From sheldonh@axl.noc.iafrica.com Wed Jun  9 08:44:21 1999
Return-Path: <sheldonh@axl.noc.iafrica.com>
Received: from axl.noc.iafrica.com (axl.noc.iafrica.com [196.31.1.175])
	by hub.freebsd.org (Postfix) with ESMTP id 30F2D15988
	for <FreeBSD-gnats-submit@freebsd.org>; Wed,  9 Jun 1999 08:44:06 -0700 (PDT)
	(envelope-from sheldonh@axl.noc.iafrica.com)
Received: from sheldonh (helo=axl.noc.iafrica.com)
	by axl.noc.iafrica.com with local-esmtp (Exim 3.02 #1)
	id 10rkWK-0001dd-00
	for FreeBSD-gnats-submit@freebsd.org; Wed, 09 Jun 1999 17:44:04 +0200
Message-Id: <6300.928943044@axl.noc.iafrica.com>
Date: Wed, 09 Jun 1999 17:44:04 +0200
From: Sheldon Hearn <sheldonh@uunet.co.za>
Sender: Sheldon Hearn <sheldonh@axl.noc.iafrica.com>
Reply-To: Sheldon Hearn <sheldonh@uunet.co.za>
To: FreeBSD-gnats-submit@freebsd.org
Subject: [PATCH] Various fixes for inetd with libwrap support
X-Send-Pr-Version: 3.2

>Number:         12097
>Category:       bin
>Synopsis:       [PATCH] Various fixes for inetd with libwrap support
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    sheldonh
>State:          closed
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          change-request
>Submitter-Id:   current-users
>Arrival-Date:   Wed Jun  9 08:50:01 PDT 1999
>Closed-Date:    Thu Jun 17 02:22:32 PDT 1999
>Last-Modified:  Thu Jun 17 02:23:12 PDT 1999
>Originator:     Sheldon Hearn
>Release:        FreeBSD 4.0-CURRENT i386
>Organization:
UUNET South Africa
>Environment:

	FreeBSD 4.0-CURRENT #2: Wed Jun  9 14:28:13 SAST 1999 i386

>Description:

	This PR supersedes:

	PR 11651 - forked inetd children for internal services don't die
	PR 11860 - inetd config() corrupts service names on HUP
	PR 11960 - inetd doesn't honour hosts_access severity extension

>How-To-Repeat:

	See relevant PR's.

>Fix:

	The patch attached accompishes the following:

	* Handle forking and non-forking internal services correctly.
	* On HUP, preserve server names for each service.
	* Handle -l option as appropriate for libwrap and non-libwrap
	  cases.
	* Honour hosts_access severity options by resetting syslog
	  facility and priority before each call to hosts_access.
	* Turn on wrapping for internal services because they work now.

	Reported by:	Pierre Beyssac <pb@fasterix.freenix.org>,
			Masachika <ISHIZUKA ishizuka@ish.org>,
			David Malone <dwmalone@maths.tcd.ie>
	Submitted by:	sheldonh, Masachika <ISHIZUKA ishizuka@ish.org>,
			David Malone <dwmalone@maths.tcd.ie>

Index: usr.sbin/inetd/Makefile
===================================================================
RCS file: /home/ncvs/src/usr.sbin/inetd/Makefile,v
retrieving revision 1.8
diff -u -d -r1.8 Makefile
--- Makefile	1999/05/07 06:48:01	1.8
+++ Makefile	1999/06/09 15:13:53
@@ -5,7 +5,7 @@
 MAN8=	inetd.8
 MLINKS=	inetd.8 inetd.conf.5
 
-COPTS+=	-Wall -DLOGIN_CAP -DLIBWRAP
+COPTS+=	-Wall -DLOGIN_CAP -DLIBWRAP -DLIBWRAP_INTERNAL
 #COPTS+=	-DSANITY_CHECK
 
 DPADD+=	${LIBUTIL} ${LIBWRAP}
Index: usr.sbin/inetd/inetd.c
===================================================================
RCS file: /home/ncvs/src/usr.sbin/inetd/inetd.c,v
retrieving revision 1.49
diff -u -d -r1.49 inetd.c
--- inetd.c	1999/05/11 12:50:14	1.49
+++ inetd.c	1999/06/09 15:13:04
@@ -146,8 +146,8 @@
 #ifndef LIBWRAP_DENY_SEVERITY
 # define LIBWRAP_DENY_SEVERITY LOG_WARNING
 #endif
-int allow_severity = LIBWRAP_ALLOW_FACILITY|LIBWRAP_ALLOW_SEVERITY;
-int deny_severity = LIBWRAP_DENY_FACILITY|LIBWRAP_DENY_SEVERITY;
+int allow_severity;
+int deny_severity;
 #endif
 
 #ifdef LOGIN_CAP
@@ -344,8 +344,6 @@
 	int tmpint, ch, dofork;
 	pid_t pid;
 	char buf[50];
-	struct  sockaddr_in peer;
-	int i;
 #ifdef LOGIN_CAP
 	login_cap_t *lc = NULL;
 #endif
@@ -353,6 +351,9 @@
 	struct request_info req;
 	int denied;
 	char *service = NULL;
+#else
+	struct  sockaddr_in peer;
+	int i;
 #endif
 
 
@@ -538,6 +539,7 @@
 				close(ctrl);
 				continue;
 			    }
+#ifndef LIBWRAP
 			    if (log) {
 				i = sizeof peer;
 				if (getpeername(ctrl, (struct sockaddr *)
@@ -552,15 +554,12 @@
 					sep->se_service,
 					inet_ntoa(peer.sin_addr));
 			    }
+#endif
 		    } else
 			    ctrl = sep->se_fd;
 		    (void) sigblock(SIGBLOCK);
 		    pid = 0;
-#ifdef LIBWRAP_INTERNAL
-		    dofork = 1;
-#else
 		    dofork = (sep->se_bi == 0 || sep->se_bi->bi_fork);
-#endif
 		    if (dofork) {
 			    if (sep->se_count++ == 0)
 				(void)gettimeofday(&sep->se_time, (struct timezone *)NULL);
@@ -624,21 +623,13 @@
 #endif
 			    if (sep->se_accept
 				&& sep->se_socktype == SOCK_STREAM) {
-				request_init(&req,
-				    RQ_DAEMON, sep->se_server_name ?
-					sep->se_server_name : sep->se_service,
-					RQ_FILE, ctrl, NULL);
+				service = sep->se_server_name ?
+				    sep->se_server_name : sep->se_service;
+				request_init(&req, RQ_DAEMON, service, RQ_FILE, ctrl, NULL);
 				fromhost(&req);
+				deny_severity = LIBWRAP_DENY_FACILITY|LIBWRAP_DENY_SEVERITY;
+				allow_severity = LIBWRAP_ALLOW_FACILITY|LIBWRAP_ALLOW_SEVERITY;
 				denied = !hosts_access(&req);
-				if (denied || log) {
-				    sp = getservbyport(sep->se_ctrladdr.sin_port, sep->se_proto);
-				    if (sp == NULL) {
-					(void)snprintf(buf, sizeof buf, "%d",
-					   ntohs(sep->se_ctrladdr.sin_port));
-					service = buf;
-				    } else
-					service = sp->s_name;
-				}
 				if (denied) {
 				    syslog(deny_severity,
 				        "refused connection from %.500s, service %s (%s)",
@@ -746,7 +737,8 @@
 #endif
 				if (sep->se_socktype != SOCK_STREAM)
 					recv(0, buf, sizeof (buf), 0);
-				_exit(EX_OSERR);
+				if (dofork)
+					_exit(EX_OSERR);
 			    }
 		    }
 		    if (sep->se_accept && sep->se_socktype == SOCK_STREAM)
@@ -911,6 +903,7 @@
 			SWAP(sep->se_class, new->se_class);
 #endif
 			SWAP(sep->se_server, new->se_server);
+			SWAP(sep->se_server_name, new->se_server_name);
 			for (i = 0; i < MAXARGV; i++)
 				SWAP(sep->se_argv[i], new->se_argv[i]);
 			sigsetmask(omask);

>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: freebsd-bugs->markm 
Responsible-Changed-By: sheldonh 
Responsible-Changed-When: Wed Jun 9 08:55:03 PDT 1999 
Responsible-Changed-Why:  
Mark promised to take a look at one of the related PR's, but I'm 
confident he'll take an interest in the whole thing. :-) 

From: Sheldon Hearn <sheldonh@uunet.co.za>
To: freebsd-gnats-submit@freebsd.org
Cc:  
Subject: Re: bin/12097: [PATCH] Various fixes for inetd with libwrap support 
Date: Wed, 09 Jun 1999 18:24:33 +0200

 This one probably deserves a HEADS UP, UPDATING and commit message
 warnings, because:
 
 	* Hitherto unwrapped internal services are now wrapped; check
 	  your /etc/hosts.allow .
 
 	* Inetd now tries harder to report the daemon name in reject
           messages; check your custom /var/log/messages-watching
 	  scripts.
 
 Ciao,
 Sheldon.
 

From: Sheldon Hearn <sheldonh@uunet.co.za>
To: freebsd-gnats-submit@freebsd.org
Cc: Pierre Beyssac <pb@fasterix.freenix.org>,
	Masachika ISHIZUKA <ishizuka@ish.org>,
	David Malone <dwmalone@maths.tcd.ie>
Subject: Re: bin/12097: [PATCH] Various fixes for inetd with libwrap support
Date: Thu, 10 Jun 1999 01:02:42 +0200

 In trying to figure out the twist problem reported in PR 11857, I
 discovered that the NetBSD okes had good reason to _always_ fork if
 builtins are wrapped. :-)
 
 The following diff supersedes the previous one on this PR and offers all
 the fixes mentioned before, but without breaking support for the twist
 command.
 
 Have fun!
 Sheldon.
 
 PS: I got one of the Submitter's addresses wrong before, it's:
     Masachika ISHIZUKA <ishizuka@ish.org> ... sorry 'bout that. :-)
 
 Index: Makefile
 ===================================================================
 RCS file: /home/ncvs/src/usr.sbin/inetd/Makefile,v
 retrieving revision 1.8
 diff -u -d -r1.8 Makefile
 --- Makefile	1999/05/07 06:48:01	1.8
 +++ Makefile	1999/06/09 22:45:31
 @@ -5,7 +5,7 @@
  MAN8=	inetd.8
  MLINKS=	inetd.8 inetd.conf.5
  
 -COPTS+=	-Wall -DLOGIN_CAP -DLIBWRAP
 +COPTS+=	-Wall -DLOGIN_CAP -DLIBWRAP -DLIBWRAP_INTERNAL
  #COPTS+=	-DSANITY_CHECK
  
  DPADD+=	${LIBUTIL} ${LIBWRAP}
 Index: inetd.c
 ===================================================================
 RCS file: /home/ncvs/src/usr.sbin/inetd/inetd.c,v
 retrieving revision 1.49
 diff -u -d -r1.49 inetd.c
 --- inetd.c	1999/05/11 12:50:14	1.49
 +++ inetd.c	1999/06/09 22:49:07
 @@ -146,8 +146,8 @@
  #ifndef LIBWRAP_DENY_SEVERITY
  # define LIBWRAP_DENY_SEVERITY LOG_WARNING
  #endif
 -int allow_severity = LIBWRAP_ALLOW_FACILITY|LIBWRAP_ALLOW_SEVERITY;
 -int deny_severity = LIBWRAP_DENY_FACILITY|LIBWRAP_DENY_SEVERITY;
 +int allow_severity;
 +int deny_severity;
  #endif
  
  #ifdef LOGIN_CAP
 @@ -344,8 +344,6 @@
  	int tmpint, ch, dofork;
  	pid_t pid;
  	char buf[50];
 -	struct  sockaddr_in peer;
 -	int i;
  #ifdef LOGIN_CAP
  	login_cap_t *lc = NULL;
  #endif
 @@ -353,6 +351,9 @@
  	struct request_info req;
  	int denied;
  	char *service = NULL;
 +#else
 +	struct  sockaddr_in peer;
 +	int i;
  #endif
  
  
 @@ -538,6 +539,7 @@
  				close(ctrl);
  				continue;
  			    }
 +#ifndef LIBWRAP
  			    if (log) {
  				i = sizeof peer;
  				if (getpeername(ctrl, (struct sockaddr *)
 @@ -552,10 +554,15 @@
  					sep->se_service,
  					inet_ntoa(peer.sin_addr));
  			    }
 +#endif
  		    } else
  			    ctrl = sep->se_fd;
  		    (void) sigblock(SIGBLOCK);
  		    pid = 0;
 +/*
 + * Fork for all services except a few builtins. If builtins are wrapped,
 + * fork for those too so that twist works.
 + */
  #ifdef LIBWRAP_INTERNAL
  		    dofork = 1;
  #else
 @@ -624,21 +631,13 @@
  #endif
  			    if (sep->se_accept
  				&& sep->se_socktype == SOCK_STREAM) {
 -				request_init(&req,
 -				    RQ_DAEMON, sep->se_server_name ?
 -					sep->se_server_name : sep->se_service,
 -					RQ_FILE, ctrl, NULL);
 +				service = sep->se_server_name ?
 +				    sep->se_server_name : sep->se_service;
 +				request_init(&req, RQ_DAEMON, service, RQ_FILE, ctrl, NULL);
  				fromhost(&req);
 +				deny_severity = LIBWRAP_DENY_FACILITY|LIBWRAP_DENY_SEVERITY;
 +				allow_severity = LIBWRAP_ALLOW_FACILITY|LIBWRAP_ALLOW_SEVERITY;
  				denied = !hosts_access(&req);
 -				if (denied || log) {
 -				    sp = getservbyport(sep->se_ctrladdr.sin_port, sep->se_proto);
 -				    if (sp == NULL) {
 -					(void)snprintf(buf, sizeof buf, "%d",
 -					   ntohs(sep->se_ctrladdr.sin_port));
 -					service = buf;
 -				    } else
 -					service = sp->s_name;
 -				}
  				if (denied) {
  				    syslog(deny_severity,
  				        "refused connection from %.500s, service %s (%s)",
 @@ -746,8 +745,9 @@
  #endif
  				if (sep->se_socktype != SOCK_STREAM)
  					recv(0, buf, sizeof (buf), 0);
 -				_exit(EX_OSERR);
  			    }
 +			    if (dofork)
 +				_exit(0);
  		    }
  		    if (sep->se_accept && sep->se_socktype == SOCK_STREAM)
  			    close(ctrl);
 @@ -911,6 +911,7 @@
  			SWAP(sep->se_class, new->se_class);
  #endif
  			SWAP(sep->se_server, new->se_server);
 +			SWAP(sep->se_server_name, new->se_server_name);
  			for (i = 0; i < MAXARGV; i++)
  				SWAP(sep->se_argv[i], new->se_argv[i]);
  			sigsetmask(omask);
 

From: Dag-Erling Smorgrav <des@flood.ping.uio.no>
To: Sheldon Hearn <sheldonh@uunet.co.za>
Cc: FreeBSD-gnats-submit@FreeBSD.ORG
Subject: Re: bin/12097: [PATCH] Various fixes for inetd with libwrap support
Date: 13 Jun 1999 16:42:42 +0200

 Sheldon Hearn <sheldonh@uunet.co.za> writes:
 > @@ -911,6 +903,7 @@
 >  			SWAP(sep->se_class, new->se_class);
 >  #endif
 >  			SWAP(sep->se_server, new->se_server);
 > +			SWAP(sep->se_server_name, new->se_server_name);
 >  			for (i = 0; i < MAXARGV; i++)
 >  				SWAP(sep->se_argv[i], new->se_argv[i]);
 >  			sigsetmask(omask);
 
 *sigh* as I've already pointed out in a followup to the original PR,
 this patch does *not* fix the SIGHUP bug.
 
 DES
 -- 
 Dag-Erling Smorgrav - des@flood.ping.uio.no
 

From: Sheldon Hearn <sheldonh@uunet.co.za>
To: Dag-Erling Smorgrav <des@flood.ping.uio.no>
Cc: FreeBSD-gnats-submit@FreeBSD.ORG
Subject: Re: bin/12097: [PATCH] Various fixes for inetd with libwrap support 
Date: Mon, 14 Jun 1999 12:55:07 +0200

 On 13 Jun 1999 16:42:42 +0200, Dag-Erling Smorgrav wrote:
 
 > *sigh* as I've already pointed out in a followup to the original PR,
 > this patch does *not* fix the SIGHUP bug.
 
 Hi DES,
 
 I'm really trying very hard to make inetd work "as advertised". I value
 your input, but I need a little more from you.
 
 Firstly, I can't see any feedback from you associated with PR 11860,
 which is "the original PR" from which I gleaned the fix for the HUP bug
 in inetd.
 
 Secondly, the fix not only makes sense to me after spending a bit of
 time in the code, but also appears to fix the symptoms described in the
 original PR.
 
 Could you either tell me how to demonstrate that the fix doesn't work or
 send the followup that you think you added to PR 11860 ? Either way,
 please make sure that your feedback gets included on this PR.
 
 Thanks,
 Sheldon.
 

From: Dag-Erling Smorgrav <des@flood.ping.uio.no>
To: Sheldon Hearn <sheldonh@uunet.co.za>
Cc: Dag-Erling Smorgrav <des@flood.ping.uio.no>,
	FreeBSD-gnats-submit@FreeBSD.ORG
Subject: Re: bin/12097: [PATCH] Various fixes for inetd with libwrap support
Date: 14 Jun 1999 13:15:11 +0200

 Sheldon Hearn <sheldonh@uunet.co.za> writes:
 > Firstly, I can't see any feedback from you associated with PR 11860,
 > which is "the original PR" from which I gleaned the fix for the HUP bug
 > in inetd.
 
 Look for message IDs <xzpu2ss3syk.fsf@localhost.ping.uio.no> and
 <xzpso8c3st0.fsf@localhost.ping.uio.no> in FreeBSD-bugs.
 
 > Secondly, the fix not only makes sense to me after spending a bit of
 > time in the code, but also appears to fix the symptoms described in the
 > original PR.
 
 Forget it - I am unable to reproduce the problem. It didn't work a
 week ago, it works now. Go figure.
 
 DES
 -- 
 Dag-Erling Smorgrav - des@flood.ping.uio.no
 

From: Sheldon Hearn <sheldonh@uunet.co.za>
To: Dag-Erling Smorgrav <des@flood.ping.uio.no>
Cc: FreeBSD-gnats-submit@FreeBSD.ORG
Subject: Re: bin/12097: [PATCH] Various fixes for inetd with libwrap support 
Date: Mon, 14 Jun 1999 14:52:08 +0200

 On 14 Jun 1999 13:15:11 +0200, Dag-Erling Smorgrav wrote:
 
 > Forget it - I am unable to reproduce the problem. It didn't work a
 > week ago, it works now. Go figure.
 
 Cool.
 
 So the objection is withdrawn and the PR remains open for review.
 
 Ciao,
 Sheldon.
 
Responsible-Changed-From-To: markm->sheldonh 
Responsible-Changed-By: sheldonh 
Responsible-Changed-When: Tue Jun 15 11:17:59 PDT 1999 
Responsible-Changed-Why:  
I'll take this one now that I'm a committer. Still waiting for review, though. 
State-Changed-From-To: open->closed 
State-Changed-By: sheldonh 
State-Changed-When: Thu Jun 17 02:22:32 PDT 1999 
State-Changed-Why:  
Committed! Thanks for the help, guys. 
>Unformatted:
