Make --enable-secure-statd the default.

[nfs-utils.git] / utils / statd / monitor.c

diff --git a/utils/statd/monitor.c b/utils/statd/monitor.c
index 834847341eb11044a87cd8c99a0b77cffa2169b0..8ee04414af050ef6c6de8a16bfeed2e6afd899fc 100644 (file)
--- a/utils/statd/monitor.c
+++ b/utils/statd/monitor.c
@@ -42,7 +42,7 @@ sm_mon_1_svc(struct mon *argp, struct svc_req *rqstp)
        notify_list     *clnt;
        struct in_addr  my_addr;
 #ifdef RESTRICTED_STATD
-       struct in_addr  mon_addr, caller;
+       struct in_addr  caller;
 #else
        struct hostent  *hostinfo = NULL;
 #endif
@@ -87,6 +87,11 @@ sm_mon_1_svc(struct mon *argp, struct svc_req *rqstp)
                goto failure;
        }
 
+#if 0
+       This is not usable anymore.  Linux-kernel can be configured to use
+       host names with NSM so that multi-homed hosts are handled properly.
+               NeilBrown 15mar2007
+
        /* 3.   mon_name must be an address in dotted quad.
         *      Again, specific to the linux kernel lockd.
         */
@@ -96,22 +101,25 @@ sm_mon_1_svc(struct mon *argp, struct svc_req *rqstp)
                        mon_name);
                goto failure;
        }
-#else
+#endif
+#endif
        /*
         * Check hostnames.  If I can't look them up, I won't monitor.  This
         * might not be legal, but it adds a little bit of safety and sanity.
         */
 
        /* must check for /'s in hostname!  See CERT's CA-96.09 for details. */
-       if (strchr(mon_name, '/')) {
-               note(N_CRIT, "SM_MON request for hostname containing '/': %s",
-                       mon_name);
+       if (strchr(mon_name, '/') || mon_name[0] == '.') {
+               note(N_CRIT, "SM_MON request for hostname containing '/' "
+                    "or starting '.': %s", mon_name);
                note(N_CRIT, "POSSIBLE SPOOF/ATTACK ATTEMPT!");
                goto failure;
        } else if (gethostbyname(mon_name) == NULL) {
                note(N_WARNING, "gethostbyname error for %s", mon_name);
                goto failure;
-       } else if (!(hostinfo = gethostbyname(my_name))) {
+       }
+#ifndef RESTRICTED_STATD
+       if (!(hostinfo = gethostbyname(my_name))) {
                note(N_WARNING, "gethostbyname error for %s", my_name);
                goto failure;
        } else
@@ -268,7 +276,9 @@ sm_unmon_1_svc(struct mon_id *argp, struct svc_req *rqstp)
                        clnt = NL_NEXT(clnt);
        }
 
+#ifdef RESTRICTED_STATD
  failure:
+#endif
        note(N_WARNING, "Received erroneous SM_UNMON request from %s for %s",
                my_name, mon_name);
        return (&result);
@@ -336,6 +346,8 @@ sm_unmon_all_1_svc(struct my_id *argp, struct svc_req *rqstp)
                dprintf(N_DEBUG, "SM_UNMON_ALL request from %s with no "
                        "SM_MON requests from it.", my_name);
        }
+#ifdef RESTRICTED_STATD
  failure:
+#endif
        return (&result);
 }