[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20090415182814.36BA81F3E9E@spike.porcupine.org>
Date: Wed, 15 Apr 2009 14:28:14 -0400 (EDT)
From: wietse@...cupine.org (Wietse Venema)
To: Tomas Hoger <thoger@...hat.com>
CC: wietse@...cupine.org, oss-security@...ts.openwall.com
Subject: Re: Re: Some fun with tcp_wrappers
Tomas Hoger:
> $ cat hosts.allow hosts.deny
> foobar: localhost
> foobar: ALL: DENY
> cat: hosts.deny: No such file or directory
>
> $ ./test-hostsctl -d foobar unknown 127.0.0.1 unknown
> denied
>
> (this is expected to be allowed)
My software behaves exactly as documented.
The hostsctl is called with a name of "unknown" and an address of
"127.0.0.1". There is no access rule that matches "unknown",
therefore, no such access rule will fire.
> $ cat hosts.allow hosts.deny
> foobar: localhost: DENY
> cat: hosts.deny: No such file or directory
>
> $ ./test-hostsctl -d foobar unknown 127.0.0.1 unknown
> allowed
>
> (this is expected to be denied)
Again, the software behaves exactly as documented.
The hostsctl is called with a name of "unknown" and an address of
"127.0.0.1". There is no access rule that matches "unknown",
therefore, no such access rule will fire.
> "test-hostsctl servicename unknown IP unknown" is what some
> applications do expecting tcp_wrappers to resolve IP to hostname.
I think that it would be a mistake to change a documented API that
has been in use for almost 20 years, just because some people can't
be bothered to read the API documentation.
Wietse
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
