Count configuration file lines for better error reporting.

On Windows, select() ignores its first argument and instead relies on a
slightly different fd_set structure that can hold file descriptors with
arbitrary values. We use the Microsoft recommended way and just increase
FD_SETSIZE at compilation time.

.travis.yml

@@ -0,0 +1,21 @@
+sudo: false
+language: c
+env: VERBOSE=1
+
+addons:
+  apt:
+    packages:
+      - build-essential
+      - pkg-config
+
+before_install:
+  - ./bootstrap
+
+os:
+  - linux
+  - osx
+
+compiler:
+  - gcc
+  - clang
+

CHANGES

@@ -1,55 +0,0 @@
-Version 0.1: original version.
-
-Version 0.2: fixed bug when several reads are necessary
-on one end or the other before a write flushes them.
-Fixed bug which threw away data not yet sent to the
-other side on close, when running under Linux. Fixed
-associated bugs that probably affected other operating
-systems as well. Fixed bug causing long, perhaps
-indefinite pauses when a possible connection to a
-server socket went away before the accept() call,
-resulting in a blocking call.
-
-Version 0.3: fixed additional bugs relating to
-the code previously used only by non-Linux OSes.
-This should fix problems such as connections not
-going away when they should or connections being
-mysteriously closed. Most of that code is now used by 
-Linux also, so it is likely that rinetd is much closer 
-to bug-free on non-Linux platforms. Of course, I don't 
-actually have any to play with it on.
-
-Version 0.4: added support for kill -1 (SIGHUP)
-and specification of service names instead of
-port numbers. Removed calls to realloc(), replacing
-them with code that should fail gracefully without
-crashing the program or breaking existing connections
-when another application is hogging memory.
-
-Version 0.5: added logging in both tab-delimited
-and web-server-style formats. No longer exits if
-an individual configuration file line generates
-an error. Added allow and deny rules. Added 
--c command line option to specify a configuration file.
-
-Version 0.51: fixed failure to check for an open
-log file before writing log entries.
-
-Version 0.52: documentation added regarding the
-ability to bind to all IP addresses, if desired,
-using the special address 0.0.0.0.
-
-Version 0.6: ported to Win32. Various compatibility
-fixes were made and some minor oversights without
-functional consequences were corrected.
-
-Version 0.61: fixed a bug in 0.6 which completely
-broke rinetd under Linux. Oops.
-
-Version 0.62: fixed a potential buffer overrun;
-prior versions failed to reallocate one of the
-arrays correctly when reallocating memory to
-accommodate more connections.  Thanks to 
-Sam Hocevar.
-
-

CHANGES.md

@@ -0,0 +1,73 @@
+## Version 0.63
+
+ * added a `-f` flag to run in the foreground
+ * quit cleanly when `SIGINT` is received
+ * increased data buffer size for better performance
+ * fixed random uninitialised data accesses
+ * fixed a memory leak in connection reallocation
+ * fixed a file descriptor leak in configuration reload
+ * fixed configuration file parsing (many bugs including a buffer overflow)
+ * fixed configuration error reporting (line numbers were wrong)
+ * log accepted connections in addition to denied ones
+ * log DNS errors
+ * code quality refactoring: got rid of a lot of old code, used C
+   library functions instead of custom ones, enforced `const` correctness
+
+## Version 0.62
+
+fixed a potential buffer overrun; prior versions failed to reallocate one of
+the arrays correctly when reallocating memory to accommodate more connections.
+Thanks to Sam Hocevar.
+
+## Version 0.61
+
+fixed a bug in 0.6 which completely broke rinetd under Linux. Oops.
+
+## Version 0.6
+
+ported to Win32. Various compatibility fixes were made and some minor
+oversights without functional consequences were corrected.
+
+## Version 0.52
+
+documentation added regarding the ability to bind to all IP addresses, if
+desired, using the special address 0.0.0.0.
+
+## Version 0.51
+
+fixed failure to check for an open log file before writing log entries.
+
+## Version 0.5
+
+added logging in both tab-delimited and web-server-style formats. No longer
+exits if an individual configuration file line generates an error. Added allow
+and deny rules. Added -c command line option to specify a configuration file.
+
+## Version 0.4
+
+added support for kill -1 (SIGHUP) and specification of service names instead
+of port numbers. Removed calls to realloc(), replacing them with code that
+should fail gracefully without crashing the program or breaking existing
+connections when another application is hogging memory.
+
+## Version 0.3
+
+fixed additional bugs relating to the code previously used only by non-Linux
+OSes. This should fix problems such as connections not going away when they
+should or connections being mysteriously closed. Most of that code is now
+used by Linux also, so it is likely that rinetd is much closer to bug-free on
+non-Linux platforms. Of course, I don't actually have any to play with it on.
+
+## Version 0.2
+
+fixed bug when several reads are necessary on one end or the other before a
+write flushes them. Fixed bug which threw away data not yet sent to the other
+side on close, when running under Linux. Fixed associated bugs that probably
+affected other operating systems as well. Fixed bug causing long, perhaps
+indefinite pauses when a possible connection to a server socket went away
+before the accept() call, resulting in a blocking call.
+
+## Version 0.1
+
+original version.
+

Makefile.am

@@ -1,17 +1,26 @@
 
 AUTOMAKE_OPTIONS = foreign dist-bzip2
 
-EXTRA_DIST = bootstrap CHANGES index.html \
+EXTRA_DIST = bootstrap CHANGES.md README.md index.html \
 	getopt.c getopt.h $(man_MANS) $(sysconf_DATA)
 
 man_MANS = rinetd.8
 sysconf_DATA = rinetd.conf
 
 sbin_PROGRAMS = rinetd
-rinetd_SOURCES = rinetd.c match.c match.h
+rinetd_SOURCES = rinetd.c rinetd.h parse.h match.c match.h
+
+GENERATED_SOURCES = parse.h
+
+# If peg/leg is available, regenerate parse.h
+parse.h: parse.peg
+	if which leg >/dev/null 2>&1; then leg -o $@ $^; else touch $@; fi
 
 # _POSIX_C_SOURCE is for SA_RESTART and others
 # _XOPEN_SOURCE is for struct sigaction
-# _DEFAULT_SOURCE is for h_errno and gethostbyname-related macros
-rinetd_CFLAGS = -std=c99 -D_XOPEN_SOURCE -D_DEFAULT_SOURCE -D_POSIX_C_SOURCE=200809L -Wall -Wextra -Wwrite-strings -I.
+# _GNU_SOURCE is for h_errno and gethostbyname-related macros
+rinetd_CFLAGS = -std=c99 -D_XOPEN_SOURCE -D_GNU_SOURCE -D_POSIX_C_SOURCE=200809L -Wall -Wextra -Wwrite-strings -I.
+
+# This is for Travis CI; we don’t have a testsuite yet.
+test:
 

README

@@ -1,14 +0,0 @@
-rinetd, by Thomas Boutell. Released under the terms of the GNU General
-Public License, version 2 or later.
-
-This program is used to efficiently redirect connections from one IP
-address/port combination to another. It is useful when operating virtual
-servers, firewalls and the like.
-
-To build under Unix, run "./bootstrap" to create the configuration
-files, then "./configure" to create the build files, and then type
-"make" to build rinetd. To install, type "make install" as root.
-
-For documentation run "make install", then type "man rinetd" for
-details. Or, read index.html in your browser.
-

README.md

@@ -0,0 +1,14 @@
+rinetd, by Thomas Boutell and Sam Hocevar. Released under the terms
+of the GNU General Public License, version 2 or later.
+
+This program is used to efficiently redirect connections from one IP
+address/port combination to another. It is useful when operating virtual
+servers, firewalls and the like.
+
+To build under Unix, run `./bootstrap` to create the configuration
+files, then `./configure` to create the build files, and then type
+`make` to build rinetd. To install, type `make install` as root.
+
+For documentation run `make install`, then type `man rinetd` for
+details. Or, read `index.html` in your browser.
+

configure.ac

@@ -1,6 +1,6 @@
 # Process this file with autoconf to produce a configure script.
 AC_PREREQ(2.52)
-AC_INIT(rinetd, 0.62.0sam, sam@hocevar.net)
+AC_INIT(rinetd, 0.63, sam@hocevar.net)
 AC_CONFIG_AUX_DIR(.auto)
 AC_CONFIG_SRCDIR([getopt.h])
 AC_CONFIG_HEADER([config.h])
@@ -11,6 +11,7 @@ AC_PROG_CC
 AC_PROG_INSTALL
 
 # Checks for libraries.
+AC_CHECK_LIB(ws2_32, main, [LIBS="${LIBS} -lws2_32"])
 
 # Checks for header files.
 AC_HEADER_STDC
@@ -26,10 +27,11 @@ AC_CHECK_TYPES(socklen_t, [], [],
 
 # Checks for library functions.
 AC_FUNC_FORK
-AC_FUNC_MALLOC
+#XXX: disabled because of cross-compilation issues
+#AC_FUNC_MALLOC
 AC_TYPE_SIGNAL
 AC_FUNC_STRFTIME
-AC_CHECK_FUNCS([gethostbyname memset select socket strstr daemon sigaction])
+AC_CHECK_FUNCS([gethostbyname memset select socket strstr daemon fork sigaction])
 
 AC_CONFIG_FILES([Makefile])
 AC_OUTPUT

index.html

@@ -1,4 +1,4 @@
-<html>
+<html>
 <head>
 <title>RINETD(8)</title>
 <style>
@@ -40,23 +40,13 @@ blockquote,code {
 
 <h3>VERSION</h3>
 
-<p> Version 0.62, 04/13/2003. Version 0.62 corrects a potential buffer overflow
-when reallocating memory to accommodate more connections. Upgrading is strongly
-recommended. </p>
+<p> Version 0.63, 2017/07/19. Version 0.63 corrects several bugs including a
+denial of service security issue, and greatly improves performance, ease of
+use, and portability. </p>
 
 <h3>WHERE TO GET</h3>
-
-<p> <strong>For Linux:</strong>
-<a href="ftp://ftp.boutell.com/pub/boutell/rinetd/rinetd.tar.gz">By
-anonymous FTP from ftp.boutell.com</a> in the subdirectory
-<code>boutell/rinetd</code> as the file <code>rinetd.tar.gz</code>.
-</p>
-
-<p> <strong>For Windows 95/98/NT:</strong>
-<a href="ftp://ftp.boutell.com/pub/boutell/rinetd/rinetd.zip">By
-anonymous FTP from ftp.boutell.com</a> in the subdirectory
-<code>boutell/rinetd</code> as the file <code>rinetd.zip</code>.
-</p>
+ <p> <a href="https://github.com/samhocevar/rinetd/releases">By HTTP on
+GitHub</a> in the releases section. </p>
 
 <h3>DESCRIPTION</h3>
 
@@ -213,17 +203,25 @@ is untested. </p>
 
 <p> Copyright (c) 1997, 1998, 1999,
 <a href="http://www.boutell.com/boutell">Thomas Boutell</a> and
-<a href="http://www.boutell.com/">Boutell.Com, Inc.</a>
-This software is released for free use under the terms of
-the GNU General Public License, version 2 or higher.
-</p>
+<a href="http://www.boutell.com/">Boutell.Com, Inc.</a> </p>
+
+<p> Copyright (c) 2003&mdash;2017 <a href="https://github.com/samhocevar">Sam
+Hocevar</a> </p>
+
+<p> This software is released for free use under the terms of the GNU
+General Public License, version 2 or higher. </p>
 
 <h3>CONTACT INFORMATION</h3>
 
-<p> See <a href="http://www.boutell.com/rinetd">the rinetd web page</a>
-for the latest release. Thomas Boutell can be reached by email: <a
+<p> See <a href="https://github.com/samhocevar/rinetd/releases">the rinetd web
+page</a> for the latest release. </p>
+
+<p> Thomas Boutell can be reached by email: <a
 href="mailto:boutell@boutell.com">boutell@boutell.com</a> </p>
 
+<p> Sam Hocevar can be reached by email: <a
+href="mailto:sam@hocevar.net">sam@hocevar.net</a> </p>
+
 <h3>THANKS</h3>
 
 <p> Thanks are due to Bill Davidsen, Libor Pechachek, Sascha Ziemann, Joel

match.c

@@ -20,7 +20,6 @@ int matchNoCase(char const *sorig, char const *p)
 
 int matchBody(char const *sorig, char const *p, int nocase)
 {
-	static int dummy = 0;
 	/* Algorithm:
 
 		Word separator: *. End-of-string
@@ -56,11 +55,6 @@ int matchBody(char const *sorig, char const *p, int nocase)
 
 	char const *s = sorig;
 	int escaped = 0;
-	if (strstr(p, "WS-0000")) {
-		if (strstr(s, "ws_ftp_pro.html")) {
-			dummy = 1;
-		}
-	}
 	while (1) {
 		char const *word;
 		int wordLen;

parse.peg

@@ -0,0 +1,182 @@
+%{
+#define YY_CTX_LOCAL 1
+#define YY_CTX_MEMBERS \
+    FILE *fp; \
+    int currentLine; \
+    int isAuthAllow; \
+    unsigned int port, bindPort, connectPort; \
+    char *bindAddress, *connectAddress;
+#define YY_INPUT(yyctx, buf, result, max_size) \
+{ \
+    int yyc = fgetc(yyctx->fp); \
+    result = (EOF == yyc) ? 0 : (*(buf) = yyc, 1); \
+}
+#define PARSE_ERROR exit(1);
+%}
+
+file     =  (sol (line eol | invalid_syntax))*
+line     =  -? (rule | auth | logfile | pidlogfile | logcommon )? -? comment?
+
+comment  =  "#" (!eol .)*
+
+rule  =  bind_address - bind_port - connect_address - connect_port {
+	/* Turn all of this stuff into reasonable addresses */
+	struct in_addr iaddr;
+	if (getAddress(yy->bindAddress, &iaddr) < 0) {
+		fprintf(stderr, "rinetd: host %s could not be resolved.\n",
+			yy->bindAddress);
+		PARSE_ERROR;
+	}
+	/* Make a server socket */
+	SOCKET fd = socket(PF_INET, SOCK_STREAM, 0);
+	if (fd == INVALID_SOCKET) {
+		syslog(LOG_ERR, "couldn't create "
+			"server socket! (%m)\n");
+		PARSE_ERROR;
+	}
+	struct sockaddr_in saddr;
+	saddr.sin_family = AF_INET;
+	memcpy(&saddr.sin_addr, &iaddr, sizeof(iaddr));
+	saddr.sin_port = htons(yy->bindPort);
+	int tmp = 1;
+	setsockopt(fd, SOL_SOCKET, SO_REUSEADDR,
+		(const char *) &tmp, sizeof(tmp));
+	if (bind(fd, (struct sockaddr *)
+		&saddr, sizeof(saddr)) == SOCKET_ERROR)
+	{
+		/* Warn -- don't exit. */
+		syslog(LOG_ERR, "couldn't bind to "
+			"address %s port %d (%m)\n",
+			yy->bindAddress, yy->bindPort);
+		closesocket(fd);
+		PARSE_ERROR;
+	}
+	if (listen(fd, RINETD_LISTEN_BACKLOG) == SOCKET_ERROR) {
+		/* Warn -- don't exit. */
+		syslog(LOG_ERR, "couldn't listen to "
+			"address %s port %d (%m)\n",
+			yy->bindAddress, yy->bindPort);
+		closesocket(fd);
+		PARSE_ERROR;
+	}
+#if _WIN32
+	u_long ioctltmp;
+#else
+	int ioctltmp;
+#endif
+	ioctlsocket(fd, FIONBIO, &ioctltmp);
+	if (getAddress(yy->connectAddress, &iaddr) < 0) {
+		/* Warn -- don't exit. */
+		syslog(LOG_ERR, "host %s could not be resolved.\n",
+			yy->bindAddress);
+		closesocket(fd);
+		PARSE_ERROR;
+	}
+	/* Allocate server info */
+	seInfo = (ServerInfo *)
+		realloc(seInfo, sizeof(ServerInfo) * (seTotal + 1));
+	if (!seInfo) {
+		PARSE_ERROR;
+	}
+	ServerInfo *srv = &seInfo[seTotal];
+	memset(srv, 0, sizeof(*srv));
+	srv->fd = fd;
+	srv->localAddr = iaddr;
+	srv->localPort = htons(yy->connectPort);
+	srv->fromHost = yy->bindAddress;
+	if (!srv->fromHost) {
+		PARSE_ERROR;
+	}
+	srv->fromPort = yy->bindPort;
+	srv->toHost = yy->connectAddress;
+	if (!srv->toHost) {
+		PARSE_ERROR;
+	}
+	srv->toPort = yy->connectPort;
+#ifndef _WIN32
+	if (fd > maxfd) {
+		maxfd = fd;
+	}
+#endif
+	++seTotal;
+
+	yy->bindAddress = yy->connectAddress = NULL;
+}
+
+bind_address     =  < ipv4 > { yy->bindAddress = strdup(yytext); }
+connect_address  =  < ipv4 > { yy->connectAddress = strdup(yytext); }
+bind_port        =  port { yy->bindPort = yy->port; }
+connect_port     =  port { yy->connectPort = yy->port; }
+
+port  =  < (number | service) > {
+	struct servent *bindService = getservbyname(yytext, "tcp");
+	yy->port = bindService ? ntohs(bindService->s_port) : atoi(yytext);
+	if (yy->port == 0 || yy->port >= 65536) {
+		syslog(LOG_ERR, "bind port missing or out of range\n");
+		PARSE_ERROR;
+	}
+}
+
+auth  =  auth_key - < pattern > {
+	allRules = (Rule *)
+		realloc(allRules, sizeof(Rule) * (allRulesCount + 1));
+	if (!allRules) {
+		PARSE_ERROR;
+	}
+	allRules[allRulesCount].pattern = strdup(yytext);
+	if (!allRules[allRulesCount].pattern) {
+		PARSE_ERROR;
+	}
+	allRules[allRulesCount].type = yy->isAuthAllow ? allowRule : denyRule;
+	if (seTotal > 0) {
+		if (seInfo[seTotal - 1].rulesStart == 0) {
+			seInfo[seTotal - 1].rulesStart = allRulesCount;
+		}
+		++seInfo[seTotal - 1].rulesCount;
+	} else {
+		++globalRulesCount;
+	}
+	++allRulesCount;
+}
+
+auth_key = < ("allow" | "deny") >         { yy->isAuthAllow = (yytext[0] == 'a'); }
+
+logfile  =  "logfile" - < filename > {
+	logFileName = strdup(yytext);
+	if (!logFileName) {
+		PARSE_ERROR;
+	}
+}
+
+pidlogfile  =  "pidlogfile" - < filename > {
+	pidLogFileName = strdup(yytext);
+	if (!pidLogFileName) {
+		PARSE_ERROR;
+	}
+}
+
+logcommon  =  "logcommon" {
+	logFormatCommon = 1;
+}
+
+invalid_syntax  =  < (!eol .)+ > eol {
+	fprintf(stderr, "rinetd: invalid syntax at line %d: %s\n",
+	        yy->currentLine, yytext);
+	PARSE_ERROR; /* FIXME */
+}
+
+service  =  name
+ipv4     =  number [.] number [.] number [.] number | '0'
+pattern  =  [0-9*?]+ ('.' [0-9*?]+ ('.' [0-9*?]+ ('.' [0-9*?]+)?)?)?
+number   =  digit+
+
+name     =  [a-zA-Z][a-zA-Z0-9_]*
+filename =  '"' [^"]+ '"'
+         | [^ \t\r\n]+
+
+-        =  [ \t]+
+digit    =  [0-9]
+sol      =  { ++yy->currentLine; }
+eol      =  '\r'? '\n' | eof
+eof      =  '\0'
+

rinetd.8

@@ -2,7 +2,7 @@
 .\" This software is released for free use under the terms of
 .\" the GNU Public License, version 2 or higher.
 .\"
-.Dd February 18, 1999
+.Dd July 19, 2017
 .Dt RINETD 8
 .Os LINUX
 .Sh NAME
@@ -12,7 +12,7 @@
 .Sh SYNOPSIS
 .Nm /usr/sbin/rinetd
 .Sh VERSION
-Version 0.62, 04/14/2003.
+Version 0.63, 2017/07/19.
 .Sh DESCRIPTION
 .Nm rinetd
 redirects TCP connections from one IP address and port to another. rinetd
@@ -181,12 +181,18 @@ is provided, but this code is untested. The logging is inadequate.
 The duration of each connection should be logged.
 .Sh LICENSE
 Copyright (c) 1997, 1998, 1999, Thomas Boutell and Boutell.Com, Inc.
+.Pp
+Copyright (c) 2003\-2017 Sam Hocevar
+.Pp
 This software is released for free use under the terms of
 the GNU Public License, version 2 or higher. NO WARRANTY
 IS EXPRESSED OR IMPLIED. USE THIS SOFTWARE AT YOUR OWN RISK.
 .Sh CONTACT INFORMATION
-See http://www.boutell.com/rinetd/ for the latest release.
+See https://github.com/samhocevar/rinetd/releases for the latest release.
+.Pp
 Thomas Boutell can be reached by email: boutell@boutell.com
+.Pp
+Sam Hocevar can be reached by email: sam@hocevar.net
 .Sh THANKS
 Thanks are due to Bill Davidsen, Libor Pechachek, Sascha Ziemann, the
 Apache Group, and many others who have contributed advice

rinetd.conf

@@ -16,7 +16,8 @@
 # to apply to only that forwarding rule
 #
 # bindadress    bindport  connectaddress  connectport
-
+127.0.0.1 4000    127.0.0.1 22
+#127.0.0.1 4000/udp    127.0.0.1 22
 
 # logging information
 logfile /var/log/rinetd.log

rinetd.h

@@ -0,0 +1,69 @@
+/* Constants */
+
+static int const RINETD_BUFFER_SIZE = 16384;
+static int const RINETD_LISTEN_BACKLOG = 128;
+
+#define RINETD_CONFIG_FILE "/etc/rinetd.conf"
+#define RINETD_PID_FILE "/var/run/rinetd.pid"
+
+/* Program state */
+
+enum ruleType {
+	allowRule,
+	denyRule,
+};
+
+typedef struct _rule Rule;
+struct _rule
+{
+	char *pattern;
+	int type;
+};
+
+typedef struct _server_info ServerInfo;
+struct _server_info {
+	SOCKET fd;
+
+	/* In network order, for network purposes */
+	struct in_addr localAddr;
+	unsigned short localPort;
+
+	/* In ASCII and local byte order, for logging purposes */
+	char *fromHost, *toHost;
+	int fromPort, toPort;
+
+	/* Offset and count into list of allow and deny rules. Any rules
+		prior to globalAllowRules and globalDenyRules are global rules. */
+	int rulesStart, rulesCount;
+};
+
+typedef struct _socket Socket;
+struct _socket
+{
+	SOCKET fd;
+	/* recv: received on this socket
+		sent: sent to this socket from the other buffer */
+	int recvPos, sentPos;
+	int recvBytes, sentBytes;
+	char *buffer;
+};
+
+typedef struct _connection_info ConnectionInfo;
+struct _connection_info
+{
+	Socket remote, local;
+	struct in_addr reAddresses;
+	int coClosing;
+	int coLog;
+	ServerInfo const *server; // only useful for logEvent
+};
+
+/* Option parsing */
+
+typedef struct _rinetd_options RinetdOptions;
+struct _rinetd_options
+{
+	char const *conf_file;
+	int foreground;
+};
+