Commit Graph

36 Commits

Author SHA1 Message Date
pirzyk
22f5936e53 Changed the clnt_perror string in yp_all because it was saying the
error came from yp_next

PR:	bin/13254
Submitted by:	Jim Pirzyk
Reviewed by:	jkh
MFC after: 1 week
2001-05-23 15:37:10 +00:00
deischen
1635c221b7 Remove _THREAD_SAFE and make libc thread-safe by default by
adding (weak definitions to) stubs for some of the pthread
functions.  If the threads library is linked in, the real
pthread functions will pulled in.

Use the following convention for system calls wrapped by the
threads library:
	__sys_foo - actual system call
	_foo - weak definition to __sys_foo
	foo - weak definition to __sys_foo

Change all libc uses of system calls wrapped by the threads
library from foo to _foo.  In order to define the prototypes
for _foo(), we introduce namespace.h and un-namespace.h
(suggested by bde).  All files that need to reference these
system calls, should include namespace.h before any standard
includes, then include un-namespace.h after the standard
includes and before any local includes.  <db.h> is an exception
and shouldn't be included in between namespace.h and
un-namespace.h  namespace.h will define foo to _foo, and
un-namespace.h will undefine foo.

Try to eliminate some of the recursive calls to MT-safe
functions in libc/stdio in preparation for adding a mutex
to FILE.  We have recursive mutexes, but would like to avoid
using them if possible.

Remove uneeded includes of <errno.h> from a few files.

Add $FreeBSD$ to a few files in order to pass commitprep.

Approved by:	-arch
2001-01-24 13:01:12 +00:00
jasone
8abe2a2d86 Simplify sytem call renaming. Instead of _foo() <-- _libc_foo <-- foo(),
just use _foo() <-- foo().  In the case of a libpthread that doesn't do
call conversion (such as linuxthreads and our upcoming libpthread), this
is adequate.  In the case of libc_r, we still need three names, which are
now _thread_sys_foo() <-- _foo() <-- foo().

Convert all internal libc usage of: aio_suspend(), close(), fsync(), msync(),
nanosleep(), open(), fcntl(), read(), and write() to _foo() instead of foo().

Remove all internal libc usage of: creat(), pause(), sleep(), system(),
tcdrain(), wait(), and waitpid().

Make thread cancellation fully POSIX-compliant.

Suggested by:	deischen
2000-01-27 23:07:25 +00:00
jasone
75903038bc Add three-tier symbol naming in support of POSIX thread cancellation
points.  For library functions, the pattern is __sleep() <--
_libc_sleep() <-- sleep().  The arrows represent weak aliases.  For
system calls, the pattern is _read() <-- _libc_read() <-- read().
2000-01-12 09:23:48 +00:00
kris
7edfaee15b Fix buffer overflows.
Reviewed by:	imp, audit@freebsd.org
1999-12-05 21:02:41 +00:00
peter
76f0c923fe $Id$ -> $FreeBSD$ 1999-08-28 00:22:10 +00:00
wpaul
b5a6d61144 Fix resource allocation problems:
- Completely recoded the ypmatch cache code. The old code could leak
  memory: it would allow the cache to grow, but never
  shrink. The new code imposes the following limits:

	o The cache is capped at a limit of 5 entries.
	o Each entry expires after five seconds, at which point
	  its slot is freed.
	o If an insertion is to be done and all five slots
	  are filled, the oldest entry is forcibly expired
	  to release its slot.

  Also, the cache is implemented on a per-binding basis rather than
  having a global cache covering all bindings. This means that each
  bound domain has its own 5 slot cache.

- Changed clntudp_create() to clntudp_bufcreate() so that the
  xmit/recv message buffer sizes can be set explicitly. NIS transactions
  are rarely much larger than 1024 bytes since YPMAXRECORD is 1024.
  The defaults chosen by clntudb_create() are actually much larger
  than needed. I set the xmit buffer to a little over 1024 and the
  recv buffer to a little over 2048. This saves a few Kbytes for each
  NIS binding.

- Add my name to the copyright. I think I've made enough changes to
  this file to merit it. :)

Note: these changes should go into the 2.2.x branch, but I'm waiting
on feedback from a tester to see if the cache fixes solve the reported
memory leak problem.
1998-03-07 05:06:10 +00:00
wpaul
6a02d37882 Don't even think about processing bogus domain names here. 1997-04-10 20:26:04 +00:00
peter
6b08958c64 Revert $FreeBSD$ to $Id$ 1997-02-22 15:12:41 +00:00
jkh
808a36ef65 Make the long-awaited change from $Id$ to $FreeBSD$
This will make a number of things easier in the future, as well as (finally!)
avoiding the Id-smashing problem which has plagued developers for so long.

Boy, I'm glad we're not using sup anymore.  This update would have been
insane otherwise.
1997-01-14 07:20:47 +00:00
wpaul
9f9cef3ee4 Fix for bug noticed by Christoph Kukulies.
_yp_dobind() checks to see if a fork() happens (by checking PIDs) and
invalidates all bindings if it finds itself in a newly created child
process. (This avoids sharing RPC client handles and socket descriptors
with the parent, which would be bad.) Unfortunately, it summarily
calls clnt_destroy() on the handles, which may result in the destruction
of a descriptor that isn't really a socket.

This is fixed by replacing the explicit call to clnt_destroy() with a
call to _yp_unbind(), which deals with potentially hosed socket descriptors
an a safe manner.

This is basically a one-liner. Once I confirm that it fixes Christoph's
problem, I'd like permission to put it in the 2.2-RELENG branch.
1996-12-20 19:41:15 +00:00
wpaul
844872c49d - Avoid possible SEGVs: never call clnt_destroy() without checking
for NULL RPC client handles. This should hopefully fix the problems
  Satoshi reported on -current.

- Add socket descriptor sanity checks to _yp_unbind().

- Fix yp_order() so that it handles the RPC_PROCUNAVAIL error gracefully.
  NIS+ in YP compat mode doesn't support the YPPROC_ORDER procedure.

This is a 2.2 candidate with bells on.
1996-11-08 01:42:02 +00:00
wpaul
dd36926d57 In _yp_dobind(), if we find ourselves required to contact the local ypbind
directly in order to obtain binding information, check that the local
ypbind is using a reserved port and return YPERR_YPBIND if it isn't.
We should not trust any ypbind running on a port >= IPPORT_RESERVED;
it may have been started by a malicious user hoping to trick us into
talking to a bogus ypserv.

Note that we do not check the ypserv port returned to us from ypbind.
It is assumed that ypbind has already done a reserved port test (or not,
depending on whether or not it was started with -s); if we trust the
authenticity of the local ypbind, we should also trust its judgement.

Obtained from: OpenBSD
1996-07-13 20:23:13 +00:00
jkh
c4d4a99d31 General -Wall warning cleanup, part I.
Submitted-By: Kent Vander Velden <graphix@iastate.edu>
1996-07-12 18:57:58 +00:00
jraynard
9f903bbfff Code clean up:
Changed type of pid from int to pid_t. (Missed one!)
1996-06-04 17:35:15 +00:00
jraynard
c64e4011c6 Code clean up:
Changed type of pid from int to pid_t.
1996-06-03 13:19:10 +00:00
wpaul
469d167428 Make _yp_dobind() a litle smarter:
Now that we preserve RPC handles instead of rebuilding them each time
a ypcln function is called, we have to be careful about keeping our sockets
in a sane state. It's possible that the caller may call a ypclnt
function, and then decide to close all its file descriptors. This would
also close the socket descriptor held by the yplib code. Worse, it
could re-open the same descriptor number for its own use. If it then calls
another ypclnt function, the subsequent RPC will fail because the socket
will either be gone or replaced with Something Completely Different. The
yplib code will recover by rebinding, but it doing so it may wreck the
descriptor which now belongs to the caller.

To fix this, _yp_dobind() needs to label the descriptor somehow so
that it can test it later to make sure it hasn't been altered between
ypclnt calls. It does this by binding the socket, thus associating a port
number with it. It then saves this port number in the dom_local_port member
of the dom_binding structure for the given domain. When _yp_dobind() is
called again (which it is at the start of each ypclnt function), it checks
to see if the domain is already bound, and if it is, it does a getsockname()
on the socket and compares the port number to the one it saved. If the
getsockname() fails, or the port number doesn't match, it abandons the
socket and sets up a new client handle.

This still incurs some syscall overhead, which is what I was trying to
avoid, but it's still not as bad as before.
1996-06-01 05:08:31 +00:00
wpaul
b0005a7f9b - Patch around amd core dump problem: don't allow yp_unbind() or _yp_unbind()
to call clnt_destroy() on a potentially NULL RPC handle. Somebody should
  bang on this a bit to make sure the problem is really gone; I seem to
  have difficulty reproducing it. Patch provided by Peter Wemm and
  slightly tweaked by me.

- Don't call _yp_unbind() in individual ypclnt functions unless we encounter
  an RPC error while making a clnt_call().
1996-05-16 18:01:17 +00:00
wpaul
4df2d36a62 NIS client-side performance tweak:
Each of the ypclnt functions does a _yp_dobind() when it starts and then
a _yp_unbind() when it finishes. This is not strictly necessary and it
wastes cycles: it means we do a new clnt_create() and clnt_destroy()
for each yp_whatever() call. In fact, you can do multiple clnt_call()s
using a single RPC client handle returned by clnt_create(). Ideally we only
have to create a handle to ypserv once (the first time we call a ypclnt
function) and then destroy it and rebind only if a call to ypserv fails.

- Modify _yp_dobind() so that it only creates a new RPC client handle
  when establishing a new binding or when one of the ypclnt calls
  invalidates an existing binding and calls _yp_dobind() to establish
  a new one.

- Modify the various ypclnt functions to only call _yp_unbind() if a
  call to ypserv fails.
1996-05-02 15:44:53 +00:00
wpaul
7ef60754ce Don't bother trying to flock() /var/run/ypbind.lock; this breaks when
/var/run resides on an NFS filesystem (flock() always returns 0 in
this case, so we falsely assume that ypbind is dead and bail out).

Settle instead for better failure checking when using clnttcp_create()
and clnt_call() to interact with ypbind. We still try to flock()
/var/yp/binding/$DOMAINNAME.2, but if this doesn't work, we drop into
the code that retrieves the binding information from ypbind directly.
If that also fails, then we're toast. On NFS filesystems, this means
we'll be ignoring the binding file for no reason and always talking to
ypbind even though we don't have to, but at least things will work.

(I could just replace the flock(/var/run/ypbind.lock) check with
an RPC call to ypbind's NULLPROC procedure, but if the flock() of
the binding file doesn't pan out we're going to try to talk to
ypbind later anyway. *sigh* Is NFS file locking ever going to work?)
1996-03-23 22:48:19 +00:00
wpaul
11fb5722e2 Fix yp_all() so that it doesn't bogusly return YP_NOMORE at the end
of a successful map retrieval. (This has to do with a previous change
to xdr_ypresp_all_seq() and ypxfr_get_map(); originally, yp_all()
would look for a return value of YP_FALSE to signal success, but now
it should be looking for YP_NOMORE. It should not be passing YP_NOMORE
back up to the caller though.)

Noticed by:  <aagero@aage.priv.no>

There is also another small bug here, which is that the call to
xdr_free() that happens immediately after the clnt_call() in yp_all()
clobbers the return status value. I've worked around this for now,
but I think the xdr_free() is actually bogus and should be removed.
I want to check some more before I do that though.
1996-03-19 19:27:03 +00:00
wpaul
eb52691f7b Clean up a few things left dangling after the last commit. The new
XDR routines auto-generated by rpcgen don't quite match the format of
the original ones even though tey have the same names (that was one of
the things wrong with the old XDR routines).
1995-12-15 03:26:40 +00:00
wpaul
4c65cdeaf9 Now that rpcgen is squared away, arrange to have all the NIS XDR routines
rpcgen-erated on the fly (just like librpcsvc).

Makefile: Add rule for generating yp_xdr.c and yp.h.

xdryp.c: gut everything except the special ypresp_all XDR function
         needed to to handle yp_all() (this one can't be created on
         the fly), and xdr_datum(), which isn't used internally by
         libc, but which as documented as being there in yp_prot.h,
         so what the hell. We now get everything else from yp_xdr.c.

yplib.c: change a few structure member names to match those found in
         yp.h instead of those declared in yp_prot.h.
1995-12-14 05:16:45 +00:00
wpaul
33bc907e9c - Make _do_ypbind() check for /var/run/ypbind.lock and attempt to flock()
it before before trying to establish a binding. If /var/run/ypbind.lock
  doesn't exist, or if it exists and isn't locked, then ypbind isn't
  running, which means NIS is either turned off or hosed.

- Have _yp_check() call yp_unbind() after it sucessfully calls yp_bind()
  to make sure it frees resources correctly. (I don't think there's really
  a memory leak here, but it seems somehow wrong to call yp_bind() without
  making a corresponding call to yp_unbind() afterwards.)

This makes the NIS code behave a little better in cases where libc makes
calls to NIS, but it isn't running correctly (i.e. there's no ypbind).

This cleans up some strange libc behavior that manifests itself if
you have the system domain name set, but aren't actually running NIS.
In this event, the getrpcent(3) code could try to call into NIS and
cause several inexplicable "clnttcp_create error: RPC program not
registered" messages to appear. This happens because _yp_check() checks
if the system domain name is set and, if it is, proceeds to call
yp_bind() to attempt to establish a binding. Since there is no
binding file (remember: ypbind isn't running, so /var/yp/binding
will be empty), _yp_dobind() will attempt to contact ypbind to
prod it into binding the domain. And because ypbind isn't running,
the code generates the 'clnttcp_create' error. Ultimately the
_yp_check() fails and the getrpcent(3) code rolls over to the /etc/rpc
file, but the error messages are annoying, and the code should be
smart enough to forgo the binding attempt when NIS is turned off.
1995-11-05 05:39:04 +00:00
wpaul
0863217995 Clear up a minor bogosity in yp_match(): we have YPMATCHCACHE turned
on, which is fine, except that _yp_dobind() is called before we check
the cache. The means we can return from the cache check (if we have
a hit) without calling _yp_unbind().

We should do the cache check first and _then_ drop into the section
that binds the server and does the yp_match query.
1995-09-02 04:16:21 +00:00
wpaul
590e5a6c7f The ypprot_err() function incorrectly maps YP_NODOM to YPERR_NODOM.
Strange as it sounds, it should map to YPERR_DOMAIN instead.

The YP_NODOM protocol error code is generally returned by ypserv when you
ask it for data from a domain that it doesn't support. By contrast,
the YPERR_NODOM error code means 'local domain name not set.'
Consequently, this incorrect mapping leads to yperr_string() generating
a very confusing error message. YPERR_DOMAIN says 'couldn't
bind to a server which serves this domain' which is much closer
to the truth.
1995-07-05 06:04:20 +00:00
rgrimes
f05428e4cd Remove trailing whitespace. 1995-05-30 05:51:47 +00:00
wpaul
595e0167eb Cosmetic changes and paranoia checks:
ypbind.c:
Make fewer assumtions about the state of the dom_alive and dom_broadcasting
flags in roc_received().

If select() fails, use syslog() to report the error rather than perror().

Check that all our malloc()s succeed. Report malloc() failure in
ypbindproc_setdom_2() to callers.

yplib.c:

Use #defined constants in ypbinderr_string() rather than hard-coded values.
1995-05-03 18:33:10 +00:00
wpaul
b72b2e3557 ypbind.c: Major overhaul.
- Moved to a more client-driven model. We aggressively attempt to keep
the default domain bound (as before) but we give up on non-default
domains if we lose contact with a server and fail to get a response
after one round of broadcasting. This helps drastically reduce the
amount of network bandwitdh that ypbind consumes: if a client references
the secondary domain at some later point, this will prod ypbind into
establishing a new binding anyway, so continuously broadcasting without
need is pointless.

Note that we still actively seek out a binding for our default domain
even if no client program has queried us yet. I'm not exactly sure if
this matches SunOS's behavior or not, but I decided to do it this way
since we can get into all sorts of trouble if our default domain comes
unbound. Even so, we're still much quieter than we used to be.

- Removed a bunch of no-longer pertinent comments and a couple of
chunks of #ifdef 0'ed code that no longer fit in to the new layout.

- Theo deRaadt must have become frustrated with the callback mechanism
in clnt_broadcast(), because he shamelessly stole the clnt_broadcast()
code right out of the RPC library and hacked it up to suit his needs.
(Comments and all! :)

I can understand why: clnt_broadcast() blocks while awaiting replies.
Changing this behavior requires surgery. However, you can work around
this: fork the broadcast into a child process and relay the results
back to the parent via a pipe. (Careful obervation has shown that the
SunOS ypbind forks children for broadcasting too, though I can only
guess what sort of interprocess communication it uses. pipe() seems to
do the job well enough.)

This may seem like the long way around, but it's not really that
hard to implement, and I'd prefer to use documented RPC library functions
wherever possible. We're careful to limit the number of simultaneous
broadcasters to avoid swamping the system (the current limit is 5).
Each clnt_broadcast() call only sends out a small number of packets
at increasing intervals. We're also careful not to spawn more than one
bradcaster for a given domain.

- Used clntudp_bufcreate() and clnt_call() to implement a ping()
function for directly querying a particular server so that we can
check if it's still alive. This lets me completely remove the old
bradcasting code and use actual RPC library calls instead, at the
cost of more than a few handfulls of torn-out hair. (Make no mistake
folks: I *HATE* RPC.) Currently, the ping interval is one minute.

- Fixed another potential 'nfds too big for select()' bug: use
_rpc_dtablesize() instead of getdtablesize().

- Quieted gcc -Wall a bit.

- Probably a bunch of other stuff that I've forgotten.

ypbind.8:

- Updated man page to reflect modifications.

ypwhich.c:

- Small mind-o fix from last time: decode error results from
ypbind correctly (*groan*)

yplib.c:

- same as above

- Change behavior of _yp_dobind() a little: if we get back a 'Domain
not bound' error for a given domain, retry a few times before giving
up and passing the error back to the caller. We have to sleep for a
few seconds between tries since the 'Domain not bound' error comes
back immediately (by repeatedly looping, we end up pounding on ypbind).
We retry at most 20 times at 5 second intervals. This gives us a full
minute to get a response. This seems to deviate a bit from SunOS
behavior -- it appears to wait forever -- but I don't like the idea
of perpetually hanging inside a library call.

Note that this should fix the problems some people have with bindings
not being established fast enough at boot time; sometimes amd is started
in /etc/rc after ypbind has run but before it gets a binding set up. The
automounter gets annoyed at this and tends to exit. By pausing ther YP
calls until a binding is ready, we avoid this situation.

- Another _yp_dobind() change: if we determine that our binding files
are unlocked or nonexistent, jump directly to code that pokes ypbind
into restablishing the binding. Again, if it fails, we'll time out
eventually and return.
1995-04-26 19:03:16 +00:00
wpaul
be813a3b68 small NIS binding fixes:
ypbind.c: if a client program asks ypbind for the name of the server
for a particular domain, and there isn't a binding for that domain
available yet, ypbind needs to supply a status value along with its
failure message. Set yprespbody.ypbind_error before returning from
a ypbindproc_domain request.

yplib.c: properly handle the error status messages ypbind now has the
ability to send us. Add a ypbinderr_string() function to decode the
error values.

ypwhich.c: handle ypbind errors correctly: yperr_string() can't handle
ypbind_status messages -- use ypbinderr_string instead.
1995-04-21 18:04:36 +00:00
wpaul
e98b1385b8 More of the same: we also need to handle multiple domains properly
even if /var/yp/binding/DOMAIN.VERS doesn't exist yet.
1995-04-09 21:52:31 +00:00
wpaul
568d625957 Fix behavior of YP library routines in environments with multiple domains,
where one or more of the non-default domains are not yet bound.

If we make a YP request for a domain other than the default domain,
and there is no binding for the new domain yet, _yp_dobind() sees
that the /var/yp/binding/DOMAIN.VERS file for the unbound domain is
not locked (by ypbind) and from this it concludes that the NIS system
is dead, so it gives up.

This behavior has been changed: before giving up in this case, we now
make a second check to see if the binding file for the *default* domain
is also not locked. Only if the default domain binding file is also
unlocked to we now assume that ypbind has bought the farm and bail out.
(Note: this assumes that the user hasn't changed the default domain
while ypbind is running.)

With this change, _do_ypbind() is allowed to proceed into the next
section of code wherein it prods ypbind into establishing a binding
for the new domain. This first call times out after ten seconds,
after which it should retry and succeed. From then on, the binding
for the second domain should be handled normally.
1995-04-09 19:26:23 +00:00
wpaul
406689a5bd Add more sanity checks. *Lots* of sanity checks. Huge tracts of sanity checks.
Make sure all arguments to the yp_*() functions are valid before sending
them off to the server. This is somewhat distressing: once again my
FreeBSD box brought down my entire network because of NIS bogosities.
I *think* the poor argument checking in this module is the cause, but
I still haven't been able to reproduce the exact series of events that
lead to the ypserv crashes. For now I've resorted to sticking my FreeBSD
box in a seprate domain. Hopefully a weekend of heavy testing will
uncover the problem.
1995-03-24 21:21:37 +00:00
wpaul
7cd88703a8 Don't let yp_match() or yp_next() operate on null or empty keys: asking
ypserv to do a yp_match() with an a null or empty key causes much havok.
(Note that this could be construed as a denial of service attack if used
maliciously.)
1995-03-23 22:23:15 +00:00
wpaul
576eeae319 Reviewed by: Bill Paul <wpaul@freebsd.org>
Submitted by:	Sebastian Strollo <seb@erix.ericsson.se>

- In /usr/src/lib/libc/yp/yplib.c, function yp_first when clnt_call
fails with (r != RPC_SUCCESS) ysd->dom_vers should be set to 0! This
ensures that /var/yp/bindings/dom.vers will be read again on retry.
What happens now is that when our server is down and someone tries to
use yp they will continue to try until kingdom come. So:
        if(r != RPC_SUCCESS) {
                clnt_perror(ysd->dom_client, "yp_first: clnt_call");
                ysd->dom_vers = -1;
                               ^^^^ change to 0
                goto again;
        }
1995-03-21 00:48:55 +00:00
wollman
905766ce24 Add back in the YP code from 1.1.5. (This attribution brought to you
by Theo de Raadt.)  Added a new make flag variable, NO_YP_LIBC, which
disables YP entirely.  User-land programs to come later.
1994-08-07 23:04:55 +00:00