/usr/src/usr.sbin/ypbind/ypbind.c

Bug Summary

File:	src/usr.sbin/ypbind/ypbind.c
Warning:	line 662, column 3 Address of stack memory associated with local variable 'dom' is still referred to by the global variable 'rmtca' upon returning to the caller. This will be a dangling reference
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name ypbind.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.sbin/ypbind/obj -resource-dir /usr/local/llvm16/lib/clang/16 -D DAEMON -D HEURISTIC -internal-isystem /usr/local/llvm16/lib/clang/16/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.sbin/ypbind/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fno-jump-tables -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c /usr/src/usr.sbin/ypbind/ypbind.c
1/*	$OpenBSD: ypbind.c,v 1.79 2023/11/27 18:37:53 tb Exp $ */

3/*
* Copyright (c) 1992, 1993, 1996, 1997, 1998 Theo de Raadt <deraadt@openbsd.org>
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
*    notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
*    notice, this list of conditions and the following disclaimer in the
*    documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS
* OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*/

29#include <sys/types.h>
30#include <sys/socket.h>
31#include <sys/stat.h>
32#include <sys/uio.h>
33#include <sys/syslog.h>

35#include <arpa/inet.h>
36#include <net/if.h>
37#include <rpc/rpc.h>
38#include <rpc/xdr.h>
39#include <rpc/pmap_clnt.h>
40#include <rpc/pmap_prot.h>
41#include <rpc/pmap_rmt.h>
42#include <rpcsvc/yp.h>
43#include <rpcsvc/ypclnt.h>

45#include <ctype.h>
46#include <dirent.h>
47#include <err.h>
48#include <errno(*__errno()).h>
49#include <fcntl.h>
50#include <ifaddrs.h>
51#include <limits.h>
52#include <netdb.h>
53#include <poll.h>
54#include <stdio.h>
55#include <stdlib.h>
56#include <string.h>
57#include <unistd.h>

59#define SERVERSDIR"/etc/yp"	"/etc/yp"
60#define BINDINGDIR"/var/yp/binding"	"/var/yp/binding"

62struct _dom_binding {
struct _dom_binding *dom_pnext;
char dom_domain[YPMAXDOMAIN64 + 1];
struct sockaddr_in dom_server_addr;
unsigned short int dom_server_port;
int dom_socket;
CLIENT *dom_client;
long dom_vers;
time_t dom_check_t;
time_t dom_ask_t;
int dom_lockfd;
int dom_alive;
u_int32_t dom_xid;
char dom_servlist[PATH_MAX1024];
FILE *dom_servlistfp;
77};

79void rpc_received(char *dom, struct sockaddr_in *raddrp, int force);
80void checkwork(void);
81enum clnt_stat handle_replies(void);
82enum clnt_stat handle_ping(void);
83int broadcast(struct _dom_binding *ypdb, char *, int);
84int direct(struct _dom_binding *ypdb, char *, int);
85int ping(struct _dom_binding *ypdb);
86int pings(struct _dom_binding *ypdb);

88char *domain;

90struct _dom_binding *ypbindlist;
91int check;

93#define YPSET_NO0	0
94#define YPSET_LOCAL1	1
95#define YPSET_ALL2	2
96int ypsetmode = YPSET_NO0;
97int insecure = 0;

99int rpcsock, pingsock;
100struct rmtcallargs rmtca;
101struct rmtcallres rmtcr;
102bool_tint32_t rmtcr_outval;
103u_long rmtcr_port;
104SVCXPRT *udptransp, *tcptransp;
105SVCXPRT *ludptransp, *ltcptransp;

107struct _dom_binding *xid2ypdb(u_int32_t xid);
108u_int32_t unique_xid(struct _dom_binding *ypdb);

110/*
* We name the local RPC functions ypbindproc_XXX_2x() instead
* of ypbindproc_XXX_2() because we need to pass an additional
* parameter. ypbindproc_setdom_2x() does a security check, and
* hence needs the CLIENT *
*
* We are faced with either making ypbindprog_2() do the security
* check before calling ypbindproc_setdom_2().. or we can simply
* declare sun's interface insufficient and roll our own.
*/

121static void *
122ypbindproc_null_2x(SVCXPRT *transp, void *argp, CLIENT *clnt)
123{
static char res;

memset(&res, 0, sizeof(res));
return (void *)&res;
128}

130static struct ypbind_resp *
131ypbindproc_domain_2x(SVCXPRT *transp, domainname *argp, CLIENT *clnt)
132{
static struct ypbind_resp res;
struct _dom_binding *ypdb;
char path[PATH_MAX1024];
time_t now;
int count = 0;

if (strchr((char *)argp, '/'))
return NULL((void *)0);

memset(&res, 0, sizeof(res));
res.ypbind_status = YPBIND_FAIL_VAL;

for (ypdb = ypbindlist; ypdb && count < 100; ypdb = ypdb->dom_pnext)
count++;
if (count >= 100)
return NULL((void *)0);	/* prevent DOS: sorry, you lose */

for (ypdb = ypbindlist; ypdb; ypdb = ypdb->dom_pnext)
if (!strcmp(ypdb->dom_domain, *argp))
	break;

if (ypdb == NULL((void *)0)) {
ypdb = malloc(sizeof *ypdb);
if (ypdb == NULL((void *)0))
	return NULL((void *)0);
memset(ypdb, 0, sizeof *ypdb);
strncpy(ypdb->dom_domain, *argp, sizeof ypdb->dom_domain-1);
ypdb->dom_domain[sizeof ypdb->dom_domain-1] = '\0';
ypdb->dom_vers = YPVERS((u_long)2);
ypdb->dom_alive = 0;
ypdb->dom_lockfd = -1;
snprintf(path, sizeof path, "%s/%s.%d", BINDINGDIR"/var/yp/binding",
    ypdb->dom_domain, (int)ypdb->dom_vers);
unlink(path);
snprintf(ypdb->dom_servlist, sizeof ypdb->dom_servlist,
    "%s/%s", SERVERSDIR"/etc/yp", ypdb->dom_domain);
ypdb->dom_servlistfp = fopen(ypdb->dom_servlist, "r");
ypdb->dom_xid = unique_xid(ypdb);
ypdb->dom_pnext = ypbindlist;
ypbindlist = ypdb;
check++;
return NULL((void *)0);
}

if (ypdb->dom_alive == 0)
return NULL((void *)0);

180#ifdef HEURISTIC1
time(&now);
if (now < ypdb->dom_ask_t + 5) {
/*
 * Hmm. More than 2 requests in 5 seconds have indicated
 * that my binding is possibly incorrect.
 * Ok, do an immediate poll of the server.
 */
if (ypdb->dom_check_t >= now) {
	/* don't flood it */
	ypdb->dom_check_t = 0;
	check++;
}
}
ypdb->dom_ask_t = now;
195#endif

res.ypbind_status = YPBIND_SUCC_VAL;
memmove(&res.ypbind_resp_u.ypbind_bindinfo.ypbind_binding_addr,
   &ypdb->dom_server_addr.sin_addr,
   sizeof(res.ypbind_resp_u.ypbind_bindinfo.ypbind_binding_addr));
memmove(&res.ypbind_resp_u.ypbind_bindinfo.ypbind_binding_port,
   &ypdb->dom_server_port,
   sizeof(res.ypbind_resp_u.ypbind_bindinfo.ypbind_binding_port));
204#ifdef DEBUG
printf("domain %s at %s/%d\n", ypdb->dom_domain,
   inet_ntoa(ypdb->dom_server_addr.sin_addr),
   ntohs(ypdb->dom_server_addr.sin_port)(__uint16_t)(__builtin_constant_p(ypdb->dom_server_addr.sin_port
) ? (__uint16_t)(((__uint16_t)(ypdb->dom_server_addr.sin_port
) & 0xffU) << 8 | ((__uint16_t)(ypdb->dom_server_addr
.sin_port) & 0xff00U) >> 8) : __swap16md(ypdb->dom_server_addr
.sin_port)));
208#endif
return &res;
210}

212static bool_tint32_t *
213ypbindproc_setdom_2x(SVCXPRT *transp, struct ypbind_setdom *argp, CLIENT *clnt)
214{
struct sockaddr_in *fromsin, bindsin;
static bool_tint32_t res = 1;

fromsin = svc_getcaller(transp)(&(transp)->xp_raddr);

switch (ypsetmode) {
case YPSET_LOCAL1:
if (transp != ludptransp && transp != ltcptransp) {
	syslog(LOG_WARNING4, "attempted spoof of ypsetme");
	svcerr_weakauth(transp);
	return NULL((void *)0);
}
if (fromsin->sin_addr.s_addr != htonl(INADDR_LOOPBACK)(__uint32_t)(__builtin_constant_p(((u_int32_t)(0x7f000001))) ?
 (__uint32_t)(((__uint32_t)(((u_int32_t)(0x7f000001))) & 0xff
) << 24 | ((__uint32_t)(((u_int32_t)(0x7f000001))) &
 0xff00) << 8 | ((__uint32_t)(((u_int32_t)(0x7f000001))
) & 0xff0000) >> 8 | ((__uint32_t)(((u_int32_t)(0x7f000001
))) & 0xff000000) >> 24) : __swap32md(((u_int32_t)(
0x7f000001))))) {
	svcerr_weakauth(transp);
	return NULL((void *)0);
}
break;
case YPSET_ALL2:
break;
case YPSET_NO0:
default:
svcerr_weakauth(transp);
return NULL((void *)0);
}

if (ntohs(fromsin->sin_port)(__uint16_t)(__builtin_constant_p(fromsin->sin_port) ? (__uint16_t
)(((__uint16_t)(fromsin->sin_port) & 0xffU) << 8
 | ((__uint16_t)(fromsin->sin_port) & 0xff00U) >>
 8) : __swap16md(fromsin->sin_port)) >= IPPORT_RESERVED1024) {
svcerr_weakauth(transp);
return NULL((void *)0);
}

if (argp->ypsetdom_vers != YPVERS((u_long)2)) {
svcerr_noprog(transp);
return NULL((void *)0);
}

memset(&bindsin, 0, sizeof bindsin);
bindsin.sin_family = AF_INET2;
bindsin.sin_len = sizeof(bindsin);
memcpy(&bindsin.sin_addr, &argp->ypsetdom_binding.ypbind_binding_addr,
   sizeof(argp->ypsetdom_binding.ypbind_binding_addr));
memcpy(&bindsin.sin_port, &argp->ypsetdom_binding.ypbind_binding_port,
   sizeof(argp->ypsetdom_binding.ypbind_binding_port));
rpc_received(argp->ypsetdom_domain, &bindsin, 1);

return &res;
260}

262static void
263ypbindprog_2(struct svc_req *rqstp, SVCXPRT *transp)
264{
union argument {
domainname ypbindproc_domain_2_arg;
struct ypbind_setdom ypbindproc_setdom_2_arg;
} argument;
struct authunix_parms *creds;
char *result;
xdrproc_t xdr_argument, xdr_result;
char *(*local)(SVCXPRT *, union argument *, struct svc_req *);

switch (rqstp->rq_proc) {
case YPBINDPROC_NULL((u_long)0):
xdr_argument = xdr_void;
xdr_result = xdr_void;
local = (char *(*)(SVCXPRT *, union argument *, struct svc_req *))
    ypbindproc_null_2x;
break;

case YPBINDPROC_DOMAIN((u_long)1):
xdr_argument = xdr_domainname;
xdr_result = xdr_ypbind_resp;
local = (char *(*)(SVCXPRT *, union argument *, struct svc_req *))
    ypbindproc_domain_2x;
break;

case YPBINDPROC_SETDOM((u_long)2):
switch (rqstp->rq_cred.oa_flavor) {
case AUTH_UNIX1:
	creds = (struct authunix_parms *)rqstp->rq_clntcred;
	if (creds->aup_uid != 0) {
		svcerr_auth(transp, AUTH_BADCRED);
		return;
	}
	break;
default:
	svcerr_auth(transp, AUTH_TOOWEAK);
	return;
}

xdr_argument = xdr_ypbind_setdom;
xdr_result = xdr_void;
local = (char *(*)(SVCXPRT *, union argument *, struct svc_req *))
    ypbindproc_setdom_2x;
break;

default:
svcerr_noproc(transp);
return;
}
memset(&argument, 0, sizeof(argument));
if (!svc_getargs(transp, xdr_argument, (caddr_t)&argument)(*(transp)->xp_ops->xp_getargs)((transp), (xdr_argument
), ((caddr_t)&argument))) {
svcerr_decode(transp);
return;
}
result = (*local)(transp, &argument, rqstp);
if (result != NULL((void *)0) && !svc_sendreply(transp, xdr_result, result)) {
svcerr_systemerr(transp);
}
return;
323}

325static void
326usage(void)
327{
fprintf(stderr(&__sF[2]), "usage: ypbind [-insecure] [-ypset] [-ypsetme]\n");
exit(1);
330}

332int
333main(int argc, char *argv[])
334{
char path[PATH_MAX1024];
struct sockaddr_in sin;
struct pollfd *pfd = NULL((void *)0);
int width = 0, nready, lsock;
socklen_t len;
int evil = 0, one = 1;
DIR *dirp;
struct dirent *dent;

if (yp_get_default_domain(&domain) != 0 || domain[0] == '\0') {
1
Assuming the condition is false→
2
←
Assuming the condition is false→
3
←
Taking false branch→
fprintf(stderr(&__sF[2]), "domainname not set. Aborting.\n");
exit(1);
}

while (--argc) {
4
←
Loop condition is false. Execution continues on line 362→
++argv;
if (!strcmp("-insecure", *argv))
	insecure = 1;
else if (!strcmp("-ypset", *argv))
	ypsetmode = YPSET_ALL2;
else if (!strcmp("-ypsetme", *argv))
	ypsetmode = YPSET_LOCAL1;
else
	usage();
}

/* blow away everything in BINDINGDIR */
dirp = opendir(BINDINGDIR"/var/yp/binding");
if (dirp) {
5
←
Assuming 'dirp' is null→
6
←
Taking false branch→
while ((dent = readdir(dirp))) {
	if (!strcmp(dent->d_name, ".") ||
	    !strcmp(dent->d_name, ".."))
		continue;
	(void)unlinkat(dirfd(dirp), dent->d_name, 0);
}
closedir(dirp);
} else {
(void)mkdir(BINDINGDIR"/var/yp/binding", 0755);
}

(void)pmap_unset(YPBINDPROG((u_long)100007), YPBINDVERS((u_long)2));

udptransp = svcudp_create(RPC_ANYSOCK-1);
if (udptransp == NULL((void *)0)) {
7
←
Assuming 'udptransp' is not equal to NULL→
8
←
Taking false branch→
fprintf(stderr(&__sF[2]), "cannot create udp service.\n");
exit(1);
}
if (!svc_register(udptransp, YPBINDPROG((u_long)100007), YPBINDVERS((u_long)2), ypbindprog_2,
9
←
Assuming the condition is false→
10
←
Taking false branch→
   IPPROTO_UDP17)) {
fprintf(stderr(&__sF[2]),
    "unable to register (YPBINDPROG, YPBINDVERS, udp).\n");
exit(1);
}

tcptransp = svctcp_create(RPC_ANYSOCK-1, 0, 0);
if (tcptransp == NULL((void *)0)) {
11
←
Assuming 'tcptransp' is not equal to NULL→
12
←
Taking false branch→
fprintf(stderr(&__sF[2]), "cannot create tcp service.\n");
exit(1);
}
if (!svc_register(tcptransp, YPBINDPROG((u_long)100007), YPBINDVERS((u_long)2), ypbindprog_2,
13
←
Assuming the condition is false→
14
←
Taking false branch→
   IPPROTO_TCP6)) {
fprintf(stderr(&__sF[2]),
    "unable to register (YPBINDPROG, YPBINDVERS, tcp).\n");
exit(1);
}

if (ypsetmode14.1
'ypsetmode' is not equal to YPSET_LOCAL
 == YPSET_LOCAL1) {
15
←
Taking false branch→
/* build UDP local port */
if ((lsock = socket(AF_INET2, SOCK_DGRAM2, IPPROTO_UDP17)) == -1) {
	syslog(LOG_ERR3, "cannot create local udp socket: %m");
	exit(1);
}
(void)setsockopt(lsock, SOL_SOCKET0xffff, SO_REUSEADDR0x0004, &one,
    (socklen_t)sizeof one);
len = sizeof(sin);
if (getsockname(udptransp->xp_sock, (struct sockaddr *)&sin,
    &len) == -1) {
	syslog(LOG_ERR3, "cannot getsockname local udp: %m");
	exit(1);
}
sin.sin_addr.s_addr = htonl(INADDR_LOOPBACK)(__uint32_t)(__builtin_constant_p(((u_int32_t)(0x7f000001))) ?
 (__uint32_t)(((__uint32_t)(((u_int32_t)(0x7f000001))) & 0xff
) << 24 | ((__uint32_t)(((u_int32_t)(0x7f000001))) &
 0xff00) << 8 | ((__uint32_t)(((u_int32_t)(0x7f000001))
) & 0xff0000) >> 8 | ((__uint32_t)(((u_int32_t)(0x7f000001
))) & 0xff000000) >> 24) : __swap32md(((u_int32_t)(
0x7f000001))));
sin.sin_port = htons(udptransp->xp_port)(__uint16_t)(__builtin_constant_p(udptransp->xp_port) ? (__uint16_t
)(((__uint16_t)(udptransp->xp_port) & 0xffU) << 8
 | ((__uint16_t)(udptransp->xp_port) & 0xff00U) >>
 8) : __swap16md(udptransp->xp_port));
if (bind(lsock, (struct sockaddr *)&sin, len) != 0) {
	syslog(LOG_ERR3, "cannot bind local udp: %m");
	exit(1);
}
if ((ludptransp = svcudp_create(lsock)) == NULL((void *)0)) {
	fprintf(stderr(&__sF[2]), "cannot create udp service.\n");
	exit(1);
}

/* build TCP local port */
if ((lsock = socket(AF_INET2, SOCK_STREAM1, IPPROTO_TCP6)) == -1) {
	syslog(LOG_ERR3, "cannot create udp socket: %m");
	exit(1);
}
(void)setsockopt(lsock, SOL_SOCKET0xffff, SO_REUSEADDR0x0004, &one,
    (socklen_t)sizeof one);
len = sizeof(sin);
if (getsockname(tcptransp->xp_sock, (struct sockaddr *)&sin,
    &len) == -1) {
	syslog(LOG_ERR3, "cannot getsockname udp: %m");
	exit(1);
}
sin.sin_addr.s_addr = htonl(INADDR_LOOPBACK)(__uint32_t)(__builtin_constant_p(((u_int32_t)(0x7f000001))) ?
 (__uint32_t)(((__uint32_t)(((u_int32_t)(0x7f000001))) & 0xff
) << 24 | ((__uint32_t)(((u_int32_t)(0x7f000001))) &
 0xff00) << 8 | ((__uint32_t)(((u_int32_t)(0x7f000001))
) & 0xff0000) >> 8 | ((__uint32_t)(((u_int32_t)(0x7f000001
))) & 0xff000000) >> 24) : __swap32md(((u_int32_t)(
0x7f000001))));
sin.sin_port = htons(tcptransp->xp_port)(__uint16_t)(__builtin_constant_p(tcptransp->xp_port) ? (__uint16_t
)(((__uint16_t)(tcptransp->xp_port) & 0xffU) << 8
 | ((__uint16_t)(tcptransp->xp_port) & 0xff00U) >>
 8) : __swap16md(tcptransp->xp_port));
if (bind(lsock, (struct sockaddr *)&sin, len) == -1) {
	syslog(LOG_ERR3, "cannot bind local tcp: %m");
	exit(1);
}
if ((ltcptransp = svctcp_create(lsock, 0, 0)) == NULL((void *)0)) {
	fprintf(stderr(&__sF[2]), "cannot create tcp service.\n");
	exit(1);
}
}

if ((rpcsock = socket(AF_INET2, SOCK_DGRAM2 | SOCK_NONBLOCK0x4000, 0)) == -1) {
16
←
Assuming the condition is false→
17
←
Taking false branch→
perror("socket");
return -1;
}
memset(&sin, 0, sizeof sin);
sin.sin_family = AF_INET2;
sin.sin_addr.s_addr = htonl(INADDR_ANY)(__uint32_t)(__builtin_constant_p(((u_int32_t)(0x00000000))) ?
 (__uint32_t)(((__uint32_t)(((u_int32_t)(0x00000000))) & 0xff
) << 24 | ((__uint32_t)(((u_int32_t)(0x00000000))) &
 0xff00) << 8 | ((__uint32_t)(((u_int32_t)(0x00000000))
) & 0xff0000) >> 8 | ((__uint32_t)(((u_int32_t)(0x00000000
))) & 0xff000000) >> 24) : __swap32md(((u_int32_t)(
0x00000000))));
18
←
'?' condition is true→
sin.sin_port = 0;
bindresvport(rpcsock, &sin);

if ((pingsock = socket(AF_INET2, SOCK_DGRAM2 | SOCK_NONBLOCK0x4000, 0)) == -1) {
19
←
Assuming the condition is false→
20
←
Taking false branch→
perror("socket");
return -1;
}
memset(&sin, 0, sizeof sin);
sin.sin_family = AF_INET2;
sin.sin_addr.s_addr = htonl(INADDR_ANY)(__uint32_t)(__builtin_constant_p(((u_int32_t)(0x00000000))) ?
 (__uint32_t)(((__uint32_t)(((u_int32_t)(0x00000000))) & 0xff
) << 24 | ((__uint32_t)(((u_int32_t)(0x00000000))) &
 0xff00) << 8 | ((__uint32_t)(((u_int32_t)(0x00000000))
) & 0xff0000) >> 8 | ((__uint32_t)(((u_int32_t)(0x00000000
))) & 0xff000000) >> 24) : __swap32md(((u_int32_t)(
0x00000000))));
21
←
'?' condition is true→
sin.sin_port = 0;
bindresvport(pingsock, &sin);

setsockopt(rpcsock, SOL_SOCKET0xffff, SO_BROADCAST0x0020, &one,
   (socklen_t)sizeof(one));
rmtca.prog = YPPROG((u_long)100004);
rmtca.vers = YPVERS((u_long)2);
rmtca.proc = YPPROC_DOMAIN_NONACK((u_long)2);
rmtca.xdr_args = NULL((void *)0);		/* set at call time */
rmtca.args_ptr = NULL((void *)0);		/* set at call time */
rmtcr.port_ptr = &rmtcr_port;
rmtcr.xdr_results = xdr_bool;
rmtcr.results_ptr = (caddr_t)&rmtcr_outval;

if (strchr(domain, '/'))
22
←
Assuming the condition is false→
23
←
Taking false branch→
errx(1, "bad domainname %s", domain);

/* build initial domain binding, make it "unsuccessful" */
ypbindlist = malloc(sizeof *ypbindlist);
if (ypbindlist == NULL((void *)0))
24
←
Assuming 'ypbindlist' is not equal to NULL→
25
←
Taking false branch→
errx(1, "no memory");
memset(ypbindlist, 0, sizeof *ypbindlist);
strncpy(ypbindlist->dom_domain, domain, sizeof ypbindlist->dom_domain-1);
ypbindlist->dom_domain[sizeof (ypbindlist->dom_domain)-1] = '\0';
ypbindlist->dom_vers = YPVERS((u_long)2);
snprintf(ypbindlist->dom_servlist, sizeof ypbindlist->dom_servlist,
   "%s/%s", SERVERSDIR"/etc/yp", ypbindlist->dom_domain);
ypbindlist->dom_servlistfp = fopen(ypbindlist->dom_servlist, "r");
ypbindlist->dom_alive = 0;
ypbindlist->dom_lockfd = -1;
ypbindlist->dom_xid = unique_xid(ypbindlist);
snprintf(path, sizeof path, "%s/%s.%d", BINDINGDIR"/var/yp/binding",
   ypbindlist->dom_domain, (int)ypbindlist->dom_vers);
(void)unlink(path);

checkwork();
26
←
Calling 'checkwork'→

while (1) {
if (pfd == NULL((void *)0) || width != svc_max_pollfd + 2) {
	width = svc_max_pollfd + 2;
	pfd = reallocarray(pfd, width, sizeof *pfd);
	if (pfd == NULL((void *)0))
		err(1, NULL((void *)0));
}

pfd[0].fd = rpcsock;
pfd[0].events = POLLIN0x0001;
pfd[1].fd = pingsock;
pfd[1].events = POLLIN0x0001;
memcpy(pfd + 2, svc_pollfd, sizeof(*pfd) * svc_max_pollfd);

nready = poll(pfd, width, 1000);
switch (nready) {
case 0:
	checkwork();
	break;
case -1:
	if (errno(*__errno()) != EINTR4)
		perror("poll");
	break;
default:
	/* No need to check for POLLHUP on UDP sockets. */
	if (pfd[0].revents & POLLIN0x0001) {
		handle_replies();
		nready--;
	}
	if (pfd[1].revents & POLLIN0x0001) {
		handle_ping();
		nready--;
	}
	svc_getreq_poll(pfd + 2, nready);
	if (check)
		checkwork();
	break;
}

544#ifdef DAEMON1
if (!evil && ypbindlist->dom_alive) {
	evil = 1;
	daemon(0, 0);
}
549#endif
}
551}

553/*
* State transition is done like this:
*
* STATE	EVENT		ACTION			NEWSTATE	TIMEOUT
* no binding	timeout		broadcast		no binding	5 sec
* no binding	answer		--			binding		60 sec
* binding	timeout		ping server		checking	5 sec
* checking	timeout		ping server + broadcast	checking	5 sec
* checking	answer		--			binding		60 sec
*/
563void
564checkwork(void)
565{
struct _dom_binding *ypdb;
time_t t;

time(&t);
for (ypdb = ypbindlist; ypdb; ypdb = ypdb->dom_pnext) {
27
←
Loop condition is true.  Entering loop body→
if (ypdb->dom_check_t < t) {
28
←
Assuming 't' is > field 'dom_check_t'→
29
←
Taking true branch→
	if (ypdb->dom_alive == 1)
30
←
Assuming field 'dom_alive' is not equal to 1→
31
←
Taking false branch→
		ping(ypdb);
	else
		pings(ypdb);
32
←
Calling 'pings'→
	time(&t);
	ypdb->dom_check_t = t + 5;
}
}
check = 0;
581}

583int
584ping(struct _dom_binding *ypdb)
585{
domainname dom = ypdb->dom_domain;
struct rpc_msg msg;
char buf[1400];
enum clnt_stat st;
int outlen;
AUTH *rpcua;
XDR xdr;

memset(&xdr, 0, sizeof xdr);
memset(&msg, 0, sizeof msg);

rpcua = authunix_create_default();
if (rpcua == (AUTH *)NULL((void *)0)) {
/*printf("cannot get unix auth\n");*/
return RPC_SYSTEMERROR;
}
msg.rm_direction = CALL;
msg.rm_callru.RM_cmb.cb_rpcvers = RPC_MSG_VERSION((unsigned long) 2);
msg.rm_callru.RM_cmb.cb_prog = YPPROG((u_long)100004);
msg.rm_callru.RM_cmb.cb_vers = YPVERS((u_long)2);
msg.rm_callru.RM_cmb.cb_proc = YPPROC_DOMAIN_NONACK((u_long)2);
msg.rm_callru.RM_cmb.cb_cred = rpcua->ah_cred;
msg.rm_callru.RM_cmb.cb_verf = rpcua->ah_verf;

msg.rm_xid = ypdb->dom_xid;
xdrmem_create(&xdr, buf, sizeof buf, XDR_ENCODE);
if (!xdr_callmsg(&xdr, &msg)) {
st = RPC_CANTENCODEARGS;
AUTH_DESTROY(rpcua)((*((rpcua)->ah_ops->ah_destroy))(rpcua));
return st;
}
if (!xdr_domainname(&xdr, &dom)) {
st = RPC_CANTENCODEARGS;
AUTH_DESTROY(rpcua)((*((rpcua)->ah_ops->ah_destroy))(rpcua));
return st;
}
outlen = (int)xdr_getpos(&xdr)(*(&xdr)->x_ops->x_getpostn)(&xdr);
xdr_destroy(&xdr)if ((&xdr)->x_ops->x_destroy) (*(&xdr)->x_ops
->x_destroy)(&xdr);
if (outlen < 1) {
st = RPC_CANTENCODEARGS;
AUTH_DESTROY(rpcua)((*((rpcua)->ah_ops->ah_destroy))(rpcua));
return st;
}
AUTH_DESTROY(rpcua)((*((rpcua)->ah_ops->ah_destroy))(rpcua));

ypdb->dom_alive = 2;
if (sendto(pingsock, buf, outlen, 0,
   (struct sockaddr *)&ypdb->dom_server_addr,
   (socklen_t)sizeof ypdb->dom_server_addr) == -1)
perror("sendto");
return 0;

638}

640int
641pings(struct _dom_binding *ypdb)
642{
domainname dom = ypdb->dom_domain;
struct rpc_msg msg;
struct sockaddr_in bindsin;
char buf[1400];
char path[PATH_MAX1024];
enum clnt_stat st;
int outlen;
AUTH *rpcua;
XDR xdr;

rmtca.xdr_args = xdr_domainname;
rmtca.args_ptr = (char *)&dom;

memset(&xdr, 0, sizeof xdr);
memset(&msg, 0, sizeof msg);

rpcua = authunix_create_default();
if (rpcua == (AUTH *)NULL((void *)0)) {
33
←
Assuming 'rpcua' is equal to null→
34
←
Taking true branch→
/*printf("cannot get unix auth\n");*/
return RPC_SYSTEMERROR;
35
←
Address of stack memory associated with local variable 'dom' is still referred to by the global variable 'rmtca' upon returning to the caller.  This will be a dangling reference
}
msg.rm_direction = CALL;
msg.rm_callru.RM_cmb.cb_rpcvers = RPC_MSG_VERSION((unsigned long) 2);
msg.rm_callru.RM_cmb.cb_prog = PMAPPROG((unsigned long)100000);
msg.rm_callru.RM_cmb.cb_vers = PMAPVERS((unsigned long)2);
msg.rm_callru.RM_cmb.cb_proc = PMAPPROC_CALLIT((unsigned long)5);
msg.rm_callru.RM_cmb.cb_cred = rpcua->ah_cred;
msg.rm_callru.RM_cmb.cb_verf = rpcua->ah_verf;

msg.rm_xid = ypdb->dom_xid;
xdrmem_create(&xdr, buf, sizeof buf, XDR_ENCODE);
if (!xdr_callmsg(&xdr, &msg)) {
st = RPC_CANTENCODEARGS;
AUTH_DESTROY(rpcua)((*((rpcua)->ah_ops->ah_destroy))(rpcua));
return st;
}
if (!xdr_rmtcall_args(&xdr, &rmtca)) {
st = RPC_CANTENCODEARGS;
AUTH_DESTROY(rpcua)((*((rpcua)->ah_ops->ah_destroy))(rpcua));
return st;
}
outlen = (int)xdr_getpos(&xdr)(*(&xdr)->x_ops->x_getpostn)(&xdr);
xdr_destroy(&xdr)if ((&xdr)->x_ops->x_destroy) (*(&xdr)->x_ops
->x_destroy)(&xdr);
if (outlen < 1) {
st = RPC_CANTENCODEARGS;
AUTH_DESTROY(rpcua)((*((rpcua)->ah_ops->ah_destroy))(rpcua));
return st;
}
AUTH_DESTROY(rpcua)((*((rpcua)->ah_ops->ah_destroy))(rpcua));

if (ypdb->dom_lockfd != -1) {
close(ypdb->dom_lockfd);
ypdb->dom_lockfd = -1;
snprintf(path, sizeof path, "%s/%s.%d", BINDINGDIR"/var/yp/binding",
    ypdb->dom_domain, (int)ypdb->dom_vers);
unlink(path);
}

if (ypdb->dom_alive == 2) {
/*
 * This resolves the following situation:
 * ypserver on other subnet was once bound,
 * but rebooted and is now using a different port
 */
memset(&bindsin, 0, sizeof bindsin);
bindsin.sin_family = AF_INET2;
bindsin.sin_len = sizeof(bindsin);
bindsin.sin_port = htons(PMAPPORT)(__uint16_t)(__builtin_constant_p(((unsigned short)111)) ? (__uint16_t
)(((__uint16_t)(((unsigned short)111)) & 0xffU) << 8
 | ((__uint16_t)(((unsigned short)111)) & 0xff00U) >>
 8) : __swap16md(((unsigned short)111)));
bindsin.sin_addr = ypdb->dom_server_addr.sin_addr;
if (sendto(rpcsock, buf, outlen, 0, (struct sockaddr *)&bindsin,
    (socklen_t)sizeof bindsin) == -1)
	perror("sendto");
}
if (ypdb->dom_servlistfp)
return direct(ypdb, buf, outlen);
return broadcast(ypdb, buf, outlen);
719}

721int
722broadcast(struct _dom_binding *ypdb, char *buf, int outlen)
723{
struct ifaddrs *ifap, *ifa;
struct sockaddr_in bindsin;
struct in_addr in;

memset(&bindsin, 0, sizeof bindsin);
bindsin.sin_family = AF_INET2;
bindsin.sin_len = sizeof(bindsin);
bindsin.sin_port = htons(PMAPPORT)(__uint16_t)(__builtin_constant_p(((unsigned short)111)) ? (__uint16_t
)(((__uint16_t)(((unsigned short)111)) & 0xffU) << 8
 | ((__uint16_t)(((unsigned short)111)) & 0xff00U) >>
 8) : __swap16md(((unsigned short)111)));

if (getifaddrs(&ifap) != 0) {
perror("getifaddrs");
return -1;
}
for (ifa = ifap; ifa; ifa = ifa->ifa_next) {
if (ifa->ifa_addr == NULL((void *)0) ||
    ifa->ifa_addr->sa_family != AF_INET2)
	continue;
if ((ifa->ifa_flags & IFF_UP0x1) == 0)
	continue;

switch (ifa->ifa_flags & (IFF_LOOPBACK0x8 | IFF_BROADCAST0x2)) {
case IFF_BROADCAST0x2:
	if (!ifa->ifa_broadaddrifa_dstaddr)
		continue;
	if (ifa->ifa_broadaddrifa_dstaddr->sa_family != AF_INET2)
		continue;
	in = ((struct sockaddr_in *)ifa->ifa_broadaddrifa_dstaddr)->sin_addr;
	break;
case IFF_LOOPBACK0x8:
	in = ((struct sockaddr_in *)ifa->ifa_addr)->sin_addr;
	break;
default:
	continue;
}

bindsin.sin_addr = in;
if (sendto(rpcsock, buf, outlen, 0, (struct sockaddr *)&bindsin,
    (socklen_t)bindsin.sin_len) == -1)
	perror("sendto");
}
freeifaddrs(ifap);
return 0;
766}

768int
769direct(struct _dom_binding *ypdb, char *buf, int outlen)
770{
char line[1024], *p;
struct hostent *hp;
struct sockaddr_in bindsin;
int i, c;
struct stat fst, st;

if (fstat(fileno(ypdb->dom_servlistfp)(!__isthreaded ? ((ypdb->dom_servlistfp)->_file) : (fileno
)(ypdb->dom_servlistfp)), &fst) != -1 &&
   stat(ypdb->dom_servlist, &st) != -1 &&
   (st.st_dev != fst.st_dev || st.st_ino != fst.st_ino)) {
FILE *fp;

fp = fopen(ypdb->dom_servlist, "r");
if (fp) {
	fclose(ypdb->dom_servlistfp);
	ypdb->dom_servlistfp = fp;
}
}
(void) rewind(ypdb->dom_servlistfp);

memset(&bindsin, 0, sizeof bindsin);
bindsin.sin_family = AF_INET2;
bindsin.sin_len = sizeof(bindsin);
bindsin.sin_port = htons(PMAPPORT)(__uint16_t)(__builtin_constant_p(((unsigned short)111)) ? (__uint16_t
)(((__uint16_t)(((unsigned short)111)) & 0xffU) << 8
 | ((__uint16_t)(((unsigned short)111)) & 0xff00U) >>
 8) : __swap16md(((unsigned short)111)));

while (fgets(line, sizeof(line), ypdb->dom_servlistfp) != NULL((void *)0)) {
/* skip lines that are too big */
p = strchr(line, '\n');
if (p == NULL((void *)0)) {
	while ((c = getc(ypdb->dom_servlistfp)(!__isthreaded ? (--(ypdb->dom_servlistfp)->_r < 0 ?
 __srget(ypdb->dom_servlistfp) : (int)(*(ypdb->dom_servlistfp
)->_p++)) : (getc)(ypdb->dom_servlistfp))) != '\n' && c != EOF(-1))
		;
	continue;
}
*p = '\0';
p = line;
while (isspace((unsigned char)*p))
	p++;
if (*p == '#')
	continue;
hp = gethostbyname(p);
if (!hp)
	continue;
/* step through all addresses in case first is unavailable */
for (i = 0; hp->h_addr_list[i]; i++) {
	memmove(&bindsin.sin_addr, hp->h_addr_list[0],
	    hp->h_length);
	if (sendto(rpcsock, buf, outlen, 0,
	    (struct sockaddr *)&bindsin,
	    (socklen_t)sizeof bindsin) == -1) {
		perror("sendto");
		continue;
	}
}
}
return 0;
825}

827enum clnt_stat
828handle_replies(void)
829{
char buf[1400];
int inlen;
socklen_t fromlen;
struct _dom_binding *ypdb;
struct sockaddr_in raddr;
struct rpc_msg msg;
XDR xdr;

838recv_again:
memset(&xdr, 0, sizeof(xdr));
memset(&msg, 0, sizeof(msg));
msg.acpted_rplyru.RM_rmb.ru.RP_ar.ar_verf = _null_auth;
msg.acpted_rplyru.RM_rmb.ru.RP_ar.ar_resultsru.AR_results.where = (caddr_t)&rmtcr;
msg.acpted_rplyru.RM_rmb.ru.RP_ar.ar_resultsru.AR_results.proc = xdr_rmtcallres;

845try_again:
fromlen = sizeof (struct sockaddr);
inlen = recvfrom(rpcsock, buf, sizeof buf, 0,
   (struct sockaddr *)&raddr, &fromlen);
if (inlen == -1) {
if (errno(*__errno()) == EINTR4)
	goto try_again;
return RPC_CANTRECV;
}
if (inlen < sizeof(u_int32_t))
goto recv_again;

/*
* see if reply transaction id matches sent id.
* If so, decode the results.
*/
xdrmem_create(&xdr, buf, (u_int)inlen, XDR_DECODE);
if (xdr_replymsg(&xdr, &msg)) {
if ((msg.rm_replyru.RM_rmb.rp_stat == MSG_ACCEPTED) &&
    (msg.acpted_rplyru.RM_rmb.ru.RP_ar.ar_stat == SUCCESS)) {
	raddr.sin_port = htons((u_short)rmtcr_port)(__uint16_t)(__builtin_constant_p((u_short)rmtcr_port) ? (__uint16_t
)(((__uint16_t)((u_short)rmtcr_port) & 0xffU) << 8 |
 ((__uint16_t)((u_short)rmtcr_port) & 0xff00U) >> 8
) : __swap16md((u_short)rmtcr_port));
	ypdb = xid2ypdb(msg.rm_xid);
	if (ypdb)
		rpc_received(ypdb->dom_domain, &raddr, 0);
}
}
xdr.x_op = XDR_FREE;
msg.acpted_rplyru.RM_rmb.ru.RP_ar.ar_resultsru.AR_results.proc = xdr_void;
xdr_destroy(&xdr)if ((&xdr)->x_ops->x_destroy) (*(&xdr)->x_ops
->x_destroy)(&xdr);

return RPC_SUCCESS;
876}

878enum clnt_stat
879handle_ping(void)
880{
char buf[1400];
int inlen;
socklen_t fromlen;
struct _dom_binding *ypdb;
struct sockaddr_in raddr;
struct rpc_msg msg;
XDR xdr;
bool_tint32_t res;

890recv_again:
memset(&xdr, 0, sizeof(xdr));
memset(&msg, 0, sizeof(msg));
msg.acpted_rplyru.RM_rmb.ru.RP_ar.ar_verf = _null_auth;
msg.acpted_rplyru.RM_rmb.ru.RP_ar.ar_resultsru.AR_results.where = (caddr_t)&res;
msg.acpted_rplyru.RM_rmb.ru.RP_ar.ar_resultsru.AR_results.proc = xdr_bool;

897try_again:
fromlen = sizeof (struct sockaddr);
inlen = recvfrom(pingsock, buf, sizeof buf, 0,
   (struct sockaddr *)&raddr, &fromlen);
if (inlen == -1) {
if (errno(*__errno()) == EINTR4)
	goto try_again;
return RPC_CANTRECV;
}
if (inlen < sizeof(u_int32_t))
goto recv_again;

/*
* see if reply transaction id matches sent id.
* If so, decode the results.
*/
xdrmem_create(&xdr, buf, (u_int)inlen, XDR_DECODE);
if (xdr_replymsg(&xdr, &msg)) {
if ((msg.rm_replyru.RM_rmb.rp_stat == MSG_ACCEPTED) &&
    (msg.acpted_rplyru.RM_rmb.ru.RP_ar.ar_stat == SUCCESS)) {
	ypdb = xid2ypdb(msg.rm_xid);
	if (ypdb)
		rpc_received(ypdb->dom_domain, &raddr, 0);
}
}
xdr.x_op = XDR_FREE;
msg.acpted_rplyru.RM_rmb.ru.RP_ar.ar_resultsru.AR_results.proc = xdr_void;
xdr_destroy(&xdr)if ((&xdr)->x_ops->x_destroy) (*(&xdr)->x_ops
->x_destroy)(&xdr);

return RPC_SUCCESS;
927}

929/*
* We prefer loopback connections.
*/
932void
933rpc_received(char *dom, struct sockaddr_in *raddrp, int force)
934{
struct _dom_binding *ypdb;
struct iovec iov[3];
struct ypbind_resp ybr;
char path[PATH_MAX1024];
u_short ypserv_tcp, ypserv_udp;
int fd;

if (strchr(dom, '/'))
return;

945#ifdef DEBUG
printf("returned from %s about %s\n", inet_ntoa(raddrp->sin_addr), dom);
947#endif

if (dom == NULL((void *)0))
return;

for (ypdb = ypbindlist; ypdb; ypdb = ypdb->dom_pnext)
if (!strcmp(ypdb->dom_domain, dom))
	break;

if (ypdb == NULL((void *)0)) {
if (force == 0)
	return;
ypdb = malloc(sizeof *ypdb);
if (ypdb == NULL((void *)0))
	return;
memset(ypdb, 0, sizeof *ypdb);
strncpy(ypdb->dom_domain, dom, sizeof ypdb->dom_domain-1);
ypdb->dom_domain[sizeof (ypdb->dom_domain)-1] = '\0';
ypdb->dom_lockfd = -1;
ypdb->dom_xid = unique_xid(ypdb);
ypdb->dom_pnext = ypbindlist;
ypbindlist = ypdb;
}

/* we do not support sunos 3.0 insecure servers */
if (insecure == 0 && ntohs(raddrp->sin_port)(__uint16_t)(__builtin_constant_p(raddrp->sin_port) ? (__uint16_t
)(((__uint16_t)(raddrp->sin_port) & 0xffU) << 8 |
 ((__uint16_t)(raddrp->sin_port) & 0xff00U) >> 8
) : __swap16md(raddrp->sin_port)) >= IPPORT_RESERVED1024)
return;

/* soft update, alive */
if (ypdb->dom_alive == 1 && force == 0) {
if (!memcmp(&ypdb->dom_server_addr, raddrp,
    sizeof ypdb->dom_server_addr)) {
	ypdb->dom_alive = 1;
	/* recheck binding in 60 sec */
	ypdb->dom_check_t = time(NULL((void *)0)) + 60;
}
if (raddrp->sin_addr.s_addr == htonl(INADDR_LOOPBACK)(__uint32_t)(__builtin_constant_p(((u_int32_t)(0x7f000001))) ?
 (__uint32_t)(((__uint32_t)(((u_int32_t)(0x7f000001))) & 0xff
) << 24 | ((__uint32_t)(((u_int32_t)(0x7f000001))) &
 0xff00) << 8 | ((__uint32_t)(((u_int32_t)(0x7f000001))
) & 0xff0000) >> 8 | ((__uint32_t)(((u_int32_t)(0x7f000001
))) & 0xff000000) >> 24) : __swap32md(((u_int32_t)(
0x7f000001))))) {
	/*
	 * we are alive and already have a binding, but
	 * after a broadcast we prefer the localhost
	 */
	memcpy(&ypdb->dom_server_addr, raddrp,
	    sizeof ypdb->dom_server_addr);
}
return;
}

/* synchronously ask for the matching ypserv TCP port number */
ypserv_udp = raddrp->sin_port;
ypserv_tcp = pmap_getport(raddrp, YPPROG((u_long)100004),
   YPVERS((u_long)2), IPPROTO_TCP6);
if (ypserv_tcp == 0) {
clnt_pcreateerror("pmap_getport");
return;
}
if (ypserv_tcp >= IPPORT_RESERVED1024 || ypserv_tcp == 20)
return;
ypserv_tcp = htons(ypserv_tcp)(__uint16_t)(__builtin_constant_p(ypserv_tcp) ? (__uint16_t)(
((__uint16_t)(ypserv_tcp) & 0xffU) << 8 | ((__uint16_t
)(ypserv_tcp) & 0xff00U) >> 8) : __swap16md(ypserv_tcp
));

memcpy(&ypdb->dom_server_addr, raddrp, sizeof ypdb->dom_server_addr);
/* recheck binding in 60 seconds */
ypdb->dom_check_t = time(NULL((void *)0)) + 60;
ypdb->dom_vers = YPVERS((u_long)2);
ypdb->dom_alive = 1;

if (ypdb->dom_lockfd != -1)
close(ypdb->dom_lockfd);

snprintf(path, sizeof path, "%s/%s.%d", BINDINGDIR"/var/yp/binding",
   ypdb->dom_domain, (int)ypdb->dom_vers);
if ((fd = open(path, O_CREAT0x0200|O_SHLOCK0x0010|O_RDWR0x0002|O_TRUNC0x0400, 0644)) == -1) {
(void)mkdir(BINDINGDIR"/var/yp/binding", 0755);
if ((fd = open(path, O_CREAT0x0200|O_SHLOCK0x0010|O_RDWR0x0002|O_TRUNC0x0400,
    0644)) == -1)
	return;
}

/*
* ok, if BINDINGDIR exists, and we can create the binding file,
* then write to it..
*/
ypdb->dom_lockfd = fd;

iov[0].iov_base = (caddr_t)&(udptransp->xp_port);
iov[0].iov_len = sizeof udptransp->xp_port;
iov[1].iov_base = (caddr_t)&ybr;
iov[1].iov_len = sizeof ybr;
iov[2].iov_base = (caddr_t)&ypserv_tcp;
iov[2].iov_len = sizeof ypserv_tcp;

memset(&ybr, 0, sizeof ybr);
ybr.ypbind_status = YPBIND_SUCC_VAL;
memmove(&ybr.ypbind_resp_u.ypbind_bindinfo.ypbind_binding_addr,
   &raddrp->sin_addr,
   sizeof(ybr.ypbind_resp_u.ypbind_bindinfo.ypbind_binding_addr));
memmove(&ybr.ypbind_resp_u.ypbind_bindinfo.ypbind_binding_port,
   &ypserv_udp,
   sizeof(ybr.ypbind_resp_u.ypbind_bindinfo.ypbind_binding_port));

if (writev(ypdb->dom_lockfd, iov, sizeof(iov)/sizeof(iov[0])) !=
   iov[0].iov_len + iov[1].iov_len + iov[2].iov_len) {
perror("write");
close(ypdb->dom_lockfd);
unlink(path);
ypdb->dom_lockfd = -1;
return;
}
1054}

1056struct _dom_binding *
1057xid2ypdb(u_int32_t xid)
1058{
struct _dom_binding *ypdb;

for (ypdb = ypbindlist; ypdb; ypdb = ypdb->dom_pnext)
if (ypdb->dom_xid == xid)
	break;
return (ypdb);
1065}

1067u_int32_t
1068unique_xid(struct _dom_binding *ypdb)
1069{
u_int32_t xid;

xid = arc4random();
while (xid2ypdb(xid) != NULL((void *)0))
xid++;

return (xid);
1077}