archlinuxarm/PKGBUILDs
1
0
Fork 0
mirror of https://github.com/archlinuxarm/PKGBUILDs.git synced 2025-01-27 23:44:04 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Added core/tcp_wrappers with hosts.allow

Browse source
This commit is contained in:
Mike Staszel 2010-04-30 15:41:45 -05:00
parent 0391a4751d
commit c2ce5c16b3
16 changed files with 2696 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

35
core/tcp_wrappers/01_all_redhat-bug11881.patch Executable file
View file

@ -0,0 +1,35 @@
--- tcp_wrappers_7.6/tcpd.c.bug11881 Thu Jul 27 15:39:27 2000
+++ tcp_wrappers_7.6/tcpd.c Thu Jul 27 15:41:54 2000
@@ -60,10 +60,10 @@
*/
if (argv[0][0] == '/') {
- strcpy(path, argv[0]);
+ strncpy(path, argv[0], sizeof(path));
argv[0] = strrchr(argv[0], '/') + 1;
} else {
- sprintf(path, "%s/%s", REAL_DAEMON_DIR, argv[0]);
+ snprintf(path, sizeof(path), "%s/%s", REAL_DAEMON_DIR, argv[0]);
}
/*
--- tcp_wrappers_7.6/eval.c.bug11881 Thu Jul 27 15:39:53 2000
+++ tcp_wrappers_7.6/eval.c Thu Jul 27 15:40:51 2000
@@ -111,7 +111,7 @@
return (hostinfo);
#endif
if (STR_NE(eval_user(request), unknown)) {
- sprintf(both, "%s@%s", request->user, hostinfo);
+ snprintf(both, sizeof(both), "%s@%s", request->user, hostinfo);
return (both);
} else {
return (hostinfo);
@@ -128,7 +128,7 @@
char *daemon = eval_daemon(request);
if (STR_NE(host, unknown)) {
- sprintf(both, "%s@%s", daemon, host);
+ snprintf(both, sizeof(both), "%s@%s", daemon, host);
return (both);
} else {
return (daemon);

49
core/tcp_wrappers/02_all_redhat-bug17795.patch Executable file
View file

@ -0,0 +1,49 @@
--- hosts_access.c Wed Feb 12 03:13:23 1997
+++ hosts_access.c Wed Jul 19 08:37:02 2000
@@ -240,6 +255,26 @@
}
}
+/* hostfile_match - look up host patterns from file */
+
+static int hostfile_match(path, host)
+char *path;
+struct hosts_info *host;
+{
+ char tok[BUFSIZ];
+ int match = NO;
+ FILE *fp;
+
+ if ((fp = fopen(path, "r")) != 0) {
+ while (fscanf(fp, "%s", tok) == 1 && !(match = host_match(tok, host)))
+ /* void */ ;
+ fclose(fp);
+ } else if (errno != ENOENT) {
+ tcpd_warn("open %s: %m", path);
+ }
+ return (match);
+}
+
/* host_match - match host name and/or address against pattern */
static int host_match(tok, host)
@@ -267,6 +302,8 @@
tcpd_warn("netgroup support is disabled"); /* not tcpd_jump() */
return (NO);
#endif
+ } else if (tok[0] == '/') { /* /file hack */
+ return (hostfile_match(tok, host));
} else if (STR_EQ(tok, "KNOWN")) { /* check address and name */
char *name = eval_hostname(host);
return (STR_NE(eval_hostaddr(host), unknown) && HOSTNAME_KNOWN(name));
--- hosts_access.5 2003-08-03 19:09:56.000000000 +0000
+++ hosts_access.5 2003-08-03 19:13:32.000000000 +0000
@@ -91,0 +92,7 @@
+.IP \(bu
+A string that begins with a `/\' character is treated as a file
+name. A host name or address is matched if it matches any host name
+or address pattern listed in the named file. The file format is
+zero or more lines with zero or more host name or address patterns
+separated by whitespace. A file name pattern can be used anywhere
+a host name or address pattern can be used.

93
core/tcp_wrappers/03_all_wildcard.patch Executable file
View file

@ -0,0 +1,93 @@
--- /tmp/hosts_access.c 2003-08-03 22:18:00.000000000 +0000
+++ hosts_access.c 2003-08-03 22:39:44.000000000 +0000
@@ -289,6 +289,17 @@
{
int n;
+#ifndef DISABLE_WILDCARD_MATCHING
+ if (strchr(tok, '*') || strchr(tok,'?')) { /* contains '*' or '?' */
+ /* we must convert the both to lowercase as match_pattern_ylo is case-sensitive */
+ for (n = 0; n < strlen(tok); n++)
+ tok[n] = isupper(tok[n]) ? tolower(tok[n]) : tok[n];
+ for (n = 0; n < strlen(string); n++)
+ string[n] = isupper(string[n]) ? tolower(string[n]) : string[n];
+ return (match_pattern_ylo(string,tok));
+ } else
+#endif
+
if (tok[0] == '.') { /* suffix */
n = strlen(string) - strlen(tok);
return (n > 0 && STR_EQ(tok, string + n));
@@ -329,3 +340,72 @@
}
return ((addr & mask) == net);
}
+
+#ifndef DISABLE_WILDCARD_MATCHING
+/* Note: this feature has been adapted in a pretty straightforward way
+ from Tatu Ylonen's last SSH version under free license by
+ Pekka Savola <pekkas@netcore.fi>.
+
+ Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
+*/
+
+/* Returns true if the given string matches the pattern (which may contain
+ ? and * as wildcards), and zero if it does not match. */
+
+int match_pattern_ylo(const char *s, const char *pattern)
+{
+ while (1)
+ {
+ /* If at end of pattern, accept if also at end of string. */
+ if (!*pattern)
+ return !*s;
+
+ /* Process '*'. */
+ if (*pattern == '*')
+ {
+ /* Skip the asterisk. */
+ pattern++;
+
+ /* If at end of pattern, accept immediately. */
+ if (!*pattern)
+ return 1;
+
+ /* If next character in pattern is known, optimize. */
+ if (*pattern != '?' && *pattern != '*')
+ {
+ /* Look instances of the next character in pattern, and try
+ to match starting from those. */
+ for (; *s; s++)
+ if (*s == *pattern &&
+ match_pattern_ylo(s + 1, pattern + 1))
+ return 1;
+ /* Failed. */
+ return 0;
+ }
+
+ /* Move ahead one character at a time and try to match at each
+ position. */
+ for (; *s; s++)
+ if (match_pattern_ylo(s, pattern))
+ return 1;
+ /* Failed. */
+ return 0;
+ }
+
+ /* There must be at least one more character in the string. If we are
+ at the end, fail. */
+ if (!*s)
+ return 0;
+
+ /* Check if the next character of the string is acceptable. */
+ if (*pattern != '?' && *pattern != *s)
+ return 0;
+
+ /* Move to the next character, both in string and in pattern. */
+ s++;
+ pattern++;
+ }
+ /*NOTREACHED*/
+}
+#endif /* DISABLE_WILDCARD_MATCHING */
+

27
core/tcp_wrappers/04_all_fixgethostbyname.patch Executable file
View file

@ -0,0 +1,27 @@
--- tcp_wrappers_7.6/socket.c.fixgethostbyname Fri Mar 21 13:27:25 1997
+++ tcp_wrappers_7.6/socket.c Mon Feb 5 14:09:40 2001
@@ -52,7 +52,8 @@
char *name;
{
char dot_name[MAXHOSTNAMELEN + 1];
-
+ struct hostent *hp;
+
/*
* Don't append dots to unqualified names. Such names are likely to come
* from local hosts files or from NIS.
@@ -61,8 +62,12 @@
if (strchr(name, '.') == 0 || strlen(name) >= MAXHOSTNAMELEN - 1) {
return (gethostbyname(name));
} else {
- sprintf(dot_name, "%s.", name);
- return (gethostbyname(dot_name));
+ sprintf(dot_name, "%s.", name);
+ hp = gethostbyname(dot_name);
+ if (hp)
+ return hp;
+ else
+ return (gethostbyname(name));
}
}

39
core/tcp_wrappers/07_all_sig.patch Executable file
View file

@ -0,0 +1,39 @@
--- tcp_wrappers_7.6/hosts_access.c.sig 2003-02-10 16:18:31.000000000 +0100
+++ tcp_wrappers_7.6/hosts_access.c 2003-02-10 16:50:38.000000000 +0100
@@ -66,6 +66,7 @@
#define YES 1
#define NO 0
+#define ERR -1
/*
* These variables are globally visible so that they can be redirected in
@@ -106,7 +107,6 @@
struct request_info *request;
{
int verdict;
-
/*
* If the (daemon, client) pair is matched by an entry in the file
* /etc/hosts.allow, access is granted. Otherwise, if the (daemon,
@@ -129,9 +129,9 @@
return (verdict == AC_PERMIT);
if (table_match(hosts_allow_table, request))
return (YES);
- if (table_match(hosts_deny_table, request))
- return (NO);
- return (YES);
+ if (table_match(hosts_deny_table, request) == NO)
+ return (YES);
+ return (NO);
}
/* table_match - match table entries with (daemon, client) pair */
@@ -175,6 +175,7 @@
(void) fclose(fp);
} else if (errno != ENOENT) {
tcpd_warn("cannot open %s: %m", table);
+ match = ERR;
}
if (match) {
if (hosts_access_verbose > 1)

27
core/tcp_wrappers/08_all_strerror.patch Executable file
View file

@ -0,0 +1,27 @@
--- tcp-wrappers-7.6/percent_m.c
+++ tcp-wrappers-7.6/percent_m.c
@@ -13,7 +13,7 @@
#include <string.h>
extern int errno;
-#ifndef SYS_ERRLIST_DEFINED
+#if !defined(SYS_ERRLIST_DEFINED) && !defined(HAVE_STRERROR)
extern char *sys_errlist[];
extern int sys_nerr;
#endif
@@ -29,11 +29,15 @@
while (*bp = *cp)
if (*cp == '%' && cp[1] == 'm') {
+#ifdef HAVE_STRERROR
+ strcpy(bp, strerror(errno));
+#else
if (errno < sys_nerr && errno > 0) {
strcpy(bp, sys_errlist[errno]);
} else {
sprintf(bp, "Unknown error %d", errno);
}
+#endif
bp += strlen(bp);
cp += 2;
} else {

12
core/tcp_wrappers/09_all_gcc-3.4.patch Executable file
View file

@ -0,0 +1,12 @@
diff -udrN tcp_wrappers_7.6/scaffold.c tcp_wrappers_7.6_modified/scaffold.c
--- tcp_wrappers_7.6/scaffold.c 2004-04-20 23:35:41.971925008 +0000
+++ tcp_wrappers_7.6_modified/scaffold.c 2004-04-20 23:44:28.553872384 +0000
@@ -25,7 +25,7 @@
#define INADDR_NONE (-1) /* XXX should be 0xffffffff */
#endif
-extern char *malloc();
+
/* Application-specific. */

209
core/tcp_wrappers/10_all_more-headers.patch Executable file
View file

@ -0,0 +1,209 @@
--- tcp_wrappers_7.6/options.c
+++ tcp_wrappers_7.6/options.c
@@ -34,6 +34,8 @@
/* System libraries. */
+#include <unistd.h>
+#include <stdlib.h>
#include <sys/types.h>
#include <sys/param.h>
#include <sys/socket.h>
--- tcp_wrappers_7.6/safe_finger.c
+++ tcp_wrappers_7.6/safe_finger.c
@@ -20,6 +20,10 @@
/* System libraries */
+#include <unistd.h>
+#include <fcntl.h>
+#include <stdlib.h>
+#include <sys/wait.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <signal.h>
@@ -27,7 +31,7 @@
#include <ctype.h>
#include <pwd.h>
-extern void exit();
+int pipe_stdin(char **argv);
/* Local stuff */
--- tcp_wrappers_7.6/scaffold.c
+++ tcp_wrappers_7.6/scaffold.c
@@ -10,6 +10,7 @@
/* System libraries. */
+#include <stdlib.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/socket.h>
--- tcp_wrappers_7.6/shell_cmd.c
+++ tcp_wrappers_7.6/shell_cmd.c
@@ -14,6 +14,10 @@
/* System libraries. */
+#include <unistd.h>
+#include <stdlib.h>
+#include <fcntl.h>
+#include <sys/wait.h>
#include <sys/types.h>
#include <sys/param.h>
#include <signal.h>
@@ -25,8 +25,6 @@
#include <syslog.h>
#include <string.h>
-extern void exit();
-
/* Local stuff. */
#include "tcpd.h"
--- tcp_wrappers_7.6/tcpdchk.c
+++ tcp_wrappers_7.6/tcpdchk.c
@@ -20,6 +20,8 @@
/* System libraries. */
+#include <unistd.h>
+#include <stdlib.h>
#include <sys/types.h>
#include <sys/stat.h>
#ifdef INET6
@@ -35,11 +36,6 @@
#include <netdb.h>
#include <string.h>
-extern int errno;
-extern void exit();
-extern int optind;
-extern char *optarg;
-
#ifndef INADDR_NONE
#define INADDR_NONE (-1) /* XXX should be 0xffffffff */
#endif
--- tcp_wrappers_7.6/clean_exit.c
+++ tcp_wrappers_7.6/clean_exit.c
@@ -13,8 +13,8 @@
#endif
#include <stdio.h>
-
-extern void exit();
+#include <unistd.h>
+#include <stdlib.h>
#include "tcpd.h"
--- tcp_wrappers_7.6/hosts_access.c
+++ tcp_wrappers_7.6/hosts_access.c
@@ -23,6 +23,7 @@
/* System libraries. */
+#include <stdlib.h>
#include <sys/types.h>
#ifdef INT32_T
typedef uint32_t u_int32_t;
@@ -43,8 +44,7 @@
#include <netdb.h>
#endif
-extern char *fgets();
-extern int errno;
+int match_pattern_ylo(const char *s, const char *pattern);
#ifndef INADDR_NONE
#define INADDR_NONE (-1) /* XXX should be 0xffffffff */
--- tcp_wrappers_7.6/inetcf.c
+++ tcp_wrappers_7.6/inetcf.c
@@ -9,15 +9,14 @@
static char sccsid[] = "@(#) inetcf.c 1.7 97/02/12 02:13:23";
#endif
+#include <stdlib.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <stdio.h>
#include <errno.h>
#include <string.h>
-extern int errno;
-extern void exit();
-
+#include "scaffold.h"
#include "tcpd.h"
#include "inetcf.h"
--- tcp_wrappers_7.6/percent_x.c
+++ tcp_wrappers_7.6/percent_x.c
@@ -16,12 +16,12 @@
/* System libraries. */
+#include <unistd.h>
+#include <stdlib.h>
#include <stdio.h>
#include <syslog.h>
#include <string.h>
-extern void exit();
-
/* Local stuff. */
#include "tcpd.h"
--- tcp_wrappers_7.6/rfc931.c
+++ tcp_wrappers_7.6/rfc931.c
@@ -15,6 +15,7 @@
/* System libraries. */
+#include <unistd.h>
#include <stdio.h>
#include <syslog.h>
#include <sys/types.h>
--- tcp_wrappers_7.6/tcpd.c
+++ tcp_wrappers_7.6/tcpd.c
@@ -16,6 +16,7 @@
/* System libraries. */
+#include <unistd.h>
#include <sys/types.h>
#include <sys/param.h>
#include <sys/stat.h>
--- tcp_wrappers_7.6/tcpdmatch.c
+++ tcp_wrappers_7.6/tcpdmatch.c
@@ -19,6 +19,8 @@
/* System libraries. */
+#include <unistd.h>
+#include <stdlib.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/socket.h>
@@ -30,9 +32,6 @@
#include <setjmp.h>
#include <string.h>
-extern void exit();
-extern int optind;
-extern char *optarg;
#ifndef INADDR_NONE
#define INADDR_NONE (-1) /* XXX should be 0xffffffff */
--- tcp_wrappers_7.6/update.c
+++ tcp_wrappers_7.6/update.c
@@ -19,6 +19,7 @@
/* System libraries */
+#include <unistd.h>
#include <stdio.h>
#include <syslog.h>
#include <string.h>

41
core/tcp_wrappers/11_inet6_fixes.patch Normal file
View file

@ -0,0 +1,41 @@
--- Makefile.old 2009-10-28 10:37:40.138328073 +0100
+++ Makefile 2009-10-28 10:37:57.014326831 +0100
@@ -154,7 +154,7 @@
@make REAL_DAEMON_DIR=$(REAL_DAEMON_DIR) STYLE=$(STYLE) \
LIBS=$(MYLIB) RANLIB=ranlib ARFLAGS=rv AUX_OBJ=weak_symbols.o \
NETGROUP=-DNETGROUP TLI= VSYSLOG= BUGS= all \
- EXTRA_CFLAGS="-DSYS_ERRLIST_DEFINED -DHAVE_WEAKSYMS -D_REENTRANT"
+ EXTRA_CFLAGS="-DINET6 -DSYS_ERRLIST_DEFINED -DHAVE_WEAKSYMS -D_REENTRANT"
gnu:
@make REAL_DAEMON_DIR=$(REAL_DAEMON_DIR) STYLE=$(STYLE) \
--- tcpd.h.old 2009-10-28 10:48:19.285326834 +0100
+++ tcpd.h 2009-10-28 10:47:32.951325793 +0100
@@ -91,7 +91,11 @@
extern void shell_cmd __P((char *)); /* execute shell command */
extern char *percent_x __P((char *, int, char *, struct request_info *)); /* do %<char> expansion */
+#ifdef INET6
+extern void rfc931 __P((struct sockaddr *, struct sockaddr *, char *)); /* client name from RFC 931 daemon */
+#else
extern void rfc931 __P((struct sockaddr_in *, struct sockaddr_in *, char *)); /* client name from RFC 931 daemon */
+#endif
extern void clean_exit __P((struct request_info *)); /* clean up and exit */
extern void refuse __P((struct request_info *)); /* clean up and exit */
extern char *xgets __P((char *, int, FILE *)); /* fgets() on steroids */
--- scaffold.c.old 2009-10-28 10:50:13.584449353 +0100
+++ scaffold.c 2009-10-28 10:52:53.765443023 +0100
@@ -182,8 +237,13 @@
/* ARGSUSED */
void rfc931(rmt_sin, our_sin, dest)
+#ifdef INET6
+struct sockaddr *rmt_sin;
+struct sockaddr *our_sin;
+#else
struct sockaddr_in *rmt_sin;
struct sockaddr_in *our_sin;
+#endif
char *dest;
{
strcpy(dest, unknown);

73
core/tcp_wrappers/PKGBUILD Executable file
View file

@ -0,0 +1,73 @@
# $Id: PKGBUILD 67074 2010-02-02 22:47:03Z tpowa $
# Maintainer: judd <jvinet@zeroflux.org>
pkgname=tcp_wrappers
pkgver=7.6
pkgrel=11
pkgdesc="Monitors and Controls incoming TCP connections"
arch=(i686 x86_64)
url="ftp://ftp.porcupine.org/pub/security/index.html"
license=('custom')
groups=('base')
backup=(etc/hosts.allow etc/hosts.deny)
depends=('bash' 'glibc')
source=(ftp://ftp.porcupine.org/pub/security/${pkgname}_$pkgver.tar.gz
hosts.allow
hosts.deny
try-from.8
safe_finger.8
shared_lib_plus_plus-1.patch
01_all_redhat-bug11881.patch
02_all_redhat-bug17795.patch
03_all_wildcard.patch
04_all_fixgethostbyname.patch
07_all_sig.patch
08_all_strerror.patch
09_all_gcc-3.4.patch
10_all_more-headers.patch
11_inet6_fixes.patch
tcp-wrappers-7.6-ipv6-1.14.patch)
md5sums=('e6fa25f71226d090f34de3f6b122fb5a'
'18fda096b93199ed866edd935061c48c'
'a0ee30f6aeaca241c4d44f7c177eca6b'
'4a8f40f9a69f0848df92b232072e8561'
'1a6d7b11abb1fd69ace775d02a1c72cf'
'99345104130b91cb151af9d87eee1449'
'e7ac7ae271703eacf175d597d329e11a'
'2790301fbf1b4711e75d5b799b6d4ac8'
'd286da9fca993f8afa89631133312151'
'97d4d81faaecf0958eeb52c45df71e34'
'374b8179b8d5c71979008c6a775d658e'
'801292cacf14a92e2784b925e72a1db1'
'0978932f49aae33834a46e189ace7d77'
'68b1c7f82fed60b446b00f6de27c3b9f'
'bd0af9dedcacd594e0715de800fc1b57'
'9154c38e3fb69d12b5bfb2fc5284314f')
build() {
cd $srcdir/${pkgname}_$pkgver
# add gentoo / fedora / redhat patches
patch -Np1 -i ../shared_lib_plus_plus-1.patch || return 1
patch -Np1 -i ../01_all_redhat-bug11881.patch || return 1
patch -Np0 -i ../02_all_redhat-bug17795.patch || return 1
patch -Np0 -i ../03_all_wildcard.patch || return 1
patch -Np1 -i ../04_all_fixgethostbyname.patch || return 1
patch -Np1 -i ../07_all_sig.patch || return 1
patch -Np1 -i ../09_all_gcc-3.4.patch || return 1
patch -Np1 -i ../10_all_more-headers.patch || return 1
patch -Np2 -i ../tcp-wrappers-7.6-ipv6-1.14.patch || return 1
make REAL_DAEMON_DIR=/usr/sbin STYLE=-DPROCESS_OPTIONS linux || return 1
# dumb makefile
mkdir -p $pkgdir/usr/{include,lib,sbin}
mkdir -p $pkgdir/usr/share/man/man{3,5,8}
make DESTDIR=$pkgdir install
install -D -m644 ../hosts.allow $pkgdir/etc/hosts.allow
install -D -m644 ../hosts.deny $pkgdir/etc/hosts.deny
# add manpage symlinks for hosts.deny and hosts.allow
cd $pkgdir/usr/share/man/man5
ln -s hosts_access.5.gz hosts.allow.5.gz
ln -s hosts_access.5.gz hosts.deny.5.gz
# install license
mkdir -p $pkgdir/usr/share/licenses/$pkgname
install -m644 $srcdir/${pkgname}_$pkgver/DISCLAIMER $pkgdir/usr/share/licenses/$pkgname/license.txt
}

5
core/tcp_wrappers/hosts.allow Normal file
View file

@ -0,0 +1,5 @@
#
# /etc/hosts.allow
#
sshd: ALL
# End of file

7
core/tcp_wrappers/hosts.deny Executable file
View file

@ -0,0 +1,7 @@
#
# /etc/hosts.deny
#
ALL: ALL: DENY
# End of file

34
core/tcp_wrappers/safe_finger.8 Executable file
View file

@ -0,0 +1,34 @@
.TH SAFE_FINGER 8 "21th June 1997" Linux "Linux Programmer's Manual"
.SH NAME
safe_finger \- finger client wrapper that protects against nasty stuff
from finger servers
.SH SYNOPSIS
.B safe_finger [finger_options]
.SH DESCRIPTION
The
.B safe_finger
command protects against nasty stuff from finger servers. Use this
program for automatic reverse finger probes from the
.B tcp_wrapper
.B (tcpd)
, not the raw finger command. The
.B safe_finger
command makes sure that the finger client is not run with root
privileges. It also runs the finger client with a defined PATH
environment.
.B safe_finger
will also protect you from problems caused by the output of some
finger servers. The problem: some programs may react to stuff in
the first column. Other programs may get upset by thrash anywhere
on a line. File systems may fill up as the finger server keeps
sending data. Text editors may bomb out on extremely long lines.
The finger server may take forever because it is somehow wedged.
.B safe_finger
takes care of all this badness.
.SH SEE ALSO
.BR hosts_access (5),
.BR hosts_options (5),
.BR tcpd (8)
.SH AUTHOR
Wietse Venema, Eindhoven University of Technology, The Netherlands.

784
core/tcp_wrappers/shared_lib_plus_plus-1.patch Executable file
View file

@ -0,0 +1,784 @@
diff -Naur tcp_wrappers_7.6/Makefile tcp_wrappers_7.6.gimli/Makefile
--- tcp_wrappers_7.6/Makefile 1997-03-21 12:27:21.000000000 -0600
+++ tcp_wrappers_7.6.gimli/Makefile 2002-07-15 16:07:21.000000000 -0500
@@ -1,5 +1,10 @@
+GLIBC=$(shell grep -s -c __GLIBC__ /usr/include/features.h)
+
# @(#) Makefile 1.23 97/03/21 19:27:20
+# unset the HOSTNAME environment variable
+HOSTNAME =
+
what:
@echo
@echo "Usage: edit the REAL_DAEMON_DIR definition in the Makefile then:"
@@ -19,7 +24,7 @@
@echo " generic (most bsd-ish systems with sys5 compatibility)"
@echo " 386bsd aix alpha apollo bsdos convex-ultranet dell-gcc dgux dgux543"
@echo " dynix epix esix freebsd hpux irix4 irix5 irix6 isc iunix"
- @echo " linux machten mips(untested) ncrsvr4 netbsd next osf power_unix_211"
+ @echo " linux gnu machten mips(untested) ncrsvr4 netbsd next osf power_unix_211"
@echo " ptx-2.x ptx-generic pyramid sco sco-nis sco-od2 sco-os5 sinix sunos4"
@echo " sunos40 sunos5 sysv4 tandem ultrix unicos7 unicos8 unixware1 unixware2"
@echo " uts215 uxp"
@@ -43,8 +48,8 @@
# Ultrix 4.x SunOS 4.x ConvexOS 10.x Dynix/ptx
#REAL_DAEMON_DIR=/usr/etc
#
-# SysV.4 Solaris 2.x OSF AIX
-#REAL_DAEMON_DIR=/usr/sbin
+# SysV.4 Solaris 2.x OSF AIX Linux
+REAL_DAEMON_DIR=/usr/sbin
#
# BSD 4.4
#REAL_DAEMON_DIR=/usr/libexec
@@ -141,10 +146,21 @@
LIBS= RANLIB=ranlib ARFLAGS=rv AUX_OBJ= NETGROUP= TLI= \
EXTRA_CFLAGS=-DSYS_ERRLIST_DEFINED VSYSLOG= all
+ifneq ($(GLIBC),0)
+MYLIB=-lnsl
+endif
+
linux:
@make REAL_DAEMON_DIR=$(REAL_DAEMON_DIR) STYLE=$(STYLE) \
- LIBS= RANLIB=ranlib ARFLAGS=rv AUX_OBJ=setenv.o \
- NETGROUP= TLI= EXTRA_CFLAGS="-DBROKEN_SO_LINGER" all
+ LIBS=$(MYLIB) RANLIB=ranlib ARFLAGS=rv AUX_OBJ=weak_symbols.o \
+ NETGROUP=-DNETGROUP TLI= VSYSLOG= BUGS= all \
+ EXTRA_CFLAGS="-DSYS_ERRLIST_DEFINED -DHAVE_WEAKSYMS -D_REENTRANT"
+
+gnu:
+ @make REAL_DAEMON_DIR=$(REAL_DAEMON_DIR) STYLE=$(STYLE) \
+ LIBS=$(MYLIB) RANLIB=ranlib ARFLAGS=rv AUX_OBJ=weak_symbols.o \
+ NETGROUP=-DNETGROUP TLI= VSYSLOG= BUGS= all \
+ EXTRA_CFLAGS="-DHAVE_STRERROR -DHAVE_WEAKSYMS -D_REENTRANT"
# This is good for many SYSV+BSD hybrids with NIS, probably also for HP-UX 7.x.
hpux hpux8 hpux9 hpux10:
@@ -391,7 +407,7 @@
# the ones provided with this source distribution. The environ.c module
# implements setenv(), getenv(), and putenv().
-AUX_OBJ= setenv.o
+#AUX_OBJ= setenv.o
#AUX_OBJ= environ.o
#AUX_OBJ= environ.o strcasecmp.o
@@ -454,7 +470,8 @@
# host name aliases. Compile with -DSOLARIS_24_GETHOSTBYNAME_BUG to work
# around this. The workaround does no harm on other Solaris versions.
-BUGS = -DGETPEERNAME_BUG -DBROKEN_FGETS -DLIBC_CALLS_STRTOK
+BUGS =
+#BUGS = -DGETPEERNAME_BUG -DBROKEN_FGETS -DLIBC_CALLS_STRTOK
#BUGS = -DGETPEERNAME_BUG -DBROKEN_FGETS -DINET_ADDR_BUG
#BUGS = -DGETPEERNAME_BUG -DBROKEN_FGETS -DSOLARIS_24_GETHOSTBYNAME_BUG
@@ -464,7 +481,7 @@
# If your system supports NIS or YP-style netgroups, enable the following
# macro definition. Netgroups are used only for host access control.
#
-#NETGROUP= -DNETGROUP
+NETGROUP= -DNETGROUP
###############################################################
# System dependencies: whether or not your system has vsyslog()
@@ -491,7 +508,7 @@
# Uncomment the next definition to turn on the language extensions
# (examples: allow, deny, banners, twist and spawn).
#
-#STYLE = -DPROCESS_OPTIONS # Enable language extensions.
+STYLE = -DPROCESS_OPTIONS # Enable language extensions.
################################################################
# Optional: Changing the default disposition of logfile records
@@ -514,7 +531,7 @@
#
# The LOG_XXX names below are taken from the /usr/include/syslog.h file.
-FACILITY= LOG_MAIL # LOG_MAIL is what most sendmail daemons use
+FACILITY= LOG_DAEMON # LOG_MAIL is what most sendmail daemons use
# The syslog priority at which successful connections are logged.
@@ -610,7 +627,7 @@
# Paranoid mode implies hostname lookup. In order to disable hostname
# lookups altogether, see the next section.
-PARANOID= -DPARANOID
+#PARANOID= -DPARANOID
########################################
# Optional: turning off hostname lookups
@@ -623,7 +640,7 @@
# In order to perform selective hostname lookups, disable paranoid
# mode (see previous section) and comment out the following definition.
-HOSTNAME= -DALWAYS_HOSTNAME
+#HOSTNAME= -DALWAYS_HOSTNAME
#############################################
# Optional: Turning on host ADDRESS checking
@@ -649,28 +666,46 @@
# source-routed traffic in the kernel. Examples: 4.4BSD derivatives,
# Solaris 2.x, and Linux. See your system documentation for details.
#
-# KILL_OPT= -DKILL_IP_OPTIONS
+KILL_OPT= -DKILL_IP_OPTIONS
## End configuration options
############################
# Protection against weird shells or weird make programs.
+CC = gcc
SHELL = /bin/sh
-.c.o:; $(CC) $(CFLAGS) -c $*.c
+.c.o:; $(CC) $(CFLAGS) -o $*.o -c $*.c
+
+SOMAJOR = 0
+SOMINOR = 7.6
+
+LIB = libwrap.a
+SHLIB = shared/libwrap.so.$(SOMAJOR).$(SOMINOR)
+SHLIBSOMAJ= shared/libwrap.so.$(SOMAJOR)
+SHLIBSO = shared/libwrap.so
+SHLIBFLAGS = -Lshared -lwrap
-CFLAGS = -O -DFACILITY=$(FACILITY) $(ACCESS) $(PARANOID) $(NETGROUP) \
+shared/%.o: %.c
+ $(CC) $(CFLAGS) $(SHCFLAGS) -c $< -o $@
+
+CFLAGS = -O2 -DFACILITY=$(FACILITY) $(ACCESS) $(PARANOID) $(NETGROUP) \
$(BUGS) $(SYSTYPE) $(AUTH) $(UMASK) \
-DREAL_DAEMON_DIR=\"$(REAL_DAEMON_DIR)\" $(STYLE) $(KILL_OPT) \
-DSEVERITY=$(SEVERITY) -DRFC931_TIMEOUT=$(RFC931_TIMEOUT) \
$(UCHAR) $(TABLES) $(STRINGS) $(TLI) $(EXTRA_CFLAGS) $(DOT) \
$(VSYSLOG) $(HOSTNAME)
+SHLINKFLAGS = -shared -Xlinker -soname -Xlinker libwrap.so.$(SOMAJOR) -lc $(LIBS)
+SHCFLAGS = -fPIC -shared -D_REENTRANT
+
LIB_OBJ= hosts_access.o options.o shell_cmd.o rfc931.o eval.o \
hosts_ctl.o refuse.o percent_x.o clean_exit.o $(AUX_OBJ) \
$(FROM_OBJ) fix_options.o socket.o tli.o workarounds.o \
update.o misc.o diag.o percent_m.o myvsyslog.o
+SHLIB_OBJ= $(addprefix shared/, $(LIB_OBJ));
+
FROM_OBJ= fromhost.o
KIT = README miscd.c tcpd.c fromhost.c hosts_access.c shell_cmd.c \
@@ -684,46 +719,80 @@
refuse.c tcpdchk.8 setenv.c inetcf.c inetcf.h scaffold.c \
scaffold.h tcpdmatch.8 README.NIS
-LIB = libwrap.a
-
-all other: config-check tcpd tcpdmatch try-from safe_finger tcpdchk
+all other: config-check tcpd tcpdmatch try-from safe_finger tcpdchk $(LIB)
# Invalidate all object files when the compiler options (CFLAGS) have changed.
config-check:
@set +e; test -n "$(REAL_DAEMON_DIR)" || { make; exit 1; }
- @set +e; echo $(CFLAGS) >/tmp/cflags.$$$$ ; \
- if cmp cflags /tmp/cflags.$$$$ ; \
- then rm /tmp/cflags.$$$$ ; \
- else mv /tmp/cflags.$$$$ cflags ; \
+ @set +e; echo $(CFLAGS) >cflags.new ; \
+ if cmp cflags cflags.new ; \
+ then rm cflags.new ; \
+ else mv cflags.new cflags ; \
fi >/dev/null 2>/dev/null
+ @if [ ! -d shared ]; then mkdir shared; fi
$(LIB): $(LIB_OBJ)
rm -f $(LIB)
$(AR) $(ARFLAGS) $(LIB) $(LIB_OBJ)
-$(RANLIB) $(LIB)
-tcpd: tcpd.o $(LIB)
- $(CC) $(CFLAGS) -o $@ tcpd.o $(LIB) $(LIBS)
+$(SHLIB): $(SHLIB_OBJ)
+ rm -f $(SHLIB)
+ $(CC) -o $(SHLIB) $(SHLINKFLAGS) $(SHLIB_OBJ)
+ ln -s $(notdir $(SHLIB)) $(SHLIBSOMAJ)
+ ln -s $(notdir $(SHLIBSOMAJ)) $(SHLIBSO)
+
+tcpd: tcpd.o $(SHLIB)
+ $(CC) $(CFLAGS) -o $@ tcpd.o $(SHLIBFLAGS)
-miscd: miscd.o $(LIB)
- $(CC) $(CFLAGS) -o $@ miscd.o $(LIB) $(LIBS)
+miscd: miscd.o $(SHLIB)
+ $(CC) $(CFLAGS) -o $@ miscd.o $(SHLIBFLAGS)
-safe_finger: safe_finger.o $(LIB)
- $(CC) $(CFLAGS) -o $@ safe_finger.o $(LIB) $(LIBS)
+safe_finger: safe_finger.o $(SHLIB)
+ $(CC) $(CFLAGS) -o $@ safe_finger.o $(SHLIBFLAGS)
TCPDMATCH_OBJ = tcpdmatch.o fakelog.o inetcf.o scaffold.o
-tcpdmatch: $(TCPDMATCH_OBJ) $(LIB)
- $(CC) $(CFLAGS) -o $@ $(TCPDMATCH_OBJ) $(LIB) $(LIBS)
+tcpdmatch: $(TCPDMATCH_OBJ) $(SHLIB)
+ $(CC) $(CFLAGS) -o $@ $(TCPDMATCH_OBJ) $(SHLIBFLAGS)
-try-from: try-from.o fakelog.o $(LIB)
- $(CC) $(CFLAGS) -o $@ try-from.o fakelog.o $(LIB) $(LIBS)
+try-from: try-from.o fakelog.o $(SHLIB)
+ $(CC) $(CFLAGS) -o $@ try-from.o fakelog.o $(SHLIBFLAGS)
TCPDCHK_OBJ = tcpdchk.o fakelog.o inetcf.o scaffold.o
-tcpdchk: $(TCPDCHK_OBJ) $(LIB)
- $(CC) $(CFLAGS) -o $@ $(TCPDCHK_OBJ) $(LIB) $(LIBS)
+tcpdchk: $(TCPDCHK_OBJ) $(SHLIB)
+ $(CC) $(CFLAGS) -o $@ $(TCPDCHK_OBJ) $(SHLIBFLAGS)
+
+install: install-lib install-bin install-dev
+
+install-lib:
+ install -o root -g root -m 0755 $(SHLIB) ${DESTDIR}/usr/lib/
+ ln -sf $(notdir $(SHLIB)) ${DESTDIR}/usr/lib/$(notdir $(SHLIBSOMAJ))
+ ln -sf $(notdir $(SHLIBSOMAJ)) ${DESTDIR}/usr/lib/$(notdir $(SHLIBSO))
+
+install-bin:
+ install -o root -g root -m 0755 tcpd ${DESTDIR}/usr/sbin/
+ install -o root -g root -m 0755 tcpdchk ${DESTDIR}/usr/sbin/
+ install -o root -g root -m 0755 tcpdmatch ${DESTDIR}/usr/sbin/
+ install -o root -g root -m 0755 try-from ${DESTDIR}/usr/sbin/
+ install -o root -g root -m 0755 safe_finger ${DESTDIR}/usr/sbin/
+ install -o root -g root -m 0644 tcpd.8 ${DESTDIR}/usr/share/man/man8/
+ install -o root -g root -m 0644 tcpdchk.8 ${DESTDIR}/usr/share/man/man8/
+ install -o root -g root -m 0644 try-from.8 ${DESTDIR}/usr/share/man/man8/
+ install -o root -g root -m 0644 tcpdmatch.8 ${DESTDIR}/usr/share/man/man8/
+ install -o root -g root -m 0644 safe_finger.8 ${DESTDIR}/usr/share/man/man8/
+ install -o root -g root -m 0644 hosts_access.5 ${DESTDIR}/usr/share/man/man5/
+ install -o root -g root -m 0644 hosts_options.5 ${DESTDIR}/usr/share/man/man5/
+
+install-dev:
+ install -o root -g root -m 0644 hosts_access.3 ${DESTDIR}/usr/share/man/man3/
+ install -o root -g root -m 0644 tcpd.h ${DESTDIR}/usr/include/
+ install -o root -g root -m 0644 $(LIB) ${DESTDIR}/usr/lib/
+ ln -sf hosts_access.3 ${DESTDIR}/usr/share/man/man3/hosts_ctl.3
+ ln -sf hosts_access.3 ${DESTDIR}/usr/share/man/man3/request_init.3
+ ln -sf hosts_access.3 ${DESTDIR}/usr/share/man/man3/request_set.3
shar: $(KIT)
@shar $(KIT)
@@ -739,7 +808,8 @@
clean:
rm -f tcpd miscd safe_finger tcpdmatch tcpdchk try-from *.[oa] core \
- cflags
+ cflags libwrap*.so*
+ rm -rf shared
tidy: clean
chmod -R a+r .
@@ -885,5 +955,6 @@
update.o: mystdarg.h
update.o: tcpd.h
vfprintf.o: cflags
+weak_symbols.o: tcpd.h
workarounds.o: cflags
workarounds.o: tcpd.h
diff -Naur tcp_wrappers_7.6/hosts_access.3 tcp_wrappers_7.6.gimli/hosts_access.3
--- tcp_wrappers_7.6/hosts_access.3 1996-02-11 10:01:27.000000000 -0600
+++ tcp_wrappers_7.6.gimli/hosts_access.3 2002-01-07 08:50:19.000000000 -0600
@@ -3,7 +3,7 @@
hosts_access, hosts_ctl, request_init, request_set \- access control library
.SH SYNOPSIS
.nf
-#include "tcpd.h"
+#include <tcpd.h>
extern int allow_severity;
extern int deny_severity;
diff -Naur tcp_wrappers_7.6/hosts_options.5 tcp_wrappers_7.6.gimli/hosts_options.5
--- tcp_wrappers_7.6/hosts_options.5 1994-12-28 10:42:29.000000000 -0600
+++ tcp_wrappers_7.6.gimli/hosts_options.5 2002-01-07 08:50:19.000000000 -0600
@@ -58,12 +58,12 @@
Execute, in a child process, the specified shell command, after
performing the %<letter> expansions described in the hosts_access(5)
manual page. The command is executed with stdin, stdout and stderr
-connected to the null device, so that it won\'t mess up the
+connected to the null device, so that it won't mess up the
conversation with the client host. Example:
.sp
.nf
.ti +3
-spawn (/some/where/safe_finger -l @%h | /usr/ucb/mail root) &
+spawn (/usr/sbin/safe_finger -l @%h | /usr/bin/mail root) &
.fi
.sp
executes, in a background child process, the shell command "safe_finger
diff -Naur tcp_wrappers_7.6/options.c tcp_wrappers_7.6.gimli/options.c
--- tcp_wrappers_7.6/options.c 1996-02-11 10:01:32.000000000 -0600
+++ tcp_wrappers_7.6.gimli/options.c 2002-01-07 08:50:19.000000000 -0600
@@ -473,6 +473,9 @@
#ifdef LOG_CRON
"cron", LOG_CRON,
#endif
+#ifdef LOG_FTP
+ "ftp", LOG_FTP,
+#endif
#ifdef LOG_LOCAL0
"local0", LOG_LOCAL0,
#endif
diff -Naur tcp_wrappers_7.6/percent_m.c tcp_wrappers_7.6.gimli/percent_m.c
--- tcp_wrappers_7.6/percent_m.c 1994-12-28 10:42:37.000000000 -0600
+++ tcp_wrappers_7.6.gimli/percent_m.c 2002-01-07 08:50:19.000000000 -0600
@@ -13,7 +13,7 @@
#include <string.h>
extern int errno;
-#ifndef SYS_ERRLIST_DEFINED
+#if !defined(SYS_ERRLIST_DEFINED) && !defined(HAVE_STRERROR)
extern char *sys_errlist[];
extern int sys_nerr;
#endif
@@ -29,11 +29,15 @@
while (*bp = *cp)
if (*cp == '%' && cp[1] == 'm') {
+#ifdef HAVE_STRERROR
+ strcpy(bp, strerror(errno));
+#else
if (errno < sys_nerr && errno > 0) {
strcpy(bp, sys_errlist[errno]);
} else {
sprintf(bp, "Unknown error %d", errno);
}
+#endif
bp += strlen(bp);
cp += 2;
} else {
diff -Naur tcp_wrappers_7.6/rfc931.c tcp_wrappers_7.6.gimli/rfc931.c
--- tcp_wrappers_7.6/rfc931.c 1995-01-02 09:11:34.000000000 -0600
+++ tcp_wrappers_7.6.gimli/rfc931.c 2002-01-07 08:50:19.000000000 -0600
@@ -33,7 +33,7 @@
int rfc931_timeout = RFC931_TIMEOUT;/* Global so it can be changed */
-static jmp_buf timebuf;
+static sigjmp_buf timebuf;
/* fsocket - open stdio stream on top of socket */
@@ -62,7 +62,7 @@
static void timeout(sig)
int sig;
{
- longjmp(timebuf, sig);
+ siglongjmp(timebuf, sig);
}
/* rfc931 - return remote user name, given socket structures */
@@ -99,7 +99,7 @@
* Set up a timer so we won't get stuck while waiting for the server.
*/
- if (setjmp(timebuf) == 0) {
+ if (sigsetjmp(timebuf,1) == 0) {
signal(SIGALRM, timeout);
alarm(rfc931_timeout);
diff -Naur tcp_wrappers_7.6/safe_finger.8 tcp_wrappers_7.6.gimli/safe_finger.8
--- tcp_wrappers_7.6/safe_finger.8 1969-12-31 18:00:00.000000000 -0600
+++ tcp_wrappers_7.6.gimli/safe_finger.8 2002-01-07 08:50:19.000000000 -0600
@@ -0,0 +1,34 @@
+.TH SAFE_FINGER 8 "21th June 1997" Linux "Linux Programmer's Manual"
+.SH NAME
+safe_finger \- finger client wrapper that protects against nasty stuff
+from finger servers
+.SH SYNOPSIS
+.B safe_finger [finger_options]
+.SH DESCRIPTION
+The
+.B safe_finger
+command protects against nasty stuff from finger servers. Use this
+program for automatic reverse finger probes from the
+.B tcp_wrapper
+.B (tcpd)
+, not the raw finger command. The
+.B safe_finger
+command makes sure that the finger client is not run with root
+privileges. It also runs the finger client with a defined PATH
+environment.
+.B safe_finger
+will also protect you from problems caused by the output of some
+finger servers. The problem: some programs may react to stuff in
+the first column. Other programs may get upset by thrash anywhere
+on a line. File systems may fill up as the finger server keeps
+sending data. Text editors may bomb out on extremely long lines.
+The finger server may take forever because it is somehow wedged.
+.B safe_finger
+takes care of all this badness.
+.SH SEE ALSO
+.BR hosts_access (5),
+.BR hosts_options (5),
+.BR tcpd (8)
+.SH AUTHOR
+Wietse Venema, Eindhoven University of Technology, The Netherlands.
+
diff -Naur tcp_wrappers_7.6/safe_finger.c tcp_wrappers_7.6.gimli/safe_finger.c
--- tcp_wrappers_7.6/safe_finger.c 1994-12-28 10:42:42.000000000 -0600
+++ tcp_wrappers_7.6.gimli/safe_finger.c 2002-01-07 08:50:19.000000000 -0600
@@ -26,21 +26,24 @@
#include <stdio.h>
#include <ctype.h>
#include <pwd.h>
+#include <syslog.h>
extern void exit();
/* Local stuff */
-char path[] = "PATH=/bin:/usr/bin:/usr/ucb:/usr/bsd:/etc:/usr/etc:/usr/sbin";
+char path[] = "PATH=/bin:/usr/bin:/sbin:/usr/sbin";
#define TIME_LIMIT 60 /* Do not keep listinging forever */
#define INPUT_LENGTH 100000 /* Do not keep listinging forever */
#define LINE_LENGTH 128 /* Editors can choke on long lines */
#define FINGER_PROGRAM "finger" /* Most, if not all, UNIX systems */
#define UNPRIV_NAME "nobody" /* Preferred privilege level */
-#define UNPRIV_UGID 32767 /* Default uid and gid */
+#define UNPRIV_UGID 65534 /* Default uid and gid */
int finger_pid;
+int allow_severity = SEVERITY;
+int deny_severity = LOG_WARNING;
void cleanup(sig)
int sig;
diff -Naur tcp_wrappers_7.6/scaffold.c tcp_wrappers_7.6.gimli/scaffold.c
--- tcp_wrappers_7.6/scaffold.c 1997-03-21 12:27:24.000000000 -0600
+++ tcp_wrappers_7.6.gimli/scaffold.c 2002-01-07 08:50:19.000000000 -0600
@@ -180,10 +180,12 @@
/* ARGSUSED */
-void rfc931(request)
-struct request_info *request;
+void rfc931(rmt_sin, our_sin, dest)
+struct sockaddr_in *rmt_sin;
+struct sockaddr_in *our_sin;
+char *dest;
{
- strcpy(request->user, unknown);
+ strcpy(dest, unknown);
}
/* check_path - examine accessibility */
diff -Naur tcp_wrappers_7.6/tcpd.8 tcp_wrappers_7.6.gimli/tcpd.8
--- tcp_wrappers_7.6/tcpd.8 1996-02-21 09:39:16.000000000 -0600
+++ tcp_wrappers_7.6.gimli/tcpd.8 2002-01-07 08:50:19.000000000 -0600
@@ -94,7 +94,7 @@
.PP
The example assumes that the network daemons live in /usr/etc. On some
systems, network daemons live in /usr/sbin or in /usr/libexec, or have
-no `in.\' prefix to their name.
+no `in.' prefix to their name.
.SH EXAMPLE 2
This example applies when \fItcpd\fR expects that the network daemons
are left in their original place.
@@ -110,26 +110,26 @@
becomes:
.sp
.ti +5
-finger stream tcp nowait nobody /some/where/tcpd in.fingerd
+finger stream tcp nowait nobody /usr/sbin/tcpd in.fingerd
.sp
.fi
.PP
The example assumes that the network daemons live in /usr/etc. On some
systems, network daemons live in /usr/sbin or in /usr/libexec, the
-daemons have no `in.\' prefix to their name, or there is no userid
+daemons have no `in.' prefix to their name, or there is no userid
field in the inetd configuration file.
.PP
Similar changes will be needed for the other services that are to be
-covered by \fItcpd\fR. Send a `kill -HUP\' to the \fIinetd\fR(8)
+covered by \fItcpd\fR. Send a `kill -HUP' to the \fIinetd\fR(8)
process to make the changes effective. AIX users may also have to
-execute the `inetimp\' command.
+execute the `inetimp' command.
.SH EXAMPLE 3
In the case of daemons that do not live in a common directory ("secret"
or otherwise), edit the \fIinetd\fR configuration file so that it
specifies an absolute path name for the process name field. For example:
.nf
.sp
- ntalk dgram udp wait root /some/where/tcpd /usr/local/lib/ntalkd
+ ntalk dgram udp wait root /usr/sbin/tcpd /usr/sbin/in.ntalkd
.sp
.fi
.PP
diff -Naur tcp_wrappers_7.6/tcpd.h tcp_wrappers_7.6.gimli/tcpd.h
--- tcp_wrappers_7.6/tcpd.h 1996-03-19 09:22:25.000000000 -0600
+++ tcp_wrappers_7.6.gimli/tcpd.h 2002-01-07 08:50:19.000000000 -0600
@@ -4,6 +4,25 @@
* Author: Wietse Venema, Eindhoven University of Technology, The Netherlands.
*/
+#ifndef _TCPWRAPPERS_TCPD_H
+#define _TCPWRAPPERS_TCPD_H
+
+/* someone else may have defined this */
+#undef __P
+
+/* use prototypes if we have an ANSI C compiler or are using C++ */
+#if defined(__STDC__) || defined(__cplusplus)
+#define __P(args) args
+#else
+#define __P(args) ()
+#endif
+
+/* Need definitions of struct sockaddr_in and FILE. */
+#include <netinet/in.h>
+#include <stdio.h>
+
+__BEGIN_DECLS
+
/* Structure to describe one communications endpoint. */
#define STRING_LENGTH 128 /* hosts, users, processes */
@@ -25,10 +44,10 @@
char pid[10]; /* access via eval_pid(request) */
struct host_info client[1]; /* client endpoint info */
struct host_info server[1]; /* server endpoint info */
- void (*sink) (); /* datagram sink function or 0 */
- void (*hostname) (); /* address to printable hostname */
- void (*hostaddr) (); /* address to printable address */
- void (*cleanup) (); /* cleanup function or 0 */
+ void (*sink) __P((int)); /* datagram sink function or 0 */
+ void (*hostname) __P((struct host_info *)); /* address to printable hostname */
+ void (*hostaddr) __P((struct host_info *)); /* address to printable address */
+ void (*cleanup) __P((struct request_info *)); /* cleanup function or 0 */
struct netconfig *config; /* netdir handle */
};
@@ -61,25 +80,30 @@
/* Global functions. */
#if defined(TLI) || defined(PTX) || defined(TLI_SEQUENT)
-extern void fromhost(); /* get/validate client host info */
+extern void fromhost __P((struct request_info *)); /* get/validate client host info */
#else
#define fromhost sock_host /* no TLI support needed */
#endif
-extern int hosts_access(); /* access control */
-extern void shell_cmd(); /* execute shell command */
-extern char *percent_x(); /* do %<char> expansion */
-extern void rfc931(); /* client name from RFC 931 daemon */
-extern void clean_exit(); /* clean up and exit */
-extern void refuse(); /* clean up and exit */
-extern char *xgets(); /* fgets() on steroids */
-extern char *split_at(); /* strchr() and split */
-extern unsigned long dot_quad_addr(); /* restricted inet_addr() */
+extern void shell_cmd __P((char *)); /* execute shell command */
+extern char *percent_x __P((char *, int, char *, struct request_info *)); /* do %<char> expansion */
+extern void rfc931 __P((struct sockaddr_in *, struct sockaddr_in *, char *)); /* client name from RFC 931 daemon */
+extern void clean_exit __P((struct request_info *)); /* clean up and exit */
+extern void refuse __P((struct request_info *)); /* clean up and exit */
+extern char *xgets __P((char *, int, FILE *)); /* fgets() on steroids */
+extern char *split_at __P((char *, int)); /* strchr() and split */
+extern unsigned long dot_quad_addr __P((char *)); /* restricted inet_addr() */
/* Global variables. */
+#ifdef HAVE_WEAKSYMS
+extern int allow_severity __attribute__ ((weak)); /* for connection logging */
+extern int deny_severity __attribute__ ((weak)); /* for connection logging */
+#else
extern int allow_severity; /* for connection logging */
extern int deny_severity; /* for connection logging */
+#endif
+
extern char *hosts_allow_table; /* for verification mode redirection */
extern char *hosts_deny_table; /* for verification mode redirection */
extern int hosts_access_verbose; /* for verbose matching mode */
@@ -92,9 +116,14 @@
*/
#ifdef __STDC__
+extern int hosts_access(struct request_info *request);
+extern int hosts_ctl(char *daemon, char *client_name, char *client_addr,
+ char *client_user);
extern struct request_info *request_init(struct request_info *,...);
extern struct request_info *request_set(struct request_info *,...);
#else
+extern int hosts_access();
+extern int hosts_ctl();
extern struct request_info *request_init(); /* initialize request */
extern struct request_info *request_set(); /* update request structure */
#endif
@@ -117,27 +146,31 @@
* host_info structures serve as caches for the lookup results.
*/
-extern char *eval_user(); /* client user */
-extern char *eval_hostname(); /* printable hostname */
-extern char *eval_hostaddr(); /* printable host address */
-extern char *eval_hostinfo(); /* host name or address */
-extern char *eval_client(); /* whatever is available */
-extern char *eval_server(); /* whatever is available */
+extern char *eval_user __P((struct request_info *)); /* client user */
+extern char *eval_hostname __P((struct host_info *)); /* printable hostname */
+extern char *eval_hostaddr __P((struct host_info *)); /* printable host address */
+extern char *eval_hostinfo __P((struct host_info *)); /* host name or address */
+extern char *eval_client __P((struct request_info *)); /* whatever is available */
+extern char *eval_server __P((struct request_info *)); /* whatever is available */
#define eval_daemon(r) ((r)->daemon) /* daemon process name */
#define eval_pid(r) ((r)->pid) /* process id */
/* Socket-specific methods, including DNS hostname lookups. */
-extern void sock_host(); /* look up endpoint addresses */
-extern void sock_hostname(); /* translate address to hostname */
-extern void sock_hostaddr(); /* address to printable address */
+/* look up endpoint addresses */
+extern void sock_host __P((struct request_info *));
+/* translate address to hostname */
+extern void sock_hostname __P((struct host_info *));
+/* address to printable address */
+extern void sock_hostaddr __P((struct host_info *));
+
#define sock_methods(r) \
{ (r)->hostname = sock_hostname; (r)->hostaddr = sock_hostaddr; }
/* The System V Transport-Level Interface (TLI) interface. */
#if defined(TLI) || defined(PTX) || defined(TLI_SEQUENT)
-extern void tli_host(); /* look up endpoint addresses etc. */
+extern void tli_host __P((struct request_info *)); /* look up endpoint addresses etc. */
#endif
/*
@@ -178,7 +211,7 @@
* behavior.
*/
-extern void process_options(); /* execute options */
+extern void process_options __P((char *, struct request_info *)); /* execute options */
extern int dry_run; /* verification flag */
/* Bug workarounds. */
@@ -217,3 +250,7 @@
#define strtok my_strtok
extern char *my_strtok();
#endif
+
+__END_DECLS
+
+#endif /* tcpd.h */
diff -Naur tcp_wrappers_7.6/tcpdchk.c tcp_wrappers_7.6.gimli/tcpdchk.c
--- tcp_wrappers_7.6/tcpdchk.c 1997-02-11 19:13:25.000000000 -0600
+++ tcp_wrappers_7.6.gimli/tcpdchk.c 2002-01-07 08:50:19.000000000 -0600
@@ -350,6 +350,8 @@
{
if (pat[0] == '@') {
tcpd_warn("%s: daemon name begins with \"@\"", pat);
+ } else if (pat[0] == '/') {
+ tcpd_warn("%s: daemon name begins with \"/\"", pat);
} else if (pat[0] == '.') {
tcpd_warn("%s: daemon name begins with dot", pat);
} else if (pat[strlen(pat) - 1] == '.') {
@@ -382,6 +384,8 @@
{
if (pat[0] == '@') { /* @netgroup */
tcpd_warn("%s: user name begins with \"@\"", pat);
+ } else if (pat[0] == '/') {
+ tcpd_warn("%s: user name begins with \"/\"", pat);
} else if (pat[0] == '.') {
tcpd_warn("%s: user name begins with dot", pat);
} else if (pat[strlen(pat) - 1] == '.') {
@@ -402,8 +406,13 @@
static int check_host(pat)
char *pat;
{
+ char buf[BUFSIZ];
char *mask;
int addr_count = 1;
+ FILE *fp;
+ struct tcpd_context saved_context;
+ char *cp;
+ char *wsp = " \t\r\n";
if (pat[0] == '@') { /* @netgroup */
#ifdef NO_NETGRENT
@@ -422,6 +431,21 @@
tcpd_warn("netgroup support disabled");
#endif
#endif
+ } else if (pat[0] == '/') { /* /path/name */
+ if ((fp = fopen(pat, "r")) != 0) {
+ saved_context = tcpd_context;
+ tcpd_context.file = pat;
+ tcpd_context.line = 0;
+ while (fgets(buf, sizeof(buf), fp)) {
+ tcpd_context.line++;
+ for (cp = strtok(buf, wsp); cp; cp = strtok((char *) 0, wsp))
+ check_host(cp);
+ }
+ tcpd_context = saved_context;
+ fclose(fp);
+ } else if (errno != ENOENT) {
+ tcpd_warn("open %s: %m", pat);
+ }
} else if (mask = split_at(pat, '/')) { /* network/netmask */
if (dot_quad_addr(pat) == INADDR_NONE
|| dot_quad_addr(mask) == INADDR_NONE)
diff -Naur tcp_wrappers_7.6/try-from.8 tcp_wrappers_7.6.gimli/try-from.8
--- tcp_wrappers_7.6/try-from.8 1969-12-31 18:00:00.000000000 -0600
+++ tcp_wrappers_7.6.gimli/try-from.8 2002-01-07 08:50:19.000000000 -0600
@@ -0,0 +1,28 @@
+.TH TRY-FROM 8 "21th June 1997" Linux "Linux Programmer's Manual"
+.SH NAME
+try-from \- test program for the tcp_wrapper
+.SH SYNOPSIS
+.B try-from
+.SH DESCRIPTION
+The
+.B try-from
+command can be called via a remote shell command to find out
+if the hostname and address are properly recognized
+by the
+.B tcp_wrapper
+library, if username lookup works, and (SysV only) if the TLI
+on top of IP heuristics work. Diagnostics are reported through
+.BR syslog (3)
+and redirected to stderr.
+
+Example:
+
+rsh host /some/where/try-from
+
+.SH SEE ALSO
+.BR hosts_access (5),
+.BR hosts_options (5),
+.BR tcpd (8)
+.SH AUTHOR
+Wietse Venema, Eindhoven University of Technology, The Netherlands.
+
diff -Naur tcp_wrappers_7.6/weak_symbols.c tcp_wrappers_7.6.gimli/weak_symbols.c
--- tcp_wrappers_7.6/weak_symbols.c 1969-12-31 18:00:00.000000000 -0600
+++ tcp_wrappers_7.6.gimli/weak_symbols.c 2002-01-07 08:50:19.000000000 -0600
@@ -0,0 +1,11 @@
+ /*
+ * @(#) weak_symbols.h 1.5 99/12/29 23:50
+ *
+ * Author: Anthony Towns <ajt@debian.org>
+ */
+
+#ifdef HAVE_WEAKSYMS
+#include <syslog.h>
+int deny_severity = LOG_WARNING;
+int allow_severity = SEVERITY;
+#endif

1233
core/tcp_wrappers/tcp-wrappers-7.6-ipv6-1.14.patch Executable file
View file

File diff suppressed because it is too large Load diff

28
core/tcp_wrappers/try-from.8 Executable file
View file

@ -0,0 +1,28 @@
.TH TRY-FROM 8 "21th June 1997" Linux "Linux Programmer's Manual"
.SH NAME
try-from \- test program for the tcp_wrapper
.SH SYNOPSIS
.B try-from
.SH DESCRIPTION
The
.B try-from
command can be called via a remote shell command to find out
if the hostname and address are properly recognized
by the
.B tcp_wrapper
library, if username lookup works, and (SysV only) if the TLI
on top of IP heuristics work. Diagnostics are reported through
.BR syslog (3)
and redirected to stderr.
Example:
rsh host /some/where/try-from
.SH SEE ALSO
.BR hosts_access (5),
.BR hosts_options (5),
.BR tcpd (8)
.SH AUTHOR
Wietse Venema, Eindhoven University of Technology, The Netherlands.