cmd/rpcbind/rpcb_svc_com.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */
/*
 * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
 */
/* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */
/* All Rights Reserved */
/*
 * University Copyright- Copyright (c) 1982, 1986, 1988
 * The Regents of the University of California
 * All Rights Reserved
 *
 * University Acknowledgment- Portions of this document are derived from
 * software developed by the University of California, Berkeley, and its
 * contributors.
 */

/*
 * rpcb_svc_com.c
 * The commom server procedure for the rpcbind.
 */

#include <stdio.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <strings.h>
#include <rpc/rpc.h>
#include <rpc/rpcb_prot.h>
#include <rpcsvc/svc_dg_priv.h>
#include <netconfig.h>
#include <sys/param.h>
#include <errno.h>
#include <zone.h>
#include <sys/poll.h>
#include <sys/stropts.h>
#ifdef PORTMAP
#include <netinet/in.h>
#include <rpc/pmap_prot.h>
#else
#define PMAPVERS    2
#endif /* PORTMAP */
#include <syslog.h>
#include <netdir.h>
#include <ucred.h>
#include <alloca.h>
#include <rpcsvc/yp_prot.h>
#include <nfs/nfs.h>
#include <nfs/nfs_acl.h>
#include <rpcsvc/mount.h>
#include <nfs/nfs_acl.h>
#include <rpc/key_prot.h>
#include <rpcsvc/yp_prot.h>
#include <rpcsvc/rquota.h>
#include <rpcsvc/yppasswd.h>
#include <rpcsvc/ypupd.h>
#include <assert.h>
#include <synch.h>
#include "rpcbind.h"

static struct finfo *forward_register(ulong_t, struct netbuf *, int, char *);
static void forward_destroy(struct finfo *);
static void handle_reply(svc_input_id_t, int, unsigned int, void *);
static int netbufcmp(struct netbuf *, struct netbuf *);
static void netbuffree(struct netbuf *);
static struct netbuf *netbufdup(struct netbuf *);
static void find_versions(rpcprog_t, char *, rpcvers_t *, rpcvers_t *);
static rpcblist_ptr find_service(ulong_t, ulong_t, char *);
#ifdef PORTMAP
static int add_pmaplist(RPCB *);
#endif

zoneid_t myzone;

/*
 * Set a mapping of program, version, netid
 */
bool_t
rpcbproc_set_com(RPCB *regp, bool_t *result, struct svc_req *rqstp,
    int rpcbversnum)
{
    char owner[64];

    *result = map_set(regp, getowner(rqstp->rq_xprt, owner));

    rpcbs_set(rpcbversnum - PMAPVERS, *result);

    return (TRUE);
}

bool_t
map_set(RPCB *regp, char *owner)
{
    RPCB *a;
    rpcblist_ptr rbl, fnd;

    /*
     * check to see if already used
     * find_service returns a hit even if
     * the versions don't match, so check for it
     */
    (void) rw_wrlock(&list_rbl_lock);
#ifdef PORTMAP
    (void) rw_wrlock(&list_pml_lock);
#endif /* PORTMAP */
    fnd = find_service(regp->r_prog, regp->r_vers, regp->r_netid);
    if (fnd && (fnd->rpcb_map.r_vers == regp->r_vers)) {
        if (strcmp(fnd->rpcb_map.r_addr, regp->r_addr) == 0) {
            /*
             * if these match then it is already
             * registered so just say "OK".
             */
#ifdef PORTMAP
            (void) rw_unlock(&list_pml_lock);
#endif /* PORTMAP */
            (void) rw_unlock(&list_rbl_lock);
            return (TRUE);
        } else {
            /*
             * Check if server is up.  If so, return FALSE.
             * If not, cleanup old registrations for the
             * program and register the new server.
             */
            if (is_bound(fnd->rpcb_map.r_netid,
                fnd->rpcb_map.r_addr)) {
#ifdef PORTMAP
                (void) rw_unlock(&list_pml_lock);
#endif /* PORTMAP */
                (void) rw_unlock(&list_rbl_lock);
                return (FALSE);
            }

            delete_prog(regp->r_prog);
            fnd = NULL;
        }
    }
#ifdef PORTMAP
    (void) rw_unlock(&list_pml_lock);
#endif /* PORTMAP */

    /*
     * add to the end of the list
     */
    rbl = malloc(sizeof (RPCBLIST));
    if (rbl == NULL) {
        (void) rw_unlock(&list_rbl_lock);
        return (FALSE);
    }
    a = &rbl->rpcb_map;
    a->r_prog = regp->r_prog;
    a->r_vers = regp->r_vers;
    a->r_netid = strdup(regp->r_netid);
    a->r_addr = strdup(regp->r_addr);
    a->r_owner = strdup(owner);
    if (a->r_addr == NULL || a->r_netid == NULL|| a->r_owner == NULL) {
        (void) rw_unlock(&list_rbl_lock);
        delete_rbl(rbl);
        return (FALSE);
    }
    rbl->rpcb_next = NULL;
    if (list_rbl == NULL) {
        list_rbl = rbl;
    } else {
        for (fnd = list_rbl; fnd->rpcb_next; fnd = fnd->rpcb_next)
            ;
        fnd->rpcb_next = rbl;
    }

#ifdef PORTMAP
    (void) add_pmaplist(regp);
#endif
    (void) rw_unlock(&list_rbl_lock);
    return (TRUE);
}

/*
 * Unset a mapping of program, version, netid
 */
bool_t
rpcbproc_unset_com(RPCB *regp, bool_t *result, struct svc_req *rqstp,
    int rpcbversnum)
{
    char owner[64];

    *result = map_unset(regp, getowner(rqstp->rq_xprt, owner));

    rpcbs_unset(rpcbversnum - PMAPVERS, *result);

    return (TRUE);
}

bool_t
map_unset(RPCB *regp, char *owner)
{
#ifdef PORTMAP
    int ans = 0;
#endif
    rpcblist_ptr rbl, next, prev = NULL;

    if (owner == NULL)
        return (0);

    (void) rw_wrlock(&list_rbl_lock);
    for (rbl = list_rbl; rbl != NULL; rbl = next) {
        next = rbl->rpcb_next;

        if ((rbl->rpcb_map.r_prog != regp->r_prog) ||
            (rbl->rpcb_map.r_vers != regp->r_vers) ||
            (regp->r_netid[0] && strcasecmp(regp->r_netid,
            rbl->rpcb_map.r_netid))) {
            /* prev moves forwards */
            prev = rbl;
            continue;
        }

        /*
         * Check whether appropriate uid. Unset only
         * if superuser or the owner itself.
         */
        if (strcmp(owner, "superuser") &&
            strcmp(rbl->rpcb_map.r_owner, owner)) {
            (void) rw_unlock(&list_rbl_lock);
            return (0);
        }

        /* prev stays */
#ifdef PORTMAP
        ans = 1;
#endif
        delete_rbl(rbl);

        if (prev == NULL)
            list_rbl = next;
        else
            prev->rpcb_next = next;
    }
#ifdef PORTMAP
    if (ans != 0) {
        (void) rw_wrlock(&list_pml_lock);
        (void) del_pmaplist(regp);
        (void) rw_unlock(&list_pml_lock);
    }
#endif
    (void) rw_unlock(&list_rbl_lock);

    /*
     * We return 1 either when the entry was not there or it
     * was able to unset it.  It can come to this point only if
     * at least one of the conditions is true.
     */
    return (1);
}

void
delete_rbl(rpcblist_ptr rbl)
{
    free(rbl->rpcb_map.r_addr);
    free(rbl->rpcb_map.r_netid);
    free(rbl->rpcb_map.r_owner);
    free(rbl);
}

void
delete_prog(rpcprog_t prog)
{
    rpcblist_ptr rbl, next, prev = NULL;

    assert(RW_WRITE_HELD(&list_rbl_lock));

    for (rbl = list_rbl; rbl != NULL; rbl = next) {
        next = rbl->rpcb_next;

        if (rbl->rpcb_map.r_prog != prog ||
            is_bound(rbl->rpcb_map.r_netid, rbl->rpcb_map.r_addr)) {
            prev = rbl;
            continue;
        }

#ifdef PORTMAP
        (void) del_pmaplist(&rbl->rpcb_map);
#endif
        delete_rbl(rbl);

        if (prev == NULL)
            list_rbl = next;
        else
            prev->rpcb_next = next;
    }
}

/*
 * Lookup the mapping for a program, version and return its
 * address. Assuming that the caller wants the address of the
 * server running on the transport on which the request came.
 *
 * For RPCBPROC_GETVERSADDR it will return a service with the exact version
 * number only.
 *
 * Otherwise, even if a service with a different version number is available,
 * it will return that address.  The client should check with an
 * clnt_call to verify whether the service is the one that is desired.
 *
 * We also try to resolve the universal address in terms of
 * address of the caller.
 */
bool_t
rpcbproc_getaddr_com(RPCB *regp, char **result, struct svc_req *rqstp,
    ulong_t rpcbversnum)
{
    char *saddr = NULL;
    rpcblist_ptr fnd;
    struct netconfig *trans_conf;   /* transport netconfig */
    SVCXPRT *transp = rqstp->rq_xprt;
    int verstype = rqstp->rq_proc == RPCBPROC_GETVERSADDR ? RPCB_ONEVERS :
        RPCB_ALLVERS;
    bool_t pml_locked = FALSE;

    /*
     * There is a potential window at startup during which rpcbind
     * service has been established over IPv6 but not over IPv4.  If an
     * IPv4 request comes in during that window, the IP code will map
     * it into IPv6.  We could patch up the request so that it looks
     * like IPv4 (so that rpcbind returns an IPv4 uaddr to the caller),
     * but that requires some non-trivial code and it's hard to test.
     * Instead, drop the request on the floor and force the caller to
     * retransmit.  By the time rpcbind sees the retransmission, IPv4
     * service should be in place and it should see the request as
     * IPv4, as desired.
     */
    trans_conf = rpcbind_get_conf(transp->xp_netid);
    if (strcmp(trans_conf->nc_protofmly, NC_INET6) == 0) {
        struct sockaddr_in6 *rmtaddr;

        rmtaddr = (struct sockaddr_in6 *)transp->xp_rtaddr.buf;
        if (IN6_IS_ADDR_V4MAPPED(&rmtaddr->sin6_addr)) {
            syslog(LOG_DEBUG,
                "IPv4 GETADDR request mapped to IPv6: ignoring");
            *result = NULL;
            return (FALSE);
        }
    }

    (void) rw_rdlock(&list_rbl_lock);
retry:
    fnd = find_service(regp->r_prog, regp->r_vers, transp->xp_netid);
    if (fnd && ((verstype == RPCB_ALLVERS) ||
        (regp->r_vers == fnd->rpcb_map.r_vers))) {
        if (*(regp->r_addr) != '\0') {  /* may contain a hint about */
            saddr = regp->r_addr;   /* the interface that we    */
        }               /* should use */
        if (!(*result = mergeaddr(transp, transp->xp_netid,
            fnd->rpcb_map.r_addr, saddr))) {
            /* Try whatever we have */
            *result = strdup(fnd->rpcb_map.r_addr);
        } else if (!(*result)[0]) {
            if (!pml_locked) {
                (void) rw_unlock(&list_rbl_lock);
                (void) rw_wrlock(&list_rbl_lock);
#ifdef PORTMAP
                (void) rw_wrlock(&list_pml_lock);
#endif /* PORTMAP */
                pml_locked = TRUE;
                goto retry;
            }
            /*
             * The server died.  Unset all versions of this prog.
             */
            delete_prog(regp->r_prog);
            *result = NULL;
        }
    } else {
        *result = NULL;
    }
#ifdef PORTMAP
    if (pml_locked)
        (void) rw_unlock(&list_pml_lock);
#endif /* PORTMAP */
    (void) rw_unlock(&list_rbl_lock);

    rpcbs_getaddr(rpcbversnum - PMAPVERS, regp->r_prog, regp->r_vers,
        transp->xp_netid, *result);
    return (TRUE);
}

/* ARGSUSED */
bool_t
rpcbproc_dump_com(void *argp, rpcblist_ptr **result)
{
    /*
     * list_rbl_lock is unlocked in xdr_rpcblist_ptr_ptr()
     */
    (void) rw_rdlock(&list_rbl_lock);
    *result = &list_rbl;
    return (TRUE);
}

bool_t
xdr_rpcblist_ptr_ptr(XDR *xdrs, rpcblist_ptr **objp)
{
    if (xdrs->x_op == XDR_FREE) {
        /*
         * list_rbl_lock is locked in rpcbproc_dump_com()
         */
        rw_unlock(&list_rbl_lock);
        return (TRUE);
    }

    return (xdr_rpcblist_ptr(xdrs, *objp));
}

/* ARGSUSED */
bool_t
rpcbproc_gettime_com(void *argp, ulong_t *result)
{
    (void) time((time_t *)result);

    return (TRUE);
}

/*
 * Convert uaddr to taddr. Should be used only by
 * local servers/clients. (kernel level stuff only)
 */
bool_t
rpcbproc_uaddr2taddr_com(char **uaddrp, struct netbuf *result,
    struct svc_req *rqstp)
{
    struct netconfig *nconf;
    struct netbuf *taddr;

    if (((nconf = rpcbind_get_conf(rqstp->rq_xprt->xp_netid)) == NULL) ||
        ((taddr = uaddr2taddr(nconf, *uaddrp)) == NULL)) {
        (void) memset(result, 0, sizeof (*result));
        return (TRUE);
    }

    memcpy(result, taddr, sizeof (*result));
    free(taddr);

    return (TRUE);
}

/*
 * Convert taddr to uaddr. Should be used only by
 * local servers/clients. (kernel level stuff only)
 */
bool_t
rpcbproc_taddr2uaddr_com(struct netbuf *taddr, char **result,
    struct svc_req *rqstp)
{
    struct netconfig *nconf;

    if ((nconf = rpcbind_get_conf(rqstp->rq_xprt->xp_netid)) == NULL)
        *result = NULL;
    else
        *result = taddr2uaddr(nconf, taddr);

    return (TRUE);
}

/*
 * Stuff for the rmtcall service
 */
bool_t
xdr_rpcb_rmtcallargs(XDR *xdrs, rpcb_rmtcallargs *objp)
{
    if (!xdr_u_long(xdrs, &objp->prog))
        return (FALSE);
    if (!xdr_u_long(xdrs, &objp->vers))
        return (FALSE);
    if (!xdr_u_long(xdrs, &objp->proc))
        return (FALSE);
    if (!xdr_bytes(xdrs, (char **)&objp->args.args_val,
        (uint_t *)&objp->args.args_len, ~0))
        return (FALSE);
    return (TRUE);
}

#ifdef PORTMAP
bool_t
xdr_rmtcallres(XDR *xdrs, rmtcallres *objp)
{
    if (!xdr_u_long(xdrs, &objp->port))
        return (FALSE);
    if (!xdr_bytes(xdrs, (char **)&objp->res.res_val,
        (uint_t *)&objp->res.res_len, ~0))
        return (FALSE);
    return (TRUE);
}
#endif

bool_t
xdr_rpcb_rmtcallres(XDR *xdrs, rpcb_rmtcallres *objp)
{
    if (!xdr_string(xdrs, &objp->addr, ~0))
        return (FALSE);
    if (!xdr_bytes(xdrs, (char **)&objp->results.results_val,
        (uint_t *)&objp->results.results_len, ~0))
        return (FALSE);
    return (TRUE);
}

struct rmtcallfd_list {
    int fd;
    char *netid;
    struct rmtcallfd_list *next;
};

static struct rmtcallfd_list *rmthead;
static struct rmtcallfd_list *rmttail;

#define MASKVAL (POLLIN | POLLPRI | POLLRDNORM | POLLRDBAND)

int
create_rmtcall_fd(struct netconfig *nconf)
{
    int fd;
    struct rmtcallfd_list *rmt;

    if ((fd = t_open(nconf->nc_device, O_RDWR, NULL)) == -1) {
        if (debugging)
            fprintf(stderr, "create_rmtcall_fd: couldn't open "
                "\"%s\" (errno %d, t_errno %d)\n",
                nconf->nc_device, errno, t_errno);
        return (-1);
    }

    if (t_bind(fd, NULL, NULL) == -1) {
        if (debugging)
            fprintf(stderr, "create_rmtcall_fd: couldn't bind to "
                "fd for \"%s\" (errno %d, t_errno %d)\n",
                nconf->nc_device, errno, t_errno);
        return (-1);
    }

    rmt = malloc(sizeof (struct rmtcallfd_list));
    if (rmt == NULL) {
        syslog(LOG_ERR, "create_rmtcall_fd: no memory!");
        return (-1);
    }

    rmt->netid = strdup(nconf->nc_netid);
    if (rmt->netid == NULL) {
        free(rmt);
        syslog(LOG_ERR, "create_rmtcall_fd: no memory!");
        return (-1);
    }

    if (svc_add_input(fd, MASKVAL, handle_reply, rmt->netid) == -1) {
        free(rmt->netid);
        free(rmt);
        syslog(LOG_ERR, "create_rmtcall_fd: svc_add_input() failed!");
        return (-1);
    }

    rmt->fd = fd;
    rmt->next = NULL;
    if (rmthead == NULL) {
        rmthead = rmt;
        rmttail = rmt;
    } else {
        rmttail->next = rmt;
        rmttail = rmt;
    }

    return (fd);
}

static int
find_rmtcallfd_by_netid(char *netid)
{
    struct rmtcallfd_list *rmt;

    for (rmt = rmthead; rmt != NULL; rmt = rmt->next) {
        if (strcmp(netid, rmt->netid) == 0) {
            return (rmt->fd);
        }
    }
    return (-1);
}

#define MAXTIME_OFF 300 /* 5 minutes timeout for rmtcalls */

struct finfo {
    struct finfo    *prev;
    struct finfo    *next;
    int     flag;
#define FINFO_ACTIVE    0x1
    ulong_t     caller_xid;
    struct netbuf   *caller_addr;
    ulong_t     forward_xid;
    int     forward_fd;
    char        *uaddr;
    struct t_unitdata *reply_data;
    struct rpc_err  reply_error;
    uint_t      res_len;
    void        *res_val;
    cond_t      cv;
};

/*
 * finfo_lock protects rpcb_rmtcalls, rpcb_rmtcalls_max, lastxid,
 * fihead, and fitail.
 */
static mutex_t finfo_lock = DEFAULTMUTEX;

static int rpcb_rmtcalls;
static int rpcb_rmtcalls_max;
static ulong_t lastxid;
static struct finfo *fihead;
static struct finfo *fitail;

void
set_rpcb_rmtcalls_max(int max)
{
    (void) mutex_lock(&finfo_lock);
    rpcb_rmtcalls_max = max;
    if (rpcb_rmtcalls > rpcb_rmtcalls_max) {
        assert(fitail != NULL);
        (void) cond_signal(&fitail->cv);
    }
    (void) mutex_unlock(&finfo_lock);
}

/*
 * Call a remote procedure service.  This procedure is very quiet when things
 * go wrong.  The proc is written to support broadcast rpc.  In the broadcast
 * case, a machine should shut-up instead of complain, lest the requestor be
 * overrun with complaints at the expense of not hearing a valid reply.
 * When receiving a request and verifying that the service exists, we
 *
 *  receive the request
 *
 *  open a new TLI endpoint on the same transport on which we received
 *  the original request
 *
 *  remember the original request's XID (which requires knowing the format
 *  of the svc_dg_data structure)
 *
 *  forward the request, with a new XID, to the requested service,
 *  remembering the XID used to send this request (for later use in
 *  reassociating the answer with the original request), the requestor's
 *  address, the file descriptor on which the forwarded request is
 *  made and the service's address
 *
 *  wait for either the timeout or the condition variable is signalled from
 *  handle_reply().
 *
 * At some time in the future, a reply will be received from the service to
 * which we forwarded the request.  At that time, svc_run() detect that the
 * socket used was for forwarding and call handle_reply() to
 *
 *  receive the reply
 *
 *  bundle the reply, along with the service's universal address
 *
 *  put the reply into the particular finfo
 *
 *  signal the condition variable.
 */

#define RPC_BUF_MAX 65536   /* can be raised if required */

/*
 *  This is from ../ypcmd/yp_b.h
 *  It does not appear in <rpcsvc/yp_prot.h>
 */
#define YPBINDPROG ((ulong_t)100007)
#define YPBINDPROC_SETDOM ((ulong_t)2)

/*
 * reply_type - which proc number
 * versnum - which vers was called
 */
void
rpcbproc_callit_com(struct svc_req *rqstp, SVCXPRT *transp, ulong_t reply_type,
    int versnum)
{
    struct t_info tinfo;
    uint_t sendsz;

    rpcb_rmtcallargs arg;
    rpcblist_ptr rbl;

    struct netconfig *nconf;
    struct netbuf *caller;
    struct nd_mergearg ma;
    int stat;

    int fd;
    struct svc_dg_data *bd;
    struct finfo *fi;

    struct rpc_msg call_msg;
    char outbuf[RPC_BUF_MAX];
    char *outbuf_alloc = NULL;
    XDR outxdr;
    bool_t outxdr_created = FALSE;

    AUTH *auth;

    struct t_unitdata tu_data;
    struct netbuf *na;

    timestruc_t to;

    (void) mutex_lock(&finfo_lock);
    if (!allow_indirect || rpcb_rmtcalls_max == 0) {
        (void) mutex_unlock(&finfo_lock);
        return;
    }
    (void) mutex_unlock(&finfo_lock);

    if (t_getinfo(transp->xp_fd, &tinfo) == -1) {
        if (reply_type == RPCBPROC_INDIRECT)
            svcerr_systemerr(transp);
        return;
    }
    if (tinfo.servtype != T_CLTS)
        return; /* Only datagram type accepted */

    sendsz = __rpc_get_t_size(0, tinfo.tsdu);
    if (sendsz == 0) {  /* data transfer not supported */
        if (reply_type == RPCBPROC_INDIRECT)
            svcerr_systemerr(transp);
        return;
    }
    /*
     * Should be multiple of 4 for XDR.
     */
    sendsz = ((sendsz + 3) / 4) * 4;

    (void) memset((char *)&arg, 0, sizeof (arg));
    if (!svc_getargs(transp, xdr_rpcb_rmtcallargs, (char *)&arg)) {
        if (reply_type == RPCBPROC_INDIRECT)
            svcerr_decode(transp);
        if (debugging)
            fprintf(stderr,
            "rpcbproc_callit_com:  svc_getargs failed\n");
        goto error;
    }

    /*
     * Disallow calling rpcbind for certain procedures.
     * Allow calling NULLPROC - per man page on rpcb_rmtcall().
     * switch is in alphabetical order.
     */
    if (arg.proc != NULLPROC) {
        switch (arg.prog) {
        case KEY_PROG:
            if (debugging)
                fprintf(stderr,
                    "rpcbind: rejecting KEY_PROG(%d)\n",
                    arg.proc);
            goto error;
        case MOUNTPROG:
            if (arg.proc != MOUNTPROC_MNT)
                break;
            /*
             * In Solaris 2.6, the host-based accesss control
             * is done by the NFS server on each request.
             * Prior to 2.6 we rely on mountd.
             */
            if (debugging)
                fprintf(stderr,
                    "rpcbind: rejecting MOUNTPROG(%d)\n",
                    arg.proc);
            goto error;
        case NFS_ACL_PROGRAM:
            if (debugging)
                fprintf(stderr,
                    "rpcbind: rejecting NFS_ACL_PROGRAM(%d)\n",
                    arg.proc);
            goto error;
        case NFS_PROGRAM:
            /* also NFS3_PROGRAM */
            if (debugging)
                fprintf(stderr,
                    "rpcbind: rejecting NFS_PROGRAM(%d)\n",
                    arg.proc);
            goto error;
        case RPCBPROG:
            /*
             * Disallow calling rpcbind for certain procedures.
             * Luckily Portmap set/unset/callit also have same
             * procedure numbers.  So, will not check for those.
             */
            switch (arg.proc) {
            case RPCBPROC_SET:
            case RPCBPROC_UNSET:
            case RPCBPROC_CALLIT:
            case RPCBPROC_INDIRECT:
                if (reply_type == RPCBPROC_INDIRECT)
                    svcerr_weakauth(transp); /* XXX */
                if (debugging)
                    fprintf(stderr, "rpcbproc_callit_com: "
                        "calling RPCBPROG procs SET, "
                        "UNSET, CALLIT, or INDIRECT not "
                        "allowed\n");
                goto error;
            default:
                /*
                 * Ideally, we should have called rpcb_service()
                 * or pmap_service() with appropriate parameters
                 * instead of going about in a roundabout
                 * manner.  Hopefully, this case should happen
                 * rarely.
                 */
                break;
            }
            break;
        case RQUOTAPROG:
            if (debugging)
                fprintf(stderr,
                    "rpcbind: rejecting RQUOTAPROG(%d)\n",
                    arg.proc);
            goto error;
        case YPPASSWDPROG:
            if (debugging)
                fprintf(stderr,
                    "rpcbind: rejecting YPPASSWDPROG(%d)\n",
                    arg.proc);
            goto error;
        case YPU_PROG:
            if (debugging)
                fprintf(stderr,
                    "rpcbind: rejecting YPU_PROG(%d)\n",
                    arg.proc);
            goto error;
        case YPBINDPROG:
            if (arg.proc != YPBINDPROC_SETDOM)
                break;
            if (debugging)
                fprintf(stderr,
                    "rpcbind: rejecting YPBINDPROG(%d)\n",
                    arg.proc);
            goto error;
        case YPPROG:
            switch (arg.proc) {
            case YPPROC_FIRST:
            case YPPROC_NEXT:
            case YPPROC_MATCH:
            case YPPROC_ALL:
                if (debugging)
                    fprintf(stderr,
                        "rpcbind: rejecting YPPROG(%d)\n",
                        arg.proc);
                goto error;
            default:
                break;
            }
            break;
        default:
            break;
        }
    }

    (void) rw_rdlock(&list_rbl_lock);
    rbl = find_service(arg.prog, arg.vers, transp->xp_netid);

    rpcbs_rmtcall(versnum - PMAPVERS, reply_type, arg.prog, arg.vers,
        arg.proc, transp->xp_netid, rbl);

    if (rbl == NULL) {
        (void) rw_unlock(&list_rbl_lock);
        if (reply_type == RPCBPROC_INDIRECT)
            svcerr_noprog(transp);
        goto error;
    }
    if (rbl->rpcb_map.r_vers != arg.vers) {
        if (reply_type == RPCBPROC_INDIRECT) {
            ulong_t vers_low, vers_high;

            find_versions(arg.prog, transp->xp_netid,
                &vers_low, &vers_high);
            (void) rw_unlock(&list_rbl_lock);
            svcerr_progvers(transp, vers_low, vers_high);
        } else {
            (void) rw_unlock(&list_rbl_lock);
        }
        goto error;
    }

    /*
     * Check whether this entry is valid and a server is present
     * Mergeaddr() returns NULL if no such entry is present, and
     * returns "" if the entry was present but the server is not
     * present (i.e., it crashed).
     */
    if (reply_type == RPCBPROC_INDIRECT) {
        char *uaddr = mergeaddr(transp, transp->xp_netid,
            rbl->rpcb_map.r_addr, NULL);
        if ((uaddr == (char *)NULL) || uaddr[0] == '\0') {
            (void) rw_unlock(&list_rbl_lock);
            svcerr_noprog(transp);
            goto error;
        } else {
            free(uaddr);
        }
    }

    nconf = rpcbind_get_conf(transp->xp_netid);
    if (nconf == NULL) {
        (void) rw_unlock(&list_rbl_lock);
        if (reply_type == RPCBPROC_INDIRECT)
            svcerr_systemerr(transp);
        if (debugging)
            fprintf(stderr,
                "rpcbproc_callit_com:  rpcbind_get_conf failed\n");
        goto error;
    }

    caller = svc_getrpccaller(transp);
    ma.c_uaddr = taddr2uaddr(nconf, caller);
    ma.s_uaddr = rbl->rpcb_map.r_addr;

    /*
     * A mergeaddr operation allocates a string, which it stores in
     * ma.m_uaddr.  It's passed to forward_register() and is
     * eventually freed by forward_destroy().
     */
    stat = netdir_options(nconf, ND_MERGEADDR, 0, (char *)&ma);
    (void) rw_unlock(&list_rbl_lock);
    free(ma.c_uaddr);
    if (stat)
        (void) syslog(LOG_ERR, "netdir_merge failed for %s: %s",
            nconf->nc_netid, netdir_sperror());

    if ((fd = find_rmtcallfd_by_netid(nconf->nc_netid)) == -1) {
        if (reply_type == RPCBPROC_INDIRECT)
            svcerr_systemerr(transp);
        free(ma.m_uaddr);
        goto error;
    }

    bd = get_svc_dg_data(transp);

    assert(!MUTEX_HELD(&finfo_lock));
    fi = forward_register(bd->su_xid, caller, fd, ma.m_uaddr);
    if (fi == NULL) {
        /*  forward_register failed.  Perhaps no memory. */
        free(ma.m_uaddr);
        if (debugging)
            fprintf(stderr,
                "rpcbproc_callit_com:  forward_register failed\n");
        assert(!MUTEX_HELD(&finfo_lock));
        goto error;
    }
    /* forward_register() returns with finfo_lock held when successful */
    assert(MUTEX_HELD(&finfo_lock));

    if (fi->flag & FINFO_ACTIVE) {
        /*
         * A duplicate request for the slow server.  Let's not
         * beat on it any more.
         */
        (void) mutex_unlock(&finfo_lock);
        free(ma.m_uaddr);
        if (debugging)
            fprintf(stderr,
                "rpcbproc_callit_com:  duplicate request\n");
        goto error;
    }
    fi->flag |= FINFO_ACTIVE;

    call_msg.rm_xid = fi->forward_xid;
    call_msg.rm_direction = CALL;
    call_msg.rm_call.cb_rpcvers = RPC_MSG_VERSION;
    call_msg.rm_call.cb_prog = arg.prog;
    call_msg.rm_call.cb_vers = arg.vers;

    if (sendsz > RPC_BUF_MAX) {
        outbuf_alloc = malloc(sendsz);
        if (outbuf_alloc == NULL) {
            forward_destroy(fi);
            (void) mutex_unlock(&finfo_lock);
            if (reply_type == RPCBPROC_INDIRECT)
                svcerr_systemerr(transp);
            if (debugging)
                fprintf(stderr,
                    "rpcbproc_callit_com:  No memory!\n");
            goto error;
        }
        xdrmem_create(&outxdr, outbuf_alloc, sendsz, XDR_ENCODE);
    } else {
        xdrmem_create(&outxdr, outbuf, sendsz, XDR_ENCODE);
    }
    outxdr_created = TRUE;

    if (!xdr_callhdr(&outxdr, &call_msg)) {
        forward_destroy(fi);
        (void) mutex_unlock(&finfo_lock);
        if (reply_type == RPCBPROC_INDIRECT)
            svcerr_systemerr(transp);
        if (debugging)
            fprintf(stderr,
                "rpcbproc_callit_com:  xdr_callhdr failed\n");
        goto error;
    }

    if (!xdr_u_long(&outxdr, &arg.proc)) {
        forward_destroy(fi);
        (void) mutex_unlock(&finfo_lock);
        if (reply_type == RPCBPROC_INDIRECT)
            svcerr_systemerr(transp);
        if (debugging)
            fprintf(stderr,
                "rpcbproc_callit_com:  xdr_u_long failed\n");
        goto error;
    }

    if (rqstp->rq_cred.oa_flavor == AUTH_NULL) {
        auth = authnone_create();
    } else if (rqstp->rq_cred.oa_flavor == AUTH_SYS) {
        struct authsys_parms *au;

        au = (struct authsys_parms *)rqstp->rq_clntcred;
        auth = authsys_create(au->aup_machname, au->aup_uid,
            au->aup_gid, au->aup_len, au->aup_gids);
        if (auth == NULL) /* fall back */
            auth = authnone_create();
    } else {
        /* we do not support any other authentication scheme */
        forward_destroy(fi);
        (void) mutex_unlock(&finfo_lock);
        if (reply_type == RPCBPROC_INDIRECT)
            svcerr_weakauth(transp); /* XXX too strong.. */
        if (debugging)
            fprintf(stderr, "rpcbproc_callit_com:  oa_flavor != "
                "AUTH_NONE and oa_flavor != AUTH_SYS\n");
        goto error;
    }
    if (auth == NULL) {
        forward_destroy(fi);
        (void) mutex_unlock(&finfo_lock);
        if (reply_type == RPCBPROC_INDIRECT)
            svcerr_systemerr(transp);
        if (debugging)
            fprintf(stderr, "rpcbproc_callit_com:  "
                "authwhatever_create returned NULL\n");
        goto error;
    }
    if (!AUTH_MARSHALL(auth, &outxdr)) {
        forward_destroy(fi);
        (void) mutex_unlock(&finfo_lock);
        if (reply_type == RPCBPROC_INDIRECT)
            svcerr_systemerr(transp);
        AUTH_DESTROY(auth);
        if (debugging)
            fprintf(stderr,
                "rpcbproc_callit_com:  AUTH_MARSHALL failed\n");
        goto error;
    }
    AUTH_DESTROY(auth);

    if (!xdr_opaque(&outxdr, arg.args.args_val, arg.args.args_len)) {
        forward_destroy(fi);
        (void) mutex_unlock(&finfo_lock);
        if (reply_type == RPCBPROC_INDIRECT)
            svcerr_systemerr(transp);
        if (debugging)
            fprintf(stderr,
                "rpcbproc_callit_com:  xdr_opaque failed\n");
        goto error;
    }

    tu_data.udata.len = XDR_GETPOS(&outxdr);
    if (outbuf_alloc)
        tu_data.udata.buf = outbuf_alloc;
    else
        tu_data.udata.buf = outbuf;
    tu_data.opt.len = 0;

    na = uaddr2taddr(nconf, ma.m_uaddr);
    if (!na) {
        forward_destroy(fi);
        (void) mutex_unlock(&finfo_lock);
        if (reply_type == RPCBPROC_INDIRECT)
            svcerr_systemerr(transp);
        goto error;
    }
    tu_data.addr = *na;

    if (t_sndudata(fd, &tu_data) == -1) {
        int err = errno;
        forward_destroy(fi);
        (void) mutex_unlock(&finfo_lock);

        netdir_free((char *)na, ND_ADDR);

        if (reply_type == RPCBPROC_INDIRECT)
            svcerr_systemerr(transp);
        if (debugging)
            fprintf(stderr,
                "rpcbproc_callit_com:  t_sndudata failed:  "
                "t_errno %d, errno %d\n", t_errno, err);
        goto error;
    }

    netdir_free((char *)na, ND_ADDR);
    xdr_destroy(&outxdr);
    outxdr_created = FALSE;
    if (outbuf_alloc != NULL) {
        free(outbuf_alloc);
        outbuf_alloc = NULL;
    }
    svc_freeargs(transp, xdr_rpcb_rmtcallargs, (char *)&arg);

    to.tv_sec = time(NULL) + MAXTIME_OFF;
    to.tv_nsec = 0;

    while (fi->reply_data == NULL &&
        cond_timedwait(&fi->cv, &finfo_lock, &to) != ETIME)
        ;

    if (fi->reply_data == NULL) {
        forward_destroy(fi);
        (void) mutex_unlock(&finfo_lock);

        if (reply_type == RPCBPROC_INDIRECT)
            svcerr_systemerr(transp);
        if (debugging)
            (void) fprintf(stderr,
                "rpcbproc_callit_com:  timeout\n");
        return;
    }

    if (fi->reply_error.re_status != RPC_SUCCESS) {
        forward_destroy(fi);
        (void) mutex_unlock(&finfo_lock);

        if (reply_type == RPCBPROC_INDIRECT)
            svcerr_systemerr(transp);
        if (debugging)
            (void) fprintf(stderr,
                "rpcbproc_callit_com:  error in reply:  %s\n",
                clnt_sperrno(fi->reply_error.re_status));
        return;
    }

    switch (versnum) {
#ifdef PORTMAP
    case PMAPVERS:
        {
            rmtcallres result;
            int h1, h2, h3, h4, p1, p2;

            /* interpret the universal address for TCP/IP */
            if (sscanf(fi->uaddr, "%d.%d.%d.%d.%d.%d",
                &h1, &h2, &h3, &h4, &p1, &p2) != 6)
                break;

            result.port = ((p1 & 0xff) << 8) + (p2 & 0xff);
            result.res.res_len = fi->res_len;
            result.res.res_val = fi->res_val;

            svc_sendreply(transp, xdr_rmtcallres, (char *)&result);
        }
        break;
#endif
    case RPCBVERS:
    case RPCBVERS4:
        {
            rpcb_rmtcallres result;

            result.addr = fi->uaddr;
            result.results.results_len = fi->res_len;
            result.results.results_val = fi->res_val;

            svc_sendreply(transp, xdr_rpcb_rmtcallres,
                (char *)&result);
        }
        break;
    }

    forward_destroy(fi);
    (void) mutex_unlock(&finfo_lock);

    return;

error:
    if (outxdr_created)
        xdr_destroy(&outxdr);
    free(outbuf_alloc);
    svc_freeargs(transp, xdr_rpcb_rmtcallargs, (char *)&arg);
}

static struct finfo *forward_find(ulong_t, char *);

/*
 * Adds an entry into the finfo list for the given request. Returns the finfo
 * and finfo_lock is left held.  If duplicate request, returns finfo with
 * FINFO_ACTIVE, else returns finfo without FINFO_ACTIVE.
 * If failed, returns NULL and finfo_lock is left unheld.
 */
static struct finfo *
forward_register(ulong_t caller_xid, struct netbuf *caller_addr, int forward_fd,
    char *uaddr)
{
    struct finfo    *fi;

    (void) mutex_lock(&finfo_lock);
    if (rpcb_rmtcalls_max == 0) {
        (void) mutex_unlock(&finfo_lock);
        return (NULL);
    }

    /*
     * initialization: once this has happened, lastxid will
     * never be 0 again, when entering or returning from this function.
     */
    if (lastxid == 0)
        lastxid = time(NULL);

    /*
     * Check if it is an duplicate entry
     */
    for (fi = fihead; fi != NULL; fi = fi->next) {
        if (fi->caller_xid == caller_xid &&
            netbufcmp(fi->caller_addr, caller_addr)) {
            assert(fi->flag & FINFO_ACTIVE);
            return (fi);
        }
    }

    fi = malloc(sizeof (*fi));
    if (fi == NULL) {
        (void) mutex_unlock(&finfo_lock);
        return (NULL);
    }

    if ((fi->caller_addr = netbufdup(caller_addr)) == NULL) {
        (void) mutex_unlock(&finfo_lock);
        free(fi);
        return (NULL);
    }

    /*
     * Generate new xid and make sure it is unique.
     */
    do {
        lastxid++;
        /* avoid lastxid wraparound to 0 */
        if (lastxid == 0)
            lastxid = 1;
    } while (forward_find(lastxid, uaddr) != NULL);

    fi->prev = NULL;
    fi->next = fihead;
    if (fihead != NULL)
        fihead->prev = fi;
    fihead = fi;
    if (fitail == NULL)
        fitail = fi;

    fi->flag = 0;
    fi->caller_xid = caller_xid;

    fi->forward_xid = lastxid;
    fi->forward_fd = forward_fd;

    /*
     * Though uaddr is not allocated here, it will still be freed
     * from forward_destroy().
     */
    fi->uaddr = uaddr;

    fi->reply_data = NULL;
    (void) cond_init(&fi->cv, USYNC_THREAD, NULL);

    rpcb_rmtcalls++;
    if (rpcb_rmtcalls > rpcb_rmtcalls_max) {
        assert(fitail != fi);
        (void) cond_signal(&fitail->cv);
    }

    return (fi);
}

static void
forward_destroy(struct finfo *fi)
{
    assert(MUTEX_HELD(&finfo_lock));
    assert(fi->flag & FINFO_ACTIVE);

    if (fihead == fi) {
        assert(fi->prev == NULL);
        fihead = fi->next;
    } else {
        fi->prev->next = fi->next;
    }

    if (fitail == fi) {
        assert(fi->next == NULL);
        fitail = fi->prev;
    } else {
        fi->next->prev = fi->prev;
    }

    netbuffree(fi->caller_addr);
    free(fi->uaddr);
    if (fi->reply_data != NULL)
        t_free((char *)fi->reply_data, T_UNITDATA);
    (void) cond_destroy(&fi->cv);

    free(fi);

    rpcb_rmtcalls--;
    if (rpcb_rmtcalls > rpcb_rmtcalls_max) {
        assert(fitail != NULL);
        (void) cond_signal(&fitail->cv);
    }
}

static struct finfo *
forward_find(ulong_t reply_xid, char *uaddr)
{
    struct finfo *fi;

    assert(MUTEX_HELD(&finfo_lock));

    for (fi = fihead; fi != NULL; fi = fi->next) {
        if (fi->forward_xid == reply_xid &&
            strcmp(fi->uaddr, uaddr) == 0)
            return (fi);
    }

    return (NULL);
}

static int
netbufcmp(struct netbuf *n1, struct netbuf *n2)
{
    return ((n1->len != n2->len) || memcmp(n1->buf, n2->buf, n1->len));
}

static struct netbuf *
netbufdup(struct netbuf *ap)
{
    struct netbuf *np;

    np = malloc(sizeof (struct netbuf) + ap->len);
    if (np) {
        np->maxlen = np->len = ap->len;
        np->buf = ((char *)np) + sizeof (struct netbuf);
        (void) memcpy(np->buf, ap->buf, ap->len);
    }
    return (np);
}

static void
netbuffree(struct netbuf *ap)
{
    free(ap);
}

static void
handle_reply(svc_input_id_t id, int fd, unsigned int events, void *cookie)
{
    struct t_unitdata *tr_data;
    int res;

    unsigned int inlen;
    char *buffer;
    XDR reply_xdrs;

    struct rpc_msg reply_msg;
    unsigned int pos;
    unsigned int len;

    struct netconfig *nconf;
    char *uaddr = NULL;

    struct finfo *fi;

    tr_data = (struct t_unitdata *)t_alloc(fd, T_UNITDATA,
        T_ADDR | T_UDATA);
    if (tr_data == NULL) {
        syslog(LOG_ERR, "handle_reply: t_alloc failed!");
        return;
    }

    do {
        int moreflag = 0;

        if (errno == EINTR)
            errno = 0;
        res = t_rcvudata(fd, tr_data, &moreflag);
        if (moreflag & T_MORE) {
            /* Drop this packet - we have no more space. */
            if (debugging)
                fprintf(stderr, "handle_reply:  recvd packet "
                    "with T_MORE flag set\n");
            goto done;
        }
    } while (res < 0 && t_errno == TSYSERR && errno == EINTR);

    if (res < 0) {
        if (debugging)
            fprintf(stderr, "handle_reply:  t_rcvudata returned "
                "%d, t_errno %d, errno %d\n", res, t_errno, errno);

        if (t_errno == TLOOK)
            (void) t_rcvuderr(fd, NULL);

        goto done;
    }

    inlen = tr_data->udata.len;
    buffer = tr_data->udata.buf;
    assert(buffer != NULL);
    xdrmem_create(&reply_xdrs, buffer, inlen, XDR_DECODE);

    reply_msg.acpted_rply.ar_verf = _null_auth;
    reply_msg.acpted_rply.ar_results.where = 0;
    reply_msg.acpted_rply.ar_results.proc = (xdrproc_t)xdr_void;

    if (!xdr_replymsg(&reply_xdrs, &reply_msg)) {
        xdr_destroy(&reply_xdrs);
        if (debugging)
            (void) fprintf(stderr,
                "handle_reply:  xdr_replymsg failed\n");
        goto done;
    }
    pos = XDR_GETPOS(&reply_xdrs);
    xdr_destroy(&reply_xdrs);

    len = inlen - pos;

    nconf = rpcbind_get_conf((char *)cookie);
    if (nconf == NULL) {
        syslog(LOG_ERR, "handle_reply: rpcbind_get_conf failed!");
        goto done;
    }
    uaddr = taddr2uaddr(nconf, &tr_data->addr);
    if (uaddr == NULL) {
        syslog(LOG_ERR, "handle_reply: taddr2uaddr failed!");
        goto done;
    }

    (void) mutex_lock(&finfo_lock);
    fi = forward_find(reply_msg.rm_xid, uaddr);
    if (fi == NULL) {
        (void) mutex_unlock(&finfo_lock);
        goto done;
    }

    fi->reply_data = tr_data;
    tr_data = NULL;

    __seterr_reply(&reply_msg, &fi->reply_error);

    fi->res_len = len;
    fi->res_val = &buffer[pos];

    (void) cond_signal(&fi->cv);
    (void) mutex_unlock(&finfo_lock);

done:
    free(uaddr);
    if (tr_data)
        t_free((char *)tr_data, T_UNITDATA);
}

/*
 * prog: Program Number
 * netid: Transport Provider token
 * lowvp: Low version number
 * highvp: High version number
 */
static void
find_versions(rpcprog_t prog, char *netid, rpcvers_t *lowvp, rpcvers_t *highvp)
{
    rpcblist_ptr rbl;
    rpcvers_t lowv = 0;
    rpcvers_t highv = 0;

    assert(RW_LOCK_HELD(&list_rbl_lock));

    for (rbl = list_rbl; rbl != NULL; rbl = rbl->rpcb_next) {
        if ((rbl->rpcb_map.r_prog != prog) ||
            (strcasecmp(rbl->rpcb_map.r_netid, netid) != 0))
            continue;
        if (lowv == 0) {
            highv = rbl->rpcb_map.r_vers;
            lowv = highv;
        } else if (rbl->rpcb_map.r_vers < lowv) {
            lowv = rbl->rpcb_map.r_vers;
        } else if (rbl->rpcb_map.r_vers > highv) {
            highv = rbl->rpcb_map.r_vers;
        }
    }

    *lowvp = lowv;
    *highvp = highv;
}

/*
 * returns the item with the given program, version number and netid.
 * If that version number is not found, it returns the item with that
 * program number, so that address is now returned to the caller. The
 * caller when makes a call to this program, version number, the call
 * will fail and it will return with PROGVERS_MISMATCH. The user can
 * then determine the highest and the lowest version number for this
 * program using clnt_geterr() and use those program version numbers.
 *
 * Returns the RPCBLIST for the given prog, vers and netid
 *
 * prog: Program Number
 * vers: Version Number
 * netid: Transport Provider token
 */
static rpcblist_ptr
find_service(rpcprog_t prog, rpcvers_t vers, char *netid)
{
    rpcblist_ptr hit = NULL;
    rpcblist_ptr rbl;

    assert(RW_LOCK_HELD(&list_rbl_lock));

    for (rbl = list_rbl; rbl != NULL; rbl = rbl->rpcb_next) {
        if ((rbl->rpcb_map.r_prog != prog) ||
            (strcasecmp(rbl->rpcb_map.r_netid, netid) != 0))
            continue;
        hit = rbl;
        if (rbl->rpcb_map.r_vers == vers)
            break;
    }

    return (hit);
}

/*
 * If the caller is from our zone and we know
 * who it is, we return the uid.
 */
uid_t
rpcb_caller_uid(SVCXPRT *transp)
{
    ucred_t *uc = alloca(ucred_size());

    if (svc_getcallerucred(transp, &uc) != 0 ||
        (ucred_getzoneid(uc)) != myzone) {
        return (-1);
    } else {
        return (ucred_geteuid(uc));
    }
}

/*
 * Copies the name associated with the uid of the caller and returns
 * a pointer to it.  Similar to getwd().
 */
char *
getowner(SVCXPRT *transp, char *owner)
{
    uid_t uid = rpcb_caller_uid(transp);

    switch (uid) {
    case -1:
        return (strcpy(owner, "unknown"));
    case 0:
        return (strcpy(owner, "superuser"));
    default:
        (void) sprintf(owner, "%u", uid);
        return (owner);
    }
}

#ifdef PORTMAP
/*
 * Add this to the pmap list only if it is UDP or TCP.
 */
static int
add_pmaplist(RPCB *arg)
{
    pmap pmap;
    pmaplist *pml;
    int h1, h2, h3, h4, p1, p2;

    if (strcmp(arg->r_netid, udptrans) == 0) {
        /* It is UDP! */
        pmap.pm_prot = IPPROTO_UDP;
    } else if (strcmp(arg->r_netid, tcptrans) == 0) {
        /* It is TCP */
        pmap.pm_prot = IPPROTO_TCP;
    } else
        /* Not a IP protocol */
        return (0);

    /* interpret the universal address for TCP/IP */
    if (sscanf(arg->r_addr, "%d.%d.%d.%d.%d.%d",
        &h1, &h2, &h3, &h4, &p1, &p2) != 6)
        return (0);
    pmap.pm_port = ((p1 & 0xff) << 8) + (p2 & 0xff);
    pmap.pm_prog = arg->r_prog;
    pmap.pm_vers = arg->r_vers;
    /*
     * add to END of list
     */
    pml = (pmaplist *) malloc((uint_t)sizeof (pmaplist));
    if (pml == NULL) {
        (void) syslog(LOG_ERR, "rpcbind: no memory!\n");
        return (1);
    }
    pml->pml_map = pmap;
    pml->pml_next = NULL;

    (void) rw_wrlock(&list_pml_lock);
    if (list_pml == NULL) {
        list_pml = pml;
    } else {
        pmaplist *fnd;

        /* Attach to the end of the list */
        for (fnd = list_pml; fnd->pml_next; fnd = fnd->pml_next)
            ;
        fnd->pml_next = pml;
    }
    (void) rw_unlock(&list_pml_lock);

    return (0);
}

/*
 * Delete this from the pmap list only if it is UDP or TCP.
 */
int
del_pmaplist(RPCB *arg)
{
    pmaplist *pml;
    pmaplist *prevpml, *fnd;
    rpcport_t prot;

    if (strcmp(arg->r_netid, udptrans) == 0) {
        /* It is UDP! */
        prot = IPPROTO_UDP;
    } else if (strcmp(arg->r_netid, tcptrans) == 0) {
        /* It is TCP */
        prot = IPPROTO_TCP;
    } else if (arg->r_netid[0] == '\0') {
        prot = 0;   /* Remove all occurrences */
    } else {
        /* Not a IP protocol */
        return (0);
    }

    assert(RW_WRITE_HELD(&list_pml_lock));

    for (prevpml = NULL, pml = list_pml; pml; /* cstyle */) {
        if ((pml->pml_map.pm_prog != arg->r_prog) ||
            (pml->pml_map.pm_vers != arg->r_vers) ||
            (prot && (pml->pml_map.pm_prot != prot))) {
            /* both pml & prevpml move forwards */
            prevpml = pml;
            pml = pml->pml_next;
            continue;
        }
        /* found it; pml moves forward, prevpml stays */
        fnd = pml;
        pml = pml->pml_next;
        if (prevpml == NULL)
            list_pml = pml;
        else
            prevpml->pml_next = pml;
        free(fnd);
    }

    return (0);
}
#endif /* PORTMAP */