[PATCH rpcbind] rpcbind: bind the TCP listeners to the -h addresses too

[PATCH rpcbind] rpcbind: bind the TCP listeners to the -h addresses too

[Orgad Shaneh]

-h restricts only the datagram transports: tcp and tcp6 still bind to
the wildcard address, so rpcbind answers on every interface over TCP
even when -h names loopback and a single internal address. A host that
uses -h to keep rpcbind off its external interfaces gets that only for
UDP.

When -h is given, take the stream transports through the same
per-address loop as the datagram ones (AF_LOCAL ones have no address
and keep their own path), with the SO_REUSEADDR and listen() that the
wildcard path already does for them. Without -h nothing changes.

Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Orgad Shaneh <orgads@gmail.com>
---
 man/rpcbind.8 |  2 +-
 src/rpcbind.c | 15 ++++++++++++++-
 2 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/man/rpcbind.8 b/man/rpcbind.8
index 15b70f9..03b5514 100644
--- a/man/rpcbind.8
+++ b/man/rpcbind.8
@@ -85,7 +85,7 @@ checks are shown in detail.
 .It Fl f
 Do not fork and become a background process.
 .It Fl h
-Specify specific IP addresses to bind to for UDP requests.
+Specify specific IP addresses to bind to for UDP and TCP requests.
 This option may be specified multiple times and can be used to
 restrict the interfaces rpcbind will respond to.
 When specifying IP addresses with
diff --git a/src/rpcbind.c b/src/rpcbind.c
index c39df97..1215c73 100644
--- a/src/rpcbind.c
+++ b/src/rpcbind.c
@@ -535,7 +535,13 @@ init_transport(struct netconfig *nconf)
 		hints.ai_socktype = si.si_socktype;
 		hints.ai_protocol = si.si_proto;
 	}
-	if (nconf->nc_semantics == NC_TPI_CLTS) {
+	/*
+	 * With -h, bind the stream transports to the given addresses too,
+	 * not only the datagram ones; AF_LOCAL transports have no address.
+	 */
+	if (nconf->nc_semantics == NC_TPI_CLTS ||
+	    (nhosts > 0 && strcmp(nconf->nc_netid, "local") != 0 &&
+	     strcmp(nconf->nc_netid, "unix") != 0)) {
 		/*
 		 * If no hosts were specified, just bind to INADDR_ANY.  Otherwise
 		 * make sure 127.0.0.1 is added to the list.
@@ -621,6 +627,11 @@ init_transport(struct netconfig *nconf)
 			}
 			addrlen = res->ai_addrlen;
 			sa = (struct sockaddr *)res->ai_addr;
+			if (nconf->nc_semantics != NC_TPI_CLTS &&
+			    setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &on,
+				       sizeof(on)) != 0)
+				syslog(LOG_ERR, "cannot set SO_REUSEADDR on %s",
+				    nconf->nc_netid);
 			oldmask = umask(S_IXUSR|S_IXGRP|S_IXOTH);
                         if (bind(fd, sa, addrlen) != 0) {
 				syslog(LOG_ERR, "cannot bind %s on %s: %m",
@@ -673,6 +684,8 @@ init_transport(struct netconfig *nconf)
 				(void) free(uaddr);
 			}
 #endif
+			if (nconf->nc_semantics != NC_TPI_CLTS)
+				listen(fd, SOMAXCONN);
 			my_xprt = (SVCXPRT *)svc_tli_create(fd, nconf, &taddr, 
                                 RPC_MAXDATASIZE, RPC_MAXDATASIZE);
 			if (my_xprt == (SVCXPRT *)NULL) {
-- 
2.53.0