Enable compile-time configurable DNS lookup for tcp_wrapper checking.

There is some small risk of deadlocking if portmap uses gethostbyaddr
for source host authentication.  But some people like it.
So make it compile-time configurable:
   make USE_DNS=yes

diff --git a/Makefile b/Makefile
index 23f361bddccdf615168b51929f13a4484e2df4b1..4db2277d68f8fb5caf8191a509acdfd9d8b2cf7a 100644 (file)
--- a/Makefile
+++ b/Makefile
@@ -14,10 +14,18 @@ FACILITY=LOG_DAEMON
 # macro definitions.  Access control can also be turned off by providing
 # no access control tables. The local system, since it runs the portmap
 # daemon, is always treated as an authorized host.
+# By default, access control does not do hostname lookup as there is a risk
+# that will require portmap access, hence deadlock.  If you are sure the
+# target system will never user NIS for hostname lookup, you can define
+# USE_DNS to add hostname tests in hosts.allow/deny.
 
 ifeq ($(NO_TCP_WRAPPER),)
 CPPFLAGS += -DHOSTS_ACCESS
 WRAP_LIB  = -lwrap
+ifdef USE_DNS
+CPPFLAGS += -DENABLE_DNS
+MAN_SED += -e 's/USE_DNS/yes/'
+endif
 endif
 
 # Comment out if your RPC library does not allocate privileged ports for

diff --git a/pmap_check.c b/pmap_check.c
index 116eb49153460c3dc6fdcf5d522d4d25d330b93d..7465913aacaf102328af93f9f4760c466311b8f8 100644 (file)
--- a/pmap_check.c
+++ b/pmap_check.c
@@ -73,8 +73,6 @@ int     deny_severity __attribute ((visibility ("hidden"))) = LOG_WARNING;
 
 /* A handful of macros for "readability". */
 
-#define        good_client(a) hosts_ctl("portmap", "", inet_ntoa(a->sin_addr), "")
-
 #define reserved_port(p) (IPPORT_RESERVED/2 < (p) && (p) < IPPORT_RESERVED)
 
 #define unreserved_port(p) (IPPORT_RESERVED <= (p) && (p) != NFS_PORT)
@@ -115,6 +113,58 @@ void check_startup(void)
     (void) signal(SIGINT, toggle_verboselog);
 }
 
+
+#ifdef HOSTS_ACCESS
+static int
+good_client(struct sockaddr_in *addr)
+{
+       if (hosts_ctl("portmap", "", inet_ntoa(addr->sin_addr), ""))
+               return 1;
+#ifdef ENABLE_DNS
+{
+       struct hostent *hp;
+       char **sp;
+       char *tmpname;
+
+       /* Check the hostname. */
+       hp = gethostbyaddr ((const char *) &(addr->sin_addr),
+                           sizeof (addr->sin_addr), AF_INET);
+
+       if (!hp)
+               return 0;
+
+       /* must make sure the hostent is authoritative. */
+       tmpname = alloca (strlen (hp->h_name) + 1);
+       strcpy (tmpname, hp->h_name);
+       hp = gethostbyname(tmpname);
+       if (hp) {
+               /* now make sure the "addr->sin_addr" is on the list */
+               for (sp = hp->h_addr_list ; *sp ; sp++) {
+                       if (memcmp(*sp, &(addr->sin_addr), hp->h_length)==0)
+                               break;
+               }
+               if (!*sp)
+                       /* it was a FAKE. */
+                       return 0;
+       } else
+               /* never heard of it. misconfigured DNS? */
+               return 0;
+
+       /* Check the official name first. */
+       if (hosts_ctl("portmap", "", hp->h_name, ""))
+               return 1;
+
+       /* Check aliases. */
+       for (sp = hp->h_aliases; *sp ; sp++) {
+               if (hosts_ctl("portmap", "", *sp, ""))
+                       return 1;
+       }
+}
+#endif /* ENABLE_DNS */
+       return 0;
+}
+#endif /* HOSTS_ACCESS */
+
 /* check_default - additional checks for NULL, DUMP, GETPORT and unknown */
 
 int

diff --git a/portmap.8 b/portmap.8
index f4d5d94bdb04f5e8e7aff5fd69dfc090e19171a8..39e07cd59ef547d11a25cb7355774090c5bc22e3 100644 (file)
--- a/portmap.8
+++ b/portmap.8
@@ -157,8 +157,10 @@ version is protected by the
 .Nm tcp_wrapper
 library. You have to give the clients access to
 .Nm portmap
-if they should be allowed to use it. To allow connects from clients of
-the network 192.168. you could use the following line in /etc/hosts.allow:
+if they should be allowed to use it.
+.if 'USE_DNS'yes' .ig
+To allow connects from clients of the network 192.168. you could use
+the following line in /etc/hosts.allow:
 
 portmap: 192.168.
 
@@ -174,6 +176,22 @@ You have to use the daemon name
 for the daemon name (even if the binary has a different name). For the
 client names you can only use the keyword ALL or IP addresses (NOT
 host or domain names).
+..
+.if !'USE_DNS'yes' .ig
+To allow connects from clients of
+the .bar.com domain you could use the following line in /etc/hosts.allow:
+.Pp
+portmap: .bar.com
+.Pp
+You have to use the daemon name
+.Nm portmap
+for the daemon name (even if the binary has a different name). For the
+client names you can use the keyword ALL, IP addresses, hostnames or domain
+names. Using netgroup names will likely cause
+.Nm portmap
+to deadlock.
+Note that localhost will always be allowed access to the portmapper.
+..
 
 For further information please have a look at the
 .Xr tcpd 8 ,