Date: Thu, 25 Feb 2010 13:07:36 -0800 From: Doug Hardie <bc979@lafn.org> To: freebsd-questions - <freebsd-questions@freebsd.org> Subject: getpwnam Message-ID: <FEE9A368-B2E0-4F96-9886-63DDFAF51BB1@lafn.org>
next in thread | raw e-mail | index | archive | help
I encountered a situation where sendmail was opening up what appeared to =
be listening on random UDP ports. In the process of tracking this down =
I discovered that the culprit is getpwnam. A ktrace of the following =
simple program show whats happening:
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <pwd.h>
int main (int argc, char *argv[])
{
struct passwd *pe;
pe =3D getpwnam ("xxx");
}
Note, xxx is a valid user id in that system.
The ktrace output is way too large to include here, but below is the =
interesting portion. Note that it creates a socket with address of =
0.0.0.0:932 and then sends data to it. Somehow it gets a response =
although I can find nothing other than this program using that port. I =
would think that it would use a unix socket rather than UDP to access =
local NIS information. The "unknown address family" error is also =
puzzling. I have traced this into _nsdispatch but it gets a bit =
convoluted at that point with all the caching. What is this doing?
87443 test CALL socket(PF_INET,SOCK_DGRAM,IPPROTO_UDP)
87443 test RET socket 4
87443 test CALL getsockname(0x4,0xbfbfe16c,0xbfbfe1f0)
87443 test STRU struct sockaddr { AF_INET, 0.0.0.0:0 }
87443 test RET getsockname 0
87443 test CALL getsockopt(0x4,0,0x13,0xbfbfe1f8,0xbfbfe1ec)
87443 test RET getsockopt 0
87443 test CALL setsockopt(0x4,0,0x13,0xbfbfe1f4,0x4)
87443 test RET setsockopt 0
87443 test CALL bind(0x4,0xbfbfe16c,0x10)
87443 test STRU struct sockaddr { AF_INET, 0.0.0.0:0 }
87443 test RET bind 0
87443 test CALL getsockname(0x4,0xbfbfe144,0xbfbfe1c8)
87443 test STRU struct sockaddr { AF_INET, 0.0.0.0:932 }
87443 test RET getsockname 0
87443 test CALL =
getsockopt(0x4,SOL_SOCKET,SO_TYPE,0xbfbfe1c4,0xbfbfe1c8)
87443 test RET getsockopt 0
87443 test CALL getrlimit(RLIMIT_NOFILE,0xbfbfe0f4)
87443 test RET getrlimit 0
87443 test CALL getsockname(0x4,0xbfbfe074,0xbfbfe0f8)
87443 test STRU struct sockaddr { AF_INET, 0.0.0.0:932 }
87443 test RET getsockname 0
87443 test CALL =
getsockopt(0x4,SOL_SOCKET,SO_TYPE,0xbfbfe0f4,0xbfbfe0f8)
87443 test RET getsockopt 0
87443 test CALL gettimeofday(0xbfbfe1c0,0)
87443 test RET gettimeofday 0
87443 test CALL getpid
87443 test RET getpid 87443/0x15593
87443 test CALL ioctl(0x4,FIONBIO,0xbfbfe1c8)
87443 test RET ioctl 0
87443 test CALL fcntl(0x4,F_SETFD,FD_CLOEXEC)
87443 test RET fcntl 0
87443 test CALL bind(0x4,0xbfbfe700,0x10)
87443 test STRU struct sockaddr { AF_UNSPEC, unknown address =
family }
87443 test RET bind -1 errno 22 Invalid argument
87443 test CALL getsockname(0x4,0xbfbfe700,0xbfbfe740)
87443 test STRU struct sockaddr { AF_INET, 0.0.0.0:932 }
87443 test RET getsockname 0
87443 test CALL gettimeofday(0xbfbfe740,0)
87443 test RET gettimeofday 0
87443 test CALL kqueue
87443 test RET kqueue 5
87443 test CALL sendto(0x4,0x282359f4,0x48,0,0x28235008,0x10)
87443 test GIO fd 4 wrote 72 bytes
0x0000 4b8e 2491 0000 0000 0000 0002 0001 86a4 =
|K.$.............|
0x0010 0000 0002 0000 000a 0000 0000 0000 0000 =
|................|
0x0020 0000 0000 0000 0000 0000 0004 7465 7374 =
|............test|
0x0030 0000 0014 6d61 7374 6572 2e70 6173 7377 =
|....master.passw|
0x0040 642e 6279 6e61 6d65 |d.byname|
87443 test RET sendto 72/0x48
87443 test CALL =
kevent(0x5,0x282350dc,0x1,0xbfbfe6fc,0x1,0xbfbfe730)
87443 test GIO fd 5 wrote 20 bytes
0x0000 0400 0000 ffff 0100 0000 0000 0000 0000 =
|................|
0x0010 0000 0000 |....|
87443 test GIO fd 5 read 20 bytes
0x0000 0400 0000 ffff 0000 0000 0000 2000 0000 |............ =
...|
0x0010 0000 0000 |....|
87443 test RET kevent 1
87443 test CALL recvfrom(0x4,0x282350f4,0x900,0,0,0)
87443 test GIO fd 4 read 32 bytes
0x0000 4b8e 2491 0000 0001 0000 0000 0000 0000 =
|K.$.............|
0x0010 0000 0000 0000 0000 0000 0001 4a3f f709 =
|............J?..|
87443 test STRU struct sockaddr { AF_INET, 206.117.18.7:876 }
87443 test RET recvfrom 32/0x20
87443 test CALL close(0x5)
87443 test RET close 0
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?FEE9A368-B2E0-4F96-9886-63DDFAF51BB1>