Skip to content

Commit

Permalink
tcp_wrappers: recognize IPv6 addresses/prefixes
Browse files Browse the repository at this point in the history
Intentionally or not, but the libwrap was written in such manner that
if your /etc/hosts.allow doesn't have any domain names, neither smart
keywords like LOCAL or KNOWN, then it will not try to resolve the
client address during the hosts check.  This was achieved with the
NOT_INADDR() check that matched IPv4 addresses/prefixes.  Extend this
to also skip resolve if client list token looks like IPv6.

Reviewed by:		philip, emaste
PR:			269456
Differential revision:	https://reviews.freebsd.org/D40070
  • Loading branch information
glebius committed Jul 20, 2023
1 parent 9ff45b8 commit 1d9722d
Show file tree
Hide file tree
Showing 2 changed files with 3 additions and 1 deletion.
3 changes: 2 additions & 1 deletion contrib/tcp_wrappers/hosts_access.c
Original file line number Diff line number Diff line change
Expand Up @@ -315,7 +315,8 @@ static int host_match(char *tok, struct host_info *host)
return (masked_match(tok, mask, eval_hostaddr(host)));
} else { /* anything else */
return (string_match(tok, eval_hostaddr(host))
|| (NOT_INADDR(tok) && string_match(tok, eval_hostname(host))));
|| (NOT_INADDR(tok) && NOT_INADDR6(tok)
&& string_match(tok, eval_hostname(host))));
}
}

Expand Down
1 change: 1 addition & 0 deletions contrib/tcp_wrappers/tcpd.h
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,7 @@ extern char paranoid[];
#define HOSTNAME_KNOWN(s) (STR_NE((s),unknown) && STR_NE((s),paranoid))

#define NOT_INADDR(s) (s[strspn(s,"01234567890./")] != 0)
#define NOT_INADDR6(s) (strchr(s, ':') == NULL)

/* Global functions. */

Expand Down

0 comments on commit 1d9722d

Please sign in to comment.