system/freebsd-src
system/freebsd-src
1
0
Fork 0
mirror of https://github.com/freebsd/freebsd-src synced 2024-10-15 12:54:27 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add IPv6 scoped address support.

Browse source 
It enables us to control link-local connections by interface like
this:

    ALL : [fe80::%ed0]/10 : allow
    ALL : [fe80::]/10 : deny
This commit is contained in:
Hajimu UMEMOTO 2000-07-14 17:15:34 +00:00
parent 3e6902efc8
commit b208ff84c1
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=63158
9 changed files with 310 additions and 329 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

59
contrib/tcp_wrappers/hosts_access.c
View file

@ -41,6 +41,9 @@ static char sccsid[] = "@(#) hosts_access.c 1.21 97/02/12 02:13:22";
#include <errno.h> #include <errno.h>
#include <setjmp.h> #include <setjmp.h>
#include <string.h> #include <string.h>
#ifdef INET6
#include <netdb.h>
#endif
extern char *fgets(); extern char *fgets();
extern int errno; extern int errno;
@ -341,7 +344,8 @@ char *string;
return (STRN_EQ(tok, string, n)); return (STRN_EQ(tok, string, n));
} else { /* exact match */ } else { /* exact match */
#ifdef INET6 #ifdef INET6
struct in6_addr pat, addr; struct addrinfo hints, *res;
struct sockaddr_in6 pat, addr;
int len, ret; int len, ret;
char ch; char ch;
@ -349,11 +353,27 @@ char *string;
if (*tok == '[' && tok[len - 1] == ']') { if (*tok == '[' && tok[len - 1] == ']') {
ch = tok[len - 1]; ch = tok[len - 1];
tok[len - 1] = '\0'; tok[len - 1] = '\0';
ret = inet_pton(AF_INET6, tok + 1, pat.s6_addr); memset(&hints, 0, sizeof(hints));
hints.ai_family = AF_INET6;
hints.ai_socktype = SOCK_STREAM;
hints.ai_flags = AI_PASSIVE | AI_NUMERICHOST;
if ((ret = getaddrinfo(tok + 1, NULL, &hints, &res)) == 0) {
memcpy(&pat, res->ai_addr, sizeof(pat));
freeaddrinfo(res);
}
tok[len - 1] = ch; tok[len - 1] = ch;
if (ret != 1 || inet_pton(AF_INET6, string, addr.s6_addr) != 1) if (ret != 0 || getaddrinfo(string, NULL, &hints, &res) != 0)
return NO; return NO;
return (!memcmp(&pat, &addr, sizeof(struct in6_addr))); memcpy(&addr, res->ai_addr, sizeof(addr));
freeaddrinfo(res);
#ifdef NI_WITHSCOPEID
if (pat.sin6_scope_id != 0 &&
addr.sin6_scope_id != pat.sin6_scope_id)
return NO;
#endif
return (!memcmp(&pat.sin6_addr, &addr.sin6_addr,
sizeof(struct in6_addr)));
return (ret);
} }
#endif #endif
return (STR_EQ(tok, string)); return (STR_EQ(tok, string));
@ -414,19 +434,26 @@ char *net_tok;
char *mask_tok; char *mask_tok;
char *string; char *string;
{ {
struct in6_addr net, addr; struct addrinfo hints, *res;
struct sockaddr_in6 net, addr;
u_int32_t mask; u_int32_t mask;
int len, mask_len, i = 0; int len, mask_len, i = 0;
char ch; char ch;
if (inet_pton(AF_INET6, string, addr.s6_addr) != 1) memset(&hints, 0, sizeof(hints));
return NO; hints.ai_family = AF_INET6;
hints.ai_socktype = SOCK_STREAM;
hints.ai_flags = AI_PASSIVE | AI_NUMERICHOST;
if (getaddrinfo(string, NULL, &hints, &res) != 0)
return NO;
memcpy(&addr, res->ai_addr, sizeof(addr));
freeaddrinfo(res);
if (IN6_IS_ADDR_V4MAPPED(&addr)) { if (IN6_IS_ADDR_V4MAPPED(&addr.sin6_addr)) {
if ((*(u_int32_t *)&net.s6_addr[12] = dot_quad_addr(net_tok)) == INADDR_NONE if ((*(u_int32_t *)&net.sin6_addr.s6_addr[12] = dot_quad_addr(net_tok)) == INADDR_NONE
|| (mask = dot_quad_addr(mask_tok)) == INADDR_NONE) || (mask = dot_quad_addr(mask_tok)) == INADDR_NONE)
return (NO); return (NO);
return ((*(u_int32_t *)&addr.s6_addr[12] & mask) == *(u_int32_t *)&net.s6_addr[12]); return ((*(u_int32_t *)&addr.sin6_addr.s6_addr[12] & mask) == *(u_int32_t *)&net.sin6_addr.s6_addr[12]);
} }
/* match IPv6 address against netnumber/prefixlen */ /* match IPv6 address against netnumber/prefixlen */
@ -435,22 +462,28 @@ char *string;
return NO; return NO;
ch = net_tok[len - 1]; ch = net_tok[len - 1];
net_tok[len - 1] = '\0'; net_tok[len - 1] = '\0';
if (inet_pton(AF_INET6, net_tok + 1, net.s6_addr) != 1) { if (getaddrinfo(net_tok + 1, NULL, &hints, &res) != 0) {
net_tok[len - 1] = ch; net_tok[len - 1] = ch;
return NO; return NO;
} }
memcpy(&net, res->ai_addr, sizeof(net));
freeaddrinfo(res);
net_tok[len - 1] = ch; net_tok[len - 1] = ch;
if ((mask_len = atoi(mask_tok)) < 0 || mask_len > 128) if ((mask_len = atoi(mask_tok)) < 0 || mask_len > 128)
return NO; return NO;
#ifdef NI_WITHSCOPEID
if (net.sin6_scope_id != 0 && addr.sin6_scope_id != net.sin6_scope_id)
return NO;
#endif
while (mask_len > 0) { while (mask_len > 0) {
if (mask_len < 32) { if (mask_len < 32) {
mask = htonl(~(0xffffffff >> mask_len)); mask = htonl(~(0xffffffff >> mask_len));
if ((*(u_int32_t *)&addr.s6_addr[i] & mask) != (*(u_int32_t *)&net.s6_addr[i] & mask)) if ((*(u_int32_t *)&addr.sin6_addr.s6_addr[i] & mask) != (*(u_int32_t *)&net.sin6_addr.s6_addr[i] & mask))
return NO; return NO;
break; break;
} }
if (*(u_int32_t *)&addr.s6_addr[i] != *(u_int32_t *)&net.s6_addr[i]) if (*(u_int32_t *)&addr.sin6_addr.s6_addr[i] != *(u_int32_t *)&net.sin6_addr.s6_addr[i])
return NO; return NO;
i += 4; i += 4;
mask_len -= 32; mask_len -= 32;

196
contrib/tcp_wrappers/scaffold.c
View file

@ -22,13 +22,14 @@ static char sccs_id[] = "@(#) scaffold.c 1.6 97/03/21 19:27:24";
#include <syslog.h> #include <syslog.h>
#include <setjmp.h> #include <setjmp.h>
#include <string.h> #include <string.h>
#include <resolv.h>
#ifndef INADDR_NONE #ifndef INADDR_NONE
#define INADDR_NONE (-1) /* XXX should be 0xffffffff */ #define INADDR_NONE (-1) /* XXX should be 0xffffffff */
#endif #endif
#ifndef INET6
extern char *malloc(); extern char *malloc();
#endif
/* Application-specific. */ /* Application-specific. */
@ -42,6 +43,7 @@ int allow_severity = SEVERITY;
int deny_severity = LOG_WARNING; int deny_severity = LOG_WARNING;
int rfc931_timeout = RFC931_TIMEOUT; int rfc931_timeout = RFC931_TIMEOUT;
#ifndef INET6
/* dup_hostent - create hostent in one memory block */ /* dup_hostent - create hostent in one memory block */
static struct hostent *dup_hostent(hp) static struct hostent *dup_hostent(hp)
@ -60,9 +62,6 @@ struct hostent *hp;
/* void */ ; /* void */ ;
if ((hb = (struct hostent_block *) malloc(sizeof(struct hostent_block) if ((hb = (struct hostent_block *) malloc(sizeof(struct hostent_block)
#ifdef INET6
+ strlen(hp->h_name) + 1
#endif
+ (hp->h_length + sizeof(char *)) * count)) == 0) { + (hp->h_length + sizeof(char *)) * count)) == 0) {
fprintf(stderr, "Sorry, out of memory\n"); fprintf(stderr, "Sorry, out of memory\n");
exit(1); exit(1);
@ -72,11 +71,6 @@ struct hostent *hp;
hb->host.h_addr_list = hb->addr_list; hb->host.h_addr_list = hb->addr_list;
hb->host.h_addr_list[count] = 0; hb->host.h_addr_list[count] = 0;
data = (char *) (hb->host.h_addr_list + count + 1); data = (char *) (hb->host.h_addr_list + count + 1);
#ifdef INET6
hb->host.h_name = data + hp->h_length * count;
strcpy(hb->host.h_name, hp->h_name);
hb->host.h_addrtype = hp->h_addrtype;
#endif
for (count = 0; (addr = hp->h_addr_list[count]) != 0; count++) { for (count = 0; (addr = hp->h_addr_list[count]) != 0; count++) {
hb->host.h_addr_list[count] = data + hp->h_length * count; hb->host.h_addr_list[count] = data + hp->h_length * count;
@ -84,107 +78,46 @@ struct hostent *hp;
} }
return (&hb->host); return (&hb->host);
} }
#if defined(INET6) && !defined(USE_GETIPNODEBY)
/* merge_hostent - merge hostent in one memory block */
static struct hostent *merge_hostent(hp1, hp2)
struct hostent *hp1, *hp2;
{
struct hostent_block {
struct hostent host;
char *addr_list[1];
};
struct hostent_block *hb;
int count, count2;
char *data;
char *addr;
for (count = 0; hp1->h_addr_list[count] != 0; count++)
/* void */ ;
for (count2 = 0; hp2->h_addr_list[count2] != 0; count2++)
/* void */ ;
count += count2;
if ((hb = (struct hostent_block *) malloc(sizeof(struct hostent_block)
+ strlen(hp1->h_name) + 1
+ (hp1->h_length + sizeof(char *)) * count)) == 0) {
fprintf(stderr, "Sorry, out of memory\n");
exit(1);
}
memset((char *) &hb->host, 0, sizeof(hb->host));
hb->host.h_length = hp1->h_length;
hb->host.h_addr_list = hb->addr_list;
hb->host.h_addr_list[count] = 0;
data = (char *) (hb->host.h_addr_list + count + 1);
hb->host.h_name = data + hp1->h_length * count;
strcpy(hb->host.h_name, hp1->h_name);
hb->host.h_addrtype = hp1->h_addrtype;
for (count = 0; (addr = hp1->h_addr_list[count]) != 0; count++) {
hb->host.h_addr_list[count] = data + hp1->h_length * count;
memcpy(hb->host.h_addr_list[count], addr, hp1->h_length);
}
for (count2 = 0; (addr = hp2->h_addr_list[count2]) != 0; count2++) {
hb->host.h_addr_list[count] = data + hp1->h_length * count;
memcpy(hb->host.h_addr_list[count], addr, hp1->h_length);
++count;
}
return (&hb->host);
}
#endif #endif
static struct hostent *gethostbyname64(host)
char *host;
{
struct hostent *hp = NULL, *hp2 = NULL;
#ifdef USE_GETIPNODEBY
int h_error;
if ((hp = getipnodebyname(host, AF_INET6,
AI_V4MAPPED | AI_ADDRCONFIG | AI_ALL,
&h_error)) != 0) {
hp2 = dup_hostent(hp);
freehostent(hp);
return (hp2);
}
#else
struct hostent *hp1;
u_long res_options;
if ((_res.options & RES_INIT) == 0) {
if (res_init() < 0) {
tcpd_warn("%s: res_init() failed", host);
return (NULL);
}
}
res_options = _res.options;
#ifdef INET6
_res.options |= RES_USE_INET6;
if ((hp1 = gethostbyname2(host, AF_INET6)) != NULL)
hp1 = dup_hostent(hp1);
#endif
if ((hp2 = gethostbyname2(host, AF_INET)) != NULL)
hp2 = dup_hostent(hp2);
_res.options = res_options;
#ifdef INET6
if (hp1 && hp2) {
hp = merge_hostent(hp1, hp2);
free((char *) hp1);
free((char *) hp2);
return (hp);
}
if (hp1)
return (hp1);
#endif
if (hp2)
return (hp2);
#endif
return (NULL);
}
/* find_inet_addr - find all addresses for this host, result to free() */ /* find_inet_addr - find all addresses for this host, result to free() */
#ifdef INET6
struct addrinfo *find_inet_addr(host)
char *host;
{
struct addrinfo hints, *res;
memset(&hints, 0, sizeof(hints));
hints.ai_family = PF_UNSPEC;
hints.ai_socktype = SOCK_STREAM;
hints.ai_flags = AI_PASSIVE | AI_NUMERICHOST;
if (getaddrinfo(host, NULL, &hints, &res) == 0)
return (res);
memset(&hints, 0, sizeof(hints));
hints.ai_family = PF_UNSPEC;
hints.ai_socktype = SOCK_STREAM;
hints.ai_flags = AI_PASSIVE | AI_CANONNAME;
if (getaddrinfo(host, NULL, &hints, &res) != 0) {
tcpd_warn("%s: host not found", host);
return (0);
}
if (res->ai_family != AF_INET6 && res->ai_family != AF_INET) {
tcpd_warn("%d: not an internet host", res->ai_family);
freeaddrinfo(res);
return (0);
}
if (!res->ai_canonname) {
tcpd_warn("%s: hostname alias", host);
tcpd_warn("(cannot obtain official name)", res->ai_canonname);
} else if (STR_NE(host, res->ai_canonname)) {
tcpd_warn("%s: hostname alias", host);
tcpd_warn("(official name: %.*s)", STRING_LENGTH, res->ai_canonname);
}
return (res);
}
#else
struct hostent *find_inet_addr(host) struct hostent *find_inet_addr(host)
char *host; char *host;
{ {
@ -192,7 +125,6 @@ char *host;
struct hostent *hp; struct hostent *hp;
static struct hostent h; static struct hostent h;
static char *addr_list[2]; static char *addr_list[2];
static char hnamebuf[BUFSIZ];
/* /*
* Host address: translate it to internal form. * Host address: translate it to internal form.
@ -201,11 +133,6 @@ char *host;
h.h_addr_list = addr_list; h.h_addr_list = addr_list;
h.h_addr_list[0] = (char *) &addr; h.h_addr_list[0] = (char *) &addr;
h.h_length = sizeof(addr); h.h_length = sizeof(addr);
#ifdef INET6
h.h_addrtype = AF_INET;
h.h_name = hnamebuf;
strcpy(h.h_name, host);
#endif
return (dup_hostent(&h)); return (dup_hostent(&h));
} }
@ -219,34 +146,21 @@ char *host;
tcpd_warn("%s: not an internet address", host); tcpd_warn("%s: not an internet address", host);
return (0); return (0);
} }
#ifdef INET6
if ((hp = gethostbyname64(host)) == 0) {
#else
if ((hp = gethostbyname(host)) == 0) { if ((hp = gethostbyname(host)) == 0) {
#endif
tcpd_warn("%s: host not found", host); tcpd_warn("%s: host not found", host);
return (0); return (0);
} }
#ifdef INET6
if (hp->h_addrtype != AF_INET6) {
tcpd_warn("%d: not an internet host", hp->h_addrtype);
free((char *) hp);
#else
if (hp->h_addrtype != AF_INET) { if (hp->h_addrtype != AF_INET) {
tcpd_warn("%d: not an internet host", hp->h_addrtype); tcpd_warn("%d: not an internet host", hp->h_addrtype);
#endif
return (0); return (0);
} }
if (STR_NE(host, hp->h_name)) { if (STR_NE(host, hp->h_name)) {
tcpd_warn("%s: hostname alias", host); tcpd_warn("%s: hostname alias", host);
tcpd_warn("(official name: %.*s)", STRING_LENGTH, hp->h_name); tcpd_warn("(official name: %.*s)", STRING_LENGTH, hp->h_name);
} }
#ifdef INET6
return (hp);
#else
return (dup_hostent(hp)); return (dup_hostent(hp));
#endif
} }
#endif
/* check_dns - give each address thorough workout, return address count */ /* check_dns - give each address thorough workout, return address count */
@ -256,12 +170,11 @@ char *host;
struct request_info request; struct request_info request;
#ifdef INET6 #ifdef INET6
struct sockaddr_storage sin; struct sockaddr_storage sin;
char *ap; struct addrinfo *hp, *res;
int alen;
#else #else
struct sockaddr_in sin; struct sockaddr_in sin;
#endif
struct hostent *hp; struct hostent *hp;
#endif
int count; int count;
char *addr; char *addr;
@ -269,29 +182,16 @@ char *host;
return (0); return (0);
request_init(&request, RQ_CLIENT_SIN, &sin, 0); request_init(&request, RQ_CLIENT_SIN, &sin, 0);
sock_methods(&request); sock_methods(&request);
#ifndef INET6
memset((char *) &sin, 0, sizeof(sin)); memset((char *) &sin, 0, sizeof(sin));
#ifdef INET6
sin.ss_family = hp->h_addrtype;
switch (hp->h_addrtype) {
case AF_INET:
ap = (char *)&((struct sockaddr_in *)&sin)->sin_addr;
alen = sizeof(struct sockaddr_in);
break;
case AF_INET6:
ap = (char *)&((struct sockaddr_in6 *)&sin)->sin6_addr;
alen = sizeof(struct sockaddr_in6);
break;
default:
return (0);
}
#else
sin.sin_family = AF_INET; sin.sin_family = AF_INET;
#endif #endif
for (count = 0; (addr = hp->h_addr_list[count]) != 0; count++) {
#ifdef INET6 #ifdef INET6
memcpy(ap, addr, alen); for (res = hp, count = 0; res; res = res->ai_next, count++) {
memcpy(&sin, res->ai_addr, res->ai_addrlen);
#else #else
for (count = 0; (addr = hp->h_addr_list[count]) != 0; count++) {
memcpy((char *) &sin.sin_addr, addr, sizeof(sin.sin_addr)); memcpy((char *) &sin.sin_addr, addr, sizeof(sin.sin_addr));
#endif #endif
@ -306,7 +206,11 @@ char *host;
tcpd_warn("host address %s->name lookup failed", tcpd_warn("host address %s->name lookup failed",
eval_hostaddr(request.client)); eval_hostaddr(request.client));
} }
#ifdef INET6
freeaddrinfo(hp);
#else
free((char *) hp); free((char *) hp);
#endif
return (count); return (count);
} }

6
contrib/tcp_wrappers/scaffold.h
View file

@ -2,8 +2,14 @@
* @(#) scaffold.h 1.3 94/12/31 18:19:19 * @(#) scaffold.h 1.3 94/12/31 18:19:19
* *
* Author: Wietse Venema, Eindhoven University of Technology, The Netherlands. * Author: Wietse Venema, Eindhoven University of Technology, The Netherlands.
*
* $FreeBSD$
*/ */
#ifdef INET6
extern struct addrinfo *find_inet_addr();
#else
extern struct hostent *find_inet_addr(); extern struct hostent *find_inet_addr();
#endif
extern int check_dns(); extern int check_dns();
extern int check_path(); extern int check_path();

265
contrib/tcp_wrappers/socket.c
View file

@ -33,12 +33,12 @@ static char sccsid[] = "@(#) socket.c 1.15 97/03/21 19:27:24";
#include <string.h> #include <string.h>
#ifdef INET6 #ifdef INET6
#ifndef USE_GETIPNODEBY #ifndef NI_WITHSCOPEID
#include <resolv.h> #define NI_WITHSCOPEID 0
#endif #endif
#endif #else
extern char *inet_ntoa(); extern char *inet_ntoa();
#endif
/* Local stuff. */ /* Local stuff. */
@ -148,25 +148,18 @@ struct host_info *host;
{ {
#ifdef INET6 #ifdef INET6
struct sockaddr *sin = host->sin; struct sockaddr *sin = host->sin;
char *ap; int salen;
int alen;
if (!sin) if (!sin)
return; return;
switch (sin->sa_family) { #ifdef SIN6_LEN
case AF_INET: salen = sin->sa_len;
ap = (char *)&((struct sockaddr_in *)sin)->sin_addr; #else
alen = sizeof(struct in_addr); salen = (sin->sa_family == AF_INET) ? sizeof(struct sockaddr_in)
break; : sizeof(struct sockaddr_in6);
case AF_INET6: #endif
ap = (char *)&((struct sockaddr_in6 *)sin)->sin6_addr; getnameinfo(sin, salen, host->addr, sizeof(host->addr),
alen = sizeof(struct in6_addr); NULL, 0, NI_NUMERICHOST | NI_WITHSCOPEID);
break;
default:
return;
}
host->addr[0] = '\0';
inet_ntop(sin->sa_family, ap, host->addr, sizeof(host->addr));
#else #else
struct sockaddr_in *sin = host->sin; struct sockaddr_in *sin = host->sin;
@ -182,64 +175,47 @@ struct host_info *host;
{ {
#ifdef INET6 #ifdef INET6
struct sockaddr *sin = host->sin; struct sockaddr *sin = host->sin;
char addr[128]; struct sockaddr_in sin4;
#ifdef USE_GETIPNODEBY struct addrinfo hints, *res, *res0 = NULL;
int h_error; int salen, alen, err = 1;
#else char *ap = NULL, *rap, hname[NI_MAXHOST];
u_long res_options;
#endif
struct hostent *hp = NULL;
char *ap;
int alen;
#else
struct sockaddr_in *sin = host->sin;
struct hostent *hp;
#endif
int i;
/*
* On some systems, for example Solaris 2.3, gethostbyaddr(0.0.0.0) does
* not fail. Instead it returns "INADDR_ANY". Unfortunately, this does
* not work the other way around: gethostbyname("INADDR_ANY") fails. We
* have to special-case 0.0.0.0, in order to avoid false alerts from the
* host name/address checking code below.
*/
#ifdef INET6
if (sin != NULL) { if (sin != NULL) {
if (sin->sa_family == AF_INET6) {
struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sin;
if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
memset(&sin4, 0, sizeof(sin4));
#ifdef SIN6_LEN
sin4.sin_len = sizeof(sin4);
#endif
sin4.sin_family = AF_INET;
sin4.sin_port = sin6->sin6_port;
sin4.sin_addr.s_addr = *(u_int32_t *)&sin6->sin6_addr.s6_addr[12];
sin = (struct sockaddr *)&sin4;
}
}
switch (sin->sa_family) { switch (sin->sa_family) {
case AF_INET: case AF_INET:
if (((struct sockaddr_in *)sin)->sin_addr.s_addr == 0) { ap = (char *)&((struct sockaddr_in *)sin)->sin_addr;
strcpy(host->name, paranoid); /* name is bad, clobber it */
return;
}
ap = (char *) &((struct sockaddr_in *)sin)->sin_addr;
alen = sizeof(struct in_addr); alen = sizeof(struct in_addr);
salen = sizeof(struct sockaddr_in);
break; break;
case AF_INET6: case AF_INET6:
ap = (char *) &((struct sockaddr_in6 *)sin)->sin6_addr; ap = (char *)&((struct sockaddr_in6 *)sin)->sin6_addr;
alen = sizeof(struct in6_addr); alen = sizeof(struct in6_addr);
salen = sizeof(struct sockaddr_in6);
break;
default:
break; break;
defalut:
strcpy(host->name, paranoid); /* name is bad, clobber it */
return;
} }
#ifdef USE_GETIPNODEBY if (ap)
hp = getipnodebyaddr(ap, alen, sin->sa_family, &h_error); err = getnameinfo(sin, salen, hname, sizeof(hname),
#else NULL, 0, NI_WITHSCOPEID | NI_NAMEREQD);
hp = gethostbyaddr(ap, alen, sin->sa_family);
#endif
} }
if (hp) { if (!err) {
#else
if (sin != 0 && sin->sin_addr.s_addr != 0
&& (hp = gethostbyaddr((char *) &(sin->sin_addr),
sizeof(sin->sin_addr), AF_INET)) != 0) {
#endif
STRN_CPY(host->name, hp->h_name, sizeof(host->name)); STRN_CPY(host->name, hname, sizeof(host->name));
#if defined(INET6) && defined(USE_GETIPNODEBY)
freehostent(hp);
#endif
/* /*
* Verify that the address is a member of the address list returned * Verify that the address is a member of the address list returned
@ -254,53 +230,116 @@ struct host_info *host;
* we're in big trouble anyway. * we're in big trouble anyway.
*/ */
#ifdef INET6 memset(&hints, 0, sizeof(hints));
#ifdef USE_GETIPNODEBY hints.ai_family = sin->sa_family;
hp = getipnodebyname(host->name, sin->sa_family, hints.ai_socktype = SOCK_STREAM;
AI_V4MAPPED | AI_ADDRCONFIG | AI_ALL, &h_error); hints.ai_flags = AI_PASSIVE | AI_CANONNAME;
#else if (getaddrinfo(host->name, NULL, &hints, &res0) != 0) {
if ((_res.options & RES_INIT) == 0) {
if (res_init() < 0) {
inet_ntop(sin->sa_family, ap, addr, sizeof(addr));
tcpd_warn("can't verify hostname: res_init() for %s failed",
addr);
strcpy(host->name, paranoid); /* name is bad, clobber it */
return;
}
}
res_options = _res.options;
if (sin->sa_family == AF_INET6)
_res.options |= RES_USE_INET6;
else
_res.options &= ~RES_USE_INET6;
hp = gethostbyname2(host->name,
(sin->sa_family == AF_INET6 &&
IN6_IS_ADDR_V4MAPPED(&((struct sockaddr_in6 *)sin)->sin6_addr)) ?
AF_INET : sin->sa_family);
_res.options = res_options;
#endif
if (!hp) {
#else
if ((hp = gethostbyname(host->name)) == 0) {
#endif
/* /*
* Unable to verify that the host name matches the address. This * Unable to verify that the host name matches the address. This
* may be a transient problem or a botched name server setup. * may be a transient problem or a botched name server setup.
*/ */
#ifdef INET6 tcpd_warn("can't verify hostname: getaddrinfo(%s, %s) failed",
#ifdef USE_GETIPNODEBY
tcpd_warn("can't verify hostname: getipnodebyname(%s, %s) failed",
#else
tcpd_warn("can't verify hostname: gethostbyname2(%s, %s) failed",
#endif
host->name, host->name,
(sin->sa_family == AF_INET) ? "AF_INET" : "AF_INET6"); (sin->sa_family == AF_INET) ? "AF_INET" : "AF_INET6");
#else
} else if (STR_NE(host->name, res0->ai_canonname)
&& STR_NE(host->name, "localhost")) {
/*
* The gethostbyaddr() and gethostbyname() calls did not return
* the same hostname. This could be a nameserver configuration
* problem. It could also be that someone is trying to spoof us.
*/
tcpd_warn("host name/name mismatch: %s != %.*s",
host->name, STRING_LENGTH, res0->ai_canonname);
} else {
/*
* The address should be a member of the address list returned by
* gethostbyname(). We should first verify that the h_addrtype
* field is AF_INET, but this program has already caused too much
* grief on systems with broken library code.
*/
for (res = res0; res; res = res->ai_next) {
if (res->ai_family != sin->sa_family)
continue;
switch (res->ai_family) {
case AF_INET:
rap = (char *)&((struct sockaddr_in *)res->ai_addr)->sin_addr;
break;
case AF_INET6:
rap = (char *)&((struct sockaddr_in6 *)res->ai_addr)->sin6_addr;
break;
default:
continue;
}
if (memcmp(rap, ap, alen) == 0) {
freeaddrinfo(res0);
return; /* name is good, keep it */
}
}
/*
* The host name does not map to the initial address. Perhaps
* someone has messed up. Perhaps someone compromised a name
* server.
*/
getnameinfo(sin, salen, hname, sizeof(hname),
NULL, 0, NI_NUMERICHOST | NI_WITHSCOPEID);
tcpd_warn("host name/address mismatch: %s != %.*s",
hname, STRING_LENGTH, res0->ai_canonname);
}
strcpy(host->name, paranoid); /* name is bad, clobber it */
if (res0)
freeaddrinfo(res0);
}
#else /* INET6 */
struct sockaddr_in *sin = host->sin;
struct hostent *hp;
int i;
/*
* On some systems, for example Solaris 2.3, gethostbyaddr(0.0.0.0) does
* not fail. Instead it returns "INADDR_ANY". Unfortunately, this does
* not work the other way around: gethostbyname("INADDR_ANY") fails. We
* have to special-case 0.0.0.0, in order to avoid false alerts from the
* host name/address checking code below.
*/
if (sin != 0 && sin->sin_addr.s_addr != 0
&& (hp = gethostbyaddr((char *) &(sin->sin_addr),
sizeof(sin->sin_addr), AF_INET)) != 0) {
STRN_CPY(host->name, hp->h_name, sizeof(host->name));
/*
* Verify that the address is a member of the address list returned
* by gethostbyname(hostname).
*
* Verify also that gethostbyaddr() and gethostbyname() return the same
* hostname, or rshd and rlogind may still end up being spoofed.
*
* On some sites, gethostbyname("localhost") returns "localhost.domain".
* This is a DNS artefact. We treat it as a special case. When we
* can't believe the address list from gethostbyname("localhost")
* we're in big trouble anyway.
*/
if ((hp = gethostbyname(host->name)) == 0) {
/*
* Unable to verify that the host name matches the address. This
* may be a transient problem or a botched name server setup.
*/
tcpd_warn("can't verify hostname: gethostbyname(%s) failed", tcpd_warn("can't verify hostname: gethostbyname(%s) failed",
host->name); host->name);
#endif
} else if (STR_NE(host->name, hp->h_name) } else if (STR_NE(host->name, hp->h_name)
&& STR_NE(host->name, "localhost")) { && STR_NE(host->name, "localhost")) {
@ -324,19 +363,10 @@ struct host_info *host;
*/ */
for (i = 0; hp->h_addr_list[i]; i++) { for (i = 0; hp->h_addr_list[i]; i++) {
#ifdef INET6
if (memcmp(hp->h_addr_list[i], ap, alen) == 0) {
#ifdef USE_GETIPNODEBY
freehostent(hp);
#endif
return; /* name is good, keep it */
}
#else
if (memcmp(hp->h_addr_list[i], if (memcmp(hp->h_addr_list[i],
(char *) &sin->sin_addr, (char *) &sin->sin_addr,
sizeof(sin->sin_addr)) == 0) sizeof(sin->sin_addr)) == 0)
return; /* name is good, keep it */ return; /* name is good, keep it */
#endif
} }
/* /*
@ -345,21 +375,12 @@ struct host_info *host;
* server. * server.
*/ */
#ifdef INET6
inet_ntop(sin->sa_family, ap, addr, sizeof(addr));
tcpd_warn("host name/address mismatch: %s != %.*s",
addr, STRING_LENGTH, hp->h_name);
#else
tcpd_warn("host name/address mismatch: %s != %.*s", tcpd_warn("host name/address mismatch: %s != %.*s",
inet_ntoa(sin->sin_addr), STRING_LENGTH, hp->h_name); inet_ntoa(sin->sin_addr), STRING_LENGTH, hp->h_name);
#endif
} }
strcpy(host->name, paranoid); /* name is bad, clobber it */ strcpy(host->name, paranoid); /* name is bad, clobber it */
#if defined(INET6) && defined(USE_GETIPNODEBY)
if (hp)
freehostent(hp);
#endif
} }
#endif /* INET6 */
} }
/* sock_sink - absorb unreceived IP datagram */ /* sock_sink - absorb unreceived IP datagram */

11
contrib/tcp_wrappers/tcpdchk.c
View file

@ -410,7 +410,7 @@ char *pat;
static int is_inet6_addr(pat) static int is_inet6_addr(pat)
char *pat; char *pat;
{ {
struct in6_addr addr; struct addrinfo hints, *res;
int len, ret; int len, ret;
char ch; char ch;
@ -420,9 +420,14 @@ static int is_inet6_addr(pat)
if ((ch = pat[len - 1]) != ']') if ((ch = pat[len - 1]) != ']')
return (0); return (0);
pat[len - 1] = '\0'; pat[len - 1] = '\0';
ret = inet_pton(AF_INET6, pat + 1, &addr); memset(&hints, 0, sizeof(hints));
hints.ai_family = AF_INET6;
hints.ai_socktype = SOCK_STREAM;
hints.ai_flags = AI_PASSIVE | AI_NUMERICHOST;
if ((ret = getaddrinfo(pat + 1, NULL, &hints, &res)) == 0)
freeaddrinfo(res);
pat[len - 1] = ch; pat[len - 1] = ch;
return (ret == 1); return (ret == 0);
} }
#endif #endif

94
contrib/tcp_wrappers/tcpdmatch.c
View file

@ -59,7 +59,11 @@ int main(argc, argv)
int argc; int argc;
char **argv; char **argv;
{ {
#ifdef INET6
struct addrinfo hints, *hp, *res;
#else
struct hostent *hp; struct hostent *hp;
#endif
char *myname = argv[0]; char *myname = argv[0];
char *client; char *client;
char *server; char *server;
@ -73,8 +77,6 @@ char **argv;
#ifdef INET6 #ifdef INET6
struct sockaddr_storage server_sin; struct sockaddr_storage server_sin;
struct sockaddr_storage client_sin; struct sockaddr_storage client_sin;
char *ap;
int alen;
#else #else
struct sockaddr_in server_sin; struct sockaddr_in server_sin;
struct sockaddr_in client_sin; struct sockaddr_in client_sin;
@ -181,33 +183,17 @@ char **argv;
if (NOT_INADDR(server) == 0 || HOSTNAME_KNOWN(server)) { if (NOT_INADDR(server) == 0 || HOSTNAME_KNOWN(server)) {
if ((hp = find_inet_addr(server)) == 0) if ((hp = find_inet_addr(server)) == 0)
exit(1); exit(1);
#ifndef INET6
memset((char *) &server_sin, 0, sizeof(server_sin)); memset((char *) &server_sin, 0, sizeof(server_sin));
#ifdef INET6
server_sin.ss_family = hp->h_addrtype;
switch (hp->h_addrtype) {
case AF_INET:
ap = (char *)&((struct sockaddr_in *)&server_sin)->sin_addr;
alen = sizeof(struct sockaddr_in);
break;
case AF_INET6:
ap = (char *)&((struct sockaddr_in6 *)&server_sin)->sin6_addr;
alen = sizeof(struct sockaddr_in6);
break;
default:
exit(1);
}
#ifdef SIN6_LEN
server_sin.ss_len = alen;
#endif
#else
server_sin.sin_family = AF_INET; server_sin.sin_family = AF_INET;
#endif #endif
request_set(&request, RQ_SERVER_SIN, &server_sin, 0); request_set(&request, RQ_SERVER_SIN, &server_sin, 0);
for (count = 0; (addr = hp->h_addr_list[count]) != 0; count++) {
#ifdef INET6 #ifdef INET6
memcpy(ap, addr, alen); for (res = hp, count = 0; res; res = res->ai_next, count++) {
memcpy(&server_sin, res->ai_addr, res->ai_addrlen);
#else #else
for (count = 0; (addr = hp->h_addr_list[count]) != 0; count++) {
memcpy((char *) &server_sin.sin_addr, addr, memcpy((char *) &server_sin.sin_addr, addr,
sizeof(server_sin.sin_addr)); sizeof(server_sin.sin_addr));
#endif #endif
@ -226,7 +212,11 @@ char **argv;
fprintf(stderr, "Please specify an address instead\n"); fprintf(stderr, "Please specify an address instead\n");
exit(1); exit(1);
} }
#ifdef INET6
freeaddrinfo(hp);
#else
free((char *) hp); free((char *) hp);
#endif
} else { } else {
request_set(&request, RQ_SERVER_NAME, server, 0); request_set(&request, RQ_SERVER_NAME, server, 0);
} }
@ -240,6 +230,18 @@ char **argv;
tcpdmatch(&request); tcpdmatch(&request);
exit(0); exit(0);
} }
#ifdef INET6
memset(&hints, 0, sizeof(hints));
hints.ai_family = AF_INET6;
hints.ai_socktype = SOCK_STREAM;
hints.ai_flags = AI_PASSIVE | AI_NUMERICHOST;
if (getaddrinfo(client, NULL, &hints, &res) == 0) {
freeaddrinfo(res);
request_set(&request, RQ_CLIENT_ADDR, client, 0);
tcpdmatch(&request);
exit(0);
}
#endif
/* /*
* Perhaps they are testing special client hostname patterns that aren't * Perhaps they are testing special client hostname patterns that aren't
@ -261,36 +263,41 @@ char **argv;
*/ */
if ((hp = find_inet_addr(client)) == 0) if ((hp = find_inet_addr(client)) == 0)
exit(1); exit(1);
memset((char *) &client_sin, 0, sizeof(client_sin));
#ifdef INET6 #ifdef INET6
client_sin.ss_family = hp->h_addrtype; request_set(&request, RQ_CLIENT_SIN, &client_sin, 0);
switch (hp->h_addrtype) {
case AF_INET: for (res = hp, count = 0; res; res = res->ai_next, count++) {
ap = (char *)&((struct sockaddr_in *)&client_sin)->sin_addr; memcpy(&client_sin, res->ai_addr, res->ai_addrlen);
alen = sizeof(struct sockaddr_in);
break; /*
case AF_INET6: * getnameinfo() doesn't do reverse lookup against link-local
ap = (char *)&((struct sockaddr_in6 *)&client_sin)->sin6_addr; * address. So, we pass through host name evaluation against
alen = sizeof(struct sockaddr_in6); * such addresses.
break; */
default: if (res->ai_family != AF_INET6 ||
exit(1); !IN6_IS_ADDR_LINKLOCAL(&((struct sockaddr_in6 *)res->ai_addr)->sin6_addr)) {
/*
* Force evaluation of client host name and address. Host name
* conflicts will be reported while eval_hostname() does its job.
*/
request_set(&request, RQ_CLIENT_NAME, "", RQ_CLIENT_ADDR, "", 0);
if (STR_EQ(eval_hostname(request.client), unknown))
tcpd_warn("host address %s->name lookup failed",
eval_hostaddr(request.client));
}
tcpdmatch(&request);
if (res->ai_next)
printf("\n");
} }
#ifdef SIN6_LEN freeaddrinfo(hp);
client_sin.ss_len = alen;
#endif
#else #else
memset((char *) &client_sin, 0, sizeof(client_sin));
client_sin.sin_family = AF_INET; client_sin.sin_family = AF_INET;
#endif
request_set(&request, RQ_CLIENT_SIN, &client_sin, 0); request_set(&request, RQ_CLIENT_SIN, &client_sin, 0);
for (count = 0; (addr = hp->h_addr_list[count]) != 0; count++) { for (count = 0; (addr = hp->h_addr_list[count]) != 0; count++) {
#ifdef INET6
memcpy(ap, addr, alen);
#else
memcpy((char *) &client_sin.sin_addr, addr, memcpy((char *) &client_sin.sin_addr, addr,
sizeof(client_sin.sin_addr)); sizeof(client_sin.sin_addr));
#endif
/* /*
* Force evaluation of client host name and address. Host name * Force evaluation of client host name and address. Host name
@ -305,6 +312,7 @@ char **argv;
printf("\n"); printf("\n");
} }
free((char *) hp); free((char *) hp);
#endif
exit(0); exit(0);
} }

1
lib/libwrap/Makefile
View file

@ -17,7 +17,6 @@ CFLAGS+=-DFACILITY=LOG_AUTH -DHOSTS_ACCESS -DNETGROUP -DDAEMON_UMASK=022 \
-DSEVERITY=LOG_INFO -DRFC931_TIMEOUT=10 \ -DSEVERITY=LOG_INFO -DRFC931_TIMEOUT=10 \
-DHOSTS_DENY=\"/etc/hosts.deny\" -DHOSTS_ALLOW=\"/etc/hosts.allow\" \ -DHOSTS_DENY=\"/etc/hosts.deny\" -DHOSTS_ALLOW=\"/etc/hosts.allow\" \
-DSYS_ERRLIST_DEFINED -DALWAYS_HOSTNAME -DSYS_ERRLIST_DEFINED -DALWAYS_HOSTNAME
CFLAGS+=-DUSE_GETIPNODEBY
.if !defined(NOINET6) .if !defined(NOINET6)
CFLAGS+=-DINET6 CFLAGS+=-DINET6
.endif .endif

4
usr.sbin/tcpdchk/Makefile
View file

@ -11,7 +11,9 @@ SRCS= tcpdchk.c fakelog.c inetcf.c scaffold.c
CFLAGS= -DREAL_DAEMON_DIR=\"/usr/libexec\" \ CFLAGS= -DREAL_DAEMON_DIR=\"/usr/libexec\" \
-DSEVERITY=LOG_INFO -DRFC931_TIMEOUT=10 \ -DSEVERITY=LOG_INFO -DRFC931_TIMEOUT=10 \
-DHOSTS_DENY=\"/etc/hosts.deny\" -DHOSTS_ALLOW=\"/etc/hosts.allow\" -DHOSTS_DENY=\"/etc/hosts.deny\" -DHOSTS_ALLOW=\"/etc/hosts.allow\"
CFLAGS+=-DINET6 -DUSE_GETIPNODEBY .if !defined(NOINET6)
CFLAGS+=-DINET6
.endif
DPADD= ${LIBWRAP} DPADD= ${LIBWRAP}
LDADD= -lwrap LDADD= -lwrap

3
usr.sbin/tcpdmatch/Makefile
View file

@ -10,6 +10,9 @@ SRCS= tcpdmatch.c fakelog.c inetcf.c scaffold.c
CFLAGS= -DREAL_DAEMON_DIR=\"/usr/libexec\" \ CFLAGS= -DREAL_DAEMON_DIR=\"/usr/libexec\" \
-DSEVERITY=LOG_INFO -DRFC931_TIMEOUT=10 -DSEVERITY=LOG_INFO -DRFC931_TIMEOUT=10
.if !defined(NOINET6)
CFLAGS+=-DINET6
.endif
DPADD= ${LIBWRAP} DPADD= ${LIBWRAP}
LDADD= -lwrap LDADD= -lwrap