File 01-legacy.patch of Package pidentd

Overview Repositories Revisions Requests Users Attributes Meta

File 01-legacy.patch of Package pidentd (Revision d5786c5f08d42a9bcdf4c216b7dc878a)

Currently displaying revision d5786c5f08d42a9bcdf4c216b7dc878a , Show latest

Index: pidentd-3.0.19.ds1/INSTALL
===================================================================
--- pidentd-3.0.19.ds1.orig/INSTALL
+++ pidentd-3.0.19.ds1/INSTALL
@@ -75,7 +75,7 @@ The libcrypto library included with his
 
 	ftp://ftp.psy.uq.oz.au/pub/Crypto/SSL/SSLeay-x.y.z.tar.gz
 
-The libcrypto library is actually the prefered one since it includes
+The libcrypto library is actually the preferred one since it includes
 a good random DES key generator which is used (if found) by the
 Ikeygen program.
 
Index: pidentd-3.0.19.ds1/etc/identd.conf
===================================================================
--- pidentd-3.0.19.ds1.orig/etc/identd.conf
+++ pidentd-3.0.19.ds1/etc/identd.conf
@@ -1,4 +1,4 @@
-# /usr/local/etc/identd.conf - an example configuration file
+# /etc/identd.conf - an example configuration file
 
 
 #-- The syslog facility for error messages
@@ -18,7 +18,7 @@ server:user = nobody
 # server:backlog = 256
 
 #-- Where to write the file containing our process id
-# server:pid-file = "/etc/identd.pid"
+# server:pid-file = "/var/run/identd/identd.pid"
 
 #-- Maximum number of concurrent requests allowed (0 = unlimited)
 # server:max-requests = 0
@@ -28,7 +28,7 @@ server:user = nobody
 #-- Enable some protocol extensions like "VERSION" or "QUIT"
 protocol:extensions = enabled
 
-#-- Allow multiple queries per connection. This slightly breaks RFC1413
+#-- Allow multiple queries per connection
 protocol:multiquery = enabled
 
 #-- Timeout in seconds since connection or last query. Zero = disable
Index: pidentd-3.0.19.ds1/doc/identd.8
===================================================================
--- pidentd-3.0.19.ds1.orig/doc/identd.8
+++ pidentd-3.0.19.ds1/doc/identd.8
@@ -2,11 +2,11 @@
 .\" Copyright (c) 1992-1999 Peter Eriksson, Lysator, Linkoping University.
 .\" This manual page is released into the public domain."
 .\"
-.TH identd 1 "8 Jan 1999"
+.TH identd 8 "8 Jan 1999"
 .SH NAME
-identd, in.identd \- TCP/IP IDENT protocol server
+identd \- TCP/IP IDENT protocol server
 .SH SYNOPSIS
-.B [in.]identd [options]
+.B identd [options]
 .SH DESCRIPTION
 .IX "identd daemon" "" \fLidentd\fP daemon"
 .B Identd
@@ -111,7 +111,7 @@ wish to keep the user names a secret).
 Directs
 .B identd
 to check for a file ".noident" in each home directory for the user which
-the daemon is about to return the user name for. It that file exists then
+the daemon is about to return the user name for. If that file exists then
 the daemon will give the error
 .B HIDDEN-USER
 instead of the normal USERID response.
@@ -134,7 +134,7 @@ processed per session. Each request is s
 the responses will be returned one per line. The connection will not
 be closed until the connecting part closes it's end of the line.
 .SH INSTALLATION
-The prefered way to start
+The preferred way to start
 .B identd
 depends on how it was built.
 .PP
@@ -193,7 +193,9 @@ The configuration file contains a list o
 pairs.
 .TP 10
 .B syslog:facility = FACILITY
-Set which facility to use when sending syslog messages.
+Set which facility to use when sending syslog messages.  See
+.BR syslog.conf (5)
+for more information.
 .TP 10
 .B server:user = USER
 Set what user (and group, from the passwd database) the daemon
@@ -254,8 +256,10 @@ Define the character set returned in rep
 Define the operating system returned in replies. Default: "UNIX"
 .TP 10
 .B result:syslog-level = LEVEL
-If set to anything other than "none", all request replies till
-be sent to the syslog service with the specificed severity level.
+If set to anything other than "none", all requested replies will
+be sent to the syslog service with the specified severity level.  See
+.BR syslog.conf (5)
+for more information.
 Default: none
 .TP 10
 .B result:encrypt = YES/NO
@@ -287,16 +291,16 @@ returns info for outgoing connections, n
 Contains the default configuration options for
 .B identd.
 .TP
-.B /etc/identd.pid
-Contains (if enabled) the process number of the
-.B identd
-daemon.
-.TP
 .B /etc/identd.key
 If compiled with
 .I DES
 encryption enabled, the 1024 first bytes of this file is used to specify
 the secret key for encrypting replies.
+.TP
+.B /var/run/identd/identd.pid
+Contains (if enabled) the process number of the
+.B identd
+daemon.
 .SH AVAILABILITY
 The daemon is free software. You can redistribute it and/or
 modify it as you wish - as long as you don't claim that you wrote
@@ -320,7 +324,5 @@ The author can be contacted at:
 ,
 .BR ikeygen (8)
 ,
-.BR authuser (3)
-,
 .BR inetd.conf (5)
 ,
Index: pidentd-3.0.19.ds1/src/request.c
===================================================================
--- pidentd-3.0.19.ds1.orig/src/request.c
+++ pidentd-3.0.19.ds1/src/request.c
@@ -98,6 +98,13 @@ handle_request(int fd,
 	
 	switch (kp->status)
 	{
+	  case 2:
+	    send_error(fd,
+		       local_port, remote_port,
+		       "HIDDEN-USER",
+		       remote_addr);
+	    break;
+
 	  case 1:
 	    send_result(fd, kp);
 	    break;
@@ -188,8 +195,9 @@ request_thread(void *vp)
 	got = s_read(rp->fd, buf+len, sizeof(buf)-len-1);
 	if (got < 0)
 	{
-	    syslog(LOG_ERR, "request_thread: read(%d, ..., %d) failed: %m",
-		   rp->fd, sizeof(buf)-len-1);
+	    if (debug)
+		fprintf(stderr, "request_thread: read(%d, ..., %d) failed: %s",
+			rp->fd, sizeof(buf)-len-1, strerror(errno));
 	    goto Exit;
 	}
 
Index: pidentd-3.0.19.ds1/src/safeio.c
===================================================================
--- pidentd-3.0.19.ds1.orig/src/safeio.c
+++ pidentd-3.0.19.ds1/src/safeio.c
@@ -327,3 +327,18 @@ s_snprintf(char *buf,
 
     return retcode;
 }
+
+
+
+int
+s_poll(struct pollfd *ufds,
+       unsigned int nfds,
+       int timeout)
+{
+    int code;
+
+    while ((code = poll(ufds, nfds, timeout)) == -1 && errno == EINTR)
+	;
+
+    return code;
+}
Index: pidentd-3.0.19.ds1/src/safeio.h
===================================================================
--- pidentd-3.0.19.ds1.orig/src/safeio.h
+++ pidentd-3.0.19.ds1/src/safeio.h
@@ -15,6 +15,8 @@
 #ifndef PIDENTD_SAFEIO_H
 #define PIDENTD_SAFEIO_H
 
+#include <sys/poll.h>
+
 extern void s_abort(void);
 
 extern int s_open(const char *path, int oflag, ...);
@@ -37,4 +39,5 @@ extern int s_snprintf(char *buf,
 		      size_t bufsize,
 		      const char *format, ...);
 
+extern int s_poll(struct pollfd *, unsigned int, int);
 #endif
Index: pidentd-3.0.19.ds1/src/main.c
===================================================================
--- pidentd-3.0.19.ds1.orig/src/main.c
+++ pidentd-3.0.19.ds1/src/main.c
@@ -377,7 +377,12 @@ main(int argc, char *argv[])
     {
 	if (!debug && pidfile_path != NULL)
 	    pidfile_create(pidfile_path);
-	
+
+	if (listen_sock < 0)
+	{
+	    request_timeout = 0;
+	}
+
 	if (server_init() < 0)
 	{
 	    if (debug)
Index: pidentd-3.0.19.ds1/src/server.c
===================================================================
--- pidentd-3.0.19.ds1.orig/src/server.c
+++ pidentd-3.0.19.ds1/src/server.c
@@ -15,11 +15,14 @@
 #include "config.h"
 
 #include <syslog.h>
+#include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/time.h>
 #include <sys/resource.h>
 #include <errno.h>
+#include <unistd.h>
+#include <fcntl.h>
 
 #include "pidentd.h"
 
@@ -115,10 +118,29 @@ server_init(void)
 int
 server_run(void)
 {
+    struct pollfd ufds[1];
     int fd;
-    
+    int timeout = request_timeout <= 0 ? -1 : request_timeout * 1000;
+    int retval;
+
+    if (fcntl(listen_sock, F_SETFL, O_NONBLOCK) == -1)
+    {
+	syslog(LOG_ERR, "fcntl() failed: %m");
+	return -1;
+    }
+
+    ufds[0].fd = listen_sock;
+    ufds[0].events = POLLIN;
     while (1)
     {
+	if ((retval = s_poll(ufds, 1, timeout)) == -1)
+	{
+	    syslog(LOG_ERR, "poll() failed: %m");
+	    return -1;
+	}
+	else if (retval == 0)
+	    break;
+
 	fd = s_accept(listen_sock, NULL, NULL);
 	if (fd < 0)
 	{
@@ -139,4 +161,8 @@ server_run(void)
 
 	request_run(fd, 0);
     }
+
+    if (debug)
+	fprintf(stderr, "accept() timed out\n");
+    exit(0);
 }
Index: pidentd-3.0.19.ds1/src/pidentd.h
===================================================================
--- pidentd-3.0.19.ds1.orig/src/pidentd.h
+++ pidentd-3.0.19.ds1/src/pidentd.h
@@ -42,7 +42,7 @@
 #endif
 
 #ifndef PATH_PIDFILE
-#define PATH_PIDFILE "/etc/identd.pid"
+#define PATH_PIDFILE "/var/run/identd/identd.pid"
 #endif
 
 #ifndef PATH_CFGFILE
Index: pidentd-3.0.19.ds1/src/k_linux.c
===================================================================
--- pidentd-3.0.19.ds1.orig/src/k_linux.c
+++ pidentd-3.0.19.ds1/src/k_linux.c
@@ -17,15 +17,28 @@
 #include <stdio.h>
 #include <syslog.h>
 #include <errno.h>
+#include <unistd.h>
 
 #include <sys/types.h>
 #include <sys/param.h>
 #include <sys/socket.h>
 #include <netinet/in.h>
+#include <netinet/tcp.h>
 #include <arpa/inet.h>
 
+#include <linux/types.h>
+#include <linux/netlink.h>
+#include <linux/inet_diag.h>
+
 #include "pidentd.h"
 
+struct kainfo
+{
+    int nlfd;
+    __u32 seq;
+    FILE *proc_net_tcp;
+};
+
 /*
 ** Make sure we are running on a supported OS version
 */
@@ -39,23 +52,85 @@ ka_init(void)
 int
 ka_open(void **misc)
 {
-    FILE *fp;
+    struct kainfo *kp;
+
+    kp = s_malloc(sizeof(*kp));
 
+    kp->seq = 0;
+    kp->nlfd = socket(AF_NETLINK, SOCK_DGRAM, NETLINK_INET_DIAG);
+    if (kp->nlfd >= 0)
+	goto out;
     
-    while ((fp = fopen("/proc/net/tcp", "r")) == NULL && errno == EINTR)
-	;
+    syslog(LOG_INFO, "netlink failed, fallback to /proc/net/tcp: %m");
+    kp->proc_net_tcp = fopen("/proc/net/tcp", "r");
     
-    if (fp == NULL)
+    if (kp->proc_net_tcp == NULL)
     {
 	syslog(LOG_ERR, "fopen(\"/proc/net/tcp\", \"r\"): %m");
 	return -1;
     }
 
-    *misc = (void *) fp;
+out:
+    *misc = (void *) kp;
     return 0;
 }
 
 
+static int
+netlink_lookup(struct kainfo *kip, struct kernel *kp)
+{
+    int status;
+    struct {
+	struct nlmsghdr nlh;
+	union {
+		struct inet_diag_req req;
+		struct inet_diag_msg rsp;
+	} u;
+    } buf;
+    struct sockaddr_nl addr;
+
+    memset(&buf, 0, sizeof(buf));
+    buf.nlh.nlmsg_len = NLMSG_ALIGN(NLMSG_LENGTH(sizeof(buf.u.req)));
+    buf.nlh.nlmsg_type = TCPDIAG_GETSOCK;
+    buf.nlh.nlmsg_flags = NLM_F_REQUEST;
+    buf.nlh.nlmsg_seq = ++kip->seq;
+    buf.u.req.idiag_family = AF_INET;
+
+    buf.u.req.id.idiag_dport = kp->remote.sin_port;
+    buf.u.req.id.idiag_sport = kp->local.sin_port;
+    buf.u.req.id.idiag_dst[0] = kp->remote.sin_addr.s_addr;
+    buf.u.req.id.idiag_src[0] = kp->local.sin_addr.s_addr;
+    buf.u.req.id.idiag_cookie[0] = INET_DIAG_NOCOOKIE;
+    buf.u.req.id.idiag_cookie[1] = INET_DIAG_NOCOOKIE;
+
+    status = write(kip->nlfd, &buf, buf.nlh.nlmsg_len);
+    if (status < 0) {
+	syslog(LOG_ERR, "netlink_lookup: write failed: %m");
+	return 3;
+    }
+
+    do {
+	socklen_t alen = sizeof(addr);
+	status = recvfrom(kip->nlfd, &buf, sizeof(buf), 0,
+	 			(void *)&addr, &alen);
+	if (status < 0) {
+	    if (errno == ENOBUFS)
+		return -1;
+	    syslog(LOG_ERR, "netlink_lookup: recvfrom failed: %m");
+	    return 3;
+	}
+    } while (addr.nl_pid || buf.nlh.nlmsg_seq != kip->seq);
+
+    if (buf.nlh.nlmsg_type != TCPDIAG_GETSOCK)
+	return 0;
+    if (buf.u.rsp.idiag_state != TCP_ESTABLISHED)
+	return 0;
+
+    kp->euid = buf.u.rsp.idiag_uid;
+    return 1;
+}
+
+
 int 
 ka_lookup(void *vp, struct kernel *kp)
 {
@@ -66,6 +141,9 @@ ka_lookup(void *vp, struct kernel *kp)
     int r_lport, r_rport, mylport, myrport;
     int euid;
     int nra;
+    int status;
+    unsigned long ino;
+    struct kainfo *kip;
     
 /*
  * PSz 11 Dec 02
@@ -94,23 +172,28 @@ ka_lookup(void *vp, struct kernel *kp)
  * 
  * Should we skip lines with just ino, or both uid and ino, zero?
  */
-    unsigned long int ino;
 
-    
+
+    kip = (struct kainfo *)vp;
+    kp->ruid = NO_UID;
+
+    if (kip->nlfd >= 0)
+	return netlink_lookup(kip, kp);
+
     r_rport = ntohs(kp->remote.sin_port);
     r_lport = ntohs(kp->local.sin_port);
     r_raddr = kp->remote.sin_addr.s_addr;
     r_laddr = kp->local.sin_addr.s_addr;
 
-    fp = (FILE *) vp;
+    fp = kip->proc_net_tcp;
 
-    kp->ruid = NO_UID;
     rewind(fp);
 
     /* eat header */
     if (fgets(buf, sizeof(buf)-1,fp) == NULL)
 	return -1;
 
+    status = 0;
     while (fgets(buf, sizeof(buf)-1, fp) != NULL)
     {
 	nra = sscanf(buf, "%d: %lX:%x %lX:%x %x %lX:%lX %x:%lX %lx %d %ld %lu",
@@ -119,9 +202,10 @@ ka_lookup(void *vp, struct kernel *kp)
 		     &euid, &dummy, &ino);
 	if (nra >= 12)
 	{
-	    if (myladdr == r_laddr && mylport == r_lport &&
-		myraddr == r_raddr && myrport == r_rport)
+	    if (myladdr == r_laddr && mylport == r_lport)
 	    {
+		if (myraddr != r_raddr || myrport != r_rport || !ino)
+		    continue;
 		if (nra >= 14 && euid == 0 && ino == 0) {
 		  /*
 		   * Both uid and ino are zero: not even a socket?
@@ -131,11 +215,11 @@ ka_lookup(void *vp, struct kernel *kp)
 		  continue;
 		}
 		kp->euid = euid;
-		return 1;
+		status = 1;
 	    }
 	}
     }
 
-    return -1;
+    return status;
 }
 
Index: pidentd-3.0.19.ds1/src/kernel.c
===================================================================
--- pidentd-3.0.19.ds1.orig/src/kernel.c
+++ pidentd-3.0.19.ds1/src/kernel.c
@@ -107,7 +107,7 @@ kernel_thread(void *vp)
 	    if (debug)
 		fprintf(stderr, "ka_lookup(), attempt = %d, status = %d\n",
 			attempt, kp->status);
-	    if (kp->status > 0)
+	    if (kp->status >= 0)
 		break;
 
 	    if (attempt > 2 && (attempt & 1) == 1)

Places

File 01-legacy.patch of Package pidentd (Revision d5786c5f08d42a9bcdf4c216b7dc878a)

Places