From owner-freebsd-bugs Sun Nov 22 13:09:59 1998 Return-Path: Received: (from majordom@localhost) by hub.freebsd.org (8.8.8/8.8.8) id NAA12923 for freebsd-bugs-outgoing; Sun, 22 Nov 1998 13:09:59 -0800 (PST) (envelope-from owner-freebsd-bugs@FreeBSD.ORG) Received: from freefall.freebsd.org (freefall.FreeBSD.ORG [204.216.27.21]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id NAA12900 for ; Sun, 22 Nov 1998 13:09:56 -0800 (PST) (envelope-from gnats@FreeBSD.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.8.8/8.8.5) id NAA25619; Sun, 22 Nov 1998 13:10:01 -0800 (PST) Received: from post.mail.demon.net (post-11.mail.demon.net [194.217.242.40]) by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id NAA12565 for ; Sun, 22 Nov 1998 13:06:03 -0800 (PST) (envelope-from dmlb@ragnet.demon.co.uk) Received: from [158.152.46.40] (helo=ragnet.demon.co.uk) by post.mail.demon.net with smtp (Exim 2.053 #1) id 0zhghD-0004ml-00 for FreeBSD-gnats-submit@freebsd.org; Sun, 22 Nov 1998 21:05:28 +0000 Received: from dmlb by ragnet.demon.co.uk with local (Exim 1.82 #1) id 0zhgUw-0000CB-00; Sun, 22 Nov 1998 20:52:46 +0000 Message-Id: Date: Sun, 22 Nov 1998 20:52:46 +0000 From: dmlb@ragnet.demon.co.uk Reply-To: dmlb@ragnet.demon.co.uk To: FreeBSD-gnats-submit@FreeBSD.ORG Cc: dmlb@ragnet.demon.co.uk X-Send-Pr-Version: 3.2 Subject: kern/8798: Patches to make mount_portal work. Sender: owner-freebsd-bugs@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org >Number: 8798 >Category: kern >Synopsis: Bug to to portal code. >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sun Nov 22 13:10:01 PST 1998 >Last-Modified: >Originator: Duncan Barclay >Organization: >Release: FreeBSD 3.0-CURRENT i386 >Environment: -current >Description: mount_portal is broken, when run and an attempt is made to open a socket with $ cat /p/tcp/localhost/daytime an error will occur. This is due to bugs in the call to sendmsg in send_reply(), activate.c. There is also a security issue in pt_tcp.c and opening privilaged ports. I think the whole code is bogus but will submit another pr dealing with it. >How-To-Repeat: $ mount_portal /etc/portal.conf /p $ cat /p/tcp/localhost/daytime Nov 22 11:07:54 computer portald[4459]: send: Invalid argument >Fix: Patches included below, diff'd against current CVSup'd 06:30 22/11/98. They may not link as I haven't included pt_tcplisten.c in this pr. Will be following. Index: Makefile =================================================================== RCS file: /ide0.e/ncvs/src/sbin/mount_portal/Makefile,v retrieving revision 1.8 diff -u -r1.8 Makefile --- Makefile 1998/01/20 10:40:04 1.8 +++ Makefile 1998/11/22 16:59:32 @@ -3,7 +3,7 @@ PROG= mount_portal SRCS= mount_portal.c activate.c conf.c getmntopts.c pt_conf.c \ - pt_exec.c pt_file.c pt_tcp.c + pt_exec.c pt_file.c pt_tcp.c MAN8= mount_portal.8 MOUNT= ${.CURDIR}/../mount Index: activate.c =================================================================== RCS file: /ide0.e/ncvs/src/sbin/mount_portal/activate.c,v retrieving revision 1.5 diff -u -r1.5 activate.c --- activate.c 1998/07/06 07:19:23 1.5 +++ activate.c 1998/11/22 20:40:05 @@ -45,6 +45,9 @@ #include #include #include +#ifdef DEBUG +#include +#endif /* DEBUG */ #include #include #include @@ -111,7 +114,7 @@ int error; { int n; - struct iovec iov; + struct iovec iov[1]; struct msghdr msg; struct { struct cmsghdr cmsg; @@ -122,15 +125,17 @@ * Line up error code. Don't worry about byte ordering * because we must be sending to the local machine. */ - iov.iov_base = (caddr_t) &error; - iov.iov_len = sizeof(error); + iov[0].iov_base = (caddr_t) &error; + iov[0].iov_len = sizeof(error); /* * Build a msghdr */ memset(&msg, 0, sizeof(msg)); - msg.msg_iov = &iov; + msg.msg_iov = iov; msg.msg_iovlen = 1; + msg.msg_name = NULL; + msg.msg_namelen = 0; /* * If there is a file descriptor to send then @@ -148,7 +153,7 @@ /* * Send to kernel... */ - if ((n = sendmsg(so, &msg, MSG_EOR)) < 0) + if ((n = sendmsg(so, &msg, 0)) < 0) syslog(LOG_ERR, "send: %s", strerror(errno)); #ifdef DEBUG fprintf(stderr, "sent %d bytes\n", n); @@ -206,6 +211,10 @@ error = ENOENT; } +#ifdef DEBUG + fprintf(stderr, "returning fd = %d\n", fd); + fprintf(stderr, " error = %d [%s]\n", error, strerror(error)); +#endif DEBUG if (error >= 0) send_reply(so, fd, error); Index: mount_portal.8 =================================================================== RCS file: /ide0.e/ncvs/src/sbin/mount_portal/mount_portal.8,v retrieving revision 1.3 diff -u -r1.3 mount_portal.8 --- mount_portal.8 1998/07/06 07:19:25 1.3 +++ mount_portal.8 1998/11/22 17:05:05 @@ -89,11 +89,22 @@ By convention, the portal daemon divides the namespace into sub-namespaces, each of which handles objects of a particular type. .Pp -Currently, two sub-namespaces are implemented: +Currently, three sub-namespaces are implemented: +.Pa tcplisten , .Pa tcp and .Pa fs . The +.Pa tcplisten +namespace takes a slash separated hostname and port and creates a TCP/IP +socket bound to the given hostname-port pair. The hostname may be +specified as "ANY" to allow any other host to connect to the socket. A +port number of 0 will dynamically allocate a port, this can be +discovered by calling +.Xr getsockname 8 +with the returned file descriptor. Privilaged ports can only be bound to +by the super-user. +The .Pa tcp namespace takes a hostname and a port (slash separated) and creates an open TCP/IP connection. @@ -116,6 +127,7 @@ Subsequent fields are passed to the creation function. .Bd -literal # @(#)portal.conf 5.1 (Berkeley) 7/13/92 +tcplisten/ tcplisten tcplisten/ tcp/ tcp tcp/ fs/ file fs/ .Ed Index: mount_portal.c =================================================================== RCS file: /ide0.e/ncvs/src/sbin/mount_portal/mount_portal.c,v retrieving revision 1.13 diff -u -r1.13 mount_portal.c --- mount_portal.c 1998/07/06 07:19:25 1.13 +++ mount_portal.c 1998/11/22 17:05:53 @@ -190,7 +190,9 @@ /* * Everything is ready to go - now is a good time to fork */ +#ifndef DEBUG daemon(0, 0); +#endif /* * Start logging (and change name) Index: portald.h =================================================================== RCS file: /ide0.e/ncvs/src/sbin/mount_portal/portald.h,v retrieving revision 1.3 diff -u -r1.3 portald.h --- portald.h 1997/02/22 14:32:55 1.3 +++ portald.h 1998/11/22 17:06:52 @@ -73,6 +73,8 @@ char *key, char **v, int so, int *fdp)); extern int portal_tcp __P((struct portal_cred *, char *key, char **v, int so, int *fdp)); +extern int portal_tcplisten __P((struct portal_cred *, + char *key, char **v, int so, int *fdp)); /* * Global functions Index: pt_conf.c =================================================================== RCS file: /ide0.e/ncvs/src/sbin/mount_portal/pt_conf.c,v retrieving revision 1.4 diff -u -r1.4 pt_conf.c --- pt_conf.c 1998/07/06 07:19:25 1.4 +++ pt_conf.c 1998/11/22 17:07:19 @@ -50,5 +50,6 @@ { "exec", portal_exec }, { "file", portal_file }, { "tcp", portal_tcp }, + { "tcplisten", portal_tcplisten }, { 0, 0 } }; Index: pt_file.c =================================================================== RCS file: /ide0.e/ncvs/src/sbin/mount_portal/pt_file.c,v retrieving revision 1.7 diff -u -r1.7 pt_file.c --- pt_file.c 1998/07/06 07:19:26 1.7 +++ pt_file.c 1998/11/22 20:39:51 @@ -46,6 +46,9 @@ #include #include #include +#ifdef DEBUG +#include +#endif /* DEBUG */ #include #include #include Index: pt_tcp.c =================================================================== RCS file: /ide0.e/ncvs/src/sbin/mount_portal/pt_tcp.c,v retrieving revision 1.7 diff -u -r1.7 pt_tcp.c --- pt_tcp.c 1998/07/06 07:19:27 1.7 +++ pt_tcp.c 1998/11/22 17:08:14 @@ -124,9 +124,9 @@ #endif sp = getservbyname(port, "tcp"); - if (sp != NULL) + if (sp != NULL) { s_port = (u_short)sp->s_port; - else { + } else { s_port = strtoul(port, &p, 0); if (s_port == 0 || *p != '\0') return (EINVAL); >Audit-Trail: >Unformatted: To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-bugs" in the body of the message