tcp wrapper support for IPv6. from netbsd.

TODO: scoped address support may need more consideration (we are taking
safer side now - rejects too much).

9 files changed, 321 insertions, 53 deletions

diff --git a/lib/libwrap/Makefile b/lib/libwrap/Makefile
index 2da18026bf6..99cba9a7137 100644
--- a/lib/libwrap/Makefile
+++ b/lib/libwrap/Makefile
@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.3 1997/04/27 20:56:19 millert Exp $
+#	$OpenBSD: Makefile,v 1.4 2000/10/14 00:56:15 itojun Exp $
 
 LIB=	wrap
 SRCS=	hosts_access.c options.c shell_cmd.c rfc931.c eval.c \
@@ -12,6 +12,7 @@ CFLAGS+=-DPROCESS_OPTIONS -DFACILITY=LOG_AUTH -DSEVERITY=LOG_INFO \
 	-DRFC931_TIMEOUT=10 -DHOSTS_ACCESS -DALWAYS_HOSTNAME \
 	-DHOSTS_DENY=\"/etc/hosts.deny\" -DHOSTS_ALLOW=\"/etc/hosts.allow\" \
 	-DNETGROUP -DSYS_ERRLIST_DEFINED -D_TCPD_PRIVATE
+CFLAGS+=-DINET6
 
 MAN=	hosts_access.3 hosts_access.5 hosts_options.5
 MLINKS+=hosts_access.5 hosts.allow.5
diff --git a/lib/libwrap/fix_options.c b/lib/libwrap/fix_options.c
index 48e95972de4..a5de0f52e46 100644
--- a/lib/libwrap/fix_options.c
+++ b/lib/libwrap/fix_options.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: fix_options.c,v 1.2 1997/04/04 09:06:28 deraadt Exp $	*/
+/*	$OpenBSD: fix_options.c,v 1.3 2000/10/14 00:56:15 itojun Exp $	*/
 
  /*
   * Routine to disable IP-level socket options. This code was taken from 4.4BSD
@@ -11,7 +11,7 @@
 #if 0
 static char sccsid[] = "@(#) fix_options.c 1.4 97/02/12 02:13:22";
 #else
-static char rcsid[] = "$OpenBSD: fix_options.c,v 1.2 1997/04/04 09:06:28 deraadt Exp $";
+static char rcsid[] = "$OpenBSD: fix_options.c,v 1.3 2000/10/14 00:56:15 itojun Exp $";
 #endif
 #endif
 
@@ -49,7 +49,21 @@ struct request_info *request;
     int     fd = request->fd;
     unsigned int opt;
     int     optlen, i;
+    struct sockaddr_storage ss;
+    int sslen;
 
+    /*
+     * check if this is AF_INET socket
+     * XXX IPv6 support?
+     */
+    sslen = sizeof(ss);
+    if (getsockname(fd, (struct sockaddr *)&ss, &sslen) < 0) {
+	syslog(LOG_ERR, "getpeername: %m");
+	clean_exit(request);
+    }
+    if (ss.ss_family != AF_INET)
+	return;
+  
     if ((ip = getprotobyname("ip")) != 0)
 	ipproto = ip->p_proto;
     else
diff --git a/lib/libwrap/hosts_access.5 b/lib/libwrap/hosts_access.5
index da3dbb54e20..7b59f26e366 100644
--- a/lib/libwrap/hosts_access.5
+++ b/lib/libwrap/hosts_access.5
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: hosts_access.5,v 1.8 2000/03/14 21:31:41 aaron Exp $
+.\"	$OpenBSD: hosts_access.5,v 1.9 2000/10/14 00:56:15 itojun Exp $
 .\"
 .\" Copyright (c) 1997, Jason Downs.  All rights reserved.
 .\"
@@ -107,6 +107,8 @@ values) or wildcards (see below).
 .Ar client_list
 is a list of one or more host names, host addresses, patterns or wildcards (see
 below) that will be matched against the client host name or address.
+When a client_list item needs to include colon character (for IPv6 addresses),
+the item needs to be wrapped with square bracket.
 .Pp
 The more complex forms
 .Ar daemon@host
@@ -169,6 +171,26 @@ matches every address in the range
 .Sq 131.155.72.0
 through
 .Sq 131.155.73.255 .
+Note that
+.Sq m.m.m.m
+portion must always be specified.
+.It
+An expression of the form
+.Sq ipv6-addr/ipv6-mask
+is interpreted as masked IPv6 address match,
+just like masked IPv4 address match (see above).
+Note that
+.Sq ipv6-mask
+portion must always be specified.
+.It
+An expression of the form
+.Sq ipv6-addr/prefixlen
+is interpreted as masked IPv6 address match
+(with mask specified by numeric prefixlen),
+just like masked IPv4 address match (see above).
+Note that
+.Sq prefixlen
+portion must always be specified.
 .El
 .Sh WILDCARDS
 The access control language supports explicit wildcards:
@@ -486,6 +508,9 @@ to the access control software, even though the host is registered.
 .Pp
 Domain name server lookups are case insensitive; NIS (formerly YP)
 netgroup lookups are case sensitive.
+.Pp
+The total length of an entry can be no more than 2047 characters long,
+including the final newline.
 .Sh AUTHOR
 .Bd -unfilled -offset indent
 Wietse Venema (wietse@wzv.win.tue.nl)
diff --git a/lib/libwrap/hosts_access.c b/lib/libwrap/hosts_access.c
index a63a8deb90d..4b43e07b39f 100644
--- a/lib/libwrap/hosts_access.c
+++ b/lib/libwrap/hosts_access.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: hosts_access.c,v 1.5 2000/02/01 03:23:17 deraadt Exp $	*/
+/*	$OpenBSD: hosts_access.c,v 1.6 2000/10/14 00:56:15 itojun Exp $	*/
 
  /*
   * This module implements a simple access control language that is based on
@@ -23,7 +23,7 @@
 #if 0
 static char sccsid[] = "@(#) hosts_access.c 1.21 97/02/12 02:13:22";
 #else
-static char rcsid[] = "$OpenBSD: hosts_access.c,v 1.5 2000/02/01 03:23:17 deraadt Exp $";
+static char rcsid[] = "$OpenBSD: hosts_access.c,v 1.6 2000/10/14 00:56:15 itojun Exp $";
 #endif
 #endif
 
@@ -31,6 +31,9 @@ static char rcsid[] = "$OpenBSD: hosts_access.c,v 1.5 2000/02/01 03:23:17 deraad
 
 #include <sys/types.h>
 #include <sys/param.h>
+#ifdef INET6
+#include <sys/socket.h>
+#endif
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #include <stdio.h>
@@ -89,6 +92,10 @@ static int client_match();
 static int host_match();
 static int string_match();
 static int masked_match();
+static int masked_match4();
+#ifdef INET6
+static int masked_match6();
+#endif
 
 /* Size of logical line buffer. */
 
@@ -195,6 +202,7 @@ struct request_info *request;
 int   (*match_fn) ();
 {
     char   *tok;
+    int l;
 
     /*
      * Process tokens one at a time. We have exhausted all possible matches
@@ -206,6 +214,11 @@ int   (*match_fn) ();
     for (tok = strtok(list, sep); tok != 0; tok = strtok((char *) 0, sep)) {
 	if (STR_EQ(tok, "EXCEPT"))		/* EXCEPT: give up */
 	    return (NO);
+	l = strlen(tok);
+	if (*tok == '[' && tok[l - 1] == ']') {
+	    tok[l - 1] = '\0';
+	    tok++;
+	}
 	if (match_fn(tok, request)) {		/* YES: look for exceptions */
 	    while ((tok = strtok((char *) 0, sep)) && STR_NE(tok, "EXCEPT"))
 		 /* VOID */ ;
@@ -317,6 +330,23 @@ char   *net_tok;
 char   *mask_tok;
 char   *string;
 {
+#ifndef INET6
+    return masked_match4(net_tok, mask_tok, string);
+#else
+    if (dot_quad_addr_new(net_tok, NULL)
+     && dot_quad_addr_new(mask_tok, NULL)
+     && dot_quad_addr_new(string, NULL)) {
+	return masked_match4(net_tok, mask_tok, string);
+    } else
+	return masked_match6(net_tok, mask_tok, string);
+#endif
+}
+
+static int masked_match4(net_tok, mask_tok, string)
+char   *net_tok;
+char   *mask_tok;
+char   *string;
+{
     in_addr_t net;
     in_addr_t mask;
     in_addr_t addr;
@@ -336,3 +366,69 @@ char   *string;
     }
     return ((addr & mask) == net);
 }
+
+#ifdef INET6
+/* Ugly because it covers IPv4 mapped address.  I hate mapped addresses. */
+static int masked_match6(net_tok, mask_tok, string)
+char   *net_tok;
+char   *mask_tok;
+char   *string;
+{
+    struct in6_addr net;
+    struct in6_addr mask;
+    struct in6_addr addr;
+    int masklen;
+    int fail;
+    int i;
+    int maskoff;
+    int netaf;
+    const int sizoff64 = sizeof(struct in6_addr) - sizeof(struct in_addr);
+
+    memset(&addr, 0, sizeof(addr));
+    if (inet_pton(AF_INET6, string, &addr) == 1)
+	; /* okay */
+    else if (inet_pton(AF_INET, string, &addr.s6_addr[sizoff64]) == 1)
+	addr.s6_addr[10] = addr.s6_addr[11] = 0xff;
+    else
+	return NO;
+
+    memset(&net, 0, sizeof(net));
+    if (inet_pton(AF_INET6, net_tok, &net) == 1) {
+	netaf = AF_INET6;
+	maskoff = 0;
+    } else if (inet_pton(AF_INET, net_tok, &net.s6_addr[sizoff64]) == 1) {
+	netaf = AF_INET;
+	maskoff = sizoff64;
+	net.s6_addr[10] = net.s6_addr[11] = 0xff;
+    } else
+	return NO;
+
+    fail = 0;
+    if (mask_tok[strspn(mask_tok, "0123456789")] == '\0') {
+	masklen = atoi(mask_tok) + maskoff * 8;
+	if (0 <= masklen && masklen <= 128) {
+	    memset(&mask, 0, sizeof(mask));
+	    memset(&mask, 0xff, masklen / 8);
+	    if (masklen % 8) {
+		((u_char *)&mask)[masklen / 8] =
+			(0xff00 >> (masklen % 8)) & 0xff;
+	    }
+	} else
+	    fail++;
+    } else if (netaf == AF_INET6 && inet_pton(AF_INET6, mask_tok, &mask) == 1)
+	; /* okay */
+    else if (netaf == AF_INET
+	  && inet_pton(AF_INET, mask_tok, &mask.s6_addr[12]) == 1) {
+	memset(&mask, 0xff, sizoff64);
+    } else
+	fail++;
+    if (fail) {
+	tcpd_warn("bad net/mask expression: %s/%s", net_tok, mask_tok);
+	return (NO);				/* not tcpd_jump() */
+    }
+
+    for (i = 0; i < sizeof(addr); i++)
+	addr.s6_addr[i] &= mask.s6_addr[i];
+    return (memcmp(&addr, &net, sizeof(addr)) == 0);
+}
+#endif
diff --git a/lib/libwrap/misc.c b/lib/libwrap/misc.c
index 69e7ac1c086..3ba0caaf023 100644
--- a/lib/libwrap/misc.c
+++ b/lib/libwrap/misc.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: misc.c,v 1.3 1999/06/06 15:34:44 deraadt Exp $	*/
+/*	$OpenBSD: misc.c,v 1.4 2000/10/14 00:56:15 itojun Exp $	*/
 
  /*
   * Misc routines that are used by tcpd and by tcpdchk.
@@ -10,7 +10,7 @@
 #if 0
 static char sccsic[] = "@(#) misc.c 1.2 96/02/11 17:01:29";
 #else
-static char rcsid[] = "$OpenBSD: misc.c,v 1.3 1999/06/06 15:34:44 deraadt Exp $";
+static char rcsid[] = "$OpenBSD: misc.c,v 1.4 2000/10/14 00:56:15 itojun Exp $";
 #endif
 #endif
 
@@ -60,11 +60,35 @@ char   *split_at(string, delimiter)
 char   *string;
 int     delimiter;
 {
+#if 0
     char   *cp;
 
     if ((cp = strchr(string, delimiter)) != 0)
 	*cp++ = 0;
     return (cp);
+#else
+    char *cp;
+    int bracket;
+
+    bracket = 0;
+    for (cp = string; cp && *cp; cp++) {
+	switch (*cp) {
+	case '[':
+	    bracket++;
+	    break;
+	case ']':
+	    bracket--;
+	    break;
+	default:
+	    if (bracket == 0 && *cp == delimiter) {
+		*cp++ = 0;
+		return cp;
+	    }
+	    break;
+	}
+    }
+    return NULL;
+#endif
 }
 
 /* dot_quad_addr_new - convert dotted quad to internal form */
diff --git a/lib/libwrap/rfc931.c b/lib/libwrap/rfc931.c
index 4bb94294e6c..8986d105a88 100644
--- a/lib/libwrap/rfc931.c
+++ b/lib/libwrap/rfc931.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: rfc931.c,v 1.1 1997/02/26 03:06:56 downsj Exp $	*/
+/*	$OpenBSD: rfc931.c,v 1.2 2000/10/14 00:56:15 itojun Exp $	*/
 
  /*
   * rfc931() speaks a common subset of the RFC 931, AUTH, TAP, IDENT and RFC
@@ -15,7 +15,7 @@
 #if 0
 static char sccsid[] = "@(#) rfc931.c 1.10 95/01/02 16:11:34";
 #else
-static char rcsid[] = "$OpenBSD: rfc931.c,v 1.1 1997/02/26 03:06:56 downsj Exp $";
+static char rcsid[] = "$OpenBSD: rfc931.c,v 1.2 2000/10/14 00:56:15 itojun Exp $";
 #endif
 #endif
 
@@ -75,19 +75,61 @@ int     sig;
 /* rfc931 - return remote user name, given socket structures */
 
 void    rfc931(rmt_sin, our_sin, dest)
-struct sockaddr_in *rmt_sin;
-struct sockaddr_in *our_sin;
+struct sockaddr *rmt_sin;
+struct sockaddr *our_sin;
 char   *dest;
 {
     unsigned rmt_port;
     unsigned our_port;
-    struct sockaddr_in rmt_query_sin;
-    struct sockaddr_in our_query_sin;
+    struct sockaddr_storage rmt_query_sin;
+    struct sockaddr_storage our_query_sin;
     char    user[256];			/* XXX */
     char    buffer[512];		/* XXX */
     char   *cp;
     char   *result = unknown;
     FILE   *fp;
+    int salen;
+    u_short *rmt_portp;
+    u_short *our_portp;
+
+    /* address family must be the same */
+    if (rmt_sin->sa_family != our_sin->sa_family) {
+	STRN_CPY(dest, result, STRING_LENGTH);
+	return;
+    }
+    switch (rmt_sin->sa_family) {
+    case AF_INET:
+	salen = sizeof(struct sockaddr_in);
+	rmt_portp = &((struct sockaddr_in *)&rmt_sin)->sin_port;
+	break;
+#ifdef INET6
+    case AF_INET6:
+	salen = sizeof(struct sockaddr_in6);
+	rmt_portp = &((struct sockaddr_in6 *)&rmt_sin)->sin6_port;
+	break;
+#endif
+    default:
+	STRN_CPY(dest, result, STRING_LENGTH);
+	return;
+    }
+    switch (our_sin->sa_family) {
+    case AF_INET:
+	our_portp = &((struct sockaddr_in *)&our_sin)->sin_port;
+	break;
+#ifdef INET6
+    case AF_INET6:
+	our_portp = &((struct sockaddr_in6 *)&our_sin)->sin6_port;
+	break;
+#endif
+    default:
+	STRN_CPY(dest, result, STRING_LENGTH);
+	return;
+    }
+
+#ifdef __GNUC__
+    (void)&result;	/* Avoid longjmp clobbering */
+    (void)&fp;		/* XXX gcc */
+#endif
 
     /*
      * Use one unbuffered stdio stream for writing to and for reading from
@@ -99,7 +141,7 @@ char   *dest;
      * sockets.
      */
 
-    if ((fp = fsocket(AF_INET, SOCK_STREAM, 0)) != 0) {
+    if ((fp = fsocket(rmt_sin->sa_family, SOCK_STREAM, 0)) != 0) {
 	setbuf(fp, (char *) 0);
 
 	/*
@@ -119,15 +161,37 @@ char   *dest;
 	     * addresses from the query socket.
 	     */
 
-	    our_query_sin = *our_sin;
-	    our_query_sin.sin_port = htons(ANY_PORT);
-	    rmt_query_sin = *rmt_sin;
-	    rmt_query_sin.sin_port = htons(RFC931_PORT);
+	    memcpy(&our_query_sin, our_sin, salen);
+	    switch (our_query_sin.ss_family) {
+	    case AF_INET:
+		((struct sockaddr_in *)&our_query_sin)->sin_port =
+			htons(ANY_PORT);
+		break;
+#ifdef INET6
+	    case AF_INET6:
+		((struct sockaddr_in6 *)&our_query_sin)->sin6_port =
+			htons(ANY_PORT);
+		break;
+#endif
+	    }
+	    memcpy(&rmt_query_sin, rmt_sin, salen);
+	    switch (rmt_query_sin.ss_family) {
+	    case AF_INET:
+		((struct sockaddr_in *)&rmt_query_sin)->sin_port =
+			htons(RFC931_PORT);
+		break;
+#ifdef INET6
+	    case AF_INET6:
+		((struct sockaddr_in6 *)&rmt_query_sin)->sin6_port = 
+			htons(RFC931_PORT);
+		break;
+#endif
+	    }
 
 	    if (bind(fileno(fp), (struct sockaddr *) & our_query_sin,
-		     sizeof(our_query_sin)) >= 0 &&
+		     salen) >= 0 &&
 		connect(fileno(fp), (struct sockaddr *) & rmt_query_sin,
-			sizeof(rmt_query_sin)) >= 0) {
+			salen) >= 0) {
 
 		/*
 		 * Send query to server. Neglect the risk that a 13-byte
@@ -136,8 +200,8 @@ char   *dest;
 		 */
 
 		fprintf(fp, "%u,%u\r\n",
-			ntohs(rmt_sin->sin_port),
-			ntohs(our_sin->sin_port));
+			ntohs(*rmt_portp),
+			ntohs(*our_portp));
 		fflush(fp);
 
 		/*
@@ -151,8 +215,8 @@ char   *dest;
 		    && ferror(fp) == 0 && feof(fp) == 0
 		    && sscanf(buffer, "%u , %u : USERID :%*[^:]:%255s",
 			      &rmt_port, &our_port, user) == 3
-		    && ntohs(rmt_sin->sin_port) == rmt_port
-		    && ntohs(our_sin->sin_port) == our_port) {
+		    && ntohs(*rmt_portp) == rmt_port
+		    && ntohs(*our_portp) == our_port) {
 
 		    /*
 		     * Strip trailing carriage return. It is part of the
diff --git a/lib/libwrap/socket.c b/lib/libwrap/socket.c
index ac6e1367f26..46e24cec8a6 100644
--- a/lib/libwrap/socket.c
+++ b/lib/libwrap/socket.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: socket.c,v 1.2 1997/06/01 05:22:08 downsj Exp $	*/
+/*	$OpenBSD: socket.c,v 1.3 2000/10/14 00:56:15 itojun Exp $	*/
 
  /*
   * This module determines the type of socket (datagram, stream), the client
@@ -21,7 +21,7 @@
 #if 0
 static char sccsid[] = "@(#) socket.c 1.15 97/03/21 19:27:24";
 #else
-static char rcsid[] = "$OpenBSD: socket.c,v 1.2 1997/06/01 05:22:08 downsj Exp $";
+static char rcsid[] = "$OpenBSD: socket.c,v 1.3 2000/10/14 00:56:15 itojun Exp $";
 #endif
 #endif
 
@@ -79,8 +79,8 @@ char   *name;
 void    sock_host(request)
 struct request_info *request;
 {
-    static struct sockaddr_in client;
-    static struct sockaddr_in server;
+    static struct sockaddr_storage client;
+    static struct sockaddr_storage server;
     int     len;
     char    buf[BUFSIZ];
     int     fd = request->fd;
@@ -94,6 +94,8 @@ struct request_info *request;
      * really should verify that client.sin_family gets the value AF_INET,
      * but this program has already caused too much grief on systems with
      * broken library code.
+     *
+     * XXX the last sentence is untrue as we support AF_INET6 as well :-)
      */
 
     len = sizeof(client);
@@ -109,7 +111,7 @@ struct request_info *request;
 	memset(buf, 0 sizeof(buf));
 #endif
     }
-    request->client->sin = &client;
+    request->client->sin = (struct sockaddr *)&client;
 
     /*
      * Determine the server binding. This is used for client username
@@ -122,7 +124,7 @@ struct request_info *request;
 	tcpd_warn("getsockname: %m");
 	return;
     }
-    request->server->sin = &server;
+    request->server->sin = (struct sockaddr *)&server;
 }
 
 /* sock_hostaddr - map endpoint address to printable form */
@@ -130,10 +132,28 @@ struct request_info *request;
 void    sock_hostaddr(host)
 struct host_info *host;
 {
-    struct sockaddr_in *sin = host->sin;
+    struct sockaddr *sa = host->sin;
+    int alen, af;
+    char *ap;
 
-    if (sin != 0)
-	STRN_CPY(host->addr, inet_ntoa(sin->sin_addr), sizeof(host->addr));
+    if (!sa)
+	return;
+    switch (af = sa->sa_family) {
+    case AF_INET:
+	ap = (char *)&((struct sockaddr_in *)sa)->sin_addr;
+	alen = sizeof(struct in_addr);
+	break;
+#ifdef INET6
+    case AF_INET6:
+	ap = (char *)&((struct sockaddr_in6 *)sa)->sin6_addr;
+	alen = sizeof(struct in6_addr);
+	break;
+#endif
+    default:
+	return;
+    }
+    host->addr[0] = '\0';
+    inet_ntop(af, ap, host->addr, sizeof(host->addr));
 }
 
 /* sock_hostname - map endpoint address to host name */
@@ -141,9 +161,12 @@ struct host_info *host;
 void    sock_hostname(host)
 struct host_info *host;
 {
-    struct sockaddr_in *sin = host->sin;
+    struct sockaddr *sin = host->sin;
     struct hostent *hp;
     int     i;
+    int af, alen;
+    char *ap;
+    char hbuf[MAXHOSTNAMELEN];
 
     /*
      * On some systems, for example Solaris 2.3, gethostbyaddr(0.0.0.0) does
@@ -152,9 +175,31 @@ struct host_info *host;
      * have to special-case 0.0.0.0, in order to avoid false alerts from the
      * host name/address checking code below.
      */
-    if (sin != 0 && sin->sin_addr.s_addr != 0
-	&& (hp = gethostbyaddr((char *) &(sin->sin_addr),
-			       sizeof(sin->sin_addr), AF_INET)) != 0) {
+    if (!sin)
+	return;
+    switch (af = sin->sa_family) {
+    case AF_INET:
+	if (((struct sockaddr_in *)sin)->sin_addr.s_addr == 0)
+	    return;
+	ap = (char *)&((struct sockaddr_in *)sin)->sin_addr;
+	alen = sizeof(struct in_addr);
+	break;
+#ifdef INET6
+    case AF_INET6:
+	ap = (char *)&((struct sockaddr_in6 *)sin)->sin6_addr;
+	alen = sizeof(struct in6_addr);
+	/* special case on reverse lookup: mapped addr.  I hate it */
+	if (IN6_IS_ADDR_V4MAPPED((struct in6_addr *)ap)) {
+	    af = AF_INET;
+	    ap += (sizeof(struct in6_addr) - sizeof(struct in_addr));
+	    alen = sizeof(struct in_addr);
+	}
+	break;
+#endif
+    default:
+	return;
+    }
+    if ((hp = gethostbyaddr(ap, alen, af)) != 0) {
 
 	STRN_CPY(host->name, hp->h_name, sizeof(host->name));
 
@@ -171,15 +216,15 @@ struct host_info *host;
 	 * we're in big trouble anyway.
 	 */
 
-	if ((hp = gethostbyname(host->name)) == 0) {
+	if ((hp = gethostbyname2(host->name, af)) == 0) {
 
 	    /*
 	     * Unable to verify that the host name matches the address. This
 	     * may be a transient problem or a botched name server setup.
 	     */
 
-	    tcpd_warn("can't verify hostname: gethostbyname(%s) failed",
-		      host->name);
+	    tcpd_warn("can't verify hostname: gethostbyname2(%s, %d) failed",
+		      host->name, af);
 
 	} else if (STR_NE(host->name, hp->h_name)
 		   && STR_NE(host->name, "localhost")) {
@@ -203,9 +248,7 @@ struct host_info *host;
 	     */
 
 	    for (i = 0; hp->h_addr_list[i]; i++) {
-		if (memcmp(hp->h_addr_list[i],
-			   (char *) &sin->sin_addr,
-			   sizeof(sin->sin_addr)) == 0)
+		if (memcmp(hp->h_addr_list[i], (char *) ap, alen) == 0)
 		    return;			/* name is good, keep it */
 	    }
 
@@ -216,7 +259,8 @@ struct host_info *host;
 	     */
 
 	    tcpd_warn("host name/address mismatch: %s != %.*s",
-		      inet_ntoa(sin->sin_addr), STRING_LENGTH, hp->h_name);
+		      inet_ntop(af, ap, hbuf, sizeof(hbuf)),
+		      STRING_LENGTH, hp->h_name);
 	}
 	strcpy(host->name, paranoid);		/* name is bad, clobber it */
     }
@@ -228,7 +272,7 @@ static void sock_sink(fd)
 int     fd;
 {
     char    buf[BUFSIZ];
-    struct sockaddr_in sin;
+    struct sockaddr_storage sin;
     int     size = sizeof(sin);
 
     /*
diff --git a/lib/libwrap/tcpd.h b/lib/libwrap/tcpd.h
index 3a12a3c92c2..9c524c8749f 100644
--- a/lib/libwrap/tcpd.h
+++ b/lib/libwrap/tcpd.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: tcpd.h,v 1.7 1999/07/21 18:27:41 form Exp $	*/
+/*	$OpenBSD: tcpd.h,v 1.8 2000/10/14 00:56:15 itojun Exp $	*/
 
 /*
  * Copyright (c) 1997, Jason Downs.  All rights reserved.
@@ -49,7 +49,7 @@
 struct host_info {
     char    name[STRING_LENGTH];	/* access via eval_hostname(host) */
     char    addr[STRING_LENGTH];	/* access via eval_hostaddr(host) */
-    struct sockaddr_in *sin;		/* socket address or 0 */
+    struct sockaddr *sin;		/* socket address or 0 */
     struct t_unitdata *unit;		/* TLI transport address or 0 */
     struct request_info *request;	/* for shared information */
 };
@@ -108,7 +108,7 @@ extern int hosts_ctl __P((char *, char *, char *, char *));
 extern void shell_cmd __P((char *));
 extern char *percent_m __P((char *, char *));
 extern char *percent_x __P((char *, int, char *, struct request_info *));
-extern void rfc931 __P((struct sockaddr_in *, struct sockaddr_in *, char *));
+extern void rfc931 __P((struct sockaddr *, struct sockaddr *, char *));
 extern void clean_exit __P((struct request_info *));
 extern void refuse __P((struct request_info *));
 #ifdef _STDIO_H_
diff --git a/lib/libwrap/update.c b/lib/libwrap/update.c
index d8eca07d3e0..0cee40df295 100644
--- a/lib/libwrap/update.c
+++ b/lib/libwrap/update.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: update.c,v 1.1 1997/02/26 03:06:59 downsj Exp $	*/
+/*	$OpenBSD: update.c,v 1.2 2000/10/14 00:56:16 itojun Exp $	*/
 
  /*
   * Routines for controlled update/initialization of request structures.
@@ -19,7 +19,7 @@
 #if 0
 static char sccsid[] = "@(#) update.c 1.1 94/12/28 17:42:56";
 #else
-static char rcsid[] = "$OpenBSD: update.c,v 1.1 1997/02/26 03:06:59 downsj Exp $";
+static char rcsid[] = "$OpenBSD: update.c,v 1.2 2000/10/14 00:56:16 itojun Exp $";
 #endif
 #endif
 
@@ -53,10 +53,10 @@ va_list ap;
 	    request->fd = va_arg(ap, int);
 	    continue;
 	case RQ_CLIENT_SIN:
-	    request->client->sin = va_arg(ap, struct sockaddr_in *);
+	    request->client->sin = va_arg(ap, struct sockaddr *);
 	    continue;
 	case RQ_SERVER_SIN:
-	    request->server->sin = va_arg(ap, struct sockaddr_in *);
+	    request->server->sin = va_arg(ap, struct sockaddr *);
 	    continue;
 
 	    /*