diff options
Diffstat (limited to 'package/tcp_wrappers/patches/patch-hosts_access_5')
| -rw-r--r-- | package/tcp_wrappers/patches/patch-hosts_access_5 | 143 |
1 files changed, 143 insertions, 0 deletions
diff --git a/package/tcp_wrappers/patches/patch-hosts_access_5 b/package/tcp_wrappers/patches/patch-hosts_access_5 new file mode 100644 index 000000000..4ebefb269 --- /dev/null +++ b/package/tcp_wrappers/patches/patch-hosts_access_5 @@ -0,0 +1,143 @@ +--- tcp_wrappers_7.6.orig/hosts_access.5 1995-01-30 19:51:47.000000000 +0100 ++++ tcp_wrappers_7.6/hosts_access.5 2009-06-05 18:45:03.000000000 +0200 +@@ -8,9 +8,9 @@ name, host name/address) patterns. Exam + impatient reader is encouraged to skip to the EXAMPLES section for a + quick introduction. + .PP +-An extended version of the access control language is described in the +-\fIhosts_options\fR(5) document. The extensions are turned on at +-program build time by building with -DPROCESS_OPTIONS. ++The extended version of the access control language is described in the ++\fIhosts_options\fR(5) document. \fBNote that this language supersedes ++the meaning of \fIshell_command\fB as documented below.\fR + .PP + In the following text, \fIdaemon\fR is the the process name of a + network daemon process, and \fIclient\fR is the name and/or address of +@@ -40,7 +40,7 @@ A newline character is ignored when it i + character. This permits you to break up long lines so that they are + easier to edit. + .IP \(bu +-Blank lines or lines that begin with a `#\' character are ignored. ++Blank lines or lines that begin with a `#' character are ignored. + This permits you to insert comments and whitespace so that the tables + are easier to read. + .IP \(bu +@@ -69,26 +69,33 @@ checks are case insensitive. + .SH PATTERNS + The access control language implements the following patterns: + .IP \(bu +-A string that begins with a `.\' character. A host name is matched if ++A string that begins with a `.' character. A host name is matched if + the last components of its name match the specified pattern. For +-example, the pattern `.tue.nl\' matches the host name +-`wzv.win.tue.nl\'. ++example, the pattern `.tue.nl' matches the host name ++`wzv.win.tue.nl'. + .IP \(bu +-A string that ends with a `.\' character. A host address is matched if ++A string that ends with a `.' character. A host address is matched if + its first numeric fields match the given string. For example, the +-pattern `131.155.\' matches the address of (almost) every host on the ++pattern `131.155.' matches the address of (almost) every host on the + Eind\%hoven University network (131.155.x.x). + .IP \(bu +-A string that begins with an `@\' character is treated as an NIS ++A string that begins with an `@' character is treated as an NIS + (formerly YP) netgroup name. A host name is matched if it is a host + member of the specified netgroup. Netgroup matches are not supported + for daemon process names or for client user names. + .IP \(bu +-An expression of the form `n.n.n.n/m.m.m.m\' is interpreted as a +-`net/mask\' pair. A host address is matched if `net\' is equal to the +-bitwise AND of the address and the `mask\'. For example, the net/mask +-pattern `131.155.72.0/255.255.254.0\' matches every address in the +-range `131.155.72.0\' through `131.155.73.255\'. ++An expression of the form `n.n.n.n/m.m.m.m' is interpreted as a ++`net/mask' pair. A host address is matched if `net' is equal to the ++bitwise AND of the address and the `mask'. For example, the net/mask ++pattern `131.155.72.0/255.255.254.0' matches every address in the ++range `131.155.72.0' through `131.155.73.255'. ++.IP \(bu ++A string that begins with a `/' character is treated as a file ++name. A host name or address is matched if it matches any host name ++or address pattern listed in the named file. The file format is ++zero or more lines with zero or more host name or address patterns ++separated by whitespace. A file name pattern can be used anywhere ++a host name or address pattern can be used. + .SH WILDCARDS + The access control language supports explicit wildcards: + .IP ALL +@@ -115,19 +122,19 @@ without -DPARANOID when you want more co + .ne 6 + .SH OPERATORS + .IP EXCEPT +-Intended use is of the form: `list_1 EXCEPT list_2\'; this construct ++Intended use is of the form: `list_1 EXCEPT list_2'; this construct + matches anything that matches \fIlist_1\fR unless it matches + \fIlist_2\fR. The EXCEPT operator can be used in daemon_lists and in + client_lists. The EXCEPT operator can be nested: if the control +-language would permit the use of parentheses, `a EXCEPT b EXCEPT c\' +-would parse as `(a EXCEPT (b EXCEPT c))\'. ++language would permit the use of parentheses, `a EXCEPT b EXCEPT c' ++would parse as `(a EXCEPT (b EXCEPT c))'. + .br + .ne 6 + .SH SHELL COMMANDS + If the first-matched access control rule contains a shell command, that + command is subjected to %<letter> substitutions (see next section). + The result is executed by a \fI/bin/sh\fR child process with standard +-input, output and error connected to \fI/dev/null\fR. Specify an `&\' ++input, output and error connected to \fI/dev/null\fR. Specify an `&' + at the end of the command if you do not want to wait until it has + completed. + .PP +@@ -159,7 +166,7 @@ depending on how much information is ava + .IP %u + The client user name (or "unknown"). + .IP %% +-Expands to a single `%\' character. ++Expands to a single `%' character. + .PP + Characters in % expansions that may confuse the shell are replaced by + underscores. +@@ -243,9 +250,9 @@ A positive IDENT lookup result (the clie + less trustworthy. It is possible for an intruder to spoof both the + client connection and the IDENT lookup, although doing so is much + harder than spoofing just a client connection. It may also be that +-the client\'s IDENT server is lying. ++the client's IDENT server is lying. + .PP +-Note: IDENT lookups don\'t work with UDP services. ++Note: IDENT lookups don't work with UDP services. + .SH EXAMPLES + The language is flexible enough that different types of access control + policy can be expressed with a minimum of fuss. Although the language +@@ -285,7 +292,7 @@ ALL: LOCAL @some_netgroup + .br + ALL: .foobar.edu EXCEPT terminalserver.foobar.edu + .PP +-The first rule permits access from hosts in the local domain (no `.\' ++The first rule permits access from hosts in the local domain (no `.' + in the host name) and from members of the \fIsome_netgroup\fP + netgroup. The second rule permits access from all hosts in the + \fIfoobar.edu\fP domain (notice the leading dot), with the exception of +@@ -322,8 +329,8 @@ in.tftpd: LOCAL, .my.domain + /etc/hosts.deny: + .in +3 + .nf +-in.tftpd: ALL: (/some/where/safe_finger -l @%h | \\ +- /usr/ucb/mail -s %d-%h root) & ++in.tftpd: ALL: (/usr/sbin/safe_finger -l @%h | \\ ++ /usr/bin/mail -s %d-%h root) & + .fi + .PP + The safe_finger command comes with the tcpd wrapper and should be +@@ -349,7 +356,7 @@ control rule; when the length of an acce + capacity of an internal buffer; when an access control rule is not + terminated by a newline character; when the result of %<letter> + expansion would overflow an internal buffer; when a system call fails +-that shouldn\'t. All problems are reported via the syslog daemon. ++that shouldn't. All problems are reported via the syslog daemon. + .SH FILES + .na + .nf |