From nobody@FreeBSD.org  Mon Mar 28 06:39:20 2011
Return-Path: <nobody@FreeBSD.org>
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id 0C69B1065674
	for <freebsd-gnats-submit@FreeBSD.org>; Mon, 28 Mar 2011 06:39:20 +0000 (UTC)
	(envelope-from nobody@FreeBSD.org)
Received: from red.freebsd.org (red.freebsd.org [IPv6:2001:4f8:fff6::22])
	by mx1.freebsd.org (Postfix) with ESMTP id F14D68FC14
	for <freebsd-gnats-submit@FreeBSD.org>; Mon, 28 Mar 2011 06:39:19 +0000 (UTC)
Received: from red.freebsd.org (localhost [127.0.0.1])
	by red.freebsd.org (8.14.4/8.14.4) with ESMTP id p2S6dJJx085567
	for <freebsd-gnats-submit@FreeBSD.org>; Mon, 28 Mar 2011 06:39:19 GMT
	(envelope-from nobody@red.freebsd.org)
Received: (from nobody@localhost)
	by red.freebsd.org (8.14.4/8.14.4/Submit) id p2S6dJYQ085566;
	Mon, 28 Mar 2011 06:39:19 GMT
	(envelope-from nobody)
Message-Id: <201103280639.p2S6dJYQ085566@red.freebsd.org>
Date: Mon, 28 Mar 2011 06:39:19 GMT
From: HIROSHI OOTA <nil@mad.dog.cx>
To: freebsd-gnats-submit@FreeBSD.org
Subject: tcpd does not perform a access-control
X-Send-Pr-Version: www-3.1
X-GNATS-Notify:

>Number:         155985
>Category:       bin
>Synopsis:       tcpd(8) does not perform a access-control
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:  
>Class:          change-request
>Submitter-Id:   current-users
>Arrival-Date:   Mon Mar 28 06:40:12 UTC 2011
>Closed-Date:    
>Last-Modified:  Tue Mar 29 19:33:24 UTC 2011
>Originator:     HIROSHI OOTA
>Release:        9-current
>Organization:
>Environment:
FreeBSD XXX 9.0-CURRENT FreeBSD 9.0-CURRENT #133 r219891M: Wed Mar 23 08:56:43 JST  2011     root@ amd64
>Description:
tcpd does not perform a access-control.  access-control table (/etc/hosts.allow) is always ignored.

I wrote 
ALL : ALL : deny
at the head of/etc/hosts.allow. Tcpd ignores this description and permits a connecting. 
>How-To-Repeat:
/etc/hosts.allow
ALL : ALL : deny
/etc/inetd.conf
ftp    stream  tcp     nowait  root    /usr/libexec/tcdp /usr/libexec/ftpd -l

# /etc/rc.d/inetd reload
# ftp localhost

>Fix:
To enable access-control facility, tcpd should be compiled with -DHOSTS_ACCESS flag.
Add  -DHOSTS_ACCESS to /usr/src/libexec/tcpd/Makefile.

The code fragment of this problem is the following. 
/usr/src/contrib/tcp_wrappers/tcpd.c:
   112      /*
   113       * Check whether this host can access the service in argv[0]. The
   114       * access-control code invokes optional shell commands as specified in
   115       * the access-control tables.
   116       */
   117
   118  #ifdef HOSTS_ACCESS
   119      if (!hosts_access(&request))
   120          refuse(&request);
   121  #endif

>Release-Note:
>Audit-Trail:
>Unformatted:
