1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
|
/* $OpenBSD: scaffold.c,v 1.8 2009/10/27 23:59:32 deraadt Exp $ */
/*
* Routines for testing only. Not really industrial strength.
*
* Author: Wietse Venema, Eindhoven University of Technology, The Netherlands.
*/
/* System libraries. */
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <arpa/inet.h>
#include <netdb.h>
#include <stdio.h>
#include <syslog.h>
#include <setjmp.h>
#include <string.h>
#include <stdlib.h>
#include <tcpd.h>
#ifndef INADDR_NONE
#define INADDR_NONE (-1) /* XXX should be 0xffffffff */
#endif
/* Application-specific. */
#include "scaffold.h"
/*
* These are referenced by the options module and by rfc931.c.
*/
int allow_severity = SEVERITY;
int deny_severity = LOG_WARNING;
int rfc931_timeout = RFC931_TIMEOUT;
/* find_inet_addr - find all addresses for this host, result to free() */
struct addrinfo *find_inet_addr(host, flags)
char *host;
int flags;
{
struct addrinfo hints, *res;
int error;
memset(&hints, 0, sizeof(hints));
hints.ai_socktype = SOCK_DGRAM;
hints.ai_flags = AI_CANONNAME | flags;
error = getaddrinfo(host, "0", &hints, &res);
if (error) {
tcpd_warn("%s: %s", host, gai_strerror(error));
return (0);
}
if (res->ai_canonname && STR_NE(host, res->ai_canonname)) {
tcpd_warn("%s: hostname alias", host);
tcpd_warn("(official name: %.*s)", STRING_LENGTH, res->ai_canonname);
}
return (res);
}
/* check_dns - give each address thorough workout, return address count */
int check_dns(host)
char *host;
{
struct request_info request;
struct sockaddr_storage ss;
struct addrinfo *res0, *res;
int count;
if ((res0 = find_inet_addr(host, 0)) == NULL)
return (0);
memset(&ss, 0, sizeof(ss));
request_init(&request, RQ_CLIENT_SIN, &ss, 0);
sock_methods(&request);
count = 0;
for (res = res0; res; res = res->ai_next) {
count++;
if (res->ai_addrlen > sizeof(ss))
continue;
memcpy(&ss, res->ai_addr, res->ai_addrlen);
/*
* Force host name and address conversions. Use the request structure
* as a cache. Detect hostname lookup problems. Any name/name or
* name/address conflicts will be reported while eval_hostname() does
* its job.
*/
request_set(&request, RQ_CLIENT_ADDR, "", RQ_CLIENT_NAME, "", 0);
if (STR_EQ(eval_hostname(request.client), unknown))
tcpd_warn("host address %s->name lookup failed",
eval_hostaddr(request.client));
tcpd_warn("%s %s", eval_hostname(request.client), unknown);
}
freeaddrinfo(res0);
return (count);
}
/* dummy function to intercept the real shell_cmd() */
/* ARGSUSED */
void shell_cmd(command)
char *command;
{
if (hosts_access_verbose)
printf("command: %s", command);
}
/* dummy function to intercept the real clean_exit() */
/* ARGSUSED */
void clean_exit(request)
struct request_info *request;
{
exit(0);
}
/* dummy function to intercept the real rfc931() */
/* ARGSUSED */
void rfc931(a1, a2, d1)
struct sockaddr *a1, *a2;
char *d1;
{
}
/* check_path - examine accessibility */
int check_path(path, st)
char *path;
struct stat *st;
{
struct stat stbuf;
char buf[BUFSIZ];
if (stat(path, st) < 0)
return (-1);
#ifdef notdef
if (st->st_uid != 0)
tcpd_warn("%s: not owned by root", path);
if (st->st_mode & 020)
tcpd_warn("%s: group writable", path);
#endif
if (st->st_mode & 002)
tcpd_warn("%s: world writable", path);
if (path[0] == '/' && path[1] != 0) {
strrchr((strlcpy(buf, path, sizeof buf), buf), '/')[0] = 0;
(void) check_path(buf[0] ? buf : "/", &stbuf);
}
return (0);
}
|
