diff options
| author | christos <christos@NetBSD.org> | 2008-12-18 20:16:52 +0000 |
|---|---|---|
| committer | christos <christos@NetBSD.org> | 2008-12-18 20:16:52 +0000 |
| commit | 4c237aa750012fc8e5541693c007d7b87c908357 (patch) | |
| tree | 59f7a5eb4808f1ce7776f35b887a9f1af06072af /lib/libwrap | |
| parent | 07236533dda54bc8a2a9879a1033c00acba92603 (diff) | |
Wietse Wenema's tcpd-blacklist-patch:
ftp://ftp.porcupine.org/pub/security/tcpd-blacklist-patch
- If a host starts with a / treat it as a filename containing a list of hosts.
Diffstat (limited to 'lib/libwrap')
| -rw-r--r-- | lib/libwrap/hosts_access.5 | 9 | ||||
| -rw-r--r-- | lib/libwrap/hosts_access.c | 27 |
2 files changed, 33 insertions, 3 deletions
diff --git a/lib/libwrap/hosts_access.5 b/lib/libwrap/hosts_access.5 index f468ddd90ed..97ce5f2b96d 100644 --- a/lib/libwrap/hosts_access.5 +++ b/lib/libwrap/hosts_access.5 @@ -117,6 +117,13 @@ An expression of the form `ipv6-addr/prefixlen\' is interpreted as masked IPv6 address match (with mask specified by numeric prefixlen), just like masked IPv4 address match (see above). Note that `prefixlen\' portion must always be specified. +.IP \(bu +A string that begins with a `/\' character is treated as a file +name. A host name or address is matched if it matches any host name +or address pattern listed in the named file. The file format is +zero or more lines with zero or more host name or address patterns +separated by whitespace. A file name pattern can be used anywhere +a host name or address pattern can be used. .SH WILDCARDS The access control language supports explicit wildcards: .IP ALL @@ -414,4 +421,4 @@ Eindhoven University of Technology Den Dolech 2, P.O. Box 513, 5600 MB Eindhoven, The Netherlands .\" @(#) hosts_access.5 1.20 95/01/30 19:51:46 -.\" $NetBSD: hosts_access.5,v 1.15 2003/09/07 16:22:22 wiz Exp $ +.\" $NetBSD: hosts_access.5,v 1.16 2008/12/18 20:16:52 christos Exp $ diff --git a/lib/libwrap/hosts_access.c b/lib/libwrap/hosts_access.c index 57242f8c4e6..91247fe8580 100644 --- a/lib/libwrap/hosts_access.c +++ b/lib/libwrap/hosts_access.c @@ -1,4 +1,4 @@ -/* $NetBSD: hosts_access.c,v 1.18 2006/01/08 17:20:28 jdc Exp $ */ +/* $NetBSD: hosts_access.c,v 1.19 2008/12/18 20:16:52 christos Exp $ */ /* * This module implements a simple access control language that is based on @@ -24,7 +24,7 @@ #if 0 static char sccsid[] = "@(#) hosts_access.c 1.21 97/02/12 02:13:22"; #else -__RCSID("$NetBSD: hosts_access.c,v 1.18 2006/01/08 17:20:28 jdc Exp $"); +__RCSID("$NetBSD: hosts_access.c,v 1.19 2008/12/18 20:16:52 christos Exp $"); #endif #endif @@ -90,6 +90,7 @@ static int list_match __P((char *, struct request_info *, static int server_match __P((char *, struct request_info *)); static int client_match __P((char *, struct request_info *)); static int host_match __P((char *, struct host_info *)); +static int hostfile_match __P((char *, struct host_info *)); static int rbl_match __P((char *, char *)); static int string_match __P((char *, char *)); static int masked_match __P((char *, char *, char *)); @@ -290,6 +291,8 @@ struct host_info *host; tcpd_warn("netgroup support is disabled"); /* not tcpd_jump() */ return (NO); #endif + } else if (tok[0] == '/') { /* /file hack */ + return (hostfile_match(tok, host)); } else if (STR_EQ(tok, "KNOWN")) { /* check address and name */ char *name = eval_hostname(host); return (STR_NE(eval_hostaddr(host), unknown) && HOSTNAME_KNOWN(name)); @@ -306,6 +309,26 @@ struct host_info *host; } } +/* hostfile_match - look up host patterns from file */ + +static int hostfile_match(path, host) +char *path; +struct host_info *host; +{ + char tok[BUFSIZ]; + int match = NO; + FILE *fp; + + if ((fp = fopen(path, "r")) != 0) { + while (fscanf(fp, "%s", tok) == 1 && !(match = host_match(tok, host))) + /* void */ ; + fclose(fp); + } else if (errno != ENOENT) { + tcpd_warn("open %s: %m", path); + } + return (match); +} + /* rbl_match() - match host by looking up in RBL domain */ static int rbl_match(rbl_domain, rbl_hostaddr) |
