libs/tcp_wrappers/patches/001-debian_subset.patch

   1 --- a/hosts_access.c
   2 +++ b/hosts_access.c
   3 @@ -240,6 +240,26 @@ struct request_info *request;
   4      }
   5  }
   6
   7 +/* hostfile_match - look up host patterns from file */
   8 +
   9 +static int hostfile_match(path, host)
  10 +char   *path;
  11 +struct hosts_info *host;
  12 +{
  13 +    char    tok[BUFSIZ];
  14 +    int     match = NO;
  15 +    FILE   *fp;
  16 +
  17 +    if ((fp = fopen(path, "r")) != 0) {
  18 +        while (fscanf(fp, "%s", tok) == 1 && !(match = host_match(tok, host)))
  19 +            /* void */ ;
  20 +        fclose(fp);
  21 +    } else if (errno != ENOENT) {
  22 +        tcpd_warn("open %s: %m", path);
  23 +    }
  24 +    return (match);
  25 +}
  26 +
  27  /* host_match - match host name and/or address against pattern */
  28
  29  static int host_match(tok, host)
  30 @@ -267,6 +287,8 @@ struct host_info *host;
  31         tcpd_warn("netgroup support is disabled");      /* not tcpd_jump() */
  32         return (NO);
  33  #endif
  34 +    } else if (tok[0] == '/') {                         /* /file hack */
  35 +        return (hostfile_match(tok, host));
  36      } else if (STR_EQ(tok, "KNOWN")) {         /* check address and name */
  37         char   *name = eval_hostname(host);
  38         return (STR_NE(eval_hostaddr(host), unknown) && HOSTNAME_KNOWN(name));
  39 --- a/tcpd.h
  40 +++ b/tcpd.h
  41 @@ -4,6 +4,27 @@
  42    * Author: Wietse Venema, Eindhoven University of Technology, The Netherlands.
  43    */
  44
  45 +#ifndef _TCPWRAPPERS_TCPD_H
  46 +#define _TCPWRAPPERS_TCPD_H
  47 +
  48 +/* someone else may have defined this */
  49 +#undef  __P
  50 +
  51 +/* use prototypes if we have an ANSI C compiler or are using C++ */
  52 +#if defined(__STDC__) || defined(__cplusplus)
  53 +#define __P(args)       args
  54 +#else
  55 +#define __P(args)       ()
  56 +#endif
  57 +
  58 +/* Need definitions of struct sockaddr_in and FILE. */
  59 +#include <netinet/in.h>
  60 +#include <stdio.h>
  61 +
  62 +#ifdef __cplusplus
  63 +extern "C" {
  64 +#endif
  65 +
  66  /* Structure to describe one communications endpoint. */
  67
  68  #define STRING_LENGTH  128             /* hosts, users, processes */
  69 @@ -25,10 +46,10 @@ struct request_info {
  70      char    pid[10];                   /* access via eval_pid(request) */
  71      struct host_info client[1];                /* client endpoint info */
  72      struct host_info server[1];                /* server endpoint info */
  73 -    void  (*sink) ();                  /* datagram sink function or 0 */
  74 -    void  (*hostname) ();              /* address to printable hostname */
  75 -    void  (*hostaddr) ();              /* address to printable address */
  76 -    void  (*cleanup) ();               /* cleanup function or 0 */
  77 +    void  (*sink) __P((int));          /* datagram sink function or 0 */
  78 +    void  (*hostname) __P((struct host_info *)); /* address to printable hostname */
  79 +    void  (*hostaddr) __P((struct host_info *)); /* address to printable address */
  80 +    void  (*cleanup) __P((struct request_info *)); /* cleanup function or 0 */
  81      struct netconfig *config;          /* netdir handle */
  82  };
  83
  84 @@ -61,25 +82,30 @@ extern char paranoid[];
  85  /* Global functions. */
  86
  87  #if defined(TLI) || defined(PTX) || defined(TLI_SEQUENT)
  88 -extern void fromhost();                        /* get/validate client host info */
  89 +extern void fromhost __P((struct request_info *));     /* get/validate client host info */
  90  #else
  91  #define fromhost sock_host             /* no TLI support needed */
  92  #endif
  93
  94 -extern int hosts_access();             /* access control */
  95 -extern void shell_cmd();               /* execute shell command */
  96 -extern char *percent_x();              /* do %<char> expansion */
  97 -extern void rfc931();                  /* client name from RFC 931 daemon */
  98 -extern void clean_exit();              /* clean up and exit */
  99 -extern void refuse();                  /* clean up and exit */
 100 -extern char *xgets();                  /* fgets() on steroids */
 101 -extern char *split_at();               /* strchr() and split */
 102 -extern unsigned long dot_quad_addr();  /* restricted inet_addr() */
 103 +extern void shell_cmd __P((char *));   /* execute shell command */
 104 +extern char *percent_x __P((char *, int, char *, struct request_info *)); /* do %<char> expansion */
 105 +extern void rfc931 __P((struct sockaddr_in *, struct sockaddr_in *, char *)); /* client name from RFC 931 daemon */
 106 +extern void clean_exit __P((struct request_info *)); /* clean up and exit */
 107 +extern void refuse __P((struct request_info *));       /* clean up and exit */
 108 +extern char *xgets __P((char *, int, FILE *)); /* fgets() on steroids */
 109 +extern char *split_at __P((char *, int));      /* strchr() and split */
 110 +extern unsigned long dot_quad_addr __P((char *)); /* restricted inet_addr() */
 111
 112  /* Global variables. */
 113
 114 +#ifdef HAVE_WEAKSYMS
 115 +extern int allow_severity __attribute__ ((weak)); /* for connection logging */
 116 +extern int deny_severity __attribute__ ((weak)); /* for connection logging */
 117 +#else
 118  extern int allow_severity;             /* for connection logging */
 119  extern int deny_severity;              /* for connection logging */
 120 +#endif
 121 +
 122  extern char *hosts_allow_table;                /* for verification mode redirection */
 123  extern char *hosts_deny_table;         /* for verification mode redirection */
 124  extern int hosts_access_verbose;       /* for verbose matching mode */
 125 @@ -92,9 +118,14 @@ extern int resident;                        /* > 0 if resident process */
 126    */
 127
 128  #ifdef __STDC__
 129 +extern int hosts_access(struct request_info *request);
 130 +extern int hosts_ctl(char *daemon, char *client_name, char *client_addr,
 131 +                     char *client_user);
 132  extern struct request_info *request_init(struct request_info *,...);
 133  extern struct request_info *request_set(struct request_info *,...);
 134  #else
 135 +extern int hosts_access();
 136 +extern int hosts_ctl();
 137  extern struct request_info *request_init();    /* initialize request */
 138  extern struct request_info *request_set();     /* update request structure */
 139  #endif
 140 @@ -117,27 +148,31 @@ extern struct request_info *request_set();        /* update request structure */
 141    * host_info structures serve as caches for the lookup results.
 142    */
 143
 144 -extern char *eval_user();              /* client user */
 145 -extern char *eval_hostname();          /* printable hostname */
 146 -extern char *eval_hostaddr();          /* printable host address */
 147 -extern char *eval_hostinfo();          /* host name or address */
 148 -extern char *eval_client();            /* whatever is available */
 149 -extern char *eval_server();            /* whatever is available */
 150 +extern char *eval_user __P((struct request_info *));   /* client user */
 151 +extern char *eval_hostname __P((struct host_info *));  /* printable hostname */
 152 +extern char *eval_hostaddr __P((struct host_info *));  /* printable host address */
 153 +extern char *eval_hostinfo __P((struct host_info *));  /* host name or address */
 154 +extern char *eval_client __P((struct request_info *)); /* whatever is available */
 155 +extern char *eval_server __P((struct request_info *)); /* whatever is available */
 156  #define eval_daemon(r) ((r)->daemon)   /* daemon process name */
 157  #define eval_pid(r)    ((r)->pid)      /* process id */
 158
 159  /* Socket-specific methods, including DNS hostname lookups. */
 160
 161 -extern void sock_host();               /* look up endpoint addresses */
 162 -extern void sock_hostname();           /* translate address to hostname */
 163 -extern void sock_hostaddr();           /* address to printable address */
 164 +/* look up endpoint addresses */
 165 +extern void sock_host __P((struct request_info *));
 166 +/* translate address to hostname */
 167 +extern void sock_hostname __P((struct host_info *));
 168 +/* address to printable address */
 169 +extern void sock_hostaddr __P((struct host_info *));
 170 +
 171  #define sock_methods(r) \
 172         { (r)->hostname = sock_hostname; (r)->hostaddr = sock_hostaddr; }
 173
 174  /* The System V Transport-Level Interface (TLI) interface. */
 175
 176  #if defined(TLI) || defined(PTX) || defined(TLI_SEQUENT)
 177 -extern void tli_host();                        /* look up endpoint addresses etc. */
 178 +extern void tli_host __P((struct request_info *));     /* look up endpoint addresses etc. */
 179  #endif
 180
 181   /*
 182 @@ -178,7 +213,7 @@ extern struct tcpd_context tcpd_context;
 183    * behavior.
 184    */
 185
 186 -extern void process_options();         /* execute options */
 187 +extern void process_options __P((char *, struct request_info *)); /* execute options */
 188  extern int dry_run;                    /* verification flag */
 189
 190  /* Bug workarounds. */
 191 @@ -217,3 +252,9 @@ extern char *fix_strtok();
 192  #define strtok my_strtok
 193  extern char *my_strtok();
 194  #endif
 195 +
 196 +#ifdef __cplusplus
 197 +}
 198 +#endif
 199 +
 200 +#endif /* tcpd.h */
 201 --- a/Makefile
 202 +++ b/Makefile
 203 @@ -1,5 +1,10 @@
 204 +GLIBC=$(shell grep -s -c __GLIBC__ /usr/include/features.h)
 205 +
 206  # @(#) Makefile 1.23 97/03/21 19:27:20
 207
 208 +# unset the HOSTNAME environment variable
 209 +HOSTNAME =
 210 +
 211  what:
 212         @echo
 213         @echo "Usage: edit the REAL_DAEMON_DIR definition in the Makefile then:"
 214 @@ -19,7 +24,7 @@ what:
 215         @echo " generic (most bsd-ish systems with sys5 compatibility)"
 216         @echo " 386bsd aix alpha apollo bsdos convex-ultranet dell-gcc dgux dgux543"
 217         @echo " dynix epix esix freebsd hpux irix4 irix5 irix6 isc iunix"
 218 -       @echo " linux machten mips(untested) ncrsvr4 netbsd next osf power_unix_211"
 219 +       @echo " linux gnu machten mips(untested) ncrsvr4 netbsd next osf power_unix_211"
 220         @echo " ptx-2.x ptx-generic pyramid sco sco-nis sco-od2 sco-os5 sinix sunos4"
 221         @echo " sunos40 sunos5 sysv4 tandem ultrix unicos7 unicos8 unixware1 unixware2"
 222         @echo " uts215 uxp"
 223 @@ -43,8 +48,8 @@ what:
 224  # Ultrix 4.x SunOS 4.x ConvexOS 10.x Dynix/ptx
 225  #REAL_DAEMON_DIR=/usr/etc
 226  #
 227 -# SysV.4 Solaris 2.x OSF AIX
 228 -#REAL_DAEMON_DIR=/usr/sbin
 229 +# SysV.4 Solaris 2.x OSF AIX Linux
 230 +REAL_DAEMON_DIR=/usr/sbin
 231  #
 232  # BSD 4.4
 233  #REAL_DAEMON_DIR=/usr/libexec
 234 @@ -141,10 +146,21 @@ freebsd:
 235         LIBS= RANLIB=ranlib ARFLAGS=rv AUX_OBJ= NETGROUP= TLI= \
 236         EXTRA_CFLAGS=-DSYS_ERRLIST_DEFINED VSYSLOG= all
 237
 238 +ifneq ($(GLIBC),0)
 239 +MYLIB=-lnsl
 240 +endif
 241 +
 242  linux:
 243         @make REAL_DAEMON_DIR=$(REAL_DAEMON_DIR) STYLE=$(STYLE) \
 244 -       LIBS= RANLIB=ranlib ARFLAGS=rv AUX_OBJ=setenv.o \
 245 -       NETGROUP= TLI= EXTRA_CFLAGS="-DBROKEN_SO_LINGER" all
 246 +       LIBS=$(MYLIB) RANLIB=ranlib ARFLAGS=rv AUX_OBJ=weak_symbols.o \
 247 +       NETGROUP=-DNETGROUP TLI= VSYSLOG= BUGS= all \
 248 +       EXTRA_CFLAGS="-DSYS_ERRLIST_DEFINED -DHAVE_WEAKSYMS -D_REENTRANT"
 249 +
 250 +gnu:
 251 +       @make REAL_DAEMON_DIR=$(REAL_DAEMON_DIR) STYLE=$(STYLE) \
 252 +       LIBS=$(MYLIB) RANLIB=ranlib ARFLAGS=rv AUX_OBJ=weak_symbols.o \
 253 +       NETGROUP=-DNETGROUP TLI= VSYSLOG= BUGS= all \
 254 +       EXTRA_CFLAGS="-DHAVE_STRERROR -DHAVE_WEAKSYMS -D_REENTRANT"
 255
 256  # This is good for many SYSV+BSD hybrids with NIS, probably also for HP-UX 7.x.
 257  hpux hpux8 hpux9 hpux10:
 258 @@ -391,7 +407,7 @@ AR  = ar
 259  # the ones provided with this source distribution. The environ.c module
 260  # implements setenv(), getenv(), and putenv().
 261
 262 -AUX_OBJ= setenv.o
 263 +#AUX_OBJ= setenv.o
 264  #AUX_OBJ= environ.o
 265  #AUX_OBJ= environ.o strcasecmp.o
 266
 267 @@ -454,7 +470,8 @@ AUX_OBJ= setenv.o
 268  # host name aliases. Compile with -DSOLARIS_24_GETHOSTBYNAME_BUG to work
 269  # around this. The workaround does no harm on other Solaris versions.
 270
 271 -BUGS = -DGETPEERNAME_BUG -DBROKEN_FGETS -DLIBC_CALLS_STRTOK
 272 +BUGS =
 273 +#BUGS = -DGETPEERNAME_BUG -DBROKEN_FGETS -DLIBC_CALLS_STRTOK
 274  #BUGS = -DGETPEERNAME_BUG -DBROKEN_FGETS -DINET_ADDR_BUG
 275  #BUGS = -DGETPEERNAME_BUG -DBROKEN_FGETS -DSOLARIS_24_GETHOSTBYNAME_BUG
 276
 277 @@ -464,7 +481,7 @@ BUGS = -DGETPEERNAME_BUG -DBROKEN_FGETS
 278  # If your system supports NIS or YP-style netgroups, enable the following
 279  # macro definition. Netgroups are used only for host access control.
 280  #
 281 -#NETGROUP= -DNETGROUP
 282 +NETGROUP= -DNETGROUP
 283
 284  ###############################################################
 285  # System dependencies: whether or not your system has vsyslog()
 286 @@ -491,7 +508,7 @@ VSYSLOG     = -Dvsyslog=myvsyslog
 287  # Uncomment the next definition to turn on the language extensions
 288  # (examples: allow, deny, banners, twist and spawn).
 289  #
 290 -#STYLE = -DPROCESS_OPTIONS     # Enable language extensions.
 291 +STYLE  = -DPROCESS_OPTIONS     # Enable language extensions.
 292
 293  ################################################################
 294  # Optional: Changing the default disposition of logfile records
 295 @@ -514,7 +531,7 @@ VSYSLOG     = -Dvsyslog=myvsyslog
 296  #
 297  # The LOG_XXX names below are taken from the /usr/include/syslog.h file.
 298
 299 -FACILITY= LOG_MAIL     # LOG_MAIL is what most sendmail daemons use
 300 +FACILITY= LOG_DAEMON   # LOG_MAIL is what most sendmail daemons use
 301
 302  # The syslog priority at which successful connections are logged.
 303
 304 @@ -610,7 +627,7 @@ TABLES      = -DHOSTS_DENY=\"/etc/hosts.deny\
 305  # Paranoid mode implies hostname lookup. In order to disable hostname
 306  # lookups altogether, see the next section.
 307
 308 -PARANOID= -DPARANOID
 309 +#PARANOID= -DPARANOID
 310
 311  ########################################
 312  # Optional: turning off hostname lookups
 313 @@ -623,7 +640,7 @@ PARANOID= -DPARANOID
 314  # In order to perform selective hostname lookups, disable paranoid
 315  # mode (see previous section) and comment out the following definition.
 316
 317 -HOSTNAME= -DALWAYS_HOSTNAME
 318 +#HOSTNAME= -DALWAYS_HOSTNAME
 319
 320  #############################################
 321  # Optional: Turning on host ADDRESS checking
 322 @@ -649,28 +666,46 @@ HOSTNAME= -DALWAYS_HOSTNAME
 323  # source-routed traffic in the kernel. Examples: 4.4BSD derivatives,
 324  # Solaris 2.x, and Linux. See your system documentation for details.
 325  #
 326 -# KILL_OPT= -DKILL_IP_OPTIONS
 327 +KILL_OPT= -DKILL_IP_OPTIONS
 328
 329  ## End configuration options
 330  ############################
 331
 332  # Protection against weird shells or weird make programs.
 333
 334 +CC     = gcc
 335  SHELL  = /bin/sh
 336 -.c.o:; $(CC) $(CFLAGS) -c $*.c
 337 +.c.o:; $(CC) $(CFLAGS) -o $*.o -c $*.c
 338 +
 339 +SOMAJOR = 0
 340 +SOMINOR = 7.6
 341 +
 342 +LIB    = libwrap.a
 343 +SHLIB  = shared/libwrap.so.$(SOMAJOR).$(SOMINOR)
 344 +SHLIBSOMAJ= shared/libwrap.so.$(SOMAJOR)
 345 +SHLIBSO        = shared/libwrap.so
 346 +SHLIBFLAGS = -Lshared -lwrap
 347
 348 -CFLAGS = -O -DFACILITY=$(FACILITY) $(ACCESS) $(PARANOID) $(NETGROUP) \
 349 +shared/%.o: %.c
 350 +       $(CC) $(CFLAGS) $(SHCFLAGS) -c $< -o $@
 351 +
 352 +CFLAGS = -O2 -g -DFACILITY=$(FACILITY) $(ACCESS) $(PARANOID) $(NETGROUP) \
 353         $(BUGS) $(SYSTYPE) $(AUTH) $(UMASK) \
 354         -DREAL_DAEMON_DIR=\"$(REAL_DAEMON_DIR)\" $(STYLE) $(KILL_OPT) \
 355         -DSEVERITY=$(SEVERITY) -DRFC931_TIMEOUT=$(RFC931_TIMEOUT) \
 356         $(UCHAR) $(TABLES) $(STRINGS) $(TLI) $(EXTRA_CFLAGS) $(DOT) \
 357         $(VSYSLOG) $(HOSTNAME)
 358
 359 +SHLINKFLAGS = -shared -Xlinker -soname -Xlinker libwrap.so.$(SOMAJOR) -lc $(LIBS)
 360 +SHCFLAGS = -fPIC -shared -D_REENTRANT
 361 +
 362  LIB_OBJ= hosts_access.o options.o shell_cmd.o rfc931.o eval.o \
 363         hosts_ctl.o refuse.o percent_x.o clean_exit.o $(AUX_OBJ) \
 364         $(FROM_OBJ) fix_options.o socket.o tli.o workarounds.o \
 365         update.o misc.o diag.o percent_m.o myvsyslog.o
 366
 367 +SHLIB_OBJ= $(addprefix shared/, $(LIB_OBJ));
 368 +
 369  FROM_OBJ= fromhost.o
 370
 371  KIT    = README miscd.c tcpd.c fromhost.c hosts_access.c shell_cmd.c \
 372 @@ -684,46 +719,78 @@ KIT       = README miscd.c tcpd.c fromhost.c h
 373         refuse.c tcpdchk.8 setenv.c inetcf.c inetcf.h scaffold.c \
 374         scaffold.h tcpdmatch.8 README.NIS
 375
 376 -LIB    = libwrap.a
 377 -
 378 -all other: config-check tcpd tcpdmatch try-from safe_finger tcpdchk
 379 +all other: config-check tcpd tcpdmatch try-from safe_finger tcpdchk $(LIB)
 380
 381  # Invalidate all object files when the compiler options (CFLAGS) have changed.
 382
 383  config-check:
 384         @set +e; test -n "$(REAL_DAEMON_DIR)" || { make; exit 1; }
 385 -       @set +e; echo $(CFLAGS) >/tmp/cflags.$$$$ ; \
 386 -       if cmp cflags /tmp/cflags.$$$$ ; \
 387 -       then rm /tmp/cflags.$$$$ ; \
 388 -       else mv /tmp/cflags.$$$$ cflags ; \
 389 +       @set +e; echo $(CFLAGS) >cflags.new ; \
 390 +       if cmp cflags cflags.new ; \
 391 +       then rm cflags.new ; \
 392 +       else mv cflags.new cflags ; \
 393         fi >/dev/null 2>/dev/null
 394 +       @if [ ! -d shared ]; then mkdir shared; fi
 395
 396  $(LIB):        $(LIB_OBJ)
 397         rm -f $(LIB)
 398         $(AR) $(ARFLAGS) $(LIB) $(LIB_OBJ)
 399         -$(RANLIB) $(LIB)
 400
 401 -tcpd:  tcpd.o $(LIB)
 402 -       $(CC) $(CFLAGS) -o $@ tcpd.o $(LIB) $(LIBS)
 403 +$(SHLIB): $(SHLIB_OBJ)
 404 +       rm -f $(SHLIB)
 405 +       $(CC) -o $(SHLIB) $(SHLINKFLAGS) $(SHLIB_OBJ)
 406 +       ln -s $(notdir $(SHLIB)) $(SHLIBSOMAJ)
 407 +       ln -s $(notdir $(SHLIBSOMAJ)) $(SHLIBSO)
 408 +
 409 +tcpd:  tcpd.o $(SHLIB)
 410 +       $(CC) $(CFLAGS) -o $@ tcpd.o $(SHLIBFLAGS)
 411
 412 -miscd: miscd.o $(LIB)
 413 -       $(CC) $(CFLAGS) -o $@ miscd.o $(LIB) $(LIBS)
 414 +miscd: miscd.o $(SHLIB)
 415 +       $(CC) $(CFLAGS) -o $@ miscd.o $(SHLIBFLAGS)
 416
 417 -safe_finger: safe_finger.o $(LIB)
 418 -       $(CC) $(CFLAGS) -o $@ safe_finger.o $(LIB) $(LIBS)
 419 +safe_finger: safe_finger.o $(SHLIB)
 420 +       $(CC) $(CFLAGS) -o $@ safe_finger.o $(SHLIBFLAGS)
 421
 422  TCPDMATCH_OBJ = tcpdmatch.o fakelog.o inetcf.o scaffold.o
 423
 424 -tcpdmatch: $(TCPDMATCH_OBJ) $(LIB)
 425 -       $(CC) $(CFLAGS) -o $@ $(TCPDMATCH_OBJ) $(LIB) $(LIBS)
 426 +tcpdmatch: $(TCPDMATCH_OBJ) $(SHLIB)
 427 +       $(CC) $(CFLAGS) -o $@ $(TCPDMATCH_OBJ) $(SHLIBFLAGS)
 428
 429 -try-from: try-from.o fakelog.o $(LIB)
 430 -       $(CC) $(CFLAGS) -o $@ try-from.o fakelog.o $(LIB) $(LIBS)
 431 +try-from: try-from.o fakelog.o $(SHLIB)
 432 +       $(CC) $(CFLAGS) -o $@ try-from.o fakelog.o $(SHLIBFLAGS)
 433
 434  TCPDCHK_OBJ = tcpdchk.o fakelog.o inetcf.o scaffold.o
 435
 436 -tcpdchk: $(TCPDCHK_OBJ) $(LIB)
 437 -       $(CC) $(CFLAGS) -o $@ $(TCPDCHK_OBJ) $(LIB) $(LIBS)
 438 +tcpdchk: $(TCPDCHK_OBJ) $(SHLIB)
 439 +       $(CC) $(CFLAGS) -o $@ $(TCPDCHK_OBJ) $(SHLIBFLAGS)
 440 +
 441 +install: install-lib install-bin install-dev
 442 +
 443 +install-lib:
 444 +       install -o root -g root -m 0644 $(SHLIB) ${DESTDIR}/lib/
 445 +       ln -s $(notdir $(SHLIB)) ${DESTDIR}/lib/$(notdir $(SHLIBSOMAJ))
 446 +
 447 +install-bin:
 448 +       install -o root -g root -m 0755 tcpd ${DESTDIR}/usr/sbin/
 449 +       install -o root -g root -m 0755 tcpdchk ${DESTDIR}/usr/sbin/
 450 +       install -o root -g root -m 0755 tcpdmatch ${DESTDIR}/usr/sbin/
 451 +       install -o root -g root -m 0755 try-from ${DESTDIR}/usr/sbin/
 452 +       install -o root -g root -m 0755 safe_finger ${DESTDIR}/usr/sbin/
 453 +       install -o root -g root -m 0644 tcpd.8 ${DESTDIR}/usr/share/man/man8/
 454 +       install -o root -g root -m 0644 tcpdchk.8 ${DESTDIR}/usr/share/man/man8/
 455 +       install -o root -g root -m 0644 tcpdmatch.8 ${DESTDIR}/usr/share/man/man8/
 456 +       install -o root -g root -m 0644 hosts_access.5 ${DESTDIR}/usr/share/man/man5/
 457 +       install -o root -g root -m 0644 hosts_options.5 ${DESTDIR}/usr/share/man/man5/
 458 +
 459 +install-dev:
 460 +       ln -s /lib/$(notdir $(SHLIBSOMAJ)) ${DESTDIR}/usr/lib/$(notdir $(SHLIBSO))
 461 +       install -o root -g root -m 0644 hosts_access.3 ${DESTDIR}/usr/share/man/man3/
 462 +       install -o root -g root -m 0644 tcpd.h ${DESTDIR}/usr/include/
 463 +       install -o root -g root -m 0644 $(LIB) ${DESTDIR}/usr/lib/
 464 +       ln -s hosts_access.3 ${DESTDIR}/usr/share/man/man3/hosts_ctl.3
 465 +       ln -s hosts_access.3 ${DESTDIR}/usr/share/man/man3/request_init.3
 466 +       ln -s hosts_access.3 ${DESTDIR}/usr/share/man/man3/request_set.3
 467
 468  shar:  $(KIT)
 469         @shar $(KIT)
 470 @@ -739,7 +806,8 @@ archive:
 471
 472  clean:
 473         rm -f tcpd miscd safe_finger tcpdmatch tcpdchk try-from *.[oa] core \
 474 -       cflags
 475 +       cflags libwrap*.so*
 476 +       rm -rf shared
 477
 478  tidy:  clean
 479         chmod -R a+r .
 480 @@ -885,5 +953,6 @@ update.o: cflags
 481  update.o: mystdarg.h
 482  update.o: tcpd.h
 483  vfprintf.o: cflags
 484 +weak_symbols.o: tcpd.h
 485  workarounds.o: cflags
 486  workarounds.o: tcpd.h
 487 --- a/hosts_access.5
 488 +++ b/hosts_access.5
 489 @@ -8,9 +8,9 @@ name, host name/address) patterns.  Exam
 490  impatient reader is encouraged to skip to the EXAMPLES section for a
 491  quick introduction.
 492  .PP
 493 -An extended version of the access control language is described in the
 494 -\fIhosts_options\fR(5) document. The extensions are turned on at
 495 -program build time by building with -DPROCESS_OPTIONS.
 496 +The extended version of the access control language is described in the
 497 +\fIhosts_options\fR(5) document. \fBNote that this language supersedes
 498 +the meaning of \fIshell_command\fB as documented below.\fR
 499  .PP
 500  In the following text, \fIdaemon\fR is the the process name of a
 501  network daemon process, and \fIclient\fR is the name and/or address of
 502 @@ -40,7 +40,7 @@ A newline character is ignored when it i
 503  character. This permits you to break up long lines so that they are
 504  easier to edit.
 505  .IP \(bu
 506 -Blank lines or lines that begin with a `#\' character are ignored.
 507 +Blank lines or lines that begin with a `#' character are ignored.
 508  This permits you to insert comments and whitespace so that the tables
 509  are easier to read.
 510  .IP \(bu
 511 @@ -69,26 +69,33 @@ checks are case insensitive.
 512  .SH PATTERNS
 513  The access control language implements the following patterns:
 514  .IP \(bu
 515 -A string that begins with a `.\' character. A host name is matched if
 516 +A string that begins with a `.' character. A host name is matched if
 517  the last components of its name match the specified pattern.  For
 518 -example, the pattern `.tue.nl\' matches the host name
 519 -`wzv.win.tue.nl\'.
 520 +example, the pattern `.tue.nl' matches the host name
 521 +`wzv.win.tue.nl'.
 522  .IP \(bu
 523 -A string that ends with a `.\' character. A host address is matched if
 524 +A string that ends with a `.' character. A host address is matched if
 525  its first numeric fields match the given string.  For example, the
 526 -pattern `131.155.\' matches the address of (almost) every host on the
 527 +pattern `131.155.' matches the address of (almost) every host on the
 528  Eind\%hoven University network (131.155.x.x).
 529  .IP \(bu
 530 -A string that begins with an `@\' character is treated as an NIS
 531 +A string that begins with an `@' character is treated as an NIS
 532  (formerly YP) netgroup name. A host name is matched if it is a host
 533  member of the specified netgroup. Netgroup matches are not supported
 534  for daemon process names or for client user names.
 535  .IP \(bu
 536 -An expression of the form `n.n.n.n/m.m.m.m\' is interpreted as a
 537 -`net/mask\' pair. A host address is matched if `net\' is equal to the
 538 -bitwise AND of the address and the `mask\'. For example, the net/mask
 539 -pattern `131.155.72.0/255.255.254.0\' matches every address in the
 540 -range `131.155.72.0\' through `131.155.73.255\'.
 541 +An expression of the form `n.n.n.n/m.m.m.m' is interpreted as a
 542 +`net/mask' pair. A host address is matched if `net' is equal to the
 543 +bitwise AND of the address and the `mask'. For example, the net/mask
 544 +pattern `131.155.72.0/255.255.254.0' matches every address in the
 545 +range `131.155.72.0' through `131.155.73.255'.
 546 +.IP \(bu
 547 +A string that begins with a `/' character is treated as a file
 548 +name. A host name or address is matched if it matches any host name
 549 +or address pattern listed in the named file. The file format is
 550 +zero or more lines with zero or more host name or address patterns
 551 +separated by whitespace.  A file name pattern can be used anywhere
 552 +a host name or address pattern can be used.
 553  .SH WILDCARDS
 554  The access control language supports explicit wildcards:
 555  .IP ALL
 556 @@ -115,19 +122,19 @@ without -DPARANOID when you want more co
 557  .ne 6
 558  .SH OPERATORS
 559  .IP EXCEPT
 560 -Intended use is of the form: `list_1 EXCEPT list_2\'; this construct
 561 +Intended use is of the form: `list_1 EXCEPT list_2'; this construct
 562  matches anything that matches \fIlist_1\fR unless it matches
 563  \fIlist_2\fR.  The EXCEPT operator can be used in daemon_lists and in
 564  client_lists. The EXCEPT operator can be nested: if the control
 565 -language would permit the use of parentheses, `a EXCEPT b EXCEPT c\'
 566 -would parse as `(a EXCEPT (b EXCEPT c))\'.
 567 +language would permit the use of parentheses, `a EXCEPT b EXCEPT c'
 568 +would parse as `(a EXCEPT (b EXCEPT c))'.
 569  .br
 570  .ne 6
 571  .SH SHELL COMMANDS
 572  If the first-matched access control rule contains a shell command, that
 573  command is subjected to %<letter> substitutions (see next section).
 574  The result is executed by a \fI/bin/sh\fR child process with standard
 575 -input, output and error connected to \fI/dev/null\fR.  Specify an `&\'
 576 +input, output and error connected to \fI/dev/null\fR.  Specify an `&'
 577  at the end of the command if you do not want to wait until it has
 578  completed.
 579  .PP
 580 @@ -159,7 +166,7 @@ depending on how much information is ava
 581  .IP %u
 582  The client user name (or "unknown").
 583  .IP %%
 584 -Expands to a single `%\' character.
 585 +Expands to a single `%' character.
 586  .PP
 587  Characters in % expansions that may confuse the shell are replaced by
 588  underscores.
 589 @@ -243,9 +250,9 @@ A positive IDENT lookup result (the clie
 590  less trustworthy. It is possible for an intruder to spoof both the
 591  client connection and the IDENT lookup, although doing so is much
 592  harder than spoofing just a client connection. It may also be that
 593 -the client\'s IDENT server is lying.
 594 +the client's IDENT server is lying.
 595  .PP
 596 -Note: IDENT lookups don\'t work with UDP services.
 597 +Note: IDENT lookups don't work with UDP services.
 598  .SH EXAMPLES
 599  The language is flexible enough that different types of access control
 600  policy can be expressed with a minimum of fuss. Although the language
 601 @@ -285,7 +292,7 @@ ALL: LOCAL @some_netgroup
 602  .br
 603  ALL: .foobar.edu EXCEPT terminalserver.foobar.edu
 604  .PP
 605 -The first rule permits access from hosts in the local domain (no `.\'
 606 +The first rule permits access from hosts in the local domain (no `.'
 607  in the host name) and from members of the \fIsome_netgroup\fP
 608  netgroup.  The second rule permits access from all hosts in the
 609  \fIfoobar.edu\fP domain (notice the leading dot), with the exception of
 610 @@ -322,8 +329,8 @@ in.tftpd: LOCAL, .my.domain
 611  /etc/hosts.deny:
 612  .in +3
 613  .nf
 614 -in.tftpd: ALL: (/some/where/safe_finger -l @%h | \\
 615 -       /usr/ucb/mail -s %d-%h root) &
 616 +in.tftpd: ALL: (/usr/sbin/safe_finger -l @%h | \\
 617 +       /usr/bin/mail -s %d-%h root) &
 618  .fi
 619  .PP
 620  The safe_finger command comes with the tcpd wrapper and should be
 621 @@ -349,7 +356,7 @@ control rule; when the length of an acce
 622  capacity of an internal buffer; when an access control rule is not
 623  terminated by a newline character; when the result of %<letter>
 624  expansion would overflow an internal buffer; when a system call fails
 625 -that shouldn\'t.  All problems are reported via the syslog daemon.
 626 +that shouldn't.  All problems are reported via the syslog daemon.
 627  .SH FILES
 628  .na
 629  .nf
 630 --- a/rfc931.c
 631 +++ b/rfc931.c
 632 @@ -33,7 +33,7 @@ static char sccsid[] = "@(#) rfc931.c 1.
 633
 634  int     rfc931_timeout = RFC931_TIMEOUT;/* Global so it can be changed */
 635
 636 -static jmp_buf timebuf;
 637 +static sigjmp_buf timebuf;
 638
 639  /* fsocket - open stdio stream on top of socket */
 640
 641 @@ -62,7 +62,7 @@ int     protocol;
 642  static void timeout(sig)
 643  int     sig;
 644  {
 645 -    longjmp(timebuf, sig);
 646 +    siglongjmp(timebuf, sig);
 647  }
 648
 649  /* rfc931 - return remote user name, given socket structures */
 650 @@ -99,7 +99,7 @@ char   *dest;
 651          * Set up a timer so we won't get stuck while waiting for the server.
 652          */
 653
 654 -       if (setjmp(timebuf) == 0) {
 655 +       if (sigsetjmp(timebuf,1) == 0) {
 656             signal(SIGALRM, timeout);
 657             alarm(rfc931_timeout);
 658
 659 --- a/tcpd.8
 660 +++ b/tcpd.8
 661 @@ -94,7 +94,7 @@ configuration files.
 662  .PP
 663  The example assumes that the network daemons live in /usr/etc. On some
 664  systems, network daemons live in /usr/sbin or in /usr/libexec, or have
 665 -no `in.\' prefix to their name.
 666 +no `in.' prefix to their name.
 667  .SH EXAMPLE 2
 668  This example applies when \fItcpd\fR expects that the network daemons
 669  are left in their original place.
 670 @@ -110,26 +110,26 @@ finger  stream  tcp  nowait  nobody  /us
 671  becomes:
 672  .sp
 673  .ti +5
 674 -finger  stream  tcp  nowait  nobody  /some/where/tcpd     in.fingerd
 675 +finger  stream  tcp  nowait  nobody  /usr/sbin/tcpd       in.fingerd
 676  .sp
 677  .fi
 678  .PP
 679  The example assumes that the network daemons live in /usr/etc. On some
 680  systems, network daemons live in /usr/sbin or in /usr/libexec, the
 681 -daemons have no `in.\' prefix to their name, or there is no userid
 682 +daemons have no `in.' prefix to their name, or there is no userid
 683  field in the inetd configuration file.
 684  .PP
 685  Similar changes will be needed for the other services that are to be
 686 -covered by \fItcpd\fR.  Send a `kill -HUP\' to the \fIinetd\fR(8)
 687 +covered by \fItcpd\fR.  Send a `kill -HUP' to the \fIinetd\fR(8)
 688  process to make the changes effective. AIX users may also have to
 689 -execute the `inetimp\' command.
 690 +execute the `inetimp' command.
 691  .SH EXAMPLE 3
 692  In the case of daemons that do not live in a common directory ("secret"
 693  or otherwise), edit the \fIinetd\fR configuration file so that it
 694  specifies an absolute path name for the process name field. For example:
 695  .nf
 696  .sp
 697 -    ntalk  dgram  udp  wait  root  /some/where/tcpd  /usr/local/lib/ntalkd
 698 +    ntalk  dgram  udp  wait  root  /usr/sbin/tcpd  /usr/sbin/in.ntalkd
 699  .sp
 700  .fi
 701  .PP
 702 --- a/hosts_access.3
 703 +++ b/hosts_access.3
 704 @@ -3,7 +3,7 @@
 705  hosts_access, hosts_ctl, request_init, request_set \- access control library
 706  .SH SYNOPSIS
 707  .nf
 708 -#include "tcpd.h"
 709 +#include <tcpd.h>
 710
 711  extern int allow_severity;
 712  extern int deny_severity;
 713 --- a/options.c
 714 +++ b/options.c
 715 @@ -473,6 +473,9 @@ static struct syslog_names log_fac[] = {
 716  #ifdef LOG_CRON
 717      "cron", LOG_CRON,
 718  #endif
 719 +#ifdef LOG_FTP
 720 +    "ftp", LOG_FTP,
 721 +#endif
 722  #ifdef LOG_LOCAL0
 723      "local0", LOG_LOCAL0,
 724  #endif
 725 --- a/fix_options.c
 726 +++ b/fix_options.c
 727 @@ -35,7 +35,12 @@ struct request_info *request;
 728  #ifdef IP_OPTIONS
 729      unsigned char optbuf[BUFFER_SIZE / 3], *cp;
 730      char    lbuf[BUFFER_SIZE], *lp;
 731 +#if !defined(__GLIBC__)
 732      int     optsize = sizeof(optbuf), ipproto;
 733 +#else /* __GLIBC__ */
 734 +    size_t  optsize = sizeof(optbuf);
 735 +    int     ipproto;
 736 +#endif /* __GLIBC__ */
 737      struct protoent *ip;
 738      int     fd = request->fd;
 739      unsigned int opt;
 740 --- a/workarounds.c
 741 +++ b/workarounds.c
 742 @@ -163,7 +163,11 @@ int    *fromlen;
 743  int     fix_getpeername(sock, sa, len)
 744  int     sock;
 745  struct sockaddr *sa;
 746 +#if !defined(__GLIBC__)
 747  int    *len;
 748 +#else /* __GLIBC__ */
 749 +size_t *len;
 750 +#endif /* __GLIBC__ */
 751  {
 752      int     ret;
 753      struct sockaddr_in *sin = (struct sockaddr_in *) sa;
 754 --- a/socket.c
 755 +++ b/socket.c
 756 @@ -76,7 +76,11 @@ struct request_info *request;
 757  {
 758      static struct sockaddr_in client;
 759      static struct sockaddr_in server;
 760 +#if !defined (__GLIBC__)
 761      int     len;
 762 +#else /* __GLIBC__ */
 763 +    size_t  len;
 764 +#endif /* __GLIBC__ */
 765      char    buf[BUFSIZ];
 766      int     fd = request->fd;
 767
 768 @@ -224,7 +228,11 @@ int     fd;
 769  {
 770      char    buf[BUFSIZ];
 771      struct sockaddr_in sin;
 772 +#if !defined(__GLIBC__)
 773      int     size = sizeof(sin);
 774 +#else /* __GLIBC__ */
 775 +    size_t  size = sizeof(sin);
 776 +#endif /* __GLIBC__ */
 777
 778      /*
 779       * Eat up the not-yet received datagram. Some systems insist on a
 780 --- a/safe_finger.c
 781 +++ b/safe_finger.c
 782 @@ -26,21 +26,24 @@ static char sccsid[] = "@(#) safe_finger
 783  #include <stdio.h>
 784  #include <ctype.h>
 785  #include <pwd.h>
 786 +#include <syslog.h>
 787
 788  extern void exit();
 789
 790  /* Local stuff */
 791
 792 -char    path[] = "PATH=/bin:/usr/bin:/usr/ucb:/usr/bsd:/etc:/usr/etc:/usr/sbin";
 793 +char    path[] = "PATH=/bin:/usr/bin:/sbin:/usr/sbin";
 794
 795  #define        TIME_LIMIT      60              /* Do not keep listinging forever */
 796  #define        INPUT_LENGTH    100000          /* Do not keep listinging forever */
 797  #define        LINE_LENGTH     128             /* Editors can choke on long lines */
 798  #define        FINGER_PROGRAM  "finger"        /* Most, if not all, UNIX systems */
 799  #define        UNPRIV_NAME     "nobody"        /* Preferred privilege level */
 800 -#define        UNPRIV_UGID     32767           /* Default uid and gid */
 801 +#define        UNPRIV_UGID     65534           /* Default uid and gid */
 802
 803  int     finger_pid;
 804 +int    allow_severity = SEVERITY;
 805 +int    deny_severity = LOG_WARNING;
 806
 807  void    cleanup(sig)
 808  int     sig;
 809 --- a/hosts_options.5
 810 +++ b/hosts_options.5
 811 @@ -58,12 +58,12 @@ Notice the leading dot on the domain nam
 812  Execute, in a child process, the specified shell command, after
 813  performing the %<letter> expansions described in the hosts_access(5)
 814  manual page.  The command is executed with stdin, stdout and stderr
 815 -connected to the null device, so that it won\'t mess up the
 816 +connected to the null device, so that it won't mess up the
 817  conversation with the client host. Example:
 818  .sp
 819  .nf
 820  .ti +3
 821 -spawn (/some/where/safe_finger -l @%h | /usr/ucb/mail root) &
 822 +spawn (/usr/sbin/safe_finger -l @%h | /usr/bin/mail root) &
 823  .fi
 824  .sp
 825  executes, in a background child process, the shell command "safe_finger
 826 --- a/tcpdchk.c
 827 +++ b/tcpdchk.c
 828 @@ -350,6 +350,8 @@ char   *pat;
 829  {
 830      if (pat[0] == '@') {
 831         tcpd_warn("%s: daemon name begins with \"@\"", pat);
 832 +    } else if (pat[0] == '/') {
 833 +        tcpd_warn("%s: daemon name begins with \"/\"", pat);
 834      } else if (pat[0] == '.') {
 835         tcpd_warn("%s: daemon name begins with dot", pat);
 836      } else if (pat[strlen(pat) - 1] == '.') {
 837 @@ -382,6 +384,8 @@ char   *pat;
 838  {
 839      if (pat[0] == '@') {                       /* @netgroup */
 840         tcpd_warn("%s: user name begins with \"@\"", pat);
 841 +    } else if (pat[0] == '/') {
 842 +        tcpd_warn("%s: user name begins with \"/\"", pat);
 843      } else if (pat[0] == '.') {
 844         tcpd_warn("%s: user name begins with dot", pat);
 845      } else if (pat[strlen(pat) - 1] == '.') {
 846 @@ -402,8 +406,13 @@ char   *pat;
 847  static int check_host(pat)
 848  char   *pat;
 849  {
 850 +    char    buf[BUFSIZ];
 851      char   *mask;
 852      int     addr_count = 1;
 853 +    FILE   *fp;
 854 +    struct tcpd_context saved_context;
 855 +    char   *cp;
 856 +    char   *wsp = " \t\r\n";
 857
 858      if (pat[0] == '@') {                       /* @netgroup */
 859  #ifdef NO_NETGRENT
 860 @@ -422,6 +431,21 @@ char   *pat;
 861         tcpd_warn("netgroup support disabled");
 862  #endif
 863  #endif
 864 +    } else if (pat[0] == '/') {                 /* /path/name */
 865 +        if ((fp = fopen(pat, "r")) != 0) {
 866 +            saved_context = tcpd_context;
 867 +            tcpd_context.file = pat;
 868 +            tcpd_context.line = 0;
 869 +            while (fgets(buf, sizeof(buf), fp)) {
 870 +                tcpd_context.line++;
 871 +                for (cp = strtok(buf, wsp); cp; cp = strtok((char *) 0, wsp))
 872 +                    check_host(cp);
 873 +            }
 874 +            tcpd_context = saved_context;
 875 +            fclose(fp);
 876 +        } else if (errno != ENOENT) {
 877 +            tcpd_warn("open %s: %m", pat);
 878 +        }
 879      } else if (mask = split_at(pat, '/')) {    /* network/netmask */
 880         if (dot_quad_addr(pat) == INADDR_NONE
 881             || dot_quad_addr(mask) == INADDR_NONE)
 882 --- a/percent_m.c
 883 +++ b/percent_m.c
 884 @@ -13,7 +13,7 @@ static char sccsid[] = "@(#) percent_m.c
 885  #include <string.h>
 886
 887  extern int errno;
 888 -#ifndef SYS_ERRLIST_DEFINED
 889 +#if !defined(SYS_ERRLIST_DEFINED) && !defined(HAVE_STRERROR)
 890  extern char *sys_errlist[];
 891  extern int sys_nerr;
 892  #endif
 893 @@ -29,11 +29,15 @@ char   *ibuf;
 894
 895      while (*bp = *cp)
 896         if (*cp == '%' && cp[1] == 'm') {
 897 +#ifdef HAVE_STRERROR
 898 +            strcpy(bp, strerror(errno));
 899 +#else
 900             if (errno < sys_nerr && errno > 0) {
 901                 strcpy(bp, sys_errlist[errno]);
 902             } else {
 903                 sprintf(bp, "Unknown error %d", errno);
 904             }
 905 +#endif
 906             bp += strlen(bp);
 907             cp += 2;
 908         } else {
 909 --- a/scaffold.c
 910 +++ b/scaffold.c
 911 @@ -180,10 +180,12 @@ struct request_info *request;
 912
 913  /* ARGSUSED */
 914
 915 -void    rfc931(request)
 916 -struct request_info *request;
 917 +void    rfc931(rmt_sin, our_sin, dest)
 918 +struct sockaddr_in *rmt_sin;
 919 +struct sockaddr_in *our_sin;
 920 +char   *dest;
 921  {
 922 -    strcpy(request->user, unknown);
 923 +    strcpy(dest, unknown);
 924  }
 925
 926  /* check_path - examine accessibility */
 927 --- /dev/null
 928 +++ b/weak_symbols.c
 929 @@ -0,0 +1,11 @@
 930 + /*
 931 +  * @(#) weak_symbols.h 1.5 99/12/29 23:50
 932 +  *
 933 +  * Author: Anthony Towns <ajt@debian.org>
 934 +  */
 935 +
 936 +#ifdef HAVE_WEAKSYMS
 937 +#include <syslog.h>
 938 +int deny_severity = LOG_WARNING;
 939 +int allow_severity = SEVERITY;
 940 +#endif