/usr/src/sbin/mountd/mountd.c

Bug Summary

File:	src/sbin/mountd/mountd.c
Warning:	line 1483, column 24 The right operand of '==' is a garbage value
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name mountd.c -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sbin/mountd/obj -resource-dir /usr/local/lib/clang/13.0.0 -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/sbin/mountd/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c /usr/src/sbin/mountd/mountd.c
1/*	$OpenBSD: mountd.c,v 1.89 2020/08/06 17:57:32 naddy Exp $	*/
2/*	$NetBSD: mountd.c,v 1.31 1996/02/18 11:57:53 fvdl Exp $	*/

4/*
* Copyright (c) 1989, 1993
*	The Regents of the University of California.  All rights reserved.
*
* This code is derived from software contributed to Berkeley by
* Herb Hasler and Rick Macklem at The University of Guelph.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
* 3. Neither the name of the University nor the names of its contributors
*    may be used to endorse or promote products derived from this software
*    without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/

36#include <sys/types.h>
37#include <sys/ioctl.h>
38#include <sys/mount.h>
39#include <sys/queue.h>
40#include <sys/socket.h>
41#include <sys/stat.h>
42#include <sys/uio.h>
43#include <sys/wait.h>
44#include <syslog.h>

46#include <rpc/rpc.h>
47#include <rpc/pmap_clnt.h>
48#include <rpc/pmap_prot.h>
49#include <nfs/rpcv2.h>
50#include <nfs/nfsproto.h>

52#include <arpa/inet.h>

54#include <ctype.h>
55#include <errno(*__errno()).h>
56#include <grp.h>
57#include <imsg.h>
58#include <netdb.h>
59#include <netgroup.h>
60#include <poll.h>
61#include <pwd.h>
62#include <signal.h>
63#include <stdio.h>
64#include <stdlib.h>
65#include <string.h>
66#include <unistd.h>
67#include <limits.h>
68#include "pathnames.h"

70#include <stdarg.h>

72#define isterminated(str, size)(memchr((str), '\0', (size)) != ((void *)0)) (memchr((str), '\0', (size)) != NULL((void *)0))

74/*
* Structures for keeping the mount list and export list
*/
77struct mountlist {
struct mountlist *ml_next;
char		ml_host[RPCMNT_NAMELEN255+1];
char		ml_dirp[RPCMNT_PATHLEN1024+1];
81};

83struct dirlist {
struct dirlist	*dp_left;
struct dirlist	*dp_right;
int		dp_flag;
struct hostlist	*dp_hosts;	/* List of hosts this dir exported to */
char		dp_dirp[1];	/* Actually malloc'd to size of dir */
89};
90/* dp_flag bits */
91#define	DP_DEFSET0x1	0x1
92#define DP_HOSTSET0x2	0x2

94struct exportlist {
struct exportlist *ex_next;
struct dirlist	*ex_dirl;
struct dirlist	*ex_defdir;
int		ex_flag;
fsid_t		ex_fs;
char		*ex_fsdir;
101};
102/* ex_flag bits */
103#define	EX_LINKED0x1	0x1

105struct netmsk {
in_addr_t	nt_net;
in_addr_t	nt_mask;
char		*nt_name;
109};

111union grouptypes {
struct hostent *gt_hostent;
struct netmsk	gt_net;
114};

116struct grouplist {
int gr_type;
union grouptypes gr_ptr;
struct grouplist *gr_next;
120};
121/* Group types */
122#define	GT_NULL0x0		0x0
123#define	GT_HOST0x1		0x1
124#define	GT_NET0x2		0x2
125#define	GT_IGNORE0x5	0x5

127struct hostlist {
int		 ht_flag;	/* Uses DP_xx bits */
struct grouplist *ht_grp;
struct hostlist	 *ht_next;
131};

133struct fhreturn {
int	fhr_flag;
int	fhr_vers;
nfsfh_t	fhr_fh;
137};

139#define IMSG_GETFH_REQ0x0		0x0
140#define IMSG_GETFH_RESP0x1		0x1
141#define IMSG_EXPORT_REQ0x2		0x2
142#define IMSG_EXPORT_RESP0x3	0x3
143#define IMSG_DELEXPORT0x4		0x4
144#define IMSG_MLIST_APPEND0x5	0x5
145#define IMSG_MLIST_OPEN0x6		0x6
146#define IMSG_MLIST_CLOSE0x7	0x7
147#define IMSG_MLIST_WRITE0x8	0x8

149struct getfh_resp {
fhandle_t	gr_fh;
int		gr_error;
152};

154struct export_req {
char		er_path[MNAMELEN90];
struct export_args er_args;
struct sockaddr	er_addr;
struct sockaddr	er_mask;
159};

161/* Global defs */
162char	*add_expdir(struct dirlist **, char *, int);
163void	add_dlist(struct dirlist **, struct dirlist *, struct grouplist *, int);
164void	add_mlist(char *, char *);
165void	check_child(int);
166int	check_dirpath(char *);
167int	check_options(struct dirlist *);
168int	chk_host(struct dirlist *, in_addr_t, int *, int *);
169void	del_mlist(char *, char *);
170struct dirlist *dirp_search(struct dirlist *, char *);
171int	do_mount(struct exportlist *, struct grouplist *, int, struct xucred *,
   char *, int);
173int	do_opt(char **, char **, struct exportlist *, struct grouplist *,
   int *, int *, struct xucred *);
175struct	exportlist *ex_search(fsid_t *);
176struct	exportlist *get_exp(void);
177void	free_dir(struct dirlist *);
178void	free_exp(struct exportlist *);
179void	free_grp(struct grouplist *);
180void	free_host(struct hostlist *);
181void	new_exportlist(int signo);
182void	get_exportlist(void);
183int	get_host(char *, struct grouplist *, struct grouplist *);
184int	get_num(char *);
185struct hostlist *get_ht(void);
186int	get_line(void);
187void	get_mountlist(void);
188int	get_net(char *, struct netmsk *, int);
189void	getexp_err(struct exportlist *, struct grouplist *);
190struct grouplist *get_grp(void);
191void	hang_dirp(struct dirlist *, struct grouplist *, struct exportlist *,
   int);
193void	mntsrv(struct svc_req *, SVCXPRT *);
194void	nextfield(char **, char **);
195void	out_of_mem(void);
196void	parsecred(char *, struct xucred *);
197void	privchild(int);
198int	put_exlist(struct dirlist *, XDR *, struct dirlist *, int *);
199ssize_t	recv_imsg(struct imsg *);
200int	scan_tree(struct dirlist *, in_addr_t);
201int	send_imsg(u_int32_t, void *, u_int16_t);
202void	send_umntall(int signo);
203int	umntall_each(caddr_t, struct sockaddr_in *);
204int	xdr_dir(XDR *, char *);
205int	xdr_explist(XDR *, caddr_t);
206int	xdr_fhs(XDR *, caddr_t);
207int	xdr_mlist(XDR *, caddr_t);
208void	mountd_svc_run(void);

210struct exportlist *exphead;
211struct mountlist *mlhead;
212struct grouplist *grphead;
213const char *exname;
214struct xucred def_anon = {
.cr_uid		= (uid_t) -2,
.cr_gid		= (gid_t) -2,
.cr_ngroups	= 0,
.cr_groups	= { 0, }
219};
220int opt_flags;
221/* Bits for above */
222#define	OP_MAPROOT0x01	0x01
223#define	OP_MAPALL0x02	0x02
224#define	OP_MASK0x08		0x08
225#define	OP_NET0x10		0x10
226#define	OP_ALLDIRS0x40	0x40

228struct imsgbuf ibuf;
229int debug = 0;

231volatile sig_atomic_t gotchld;
232volatile sig_atomic_t gothup;
233volatile sig_atomic_t gotterm;

235/*
* Mountd server for NFS mount protocol as described in:
* NFS: Network File System Protocol Specification, RFC1094, Appendix A
* The optional arguments are the exports file name
* default: _PATH_EXPORTS
* "-d" to enable debugging
*/
242int
243main(int argc, char *argv[])
244{
SVCXPRT *udptransp, *tcptransp;
FILE *pidfile;
int c, socks[2];

while ((c = getopt(argc, argv, "dnr")) != -1)
switch (c) {
case 'd':
	debug = 1;
	break;
case 'n':
case 'r':
	/* Compatibility */
	break;
default:
	fprintf(stderr(&__sF[2]), "usage: mountd [-d] [exportsfile]\n");
	exit(1);
}
argc -= optind;
argv += optind;
grphead = NULL((void *)0);
exphead = NULL((void *)0);
mlhead = NULL((void *)0);

if (argc == 1)
exname = *argv;
else
exname = _PATH_EXPORTS"/etc/exports";

openlog("mountd", LOG_PID0x01, LOG_DAEMON(3<<3));
if (debug)
fprintf(stderr(&__sF[2]), "Here we go.\n");
if (debug == 0) {
daemon(0, 0);
signal(SIGINT2, SIG_IGN(void (*)(int))1);
signal(SIGQUIT3, SIG_IGN(void (*)(int))1);
}
/* Store pid in file unless mountd is already running */
pidfile = fopen(_PATH_MOUNTDPID"/var/run/mountd.pid", "r");
if (pidfile != NULL((void *)0)) {
if (fscanf(pidfile, "%d\n", &c) > 0 && c > 0) {
	if (kill(c, 0) == 0) {
		syslog(LOG_ERR3, "Already running (pid %d)", c);
		exit(1);
	}
}
pidfile = freopen(_PATH_MOUNTDPID"/var/run/mountd.pid", "w", pidfile);
} else {
pidfile = fopen(_PATH_MOUNTDPID"/var/run/mountd.pid", "w");
}
if (pidfile) {
fprintf(pidfile, "%ld\n", (long)getpid());
fclose(pidfile);
}

signal(SIGCHLD20, (void (*)(int)) check_child);
signal(SIGHUP1, (void (*)(int)) new_exportlist);
signal(SIGPIPE13, SIG_IGN(void (*)(int))1);

if (socketpair(AF_UNIX1, SOCK_STREAM1, PF_UNSPEC0, socks) == -1) {
syslog(LOG_ERR3, "socketpair: %m");
exit(1);
}

switch (fork()) {
case -1:
syslog(LOG_ERR3, "fork: %m");
exit(1);
case 0:
close(socks[0]);
privchild(socks[1]);
}

close(socks[1]);

if (pledge("stdio rpath inet dns getpw", NULL((void *)0)) == -1) {
syslog(LOG_ERR3, "pledge: %m");
exit(1);
}

signal(SIGTERM15, (void (*)(int)) send_umntall);
imsg_init(&ibuf, socks[0]);
setproctitle("parent");

if (debug)
fprintf(stderr(&__sF[2]), "Getting export list.\n");
get_exportlist();
if (debug)
fprintf(stderr(&__sF[2]), "Getting mount list.\n");
get_mountlist();

if ((udptransp = svcudp_create(RPC_ANYSOCK-1)) == NULL((void *)0) ||
   (tcptransp = svctcp_create(RPC_ANYSOCK-1, 0, 0)) == NULL((void *)0)) {
syslog(LOG_ERR3, "Can't create socket");
exit(1);
}
pmap_unset(RPCPROG_MNT100005, RPCMNT_VER11);
pmap_unset(RPCPROG_MNT100005, RPCMNT_VER33);
if (!svc_register(udptransp, RPCPROG_MNT100005, RPCMNT_VER11, mntsrv, IPPROTO_UDP17) ||
   !svc_register(udptransp, RPCPROG_MNT100005, RPCMNT_VER33, mntsrv, IPPROTO_UDP17) ||
   !svc_register(tcptransp, RPCPROG_MNT100005, RPCMNT_VER11, mntsrv, IPPROTO_TCP6) ||
   !svc_register(tcptransp, RPCPROG_MNT100005, RPCMNT_VER33, mntsrv, IPPROTO_TCP6)) {
syslog(LOG_ERR3, "Can't register mount");
exit(1);
}
mountd_svc_run();
syslog(LOG_ERR3, "Mountd died");
exit(1);
352}

354void
355check_child(int signo)
356{
gotchld = 1;
358}

360void
361privchild(int sock)
362{
struct imsg imsg;
struct pollfd pfd[1];
struct ufs_args args;
struct statfs sfb;
struct getfh_resp resp;
struct export_req *req;
struct mountlist *ml;
FILE *fp;
char *path;
int error, size;

imsg_init(&ibuf, sock);
setproctitle("[priv]");
fp = NULL((void *)0);

for (;;) {
if (gothup) {
	kill(getppid(), SIGHUP1);
	gothup = 0;
}

pfd[0].fd = ibuf.fd;
pfd[0].events = POLLIN0x0001;
switch (poll(pfd, 1, INFTIM(-1))) {
case -1:
	if (errno(*__errno()) == EINTR4)
		continue;
	syslog(LOG_ERR3, "poll: %m");
	_exit(1);
case 0:
	continue;
}
if (pfd[0].revents & POLLHUP0x0010) {
	syslog(LOG_ERR3, "Socket disconnected");
	_exit(1);
}
if (!(pfd[0].revents & POLLIN0x0001))
	continue;

switch (imsg_read(&ibuf)) {
case -1:
	syslog(LOG_ERR3, "imsg_read: %m");
	_exit(1);
case 0:
	syslog(LOG_ERR3, "Socket disconnected");
	_exit(1);
}

while ((size = imsg_get(&ibuf, &imsg)) != 0) {
	if (size == -1) {
		syslog(LOG_ERR3, "imsg_get: %m");
		_exit(1);
	}
	size -= IMSG_HEADER_SIZEsizeof(struct imsg_hdr);

	switch (imsg.hdr.type) {
	case IMSG_GETFH_REQ0x0:
		if (size != PATH_MAX1024) {
			syslog(LOG_ERR3, "Invalid message size");
			break;
		}
		path = imsg.data;
		if (getfh(path, &resp.gr_fh) == -1)
			resp.gr_error = errno(*__errno());
		else
			resp.gr_error = 0;
		send_imsg(IMSG_GETFH_RESP0x1, &resp, sizeof(resp));
		break;
	case IMSG_EXPORT_REQ0x2:
		if (size != sizeof(*req)) {
			syslog(LOG_ERR3, "Invalid message size");
			break;
		}
		req = imsg.data;
		if (statfs(req->er_path, &sfb) == -1) {
			error = errno(*__errno());
			syslog(LOG_ERR3, "statfs: %m");
			send_imsg(IMSG_EXPORT_RESP0x3, &error,
			    sizeof(error));
			break;
		}
		args.fspec = 0;
		args.export_info = req->er_args;
		args.export_info.ex_addr = &req->er_addr;
		args.export_info.ex_mask = &req->er_mask;
		if (mount(sfb.f_fstypename, sfb.f_mntonname,
		    sfb.f_flags | MNT_UPDATE0x00010000, &args) == -1) {
		    	error = errno(*__errno());
		    	syslog(LOG_ERR3, "mount: %m");
			send_imsg(IMSG_EXPORT_RESP0x3, &error,
			    sizeof(error));
			break;
		}
		error = 0;
		send_imsg(IMSG_EXPORT_RESP0x3, &error, sizeof(error));
		break;
	case IMSG_DELEXPORT0x4:
		if (size != MNAMELEN90) {
			syslog(LOG_ERR3, "Invalid message size");
			break;
		}
		path = imsg.data;
		if (statfs(path, &sfb) == -1) {
			syslog(LOG_ERR3, "statfs: %m");
			break;
		}
		memset(&args, 0, sizeof(args));
		args.export_info.ex_flags = MNT_DELEXPORT0x00020000;
		if (mount(sfb.f_fstypename, sfb.f_mntonname,
		    sfb.f_flags | MNT_UPDATE0x00010000, &args) == -1)
			syslog(LOG_ERR3, "mount: %m");
		break;
	case IMSG_MLIST_APPEND0x5:
		if (size != sizeof(*ml)) {
			syslog(LOG_ERR3, "Invalid message size");
			break;
		}
		if (fp != NULL((void *)0))
			break;
		ml = imsg.data;
		if (!isterminated(&ml->ml_host,(memchr((&ml->ml_host), '\0', (sizeof(ml->ml_host))
) != ((void *)0))
		    sizeof(ml->ml_host))(memchr((&ml->ml_host), '\0', (sizeof(ml->ml_host))
) != ((void *)0)) ||
		    !isterminated(&ml->ml_dirp,(memchr((&ml->ml_dirp), '\0', (sizeof(ml->ml_dirp))
) != ((void *)0))
		    sizeof(ml->ml_dirp))(memchr((&ml->ml_dirp), '\0', (sizeof(ml->ml_dirp))
) != ((void *)0)))
			break;
		fp = fopen(_PATH_RMOUNTLIST"/var/db/mountdtab", "a");
		if (fp == NULL((void *)0)) {
			syslog(LOG_ERR3, "fopen: %s: %m",
			    _PATH_RMOUNTLIST"/var/db/mountdtab");
			break;
		}
		fprintf(fp, "%s %s\n", ml->ml_host,
		    ml->ml_dirp);
		fclose(fp);
		fp = NULL((void *)0);
		break;
	case IMSG_MLIST_OPEN0x6:
		if (size != 0) {
			syslog(LOG_ERR3, "Invalid message size");
			break;
		}
		if (fp != NULL((void *)0))
			break;
		fp = fopen(_PATH_RMOUNTLIST"/var/db/mountdtab", "w");
		if (fp == NULL((void *)0))
			syslog(LOG_ERR3, "fopen: %s: %m",
			    _PATH_RMOUNTLIST"/var/db/mountdtab");
		break;
	case IMSG_MLIST_WRITE0x8:
		if (size != sizeof(*ml)) {
			syslog(LOG_ERR3, "Invalid message size");
			break;
		}
		if (fp == NULL((void *)0))
			break;
		ml = imsg.data;
		if (!isterminated(&ml->ml_host,(memchr((&ml->ml_host), '\0', (sizeof(ml->ml_host))
) != ((void *)0))
		    sizeof(ml->ml_host))(memchr((&ml->ml_host), '\0', (sizeof(ml->ml_host))
) != ((void *)0)) ||
		    !isterminated(&ml->ml_dirp,(memchr((&ml->ml_dirp), '\0', (sizeof(ml->ml_host))
) != ((void *)0))
		    sizeof(ml->ml_host))(memchr((&ml->ml_dirp), '\0', (sizeof(ml->ml_host))
) != ((void *)0)))
			break;
		fprintf(fp, "%s %s\n", ml->ml_host,
		    ml->ml_dirp);
		break;
	case IMSG_MLIST_CLOSE0x7:
		if (size != 0) {
			syslog(LOG_ERR3, "Invalid message size");
			break;
		}
		if (fp != NULL((void *)0)) {
			fclose(fp);
			fp = NULL((void *)0);
		}
		break;
	default:
		syslog(LOG_ERR3, "Unexpected message type");
		break;
	}

	imsg_free(&imsg);
}
}
545}

547int
548imsg_getfh(char *path, fhandle_t *fh)
549{
struct imsg imsg;
struct getfh_resp *resp;
ssize_t size;

if (send_imsg(IMSG_GETFH_REQ0x0, path, PATH_MAX1024) == -1)
return (-1);

size = recv_imsg(&imsg);
if (size == -1)
return (-1);
if (imsg.hdr.type != IMSG_GETFH_RESP0x1 || size != sizeof(*resp)) {
syslog(LOG_ERR3, "Invalid message");
imsg_free(&imsg);
errno(*__errno()) = EINVAL22;
return (-1);
}

resp = imsg.data;
*fh = resp->gr_fh;
if (resp->gr_error) {
errno(*__errno()) = resp->gr_error;
imsg_free(&imsg);
return (-1);
}

imsg_free(&imsg);
return (0);
577}

579int
580imsg_export(const char *dir, struct export_args *args)
581{
struct export_req req;
struct imsg imsg;
ssize_t size;

if (strlcpy(req.er_path, dir, sizeof(req.er_path)) >=
   sizeof(req.er_path)) {
syslog(LOG_ERR3, "%s: mount dir too long", dir);
errno(*__errno()) = EINVAL22;
return (-1);
}

req.er_args = *args;
if (args->ex_addrlen)
req.er_addr = *args->ex_addr;
if (args->ex_masklen)
req.er_mask = *args->ex_mask;

if (send_imsg(IMSG_EXPORT_REQ0x2, &req, sizeof(req)) == -1)
return (-1);

size = recv_imsg(&imsg);
if (size == -1)
return (-1);
if (imsg.hdr.type != IMSG_EXPORT_RESP0x3 || size != sizeof(int)) {
syslog(LOG_ERR3, "Invalid message");
imsg_free(&imsg);
errno(*__errno()) = EINVAL22;
return (-1);
}

if (*(int *)imsg.data != 0) {
errno(*__errno()) = *(int *)imsg.data;
imsg_free(&imsg);
return (-1);
}

imsg_free(&imsg);
return (0);
620}

622ssize_t
623recv_imsg(struct imsg *imsg)
624{
ssize_t n;

n = imsg_read(&ibuf);
if (n == -1) {
syslog(LOG_ERR3, "imsg_read: %m");
return (-1);
}
if (n == 0) {
syslog(LOG_ERR3, "Socket disconnected");
errno(*__errno()) = EINVAL22;
return (-1);
}

n = imsg_get(&ibuf, imsg);
if (n == -1) {
syslog(LOG_ERR3, "imsg_get: %m");
return (-1);
}
if (n == 0) {
syslog(LOG_ERR3, "No messages ready");
errno(*__errno()) = EINVAL22;
return (-1);
}

return (n - IMSG_HEADER_SIZEsizeof(struct imsg_hdr));
650}

652int
653send_imsg(u_int32_t type, void *data, u_int16_t size)
654{
if (imsg_compose(&ibuf, type, 0, 0, -1, data, size) == -1) {
syslog(LOG_ERR3, "imsg_compose: %m");
return (-1);
}

if (imsg_flush(&ibuf) == -1) {
syslog(LOG_ERR3, "imsg_flush: %m");
return (-1);
}

return (0);
666}

668void
669mountd_svc_run(void)
670{
struct pollfd *pfd = NULL((void *)0), *newp;
nfds_t saved_max_pollfd = 0;
int nready, status;

for (;;) {
if (gotchld) {
	if (waitpid(WAIT_ANY(-1), &status, WNOHANG1) == -1) {
		syslog(LOG_ERR3, "waitpid: %m");
		break;
	}
	if (WIFEXITED(status)(((status) & 0177) == 0)) {
		syslog(LOG_ERR3, "Child exited");
		break;
	}
	if (WIFSIGNALED(status)(((status) & 0177) != 0177 && ((status) & 0177
) != 0)) {
		syslog(LOG_ERR3, "Child terminated by signal");
		break;
	}
	gotchld = 0;
}
if (gothup) {
	get_exportlist();
	gothup = 0;
}
if (gotterm)
	break;
if (svc_max_pollfd > saved_max_pollfd) {
	newp = reallocarray(pfd, svc_max_pollfd, sizeof(*pfd));
	if (!newp) {
		free(pfd);
		perror("mountd_svc_run: - realloc failed");
		return;
	}
	pfd = newp;
	saved_max_pollfd = svc_max_pollfd;
}
memcpy(pfd, svc_pollfd, svc_max_pollfd * sizeof(*pfd));

nready = poll(pfd, svc_max_pollfd, INFTIM(-1));
switch (nready) {
case -1:
	if (errno(*__errno()) == EINTR4)
		break;
	perror("mountd_svc_run: - poll failed");
	free(pfd);
	return;
case 0:
	break;
default:
	svc_getreq_poll(pfd, nready);
	break;
}
}

(void) clnt_broadcast(RPCPROG_MNT100005, RPCMNT_VER11, RPCMNT_UMNTALL4,
   xdr_void, (caddr_t)0, xdr_void, (caddr_t)0, umntall_each);
exit(0);
728}

730/*
* The mount rpc service
*/
733void
734mntsrv(struct svc_req *rqstp, SVCXPRT *transp)
735{
char rpcpath[RPCMNT_PATHLEN1024+1], dirpath[PATH_MAX1024];
struct hostent *hp = NULL((void *)0);
struct exportlist *ep;
sigset_t sighup_mask;
int defset, hostset;
struct fhreturn fhr;
struct dirlist *dp;
struct statfs fsb;
struct stat stb;
in_addr_t saddr;
u_short sport;
long bad = 0;

sigemptyset(&sighup_mask);
sigaddset(&sighup_mask, SIGHUP1);
saddr = transp->xp_raddr.sin_addr.s_addr;
sport = ntohs(transp->xp_raddr.sin_port)(__uint16_t)(__builtin_constant_p(transp->xp_raddr.sin_port
) ? (__uint16_t)(((__uint16_t)(transp->xp_raddr.sin_port) &
 0xffU) << 8 | ((__uint16_t)(transp->xp_raddr.sin_port
) & 0xff00U) >> 8) : __swap16md(transp->xp_raddr
.sin_port));
1
'?' condition is false→
switch (rqstp->rq_proc) {
2
←
Control jumps to 'case 1:'  at line 758→
case NULLPROC((unsigned int)0):
if (!svc_sendreply(transp, xdr_void, NULL((void *)0)))
	syslog(LOG_ERR3, "Can't send reply");
return;
case RPCMNT_MOUNT1:
if (debug)
3
←
Assuming 'debug' is 0→
4
←
Taking false branch→
	fprintf(stderr(&__sF[2]), "Got mount request from %s\n",
	    inet_ntoa(transp->xp_raddr.sin_addr));
if (sport >= IPPORT_RESERVED1024) {
5
←
Assuming 'sport' is < IPPORT_RESERVED→
6
←
Taking false branch→
	syslog(LOG_NOTICE5,
	    "Refused mount RPC from host %s port %d",
	    inet_ntoa(transp->xp_raddr.sin_addr), sport);
	svcerr_weakauth(transp);
	return;
}
if (!svc_getargs(transp, xdr_dir, rpcpath)(*(transp)->xp_ops->xp_getargs)((transp), (xdr_dir), (rpcpath
))) {
7
←
Assuming the condition is false→
8
←
Taking false branch→
	svcerr_decode(transp);
	return;
}
if (debug)
9
←
Assuming 'debug' is 0→
10
←
Taking false branch→
	fprintf(stderr(&__sF[2]), "rpcpath: %s\n", rpcpath);

/*
 * Get the real pathname and make sure it is a file or
 * directory that exists.
 */
if (realpath(rpcpath, dirpath) == NULL((void *)0)) {
11
←
Assuming the condition is false→
12
←
Taking false branch→
	bad = errno(*__errno());
	if (debug)
		fprintf(stderr(&__sF[2]), "realpath failed on %s\n",
		    rpcpath);
	strlcpy(dirpath, rpcpath, sizeof(dirpath));
} else if (stat(dirpath, &stb) == -1 ||
13
←
Assuming the condition is true→
    (!S_ISDIR(stb.st_mode)((stb.st_mode & 0170000) == 0040000) && !S_ISREG(stb.st_mode)((stb.st_mode & 0170000) == 0100000)) ||
    statfs(dirpath, &fsb) == -1) {
	if (debug13.1
'debug' is 0
)
14
←
Taking false branch→
		fprintf(stderr(&__sF[2]), "stat failed on %s\n", dirpath);
	bad = ENOENT2;	/* We will send error reply later */
}

/* Check in the exports list */
sigprocmask(SIG_BLOCK1, &sighup_mask, NULL((void *)0));
ep = ex_search(&fsb.f_fsid);
15
←
Calling 'ex_search'→
hostset = defset = 0;
if (ep && (chk_host(ep->ex_defdir, saddr, &defset, &hostset) ||
    ((dp = dirp_search(ep->ex_dirl, dirpath)) &&
    chk_host(dp, saddr, &defset, &hostset)) ||
    (defset && scan_tree(ep->ex_defdir, saddr) == 0 &&
    scan_tree(ep->ex_dirl, saddr) == 0))) {
	if (bad) {
		if (!svc_sendreply(transp, xdr_long,
		    (caddr_t)&bad))
			syslog(LOG_ERR3, "Can't send reply");
		sigprocmask(SIG_UNBLOCK2, &sighup_mask, NULL((void *)0));
		return;
	}
	if (hostset & DP_HOSTSET0x2)
		fhr.fhr_flag = hostset;
	else
		fhr.fhr_flag = defset;
	fhr.fhr_vers = rqstp->rq_vers;
	/* Get the file handle */
	memset(&fhr.fhr_fh, 0, sizeof(nfsfh_t));
	if (imsg_getfh(dirpath, (fhandle_t *)&fhr.fhr_fh) < 0) {
		bad = errno(*__errno());
		syslog(LOG_ERR3, "Can't get fh for %s", dirpath);
		if (!svc_sendreply(transp, xdr_long,
		    (caddr_t)&bad))
			syslog(LOG_ERR3, "Can't send reply");
		sigprocmask(SIG_UNBLOCK2, &sighup_mask, NULL((void *)0));
		return;
	}
	if (!svc_sendreply(transp, xdr_fhs, (caddr_t)&fhr))
		syslog(LOG_ERR3, "Can't send reply");
	if (hp == NULL((void *)0))
		hp = gethostbyaddr((caddr_t)&saddr,
		    sizeof(saddr), AF_INET2);
	if (hp)
		add_mlist(hp->h_name, dirpath);
	else
		add_mlist(inet_ntoa(transp->xp_raddr.sin_addr),
			dirpath);
	if (debug) {
		fprintf(stderr(&__sF[2]),
		    "Mount successful for %s by %s.\n",
		    dirpath,
		    inet_ntoa(transp->xp_raddr.sin_addr));
	}
} else
	bad = EACCES13;

if (bad && !svc_sendreply(transp, xdr_long, (caddr_t)&bad))
	syslog(LOG_ERR3, "Can't send reply");
sigprocmask(SIG_UNBLOCK2, &sighup_mask, NULL((void *)0));
return;
case RPCMNT_DUMP2:
if (!svc_sendreply(transp, xdr_mlist, NULL((void *)0)))
	syslog(LOG_ERR3, "Can't send reply");
return;
case RPCMNT_UMOUNT3:
if (sport >= IPPORT_RESERVED1024) {
	svcerr_weakauth(transp);
	return;
}
if (!svc_getargs(transp, xdr_dir, dirpath)(*(transp)->xp_ops->xp_getargs)((transp), (xdr_dir), (dirpath
))) {
	svcerr_decode(transp);
	return;
}
if (!svc_sendreply(transp, xdr_void, NULL((void *)0)))
	syslog(LOG_ERR3, "Can't send reply");
hp = gethostbyaddr((caddr_t)&saddr, sizeof(saddr), AF_INET2);
if (hp)
	del_mlist(hp->h_name, dirpath);
del_mlist(inet_ntoa(transp->xp_raddr.sin_addr), dirpath);
return;
case RPCMNT_UMNTALL4:
if (sport >= IPPORT_RESERVED1024) {
	svcerr_weakauth(transp);
	return;
}
if (!svc_sendreply(transp, xdr_void, NULL((void *)0)))
	syslog(LOG_ERR3, "Can't send reply");
hp = gethostbyaddr((caddr_t)&saddr, sizeof(saddr), AF_INET2);
if (hp)
	del_mlist(hp->h_name, NULL((void *)0));
del_mlist(inet_ntoa(transp->xp_raddr.sin_addr), NULL((void *)0));
return;
case RPCMNT_EXPORT5:
if (!svc_sendreply(transp, xdr_explist, NULL((void *)0)))
	syslog(LOG_ERR3, "Can't send reply");
return;
default:
svcerr_noproc(transp);
return;
}
889}

891/*
* Xdr conversion for a dirpath string
*/
894int
895xdr_dir(XDR *xdrsp, char *dirp)
896{
return (xdr_string(xdrsp, &dirp, RPCMNT_PATHLEN1024));
898}

900/*
* Xdr routine to generate file handle reply
*/
903int
904xdr_fhs(XDR *xdrsp, caddr_t cp)
905{
struct fhreturn *fhrp = (struct fhreturn *)cp;
long ok = 0, len, auth;

if (!xdr_long(xdrsp, &ok))
return (0);
switch (fhrp->fhr_vers) {
case 1:
return (xdr_opaque(xdrsp, (caddr_t)&fhrp->fhr_fh, NFSX_V2FH32));
case 3:
len = NFSX_V3FH(sizeof (fhandle_t));
if (!xdr_long(xdrsp, &len))
	return (0);
if (!xdr_opaque(xdrsp, (caddr_t)&fhrp->fhr_fh, len))
	return (0);
auth = RPCAUTH_UNIX1;
len = 1;
if (!xdr_long(xdrsp, &len))
	return (0);
return (xdr_long(xdrsp, &auth));
}
return (0);
927}

929int
930xdr_mlist(XDR *xdrsp, caddr_t cp)
931{
int true = 1, false = 0;
struct mountlist *mlp;
char *strp;

mlp = mlhead;
while (mlp) {
if (!xdr_bool(xdrsp, &true))
	return (0);
strp = &mlp->ml_host[0];
if (!xdr_string(xdrsp, &strp, RPCMNT_NAMELEN255))
	return (0);
strp = &mlp->ml_dirp[0];
if (!xdr_string(xdrsp, &strp, RPCMNT_PATHLEN1024))
	return (0);
mlp = mlp->ml_next;
}
if (!xdr_bool(xdrsp, &false))
return (0);
return (1);
951}

953/*
* Xdr conversion for export list
*/
956int
957xdr_explist(XDR *xdrsp, caddr_t cp)
958{
struct exportlist *ep;
int false = 0, putdef;
sigset_t sighup_mask;

sigemptyset(&sighup_mask);
sigaddset(&sighup_mask, SIGHUP1);
sigprocmask(SIG_BLOCK1, &sighup_mask, NULL((void *)0));
ep = exphead;
while (ep) {
putdef = 0;
if (put_exlist(ep->ex_dirl, xdrsp, ep->ex_defdir, &putdef))
	goto errout;
if (ep->ex_defdir && putdef == 0 && put_exlist(ep->ex_defdir,
    xdrsp, NULL((void *)0), &putdef))
	goto errout;
ep = ep->ex_next;
}
sigprocmask(SIG_UNBLOCK2, &sighup_mask, NULL((void *)0));
if (!xdr_bool(xdrsp, &false))
return (0);
return (1);
980errout:
sigprocmask(SIG_UNBLOCK2, &sighup_mask, NULL((void *)0));
return (0);
983}

985/*
* Called from xdr_explist() to traverse the tree and export the
* directory paths.
*/
989int
990put_exlist(struct dirlist *dp, XDR *xdrsp, struct dirlist *adp,
  int *putdefp)
992{
int true = 1, false = 0, gotalldir = 0;
struct grouplist *grp;
struct hostlist *hp;
char *strp;

if (dp) {
if (put_exlist(dp->dp_left, xdrsp, adp, putdefp))
	return (1);
if (!xdr_bool(xdrsp, &true))
	return (1);
strp = dp->dp_dirp;
if (!xdr_string(xdrsp, &strp, RPCMNT_PATHLEN1024))
	return (1);
if (adp && !strcmp(dp->dp_dirp, adp->dp_dirp)) {
	gotalldir = 1;
	*putdefp = 1;
}
if ((dp->dp_flag & DP_DEFSET0x1) == 0 &&
    (gotalldir == 0 || (adp->dp_flag & DP_DEFSET0x1) == 0)) {
	hp = dp->dp_hosts;
	while (hp) {
		grp = hp->ht_grp;
		if (grp->gr_type == GT_HOST0x1) {
			if (!xdr_bool(xdrsp, &true))
				return (1);
			strp = grp->gr_ptr.gt_hostent->h_name;
			if (!xdr_string(xdrsp, &strp,
			    RPCMNT_NAMELEN255))
				return (1);
		} else if (grp->gr_type == GT_NET0x2) {
			if (!xdr_bool(xdrsp, &true))
				return (1);
			strp = grp->gr_ptr.gt_net.nt_name;
			if (!xdr_string(xdrsp, &strp,
			    RPCMNT_NAMELEN255))
				return (1);
		}
		hp = hp->ht_next;
		if (gotalldir && hp == NULL((void *)0)) {
			hp = adp->dp_hosts;
			gotalldir = 0;
		}
	}
}
if (!xdr_bool(xdrsp, &false))
	return (1);
if (put_exlist(dp->dp_right, xdrsp, adp, putdefp))
	return (1);
}
return (0);
1043}

1045#define LINESIZ10240	10240
1046char line[LINESIZ10240];
1047FILE *exp_file;

1049void
1050new_exportlist(int signo)
1051{
gothup = 1;

1054}

1056/*
* Get the export list
*/
1059void
1060get_exportlist(void)
1061{
int len, has_host, exflags, got_nondir, dirplen = 0, num;
int lookup_failed, num_hosts, i, netgrp;
char *cp, *endcp, *dirp = NULL((void *)0), *hst, *usr, *dom, savedc;
struct exportlist *ep, *ep2;
struct grouplist *grp, *tgrp;
struct exportlist **epp;
struct dirlist *dirhead;
struct statfs fsb, *ofsp, *fsp;
struct hostent *hpe;
struct xucred anon;
struct fsarray {
int exflags;
char *mntonname;
} *fstbl;

/*
* First, get rid of the old list
*/
ep = exphead;
while (ep) {
ep2 = ep;
ep = ep->ex_next;
free_exp(ep2);
}
exphead = NULL((void *)0);

grp = grphead;
while (grp) {
tgrp = grp;
grp = grp->gr_next;
free_grp(tgrp);
}
grphead = NULL((void *)0);

/*
* And delete exports that are in the kernel for all local
* file systems.
* XXX: Should know how to handle all local exportable file systems
*      instead of just MOUNT_FFS.
*/
num = getmntinfo(&ofsp, MNT_NOWAIT2);
if (num == 0 && errno(*__errno()))
syslog(LOG_ERR3, "getmntinfo: %s", strerror(errno(*__errno())));

fsp = ofsp;

fstbl = calloc(num, sizeof (fstbl[0]));
if (fstbl == NULL((void *)0))
out_of_mem();

for (i = 0; i < num; i++) {

if (!strncmp(fsp->f_fstypename, MOUNT_MFS"mfs", MFSNAMELEN16) ||
    !strncmp(fsp->f_fstypename, MOUNT_FFS"ffs", MFSNAMELEN16) ||
    !strncmp(fsp->f_fstypename, MOUNT_EXT2FS"ext2fs", MFSNAMELEN16) ||
    !strncmp(fsp->f_fstypename, MOUNT_MSDOS"msdos", MFSNAMELEN16) ||
    !strncmp(fsp->f_fstypename, MOUNT_CD9660"cd9660", MFSNAMELEN16)) {
	fstbl[i].exflags = MNT_DELEXPORT0x00020000;
	fstbl[i].mntonname = fsp->f_mntonname;
}
fsp++;
}

/*
* Read in the exports file and build the list, calling mount() through
* the privileged child as we go along to push the export rules into
* the kernel.
*/
if ((exp_file = fopen(exname, "r")) == NULL((void *)0)) {
syslog(LOG_ERR3, "Can't open %s", exname);
exit(2);
}
dirhead = NULL((void *)0);
while (get_line()) {
if (debug)
	fprintf(stderr(&__sF[2]), "Got line %s\n",line);
cp = line;
nextfield(&cp, &endcp);
if (*cp == '#')
	goto nextline;

/*
 * Set defaults.
 */
has_host = FALSE(0);
num_hosts = 0;
lookup_failed = FALSE(0);
anon = def_anon;
exflags = MNT_EXPORTED0x00000100;
got_nondir = 0;
opt_flags = 0;
ep = NULL((void *)0);

/*
 * Create new exports list entry
 */
len = endcp-cp;
tgrp = grp = get_grp();
while (len > 0) {
	if (len > RPCMNT_NAMELEN255) {
		getexp_err(ep, tgrp);
		goto nextline;
	}
	if (*cp == '-') {
		if (ep == NULL((void *)0)) {
			getexp_err(ep, tgrp);
			goto nextline;
		}
		if (debug)
			fprintf(stderr(&__sF[2]), "doing opt %s\n", cp);
		got_nondir = 1;
		if (do_opt(&cp, &endcp, ep, grp, &has_host,
		    &exflags, &anon)) {
			getexp_err(ep, tgrp);
			goto nextline;
		}
	} else if (*cp == '/') {
	    savedc = *endcp;
	    *endcp = '\0';
	    if (check_dirpath(cp) &&
		statfs(cp, &fsb) >= 0) {
		if (got_nondir) {
		    syslog(LOG_ERR3, "Dirs must be first");
		    getexp_err(ep, tgrp);
		    goto nextline;
		}
		if (ep) {
		    if (ep->ex_fs.val[0] != fsb.f_fsid.val[0] ||
			ep->ex_fs.val[1] != fsb.f_fsid.val[1]) {
			getexp_err(ep, tgrp);
			goto nextline;
		    }
		} else {
		    /*
		     * See if this directory is already
		     * in the list.
		     */
		    ep = ex_search(&fsb.f_fsid);
		    if (ep == NULL((void *)0)) {
			int len;

			ep = get_exp();
			ep->ex_fs = fsb.f_fsid;
			len = strlen(fsb.f_mntonname) + 1;
			ep->ex_fsdir = malloc(len);
			if (ep->ex_fsdir)
			    strlcpy(ep->ex_fsdir,
			        fsb.f_mntonname, len);
			else
			    out_of_mem();
			if (debug)
			  fprintf(stderr(&__sF[2]),
			      "Making new ep fs=0x%x,0x%x\n",
			      fsb.f_fsid.val[0],
			      fsb.f_fsid.val[1]);
		    } else if (debug)
			fprintf(stderr(&__sF[2]),
			    "Found ep fs=0x%x,0x%x\n",
			    fsb.f_fsid.val[0],
			    fsb.f_fsid.val[1]);
		}

		/*
		 * Add dirpath to export mount point.
		 */
		dirp = add_expdir(&dirhead, cp, len);
		dirplen = len;
	    } else {
		getexp_err(ep, tgrp);
		goto nextline;
	    }
	    *endcp = savedc;
	} else {
	    savedc = *endcp;
	    *endcp = '\0';
	    got_nondir = 1;
	    if (ep == NULL((void *)0)) {
		getexp_err(ep, tgrp);
		goto nextline;
	    }

	    /*
	     * Get the host or netgroup.
	     */
	    setnetgrent(cp);
	    netgrp = getnetgrent((const char **)&hst,
		(const char **)&usr, (const char **)&dom);
	    do {
		if (has_host) {
		    grp->gr_next = get_grp();
		    grp = grp->gr_next;
		} else {
		    memset(grp, 0, sizeof(*grp));
		}
		if (netgrp) {
		    if (hst == NULL((void *)0)) {
			syslog(LOG_ERR3,
			    "NULL hostname in netgroup %s, skipping",
			    cp);
			grp->gr_type = GT_IGNORE0x5;
			lookup_failed = TRUE(1);
			continue;
		    } else if (get_host(hst, grp, tgrp)) {
			syslog(LOG_ERR3,
			    "Unknown host (%s) in netgroup %s",
			    hst, cp);
			grp->gr_type = GT_IGNORE0x5;
			lookup_failed = TRUE(1);
			continue;
		    }
		} else if (get_host(cp, grp, tgrp)) {
		    syslog(LOG_ERR3,
			"Unknown host (%s) in line %s",
			cp, line);
		    grp->gr_type = GT_IGNORE0x5;
		    lookup_failed = TRUE(1);
		    continue;
		}
		has_host = TRUE(1);
		num_hosts++;
	    } while (netgrp && getnetgrent((const char **)&hst,
		(const char **)&usr, (const char **)&dom));
	    endnetgrent();
	    *endcp = savedc;
	}
	cp = endcp;
	nextfield(&cp, &endcp);
	len = endcp - cp;
}
/*
 * If the exports list is empty due to unresolvable hostnames
 * we throw away the line.
 */
if (lookup_failed == TRUE(1) && num_hosts == 0 &&
    tgrp->gr_type == GT_IGNORE0x5)  {
	getexp_err(ep, tgrp);
	goto nextline;
}
if (check_options(dirhead)) {
	getexp_err(ep, tgrp);
	goto nextline;
}
if (!has_host) {
	grp->gr_type = GT_HOST0x1;
	if (debug)
		fprintf(stderr(&__sF[2]), "Adding a default entry\n");
	/* add a default group and make the grp list NULL */
	hpe = malloc(sizeof(struct hostent));
	if (hpe == NULL((void *)0))
		out_of_mem();
	hpe->h_name = strdup("Default");
	if (hpe->h_name == NULL((void *)0))
		out_of_mem();
	hpe->h_addrtype = AF_INET2;
	hpe->h_length = sizeof (u_int32_t);
	hpe->h_addr_list = NULL((void *)0);
	grp->gr_ptr.gt_hostent = hpe;

/*
 * Don't allow a network export coincide with a list of
 * host(s) on the same line.
 */
} else if ((opt_flags & OP_NET0x10) && tgrp->gr_next) {
	getexp_err(ep, tgrp);
	goto nextline;
}

/*
 * Loop through hosts, pushing the exports into the kernel.
 * After loop, tgrp points to the start of the list and
 * grp points to the last entry in the list.
 */
grp = tgrp;
do {

	/*
	 * remove filesystem from unexport list
	 * add MNT_DELEXPORT to exflags to clean up
	 * any old addrlist in the kernel
	 */

	for (i = 0; i < num; i++) {
		if ((fstbl[i].mntonname != NULL((void *)0)) &&
		    (strcmp(fsb.f_mntonname,
		    fstbl[i].mntonname) == 0) &&
		    (fstbl[i].exflags & MNT_DELEXPORT0x00020000)) {
			exflags |= MNT_DELEXPORT0x00020000;
			fstbl[i].exflags = 0;
			if (debug)
				fprintf(stderr(&__sF[2]), "removing  %s %s from unexport list\n", dirp, fstbl[i].mntonname);
		}
	}

	if (debug)
		fprintf(stderr(&__sF[2]), "exporting %s\n", dirp);
	/*
	 * Non-zero return indicates an error.  Return
	 * val of 1 means line is invalid (not just entry).
	 */
	i = do_mount(ep, grp, exflags, &anon, dirp, dirplen);
	exflags &= ~MNT_DELEXPORT0x00020000;
	if (i == 1) {
		getexp_err(ep, tgrp);
		goto nextline;
	} else if (i == 2) {
		syslog(LOG_ERR3,
		    "Bad exports list entry (%s) in line %s",
		    (grp->gr_type == GT_HOST0x1)
		    ? grp->gr_ptr.gt_hostent->h_name
		    : (grp->gr_type == GT_NET0x2)
		    ? grp->gr_ptr.gt_net.nt_name
		    : "Unknown", line);
	}
} while (grp->gr_next && (grp = grp->gr_next));

/*
 * Success. Update the data structures.
 */
if (has_host) {
	hang_dirp(dirhead, tgrp, ep, opt_flags);
	grp->gr_next = grphead;
	grphead = tgrp;
} else {
	hang_dirp(dirhead, NULL((void *)0), ep,
		opt_flags);
	free_grp(grp);
}
dirhead = NULL((void *)0);
if ((ep->ex_flag & EX_LINKED0x1) == 0) {
	ep2 = exphead;
	epp = &exphead;

	/*
	 * Insert in the list in alphabetical order.
	 */
	while (ep2 && strcmp(ep2->ex_fsdir, ep->ex_fsdir) < 0) {
		epp = &ep2->ex_next;
		ep2 = ep2->ex_next;
	}
	if (ep2)
		ep->ex_next = ep2;
	*epp = ep;
	ep->ex_flag |= EX_LINKED0x1;
}
1406nextline:
if (dirhead) {
	free_dir(dirhead);
	dirhead = NULL((void *)0);
}
}

fsp = ofsp;
for (i = 0; i < num; i++, fsp++) {
if ((fstbl[i].exflags & MNT_DELEXPORT0x00020000) == 0)
	continue;
if (debug)
	fprintf(stderr(&__sF[2]), "unexporting %s %s\n",
	    fsp->f_mntonname, fstbl[i].mntonname);
send_imsg(IMSG_DELEXPORT0x4, fsp->f_mntonname,
    sizeof(fsp->f_mntonname));
}
free(fstbl);
fclose(exp_file);
1425}

1427/*
* Allocate an export list element
*/
1430struct exportlist *
1431get_exp(void)
1432{
struct exportlist *ep;

ep = calloc(1, sizeof (struct exportlist));
if (ep == NULL((void *)0))
out_of_mem();
return (ep);
1439}

1441/*
* Allocate a group list element
*/
1444struct grouplist *
1445get_grp(void)
1446{
struct grouplist *gp;

gp = calloc(1, sizeof (struct grouplist));
if (gp == NULL((void *)0))
out_of_mem();
return (gp);
1453}

1455/*
* Clean up upon an error in get_exportlist().
*/
1458void
1459getexp_err(struct exportlist *ep, struct grouplist *grp)
1460{
struct grouplist *tgrp;

syslog(LOG_ERR3, "Bad exports list line %s", line);
if (ep && (ep->ex_flag & EX_LINKED0x1) == 0)
free_exp(ep);
while (grp) {
tgrp = grp;
grp = grp->gr_next;
free_grp(tgrp);
}
1471}

1473/*
* Search the export list for a matching fs.
*/
1476struct exportlist *
1477ex_search(fsid_t *fsid)
1478{
struct exportlist *ep;

ep = exphead;
while (ep) {
16
←
Loop condition is true.  Entering loop body→
if (ep->ex_fs.val[0] == fsid->val[0] &&
17
←
The right operand of '==' is a garbage value
    ep->ex_fs.val[1] == fsid->val[1])
	return (ep);
ep = ep->ex_next;
}
return (ep);
1489}

1491/*
* Add a directory path to the list.
*/
1494char *
1495add_expdir(struct dirlist **dpp, char *cp, int len)
1496{
struct dirlist *dp;

/* do not need +1 because of dp_dirp[1] */
dp = malloc(sizeof (struct dirlist) + len);
if (dp == NULL((void *)0))
out_of_mem();
dp->dp_left = *dpp;
dp->dp_right = NULL((void *)0);
dp->dp_flag = 0;
dp->dp_hosts = NULL((void *)0);
strlcpy(dp->dp_dirp, cp, len + 1);
*dpp = dp;
return (dp->dp_dirp);
1510}

1512/*
* Hang the dir list element off the dirpath binary tree as required
* and update the entry for host.
*/
1516void
1517hang_dirp(struct dirlist *dp, struct grouplist *grp, struct exportlist *ep,
  int flags)
1519{
struct hostlist *hp;
struct dirlist *dp2;

if (flags & OP_ALLDIRS0x40) {
if (ep->ex_defdir)
	free((caddr_t)dp);
else
	ep->ex_defdir = dp;
if (grp == NULL((void *)0)) {
	ep->ex_defdir->dp_flag |= DP_DEFSET0x1;
} else while (grp) {
	hp = get_ht();
	hp->ht_grp = grp;
	hp->ht_next = ep->ex_defdir->dp_hosts;
	ep->ex_defdir->dp_hosts = hp;
	grp = grp->gr_next;
}
} else {

/*
 * Loop through the directories adding them to the tree.
 */
while (dp) {
	dp2 = dp->dp_left;
	add_dlist(&ep->ex_dirl, dp, grp, flags);
	dp = dp2;
}
}
1548}

1550/*
* Traverse the binary tree either updating a node that is already there
* for the new directory or adding the new node.
*/
1554void
1555add_dlist(struct dirlist **dpp, struct dirlist *newdp, struct grouplist *grp,
  int flags)
1557{
struct dirlist *dp;
struct hostlist *hp;
int cmp;

dp = *dpp;
if (dp) {
cmp = strcmp(dp->dp_dirp, newdp->dp_dirp);
if (cmp > 0) {
	add_dlist(&dp->dp_left, newdp, grp, flags);
	return;
} else if (cmp < 0) {
	add_dlist(&dp->dp_right, newdp, grp, flags);
	return;
} else
	free((caddr_t)newdp);
} else {
dp = newdp;
dp->dp_left = NULL((void *)0);
*dpp = dp;
}
if (grp) {

/*
 * Hang all of the host(s) off of the directory point.
 */
do {
	hp = get_ht();
	hp->ht_grp = grp;
	hp->ht_next = dp->dp_hosts;
	dp->dp_hosts = hp;
	grp = grp->gr_next;
} while (grp);
} else {
dp->dp_flag |= DP_DEFSET0x1;
}
1593}

1595/*
* Search for a dirpath on the export point.
*/
1598struct dirlist *
1599dirp_search(struct dirlist *dp, char *dirpath)
1600{
int cmp;

if (dp) {
cmp = strcmp(dp->dp_dirp, dirpath);
if (cmp > 0)
	return (dirp_search(dp->dp_left, dirpath));
else if (cmp < 0)
	return (dirp_search(dp->dp_right, dirpath));
else
	return (dp);
}
return (dp);
1613}

1615/*
* Scan for a host match in a directory tree.
*/
1618int
1619chk_host(struct dirlist *dp, in_addr_t saddr, int *defsetp, int *hostsetp)
1620{
struct hostlist *hp;
struct grouplist *grp;
u_int32_t **addrp;

if (dp) {
if (dp->dp_flag & DP_DEFSET0x1)
	*defsetp = dp->dp_flag;
hp = dp->dp_hosts;
while (hp) {
	grp = hp->ht_grp;
	switch (grp->gr_type) {
	case GT_HOST0x1:
	    addrp = (u_int32_t **)
		grp->gr_ptr.gt_hostent->h_addr_list;
	    while (*addrp) {
		if (**addrp == saddr) {
		    *hostsetp = (hp->ht_flag | DP_HOSTSET0x2);
		    return (1);
		}
		addrp++;
	    }
	    break;
	case GT_NET0x2:
	    if ((saddr & grp->gr_ptr.gt_net.nt_mask) ==
		grp->gr_ptr.gt_net.nt_net) {
		*hostsetp = (hp->ht_flag | DP_HOSTSET0x2);
		return (1);
	    }
	    break;
	}
	hp = hp->ht_next;
}
}
return (0);
1655}

1657/*
* Scan tree for a host that matches the address.
*/
1660int
1661scan_tree(struct dirlist *dp, in_addr_t saddr)
1662{
int defset, hostset;

if (dp) {
if (scan_tree(dp->dp_left, saddr))
	return (1);
if (chk_host(dp, saddr, &defset, &hostset))
	return (1);
if (scan_tree(dp->dp_right, saddr))
	return (1);
}
return (0);
1674}

1676/*
* Traverse the dirlist tree and free it up.
*/
1679void
1680free_dir(struct dirlist *dp)
1681{

if (dp) {
free_dir(dp->dp_left);
free_dir(dp->dp_right);
free_host(dp->dp_hosts);
free((caddr_t)dp);
}
1689}

1691/*
* Parse the option string and update fields.
* Option arguments may either be -<option>=<value> or
* -<option> <value>
*/
1696int
1697do_opt(char **cpp, char **endcpp, struct exportlist *ep, struct grouplist *grp,
  int *has_hostp, int *exflagsp, struct xucred *cr)
1699{
char *cp, *endcp, *cpopt, savedc, savedc2 = 0;
char *cpoptarg, *cpoptend;
int allflag, usedarg;

cpopt = *cpp;
cpopt++;
cp = *endcpp;
savedc = *cp;
*cp = '\0';
while (cpopt && *cpopt) {
allflag = 1;
usedarg = -2;
if ((cpoptend = strchr(cpopt, ','))) {
	*cpoptend++ = '\0';
	if ((cpoptarg = strchr(cpopt, '=')))
		*cpoptarg++ = '\0';
} else {
	if ((cpoptarg = strchr(cpopt, '=')))
		*cpoptarg++ = '\0';
	else {
		*cp = savedc;
		nextfield(&cp, &endcp);
		**endcpp = '\0';
		if (endcp > cp && *cp != '-') {
			cpoptarg = cp;
			savedc2 = *endcp;
			*endcp = '\0';
			usedarg = 0;
		}
	}
}
if (!strcmp(cpopt, "ro") || !strcmp(cpopt, "o")) {
	*exflagsp |= MNT_EXRDONLY0x00000080;
} else if (cpoptarg && (!strcmp(cpopt, "maproot") ||
    !(allflag = strcmp(cpopt, "mapall")) ||
    !strcmp(cpopt, "root") || !strcmp(cpopt, "r"))) {
	usedarg++;
	parsecred(cpoptarg, cr);
	if (allflag == 0) {
		*exflagsp |= MNT_EXPORTANON0x00000400;
		opt_flags |= OP_MAPALL0x02;
	} else
		opt_flags |= OP_MAPROOT0x01;
} else
    if (cpoptarg && (!strcmp(cpopt, "mask") ||
		     !strcmp(cpopt, "m"))) {
	if (get_net(cpoptarg, &grp->gr_ptr.gt_net, 1)) {
		syslog(LOG_ERR3, "Bad mask: %s", cpoptarg);
		return (1);
	}
	usedarg++;
	opt_flags |= OP_MASK0x08;
} else if (cpoptarg && (!strcmp(cpopt, "network") ||
    !strcmp(cpopt, "n"))) {
	if (grp->gr_type != GT_NULL0x0) {
		syslog(LOG_ERR3, "Network/host conflict");
		return (1);
	} else if (get_net(cpoptarg, &grp->gr_ptr.gt_net, 0)) {
		syslog(LOG_ERR3, "Bad net: %s", cpoptarg);
		return (1);
	}
	grp->gr_type = GT_NET0x2;
	*has_hostp = 1;
	usedarg++;
	opt_flags |= OP_NET0x10;
} else if (!strcmp(cpopt, "alldirs")) {
	opt_flags |= OP_ALLDIRS0x40;
} else {
	syslog(LOG_ERR3, "Bad opt %s", cpopt);
	return (1);
}
if (usedarg >= 0) {
	*endcp = savedc2;
	**endcpp = savedc;
	if (usedarg > 0) {
		*cpp = cp;
		*endcpp = endcp;
	}
	return (0);
}
cpopt = cpoptend;
}
**endcpp = savedc;
return (0);
1784}

1786/*
* Translate a character string to the corresponding list of network
* addresses for a hostname.
*/
1790int
1791get_host(char *cp, struct grouplist *grp, struct grouplist *tgrp)
1792{
struct hostent *hp, *nhp, t_host;
struct grouplist *checkgrp;
char **addrp, **naddrp;
struct in_addr saddr;
char *aptr[2];
int i;

if (grp->gr_type != GT_NULL0x0)
return (1);
if ((hp = gethostbyname(cp)) == NULL((void *)0)) {
if (isdigit((unsigned char)*cp)) {
	if (inet_aton(cp, &saddr) == 0) {
		syslog(LOG_ERR3, "inet_aton failed for %s", cp);
		return (1);
	}
	if ((hp = gethostbyaddr((caddr_t)&saddr.s_addr,
	    sizeof (saddr.s_addr), AF_INET2)) == NULL((void *)0)) {
		hp = &t_host;
		hp->h_name = cp;
		hp->h_addrtype = AF_INET2;
		hp->h_length = sizeof (u_int32_t);
		hp->h_addr_list = aptr;
		aptr[0] = (char *)&saddr;
		aptr[1] = NULL((void *)0);
	}
} else {
	syslog(LOG_ERR3, "gethostbyname; failed for %s: %s", cp,
	    hstrerror(h_errno));
	return (1);
}
}

/* only insert each host onto the list once */
for (checkgrp = tgrp; checkgrp; checkgrp = checkgrp->gr_next) {
if (checkgrp->gr_type == GT_HOST0x1 &&
    checkgrp->gr_ptr.gt_hostent != NULL((void *)0) &&
    !strcmp(checkgrp->gr_ptr.gt_hostent->h_name, hp->h_name)) {
	grp->gr_type = GT_IGNORE0x5;
	return (0);
}
}

grp->gr_type = GT_HOST0x1;
nhp = grp->gr_ptr.gt_hostent = malloc(sizeof(struct hostent));
if (nhp == NULL((void *)0))
out_of_mem();
memcpy(nhp, hp, sizeof(struct hostent));
i = strlen(hp->h_name)+1;
nhp->h_name = malloc(i);
if (nhp->h_name == NULL((void *)0))
out_of_mem();
memcpy(nhp->h_name, hp->h_name, i);
addrp = hp->h_addr_list;
i = 1;
while (*addrp++)
i++;
naddrp = nhp->h_addr_list = reallocarray(NULL((void *)0), i, sizeof(char *));
if (naddrp == NULL((void *)0))
out_of_mem();
addrp = hp->h_addr_list;
while (*addrp) {
*naddrp = malloc(hp->h_length);
if (*naddrp == NULL((void *)0))
    out_of_mem();
memcpy(*naddrp, *addrp, hp->h_length);
addrp++;
naddrp++;
}
*naddrp = NULL((void *)0);
if (debug)
fprintf(stderr(&__sF[2]), "got host %s\n", hp->h_name);
return (0);
1865}

1867/*
* Free up an exports list component
*/
1870void
1871free_exp(struct exportlist *ep)
1872{

if (ep->ex_defdir) {
free_host(ep->ex_defdir->dp_hosts);
free((caddr_t)ep->ex_defdir);
}
free(ep->ex_fsdir);
free_dir(ep->ex_dirl);
free((caddr_t)ep);
1881}

1883/*
* Free hosts.
*/
1886void
1887free_host(struct hostlist *hp)
1888{
struct hostlist *hp2;

while (hp) {
hp2 = hp;
hp = hp->ht_next;
free((caddr_t)hp2);
}
1896}

1898struct hostlist *
1899get_ht(void)
1900{
struct hostlist *hp;

hp = malloc(sizeof (struct hostlist));
if (hp == NULL((void *)0))
out_of_mem();
hp->ht_next = NULL((void *)0);
hp->ht_flag = 0;
return (hp);
1909}

1911/*
* Out of memory, fatal
*/
1914void
1915out_of_mem(void)
1916{

syslog(LOG_ERR3, "Out of memory");
exit(2);
1920}

1922/*
* Do the mount syscall with the update flag to push the export info into
* the kernel.  Returns 0 on success, 1 for fatal error, and 2 for error
* that only invalidates the specific entry/host.
*/
1927int
1928do_mount(struct exportlist *ep, struct grouplist *grp, int exflags,
  struct xucred *anoncrp, char *dirp, int dirplen)
1930{
struct sockaddr_in sin, imask;
struct export_args args;
char savedc = '\0';
u_int32_t **addrp;
char *cp = NULL((void *)0);
in_addr_t net;
int done;

args.ex_flags = exflags;
args.ex_anon = *anoncrp;
memset(&sin, 0, sizeof(sin));
memset(&imask, 0, sizeof(imask));
sin.sin_family = AF_INET2;
sin.sin_len = sizeof(sin);
imask.sin_family = AF_INET2;
imask.sin_len = sizeof(sin);
if (grp->gr_type == GT_HOST0x1)
addrp = (u_int32_t **)grp->gr_ptr.gt_hostent->h_addr_list;
else
addrp = NULL((void *)0);

done = FALSE(0);
while (!done) {
switch (grp->gr_type) {
case GT_HOST0x1:
	args.ex_addr = (struct sockaddr *)&sin;
	args.ex_masklen = 0;
	if (!addrp) {
		args.ex_addrlen = 0;
		break;
	}
	sin.sin_addr.s_addr = **addrp;
	args.ex_addrlen = sizeof(sin);
	break;
case GT_NET0x2:
	sin.sin_addr.s_addr = grp->gr_ptr.gt_net.nt_net;
	args.ex_addr = (struct sockaddr *)&sin;
	args.ex_addrlen = sizeof (sin);
	args.ex_mask = (struct sockaddr *)&imask;
	args.ex_masklen = sizeof (imask);
	if (grp->gr_ptr.gt_net.nt_mask) {
		imask.sin_addr.s_addr = grp->gr_ptr.gt_net.nt_mask;
		break;
	}
	net = ntohl(grp->gr_ptr.gt_net.nt_net)(__uint32_t)(__builtin_constant_p(grp->gr_ptr.gt_net.nt_net
) ? (__uint32_t)(((__uint32_t)(grp->gr_ptr.gt_net.nt_net) &
 0xff) << 24 | ((__uint32_t)(grp->gr_ptr.gt_net.nt_net
) & 0xff00) << 8 | ((__uint32_t)(grp->gr_ptr.gt_net
.nt_net) & 0xff0000) >> 8 | ((__uint32_t)(grp->gr_ptr
.gt_net.nt_net) & 0xff000000) >> 24) : __swap32md(grp
->gr_ptr.gt_net.nt_net));
	if (IN_CLASSA(net)(((u_int32_t)(net) & ((u_int32_t)(0x80000000))) == ((u_int32_t
)(0x00000000))))
		imask.sin_addr.s_addr = inet_addr("255.0.0.0");
	else if (IN_CLASSB(net)(((u_int32_t)(net) & ((u_int32_t)(0xc0000000))) == ((u_int32_t
)(0x80000000))))
		imask.sin_addr.s_addr = inet_addr("255.255.0.0");
	else
		imask.sin_addr.s_addr = inet_addr("255.255.255.0");
	grp->gr_ptr.gt_net.nt_mask = imask.sin_addr.s_addr;
	break;
case GT_IGNORE0x5:
	return (0);
default:
	syslog(LOG_ERR3, "Bad grouptype");
	if (cp)
		*cp = savedc;
	return (1);
}

/*
 * XXX:
 * Maybe I should just use the fsb->f_mntonname path instead
 * of looping back up the dirp to the mount point??
 * Also, needs to know how to export all types of local
 * exportable file systems and not just MOUNT_FFS.
 */
while (imsg_export(dirp, &args) == -1) {
	if (cp)
		*cp-- = savedc;
	else
		cp = dirp + dirplen - 1;
	if (errno(*__errno()) == EPERM1) {
		syslog(LOG_ERR3,
		    "Can't change attributes for %s (%s).\n",
		    dirp,
		    (grp->gr_type == GT_HOST0x1)
		    ?grp->gr_ptr.gt_hostent->h_name
		    :(grp->gr_type == GT_NET0x2)
		    ?grp->gr_ptr.gt_net.nt_name
		    :"Unknown");
		return (2);
	}
	if (opt_flags & OP_ALLDIRS0x40) {
2017#if 0
		syslog(LOG_ERR3, "Could not remount %s: %m",
			dirp);
		return (2);
2021#endif
	}
	/* back up over the last component */
	while (cp > dirp && *cp == '/')
		cp--;
	while (cp > dirp && *(cp - 1) != '/')
		cp--;
	if (cp == dirp) {
		if (debug)
			fprintf(stderr(&__sF[2]), "mnt unsucc\n");
		syslog(LOG_ERR3, "Can't export %s: %m", dirp);
		return (2);
	}
	savedc = *cp;
	*cp = '\0';
}
if (addrp) {
	++addrp;
	if (*addrp == NULL((void *)0))
		done = TRUE(1);
} else
	done = TRUE(1);
}
if (cp)
*cp = savedc;
return (0);
2047}

2049/*
* Translate a net address.
*/
2052int
2053get_net(char *cp, struct netmsk *net, int maskflg)
2054{
struct in_addr inetaddr, inetaddr2;
in_addr_t netaddr;
struct netent *np;
char *name;

if ((netaddr = inet_network(cp)) != INADDR_NONE((u_int32_t)(0xffffffff))) {
inetaddr = inet_makeaddr(netaddr, 0);
/*
 * Due to arbitrary subnet masks, you don't know how many
 * bits to shift the address to make it into a network,
 * however you do know how to make a network address into
 * a host with host == 0 and then compare them.
 * (What a pest)
 */
if (!maskflg) {
	setnetent(0);
	while ((np = getnetent())) {
		inetaddr2 = inet_makeaddr(np->n_net, 0);
		if (inetaddr2.s_addr == inetaddr.s_addr)
			break;
	}
	endnetent();
}
} else {
if ((np = getnetbyname(cp)))
	inetaddr = inet_makeaddr(np->n_net, 0);
else
	return (1);
}
if (maskflg)
net->nt_mask = inetaddr.s_addr;
else {
int len;

if (np)
	name = np->n_name;
else
	name = inet_ntoa(inetaddr);
len = strlen(name) + 1;
net->nt_name = malloc(len);
if (net->nt_name == NULL((void *)0))
	out_of_mem();
strlcpy(net->nt_name, name, len);
net->nt_net = inetaddr.s_addr;
}
return (0);
2101}

2103/*
* Parse out the next white space separated field
*/
2106void
2107nextfield(char **cp, char **endcp)
2108{
char *p;

p = *cp;
while (*p == ' ' || *p == '\t')
p++;
if (*p == '\n' || *p == '\0')
*cp = *endcp = p;
else {
*cp = p++;
while (*p != ' ' && *p != '\t' && *p != '\n' && *p != '\0')
	p++;
*endcp = p;
}
2122}

2124/*
* Get an exports file line. Skip over blank lines and handle line
* continuations.
*/
2128int
2129get_line(void)
2130{
int totlen, cont_line, len;
char *p, *cp;

/*
* Loop around ignoring blank lines and getting all continuation lines.
*/
p = line;
totlen = 0;
do {
if (fgets(p, LINESIZ10240 - totlen, exp_file) == NULL((void *)0))
	return (0);
len = strlen(p);
cp = p + len - 1;
cont_line = 0;
while (cp >= p && (*cp == ' ' || *cp == '\t' || *cp == '\n' ||
    *cp == '\\')) {
	if (*cp == '\\')
		cont_line = 1;
	cp--;
	len--;
}
*++cp = '\0';
if (len > 0) {
	totlen += len;
	if (totlen >= LINESIZ10240) {
		syslog(LOG_ERR3, "Exports line too long");
		exit(2);
	}
	p = cp;
}
} while (totlen == 0 || cont_line);
return (1);
2163}

2165/*
* Parse a description of a credential.
*/
2168void
2169parsecred(char *namelist, struct xucred *cr)
2170{
gid_t groups[NGROUPS_MAX16 + 1];
char *name, *names;
struct passwd *pw;
struct group *gr;
int ngroups, cnt;

/*
* Set up the unprivileged user.
*/
*cr = def_anon;

/*
* Get the user's password table entry.
*/
names = strsep(&namelist, " \t\n");
name = strsep(&names, ":");
if (isdigit((unsigned char)*name) || *name == '-')
pw = getpwuid(atoi(name));
else
pw = getpwnam(name);
/*
* Credentials specified as those of a user.
*/
if (names == NULL((void *)0)) {
if (pw == NULL((void *)0)) {
	syslog(LOG_ERR3, "Unknown user: %s", name);
	return;
}
cr->cr_uid = pw->pw_uid;
ngroups = NGROUPS_MAX16 + 1;
if (getgrouplist(pw->pw_name, pw->pw_gid, groups, &ngroups))
	syslog(LOG_ERR3, "Too many groups for %s: %m", pw->pw_name);
/*
 * compress out duplicate
 */
cr->cr_ngroups = ngroups - 1;
cr->cr_gid = groups[0];
for (cnt = 1; cnt < ngroups; cnt++)
	cr->cr_groups[cnt - 1] = groups[cnt];
return;
}
/*
* Explicit credential specified as a colon separated list:
*	uid:gid:gid:...
*/
if (pw != NULL((void *)0))
cr->cr_uid = pw->pw_uid;
else if (isdigit((unsigned char)*name) || *name == '-')
cr->cr_uid = atoi(name);
else {
syslog(LOG_ERR3, "Unknown user: %s", name);
return;
}
cr->cr_ngroups = 0;
while (names != NULL((void *)0) && *names != '\0' && cr->cr_ngroups < NGROUPS_MAX16) {
name = strsep(&names, ":");
if (isdigit((unsigned char)*name) || *name == '-') {
	cr->cr_groups[cr->cr_ngroups++] = atoi(name);
} else {
	if ((gr = getgrnam(name)) == NULL((void *)0)) {
		syslog(LOG_ERR3, "Unknown group: %s", name);
		continue;
	}
	cr->cr_groups[cr->cr_ngroups++] = gr->gr_gid;
}
}
if (names != NULL((void *)0) && *names != '\0' && cr->cr_ngroups == NGROUPS_MAX16)
syslog(LOG_ERR3, "Too many groups");
2239}

2241#define	STRSIZ(255 +1024 +50)	(RPCMNT_NAMELEN255+RPCMNT_PATHLEN1024+50)
2242/*
* Routines that maintain the remote mounttab
*/
2245void
2246get_mountlist(void)
2247{
struct mountlist *mlp, **mlpp;
char *host, *dirp, *cp;
char str[STRSIZ(255 +1024 +50)];
FILE *mlfile;

if ((mlfile = fopen(_PATH_RMOUNTLIST"/var/db/mountdtab", "r")) == NULL((void *)0)) {
syslog(LOG_ERR3, "Can't open %s: %m", _PATH_RMOUNTLIST"/var/db/mountdtab");
return;
}
mlpp = &mlhead;
while (fgets(str, STRSIZ(255 +1024 +50), mlfile) != NULL((void *)0)) {
cp = str;
host = strsep(&cp, " \t\n");
dirp = strsep(&cp, " \t\n");
if (host == NULL((void *)0) || dirp == NULL((void *)0))
	continue;
mlp = malloc(sizeof (*mlp));
if (mlp == NULL((void *)0))
	out_of_mem();
strlcpy(mlp->ml_host, host, sizeof(mlp->ml_host));
strlcpy(mlp->ml_dirp, dirp, sizeof(mlp->ml_dirp));
mlp->ml_next = NULL((void *)0);
*mlpp = mlp;
mlpp = &mlp->ml_next;
}
fclose(mlfile);
2274}

2276void
2277del_mlist(char *hostp, char *dirp)
2278{
struct mountlist *mlp, **mlpp;
struct mountlist *mlp2;
int fnd = 0;

mlpp = &mlhead;
mlp = mlhead;
while (mlp) {
if (!strcmp(mlp->ml_host, hostp) &&
    (!dirp || !strcmp(mlp->ml_dirp, dirp))) {
	fnd = 1;
	mlp2 = mlp;
	*mlpp = mlp = mlp->ml_next;
	free((caddr_t)mlp2);
} else {
	mlpp = &mlp->ml_next;
	mlp = mlp->ml_next;
}
}
if (fnd) {
send_imsg(IMSG_MLIST_OPEN0x6, NULL((void *)0), 0);
mlp = mlhead;
while (mlp) {
	send_imsg(IMSG_MLIST_WRITE0x8, mlp, sizeof(*mlp));
	mlp = mlp->ml_next;
}
send_imsg(IMSG_MLIST_CLOSE0x7, NULL((void *)0), 0);
}
2306}

2308void
2309add_mlist(char *hostp, char *dirp)
2310{
struct mountlist *mlp, **mlpp;

mlpp = &mlhead;
mlp = mlhead;
while (mlp) {
if (!strcmp(mlp->ml_host, hostp) && !strcmp(mlp->ml_dirp, dirp))
	return;
mlpp = &mlp->ml_next;
mlp = mlp->ml_next;
}
mlp = malloc(sizeof (*mlp));
if (mlp == NULL((void *)0))
out_of_mem();
strlcpy(mlp->ml_host, hostp, sizeof(mlp->ml_host));
strlcpy(mlp->ml_dirp, dirp, sizeof(mlp->ml_dirp));
mlp->ml_next = NULL((void *)0);
*mlpp = mlp;
send_imsg(IMSG_MLIST_APPEND0x5, mlp, sizeof(*mlp));
2329}

2331/*
* This function is called via SIGTERM when the system is going down.
* It sends a broadcast RPCMNT_UMNTALL.
*/
2335void
2336send_umntall(int signo)
2337{
gotterm = 1;
2339}

2341int
2342umntall_each(caddr_t resultsp, struct sockaddr_in *raddr)
2343{
return (1);
2345}

2347/*
* Free up a group list.
*/
2350void
2351free_grp(struct grouplist *grp)
2352{
char **addrp;

if (grp->gr_type == GT_HOST0x1) {
if (grp->gr_ptr.gt_hostent->h_name) {
	addrp = grp->gr_ptr.gt_hostent->h_addr_list;
	while (addrp && *addrp)
		free(*addrp++);
	free((caddr_t)grp->gr_ptr.gt_hostent->h_addr_list);
	free(grp->gr_ptr.gt_hostent->h_name);
}
free((caddr_t)grp->gr_ptr.gt_hostent);
} else if (grp->gr_type == GT_NET0x2) {
free(grp->gr_ptr.gt_net.nt_name);
}
free((caddr_t)grp);
2368}

2370/*
* Check options for consistency.
*/
2373int
2374check_options(struct dirlist *dp)
2375{

if (dp == NULL((void *)0))
return (1);
if ((opt_flags & (OP_MAPROOT0x01 | OP_MAPALL0x02)) == (OP_MAPROOT0x01 | OP_MAPALL0x02)) {
syslog(LOG_ERR3, "-mapall and -maproot mutually exclusive");
return (1);
}
if ((opt_flags & OP_MASK0x08) && (opt_flags & OP_NET0x10) == 0) {
syslog(LOG_ERR3, "-mask requires -network");
return (1);
}
if ((opt_flags & OP_ALLDIRS0x40) && dp->dp_left) {
syslog(LOG_ERR3, "-alldirs has multiple directories");
return (1);
}
return (0);
2392}

2394/*
* Check an absolute directory path for any symbolic links. Return true
* if no symbolic links are found.
*/
2398int
2399check_dirpath(char *dirp)
2400{
struct stat sb;
int ret = 1;
char *cp;

/* Remove trailing '/' */
cp = dirp + strlen(dirp) - 1;
while (cp > dirp && *cp == '/')
*cp-- = '\0';

cp = dirp + 1;
while (*cp && ret) {
if (*cp == '/') {
	*cp = '\0';
	if (lstat(dirp, &sb) == -1 || !S_ISDIR(sb.st_mode)((sb.st_mode & 0170000) == 0040000))
		ret = 0;
	*cp = '/';
}
cp++;
}
if (lstat(dirp, &sb) == -1 ||
   (!S_ISDIR(sb.st_mode)((sb.st_mode & 0170000) == 0040000) && !S_ISREG(sb.st_mode)((sb.st_mode & 0170000) == 0100000)))
ret = 0;
return (ret);
2424}