Merge lp:~niedbalski/ubuntu/vivid/rpcbind/fix-lp-1430181 into lp:ubuntu/vivid/rpcbind

[Jorge Niedbalski]

[Description]

There is no way to prevent rpcbind from listening on all interfaces for TCP connections. The setting "-h" only applies to UDP connections.

Without this patch, starting rpcbind with -h makes no effect to listen on a specific address:

$ rpcbind -h 192.168.100.2

tcp 0 0 0.0.0.0:111 0.0.0.0:* LISTEN 22011/rpcbind
tcp6 0 0 :::111 :::* LISTEN 22011/rpcbind
udp 0 0 127.0.0.1:111 0.0.0.0:* 22011/rpcbind
udp 0 0 0.0.0.0:986 0.0.0.0:* 22011/rpcbind
udp6 0 0 ::1:111 :::* 22011/rpcbind
udp6 0 0 :::986 :::* 22011/rpcbind

With this patch, starting rpcbind with -h makes effect to listen to a specific address

$ rpcbind -h 192.168.100.2

tcp 0 0 192.168.100.2:111 0.0.0.0:* LISTEN 24826/rpcbind
tcp 0 0 127.0.0.1:111 0.0.0.0:* LISTEN 24826/rpcbind
tcp6 0 0 ::1:111 :::* LISTEN 24826/rpcbind

[Robie Basak (racb)]

I'm not sure this is appropriate to land at this point in the cycle, or in its current form, so I've made general review comments in the bug instead of here.

[Sebastien Bacher (seb128)]

settings as "work in progress" rather than "needs review", seems it needs more work/discussion and is not ready for sponsoring

Unmerged revisions

43. By Jorge Niedbalski on 2015-03-17

debian/patches/rcpbind-tcp-bind-specific-addrs.patch: Make it possible
for rpcbind(8) to bind TCP listening socket to an IP other than INADDR_ANY.
Fixes Bug LP: #1430181.

=== modified file 'debian/changelog'
--- debian/changelog	2015-03-03 08:32:38 +0000
+++ debian/changelog	2015-03-17 18:47:25 +0000
@@ -1,3 +1,11 @@
+rpcbind (0.2.1-6ubuntu3) vivid; urgency=medium
+
+  * debian/patches/rcpbind-tcp-bind-specific-addrs.patch: Make it possible 
+    for rpcbind(8) to bind TCP listening socket to an IP other than INADDR_ANY.
+    Fixes Bug LP: #1430181.
+
+ -- Jorge Niedbalski <[e-mail]>  Tue, 17 Mar 2015 15:31:24 -0300
+
 rpcbind (0.2.1-6ubuntu2) vivid; urgency=medium
 
   * Add systemd unit. Patch by Simon McVittie. (Closes: #748074, LP: #1312976)

=== added file 'debian/patches/rcpbind-tcp-bind-specific-addrs.patch'
--- debian/patches/rcpbind-tcp-bind-specific-addrs.patch	1970-01-01 00:00:00 +0000
+++ debian/patches/rcpbind-tcp-bind-specific-addrs.patch	2015-03-17 18:47:25 +0000
@@ -0,0 +1,245 @@
+Description: Make it possible for rpcbind(8) to bind TCP listening socket to an IP
+other than INADDR_ANY.
+
+Origin: other, https://github.com/freebsd/freebsd/commit/dcf99d183073745b493d80af6381a9a76b899740
+Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/rpcbind/+bug/1430181
+
+--- rpcbind-0.2.1.orig/man/rpcbind.8
++++ rpcbind-0.2.1/man/rpcbind.8
+@@ -85,7 +85,7 @@ checks are shown in detail.
+ .It Fl f
+ Do not fork and become a background process.
+ .It Fl h
+-Specify specific IP addresses to bind to for UDP requests.
++Specify specific IP addresses to bind to for requests.
+ This option
+ may be specified multiple times and is typically necessary when running
+ on a multi-homed host.
+--- rpcbind-0.2.1.orig/src/rpcbind.c
++++ rpcbind-0.2.1/src/rpcbind.c
+@@ -289,7 +289,7 @@ init_transport(struct netconfig *nconf)
+ 	int status;	/* bound checking ? */
+ 	int aicode;
+ 	int addrlen = 0;
+-	int nhostsbak;
++	int nhostsbak = 1;
+ 	int checkbind;
+ 	int on = 1;
+ 	struct sockaddr *sa = NULL;
+@@ -315,18 +315,6 @@ init_transport(struct netconfig *nconf)
+ 	}
+ #endif
+ 
+-	/*
+-	 * XXX - using RPC library internal functions. For NC_TPI_CLTS
+-	 * we call this later, for each socket we like to bind.
+-	 */
+-	if (nconf->nc_semantics != NC_TPI_CLTS) {
+-		if ((fd = __rpc_nconf2fd(nconf)) < 0) {
+-			syslog(LOG_ERR, "cannot create socket for %s",
+-			    nconf->nc_netid);
+-			return (1);
+-		}
+-	}
+-
+ 	if (!__rpc_nconf2sockinfo(nconf, &si)) {
+ 		syslog(LOG_ERR, "cannot get information for %s",
+ 		    nconf->nc_netid);
+@@ -349,8 +337,6 @@ init_transport(struct netconfig *nconf)
+ 		hints.ai_family = si.si_af;
+ 		hints.ai_socktype = si.si_socktype;
+ 		hints.ai_protocol = si.si_proto;
+-	}
+-	if (nconf->nc_semantics == NC_TPI_CLTS) {
+ 		/*
+ 		 * If no hosts were specified, just bind to INADDR_ANY.  Otherwise
+ 		 * make sure 127.0.0.1 is added to the list.
+@@ -368,21 +354,15 @@ init_transport(struct netconfig *nconf)
+ 			} else
+ 				return 1;
+ 		}
+-
+-	       /*
+-		* Bind to specific IPs if asked to
+-		*/
+-		checkbind = 0;
+-		while (nhostsbak > 0) {
+-			--nhostsbak;
+-			/*
+-			 * XXX - using RPC library internal functions.
+-			 */
+-			if ((fd = __rpc_nconf2fd(nconf)) < 0) {
+-				syslog(LOG_ERR, "cannot create socket for %s",
+-				    nconf->nc_netid);
+-				return (1);
+-			}
++	}
++       /*
++	* Bind to specific IPs if asked to
++	*/
++	checkbind = 0;
++	while (nhostsbak > 0) {
++		--nhostsbak;
++		if ((strcmp(nconf->nc_netid, "local") != 0) &&
++		    (strcmp(nconf->nc_netid, "unix") != 0)) {
+ 			switch (hints.ai_family) {
+ 			case AF_INET:
+ 				if (inet_pton(AF_INET, hosts[nhostsbak],
+@@ -409,7 +389,7 @@ init_transport(struct netconfig *nconf)
+ 					    host_addr) == 1)
+ 						continue;
+ 				}
+-	        		break;
++				break;
+ 			default:
+ 				break;
+ 			}
+@@ -432,97 +412,37 @@ init_transport(struct netconfig *nconf)
+ 			}
+ 			addrlen = res->ai_addrlen;
+ 			sa = (struct sockaddr *)res->ai_addr;
+-			oldmask = umask(S_IXUSR|S_IXGRP|S_IXOTH);
+-                        if (bind(fd, sa, addrlen) != 0) {
+-				syslog(LOG_ERR, "cannot bind %s on %s: %m",
+-					(hosts[nhostsbak] == NULL) ? "*" :
+-					hosts[nhostsbak], nconf->nc_netid);
+-				if (res != NULL)
+-					freeaddrinfo(res);
+-				continue;
+-			} else
+-				checkbind++;
+-			(void) umask(oldmask);
++		}
+ 
+-			/* Copy the address */
+-			taddr.addr.maxlen = taddr.addr.len = addrlen;
+-			taddr.addr.buf = malloc(addrlen);
+-			if (taddr.addr.buf == NULL) {
+-				syslog(LOG_ERR,
+-				    "cannot allocate memory for %s address",
+-				    nconf->nc_netid);
++		/*
++		 * XXX - using RPC library internal functions.
++		 */
++		if ((fd = __rpc_nconf2fd(nconf)) < 0) {
++			syslog(LOG_ERR, "cannot create socket for %s",
++			    nconf->nc_netid);
++			continue;
++		}
++		oldmask = umask(S_IXUSR|S_IXGRP|S_IXOTH);
++		if (nconf->nc_semantics != NC_TPI_CLTS) {
++			__rpc_fd2sockinfo(fd, &si);
++			if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &on,
++					sizeof(on)) != 0) {
++				syslog(LOG_ERR, "cannot set SO_REUSEADDR on %s",
++					nconf->nc_netid);
+ 				if (res != NULL)
+ 					freeaddrinfo(res);
+-				return 1;
+-			}
+-			memcpy(taddr.addr.buf, sa, addrlen);
+-#ifdef RPCBIND_DEBUG
+-			if (debugging) {
+-				/*
+-				 * for debugging print out our universal
+-				 * address
+-				 */
+-				char *uaddr;
+-				struct netbuf nb;
+-				int sa_size = 0;
+-
+-				nb.buf = sa;
+-				switch( sa->sa_family){
+-				case AF_INET:
+-				  sa_size = sizeof (struct sockaddr_in);
+-				  break;
+-				case AF_INET6:
+-				  sa_size = sizeof (struct sockaddr_in6);				 
+-				  break;
+-				}
+-				nb.len = nb.maxlen = sa_size;
+-				uaddr = taddr2uaddr(nconf, &nb);
+-				(void) fprintf(stderr,
+-				    "rpcbind : my address is %s\n", uaddr);
+-				(void) free(uaddr);
+-			}
+-#endif
+-			my_xprt = (SVCXPRT *)svc_tli_create(fd, nconf, &taddr, 
+-                                RPC_MAXDATASIZE, RPC_MAXDATASIZE);
+-			if (my_xprt == (SVCXPRT *)NULL) {
+-				syslog(LOG_ERR, "%s: could not create service", 
+-                                        nconf->nc_netid);
+-				goto error;
+-			}
+-		}
+-		if (!checkbind)
+-			return 1;
+-	} else {	/* NC_TPI_COTS */
+-		if ((strcmp(nconf->nc_netid, "local") != 0) &&
+-		    (strcmp(nconf->nc_netid, "unix") != 0)) {
+-			if ((aicode = getaddrinfo(NULL, servname, &hints, &res))!= 0) {
+-			  if ((aicode = getaddrinfo(NULL, "portmapper", &hints, &res))!= 0) {
+-			  printf("cannot get local address for %s: %s",  nconf->nc_netid, gai_strerror(aicode));
+-			  syslog(LOG_ERR,
+-				    "cannot get local address for %s: %s",
+-				    nconf->nc_netid, gai_strerror(aicode));
+-				return 1;
+-			  }
++				continue;
+ 			}
+-			addrlen = res->ai_addrlen;
+-			sa = (struct sockaddr *)res->ai_addr;
+-		}
+-		oldmask = umask(S_IXUSR|S_IXGRP|S_IXOTH);
+-		__rpc_fd2sockinfo(fd, &si);
+-		if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &on,
+-				sizeof(on)) != 0) {
+-			syslog(LOG_ERR, "cannot set SO_REUSEADDR on %s",
+-				nconf->nc_netid);
+-			if (res != NULL)
+-				freeaddrinfo(res);
+-			return 1;
+ 		}
+ 		if (bind(fd, sa, addrlen) < 0) {
+-			syslog(LOG_ERR, "cannot bind %s: %m", nconf->nc_netid);
++			syslog(LOG_ERR, "cannot bind %s on %s: %m",
++				(hosts && hosts[nhostsbak]) ? hosts[nhostsbak] : "*",
++				nconf->nc_netid);
+ 			if (res != NULL)
+ 				freeaddrinfo(res);
+-			return 1;
+-		}
++			continue;
++		} else
++			checkbind++;
+ 		(void) umask(oldmask);
+ 
+ 		/* Copy the address */
+@@ -541,7 +461,7 @@ init_transport(struct netconfig *nconf)
+ 			/* for debugging print out our universal address */
+ 			char *uaddr;
+ 			struct netbuf nb;
+-		        int sa_size2 = 0;
++			int sa_size2 = 0;
+ 
+ 			nb.buf = sa;
+ 			switch( sa->sa_family){
+@@ -560,7 +480,8 @@ init_transport(struct netconfig *nconf)
+ 		}
+ #endif
+ 
+-		listen(fd, SOMAXCONN);
++		if (nconf->nc_semantics != NC_TPI_CLTS)
++			listen(fd, SOMAXCONN);
+ 
+ 		my_xprt = (SVCXPRT *)svc_tli_create(fd, nconf, &taddr, RPC_MAXDATASIZE, RPC_MAXDATASIZE);
+ 		if (my_xprt == (SVCXPRT *)NULL) {
+@@ -569,6 +490,8 @@ init_transport(struct netconfig *nconf)
+ 			goto error;
+ 		}
+ 	}
++	if (!checkbind)
++		return 1;
+ 
+ #ifdef PORTMAP
+ 	/*

=== modified file 'debian/patches/series'
--- debian/patches/series	2014-01-14 00:27:44 +0000
+++ debian/patches/series	2015-03-17 18:47:25 +0000
@@ -2,3 +2,4 @@
 03-563971-warmstart-error-msg.patch
 04-610718-non-linux.patch
 run-migration
+rcpbind-tcp-bind-specific-addrs.patch