Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 15 Apr 2009 19:58:30 +0200
From: Tomas Hoger <>
Subject: Re: Re: Some fun with tcp_wrappers

On Wed, 15 Apr 2009 10:58:54 -0400 (EDT) (Wietse
Venema) wrote:

> > STRING_UNKNOWN is valid argument expected to be passed to hosts_ctl.
> > That description does not seem to be too clear to indicate that when
> > one uses hosts_ctl as:
> > 
> >   hosts_ctl(svcname, STRING_UNKNOWN, client_addr, STRING_UNKNOWN)
> > 
> > all hostname-based rules are ignored.  It seems those using
> > hosts_ctl do not always realize that.
> That behavior is not what I implemented. It must have been introduced
> by someone else.

[ .. ]

> As you see, my own code does not ignore hostname rules when
> the hostname is "unknown".

Your examples work as the hostname used in hosts.{allow,deny} is
"unknown", but it should not work for any other hostname.  Can you try

$ getent hosts       localhost

$ cat hosts.allow hosts.deny
foobar: localhost
foobar: ALL: DENY
cat: hosts.deny: No such file or directory

$ ./test-hostsctl -d foobar unknown unknown

(this is expected to be allowed)

$ cat hosts.allow hosts.deny
foobar: localhost: DENY
cat: hosts.deny: No such file or directory

$ ./test-hostsctl -d foobar unknown unknown

(this is expected to be denied)

"test-hostsctl servicename unknown IP unknown" is what some
applications do expecting tcp_wrappers to resolve IP to hostname.

Tomas Hoger / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.