summaryrefslogtreecommitdiff
path: root/lib/libwrap
diff options
context:
space:
mode:
authorchristos <christos@NetBSD.org>2008-12-18 20:16:52 +0000
committerchristos <christos@NetBSD.org>2008-12-18 20:16:52 +0000
commit4c237aa750012fc8e5541693c007d7b87c908357 (patch)
tree59f7a5eb4808f1ce7776f35b887a9f1af06072af /lib/libwrap
parent07236533dda54bc8a2a9879a1033c00acba92603 (diff)
Wietse Wenema's tcpd-blacklist-patch:
ftp://ftp.porcupine.org/pub/security/tcpd-blacklist-patch - If a host starts with a / treat it as a filename containing a list of hosts.
Diffstat (limited to 'lib/libwrap')
-rw-r--r--lib/libwrap/hosts_access.59
-rw-r--r--lib/libwrap/hosts_access.c27
2 files changed, 33 insertions, 3 deletions
diff --git a/lib/libwrap/hosts_access.5 b/lib/libwrap/hosts_access.5
index f468ddd90ed..97ce5f2b96d 100644
--- a/lib/libwrap/hosts_access.5
+++ b/lib/libwrap/hosts_access.5
@@ -117,6 +117,13 @@ An expression of the form `ipv6-addr/prefixlen\' is interpreted as
masked IPv6 address match (with mask specified by numeric prefixlen),
just like masked IPv4 address match (see above).
Note that `prefixlen\' portion must always be specified.
+.IP \(bu
+A string that begins with a `/\' character is treated as a file
+name. A host name or address is matched if it matches any host name
+or address pattern listed in the named file. The file format is
+zero or more lines with zero or more host name or address patterns
+separated by whitespace. A file name pattern can be used anywhere
+a host name or address pattern can be used.
.SH WILDCARDS
The access control language supports explicit wildcards:
.IP ALL
@@ -414,4 +421,4 @@ Eindhoven University of Technology
Den Dolech 2, P.O. Box 513,
5600 MB Eindhoven, The Netherlands
.\" @(#) hosts_access.5 1.20 95/01/30 19:51:46
-.\" $NetBSD: hosts_access.5,v 1.15 2003/09/07 16:22:22 wiz Exp $
+.\" $NetBSD: hosts_access.5,v 1.16 2008/12/18 20:16:52 christos Exp $
diff --git a/lib/libwrap/hosts_access.c b/lib/libwrap/hosts_access.c
index 57242f8c4e6..91247fe8580 100644
--- a/lib/libwrap/hosts_access.c
+++ b/lib/libwrap/hosts_access.c
@@ -1,4 +1,4 @@
-/* $NetBSD: hosts_access.c,v 1.18 2006/01/08 17:20:28 jdc Exp $ */
+/* $NetBSD: hosts_access.c,v 1.19 2008/12/18 20:16:52 christos Exp $ */
/*
* This module implements a simple access control language that is based on
@@ -24,7 +24,7 @@
#if 0
static char sccsid[] = "@(#) hosts_access.c 1.21 97/02/12 02:13:22";
#else
-__RCSID("$NetBSD: hosts_access.c,v 1.18 2006/01/08 17:20:28 jdc Exp $");
+__RCSID("$NetBSD: hosts_access.c,v 1.19 2008/12/18 20:16:52 christos Exp $");
#endif
#endif
@@ -90,6 +90,7 @@ static int list_match __P((char *, struct request_info *,
static int server_match __P((char *, struct request_info *));
static int client_match __P((char *, struct request_info *));
static int host_match __P((char *, struct host_info *));
+static int hostfile_match __P((char *, struct host_info *));
static int rbl_match __P((char *, char *));
static int string_match __P((char *, char *));
static int masked_match __P((char *, char *, char *));
@@ -290,6 +291,8 @@ struct host_info *host;
tcpd_warn("netgroup support is disabled"); /* not tcpd_jump() */
return (NO);
#endif
+ } else if (tok[0] == '/') { /* /file hack */
+ return (hostfile_match(tok, host));
} else if (STR_EQ(tok, "KNOWN")) { /* check address and name */
char *name = eval_hostname(host);
return (STR_NE(eval_hostaddr(host), unknown) && HOSTNAME_KNOWN(name));
@@ -306,6 +309,26 @@ struct host_info *host;
}
}
+/* hostfile_match - look up host patterns from file */
+
+static int hostfile_match(path, host)
+char *path;
+struct host_info *host;
+{
+ char tok[BUFSIZ];
+ int match = NO;
+ FILE *fp;
+
+ if ((fp = fopen(path, "r")) != 0) {
+ while (fscanf(fp, "%s", tok) == 1 && !(match = host_match(tok, host)))
+ /* void */ ;
+ fclose(fp);
+ } else if (errno != ENOENT) {
+ tcpd_warn("open %s: %m", path);
+ }
+ return (match);
+}
+
/* rbl_match() - match host by looking up in RBL domain */
static int rbl_match(rbl_domain, rbl_hostaddr)