| Commit message (Collapse) | Author | Age | Files | Lines |
... | |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
internal services in inetd.conf .
The inetd(8) manpage used to say that the official name of a service
_must_ be used, yet inetd itself was hardcoded to used a service alias for
the auth service, namely ident!
Rather than change inetd.conf and break existing configurations on next
upgrade, we now allow service aliases as well as official names. This
allows the software to work as expected and still support existing
configurations.
This should not breaking existing wrapped configurations either and the
inetd(8) manpage already states that it is the service name specified in
inetd.conf that is used for calls to hosts_access(3).
PR: 11796
Reported by: Alex Charalabidis <alex@wnm.net>
Approved by: des
|
|
|
|
|
| |
internal service should be used as the daemon name when constructing
hosts_access(5) rules.
|
|
|
|
| |
Submitted by: David Malone <dwmalone@maths.tcd.ie>
|
|
|
|
| |
does log all connections.
|
|
|
|
| |
Approved by: mpp
|
|
|
|
| |
Reported by: David Malone <dwmalone@maths.tcd.ie>
|
|
|
|
|
| |
Requested by: obrien
Approved by: mpp
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
twice to enable wrapping for internal wrapping as well. If the option is
not specified wrapping is turned off so that inetd will behave exactly
as it used to before TCP Wrappers was imported.
Change etc/defaults/rc.conf so as to encourage wrapping on new systems.
Clarify the use of TCP Wrappers in the IMPLEMENTATION NOTES of the
manual page.
Approved by: jkh
|
| |
|
|
|
|
| |
Submitted by: David Malone <dwmalone@maths.tcd.ie>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
1) Handle forking and non-forking internal services correctly.
Turn on wrapping for internal services because it works now.
2) Preserve server names for each service on HUP.
3) Honour hosts_options(5) severity option.
4) Add IMPLEMENTATION NOTES section to clarify TCP Wrappers
usage and limitations.
This change may cause previously allowed builtin services (e.g. daytime)
to be denied in existing configurations.
PR: 12097
Reviewed by: markm
1)
Reported by: Pierre Beyssac <pb@fasterix.freenix.org>
2)
Submitted by: Masachika ISHIZUKA <ishizuka@ish.org>
3)
Submitted by: David Malone <dwmalone@maths.tcd.ie>
|
|
|
|
|
|
| |
anything else to do.
PR: 10468, 11594
|
|
|
|
| |
with wrapping the internal services, so do not wrap them for now.
|
| |
|
|
|
|
|
|
|
| |
the daemon name vs the path. Also fix some warnings and improve
the wrapper section of the man page.
Nice debugging work by: Sheldon Hearn
|
|
|
|
|
| |
moment is support for the internal serfvices, so these are not
enabled. Volunteers welcome!
|
|
|
|
| |
Reviewed by: phk
|
|
|
|
| |
Requested by: bde
|
|
|
|
|
|
| |
Reviewed by: jkh & eivind
Submitted by: Graham Wheeler <gram@cdsec.com>
PR: bin/8183
|
| |
|
|
|
|
|
| |
Fix signal/library corruption by blocking all signals except during
select(). The reported corruption was with reentrancy in the malloc lib.
|
|
|
|
|
|
|
|
| |
It will return "ERROR:HIDDEN-USER" for all requests.
To use it add:
ident stream tcp nowait root internal
to inetd.conf
|
|
|
|
|
| |
cast. There are pointers and then there are _pointers_. One day I'll
figure out which are which. 8-)
|
| |
|
| |
|
|
|
|
|
| |
Add missing arg to error diagnostic
Print yet one arg of error diagnostic
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
For a tcp/nowait connection, inetd invokes accept(2) for
each pending connection; this call returns a file descriptor
associated with the new connection.
Twelve years ago, code was added to inetd to detect "failing
servers". The heuristic that identifies a failing server is
one that has been invoked a large number of times over some
specified interval (e.g., more than 128 ftp services started
in 60 seconds may flag the ftp service as "failing"). These
compile-time constants vary depending on vendor.
The problem is that, when a failing server is detected, the
code neglects to close the file descriptor returned by the
accept(2).
Security-Implications:
I suppose someone with ample free time could orchestrate an
attack buy pummeling services until the inetd process finally
runs out of file descriptors thus rendering inetd useless to
any new connections that require a new descriptor.
PR: 7286
Reviewed by: phk
Submitted by: Jeff Forys <jeff@forys.cranbury.nj.us>
|
|
|
|
|
|
| |
PR: 6903
Reviewed by: phk
Submitted by: Josh Gilliam <josh@quick.net>
|
| |
|
|
|
|
|
| |
reachable via T/TCP
Reviewed by: Garrett Wollman
|
|
|
|
|
|
|
|
|
|
| |
to attempt to unblock SIGCHLD, but we actually want to unignore SIGPIPE.
Obtained from: OpenBSD
Finished conversion from sigvec to sigaction (don't assume that sa_mask
is a scalar...). Didn't convert from sigblock to sigprocmask. Didn't
fix missing error checking for sigaction...
|
|
|
|
| |
Obtained from: OpenBSD
|
|
|
|
|
|
|
| |
forks. Furthermore, invalid input for tcpmux does not lead to
an exiting inetd.
This patch is recommended for people running tcpmux (which is NOT
enabled by default)
|
|
|
|
|
|
| |
service if any external TCPMUX servers are desired.
PR: 826
|
|
|
|
| |
the command line or Makefile.
|
|
|
|
|
| |
for a given IP address.
This should be very effective against DoS attacks.
|
|
|
|
| |
user[:group][/login-class]
|
|
|
|
|
| |
By default inetd run things with the same limits as from /etc/rc
(daemon class) to not break anything as in good old days.
|
| |
|
|
|
|
|
| |
Reviewed by: Theo de Raadt (who put it into OpenBSD)
Submitted by: David Holland <dholland@eecs.harvard.edu>
|
| |
|
|
|
|
| |
(This was done as a #ifdef to keep source compatibility between 2.2 and 3.0.)
|
|
|
|
| |
posix standard on the topic.
|
| |
|
|
|
|
|
|
|
|
|
|
|
| |
server to bind to. This works until you send it a SIGHUP with a
new service defined ... the new service is bound to INADDR_ANY.
This patch fixes this bug (in both RELENG_2_2 and -current).
This is a 2.2 candidate..(i.e. pure bug fix)
Submitted by: Archie Cobbs (archie@whistle.com)
|
| |
|
|
|
|
|
|
|
|
| |
This will make a number of things easier in the future, as well as (finally!)
avoiding the Id-smashing problem which has plagued developers for so long.
Boy, I'm glad we're not using sup anymore. This update would have been
insane otherwise.
|
|
|
|
| |
Enabled by defining LOGIN_CAP in Makefile, on by default.
|
|
|
|
|
|
|
|
|
|
|
| |
Submitted by: Archie Cobbs (Archie@whistle.com)
Changes to allow inted to control the number of servers to
start on each service. This is a defence against a denial of service attack
in which the system is made unusable by
an external party. It also allows the behaviour of
small memory systems to be more accuratly predicted, by
bounding the extent to which processes can multiply.
|