>Number:         7017
>Category:       bin
>Synopsis:       portmap can lose log entries if process table is exhausted
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    bin-bug-people (Utility Bug People)
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Feb 19 00:20:00 1999
>Last-Modified:
>Originator:     Greg A. Woods
>Organization:
Planix, Inc.; Toronto, Ontario; Canada
>Release:        NetBSD-current Thu Feb 18 08:37:39 EST 1999
>Environment:

System: NetBSD proven 1.3I i386

>Description:

	It is possible for the new portmap logging to loose log entries
	if the system process table becomes full.

>How-To-Repeat:

	by examination

>Fix:

	if fork() fails the syslog() should still be done

	apply the following patch -- line numbers are approximate

	(portmap needs a bit of KNF too)

	(all code that only handles two conditions from fork() is
	probably somewhat buggy under stressful conditions....)

*** /var/sup/sup.NetBSD.ORG/src/usr.sbin/portmap/portmap.c	Thu Jan 21 07:16:08 1999
--- ./portmap.c	Fri Feb 19 02:56:02 1999
***************
*** 726,733 ****
       * getrpcbynumber() or syslog() does its thing.
       */
  
!     if (fork() == 0) {
  
          /* Try to map program number to name. */
  
          if (prognum == 0) {
--- 721,729 ----
       * getrpcbynumber() or syslog() does its thing.
       */
  
!     switch (fork()) {
  
+     case 0:
          /* Try to map program number to name. */
  
          if (prognum == 0) {
***************
*** 747,754 ****
  
          /* Write syslog record. */
  
!         syslog(severity, "connect from %s to %s(%s)%s",
!             inet_ntoa(addr->sin_addr), procname, progname, text);
! 		exit(0);
! 	}
  }
--- 743,759 ----
  
          /* Write syslog record. */
  
!         syslog(severity, "[%d] connect from %s to %s(%s)%s",
! 	       getppid(), inet_ntoa(addr->sin_addr), procname, progname, text);
!         exit(0);
! 	/* NOTREACHED */
! 
!     case -1:
!         syslog(severity, "connect from %s to %ld(%ld)%s",
! 	       inet_ntoa(addr->sin_addr), procnum, prognum, text);
! 	return;
! 
!     default:
!         return;
!     }
  }
>Audit-Trail:
>Unformatted: