Date: Thu, 25 Feb 2010 13:07:36 -0800 From: Doug Hardie <bc979@lafn.org> To: freebsd-questions - <freebsd-questions@freebsd.org> Subject: getpwnam Message-ID: <FEE9A368-B2E0-4F96-9886-63DDFAF51BB1@lafn.org>
next in thread | raw e-mail | index | archive | help
I encountered a situation where sendmail was opening up what appeared to = be listening on random UDP ports. In the process of tracking this down = I discovered that the culprit is getpwnam. A ktrace of the following = simple program show whats happening: #include <stdio.h> #include <stdlib.h> #include <string.h> #include <sys/types.h> #include <pwd.h> int main (int argc, char *argv[]) { struct passwd *pe; pe =3D getpwnam ("xxx"); } Note, xxx is a valid user id in that system. The ktrace output is way too large to include here, but below is the = interesting portion. Note that it creates a socket with address of = 0.0.0.0:932 and then sends data to it. Somehow it gets a response = although I can find nothing other than this program using that port. I = would think that it would use a unix socket rather than UDP to access = local NIS information. The "unknown address family" error is also = puzzling. I have traced this into _nsdispatch but it gets a bit = convoluted at that point with all the caching. What is this doing? 87443 test CALL socket(PF_INET,SOCK_DGRAM,IPPROTO_UDP) 87443 test RET socket 4 87443 test CALL getsockname(0x4,0xbfbfe16c,0xbfbfe1f0) 87443 test STRU struct sockaddr { AF_INET, 0.0.0.0:0 } 87443 test RET getsockname 0 87443 test CALL getsockopt(0x4,0,0x13,0xbfbfe1f8,0xbfbfe1ec) 87443 test RET getsockopt 0 87443 test CALL setsockopt(0x4,0,0x13,0xbfbfe1f4,0x4) 87443 test RET setsockopt 0 87443 test CALL bind(0x4,0xbfbfe16c,0x10) 87443 test STRU struct sockaddr { AF_INET, 0.0.0.0:0 } 87443 test RET bind 0 87443 test CALL getsockname(0x4,0xbfbfe144,0xbfbfe1c8) 87443 test STRU struct sockaddr { AF_INET, 0.0.0.0:932 } 87443 test RET getsockname 0 87443 test CALL = getsockopt(0x4,SOL_SOCKET,SO_TYPE,0xbfbfe1c4,0xbfbfe1c8) 87443 test RET getsockopt 0 87443 test CALL getrlimit(RLIMIT_NOFILE,0xbfbfe0f4) 87443 test RET getrlimit 0 87443 test CALL getsockname(0x4,0xbfbfe074,0xbfbfe0f8) 87443 test STRU struct sockaddr { AF_INET, 0.0.0.0:932 } 87443 test RET getsockname 0 87443 test CALL = getsockopt(0x4,SOL_SOCKET,SO_TYPE,0xbfbfe0f4,0xbfbfe0f8) 87443 test RET getsockopt 0 87443 test CALL gettimeofday(0xbfbfe1c0,0) 87443 test RET gettimeofday 0 87443 test CALL getpid 87443 test RET getpid 87443/0x15593 87443 test CALL ioctl(0x4,FIONBIO,0xbfbfe1c8) 87443 test RET ioctl 0 87443 test CALL fcntl(0x4,F_SETFD,FD_CLOEXEC) 87443 test RET fcntl 0 87443 test CALL bind(0x4,0xbfbfe700,0x10) 87443 test STRU struct sockaddr { AF_UNSPEC, unknown address = family } 87443 test RET bind -1 errno 22 Invalid argument 87443 test CALL getsockname(0x4,0xbfbfe700,0xbfbfe740) 87443 test STRU struct sockaddr { AF_INET, 0.0.0.0:932 } 87443 test RET getsockname 0 87443 test CALL gettimeofday(0xbfbfe740,0) 87443 test RET gettimeofday 0 87443 test CALL kqueue 87443 test RET kqueue 5 87443 test CALL sendto(0x4,0x282359f4,0x48,0,0x28235008,0x10) 87443 test GIO fd 4 wrote 72 bytes 0x0000 4b8e 2491 0000 0000 0000 0002 0001 86a4 = |K.$.............| 0x0010 0000 0002 0000 000a 0000 0000 0000 0000 = |................| 0x0020 0000 0000 0000 0000 0000 0004 7465 7374 = |............test| 0x0030 0000 0014 6d61 7374 6572 2e70 6173 7377 = |....master.passw| 0x0040 642e 6279 6e61 6d65 |d.byname| 87443 test RET sendto 72/0x48 87443 test CALL = kevent(0x5,0x282350dc,0x1,0xbfbfe6fc,0x1,0xbfbfe730) 87443 test GIO fd 5 wrote 20 bytes 0x0000 0400 0000 ffff 0100 0000 0000 0000 0000 = |................| 0x0010 0000 0000 |....| 87443 test GIO fd 5 read 20 bytes 0x0000 0400 0000 ffff 0000 0000 0000 2000 0000 |............ = ...| 0x0010 0000 0000 |....| 87443 test RET kevent 1 87443 test CALL recvfrom(0x4,0x282350f4,0x900,0,0,0) 87443 test GIO fd 4 read 32 bytes 0x0000 4b8e 2491 0000 0001 0000 0000 0000 0000 = |K.$.............| 0x0010 0000 0000 0000 0000 0000 0001 4a3f f709 = |............J?..| 87443 test STRU struct sockaddr { AF_INET, 206.117.18.7:876 } 87443 test RET recvfrom 32/0x20 87443 test CALL close(0x5) 87443 test RET close 0
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?FEE9A368-B2E0-4F96-9886-63DDFAF51BB1>