Reduce white space diffs between FreeBSD.
[dragonfly.git] / libexec / rshd / rshd.c
1 /*-
2  * Copyright (c) 1988, 1989, 1992, 1993, 1994
3  *      The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 3. All advertising materials mentioning features or use of this software
14  *    must display the following acknowledgement:
15  *      This product includes software developed by the University of
16  *      California, Berkeley and its contributors.
17  * 4. Neither the name of the University nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  * @(#) Copyright (c) 1988, 1989, 1992, 1993, 1994 The Regents of the University of California.  All rights reserved.
34  * @(#)rshd.c   8.2 (Berkeley) 4/6/94
35  * $FreeBSD: src/libexec/rshd/rshd.c,v 1.30.2.5 2002/05/14 22:27:21 des Exp $
36  * $DragonFly: src/libexec/rshd/rshd.c,v 1.3 2003/11/14 03:54:31 dillon Exp $
37  */
38
39 /*
40  * remote shell server:
41  *      [port]\0
42  *      remuser\0
43  *      locuser\0
44  *      command\0
45  *      data
46  */
47 #include <sys/param.h>
48 #include <sys/ioctl.h>
49 #include <sys/time.h>
50 #include <sys/socket.h>
51
52 #include <netinet/in_systm.h>
53 #include <netinet/in.h>
54 #include <netinet/ip.h>
55 #include <netinet/tcp.h>
56 #include <arpa/inet.h>
57 #include <netdb.h>
58
59 #include <errno.h>
60 #include <fcntl.h>
61 #include <libutil.h>
62 #include <paths.h>
63 #include <pwd.h>
64 #include <signal.h>
65 #include <stdio.h>
66 #include <stdlib.h>
67 #include <string.h>
68 #include <syslog.h>
69 #include <unistd.h>
70 #ifdef  LOGIN_CAP
71 #include <login_cap.h>
72 #endif
73
74 /* wrapper for KAME-special getnameinfo() */
75 #ifndef NI_WITHSCOPEID
76 #define NI_WITHSCOPEID  0
77 #endif
78
79 int     keepalive = 1;
80 int     log_success;            /* If TRUE, log all successful accesses */
81 int     sent_null;
82 int     no_delay;
83 #ifdef CRYPT
84 int     doencrypt = 0;
85 #endif
86
87 union sockunion {
88         struct sockinet {
89                 u_char si_len;
90                 u_char si_family;
91                 u_short si_port;
92         } su_si;
93         struct sockaddr_in  su_sin;
94         struct sockaddr_in6 su_sin6;
95 };
96 #define su_len          su_si.si_len
97 #define su_family       su_si.si_family
98 #define su_port         su_si.si_port
99
100 void     doit (union sockunion *);
101 void     error (const char *, ...);
102 void     getstr (char *, int, char *);
103 int      local_domain (char *);
104 char    *topdomain (char *);
105 void     usage (void);
106
107 #define OPTIONS "alnDL"
108
109 int
110 main(argc, argv)
111         int argc;
112         char *argv[];
113 {
114         extern int __check_rhosts_file;
115         struct linger linger;
116         int ch, on = 1, fromlen;
117         struct sockaddr_storage from;
118
119         openlog("rshd", LOG_PID | LOG_ODELAY, LOG_DAEMON);
120
121         opterr = 0;
122         while ((ch = getopt(argc, argv, OPTIONS)) != -1)
123                 switch (ch) {
124                 case 'a':
125                         /* ignored for compatibility */
126                         break;
127                 case 'l':
128                         __check_rhosts_file = 0;
129                         break;
130                 case 'n':
131                         keepalive = 0;
132                         break;
133 #ifdef CRYPT
134                 case 'x':
135                         doencrypt = 1;
136                         break;
137 #endif
138                 case 'D':
139                         no_delay = 1;
140                         break;
141                 case 'L':
142                         log_success = 1;
143                         break;
144                 case '?':
145                 default:
146                         usage();
147                         break;
148                 }
149
150         argc -= optind;
151         argv += optind;
152
153 #ifdef CRYPT
154         if (doencrypt) {
155                 syslog(LOG_ERR, "-k is required for -x");
156                 exit(2);
157         }
158 #endif
159
160         fromlen = sizeof (from);
161         if (getpeername(0, (struct sockaddr *)&from, &fromlen) < 0) {
162                 syslog(LOG_ERR, "getpeername: %m");
163                 exit(1);
164         }
165         if (keepalive &&
166             setsockopt(0, SOL_SOCKET, SO_KEEPALIVE, (char *)&on,
167             sizeof(on)) < 0)
168                 syslog(LOG_WARNING, "setsockopt (SO_KEEPALIVE): %m");
169         linger.l_onoff = 1;
170         linger.l_linger = 60;                   /* XXX */
171         if (setsockopt(0, SOL_SOCKET, SO_LINGER, (char *)&linger,
172             sizeof (linger)) < 0)
173                 syslog(LOG_WARNING, "setsockopt (SO_LINGER): %m");
174         if (no_delay &&
175             setsockopt(0, IPPROTO_TCP, TCP_NODELAY, &on, sizeof(on)) < 0)
176                 syslog(LOG_WARNING, "setsockopt (TCP_NODELAY): %m");
177         doit((union sockunion *)&from);
178         /* NOTREACHED */
179         return(0);
180 }
181
182 char    username[20] = "USER=";
183 char    homedir[64] = "HOME=";
184 char    shell[64] = "SHELL=";
185 char    path[100] = "PATH=";
186 char    *envinit[] =
187             {homedir, shell, path, username, 0};
188 char    **environ;
189
190 void
191 doit(fromp)
192         union sockunion *fromp;
193 {
194         extern char *__rcmd_errstr;     /* syslog hook from libc/net/rcmd.c. */
195         struct passwd *pwd;
196         u_short port;
197         fd_set ready, readfrom;
198         int cc, nfd, pv[2], pid, s;
199         int one = 1;
200         char *errorstr;
201         char *cp, sig, buf[BUFSIZ];
202         char cmdbuf[NCARGS+1], locuser[16], remuser[16];
203         char fromhost[2 * MAXHOSTNAMELEN + 1];
204         char numericname[INET6_ADDRSTRLEN];
205         int af = fromp->su_family, err;
206 #ifdef  CRYPT
207         int rc;
208         int pv1[2], pv2[2];
209 #endif
210 #ifdef  LOGIN_CAP
211         login_cap_t *lc;
212 #endif
213
214         (void) signal(SIGINT, SIG_DFL);
215         (void) signal(SIGQUIT, SIG_DFL);
216         (void) signal(SIGTERM, SIG_DFL);
217         fromp->su_port = ntohs((u_short)fromp->su_port);
218         if (af != AF_INET
219 #ifdef INET6
220             && af != AF_INET6
221 #endif
222             ) {
223                 syslog(LOG_ERR, "malformed \"from\" address (af %d)\n", af);
224                 exit(1);
225         }
226         err = getnameinfo((struct sockaddr *)fromp, fromp->su_len, numericname,
227                           sizeof(numericname), NULL, 0,
228                           NI_NUMERICHOST|NI_WITHSCOPEID);
229         /* XXX: do 'err' check */
230 #ifdef IP_OPTIONS
231       if (af == AF_INET) {
232         u_char optbuf[BUFSIZ/3];
233         int optsize = sizeof(optbuf), ipproto, i;
234         struct protoent *ip;
235
236         if ((ip = getprotobyname("ip")) != NULL)
237                 ipproto = ip->p_proto;
238         else
239                 ipproto = IPPROTO_IP;
240         if (!getsockopt(0, ipproto, IP_OPTIONS, (char *)optbuf, &optsize) &&
241             optsize != 0) {
242                 for (i = 0; i < optsize; ) {
243                         u_char c = optbuf[i];
244                         if (c == IPOPT_LSRR || c == IPOPT_SSRR) {
245                                 syslog(LOG_NOTICE,
246                                         "connection refused from %s with IP option %s",
247                                         numericname,
248                                         c == IPOPT_LSRR ? "LSRR" : "SSRR");
249                                 exit(1);
250                         }
251                         if (c == IPOPT_EOL)
252                                 break;
253                         i += (c == IPOPT_NOP) ? 1 : optbuf[i+1];
254                 }
255         }
256       }
257 #endif
258
259         if (fromp->su_port >= IPPORT_RESERVED ||
260             fromp->su_port < IPPORT_RESERVED/2) {
261                 syslog(LOG_NOTICE|LOG_AUTH,
262                     "connection from %s on illegal port %u",
263                     numericname,
264                     fromp->su_port);
265                 exit(1);
266         }
267
268         (void) alarm(60);
269         port = 0;
270         s = 0;          /* not set or used if port == 0 */
271         for (;;) {
272                 char c;
273                 if ((cc = read(STDIN_FILENO, &c, 1)) != 1) {
274                         if (cc < 0)
275                                 syslog(LOG_NOTICE, "read: %m");
276                         shutdown(0, 1+1);
277                         exit(1);
278                 }
279                 if (c == 0)
280                         break;
281                 port = port * 10 + c - '0';
282         }
283
284         (void) alarm(0);
285         if (port != 0) {
286                 int lport = IPPORT_RESERVED - 1;
287                 s = rresvport_af(&lport, af);
288                 if (s < 0) {
289                         syslog(LOG_ERR, "can't get stderr port: %m");
290                         exit(1);
291                 }
292                 if (port >= IPPORT_RESERVED ||
293                     port < IPPORT_RESERVED/2) {
294                         syslog(LOG_NOTICE|LOG_AUTH,
295                             "2nd socket from %s on unreserved port %u",
296                             numericname,
297                             port);
298                         exit(1);
299                 }
300                 fromp->su_port = htons(port);
301                 if (connect(s, (struct sockaddr *)fromp, fromp->su_len) < 0) {
302                         syslog(LOG_INFO, "connect second port %d: %m", port);
303                         exit(1);
304                 }
305         }
306
307         errorstr = NULL;
308         realhostname_sa(fromhost, sizeof(fromhost) - 1,
309                         (struct sockaddr *)fromp,
310                         fromp->su_len);
311         fromhost[sizeof(fromhost) - 1] = '\0';
312
313 #ifdef CRYPT
314         if (doencrypt && af == AF_INET) {
315                 struct sockaddr_in local_addr;
316                 rc = sizeof(local_addr);
317                 if (getsockname(0, (struct sockaddr *)&local_addr,
318                     &rc) < 0) {
319                         syslog(LOG_ERR, "getsockname: %m");
320                         error("rlogind: getsockname: %m");
321                         exit(1);
322                 }
323                 authopts = KOPT_DO_MUTUAL;
324                 rc = krb_recvauth(authopts, 0, ticket,
325                         "rcmd", instance, &fromaddr,
326                         &local_addr, kdata, "", schedule,
327                         version);
328                 des_set_key(&kdata->session, schedule);
329         }
330 #endif
331         (void) alarm(60);
332         getstr(remuser, sizeof(remuser), "remuser");
333         getstr(locuser, sizeof(locuser), "locuser");
334         getstr(cmdbuf, sizeof(cmdbuf), "command");
335         (void) alarm(0);
336         setpwent();
337         pwd = getpwnam(locuser);
338         if (pwd == NULL) {
339                 syslog(LOG_INFO|LOG_AUTH,
340                     "%s@%s as %s: unknown login. cmd='%.80s'",
341                     remuser, fromhost, locuser, cmdbuf);
342                 if (errorstr == NULL)
343                         errorstr = "Login incorrect.\n";
344                 goto fail;
345         }
346 #ifdef  LOGIN_CAP
347         lc = login_getpwclass(pwd);
348 #endif
349         if (chdir(pwd->pw_dir) < 0) {
350 #ifdef  LOGIN_CAP
351                 if (chdir("/") < 0 ||
352                     login_getcapbool(lc, "requirehome", !!pwd->pw_uid)) {
353                         syslog(LOG_INFO|LOG_AUTH,
354                         "%s@%s as %s: no home directory. cmd='%.80s'",
355                         remuser, fromhost, locuser, cmdbuf);
356                         error("No remote home directory.\n");
357                         exit(0);
358                 }
359 #else
360                 (void) chdir("/");
361 #ifdef notdef
362                 syslog(LOG_INFO|LOG_AUTH,
363                     "%s@%s as %s: no home directory. cmd='%.80s'",
364                     remuser, fromhost, locuser, cmdbuf);
365                 error("No remote directory.\n");
366                 exit(1);
367 #endif
368 #endif
369                 pwd->pw_dir = "/";
370         }
371
372                 if (errorstr ||
373                     (pwd->pw_expire && time(NULL) >= pwd->pw_expire) ||
374                     iruserok_sa(fromp, fromp->su_len, pwd->pw_uid == 0,
375                                  remuser, locuser) < 0) {
376                         if (__rcmd_errstr)
377                                 syslog(LOG_INFO|LOG_AUTH,
378                             "%s@%s as %s: permission denied (%s). cmd='%.80s'",
379                                     remuser, fromhost, locuser, __rcmd_errstr,
380                                     cmdbuf);
381                         else
382                                 syslog(LOG_INFO|LOG_AUTH,
383                             "%s@%s as %s: permission denied. cmd='%.80s'",
384                                     remuser, fromhost, locuser, cmdbuf);
385 fail:
386                         if (errorstr == NULL)
387                                 errorstr = "Login incorrect.\n";
388                         error(errorstr, fromhost);
389                         exit(1);
390                 }
391
392         if (pwd->pw_uid && !access(_PATH_NOLOGIN, F_OK)) {
393                 error("Logins currently disabled.\n");
394                 exit(1);
395         }
396 #ifdef  LOGIN_CAP
397         if (lc != NULL && fromp->su_family == AF_INET) {        /*XXX*/
398                 char    remote_ip[MAXHOSTNAMELEN];
399
400                 strncpy(remote_ip, numericname,
401                         sizeof(remote_ip) - 1);
402                 remote_ip[sizeof(remote_ip) - 1] = 0;
403                 if (!auth_hostok(lc, fromhost, remote_ip)) {
404                         syslog(LOG_INFO|LOG_AUTH,
405                             "%s@%s as %s: permission denied (%s). cmd='%.80s'",
406                             remuser, fromhost, locuser, __rcmd_errstr,
407                             cmdbuf);
408                         error("Login incorrect.\n");
409                         exit(1);
410                 }
411                 if (!auth_timeok(lc, time(NULL))) {
412                         error("Logins not available right now\n");
413                         exit(1);
414                 }
415         }
416 #endif  /* !LOGIN_CAP */
417 #if     BSD > 43
418         /* before fork, while we're session leader */
419         if (setlogin(pwd->pw_name) < 0)
420                 syslog(LOG_ERR, "setlogin() failed: %m");
421 #endif
422
423         (void) write(STDERR_FILENO, "\0", 1);
424         sent_null = 1;
425
426         if (port) {
427                 if (pipe(pv) < 0) {
428                         error("Can't make pipe.\n");
429                         exit(1);
430                 }
431 #ifdef CRYPT
432                 if (doencrypt) {
433                         if (pipe(pv1) < 0) {
434                                 error("Can't make 2nd pipe.\n");
435                                 exit(1);
436                         }
437                         if (pipe(pv2) < 0) {
438                                 error("Can't make 3rd pipe.\n");
439                                 exit(1);
440                         }
441                 }
442 #endif
443                 pid = fork();
444                 if (pid == -1)  {
445                         error("Can't fork; try again.\n");
446                         exit(1);
447                 }
448                 if (pid) {
449 #ifdef CRYPT
450                         if (doencrypt) {
451                                 static char msg[] = SECURE_MESSAGE;
452                                 (void) close(pv1[1]);
453                                 (void) close(pv2[1]);
454                                 des_enc_write(s, msg, sizeof(msg) - 1, 
455                                         schedule, &kdata->session);
456
457                         } else
458 #endif
459                         {
460                                 (void) close(0);
461                                 (void) close(1);
462                         }
463                         (void) close(2);
464                         (void) close(pv[1]);
465
466                         FD_ZERO(&readfrom);
467                         FD_SET(s, &readfrom);
468                         FD_SET(pv[0], &readfrom);
469                         if (pv[0] > s)
470                                 nfd = pv[0];
471                         else
472                                 nfd = s;
473 #ifdef CRYPT
474                         if (doencrypt) {
475                                 FD_ZERO(&writeto);
476                                 FD_SET(pv2[0], &writeto);
477                                 FD_SET(pv1[0], &readfrom);
478
479                                 nfd = MAX(nfd, pv2[0]);
480                                 nfd = MAX(nfd, pv1[0]);
481                         } else
482 #endif
483                                 ioctl(pv[0], FIONBIO, (char *)&one);
484
485                         /* should set s nbio! */
486                         nfd++;
487                         do {
488                                 ready = readfrom;
489 #ifdef CRYPT
490                                 if (doencrypt) {
491                                         wready = writeto;
492                                         if (select(nfd, &ready,
493                                             &wready, (fd_set *) 0,
494                                             (struct timeval *) 0) < 0)
495                                                 break;
496                                 } else
497 #endif
498                                         if (select(nfd, &ready, (fd_set *)0,
499                                           (fd_set *)0, (struct timeval *)0) < 0)
500                                                 break;
501                                 if (FD_ISSET(s, &ready)) {
502                                         int     ret;
503 #ifdef CRYPT
504                                         if (doencrypt)
505                                                 ret = des_enc_read(s, &sig, 1,
506                                                 schedule, &kdata->session);
507                                         else
508 #endif
509                                                 ret = read(s, &sig, 1);
510                                         if (ret <= 0)
511                                                 FD_CLR(s, &readfrom);
512                                         else
513                                                 killpg(pid, sig);
514                                 }
515                                 if (FD_ISSET(pv[0], &ready)) {
516                                         errno = 0;
517                                         cc = read(pv[0], buf, sizeof(buf));
518                                         if (cc <= 0) {
519                                                 shutdown(s, 1+1);
520                                                 FD_CLR(pv[0], &readfrom);
521                                         } else {
522 #ifdef CRYPT
523                                                 if (doencrypt)
524                                                         (void)
525                                                           des_enc_write(s, buf, cc,
526                                                                 schedule, &kdata->session);
527                                                 else
528 #endif
529                                                         (void)
530                                                           write(s, buf, cc);
531                                         }
532                                 }
533 #ifdef CRYPT
534                                 if (doencrypt && FD_ISSET(pv1[0], &ready)) {
535                                         errno = 0;
536                                         cc = read(pv1[0], buf, sizeof(buf));
537                                         if (cc <= 0) {
538                                                 shutdown(pv1[0], 1+1);
539                                                 FD_CLR(pv1[0], &readfrom);
540                                         } else
541                                                 (void) des_enc_write(STDOUT_FILENO,
542                                                     buf, cc,
543                                                         schedule, &kdata->session);
544                                 }
545
546                                 if (doencrypt && FD_ISSET(pv2[0], &wready)) {
547                                         errno = 0;
548                                         cc = des_enc_read(STDIN_FILENO,
549                                             buf, sizeof(buf),
550                                                 schedule, &kdata->session);
551                                         if (cc <= 0) {
552                                                 shutdown(pv2[0], 1+1);
553                                                 FD_CLR(pv2[0], &writeto);
554                                         } else
555                                                 (void) write(pv2[0], buf, cc);
556                                 }
557 #endif
558
559                         } while (FD_ISSET(s, &readfrom) ||
560 #ifdef CRYPT
561                             (doencrypt && FD_ISSET(pv1[0], &readfrom)) ||
562 #endif
563                             FD_ISSET(pv[0], &readfrom));
564                         exit(0);
565                 }
566                 setpgrp(0, getpid());
567                 (void) close(s);
568                 (void) close(pv[0]);
569 #ifdef CRYPT
570                 if (doencrypt) {
571                         close(pv1[0]); close(pv2[0]);
572                         dup2(pv1[1], 1);
573                         dup2(pv2[1], 0);
574                         close(pv1[1]);
575                         close(pv2[1]);
576                 }
577 #endif
578                 dup2(pv[1], 2);
579                 close(pv[1]);
580         }
581         if (*pwd->pw_shell == '\0')
582                 pwd->pw_shell = _PATH_BSHELL;
583         environ = envinit;
584         strncat(homedir, pwd->pw_dir, sizeof(homedir)-6);
585         strcat(path, _PATH_DEFPATH);
586         strncat(shell, pwd->pw_shell, sizeof(shell)-7);
587         strncat(username, pwd->pw_name, sizeof(username)-6);
588         cp = strrchr(pwd->pw_shell, '/');
589         if (cp)
590                 cp++;
591         else
592                 cp = pwd->pw_shell;
593 #ifdef  LOGIN_CAP
594         if (setusercontext(lc, pwd, pwd->pw_uid, LOGIN_SETALL) != 0) {
595                 syslog(LOG_ERR, "setusercontext: %m");
596                 exit(1);
597         }
598         login_close(lc);
599 #else
600         (void) setgid((gid_t)pwd->pw_gid);
601         initgroups(pwd->pw_name, pwd->pw_gid);
602         (void) setuid((uid_t)pwd->pw_uid);
603 #endif
604         endpwent();
605         if (log_success || pwd->pw_uid == 0) {
606                     syslog(LOG_INFO|LOG_AUTH, "%s@%s as %s: cmd='%.80s'",
607                         remuser, fromhost, locuser, cmdbuf);
608         }
609         execl(pwd->pw_shell, cp, "-c", cmdbuf, 0);
610         perror(pwd->pw_shell);
611         exit(1);
612 }
613
614 /*
615  * Report error to client.  Note: can't be used until second socket has
616  * connected to client, or older clients will hang waiting for that
617  * connection first.
618  */
619 #if __STDC__
620 #include <stdarg.h>
621 #else
622 #include <varargs.h>
623 #endif
624
625 void
626 #if __STDC__
627 error(const char *fmt, ...)
628 #else
629 error(fmt, va_alist)
630         char *fmt;
631         va_dcl
632 #endif
633 {
634         va_list ap;
635         int len;
636         char *bp, buf[BUFSIZ];
637 #if __STDC__
638         va_start(ap, fmt);
639 #else
640         va_start(ap);
641 #endif
642         bp = buf;
643         if (sent_null == 0) {
644                 *bp++ = 1;
645                 len = 1;
646         } else
647                 len = 0;
648         (void)vsnprintf(bp, sizeof(buf) - 1, fmt, ap);
649         (void)write(STDERR_FILENO, buf, len + strlen(bp));
650 }
651
652 void
653 getstr(buf, cnt, err)
654         char *buf, *err;
655         int cnt;
656 {
657         char c;
658
659         do {
660                 if (read(STDIN_FILENO, &c, 1) != 1)
661                         exit(1);
662                 *buf++ = c;
663                 if (--cnt == 0) {
664                         error("%s too long\n", err);
665                         exit(1);
666                 }
667         } while (c != 0);
668 }
669
670 /*
671  * Check whether host h is in our local domain,
672  * defined as sharing the last two components of the domain part,
673  * or the entire domain part if the local domain has only one component.
674  * If either name is unqualified (contains no '.'),
675  * assume that the host is local, as it will be
676  * interpreted as such.
677  */
678 int
679 local_domain(h)
680         char *h;
681 {
682         char localhost[MAXHOSTNAMELEN];
683         char *p1, *p2;
684
685         localhost[0] = 0;
686         (void) gethostname(localhost, sizeof(localhost) - 1);
687         localhost[sizeof(localhost) - 1] = '\0';
688         p1 = topdomain(localhost);
689         p2 = topdomain(h);
690         if (p1 == NULL || p2 == NULL || !strcasecmp(p1, p2))
691                 return (1);
692         return (0);
693 }
694
695 char *
696 topdomain(h)
697         char *h;
698 {
699         char *p, *maybe = NULL;
700         int dots = 0;
701
702         for (p = h + strlen(h); p >= h; p--) {
703                 if (*p == '.') {
704                         if (++dots == 2)
705                                 return (p);
706                         maybe = p;
707                 }
708         }
709         return (maybe);
710 }
711
712 void
713 usage()
714 {
715
716         syslog(LOG_ERR, "usage: rshd [-%s]", OPTIONS);
717         exit(2);
718 }