1*7c478bd9Sstevel@tonic-gate /* 2*7c478bd9Sstevel@tonic-gate * Copyright 2003 Sun Microsystems, Inc. All rights reserved. 3*7c478bd9Sstevel@tonic-gate * Use is subject to license terms. 4*7c478bd9Sstevel@tonic-gate */ 5*7c478bd9Sstevel@tonic-gate 6*7c478bd9Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 7*7c478bd9Sstevel@tonic-gate 8*7c478bd9Sstevel@tonic-gate /* 9*7c478bd9Sstevel@tonic-gate * Copyright (c) 1983 Regents of the University of California. 10*7c478bd9Sstevel@tonic-gate * All rights reserved. The Berkeley software License Agreement 11*7c478bd9Sstevel@tonic-gate * specifies the terms and conditions for redistribution. 12*7c478bd9Sstevel@tonic-gate * 13*7c478bd9Sstevel@tonic-gate */ 14*7c478bd9Sstevel@tonic-gate 15*7c478bd9Sstevel@tonic-gate #define _FILE_OFFSET_BITS 64 16*7c478bd9Sstevel@tonic-gate 17*7c478bd9Sstevel@tonic-gate #include <sys/time.h> 18*7c478bd9Sstevel@tonic-gate #include <sys/types.h> 19*7c478bd9Sstevel@tonic-gate #include <sys/socket.h> 20*7c478bd9Sstevel@tonic-gate #include <sys/ioctl.h> 21*7c478bd9Sstevel@tonic-gate /* just for FIONBIO ... */ 22*7c478bd9Sstevel@tonic-gate #include <sys/filio.h> 23*7c478bd9Sstevel@tonic-gate #include <sys/stat.h> 24*7c478bd9Sstevel@tonic-gate #include <sys/select.h> 25*7c478bd9Sstevel@tonic-gate 26*7c478bd9Sstevel@tonic-gate #include <netinet/in.h> 27*7c478bd9Sstevel@tonic-gate 28*7c478bd9Sstevel@tonic-gate #include <assert.h> 29*7c478bd9Sstevel@tonic-gate #include <fcntl.h> 30*7c478bd9Sstevel@tonic-gate #include <stdlib.h> 31*7c478bd9Sstevel@tonic-gate #include <string.h> 32*7c478bd9Sstevel@tonic-gate #include <unistd.h> 33*7c478bd9Sstevel@tonic-gate #include <stdio.h> 34*7c478bd9Sstevel@tonic-gate #include <errno.h> 35*7c478bd9Sstevel@tonic-gate #include <signal.h> 36*7c478bd9Sstevel@tonic-gate #include <pwd.h> 37*7c478bd9Sstevel@tonic-gate #include <netdb.h> 38*7c478bd9Sstevel@tonic-gate #include <locale.h> 39*7c478bd9Sstevel@tonic-gate #include <priv_utils.h> 40*7c478bd9Sstevel@tonic-gate 41*7c478bd9Sstevel@tonic-gate #include <k5-int.h> 42*7c478bd9Sstevel@tonic-gate #include <profile/prof_int.h> 43*7c478bd9Sstevel@tonic-gate #include <com_err.h> 44*7c478bd9Sstevel@tonic-gate #include <kcmd.h> 45*7c478bd9Sstevel@tonic-gate #include <krb5.h> 46*7c478bd9Sstevel@tonic-gate 47*7c478bd9Sstevel@tonic-gate /* signal disposition - signal handler or SIG_IGN, SIG_ERR, etc. */ 48*7c478bd9Sstevel@tonic-gate typedef void (*sigdisp_t)(int); 49*7c478bd9Sstevel@tonic-gate 50*7c478bd9Sstevel@tonic-gate extern errcode_t profile_get_options_boolean(profile_t, char **, 51*7c478bd9Sstevel@tonic-gate profile_options_boolean *); 52*7c478bd9Sstevel@tonic-gate extern errcode_t profile_get_options_string(profile_t, char **, 53*7c478bd9Sstevel@tonic-gate profile_option_strings *); 54*7c478bd9Sstevel@tonic-gate 55*7c478bd9Sstevel@tonic-gate #define RSH_BUFSIZ (1024 * 50) 56*7c478bd9Sstevel@tonic-gate 57*7c478bd9Sstevel@tonic-gate static char des_inbuf[2 * RSH_BUFSIZ]; /* needs to be > largest read size */ 58*7c478bd9Sstevel@tonic-gate static char des_outbuf[2 * RSH_BUFSIZ]; /* needs to be > largest write size */ 59*7c478bd9Sstevel@tonic-gate static krb5_data desinbuf, desoutbuf; 60*7c478bd9Sstevel@tonic-gate static krb5_encrypt_block eblock; /* eblock for encrypt/decrypt */ 61*7c478bd9Sstevel@tonic-gate static krb5_context bsd_context; 62*7c478bd9Sstevel@tonic-gate static krb5_auth_context auth_context; 63*7c478bd9Sstevel@tonic-gate static krb5_creds *cred; 64*7c478bd9Sstevel@tonic-gate static krb5_keyblock *session_key; 65*7c478bd9Sstevel@tonic-gate 66*7c478bd9Sstevel@tonic-gate static int encrypt_flag; /* Flag set, when encryption is used */ 67*7c478bd9Sstevel@tonic-gate static boolean_t krb5auth_flag; /* Flag set, when KERBEROS is enabled */ 68*7c478bd9Sstevel@tonic-gate static int fflag; /* Flag set, if creds to be fwd'ed via -f */ 69*7c478bd9Sstevel@tonic-gate static int Fflag; /* Flag set, if fwd'able creds to be fwd'ed via -F */ 70*7c478bd9Sstevel@tonic-gate 71*7c478bd9Sstevel@tonic-gate /* Flag set, if -PN / -PO is specified */ 72*7c478bd9Sstevel@tonic-gate static boolean_t rcmdoption_done; 73*7c478bd9Sstevel@tonic-gate 74*7c478bd9Sstevel@tonic-gate /* Flags set, if corres. cmd line options are turned on */ 75*7c478bd9Sstevel@tonic-gate static boolean_t encrypt_done, fwd_done, fwdable_done; 76*7c478bd9Sstevel@tonic-gate 77*7c478bd9Sstevel@tonic-gate static profile_options_boolean option[] = { 78*7c478bd9Sstevel@tonic-gate { "encrypt", &encrypt_flag, 0 }, 79*7c478bd9Sstevel@tonic-gate { "forward", &fflag, 0 }, 80*7c478bd9Sstevel@tonic-gate { "forwardable", &Fflag, 0 }, 81*7c478bd9Sstevel@tonic-gate { NULL, NULL, 0 } 82*7c478bd9Sstevel@tonic-gate }; 83*7c478bd9Sstevel@tonic-gate 84*7c478bd9Sstevel@tonic-gate static char *rcmdproto; 85*7c478bd9Sstevel@tonic-gate static profile_option_strings rcmdversion[] = { 86*7c478bd9Sstevel@tonic-gate { "rcmd_protocol", &rcmdproto, 0 }, 87*7c478bd9Sstevel@tonic-gate { NULL, NULL, 0 } 88*7c478bd9Sstevel@tonic-gate }; 89*7c478bd9Sstevel@tonic-gate 90*7c478bd9Sstevel@tonic-gate static char *realmdef[] = { "realms", NULL, "rsh", NULL }; 91*7c478bd9Sstevel@tonic-gate static char *appdef[] = { "appdefaults", "rsh", NULL }; 92*7c478bd9Sstevel@tonic-gate 93*7c478bd9Sstevel@tonic-gate static void sendsig(int); 94*7c478bd9Sstevel@tonic-gate static sigdisp_t sigdisp(int); 95*7c478bd9Sstevel@tonic-gate static boolean_t init_service(boolean_t); 96*7c478bd9Sstevel@tonic-gate static int desrshread(int, char *, int); 97*7c478bd9Sstevel@tonic-gate static int desrshwrite(int, char *, int); 98*7c478bd9Sstevel@tonic-gate 99*7c478bd9Sstevel@tonic-gate static int options; 100*7c478bd9Sstevel@tonic-gate static int rfd2; 101*7c478bd9Sstevel@tonic-gate static int portnumber; 102*7c478bd9Sstevel@tonic-gate 103*7c478bd9Sstevel@tonic-gate static const char rlogin_path[] = "/usr/bin/rlogin"; 104*7c478bd9Sstevel@tonic-gate static const char dash_x[] = "-x "; /* Note the blank after -x */ 105*7c478bd9Sstevel@tonic-gate 106*7c478bd9Sstevel@tonic-gate static boolean_t readiv, writeiv; 107*7c478bd9Sstevel@tonic-gate 108*7c478bd9Sstevel@tonic-gate #define set2mask(setp) ((setp)->__sigbits[0]) 109*7c478bd9Sstevel@tonic-gate #define mask2set(mask, setp) \ 110*7c478bd9Sstevel@tonic-gate ((mask) == -1 ? sigfillset(setp) : (set2mask(setp) = (mask))) 111*7c478bd9Sstevel@tonic-gate 112*7c478bd9Sstevel@tonic-gate #ifdef DEBUG 113*7c478bd9Sstevel@tonic-gate #define DEBUGOPTSTRING "D:" 114*7c478bd9Sstevel@tonic-gate #else 115*7c478bd9Sstevel@tonic-gate #define DEBUGOPTSTRING "" 116*7c478bd9Sstevel@tonic-gate #endif /* DEBUG */ 117*7c478bd9Sstevel@tonic-gate 118*7c478bd9Sstevel@tonic-gate static void 119*7c478bd9Sstevel@tonic-gate sigsetmask(int mask) 120*7c478bd9Sstevel@tonic-gate { 121*7c478bd9Sstevel@tonic-gate sigset_t nset; 122*7c478bd9Sstevel@tonic-gate 123*7c478bd9Sstevel@tonic-gate (void) sigprocmask(0, NULL, &nset); 124*7c478bd9Sstevel@tonic-gate mask2set(mask, &nset); 125*7c478bd9Sstevel@tonic-gate (void) sigprocmask(SIG_SETMASK, &nset, NULL); 126*7c478bd9Sstevel@tonic-gate } 127*7c478bd9Sstevel@tonic-gate 128*7c478bd9Sstevel@tonic-gate static int 129*7c478bd9Sstevel@tonic-gate sigblock(int mask) 130*7c478bd9Sstevel@tonic-gate { 131*7c478bd9Sstevel@tonic-gate sigset_t oset; 132*7c478bd9Sstevel@tonic-gate sigset_t nset; 133*7c478bd9Sstevel@tonic-gate 134*7c478bd9Sstevel@tonic-gate (void) sigprocmask(0, NULL, &nset); 135*7c478bd9Sstevel@tonic-gate mask2set(mask, &nset); 136*7c478bd9Sstevel@tonic-gate (void) sigprocmask(SIG_BLOCK, &nset, &oset); 137*7c478bd9Sstevel@tonic-gate return (set2mask(&oset)); 138*7c478bd9Sstevel@tonic-gate } 139*7c478bd9Sstevel@tonic-gate 140*7c478bd9Sstevel@tonic-gate /* 141*7c478bd9Sstevel@tonic-gate * Get signal disposition (or signal handler) for a given signal 142*7c478bd9Sstevel@tonic-gate */ 143*7c478bd9Sstevel@tonic-gate static sigdisp_t 144*7c478bd9Sstevel@tonic-gate sigdisp(int sig) 145*7c478bd9Sstevel@tonic-gate { 146*7c478bd9Sstevel@tonic-gate struct sigaction act; 147*7c478bd9Sstevel@tonic-gate 148*7c478bd9Sstevel@tonic-gate act.sa_handler = NULL; 149*7c478bd9Sstevel@tonic-gate act.sa_flags = 0; 150*7c478bd9Sstevel@tonic-gate (void) sigemptyset(&act.sa_mask); 151*7c478bd9Sstevel@tonic-gate (void) sigaction(sig, NULL, &act); 152*7c478bd9Sstevel@tonic-gate return (act.sa_handler); 153*7c478bd9Sstevel@tonic-gate } 154*7c478bd9Sstevel@tonic-gate 155*7c478bd9Sstevel@tonic-gate static pid_t child_pid = -1; 156*7c478bd9Sstevel@tonic-gate 157*7c478bd9Sstevel@tonic-gate /* 158*7c478bd9Sstevel@tonic-gate * If you do a command like "rsh host output | wc" 159*7c478bd9Sstevel@tonic-gate * and wc terminates, then the parent will receive SIGPIPE 160*7c478bd9Sstevel@tonic-gate * and the child needs to be terminated. 161*7c478bd9Sstevel@tonic-gate */ 162*7c478bd9Sstevel@tonic-gate /* ARGSUSED */ 163*7c478bd9Sstevel@tonic-gate static void 164*7c478bd9Sstevel@tonic-gate sigpipehandler(int signal) 165*7c478bd9Sstevel@tonic-gate { 166*7c478bd9Sstevel@tonic-gate if (child_pid != -1) 167*7c478bd9Sstevel@tonic-gate (void) kill(child_pid, SIGKILL); 168*7c478bd9Sstevel@tonic-gate exit(EXIT_SUCCESS); 169*7c478bd9Sstevel@tonic-gate } 170*7c478bd9Sstevel@tonic-gate 171*7c478bd9Sstevel@tonic-gate #define mask(s) (1 << ((s) - 1)) 172*7c478bd9Sstevel@tonic-gate 173*7c478bd9Sstevel@tonic-gate static void 174*7c478bd9Sstevel@tonic-gate usage(void) { 175*7c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "%s\n%s\n", 176*7c478bd9Sstevel@tonic-gate gettext("usage: rsh [ -PN / -PO ] [ -l login ] [ -n ] " 177*7c478bd9Sstevel@tonic-gate "[ -k realm ] [ -a ] [ -x ] [ -f / -F ] host command"), 178*7c478bd9Sstevel@tonic-gate gettext(" rsh [ -PN / -PO ] [ -l login ] [ -k realm ] " 179*7c478bd9Sstevel@tonic-gate "[ -a ] [ -x ] [ -f / -F ] host")); 180*7c478bd9Sstevel@tonic-gate exit(EXIT_FAILURE); 181*7c478bd9Sstevel@tonic-gate } 182*7c478bd9Sstevel@tonic-gate 183*7c478bd9Sstevel@tonic-gate static void 184*7c478bd9Sstevel@tonic-gate die(const char *message) 185*7c478bd9Sstevel@tonic-gate { 186*7c478bd9Sstevel@tonic-gate (void) fputs(message, stderr); 187*7c478bd9Sstevel@tonic-gate usage(); 188*7c478bd9Sstevel@tonic-gate } 189*7c478bd9Sstevel@tonic-gate 190*7c478bd9Sstevel@tonic-gate static void 191*7c478bd9Sstevel@tonic-gate usage_forward(void) 192*7c478bd9Sstevel@tonic-gate { 193*7c478bd9Sstevel@tonic-gate die(gettext("rsh: Only one of -f and -F allowed.\n")); 194*7c478bd9Sstevel@tonic-gate } 195*7c478bd9Sstevel@tonic-gate 196*7c478bd9Sstevel@tonic-gate /* 197*7c478bd9Sstevel@tonic-gate * rsh - remote shell 198*7c478bd9Sstevel@tonic-gate */ 199*7c478bd9Sstevel@tonic-gate /* VARARGS */ 200*7c478bd9Sstevel@tonic-gate int 201*7c478bd9Sstevel@tonic-gate main(int argc, char **argv) 202*7c478bd9Sstevel@tonic-gate { 203*7c478bd9Sstevel@tonic-gate int c, rem; 204*7c478bd9Sstevel@tonic-gate char *cmd, *cp, **ap, buf[RSH_BUFSIZ], **argv0, *args, *args_no_x; 205*7c478bd9Sstevel@tonic-gate char *host = NULL, *user = NULL; 206*7c478bd9Sstevel@tonic-gate int cc; 207*7c478bd9Sstevel@tonic-gate boolean_t asrsh = B_FALSE; 208*7c478bd9Sstevel@tonic-gate struct passwd *pwd; 209*7c478bd9Sstevel@tonic-gate boolean_t readfrom_rem; 210*7c478bd9Sstevel@tonic-gate boolean_t readfrom_rfd2; 211*7c478bd9Sstevel@tonic-gate int one = 1; 212*7c478bd9Sstevel@tonic-gate int omask; 213*7c478bd9Sstevel@tonic-gate boolean_t nflag = B_FALSE; 214*7c478bd9Sstevel@tonic-gate char *krb_realm = NULL; 215*7c478bd9Sstevel@tonic-gate krb5_flags authopts; 216*7c478bd9Sstevel@tonic-gate krb5_error_code status; 217*7c478bd9Sstevel@tonic-gate enum kcmd_proto kcmd_proto = KCMD_NEW_PROTOCOL; 218*7c478bd9Sstevel@tonic-gate uid_t uid = getuid(); 219*7c478bd9Sstevel@tonic-gate 220*7c478bd9Sstevel@tonic-gate c = (argc + 1) * sizeof (char *); 221*7c478bd9Sstevel@tonic-gate if ((argv0 = malloc(c)) == NULL) { 222*7c478bd9Sstevel@tonic-gate perror("malloc"); 223*7c478bd9Sstevel@tonic-gate return (EXIT_FAILURE); 224*7c478bd9Sstevel@tonic-gate } 225*7c478bd9Sstevel@tonic-gate (void) memcpy(argv0, argv, c); 226*7c478bd9Sstevel@tonic-gate 227*7c478bd9Sstevel@tonic-gate (void) setlocale(LC_ALL, ""); 228*7c478bd9Sstevel@tonic-gate 229*7c478bd9Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN); 230*7c478bd9Sstevel@tonic-gate 231*7c478bd9Sstevel@tonic-gate /* 232*7c478bd9Sstevel@tonic-gate * Determine command name used to invoke to rlogin(1). Users can 233*7c478bd9Sstevel@tonic-gate * create links named by a host pointing to the binary and type 234*7c478bd9Sstevel@tonic-gate * "hostname" to log into that host afterwards. 235*7c478bd9Sstevel@tonic-gate */ 236*7c478bd9Sstevel@tonic-gate cmd = strrchr(argv[0], '/'); 237*7c478bd9Sstevel@tonic-gate cmd = (cmd != NULL) ? (cmd + 1) : argv[0]; 238*7c478bd9Sstevel@tonic-gate 239*7c478bd9Sstevel@tonic-gate /* 240*7c478bd9Sstevel@tonic-gate * Add "remsh" as an alias for "rsh" (System III, V networking 241*7c478bd9Sstevel@tonic-gate * add-ons often used this name for the remote shell since rsh 242*7c478bd9Sstevel@tonic-gate * was already taken for the restricted shell). Note that this 243*7c478bd9Sstevel@tonic-gate * usurps the ability to use "remsh" as the name of a host (by 244*7c478bd9Sstevel@tonic-gate * symlinking it to rsh), so we go one step farther: if the 245*7c478bd9Sstevel@tonic-gate * file "/usr/bin/remsh" does not exist, we behave as if "remsh" 246*7c478bd9Sstevel@tonic-gate * is a host name. If it does exist, we accept "remsh" as an 247*7c478bd9Sstevel@tonic-gate * "rsh" alias. 248*7c478bd9Sstevel@tonic-gate */ 249*7c478bd9Sstevel@tonic-gate if (strcmp(cmd, "remsh") == 0) { 250*7c478bd9Sstevel@tonic-gate struct stat sb; 251*7c478bd9Sstevel@tonic-gate 252*7c478bd9Sstevel@tonic-gate if (stat("/usr/bin/remsh", &sb) < 0) 253*7c478bd9Sstevel@tonic-gate host = cmd; 254*7c478bd9Sstevel@tonic-gate } else if (strcmp(cmd, "rsh") != 0) { 255*7c478bd9Sstevel@tonic-gate host = cmd; 256*7c478bd9Sstevel@tonic-gate } 257*7c478bd9Sstevel@tonic-gate 258*7c478bd9Sstevel@tonic-gate /* Handle legacy synopsis "rsh hostname options [command]". */ 259*7c478bd9Sstevel@tonic-gate if (host == NULL) { 260*7c478bd9Sstevel@tonic-gate if (argc < 2) 261*7c478bd9Sstevel@tonic-gate usage(); 262*7c478bd9Sstevel@tonic-gate if (*argv[1] != '-') { 263*7c478bd9Sstevel@tonic-gate host = argv[1]; 264*7c478bd9Sstevel@tonic-gate argc--; 265*7c478bd9Sstevel@tonic-gate argv[1] = argv[0]; 266*7c478bd9Sstevel@tonic-gate argv++; 267*7c478bd9Sstevel@tonic-gate asrsh = B_TRUE; 268*7c478bd9Sstevel@tonic-gate } 269*7c478bd9Sstevel@tonic-gate } 270*7c478bd9Sstevel@tonic-gate 271*7c478bd9Sstevel@tonic-gate while ((c = getopt(argc, argv, 272*7c478bd9Sstevel@tonic-gate DEBUGOPTSTRING "8AFLP:ade:fk:l:nwx")) != -1) { 273*7c478bd9Sstevel@tonic-gate switch (c) { 274*7c478bd9Sstevel@tonic-gate #ifdef DEBUG 275*7c478bd9Sstevel@tonic-gate case 'D': 276*7c478bd9Sstevel@tonic-gate portnumber = htons(atoi(optarg)); 277*7c478bd9Sstevel@tonic-gate krb5auth_flag = B_TRUE; 278*7c478bd9Sstevel@tonic-gate break; 279*7c478bd9Sstevel@tonic-gate #endif /* DEBUG */ 280*7c478bd9Sstevel@tonic-gate case 'F': 281*7c478bd9Sstevel@tonic-gate if (fflag) 282*7c478bd9Sstevel@tonic-gate usage_forward(); 283*7c478bd9Sstevel@tonic-gate Fflag = 1; 284*7c478bd9Sstevel@tonic-gate krb5auth_flag = B_TRUE; 285*7c478bd9Sstevel@tonic-gate fwdable_done = B_TRUE; 286*7c478bd9Sstevel@tonic-gate break; 287*7c478bd9Sstevel@tonic-gate case 'f': 288*7c478bd9Sstevel@tonic-gate if (Fflag) 289*7c478bd9Sstevel@tonic-gate usage_forward(); 290*7c478bd9Sstevel@tonic-gate fflag = 1; 291*7c478bd9Sstevel@tonic-gate krb5auth_flag = B_TRUE; 292*7c478bd9Sstevel@tonic-gate fwd_done = B_TRUE; 293*7c478bd9Sstevel@tonic-gate break; 294*7c478bd9Sstevel@tonic-gate case 'P': 295*7c478bd9Sstevel@tonic-gate if (strcmp(optarg, "N") == 0) 296*7c478bd9Sstevel@tonic-gate kcmd_proto = KCMD_NEW_PROTOCOL; 297*7c478bd9Sstevel@tonic-gate else if (strcmp(optarg, "O") == 0) 298*7c478bd9Sstevel@tonic-gate kcmd_proto = KCMD_OLD_PROTOCOL; 299*7c478bd9Sstevel@tonic-gate else 300*7c478bd9Sstevel@tonic-gate die(gettext("rsh: Only -PN or -PO " 301*7c478bd9Sstevel@tonic-gate "allowed.\n")); 302*7c478bd9Sstevel@tonic-gate if (rcmdoption_done) 303*7c478bd9Sstevel@tonic-gate die(gettext("rsh: Only one of -PN and -PO " 304*7c478bd9Sstevel@tonic-gate "allowed.\n")); 305*7c478bd9Sstevel@tonic-gate rcmdoption_done = B_TRUE; 306*7c478bd9Sstevel@tonic-gate krb5auth_flag = B_TRUE; 307*7c478bd9Sstevel@tonic-gate break; 308*7c478bd9Sstevel@tonic-gate case 'a': 309*7c478bd9Sstevel@tonic-gate krb5auth_flag = B_TRUE; 310*7c478bd9Sstevel@tonic-gate break; 311*7c478bd9Sstevel@tonic-gate case 'd': 312*7c478bd9Sstevel@tonic-gate options |= SO_DEBUG; 313*7c478bd9Sstevel@tonic-gate break; 314*7c478bd9Sstevel@tonic-gate case 'k': 315*7c478bd9Sstevel@tonic-gate krb_realm = optarg; 316*7c478bd9Sstevel@tonic-gate krb5auth_flag = B_TRUE; 317*7c478bd9Sstevel@tonic-gate break; 318*7c478bd9Sstevel@tonic-gate case 'l': 319*7c478bd9Sstevel@tonic-gate user = optarg; 320*7c478bd9Sstevel@tonic-gate break; 321*7c478bd9Sstevel@tonic-gate case 'n': 322*7c478bd9Sstevel@tonic-gate if (!nflag) { 323*7c478bd9Sstevel@tonic-gate if (close(STDIN_FILENO) < 0) { 324*7c478bd9Sstevel@tonic-gate perror("close"); 325*7c478bd9Sstevel@tonic-gate return (EXIT_FAILURE); 326*7c478bd9Sstevel@tonic-gate } 327*7c478bd9Sstevel@tonic-gate /* 328*7c478bd9Sstevel@tonic-gate * "STDION_FILENO" defined to 0 by POSIX 329*7c478bd9Sstevel@tonic-gate * and hence the lowest file descriptor. 330*7c478bd9Sstevel@tonic-gate * So the open(2) below is guaranteed to 331*7c478bd9Sstevel@tonic-gate * reopen it because we closed it above. 332*7c478bd9Sstevel@tonic-gate */ 333*7c478bd9Sstevel@tonic-gate if (open("/dev/null", O_RDONLY) < 0) { 334*7c478bd9Sstevel@tonic-gate perror("open"); 335*7c478bd9Sstevel@tonic-gate return (EXIT_FAILURE); 336*7c478bd9Sstevel@tonic-gate } 337*7c478bd9Sstevel@tonic-gate nflag = B_TRUE; 338*7c478bd9Sstevel@tonic-gate } 339*7c478bd9Sstevel@tonic-gate break; 340*7c478bd9Sstevel@tonic-gate case 'x': 341*7c478bd9Sstevel@tonic-gate encrypt_flag = 1; 342*7c478bd9Sstevel@tonic-gate krb5auth_flag = B_TRUE; 343*7c478bd9Sstevel@tonic-gate encrypt_done = B_TRUE; 344*7c478bd9Sstevel@tonic-gate break; 345*7c478bd9Sstevel@tonic-gate /* 346*7c478bd9Sstevel@tonic-gate * Ignore the -L, -w, -e and -8 flags to allow aliases with 347*7c478bd9Sstevel@tonic-gate * rlogin to work. Actually rlogin(1) doesn't understand 348*7c478bd9Sstevel@tonic-gate * -w either but because "rsh -w hostname command" used 349*7c478bd9Sstevel@tonic-gate * to work we still accept it. 350*7c478bd9Sstevel@tonic-gate */ 351*7c478bd9Sstevel@tonic-gate case '8': 352*7c478bd9Sstevel@tonic-gate case 'L': 353*7c478bd9Sstevel@tonic-gate case 'e': 354*7c478bd9Sstevel@tonic-gate case 'w': 355*7c478bd9Sstevel@tonic-gate /* 356*7c478bd9Sstevel@tonic-gate * On the lines of the -L, -w, -e and -8 options above, we 357*7c478bd9Sstevel@tonic-gate * ignore the -A option too, in order to allow aliases with 358*7c478bd9Sstevel@tonic-gate * rlogin to work. 359*7c478bd9Sstevel@tonic-gate * 360*7c478bd9Sstevel@tonic-gate * Mind you !, the -a option to trigger Kerberos authentication 361*7c478bd9Sstevel@tonic-gate * in rsh, has a totally different usage in rlogin, its the 362*7c478bd9Sstevel@tonic-gate * -A option (in rlogin) which needs to be used to talk 363*7c478bd9Sstevel@tonic-gate * Kerberos. 364*7c478bd9Sstevel@tonic-gate */ 365*7c478bd9Sstevel@tonic-gate case 'A': 366*7c478bd9Sstevel@tonic-gate break; 367*7c478bd9Sstevel@tonic-gate default: 368*7c478bd9Sstevel@tonic-gate usage(); 369*7c478bd9Sstevel@tonic-gate } 370*7c478bd9Sstevel@tonic-gate } 371*7c478bd9Sstevel@tonic-gate 372*7c478bd9Sstevel@tonic-gate argc -= optind; 373*7c478bd9Sstevel@tonic-gate argv += optind; 374*7c478bd9Sstevel@tonic-gate 375*7c478bd9Sstevel@tonic-gate if (host == NULL) { 376*7c478bd9Sstevel@tonic-gate if (argc == 0) 377*7c478bd9Sstevel@tonic-gate usage(); 378*7c478bd9Sstevel@tonic-gate argc--; 379*7c478bd9Sstevel@tonic-gate host = *argv++; 380*7c478bd9Sstevel@tonic-gate asrsh = B_TRUE; 381*7c478bd9Sstevel@tonic-gate } 382*7c478bd9Sstevel@tonic-gate 383*7c478bd9Sstevel@tonic-gate if (argc == 0) { 384*7c478bd9Sstevel@tonic-gate (void) setreuid(uid, uid); 385*7c478bd9Sstevel@tonic-gate if (nflag) 386*7c478bd9Sstevel@tonic-gate usage(); 387*7c478bd9Sstevel@tonic-gate if (asrsh) 388*7c478bd9Sstevel@tonic-gate *argv0 = "rlogin"; 389*7c478bd9Sstevel@tonic-gate (void) execv(rlogin_path, argv0); 390*7c478bd9Sstevel@tonic-gate perror(rlogin_path); 391*7c478bd9Sstevel@tonic-gate 392*7c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("No local rlogin " 393*7c478bd9Sstevel@tonic-gate "program found.\n")); 394*7c478bd9Sstevel@tonic-gate return (EXIT_FAILURE); 395*7c478bd9Sstevel@tonic-gate } 396*7c478bd9Sstevel@tonic-gate 397*7c478bd9Sstevel@tonic-gate if (__init_suid_priv(0, PRIV_NET_PRIVADDR, NULL) == -1) { 398*7c478bd9Sstevel@tonic-gate (void) fprintf(stderr, 399*7c478bd9Sstevel@tonic-gate gettext("Insufficient privileges, " 400*7c478bd9Sstevel@tonic-gate "rsh must be set-uid root\n")); 401*7c478bd9Sstevel@tonic-gate return (EXIT_FAILURE); 402*7c478bd9Sstevel@tonic-gate } 403*7c478bd9Sstevel@tonic-gate 404*7c478bd9Sstevel@tonic-gate pwd = getpwuid(uid); 405*7c478bd9Sstevel@tonic-gate if (pwd == NULL) { 406*7c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("who are you?\n")); 407*7c478bd9Sstevel@tonic-gate return (EXIT_FAILURE); 408*7c478bd9Sstevel@tonic-gate } 409*7c478bd9Sstevel@tonic-gate if (user == NULL) 410*7c478bd9Sstevel@tonic-gate user = pwd->pw_name; 411*7c478bd9Sstevel@tonic-gate 412*7c478bd9Sstevel@tonic-gate if (krb5auth_flag) { 413*7c478bd9Sstevel@tonic-gate status = krb5_init_context(&bsd_context); 414*7c478bd9Sstevel@tonic-gate if (status) { 415*7c478bd9Sstevel@tonic-gate com_err("rsh", status, "while initializing krb5"); 416*7c478bd9Sstevel@tonic-gate return (EXIT_FAILURE); 417*7c478bd9Sstevel@tonic-gate } 418*7c478bd9Sstevel@tonic-gate 419*7c478bd9Sstevel@tonic-gate /* 420*7c478bd9Sstevel@tonic-gate * Get our local realm to look up local realm options. 421*7c478bd9Sstevel@tonic-gate */ 422*7c478bd9Sstevel@tonic-gate status = krb5_get_default_realm(bsd_context, &realmdef[1]); 423*7c478bd9Sstevel@tonic-gate if (status) { 424*7c478bd9Sstevel@tonic-gate com_err("rsh", status, 425*7c478bd9Sstevel@tonic-gate gettext("while getting default realm")); 426*7c478bd9Sstevel@tonic-gate return (EXIT_FAILURE); 427*7c478bd9Sstevel@tonic-gate } 428*7c478bd9Sstevel@tonic-gate /* 429*7c478bd9Sstevel@tonic-gate * Check the realms section in krb5.conf for encryption, 430*7c478bd9Sstevel@tonic-gate * forward & forwardable info 431*7c478bd9Sstevel@tonic-gate */ 432*7c478bd9Sstevel@tonic-gate profile_get_options_boolean(bsd_context->profile, realmdef, 433*7c478bd9Sstevel@tonic-gate option); 434*7c478bd9Sstevel@tonic-gate /* 435*7c478bd9Sstevel@tonic-gate * Check the appdefaults section 436*7c478bd9Sstevel@tonic-gate */ 437*7c478bd9Sstevel@tonic-gate profile_get_options_boolean(bsd_context->profile, appdef, 438*7c478bd9Sstevel@tonic-gate option); 439*7c478bd9Sstevel@tonic-gate profile_get_options_string(bsd_context->profile, appdef, 440*7c478bd9Sstevel@tonic-gate rcmdversion); 441*7c478bd9Sstevel@tonic-gate /* 442*7c478bd9Sstevel@tonic-gate * Set the *_flag variables, if the corresponding *_done are 443*7c478bd9Sstevel@tonic-gate * set to 1, because we dont want the config file values 444*7c478bd9Sstevel@tonic-gate * overriding the command line options. 445*7c478bd9Sstevel@tonic-gate */ 446*7c478bd9Sstevel@tonic-gate if (encrypt_done) 447*7c478bd9Sstevel@tonic-gate encrypt_flag = 1; 448*7c478bd9Sstevel@tonic-gate if (fwd_done) { 449*7c478bd9Sstevel@tonic-gate fflag = 1; 450*7c478bd9Sstevel@tonic-gate Fflag = 0; 451*7c478bd9Sstevel@tonic-gate } else if (fwdable_done) { 452*7c478bd9Sstevel@tonic-gate Fflag = 1; 453*7c478bd9Sstevel@tonic-gate fflag = 0; 454*7c478bd9Sstevel@tonic-gate } 455*7c478bd9Sstevel@tonic-gate if (!rcmdoption_done && (rcmdproto != NULL)) { 456*7c478bd9Sstevel@tonic-gate if (strncmp(rcmdproto, "rcmdv2", 6) == 0) { 457*7c478bd9Sstevel@tonic-gate kcmd_proto = KCMD_NEW_PROTOCOL; 458*7c478bd9Sstevel@tonic-gate } else if (strncmp(rcmdproto, "rcmdv1", 6) == 0) { 459*7c478bd9Sstevel@tonic-gate kcmd_proto = KCMD_OLD_PROTOCOL; 460*7c478bd9Sstevel@tonic-gate } else { 461*7c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("Unrecognized " 462*7c478bd9Sstevel@tonic-gate "KCMD protocol (%s)"), rcmdproto); 463*7c478bd9Sstevel@tonic-gate return (EXIT_FAILURE); 464*7c478bd9Sstevel@tonic-gate } 465*7c478bd9Sstevel@tonic-gate } 466*7c478bd9Sstevel@tonic-gate 467*7c478bd9Sstevel@tonic-gate 468*7c478bd9Sstevel@tonic-gate if (encrypt_flag && (!krb5_privacy_allowed())) { 469*7c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("rsh: Encryption not " 470*7c478bd9Sstevel@tonic-gate "supported.\n")); 471*7c478bd9Sstevel@tonic-gate return (EXIT_FAILURE); 472*7c478bd9Sstevel@tonic-gate } 473*7c478bd9Sstevel@tonic-gate } 474*7c478bd9Sstevel@tonic-gate 475*7c478bd9Sstevel@tonic-gate /* 476*7c478bd9Sstevel@tonic-gate * Connect with the service (shell/kshell) on the daemon side 477*7c478bd9Sstevel@tonic-gate */ 478*7c478bd9Sstevel@tonic-gate if (portnumber == 0) { 479*7c478bd9Sstevel@tonic-gate while (!init_service(krb5auth_flag)) { 480*7c478bd9Sstevel@tonic-gate /* 481*7c478bd9Sstevel@tonic-gate * Connecting to the 'kshell' service failed, 482*7c478bd9Sstevel@tonic-gate * fallback to normal rsh; Reset all KRB5 flags 483*7c478bd9Sstevel@tonic-gate * and connect to 'shell' service on the server 484*7c478bd9Sstevel@tonic-gate */ 485*7c478bd9Sstevel@tonic-gate krb5auth_flag = B_FALSE; 486*7c478bd9Sstevel@tonic-gate encrypt_flag = fflag = Fflag = 0; 487*7c478bd9Sstevel@tonic-gate } 488*7c478bd9Sstevel@tonic-gate } 489*7c478bd9Sstevel@tonic-gate 490*7c478bd9Sstevel@tonic-gate cc = encrypt_flag ? strlen(dash_x) : 0; 491*7c478bd9Sstevel@tonic-gate for (ap = argv; *ap != NULL; ap++) 492*7c478bd9Sstevel@tonic-gate cc += strlen(*ap) + 1; 493*7c478bd9Sstevel@tonic-gate cp = args = malloc(cc); 494*7c478bd9Sstevel@tonic-gate if (cp == NULL) 495*7c478bd9Sstevel@tonic-gate perror("malloc"); 496*7c478bd9Sstevel@tonic-gate if (encrypt_flag) { 497*7c478bd9Sstevel@tonic-gate int length; 498*7c478bd9Sstevel@tonic-gate 499*7c478bd9Sstevel@tonic-gate length = strlcpy(args, dash_x, cc); 500*7c478bd9Sstevel@tonic-gate cp += length; 501*7c478bd9Sstevel@tonic-gate cc -= length; 502*7c478bd9Sstevel@tonic-gate } 503*7c478bd9Sstevel@tonic-gate args_no_x = args; 504*7c478bd9Sstevel@tonic-gate 505*7c478bd9Sstevel@tonic-gate for (ap = argv; *ap != NULL; ap++) { 506*7c478bd9Sstevel@tonic-gate int length; 507*7c478bd9Sstevel@tonic-gate 508*7c478bd9Sstevel@tonic-gate length = strlcpy(cp, *ap, cc); 509*7c478bd9Sstevel@tonic-gate assert(length < cc); 510*7c478bd9Sstevel@tonic-gate cp += length; 511*7c478bd9Sstevel@tonic-gate cc -= length; 512*7c478bd9Sstevel@tonic-gate if (ap[1] != NULL) { 513*7c478bd9Sstevel@tonic-gate *cp++ = ' '; 514*7c478bd9Sstevel@tonic-gate cc--; 515*7c478bd9Sstevel@tonic-gate } 516*7c478bd9Sstevel@tonic-gate } 517*7c478bd9Sstevel@tonic-gate 518*7c478bd9Sstevel@tonic-gate if (krb5auth_flag) { 519*7c478bd9Sstevel@tonic-gate authopts = AP_OPTS_MUTUAL_REQUIRED; 520*7c478bd9Sstevel@tonic-gate /* 521*7c478bd9Sstevel@tonic-gate * Piggy-back forwarding flags on top of authopts; 522*7c478bd9Sstevel@tonic-gate * they will be reset in kcmd 523*7c478bd9Sstevel@tonic-gate */ 524*7c478bd9Sstevel@tonic-gate if (fflag || Fflag) 525*7c478bd9Sstevel@tonic-gate authopts |= OPTS_FORWARD_CREDS; 526*7c478bd9Sstevel@tonic-gate if (Fflag) 527*7c478bd9Sstevel@tonic-gate authopts |= OPTS_FORWARDABLE_CREDS; 528*7c478bd9Sstevel@tonic-gate 529*7c478bd9Sstevel@tonic-gate status = kcmd(&rem, &host, portnumber, 530*7c478bd9Sstevel@tonic-gate pwd->pw_name, user, 531*7c478bd9Sstevel@tonic-gate args, &rfd2, "host", krb_realm, 532*7c478bd9Sstevel@tonic-gate bsd_context, &auth_context, &cred, 533*7c478bd9Sstevel@tonic-gate NULL, /* No need for sequence number */ 534*7c478bd9Sstevel@tonic-gate NULL, /* No need for server seq # */ 535*7c478bd9Sstevel@tonic-gate authopts, 536*7c478bd9Sstevel@tonic-gate 1, /* Always set anyport */ 537*7c478bd9Sstevel@tonic-gate &kcmd_proto); 538*7c478bd9Sstevel@tonic-gate if (status != 0) { 539*7c478bd9Sstevel@tonic-gate /* 540*7c478bd9Sstevel@tonic-gate * If new protocol requested, we dont fallback to 541*7c478bd9Sstevel@tonic-gate * less secure ones. 542*7c478bd9Sstevel@tonic-gate */ 543*7c478bd9Sstevel@tonic-gate if (kcmd_proto == KCMD_NEW_PROTOCOL) { 544*7c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("rsh: kcmdv2 " 545*7c478bd9Sstevel@tonic-gate "to host %s failed - %s\n" 546*7c478bd9Sstevel@tonic-gate "Fallback to normal rsh denied."), 547*7c478bd9Sstevel@tonic-gate host, error_message(status)); 548*7c478bd9Sstevel@tonic-gate return (EXIT_FAILURE); 549*7c478bd9Sstevel@tonic-gate } 550*7c478bd9Sstevel@tonic-gate /* check NO_TKT_FILE or equivalent... */ 551*7c478bd9Sstevel@tonic-gate if (status != -1) { 552*7c478bd9Sstevel@tonic-gate (void) fprintf(stderr, 553*7c478bd9Sstevel@tonic-gate gettext("rsh: kcmd to host %s failed - %s\n" 554*7c478bd9Sstevel@tonic-gate "trying normal rsh...\n\n"), 555*7c478bd9Sstevel@tonic-gate host, error_message(status)); 556*7c478bd9Sstevel@tonic-gate } else { 557*7c478bd9Sstevel@tonic-gate (void) fprintf(stderr, 558*7c478bd9Sstevel@tonic-gate gettext("trying normal rsh...\n")); 559*7c478bd9Sstevel@tonic-gate } 560*7c478bd9Sstevel@tonic-gate /* 561*7c478bd9Sstevel@tonic-gate * kcmd() failed, so we now fallback to normal rsh, 562*7c478bd9Sstevel@tonic-gate * after resetting the KRB5 flags and the 'args' array 563*7c478bd9Sstevel@tonic-gate */ 564*7c478bd9Sstevel@tonic-gate krb5auth_flag = B_FALSE; 565*7c478bd9Sstevel@tonic-gate encrypt_flag = fflag = Fflag = 0; 566*7c478bd9Sstevel@tonic-gate args = args_no_x; 567*7c478bd9Sstevel@tonic-gate (void) init_service(B_FALSE); 568*7c478bd9Sstevel@tonic-gate } else { 569*7c478bd9Sstevel@tonic-gate /* 570*7c478bd9Sstevel@tonic-gate * Set up buffers for desread and deswrite. 571*7c478bd9Sstevel@tonic-gate */ 572*7c478bd9Sstevel@tonic-gate desinbuf.data = des_inbuf; 573*7c478bd9Sstevel@tonic-gate desoutbuf.data = des_outbuf; 574*7c478bd9Sstevel@tonic-gate desinbuf.length = sizeof (des_inbuf); 575*7c478bd9Sstevel@tonic-gate desoutbuf.length = sizeof (des_outbuf); 576*7c478bd9Sstevel@tonic-gate 577*7c478bd9Sstevel@tonic-gate session_key = &cred->keyblock; 578*7c478bd9Sstevel@tonic-gate 579*7c478bd9Sstevel@tonic-gate if (kcmd_proto == KCMD_NEW_PROTOCOL) { 580*7c478bd9Sstevel@tonic-gate status = krb5_auth_con_getlocalsubkey( 581*7c478bd9Sstevel@tonic-gate bsd_context, 582*7c478bd9Sstevel@tonic-gate auth_context, 583*7c478bd9Sstevel@tonic-gate &session_key); 584*7c478bd9Sstevel@tonic-gate if (status) { 585*7c478bd9Sstevel@tonic-gate com_err("rsh", status, 586*7c478bd9Sstevel@tonic-gate "determining subkey for session"); 587*7c478bd9Sstevel@tonic-gate return (EXIT_FAILURE); 588*7c478bd9Sstevel@tonic-gate } 589*7c478bd9Sstevel@tonic-gate if (session_key == NULL) { 590*7c478bd9Sstevel@tonic-gate com_err("rsh", 0, "no subkey " 591*7c478bd9Sstevel@tonic-gate "negotiated for connection"); 592*7c478bd9Sstevel@tonic-gate return (EXIT_FAILURE); 593*7c478bd9Sstevel@tonic-gate } 594*7c478bd9Sstevel@tonic-gate } 595*7c478bd9Sstevel@tonic-gate 596*7c478bd9Sstevel@tonic-gate eblock.crypto_entry = session_key->enctype; 597*7c478bd9Sstevel@tonic-gate eblock.key = (krb5_keyblock *)session_key; 598*7c478bd9Sstevel@tonic-gate 599*7c478bd9Sstevel@tonic-gate init_encrypt(encrypt_flag, bsd_context, kcmd_proto, 600*7c478bd9Sstevel@tonic-gate &desinbuf, &desoutbuf, CLIENT, &eblock); 601*7c478bd9Sstevel@tonic-gate if (encrypt_flag) { 602*7c478bd9Sstevel@tonic-gate char *s = gettext("This rsh session is using " 603*7c478bd9Sstevel@tonic-gate "encryption for all data transmissions."); 604*7c478bd9Sstevel@tonic-gate (void) write(STDERR_FILENO, s, strlen(s)); 605*7c478bd9Sstevel@tonic-gate (void) write(STDERR_FILENO, "\r\n", 2); 606*7c478bd9Sstevel@tonic-gate } 607*7c478bd9Sstevel@tonic-gate } 608*7c478bd9Sstevel@tonic-gate } 609*7c478bd9Sstevel@tonic-gate 610*7c478bd9Sstevel@tonic-gate /* 611*7c478bd9Sstevel@tonic-gate * Don't merge this with the "if" statement above because 612*7c478bd9Sstevel@tonic-gate * "krb5auth_flag" might be set to false inside it. 613*7c478bd9Sstevel@tonic-gate */ 614*7c478bd9Sstevel@tonic-gate if (!krb5auth_flag) { 615*7c478bd9Sstevel@tonic-gate rem = rcmd_af(&host, portnumber, pwd->pw_name, user, args, 616*7c478bd9Sstevel@tonic-gate &rfd2, AF_INET6); 617*7c478bd9Sstevel@tonic-gate if (rem < 0) 618*7c478bd9Sstevel@tonic-gate return (EXIT_FAILURE); 619*7c478bd9Sstevel@tonic-gate } 620*7c478bd9Sstevel@tonic-gate __priv_relinquish(); 621*7c478bd9Sstevel@tonic-gate 622*7c478bd9Sstevel@tonic-gate if (rfd2 < 0) { 623*7c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("rsh: can't establish " 624*7c478bd9Sstevel@tonic-gate "stderr\n")); 625*7c478bd9Sstevel@tonic-gate return (EXIT_FAILURE); 626*7c478bd9Sstevel@tonic-gate } 627*7c478bd9Sstevel@tonic-gate if (options & SO_DEBUG) { 628*7c478bd9Sstevel@tonic-gate if (setsockopt(rem, SOL_SOCKET, SO_DEBUG, (char *)&one, 629*7c478bd9Sstevel@tonic-gate sizeof (one)) < 0) 630*7c478bd9Sstevel@tonic-gate perror("rsh: setsockopt (stdin)"); 631*7c478bd9Sstevel@tonic-gate if (setsockopt(rfd2, SOL_SOCKET, SO_DEBUG, (char *)&one, 632*7c478bd9Sstevel@tonic-gate sizeof (one)) < 0) 633*7c478bd9Sstevel@tonic-gate perror("rsh: setsockopt (stderr)"); 634*7c478bd9Sstevel@tonic-gate } 635*7c478bd9Sstevel@tonic-gate omask = sigblock(mask(SIGINT)|mask(SIGQUIT)|mask(SIGTERM)); 636*7c478bd9Sstevel@tonic-gate 637*7c478bd9Sstevel@tonic-gate if (sigdisp(SIGINT) != SIG_IGN) 638*7c478bd9Sstevel@tonic-gate (void) sigset(SIGINT, sendsig); 639*7c478bd9Sstevel@tonic-gate if (sigdisp(SIGQUIT) != SIG_IGN) 640*7c478bd9Sstevel@tonic-gate (void) sigset(SIGQUIT, sendsig); 641*7c478bd9Sstevel@tonic-gate if (sigdisp(SIGTERM) != SIG_IGN) 642*7c478bd9Sstevel@tonic-gate (void) sigset(SIGTERM, sendsig); 643*7c478bd9Sstevel@tonic-gate 644*7c478bd9Sstevel@tonic-gate if (nflag) { 645*7c478bd9Sstevel@tonic-gate (void) shutdown(rem, SHUT_WR); 646*7c478bd9Sstevel@tonic-gate } else { 647*7c478bd9Sstevel@tonic-gate child_pid = fork(); 648*7c478bd9Sstevel@tonic-gate if (child_pid < 0) { 649*7c478bd9Sstevel@tonic-gate perror("rsh: fork"); 650*7c478bd9Sstevel@tonic-gate return (EXIT_FAILURE); 651*7c478bd9Sstevel@tonic-gate } 652*7c478bd9Sstevel@tonic-gate 653*7c478bd9Sstevel@tonic-gate if (!encrypt_flag) { 654*7c478bd9Sstevel@tonic-gate (void) ioctl(rfd2, FIONBIO, &one); 655*7c478bd9Sstevel@tonic-gate (void) ioctl(rem, FIONBIO, &one); 656*7c478bd9Sstevel@tonic-gate } 657*7c478bd9Sstevel@tonic-gate 658*7c478bd9Sstevel@tonic-gate if (child_pid == 0) { 659*7c478bd9Sstevel@tonic-gate /* Child */ 660*7c478bd9Sstevel@tonic-gate fd_set remset; 661*7c478bd9Sstevel@tonic-gate char *bp; 662*7c478bd9Sstevel@tonic-gate int wc; 663*7c478bd9Sstevel@tonic-gate (void) close(rfd2); 664*7c478bd9Sstevel@tonic-gate reread: 665*7c478bd9Sstevel@tonic-gate errno = 0; 666*7c478bd9Sstevel@tonic-gate cc = read(0, buf, sizeof (buf)); 667*7c478bd9Sstevel@tonic-gate if (cc <= 0) 668*7c478bd9Sstevel@tonic-gate goto done; 669*7c478bd9Sstevel@tonic-gate bp = buf; 670*7c478bd9Sstevel@tonic-gate rewrite: 671*7c478bd9Sstevel@tonic-gate FD_ZERO(&remset); 672*7c478bd9Sstevel@tonic-gate FD_SET(rem, &remset); 673*7c478bd9Sstevel@tonic-gate if (select(rem + 1, NULL, &remset, NULL, NULL) < 0) { 674*7c478bd9Sstevel@tonic-gate if (errno != EINTR) { 675*7c478bd9Sstevel@tonic-gate perror("rsh: select"); 676*7c478bd9Sstevel@tonic-gate return (EXIT_FAILURE); 677*7c478bd9Sstevel@tonic-gate } 678*7c478bd9Sstevel@tonic-gate goto rewrite; 679*7c478bd9Sstevel@tonic-gate } 680*7c478bd9Sstevel@tonic-gate if (!FD_ISSET(rem, &remset)) 681*7c478bd9Sstevel@tonic-gate goto rewrite; 682*7c478bd9Sstevel@tonic-gate writeiv = B_FALSE; 683*7c478bd9Sstevel@tonic-gate wc = desrshwrite(rem, bp, cc); 684*7c478bd9Sstevel@tonic-gate if (wc < 0) { 685*7c478bd9Sstevel@tonic-gate if (errno == EWOULDBLOCK) 686*7c478bd9Sstevel@tonic-gate goto rewrite; 687*7c478bd9Sstevel@tonic-gate goto done; 688*7c478bd9Sstevel@tonic-gate } 689*7c478bd9Sstevel@tonic-gate cc -= wc; bp += wc; 690*7c478bd9Sstevel@tonic-gate if (cc == 0) 691*7c478bd9Sstevel@tonic-gate goto reread; 692*7c478bd9Sstevel@tonic-gate goto rewrite; 693*7c478bd9Sstevel@tonic-gate done: 694*7c478bd9Sstevel@tonic-gate (void) shutdown(rem, SHUT_WR); 695*7c478bd9Sstevel@tonic-gate return (EXIT_SUCCESS); 696*7c478bd9Sstevel@tonic-gate } 697*7c478bd9Sstevel@tonic-gate } 698*7c478bd9Sstevel@tonic-gate 699*7c478bd9Sstevel@tonic-gate #define MAX(a, b) (((a) > (b)) ? (a) : (b)) 700*7c478bd9Sstevel@tonic-gate 701*7c478bd9Sstevel@tonic-gate sigsetmask(omask); 702*7c478bd9Sstevel@tonic-gate readfrom_rem = B_TRUE; 703*7c478bd9Sstevel@tonic-gate readfrom_rfd2 = B_TRUE; 704*7c478bd9Sstevel@tonic-gate (void) sigset(SIGPIPE, sigpipehandler); 705*7c478bd9Sstevel@tonic-gate do { 706*7c478bd9Sstevel@tonic-gate fd_set readyset; 707*7c478bd9Sstevel@tonic-gate 708*7c478bd9Sstevel@tonic-gate FD_ZERO(&readyset); 709*7c478bd9Sstevel@tonic-gate if (readfrom_rem) 710*7c478bd9Sstevel@tonic-gate FD_SET(rem, &readyset); 711*7c478bd9Sstevel@tonic-gate if (readfrom_rfd2) 712*7c478bd9Sstevel@tonic-gate FD_SET(rfd2, &readyset); 713*7c478bd9Sstevel@tonic-gate if (select(MAX(rem, rfd2) + 1, &readyset, NULL, NULL, 714*7c478bd9Sstevel@tonic-gate NULL) < 0) { 715*7c478bd9Sstevel@tonic-gate if (errno != EINTR) { 716*7c478bd9Sstevel@tonic-gate perror("rsh: select"); 717*7c478bd9Sstevel@tonic-gate return (EXIT_FAILURE); 718*7c478bd9Sstevel@tonic-gate } 719*7c478bd9Sstevel@tonic-gate continue; 720*7c478bd9Sstevel@tonic-gate } 721*7c478bd9Sstevel@tonic-gate if (FD_ISSET(rfd2, &readyset)) { 722*7c478bd9Sstevel@tonic-gate errno = 0; 723*7c478bd9Sstevel@tonic-gate readiv = B_TRUE; 724*7c478bd9Sstevel@tonic-gate cc = desrshread(rfd2, buf, sizeof (buf)); 725*7c478bd9Sstevel@tonic-gate if (cc <= 0) { 726*7c478bd9Sstevel@tonic-gate if (errno != EWOULDBLOCK) 727*7c478bd9Sstevel@tonic-gate readfrom_rfd2 = B_FALSE; 728*7c478bd9Sstevel@tonic-gate } else { 729*7c478bd9Sstevel@tonic-gate (void) write(STDERR_FILENO, buf, cc); 730*7c478bd9Sstevel@tonic-gate } 731*7c478bd9Sstevel@tonic-gate } 732*7c478bd9Sstevel@tonic-gate if (FD_ISSET(rem, &readyset)) { 733*7c478bd9Sstevel@tonic-gate errno = 0; 734*7c478bd9Sstevel@tonic-gate readiv = B_FALSE; 735*7c478bd9Sstevel@tonic-gate cc = desrshread(rem, buf, sizeof (buf)); 736*7c478bd9Sstevel@tonic-gate if (cc <= 0) { 737*7c478bd9Sstevel@tonic-gate if (errno != EWOULDBLOCK) 738*7c478bd9Sstevel@tonic-gate readfrom_rem = B_FALSE; 739*7c478bd9Sstevel@tonic-gate } else 740*7c478bd9Sstevel@tonic-gate (void) write(STDOUT_FILENO, buf, cc); 741*7c478bd9Sstevel@tonic-gate } 742*7c478bd9Sstevel@tonic-gate } while (readfrom_rem || readfrom_rfd2); 743*7c478bd9Sstevel@tonic-gate 744*7c478bd9Sstevel@tonic-gate if (!nflag) 745*7c478bd9Sstevel@tonic-gate (void) kill(child_pid, SIGKILL); 746*7c478bd9Sstevel@tonic-gate return (EXIT_SUCCESS); 747*7c478bd9Sstevel@tonic-gate } 748*7c478bd9Sstevel@tonic-gate 749*7c478bd9Sstevel@tonic-gate static void 750*7c478bd9Sstevel@tonic-gate sendsig(int signum) 751*7c478bd9Sstevel@tonic-gate { 752*7c478bd9Sstevel@tonic-gate char buffer; 753*7c478bd9Sstevel@tonic-gate 754*7c478bd9Sstevel@tonic-gate writeiv = B_TRUE; 755*7c478bd9Sstevel@tonic-gate buffer = (char)signum; 756*7c478bd9Sstevel@tonic-gate (void) desrshwrite(rfd2, &buffer, 1); 757*7c478bd9Sstevel@tonic-gate } 758*7c478bd9Sstevel@tonic-gate 759*7c478bd9Sstevel@tonic-gate static boolean_t 760*7c478bd9Sstevel@tonic-gate init_service(boolean_t krb5flag) 761*7c478bd9Sstevel@tonic-gate { 762*7c478bd9Sstevel@tonic-gate struct servent *sp; 763*7c478bd9Sstevel@tonic-gate 764*7c478bd9Sstevel@tonic-gate if (krb5flag) { 765*7c478bd9Sstevel@tonic-gate sp = getservbyname("kshell", "tcp"); 766*7c478bd9Sstevel@tonic-gate if (sp == NULL) { 767*7c478bd9Sstevel@tonic-gate (void) fprintf(stderr, 768*7c478bd9Sstevel@tonic-gate gettext("rsh: kshell/tcp: unknown service.\n" 769*7c478bd9Sstevel@tonic-gate "trying normal shell/tcp service\n")); 770*7c478bd9Sstevel@tonic-gate return (B_FALSE); 771*7c478bd9Sstevel@tonic-gate } 772*7c478bd9Sstevel@tonic-gate } else { 773*7c478bd9Sstevel@tonic-gate sp = getservbyname("shell", "tcp"); 774*7c478bd9Sstevel@tonic-gate if (sp == NULL) { 775*7c478bd9Sstevel@tonic-gate portnumber = htons(IPPORT_CMDSERVER); 776*7c478bd9Sstevel@tonic-gate return (B_TRUE); 777*7c478bd9Sstevel@tonic-gate } 778*7c478bd9Sstevel@tonic-gate } 779*7c478bd9Sstevel@tonic-gate 780*7c478bd9Sstevel@tonic-gate portnumber = sp->s_port; 781*7c478bd9Sstevel@tonic-gate return (B_TRUE); 782*7c478bd9Sstevel@tonic-gate } 783*7c478bd9Sstevel@tonic-gate 784*7c478bd9Sstevel@tonic-gate static int 785*7c478bd9Sstevel@tonic-gate desrshread(int fd, char *buf, int len) 786*7c478bd9Sstevel@tonic-gate { 787*7c478bd9Sstevel@tonic-gate return (desread(fd, buf, len, readiv ? 1 : 0)); 788*7c478bd9Sstevel@tonic-gate } 789*7c478bd9Sstevel@tonic-gate 790*7c478bd9Sstevel@tonic-gate static int 791*7c478bd9Sstevel@tonic-gate desrshwrite(int fd, char *buf, int len) 792*7c478bd9Sstevel@tonic-gate { 793*7c478bd9Sstevel@tonic-gate return (deswrite(fd, buf, len, writeiv ? 1 : 0)); 794*7c478bd9Sstevel@tonic-gate } 795