfig(sep);

while ((cp = nextline(fconfig)) && *cp == '#')
;
if (cp == NULL((void *)0)) {
free(sep);
return (NULL((void *)0));
}

memset(sep, 0, sizeof *sep);
arg = skip(&cp, 0);
if (arg == NULL((void *)0)) {
/* A blank line. */
goto more;
}

/* Check for a host name. */
hostdelim = strrchr(arg, ':');
if (hostdelim) {
*hostdelim = '\0';
if (arg[0] == '[' && hostdelim > arg && hostdelim[-1] == ']') {
	hostdelim[-1] = '\0';
	sep->se_hostaddr = newstr(arg + 1);
} else if (hostdelim == arg)
	sep->se_hostaddr = newstr("*");
else
	sep->se_hostaddr = newstr(arg);
arg = hostdelim + 1;
/*
 * If the line is of the form `host:', then just change the
 * default host for the following lines.
 */
if (*arg == '\0') {
	arg = skip(&cp, 0);
	if (cp == NULL((void *)0)) {
		free(defhost);
		defhost = newstr(sep->se_hostaddr);
		goto more;
	}
}
} else
sep->se_hostaddr = newstr(defhost);

sep->se_service = newstr(arg);
if ((arg = skip(&cp, 1)) == NULL((void *)0))
goto more;

if (strcmp(arg, "stream") == 0)
sep->se_socktype = SOCK_STREAM1;
else if (strcmp(arg, "dgram") == 0)
sep->se_socktype = SOCK_DGRAM2;
else
sep->se_socktype = -1;

if ((arg = skip(&cp, 1)) == NULL((void *)0))
goto more;

sep->se_proto = newstr(arg);

if (strcmp(sep->se_proto, "unix") == 0) {
sep->se_family = AF_UNIX1;
} else {
int s;

sep->se_family = AF_INET2;
if (sep->se_proto[strlen(sep->se_proto) - 1] == '6')
	sep->se_family = AF_INET624;

/* check if the family is supported */
s = socket(sep->se_family, SOCK_DGRAM2, 0);
if (s == -1) {
	syslog(LOG_WARNING4, "%s/%s: %s: the address family is "
	    "not supported by the kernel", sep->se_service,
	    sep->se_proto, sep->se_hostaddr);
	goto more;
}
close(s);

if (strncmp(sep->se_proto, "rpc/", 4) == 0) {
	char *cp, *ccp;
	long l;

	cp = strchr(sep->se_service, '/');
	if (cp == 0) {
		syslog(LOG_ERR3, "%s: no rpc version",
		    sep->se_service);
		goto more;
	}
	*cp++ = '\0';
	l = strtol(cp, &ccp, 0);
	if (ccp == cp || l < 0 || l > INT_MAX0x7fffffff) {
badafterall:
		syslog(LOG_ERR3, "%s/%s: bad rpc version",
		    sep->se_service, cp);
		goto more;
	}
	sep->se_rpcversl = sep->se_rpcversh = l;
	if (*ccp == '-') {
		cp = ccp + 1;
		l = strtol(cp, &ccp, 0);
		if (ccp == cp || l < 0 || l > INT_MAX0x7fffffff ||
		    l < sep->se_rpcversl || *ccp)
			goto badafterall;
		sep->se_rpcversh = l;
	} else if (*ccp != '\0')
		goto badafterall;
}
}
arg = skip(&cp, 1);
if (arg == NULL((void *)0))
goto more;

s = strchr(arg, '.');
if (s) {
char *p;

*s++ = '\0';
sep->se_max = strtoul(s, &p, 0);
if (sep->se_max < 1 || *p) {
	syslog(LOG_ERR3,
	    "%s: illegal max field \"%s\", setting to %d",
	    sep->se_service, s, toomany);
	sep->se_max = toomany;
}
} else
sep->se_max = toomany;

sep->se_wait = strcmp(arg, "wait") == 0;
if ((arg = skip(&cp, 1)) == NULL((void *)0))
goto more;
sep->se_user = newstr(arg);
arg = strchr(sep->se_user, '.');
if (arg == NULL((void *)0))
arg = strchr(sep->se_user, ':');
if (arg) {
*arg++ = '\0';
sep->se_group = newstr(arg);
}
if ((arg = skip(&cp, 1)) == NULL((void *)0))
goto more;

sep->se_server = newstr(arg);
if (strcmp(sep->se_server, "internal") == 0) {
struct biltin *bi;

for (bi = biltins; bi->bi_service; bi++)
	if (bi->bi_socktype == sep->se_socktype &&
	    strcmp(bi->bi_service, sep->se_service) == 0)
		break;
if (bi->bi_service == 0) {
	syslog(LOG_ERR3, "internal service %s unknown",
	    sep->se_service);
	goto more;
}
sep->se_bi = bi;
sep->se_wait = bi->bi_wait;
} else
sep->se_bi = NULL((void *)0);
argc = 0;
for (arg = skip(&cp, 0); cp; arg = skip(&cp, 0)) {
if (argc < MAXARGV20)
	sep->se_argv[argc++] = newstr(arg);
}
if (argc == 0 && sep->se_bi == NULL((void *)0)) {
if ((arg = strrchr(sep->se_server, '/')) != NULL((void *)0))
	arg++;
else
	arg = sep->se_server;
sep->se_argv[argc++] = newstr(arg);
}
while (argc <= MAXARGV20)
sep->se_argv[argc++] = NULL((void *)0);

/*
* Resolve each hostname in the se_hostaddr list (if any)
* and create a new entry for each resolved address.
*/
if (sep->se_hostaddr != NULL((void *)0) && strcmp(sep->se_proto, "unix") != 0) {
struct addrinfo hints, *res0, *res;
char *host, *hostlist0, *hostlist, *port;
int error;

hostlist = hostlist0 = sep->se_hostaddr;
sep->se_hostaddr = NULL((void *)0);
sep->se_checked = -1;
while ((host = strsep(&hostlist, ",")) != NULL((void *)0)) {
	if (*host == '\0')
		continue;

	memset(&hints, 0, sizeof(hints));
	hints.ai_family = sep->se_family;
	hints.ai_socktype = sep->se_socktype;
	hints.ai_flags = AI_PASSIVE1;
	port = "0";
	error = getaddrinfo(strcmp(host, "*") ? host : NULL((void *)0),
	    port, &hints, &res0);
	if (error) {
		syslog(LOG_ERR3, "%s/%s: %s: %s",
		    sep->se_service, sep->se_proto,
		    host, gai_strerror(error));
		continue;
	}
	for (res = res0; res; res = res->ai_next) {
		/*
		 * If sep is unused, store host in there.
		 * Otherwise, dup a new entry and prepend it.
		 */
		if (sep->se_checked == -1) {
			sep->se_checked = 0;
		} else {
			tsep = dupconfig(sep);
			tsep->se_next = sep;
			sep = tsep;
		}
		sep->se_hostaddr = newstr(host);
		memcpy(&sep->se_ctrladdr_storagese_un.se_un_ctrladdr_storage,
		    res->ai_addr, res->ai_addrlen);
		sep->se_ctrladdr_size = res->ai_addrlen;
	}
	freeaddrinfo(res0);
}
free(hostlist0);
if (sep->se_checked == -1)
	goto more;	/* no resolvable names/addresses */
}

return (sep);
1275}

1277void
1278freeconfig(struct servtab *cp)
1279{
int i;

free(cp->se_hostaddr);
cp->se_hostaddr = NULL((void *)0);
free(cp->se_service);
cp->se_service = NULL((void *)0);
free(cp->se_proto);
cp->se_proto = NULL((void *)0);
free(cp->se_user);
cp->se_user = NULL((void *)0);
free(cp->se_group);
cp->se_group = NULL((void *)0);
free(cp->se_server);
cp->se_server = NULL((void *)0);
for (i = 0; i < MAXARGV20; i++) {
free(cp->se_argv[i]);
cp->se_argv[i] = NULL((void *)0);
}
1298}

1300char *
1301skip(char **cpp, int report)
1302{
char *cp = *cpp;
char *start;

1306erp:
if (*cpp == NULL((void *)0)) {
if (report)
	syslog(LOG_ERR3, "syntax error in inetd config file");
return (NULL((void *)0));
}

1313again:
while (*cp == ' ' || *cp == '\t')
cp++;
if (*cp == '\0') {
int c;

c = getc(fconfig)(!__isthreaded ? (--(fconfig)->_r < 0 ? __srget(fconfig
) : (int)(*(fconfig)->_p++)) : (getc)(fconfig));
(void) ungetc(c, fconfig);
if (c == ' ' || c == '\t')
	if ((cp = nextline(fconfig)))
		goto again;
*cpp = NULL((void *)0);
goto erp;
}
start = cp;
while (*cp && *cp != ' ' && *cp != '\t')
cp++;
if (*cp != '\0')
*cp++ = '\0';
if ((*cpp = cp) == NULL((void *)0))
goto erp;

return (start);
1336}

1338char *
1339nextline(FILE *fd)
1340{
if (fgets(line, sizeof (line), fd) == NULL((void *)0))
return (NULL((void *)0));
line[strcspn(line, "\n")] = '\0';
return (line);
1345}

1347char *
1348newstr(char *cp)
1349{
if ((cp = strdup(cp ? cp : "")))
return(cp);
syslog(LOG_ERR3, "strdup: %m");
exit(1);
1354}

1356struct servtab *
1357dupconfig(struct servtab *sep)
1358{
struct servtab *newtab;
int argc;

newtab = calloc(1, sizeof(struct servtab));

if (newtab == NULL((void *)0)) {
syslog(LOG_ERR3, "calloc: %m");
exit(1);
}

newtab->se_service = sep->se_service ? newstr(sep->se_service) : NULL((void *)0);
newtab->se_socktype = sep->se_socktype;
newtab->se_family = sep->se_family;
newtab->se_proto = sep->se_proto ? newstr(sep->se_proto) : NULL((void *)0);
newtab->se_rpcprog = sep->se_rpcprog;
newtab->se_rpcversl = sep->se_rpcversl;
newtab->se_rpcversh = sep->se_rpcversh;
newtab->se_wait = sep->se_wait;
newtab->se_user = sep->se_user ? newstr(sep->se_user) : NULL((void *)0);
newtab->se_group = sep->se_group ? newstr(sep->se_group) : NULL((void *)0);
newtab->se_bi = sep->se_bi;
newtab->se_server = sep->se_server ? newstr(sep->se_server) : 0;

for (argc = 0; argc <= MAXARGV20; argc++)
newtab->se_argv[argc] = sep->se_argv[argc] ?
    newstr(sep->se_argv[argc]) : NULL((void *)0);
newtab->se_max = sep->se_max;

return (newtab);
1388}

1390void
1391inetd_setproctitle(char *a, int s)
1392{
socklen_t size;
struct sockaddr_storage ss;
char hbuf[NI_MAXHOST256];

size = sizeof(ss);
if (getpeername(s, (struct sockaddr *)&ss, &size) == 0) {
if (getnameinfo((struct sockaddr *)&ss, size, hbuf,
    sizeof(hbuf), NULL((void *)0), 0, NI_NUMERICHOST1) == 0)
	setproctitle("-%s [%s]", a, hbuf);
else
	setproctitle("-%s [?]", a);
} else
setproctitle("-%s", a);
1406}

1408int
1409bump_nofile(void)
1410{
1411#define FD_CHUNK32	32

struct rlimit rl;

if (getrlimit(RLIMIT_NOFILE8, &rl) == -1) {
syslog(LOG_ERR3, "getrlimit: %m");
return -1;
}
rl.rlim_cur = MINIMUM(rl.rlim_max, rl.rlim_cur + FD_CHUNK)(((rl.rlim_max) < (rl.rlim_cur + 32)) ? (rl.rlim_max) : (rl
.rlim_cur + 32));
rl.rlim_cur = MINIMUM(FD_SETSIZE, rl.rlim_cur + FD_CHUNK)(((1024) < (rl.rlim_cur + 32)) ? (1024) : (rl.rlim_cur + 32
));
if (rl.rlim_cur <= rlim_nofile_cur) {
syslog(LOG_ERR3,
    "bump_nofile: cannot extend file limit, max = %d",
    (int)rl.rlim_cur);
return -1;
}

if (setrlimit(RLIMIT_NOFILE8, &rl) == -1) {
syslog(LOG_ERR3, "setrlimit: %m");
return -1;
}

rlim_nofile_cur = rl.rlim_cur;
return 0;
1435}

1437/*
* Internet services provided internally by inetd:
*/
1440#define	BUFSIZE4096	4096

1442void
1443echo_stream(int s, struct servtab *sep)
1444{
char buffer[BUFSIZE4096];
int i;

inetd_setproctitle(sep->se_service, s);
while ((i = read(s, buffer, sizeof(buffer))) > 0 &&
   write(s, buffer, i) > 0)
;
exit(0);
1453}

1455void
1456echo_dg(int s, struct servtab *sep)
1457{
char buffer[BUFSIZE4096];
int i;
socklen_t size;
struct sockaddr_storage ss;

size = sizeof(ss);
if ((i = recvfrom(s, buffer, sizeof(buffer), 0,
   (struct sockaddr *)&ss, &size)) == -1)
return;
if (dg_badinput((struct sockaddr *)&ss))
return;
(void) sendto(s, buffer, i, 0, (struct sockaddr *)&ss, size);
1470}

1472void
1473discard_stream(int s, struct servtab *sep)
1474{
char buffer[BUFSIZE4096];

inetd_setproctitle(sep->se_service, s);
while ((errno(*__errno()) = 0, read(s, buffer, sizeof(buffer)) > 0) ||
   errno(*__errno()) == EINTR4)
;
exit(0);
1482}

1484void
1485discard_dg(int s, struct servtab *sep)
1486{
char buffer[BUFSIZE4096];

(void) read(s, buffer, sizeof(buffer));
1490}

1492#define LINESIZ72 72
1493char ring[128];
1494char *endring;

1496void
1497initring(void)
1498{
int i;

endring = ring;

for (i = 0; i <= sizeof ring; ++i)
if (isprint((unsigned char)i))
	*endring++ = i;
1506}

1508void
1509chargen_stream(int s, struct servtab *sep)
1510{
char *rs;
int len;
char text[LINESIZ72+2];

inetd_setproctitle(sep->se_service, s);

if (!endring) {
initring();
rs = ring;
}

text[LINESIZ72] = '\r';
text[LINESIZ72 + 1] = '\n';
for (rs = ring;;) {
if ((len = endring - rs) >= LINESIZ72)
	memmove(text, rs, LINESIZ72);
else {
	memmove(text, rs, len);
	memmove(text + len, ring, LINESIZ72 - len);
}
if (++rs == endring)
	rs = ring;
if (write(s, text, sizeof(text)) != sizeof(text))
	break;
}
exit(0);
1537}

1539void
1540chargen_dg(int s, struct servtab *sep)
1541{
struct sockaddr_storage ss;
static char *rs;
1
'rs' initialized to a null pointer value→
int len;
socklen_t size;
char text[LINESIZ72+2];

if (endring == 0) {
2
←
Assuming 'endring' is not equal to null→
3
←
Taking false branch→
initring();
rs = ring;
}

size = sizeof(ss);
if (recvfrom(s, text, sizeof(text), 0, (struct sockaddr *)&ss,
4
←
Assuming the condition is false→
5
←
Taking false branch→
   &size) == -1)
return;
if (dg_badinput((struct sockaddr *)&ss))
6
←
Taking false branch→
return;

if ((len = endring - rs) >= LINESIZ72)
7
←
Assuming the condition is true→
8
←
Taking true branch→
memmove(text, rs, LINESIZ72);
9
←
Null pointer passed as 2nd argument to memory copy function
else {
memmove(text, rs, len);
memmove(text + len, ring, LINESIZ72 - len);
}
if (++rs == endring)
rs = ring;
text[LINESIZ72] = '\r';
text[LINESIZ72 + 1] = '\n';
(void) sendto(s, text, sizeof(text), 0, (struct sockaddr *)&ss, size);
1571}

1573/*
* Return a machine readable date and time, in the form of the
* number of seconds since midnight, Jan 1, 1900.  Since gettimeofday
* returns the number of seconds since midnight, Jan 1, 1970,
* we must add 2208988800 seconds to this figure to make up for
* some seventy years Bell Labs was asleep.
*/
1580u_int32_t
1581machtime(void)
1582{
struct timeval tv;

if (gettimeofday(&tv, NULL((void *)0)) == -1)
return (0L);

return (htonl((u_int32_t)tv.tv_sec + 2208988800UL)(__uint32_t)(__builtin_constant_p((u_int32_t)tv.tv_sec + 2208988800UL
) ? (__uint32_t)(((__uint32_t)((u_int32_t)tv.tv_sec + 2208988800UL
) & 0xff) << 24 | ((__uint32_t)((u_int32_t)tv.tv_sec
 + 2208988800UL) & 0xff00) << 8 | ((__uint32_t)((u_int32_t
)tv.tv_sec + 2208988800UL) & 0xff0000) >> 8 | ((__uint32_t
)((u_int32_t)tv.tv_sec + 2208988800UL) & 0xff000000) >>
 24) : __swap32md((u_int32_t)tv.tv_sec + 2208988800UL)));
1589}

1591void
1592machtime_stream(int s, struct servtab *sep)
1593{
u_int32_t result;

result = machtime();
(void) write(s, &result, sizeof(result));
1598}

1600void
1601machtime_dg(int s, struct servtab *sep)
1602{
u_int32_t result;
struct sockaddr_storage ss;
socklen_t size;

size = sizeof(ss);
if (recvfrom(s, &result, sizeof(result), 0,
   (struct sockaddr *)&ss, &size) == -1)
return;
if (dg_badinput((struct sockaddr *)&ss))
return;
result = machtime();
(void) sendto(s, &result, sizeof(result), 0,
   (struct sockaddr *)&ss, size);
1616}

1618/* Return human-readable time of day */
1619void
1620daytime_stream(int s, struct servtab *sep)
1621{
char buffer[256];
time_t clock;

clock = time(NULL((void *)0));

(void) snprintf(buffer, sizeof buffer, "%.24s\r\n", ctime(&clock));
(void) write(s, buffer, strlen(buffer));
1629}

1631/* Return human-readable time of day */
1632void
1633daytime_dg(int s, struct servtab *sep)
1634{
char buffer[256];
time_t clock;
struct sockaddr_storage ss;
socklen_t size;

clock = time(NULL((void *)0));

size = sizeof(ss);
if (recvfrom(s, buffer, sizeof(buffer), 0, (struct sockaddr *)&ss,
   &size) == -1)
return;
if (dg_badinput((struct sockaddr *)&ss))
return;
(void) snprintf(buffer, sizeof buffer, "%.24s\r\n", ctime(&clock));
(void) sendto(s, buffer, strlen(buffer), 0, (struct sockaddr *)&ss,
   size);
1651}

1653/*
* print_service:
*	Dump relevant information to stderr
*/
1657void
1658print_service(char *action, struct servtab *sep)
1659{
if (strcmp(sep->se_hostaddr, "*") == 0)
fprintf(stderr(&__sF[2]), "%s: %s ", action, sep->se_service);
else
fprintf(stderr(&__sF[2]), "%s: %s:%s ", action, sep->se_hostaddr,
    sep->se_service);

if (isrpcservice(sep)((sep)->se_rpcversl != 0))
fprintf(stderr(&__sF[2]), "rpcprog=%d, rpcvers=%d/%d, proto=%s,",
    sep->se_rpcprog, sep->se_rpcversh,
    sep->se_rpcversl, sep->se_proto);
else
fprintf(stderr(&__sF[2]), "proto=%s,", sep->se_proto);

fprintf(stderr(&__sF[2]),
   " wait.max=%d.%d user:group=%s:%s builtin=%lx server=%s\n",
   sep->se_wait, sep->se_max, sep->se_user,
   sep->se_group ? sep->se_group : "wheel",
   (long)sep->se_bi, sep->se_server);
1678}

1680void
1681spawn(int ctrl, short events, void *xsep)
1682{
struct servtab *sep = xsep;
struct passwd *pwd;
int tmpint, dofork;
struct group *grp = NULL((void *)0);
char buf[50];
pid_t pid;

if (debug)
fprintf(stderr(&__sF[2]), "someone wants %s\n", sep->se_service);

pid = 0;
dofork = (sep->se_bi == 0 || sep->se_bi->bi_fork);
if (dofork) {
if (sep->se_count++ == 0)
    (void)gettimeofday(&sep->se_time, NULL((void *)0));
else if (sep->se_count >= sep->se_max) {
	struct timeval now;

	(void)gettimeofday(&now, NULL((void *)0));
	if (now.tv_sec - sep->se_time.tv_sec >
	    CNT_INTVL60) {
		sep->se_time = now;
		sep->se_count = 1;
	} else {
		if (!sep->se_wait &&
		    sep->se_socktype == SOCK_STREAM1)
			close(ctrl);
		if (sep->se_family == AF_INET2 &&
		    ntohs(sep->se_ctrladdr_in.sin_port)(__uint16_t)(__builtin_constant_p(sep->se_un.se_un_ctrladdr_in
.sin_port) ? (__uint16_t)(((__uint16_t)(sep->se_un.se_un_ctrladdr_in
.sin_port) & 0xffU) << 8 | ((__uint16_t)(sep->se_un
.se_un_ctrladdr_in.sin_port) & 0xff00U) >> 8) : __swap16md
(sep->se_un.se_un_ctrladdr_in.sin_port)) >=
		    IPPORT_RESERVED1024) {
			/*
			 * Cannot close it -- there are
			 * thieves on the system.
			 * Simply ignore the connection.
			 */
			--sep->se_count;
			return;
		}
		syslog(LOG_ERR3,
		    "%s/%s server failing (looping), service terminated",
		    sep->se_service, sep->se_proto);
		if (!sep->se_wait &&
		    sep->se_socktype == SOCK_STREAM1)
			close(ctrl);
		event_del(&sep->se_event);
		(void) close(sep->se_fd);

		sep->se_fd = -1;
		sep->se_count = 0;
		if (!timingout) {
			timingout = 1;
			alarm(RETRYTIME(60*10));
		}
		return;
	}
}
pid = fork();
}
if (pid == -1) {
syslog(LOG_ERR3, "fork: %m");
if (!sep->se_wait && sep->se_socktype == SOCK_STREAM1)
	close(ctrl);
sleep(1);
return;
}

if (pid && sep->se_wait) {
sep->se_wait = pid;
event_del(&sep->se_event);
}
if (pid == 0) {
if (sep->se_bi) {
	if (dofork && pledge("stdio inet", NULL((void *)0)) == -1)
		err(1, "pledge");
	(*sep->se_bi->bi_fn)(ctrl, sep);
} else {
	if ((pwd = getpwnam(sep->se_user)) == NULL((void *)0)) {
		syslog(LOG_ERR3,
		    "getpwnam: %s: No such user",
		    sep->se_user);
		if (sep->se_socktype != SOCK_STREAM1)
			recv(0, buf, sizeof (buf), 0);
		exit(1);
	}
	if (setsid() <0)
		syslog(LOG_ERR3, "%s: setsid: %m",
		    sep->se_service);
	if (sep->se_group &&
	    (grp = getgrnam(sep->se_group)) == NULL((void *)0)) {
		syslog(LOG_ERR3,
		    "getgrnam: %s: No such group",
		    sep->se_group);
		if (sep->se_socktype != SOCK_STREAM1)
			recv(0, buf, sizeof (buf), 0);
		exit(1);
	}
	if (uid != 0) {
		/* a user running private inetd */
		if (uid != pwd->pw_uid)
			exit(1);
	} else {
		tmpint = LOGIN_SETALL0x01ff &
		    ~(LOGIN_SETGROUP0x0001|LOGIN_SETLOGIN0x0002);
		if (pwd->pw_uid)
			tmpint |= LOGIN_SETGROUP0x0001|LOGIN_SETLOGIN0x0002;
		if (sep->se_group) {
			pwd->pw_gid = grp->gr_gid;
			tmpint |= LOGIN_SETGROUP0x0001;
		}
		if (setusercontext(NULL((void *)0), pwd, pwd->pw_uid,
		    tmpint) == -1) {
			syslog(LOG_ERR3,
			    "%s/%s: setusercontext: %m",
			    sep->se_service, sep->se_proto);
			exit(1);
		}
	}
	if (debug)
		fprintf(stderr(&__sF[2]), "%ld execv %s\n",
		    (long)getpid(), sep->se_server);
	if (ctrl != STDIN_FILENO0) {
		dup2(ctrl, STDIN_FILENO0);
		close(ctrl);
	}
	dup2(STDIN_FILENO0, STDOUT_FILENO1);
	dup2(STDIN_FILENO0, STDERR_FILENO2);
	closelog();
	closefrom(3);
	signal(SIGPIPE13, SIG_DFL(void (*)(int))0);
	execv(sep->se_server, sep->se_argv);
	if (sep->se_socktype != SOCK_STREAM1)
		recv(0, buf, sizeof (buf), 0);
	syslog(LOG_ERR3, "execv %s: %m", sep->se_server);
	exit(1);
}
}
if (!sep->se_wait && sep->se_socktype == SOCK_STREAM1)
close(ctrl);
1821}