code:
--- a/fix_options.c
+++ b/fix_options.c
@@ -11,6 +11,9 @@ static char sccsid[] = "@(#) fix_options

 #include <sys/types.h>
 #include <sys/param.h>
+#ifdef INET6
+#include <sys/socket.h>
+#endif
 #include <netinet/in.h>
 #include <netinet/in_systm.h>
 #include <netinet/ip.h>
@@ -41,6 +44,22 @@ struct request_info *request;
     unsigned int opt;
     int     optlen;
     struct in_addr dummy;
+#ifdef INET6
+    struct sockaddr_storage ss;
+    int sslen;
+
+    /*
+     * check if this is AF_INET socket
+     * XXX IPv6 support?
+     */
+    sslen = sizeof(ss);
+    if (getsockname(fd, (struct sockaddr *)&ss, &sslen) < 0) {
+	syslog(LOG_ERR, "getpeername: %m");
+	clean_exit(request);
+    }
+    if (ss.ss_family != AF_INET)
+	return;
+#endif

     if ((ip = getprotobyname("ip")) != 0)
 	ipproto = ip->p_proto;
--- a/hosts_access.5
+++ b/hosts_access.5
@@ -85,11 +85,18 @@ member of the specified netgroup. Netgro
 for daemon process names or for client user names.
 .IP \(bu
 An expression of the form `n.n.n.n/m.m.m.m\' is interpreted as a
-`net/mask\' pair. A host address is matched if `net\' is equal to the
+`net/mask\' pair. An IPv4 host address is matched if `net\' is equal to the
 bitwise AND of the address and the `mask\'. For example, the net/mask
 pattern `131.155.72.0/255.255.254.0\' matches every address in the
 range `131.155.72.0\' through `131.155.73.255\'.
 .IP \(bu
+An expression of the form `[n:n:n:n:n:n:n:n]/m\' is interpreted as a
+`[net]/prefixlen\' pair. An IPv6 host address is matched if
+`prefixlen\' bits of `net\' is equal to the `prefixlen\' bits of the
+address. For example, the [net]/prefixlen pattern
+`[3ffe:505:2:1::]/64\' matches every address in the range
+`3ffe:505:2:1::\' through `3ffe:505:2:1:ffff:ffff:ffff:ffff\'.
+.IP \(bu
 Wildcards `*\' and `?\' can be used to match hostnames or IP addresses.  This
 method of matching cannot be used in conjunction with `net/mask\' matching,
 hostname matching beginning with `.\' or IP address matching ending with `.\'.
--- a/hosts_access.c
+++ b/hosts_access.c
@@ -24,7 +24,13 @@ static char sccsid[] = "@(#) hosts_acces
 /* System libraries. */

 #include <sys/types.h>
+#ifdef INT32_T
+    typedef uint32_t u_int32_t;
+#endif
 #include <sys/param.h>
+#ifdef INET6
+#include <sys/socket.h>
+#endif
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #include <stdio.h>
@@ -33,6 +39,9 @@ static char sccsid[] = "@(#) hosts_acces
 #include <errno.h>
 #include <setjmp.h>
 #include <string.h>
+#ifdef INET6
+#include <netdb.h>
+#endif

 extern char *fgets();
 extern int errno;
@@ -83,6 +92,10 @@ static int host_match();
 static int string_match();
 static int masked_match();
 static int match_pattern_ylo();
+#ifdef INET6
+static int masked_match4();
+static int masked_match6();
+#endif

 /* Size of logical line buffer. */

@@ -290,6 +303,13 @@ char   *string;
 {
     int     n;

+#ifdef INET6
+    /* convert IPv4 mapped IPv6 address to IPv4 address */
+    if (STRN_EQ(string, "::ffff:", 7)
+      && dot_quad_addr(string + 7) != INADDR_NONE) {
+      string += 7;
+    }
+#endif
 #ifndef DISABLE_WILDCARD_MATCHING
     if (strchr(tok, '*') || strchr(tok,'?')) {  /* contains '*' or '?' */
         return (match_pattern_ylo(string,tok));
@@ -305,20 +325,72 @@ char   *string;
     } else if (tok[(n = strlen(tok)) - 1] == '.') {	/* prefix */
 	return (STRN_EQ(tok, string, n));
     } else {					/* exact match */
+#ifdef INET6
+	struct addrinfo hints, *res;
+	struct sockaddr_in6 pat, addr;
+	int len, ret;
+	char ch;
+
+	len = strlen(tok);
+	if (*tok == '[' && tok[len - 1] == ']') {
+	    ch = tok[len - 1];
+	    tok[len - 1] = '\0';
+	    memset(&hints, 0, sizeof(hints));
+	    hints.ai_family = AF_INET6;
+	    hints.ai_socktype = SOCK_STREAM;
+	    hints.ai_flags = AI_PASSIVE | AI_NUMERICHOST;
+	    if ((ret = getaddrinfo(tok + 1, NULL, &hints, &res)) == 0) {
+		memcpy(&pat, res->ai_addr, sizeof(pat));
+		freeaddrinfo(res);
+	    }
+	    tok[len - 1] = ch;
+	    if (ret != 0 || getaddrinfo(string, NULL, &hints, &res) != 0)
+		return NO;
+	    memcpy(&addr, res->ai_addr, sizeof(addr));
+	    freeaddrinfo(res);
+#ifdef NI_WITHSCOPEID
+	    if (pat.sin6_scope_id != 0 &&
+		addr.sin6_scope_id != pat.sin6_scope_id)
+		return NO;
+#endif
+	    return (!memcmp(&pat.sin6_addr, &addr.sin6_addr,
+			    sizeof(struct in6_addr)));
+	    return (ret);
+	}
+#endif
 	return (STR_EQ(tok, string));
     }
 }

 /* masked_match - match address against netnumber/netmask */

+#ifdef INET6
 static int masked_match(net_tok, mask_tok, string)
 char   *net_tok;
 char   *mask_tok;
 char   *string;
 {
+    return (masked_match4(net_tok, mask_tok, string) ||
+	    masked_match6(net_tok, mask_tok, string));
+}
+
+static int masked_match4(net_tok, mask_tok, string)
+#else
+static int masked_match(net_tok, mask_tok, string)
+#endif
+char   *net_tok;
+char   *mask_tok;
+char   *string;
+{
+#ifdef INET6
+    u_int32_t net;
+    u_int32_t mask;
+    u_int32_t addr;
+#else
     unsigned long net;
     unsigned long mask;
     unsigned long addr;
+#endif

     /*
      * Disallow forms other than dotted quad: the treatment that inet_addr()
@@ -330,12 +402,78 @@ char   *string;
 	return (NO);
     if ((net = dot_quad_addr(net_tok)) == INADDR_NONE
 	|| (mask = dot_quad_addr(mask_tok)) == INADDR_NONE) {
+#ifndef INET6
 	tcpd_warn("bad net/mask expression: %s/%s", net_tok, mask_tok);
+#endif
 	return (NO);				/* not tcpd_jump() */
     }
     return ((addr & mask) == net);
 }

+#ifdef INET6
+static int masked_match6(net_tok, mask_tok, string)
+char   *net_tok;
+char   *mask_tok;
+char   *string;
+{
+    struct addrinfo hints, *res;
+    struct sockaddr_in6 net, addr;
+    u_int32_t mask;
+    int len, mask_len, i = 0;
+    char ch;
+
+    memset(&hints, 0, sizeof(hints));
+    hints.ai_family = AF_INET6;
+    hints.ai_socktype = SOCK_STREAM;
+    hints.ai_flags = AI_PASSIVE | AI_NUMERICHOST;
+    if (getaddrinfo(string, NULL, &hints, &res) != 0)
+	return NO;
+    memcpy(&addr, res->ai_addr, sizeof(addr));
+    freeaddrinfo(res);
+
+    if (IN6_IS_ADDR_V4MAPPED(&addr.sin6_addr)) {
+	if ((*(u_int32_t *)&net.sin6_addr.s6_addr[12] = dot_quad_addr(net_tok)) == INADDR_NONE
+	 || (mask = dot_quad_addr(mask_tok)) == INADDR_NONE)
+	    return (NO);
+	return ((*(u_int32_t *)&addr.sin6_addr.s6_addr[12] & mask) == *(u_int32_t *)&net.sin6_addr.s6_addr[12]);
+    }
+
+    /* match IPv6 address against netnumber/prefixlen */
+    len = strlen(net_tok);
+    if (*net_tok != '[' || net_tok[len - 1] != ']')
+	return NO;
+    ch = net_tok[len - 1];
+    net_tok[len - 1] = '\0';
+    if (getaddrinfo(net_tok + 1, NULL, &hints, &res) != 0) {
+	net_tok[len - 1] = ch;
+	return NO;
+    }
+    memcpy(&net, res->ai_addr, sizeof(net));
+    freeaddrinfo(res);
+    net_tok[len - 1] = ch;
+    if ((mask_len = atoi(mask_tok)) < 0 || mask_len > 128)
+	return NO;
+
+#ifdef NI_WITHSCOPEID
+    if (net.sin6_scope_id != 0 && addr.sin6_scope_id != net.sin6_scope_id)
+	return NO;
+#endif
+    while (mask_len > 0) {
+	if (mask_len < 32) {
+	    mask = htonl(~(0xffffffff >> mask_len));
+	    if ((*(u_int32_t *)&addr.sin6_addr.s6_addr[i] & mask) != (*(u_int32_t *)&net.sin6_addr.s6_addr[i] & mask))
+		return NO;
+	    break;
+	}
+	if (*(u_int32_t *)&addr.sin6_addr.s6_addr[i] != *(u_int32_t *)&net.sin6_addr.s6_addr[i])
+	    return NO;
+	i += 4;
+	mask_len -= 32;
+    }
+    return YES;
+}
+#endif /* INET6 */
+
 #ifndef DISABLE_WILDCARD_MATCHING
 /* Note: this feature has been adapted in a pretty straightforward way
    from Tatu Ylonen's last SSH version under free license by
--- a/Makefile
+++ b/Makefile
@@ -21,7 +21,7 @@ what:
 	@echo "	dynix epix esix freebsd hpux irix4 irix5 irix6 isc iunix"
 	@echo "	linux machten mips(untested) ncrsvr4 netbsd next osf power_unix_211"
 	@echo "	ptx-2.x ptx-generic pyramid sco sco-nis sco-od2 sco-os5 sinix sunos4"
-	@echo "	sunos40 sunos5 sysv4 tandem ultrix unicos7 unicos8 unixware1 unixware2"
+	@echo "	sunos40 sunos5 solaris8 sysv4 tandem ultrix unicos7 unicos8 unixware1 unixware2"
 	@echo "	uts215 uxp"
 	@echo
 	@echo "If none of these match your environment, edit the system"
@@ -131,20 +131,34 @@ epix:
 	NETGROUP=-DNETGROUP TLI= SYSTYPE="-systype bsd43" all

 # Freebsd and linux by default have no NIS.
-386bsd netbsd bsdos:
+386bsd bsdos:
 	@make REAL_DAEMON_DIR=$(REAL_DAEMON_DIR) STYLE=$(STYLE) \
 	LIBS= RANLIB=ranlib ARFLAGS=rv AUX_OBJ= NETGROUP= TLI= \
 	EXTRA_CFLAGS=-DSYS_ERRLIST_DEFINED VSYSLOG= all

 freebsd:
 	@make REAL_DAEMON_DIR=$(REAL_DAEMON_DIR) STYLE=$(STYLE) \
+	LIBS="-L/usr/local/v6/lib -linet6" \
 	LIBS= RANLIB=ranlib ARFLAGS=rv AUX_OBJ= NETGROUP= TLI= \
-	EXTRA_CFLAGS=-DSYS_ERRLIST_DEFINED VSYSLOG= all
+	EXTRA_CFLAGS="-DSYS_ERRLIST_DEFINED -DINET6 -Dss_family=__ss_family -Dss_len=__ss_len" \
+	VSYSLOG= all
+
+netbsd:
+	@make REAL_DAEMON_DIR=$(REAL_DAEMON_DIR) STYLE=$(STYLE) \
+	LIBS= RANLIB=ranlib ARFLAGS=rv AUX_OBJ= NETGROUP= TLI= \
+	EXTRA_CFLAGS="-DSYS_ERRLIST_DEFINED -DINET6 -Dss_family=__ss_family -Dss_len=__ss_len" VSYSLOG= all

 linux:
 	@make REAL_DAEMON_DIR=$(REAL_DAEMON_DIR) STYLE=$(STYLE) \
-	LIBS= RANLIB=ranlib ARFLAGS=rv AUX_OBJ=setenv.o \
-	NETGROUP= TLI= EXTRA_CFLAGS="-DBROKEN_SO_LINGER" all
+	LIBS=-lnsl RANLIB=ranlib ARFLAGS=rv AUX_OBJ= \
+	NETGROUP="-DNETGROUP" TLI= VSYSLOG= BUGS= \
+	EXTRA_CFLAGS="-DSYS_ERRLIST_DEFINED -DHAVE_STRERROR -DINET6=1 -Dss_family=__ss_family -Dss_len=__ss_len" all
+
+gnu:
+	@make REAL_DAEMON_DIR=$(REAL_DAEMON_DIR) STYLE=$(STYLE) \
+	LIBS=-lnsl RANLIB=ranlib ARFLAGS=rv AUX_OBJ= \
+	NETGROUP=-DNETGROUP TLI= VSYSLOG= BUGS= \
+	EXTRA_CFLAGS="-DSYS_ERRLIST_DEFINED -DHAVE_STRERROR -DINET6=1" all

 # This is good for many SYSV+BSD hybrids with NIS, probably also for HP-UX 7.x.
 hpux hpux8 hpux9 hpux10:
@@ -196,6 +210,13 @@ sunos5:
 	NETGROUP=-DNETGROUP AUX_OBJ=setenv.o TLI=-DTLI \
 	BUGS="$(BUGS) -DSOLARIS_24_GETHOSTBYNAME_BUG" all

+# SunOS 5.8 is another SYSV4 variant, but has IPv6 support
+solaris8:
+	@make REAL_DAEMON_DIR=$(REAL_DAEMON_DIR) STYLE=$(STYLE) \
+	LIBS="-lsocket -lnsl" RANLIB=echo ARFLAGS=rv VSYSLOG= \
+	NETGROUP=-DNETGROUP AUX_OBJ=setenv.o TLI=-DTLI \
+	EXTRA_CFLAGS="-DINET6 -DNO_CLONE_DEVICE -DINT32_T" all
+
 # Generic SYSV40
 esix sysv4:
 	@make REAL_DAEMON_DIR=$(REAL_DAEMON_DIR) STYLE=$(STYLE) \
--- a/misc.c
+++ b/misc.c
@@ -58,9 +58,31 @@ int     delimiter;
 {
     char   *cp;

+#ifdef INET6
+    int bracket = 0;
+
+    for (cp = string; cp && *cp; cp++) {
+	switch (*cp) {
+	case '[':
+	    bracket++;
+	    break;
+	case ']':
+	    bracket--;
+	    break;
+	default:
+	    if (bracket == 0 && *cp == delimiter) {
+		*cp++ = 0;
+		return cp;
+	    }
+	    break;
+	}
+    }
+    return (NULL);
+#else
     if ((cp = strchr(string, delimiter)) != 0)
 	*cp++ = 0;
     return (cp);
+#endif
 }

 /* dot_quad_addr - convert dotted quad to internal form */
--- a/refuse.c
+++ b/refuse.c
@@ -25,7 +25,12 @@ static char sccsid[] = "@(#) refuse.c 1.
 void    refuse(request)
 struct request_info *request;
 {
+#ifdef INET6
+    syslog(deny_severity, "refused connect from %s (%s)",
+	   eval_client(request), eval_hostaddr(request->client));
+#else
     syslog(deny_severity, "refused connect from %s", eval_client(request));
+#endif
     clean_exit(request);
     /* NOTREACHED */
 }
--- a/rfc931.c
+++ b/rfc931.c
@@ -68,20 +68,50 @@ int     sig;
 /* rfc931 - return remote user name, given socket structures */

 void    rfc931(rmt_sin, our_sin, dest)
+#ifdef INET6
+struct sockaddr *rmt_sin;
+struct sockaddr *our_sin;
+#else
 struct sockaddr_in *rmt_sin;
 struct sockaddr_in *our_sin;
+#endif
 char   *dest;
 {
     unsigned rmt_port;
     unsigned our_port;
+#ifdef INET6
+    struct sockaddr_storage rmt_query_sin;
+    struct sockaddr_storage our_query_sin;
+    int alen;
+#else
     struct sockaddr_in rmt_query_sin;
     struct sockaddr_in our_query_sin;
+#endif
     char    user[256];			/* XXX */
     char    buffer[512];		/* XXX */
     char   *cp;
     char   *result = unknown;
     FILE   *fp;

+#ifdef INET6
+    /* address family must be the same */
+    if (rmt_sin->sa_family != our_sin->sa_family) {
+	STRN_CPY(dest, result, STRING_LENGTH);
+	return;
+    }
+    switch (our_sin->sa_family) {
+    case AF_INET:
+	alen = sizeof(struct sockaddr_in);
+	break;
+    case AF_INET6:
+	alen = sizeof(struct sockaddr_in6);
+	break;
+    default:
+	STRN_CPY(dest, result, STRING_LENGTH);
+	return;
+    }
+#endif
+
     /*
      * Use one unbuffered stdio stream for writing to and for reading from
      * the RFC931 etc. server. This is done because of a bug in the SunOS
@@ -92,7 +122,11 @@ char   *dest;
      * sockets.
      */

+#ifdef INET6
+    if ((fp = fsocket(our_sin->sa_family, SOCK_STREAM, 0)) != 0) {
+#else
     if ((fp = fsocket(AF_INET, SOCK_STREAM, 0)) != 0) {
+#endif
 	setbuf(fp, (char *) 0);

 	/*
@@ -112,6 +146,25 @@ char   *dest;
 	     * addresses from the query socket.
 	     */

+#ifdef INET6
+	    memcpy(&our_query_sin, our_sin, alen);
+	    memcpy(&rmt_query_sin, rmt_sin, alen);
+	    switch (our_sin->sa_family) {
+	    case AF_INET:
+		((struct sockaddr_in *)&our_query_sin)->sin_port = htons(ANY_PORT);
+		((struct sockaddr_in *)&rmt_query_sin)->sin_port = htons(RFC931_PORT);
+		break;
+	    case AF_INET6:
+		((struct sockaddr_in6 *)&our_query_sin)->sin6_port = htons(ANY_PORT);
+		((struct sockaddr_in6 *)&rmt_query_sin)->sin6_port = htons(RFC931_PORT);
+		break;
+	    }
+
+	    if (bind(fileno(fp), (struct sockaddr *) & our_query_sin,
+		     alen) >= 0 &&
+		connect(fileno(fp), (struct sockaddr *) & rmt_query_sin,
+			alen) >= 0) {
+#else
 	    our_query_sin = *our_sin;
 	    our_query_sin.sin_port = htons(ANY_PORT);
 	    rmt_query_sin = *rmt_sin;
@@ -121,6 +174,7 @@ char   *dest;
 		     sizeof(our_query_sin)) >= 0 &&
 		connect(fileno(fp), (struct sockaddr *) & rmt_query_sin,
 			sizeof(rmt_query_sin)) >= 0) {
+#endif

 		/*
 		 * Send query to server. Neglect the risk that a 13-byte
@@ -129,8 +183,13 @@ char   *dest;
 		 */

 		fprintf(fp, "%u,%u\r\n",
+#ifdef INET6
+			ntohs(((struct sockaddr_in *)rmt_sin)->sin_port),
+			ntohs(((struct sockaddr_in *)our_sin)->sin_port));
+#else
 			ntohs(rmt_sin->sin_port),
 			ntohs(our_sin->sin_port));
+#endif
 		fflush(fp);

 		/*
@@ -144,8 +203,13 @@ char   *dest;
 		    && ferror(fp) == 0 && feof(fp) == 0
 		    && sscanf(buffer, "%u , %u : USERID :%*[^:]:%255s",
 			      &rmt_port, &our_port, user) == 3
+#ifdef INET6
+		    && ntohs(((struct sockaddr_in *)rmt_sin)->sin_port) == rmt_port
+		    && ntohs(((struct sockaddr_in *)our_sin)->sin_port) == our_port) {
+#else
 		    && ntohs(rmt_sin->sin_port) == rmt_port
 		    && ntohs(our_sin->sin_port) == our_port) {
+#endif

 		    /*
 		     * Strip trailing carriage return. It is part of the
--- a/scaffold.c
+++ b/scaffold.c
@@ -25,7 +25,9 @@ static char sccs_id[] = "@(#) scaffold.c
 #define	INADDR_NONE	(-1)		/* XXX should be 0xffffffff */
 #endif

+#ifndef INET6
 extern char *malloc();
+#endif

 /* Application-specific. */

@@ -39,6 +41,7 @@ int     allow_severity = SEVERITY;
 int     deny_severity = LOG_WARNING;
 int     rfc931_timeout = RFC931_TIMEOUT;

+#ifndef INET6
 /* dup_hostent - create hostent in one memory block */

 static struct hostent *dup_hostent(hp)
@@ -73,9 +76,46 @@ struct hostent *hp;
     }
     return (&hb->host);
 }
+#endif

 /* find_inet_addr - find all addresses for this host, result to free() */

+#ifdef INET6
+struct addrinfo *find_inet_addr(host)
+char   *host;
+{
+    struct addrinfo hints, *res;
+
+    memset(&hints, 0, sizeof(hints));
+    hints.ai_family = PF_UNSPEC;
+    hints.ai_socktype = SOCK_STREAM;
+    hints.ai_flags = AI_PASSIVE | AI_NUMERICHOST;
+    if (getaddrinfo(host, NULL, &hints, &res) == 0)
+	return (res);
+
+    memset(&hints, 0, sizeof(hints));
+    hints.ai_family = PF_UNSPEC;
+    hints.ai_socktype = SOCK_STREAM;
+    hints.ai_flags = AI_PASSIVE | AI_CANONNAME;
+    if (getaddrinfo(host, NULL, &hints, &res) != 0) {
+	tcpd_warn("%s: host not found", host);
+	return (0);
+    }
+    if (res->ai_family != AF_INET6 && res->ai_family != AF_INET) {
+	tcpd_warn("%d: not an internet host", res->ai_family);
+	freeaddrinfo(res);
+	return (0);
+    }
+    if (!res->ai_canonname) {
+	tcpd_warn("%s: hostname alias", host);
+	tcpd_warn("(cannot obtain official name)", res->ai_canonname);
+    } else if (STR_NE(host, res->ai_canonname)) {
+	tcpd_warn("%s: hostname alias", host);
+	tcpd_warn("(official name: %.*s)", STRING_LENGTH, res->ai_canonname);
+    }
+    return (res);
+}
+#else
 struct hostent *find_inet_addr(host)
 char   *host;
 {
@@ -118,6 +158,7 @@ char   *host;
     }
     return (dup_hostent(hp));
 }
+#endif

 /* check_dns - give each address thorough workout, return address count */

@@ -125,8 +166,13 @@ int     check_dns(host)
 char   *host;
 {
     struct request_info request;
+#ifdef INET6
+    struct sockaddr_storage sin;
+    struct addrinfo *hp, *res;
+#else
     struct sockaddr_in sin;
     struct hostent *hp;
+#endif
     int     count;
     char   *addr;

@@ -134,11 +180,18 @@ char   *host;
 	return (0);
     request_init(&request, RQ_CLIENT_SIN, &sin, 0);
     sock_methods(&request);
+#ifndef INET6
     memset((char *) &sin, 0, sizeof(sin));
     sin.sin_family = AF_INET;
+#endif

+#ifdef INET6
+    for (res = hp, count = 0; res; res = res->ai_next, count++) {
+	memcpy(&sin, res->ai_addr, res->ai_addrlen);
+#else
     for (count = 0; (addr = hp->h_addr_list[count]) != 0; count++) {
 	memcpy((char *) &sin.sin_addr, addr, sizeof(sin.sin_addr));
+#endif

 	/*
 	 * Force host name and address conversions. Use the request structure
@@ -151,7 +204,11 @@ char   *host;
 	    tcpd_warn("host address %s->name lookup failed",
 		      eval_hostaddr(request.client));
     }
+#ifdef INET6
+    freeaddrinfo(hp);
+#else
     free((char *) hp);
+#endif
     return (count);
 }

--- a/scaffold.h
+++ b/scaffold.h
@@ -4,6 +4,10 @@
   * Author: Wietse Venema, Eindhoven University of Technology, The Netherlands.
   */

+#ifdef INET6
+extern struct addrinfo *find_inet_addr();
+#else
 extern struct hostent *find_inet_addr();
+#endif
 extern int check_dns();
 extern int check_path();
--- a/socket.c
+++ b/socket.c
@@ -24,13 +24,22 @@ static char sccsid[] = "@(#) socket.c 1.
 #include <sys/types.h>
 #include <sys/param.h>
 #include <sys/socket.h>
+#ifdef INT32_T
+typedef uint32_t u_int32_t;
+#endif
 #include <netinet/in.h>
 #include <netdb.h>
 #include <stdio.h>
 #include <syslog.h>
 #include <string.h>

+#ifdef INET6
+#ifndef NI_WITHSCOPEID
+#define NI_WITHSCOPEID	0
+#endif
+#else
 extern char *inet_ntoa();
+#endif

 /* Local stuff. */

@@ -79,8 +88,13 @@ char   *name;
 void    sock_host(request)
 struct request_info *request;
 {
+#ifdef INET6
+    static struct sockaddr_storage client;
+    static struct sockaddr_storage server;
+#else
     static struct sockaddr_in client;
     static struct sockaddr_in server;
+#endif
     int     len;
     char    buf[BUFSIZ];
     int     fd = request->fd;
@@ -109,7 +123,11 @@ struct request_info *request;
 	memset(buf, 0 sizeof(buf));
 #endif
     }
+#ifdef INET6
+    request->client->sin = (struct sockaddr *)&client;
+#else
     request->client->sin = &client;
+#endif

     /*
      * Determine the server binding. This is used for client username
@@ -122,7 +140,11 @@ struct request_info *request;
 	tcpd_warn("getsockname: %m");
 	return;
     }
+#ifdef INET6
+    request->server->sin = (struct sockaddr *)&server;
+#else
     request->server->sin = &server;
+#endif
 }

 /* sock_hostaddr - map endpoint address to printable form */
@@ -130,10 +152,26 @@ struct request_info *request;
 void    sock_hostaddr(host)
 struct host_info *host;
 {
+#ifdef INET6
+    struct sockaddr *sin = host->sin;
+    int salen;
+
+    if (!sin)
+	return;
+#ifdef SIN6_LEN
+    salen = sin->sa_len;
+#else
+    salen = (sin->sa_family == AF_INET) ? sizeof(struct sockaddr_in)
+					: sizeof(struct sockaddr_in6);
+#endif
+    getnameinfo(sin, salen, host->addr, sizeof(host->addr),
+		NULL, 0, NI_NUMERICHOST | NI_WITHSCOPEID);
+#else
     struct sockaddr_in *sin = host->sin;

     if (sin != 0)
 	STRN_CPY(host->addr, inet_ntoa(sin->sin_addr), sizeof(host->addr));
+#endif
 }

 /* sock_hostname - map endpoint address to host name */
@@ -141,6 +179,160 @@ struct host_info *host;
 void    sock_hostname(host)
 struct host_info *host;
 {
+#ifdef INET6
+    struct sockaddr *sin = host->sin;
+    struct sockaddr_in sin4;
+    struct addrinfo hints, *res, *res0 = NULL;
+    int salen, alen, err = 1;
+    char *ap = NULL, *rap, hname[NI_MAXHOST];
+
+    if (sin != NULL) {
+	if (sin->sa_family == AF_INET6) {
+	    struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)sin;
+
+	    if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
+		memset(&sin4, 0, sizeof(sin4));
+#ifdef SIN6_LEN
+		sin4.sin_len = sizeof(sin4);
+#endif
+		sin4.sin_family = AF_INET;
+		sin4.sin_port = sin6->sin6_port;
+		sin4.sin_addr.s_addr = *(u_int32_t *)&sin6->sin6_addr.s6_addr[12];
+		sin = (struct sockaddr *)&sin4;
+	    }
+	}
+	switch (sin->sa_family) {
+	case AF_INET:
+	    ap = (char *)&((struct sockaddr_in *)sin)->sin_addr;
+	    alen = sizeof(struct in_addr);
+	    salen = sizeof(struct sockaddr_in);
+	    break;
+	case AF_INET6:
+	    ap = (char *)&((struct sockaddr_in6 *)sin)->sin6_addr;
+	    alen = sizeof(struct in6_addr);
+	    salen = sizeof(struct sockaddr_in6);
+	    break;
+	default:
+	    break;
+	}
+	if (ap)
+	    err = getnameinfo(sin, salen, hname, sizeof(hname),
+			      NULL, 0, NI_WITHSCOPEID | NI_NAMEREQD);
+    }
+    if (!err) {
+
+	STRN_CPY(host->name, hname, sizeof(host->name));
+
+	/* reject numeric addresses */
+	memset(&hints, 0, sizeof(hints));
+	hints.ai_family = sin->sa_family;
+	hints.ai_socktype = SOCK_STREAM;
+	hints.ai_flags = AI_PASSIVE | AI_CANONNAME | AI_NUMERICHOST;
+	if ((err = getaddrinfo(host->name, NULL, &hints, &res0) == 0)) {
+	    freeaddrinfo(res0);
+	    res0 = NULL;
+	    tcpd_warn("host name/name mismatch: "
+		      "reverse lookup results in non-FQDN %s",
+		      host->name);
+	    strcpy(host->name, paranoid);	/* name is bad, clobber it */
+	}
+	err = !err;
+    }
+    if (!err) {
+	/* we are now sure that this is non-numeric */
+
+	/*
+	 * Verify that the address is a member of the address list returned
+	 * by gethostbyname(hostname).
+	 *
+	 * Verify also that gethostbyaddr() and gethostbyname() return the same
+	 * hostname, or rshd and rlogind may still end up being spoofed.
+	 *
+	 * On some sites, gethostbyname("localhost") returns "localhost.domain".
+	 * This is a DNS artefact. We treat it as a special case. When we
+	 * can't believe the address list from gethostbyname("localhost")
+	 * we're in big trouble anyway.
+	 */
+
+	memset(&hints, 0, sizeof(hints));
+	hints.ai_family = sin->sa_family;
+	hints.ai_socktype = SOCK_STREAM;
+	hints.ai_flags = AI_PASSIVE | AI_CANONNAME;
+	if (getaddrinfo(host->name, NULL, &hints, &res0) != 0) {
+
+	    /*
+	     * Unable to verify that the host name matches the address. This
+	     * may be a transient problem or a botched name server setup.
+	     */
+
+	    tcpd_warn("can't verify hostname: getaddrinfo(%s, %s) failed",
+		      host->name,
+		      (sin->sa_family == AF_INET) ? "AF_INET" : "AF_INET6");
+
+	} else if ((res0->ai_canonname == NULL
+		    || STR_NE(host->name, res0->ai_canonname))
+		   && STR_NE(host->name, "localhost")) {
+
+	    /*
+	     * The gethostbyaddr() and gethostbyname() calls did not return
+	     * the same hostname. This could be a nameserver configuration
+	     * problem. It could also be that someone is trying to spoof us.
+	     */
+
+	    tcpd_warn("host name/name mismatch: %s != %.*s",
+		      host->name, STRING_LENGTH,
+		      (res0->ai_canonname == NULL) ? "" : res0->ai_canonname);
+
+	} else {
+
+	    /*
+	     * The address should be a member of the address list returned by
+	     * gethostbyname(). We should first verify that the h_addrtype
+	     * field is AF_INET, but this program has already caused too much
+	     * grief on systems with broken library code.
+	     */
+
+	    for (res = res0; res; res = res->ai_next) {
+		if (res->ai_family != sin->sa_family)
+		    continue;
+		switch (res->ai_family) {
+		case AF_INET:
+		    rap = (char *)&((struct sockaddr_in *)res->ai_addr)->sin_addr;
+		    break;
+		case AF_INET6:
+		    /* need to check scope_id */
+		    if (((struct sockaddr_in6 *)sin)->sin6_scope_id !=
+		        ((struct sockaddr_in6 *)res->ai_addr)->sin6_scope_id) {
+			continue;
+		    }
+		    rap = (char *)&((struct sockaddr_in6 *)res->ai_addr)->sin6_addr;
+		    break;
+		default:
+		    continue;
+		}
+		if (memcmp(rap, ap, alen) == 0) {
+		    freeaddrinfo(res0);
+		    return;			/* name is good, keep it */
+		}
+	    }
+
+	    /*
+	     * The host name does not map to the initial address. Perhaps
+	     * someone has messed up. Perhaps someone compromised a name
+	     * server.
+	     */
+
+	    getnameinfo(sin, salen, hname, sizeof(hname),
+			NULL, 0, NI_NUMERICHOST | NI_WITHSCOPEID);
+	    tcpd_warn("host name/address mismatch: %s != %.*s",
+		      hname, STRING_LENGTH,
+		      (res0->ai_canonname == NULL) ? "" : res0->ai_canonname);
+	}
+	strcpy(host->name, paranoid);		/* name is bad, clobber it */
+	if (res0)
+	    freeaddrinfo(res0);
+    }
+#else /* INET6 */
     struct sockaddr_in *sin = host->sin;
     struct hostent *hp;
     int     i;
@@ -220,6 +412,7 @@ struct host_info *host;
 	}
 	strcpy(host->name, paranoid);		/* name is bad, clobber it */
     }
+#endif /* INET6 */
 }

 /* sock_sink - absorb unreceived IP datagram */
@@ -228,7 +421,11 @@ static void sock_sink(fd)
 int     fd;
 {
     char    buf[BUFSIZ];
+#ifdef INET6
+    struct sockaddr_storage sin;
+#else
     struct sockaddr_in sin;
+#endif
     int     size = sizeof(sin);

     /*
--- a/tcpd.c
+++ b/tcpd.c
@@ -120,7 +120,12 @@ char  **argv;

     /* Report request and invoke the real daemon program. */

+#ifdef INET6
+    syslog(allow_severity, "connect from %s (%s)",
+	   eval_client(&request), eval_hostaddr(request.client));
+#else
     syslog(allow_severity, "connect from %s", eval_client(&request));
+#endif
     closelog();
     (void) execv(path, argv);
     syslog(LOG_ERR, "error: cannot execute %s: %m", path);
--- a/tcpdchk.c
+++ b/tcpdchk.c
@@ -22,6 +22,9 @@ static char sccsid[] = "@(#) tcpdchk.c 1

 #include <sys/types.h>
 #include <sys/stat.h>
+#ifdef INET6
+#include <sys/socket.h>
+#endif
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #include <stdio.h>
@@ -397,6 +400,31 @@ char   *pat;
     }
 }

+#ifdef INET6
+static int is_inet6_addr(pat)
+    char *pat;
+{
+    struct addrinfo hints, *res;
+    int len, ret;
+    char ch;
+
+    if (*pat != '[')
+	return (0);
+    len = strlen(pat);
+    if ((ch = pat[len - 1]) != ']')
+	return (0);
+    pat[len - 1] = '\0';
+    memset(&hints, 0, sizeof(hints));
+    hints.ai_family = AF_INET6;
+    hints.ai_socktype = SOCK_STREAM;
+    hints.ai_flags = AI_PASSIVE | AI_NUMERICHOST;
+    if ((ret = getaddrinfo(pat + 1, NULL, &hints, &res)) == 0)
+	freeaddrinfo(res);
+    pat[len - 1] = ch;
+    return (ret == 0);
+}
+#endif
+
 /* check_host - criticize host pattern */

 static int check_host(pat)
@@ -423,14 +451,27 @@ char   *pat;
 #endif
 #endif
     } else if (mask = split_at(pat, '/')) {	/* network/netmask */
+#ifdef INET6
+	int mask_len;
+
+	if ((dot_quad_addr(pat) == INADDR_NONE
+	    || dot_quad_addr(mask) == INADDR_NONE)
+	    && (!is_inet6_addr(pat)
+		|| ((mask_len = atoi(mask)) < 0 || mask_len > 128)))
+#else
 	if (dot_quad_addr(pat) == INADDR_NONE
 	    || dot_quad_addr(mask) == INADDR_NONE)
+#endif
 	    tcpd_warn("%s/%s: bad net/mask pattern", pat, mask);
     } else if (STR_EQ(pat, "FAIL")) {		/* obsolete */
 	tcpd_warn("FAIL is no longer recognized");
 	tcpd_warn("(use EXCEPT or DENY instead)");
     } else if (reserved_name(pat)) {		/* other reserved */
 	 /* void */ ;
+#ifdef INET6
+    } else if (is_inet6_addr(pat)) { /* IPv6 address */
+	addr_count = 1;
+#endif
     } else if (NOT_INADDR(pat)) {		/* internet name */
 	if (pat[strlen(pat) - 1] == '.') {
 	    tcpd_warn("%s: domain or host name ends in dot", pat);
--- a/tcpd.h
+++ b/tcpd.h
@@ -11,7 +11,11 @@
 struct host_info {
     char    name[STRING_LENGTH];	/* access via eval_hostname(host) */
     char    addr[STRING_LENGTH];	/* access via eval_hostaddr(host) */
+#ifdef INET6
+    struct sockaddr *sin;		/* socket address or 0 */
+#else
     struct sockaddr_in *sin;		/* socket address or 0 */
+#endif
     struct t_unitdata *unit;		/* TLI transport address or 0 */
     struct request_info *request;	/* for shared information */
 };
--- a/tcpdmatch.c
+++ b/tcpdmatch.c
@@ -57,7 +57,11 @@ int     main(argc, argv)
 int     argc;
 char  **argv;
 {
+#ifdef INET6
+    struct addrinfo hints, *hp, *res;
+#else
     struct hostent *hp;
+#endif
     char   *myname = argv[0];
     char   *client;
     char   *server;
@@ -68,8 +72,13 @@ char  **argv;
     int     ch;
     char   *inetcf = 0;
     int     count;
+#ifdef INET6
+    struct sockaddr_storage server_sin;
+    struct sockaddr_storage client_sin;
+#else
     struct sockaddr_in server_sin;
     struct sockaddr_in client_sin;
+#endif
     struct stat st;

     /*
@@ -172,13 +181,20 @@ char  **argv;
     if (NOT_INADDR(server) == 0 || HOSTNAME_KNOWN(server)) {
 	if ((hp = find_inet_addr(server)) == 0)
 	    exit(1);
+#ifndef INET6
 	memset((char *) &server_sin, 0, sizeof(server_sin));
 	server_sin.sin_family = AF_INET;
+#endif
 	request_set(&request, RQ_SERVER_SIN, &server_sin, 0);

+#ifdef INET6
+	for (res = hp, count = 0; res; res = res->ai_next, count++) {
+	    memcpy(&server_sin, res->ai_addr, res->ai_addrlen);
+#else
 	for (count = 0; (addr = hp->h_addr_list[count]) != 0; count++) {
 	    memcpy((char *) &server_sin.sin_addr, addr,
 		   sizeof(server_sin.sin_addr));
+#endif

 	    /*
 	     * Force evaluation of server host name and address. Host name
@@ -194,7 +210,11 @@ char  **argv;
 	    fprintf(stderr, "Please specify an address instead\n");
 	    exit(1);
 	}
+#ifdef INET6
+	freeaddrinfo(hp);
+#else
 	free((char *) hp);
+#endif
     } else {
 	request_set(&request, RQ_SERVER_NAME, server, 0);
     }
@@ -208,6 +228,18 @@ char  **argv;
 	tcpdmatch(&request);
 	exit(0);
     }
+#ifdef INET6
+    memset(&hints, 0, sizeof(hints));
+    hints.ai_family = AF_INET6;
+    hints.ai_socktype = SOCK_STREAM;
+    hints.ai_flags = AI_PASSIVE | AI_NUMERICHOST;
+    if (getaddrinfo(client, NULL, &hints, &res) == 0) {
+	freeaddrinfo(res);
+	request_set(&request, RQ_CLIENT_ADDR, client, 0);
+	tcpdmatch(&request);
+	exit(0);
+    }
+#endif

     /*
      * Perhaps they are testing special client hostname patterns that aren't
@@ -229,6 +261,34 @@ char  **argv;
      */
     if ((hp = find_inet_addr(client)) == 0)
 	exit(1);
+#ifdef INET6
+    request_set(&request, RQ_CLIENT_SIN, &client_sin, 0);
+
+    for (res = hp, count = 0; res; res = res->ai_next, count++) {
+	memcpy(&client_sin, res->ai_addr, res->ai_addrlen);
+
+	/*
+	 * getnameinfo() doesn't do reverse lookup against link-local
+	 * address.  So, we pass through host name evaluation against
+	 * such addresses.
+	 */
+	if (res->ai_family != AF_INET6 ||
+	    !IN6_IS_ADDR_LINKLOCAL(&((struct sockaddr_in6 *)res->ai_addr)->sin6_addr)) {
+	    /*
+	     * Force evaluation of client host name and address. Host name
+	     * conflicts will be reported while eval_hostname() does its job.
+	     */
+	    request_set(&request, RQ_CLIENT_NAME, "", RQ_CLIENT_ADDR, "", 0);
+	    if (STR_EQ(eval_hostname(request.client), unknown))
+		tcpd_warn("host address %s->name lookup failed",
+			  eval_hostaddr(request.client));
+	}
+	tcpdmatch(&request);
+	if (res->ai_next)
+	    printf("\n");
+    }
+    freeaddrinfo(hp);
+#else
     memset((char *) &client_sin, 0, sizeof(client_sin));
     client_sin.sin_family = AF_INET;
     request_set(&request, RQ_CLIENT_SIN, &client_sin, 0);
@@ -250,6 +310,7 @@ char  **argv;
 	    printf("\n");
     }
     free((char *) hp);
+#endif
     exit(0);
 }

--- a/tli.c
+++ b/tli.c
@@ -65,8 +65,13 @@ static void tli_sink();
 void    tli_host(request)
 struct request_info *request;
 {
+#ifdef INET6
+    static struct sockaddr_storage client;
+    static struct sockaddr_storage server;
+#else
     static struct sockaddr_in client;
     static struct sockaddr_in server;
+#endif

     /*
      * If we discover that we are using an IP transport, pretend we never
@@ -76,14 +81,29 @@ struct request_info *request;

     tli_endpoints(request);
     if ((request->config = tli_transport(request->fd)) != 0
+#ifdef INET6
+	&& (STR_EQ(request->config->nc_protofmly, "inet") ||
+	    STR_EQ(request->config->nc_protofmly, "inet6"))) {
+#else
 	&& STR_EQ(request->config->nc_protofmly, "inet")) {
+#endif
 	if (request->client->unit != 0) {
+#ifdef INET6
+	    client = *(struct sockaddr_storage *) request->client->unit->addr.buf;
+	    request->client->sin = (struct sockaddr *) &client;
+#else
 	    client = *(struct sockaddr_in *) request->client->unit->addr.buf;
 	    request->client->sin = &client;
+#endif
 	}
 	if (request->server->unit != 0) {
+#ifdef INET6
+	    server = *(struct sockaddr_storage *) request->server->unit->addr.buf;
+	    request->server->sin = (struct sockaddr *) &server;
+#else
 	    server = *(struct sockaddr_in *) request->server->unit->addr.buf;
 	    request->server->sin = &server;
+#endif
 	}
 	tli_cleanup(request);
 	sock_methods(request);
@@ -187,7 +207,15 @@ int     fd;
     }
     while (config = getnetconfig(handlep)) {
 	if (stat(config->nc_device, &from_config) == 0) {
+#ifdef NO_CLONE_DEVICE
+	/*
+	 * If the network devices are not cloned (as is the case for
+	 * Solaris 8 Beta), we must compare the major device numbers.
+	 */
+	    if (major(from_config.st_rdev) == major(from_client.st_rdev))
+#else
 	    if (minor(from_config.st_rdev) == major(from_client.st_rdev))
+#endif
 		break;
 	}
     }
--- a/update.c
+++ b/update.c
@@ -46,10 +46,18 @@ va_list ap;
 	    request->fd = va_arg(ap, int);
 	    continue;
 	case RQ_CLIENT_SIN:
+#ifdef INET6
+	    request->client->sin = va_arg(ap, struct sockaddr *);
+#else
 	    request->client->sin = va_arg(ap, struct sockaddr_in *);
+#endif
 	    continue;
 	case RQ_SERVER_SIN:
+#ifdef INET6
+	    request->server->sin = va_arg(ap, struct sockaddr *);
+#else
 	    request->server->sin = va_arg(ap, struct sockaddr_in *);
+#endif
 	    continue;

 	    /*
--- a/workarounds.c
+++ b/workarounds.c
@@ -166,11 +166,22 @@ struct sockaddr *sa;
 int    *len;
 {
     int     ret;
+#ifdef INET6
+    struct sockaddr *sin = sa;
+#else
     struct sockaddr_in *sin = (struct sockaddr_in *) sa;
+#endif

     if ((ret = getpeername(sock, sa, len)) >= 0
+#ifdef INET6
+	&& ((sin->su_si.si_family == AF_INET6
+	     && IN6_IS_ADDR_UNSPECIFIED(&sin->su_sin6.sin6_addr))
+	    || (sin->su_si.si_family == AF_INET
+		&& sin->su_sin.sin_addr.s_addr == 0))) {
+#else
 	&& sa->sa_family == AF_INET
 	&& sin->sin_addr.s_addr == 0) {
+#endif
 	errno = ENOTCONN;
 	return (-1);
     } else {


code:
Path: news.porcupine.org!news.porcupine.org!not-for-mail
From: Wietse Venema <wietse@((no)(spam)(please))wzv.win.tue.nl>
Newsgroups: comp.mail.sendmail,comp.security.unix
Subject: TCP Wrapper Blacklist Extension
Followup-To: poster
Date: 8 Sep 1997 18:53:13 -0400
Organization: Wietse's hangout while on sabattical in the USA
Lines: 147
Sender: wietse@spike.porcupine.org
Message-ID: <5v1vkp$h4f$1@spike.porcupine.org>
NNTP-Posting-Host: spike.porcupine.org
Xref: news.porcupine.org comp.mail.sendmail:3541 comp.security.unix:7158

The patch below adds a new host pattern to the TCP Wrapper access
control language. Instead of a host name or address pattern, you
can specify an external /file/name with host name or address
patterns.   The feature can be used recursively.

The /file/name extension makes it easy to blacklist bad sites, for
example, to block unwanted electronic mail when libwrap is linked
into sendmail.  Adding hosts to a simple text file is much easier
than having to edit a more complex hosts.allow/deny file.

I developed this a year or so ago as a substitute for NIS netgroups.
At that time, I did not consider it of sufficient interest for
inclusion in the TCP Wrapper distribution. How times have changed.

The patch is relative to TCP Wrappers version 7.6. The main archive
site is ftp://ftp.win.tue.nl/pub/security/tcp_wrappers_7.6.tar.gz

Thanks to the Debian LINUX folks for expressing their interest in
this patch.

	Wietse

[diff updated by Md]

diff -ruN tcp_wrappers_7.6.orig/hosts_access.5 tcp_wrappers_7.6/hosts_access.5
--- tcp_wrappers_7.6.orig/hosts_access.5	2004-04-10 19:28:09.000000000 +0200
+++ tcp_wrappers_7.6/hosts_access.5	2004-04-10 19:28:01.000000000 +0200
@@ -97,6 +97,13 @@
 `[3ffe:505:2:1::]/64\' matches every address in the range
 `3ffe:505:2:1::\' through `3ffe:505:2:1:ffff:ffff:ffff:ffff\'.
 .IP \(bu
+A string that begins with a `/\' character is treated as a file
+name. A host name or address is matched if it matches any host name
+or address pattern listed in the named file. The file format is
+zero or more lines with zero or more host name or address patterns
+separated by whitespace.  A file name pattern can be used anywhere
+a host name or address pattern can be used.
+.IP \(bu
 Wildcards `*\' and `?\' can be used to match hostnames or IP addresses.  This
 method of matching cannot be used in conjunction with `net/mask\' matching,
 hostname matching beginning with `.\' or IP address matching ending with `.\'.
diff -ruN tcp_wrappers_7.6.orig/hosts_access.c tcp_wrappers_7.6/hosts_access.c
--- tcp_wrappers_7.6.orig/hosts_access.c	2004-04-10 19:28:09.000000000 +0200
+++ tcp_wrappers_7.6/hosts_access.c	2004-04-10 19:27:05.000000000 +0200
@@ -253,6 +253,26 @@
     }
 }

+/* hostfile_match - look up host patterns from file */
+
+static int hostfile_match(path, host)
+char   *path;
+struct hosts_info *host;
+{
+    char    tok[BUFSIZ];
+    int     match = NO;
+    FILE   *fp;
+
+    if ((fp = fopen(path, "r")) != 0) {
+	while (fscanf(fp, "%s", tok) == 1 && !(match = host_match(tok, host)))
+	     /* void */ ;
+	fclose(fp);
+    } else if (errno != ENOENT) {
+	tcpd_warn("open %s: %m", path);
+    }
+    return (match);
+}
+
 /* host_match - match host name and/or address against pattern */

 static int host_match(tok, host)
@@ -280,6 +300,8 @@
 	tcpd_warn("netgroup support is disabled");	/* not tcpd_jump() */
 	return (NO);
 #endif
+    } else if (tok[0] == '/') {			/* /file hack */
+	return (hostfile_match(tok, host));
     } else if (STR_EQ(tok, "KNOWN")) {		/* check address and name */
 	char   *name = eval_hostname(host);
 	return (STR_NE(eval_hostaddr(host), unknown) && HOSTNAME_KNOWN(name));
diff -ruN tcp_wrappers_7.6.orig/tcpdchk.c tcp_wrappers_7.6/tcpdchk.c
--- tcp_wrappers_7.6.orig/tcpdchk.c	2004-04-10 19:28:09.000000000 +0200
+++ tcp_wrappers_7.6/tcpdchk.c	2004-04-10 19:27:05.000000000 +0200
@@ -353,6 +353,8 @@
 {
     if (pat[0] == '@') {
 	tcpd_warn("%s: daemon name begins with \"@\"", pat);
+    } else if (pat[0] == '/') {
+	tcpd_warn("%s: daemon name begins with \"/\"", pat);
     } else if (pat[0] == '.') {
 	tcpd_warn("%s: daemon name begins with dot", pat);
     } else if (pat[strlen(pat) - 1] == '.') {
@@ -385,6 +387,8 @@
 {
     if (pat[0] == '@') {			/* @netgroup */
 	tcpd_warn("%s: user name begins with \"@\"", pat);
+    } else if (pat[0] == '/') {
+	tcpd_warn("%s: user name begins with \"/\"", pat);
     } else if (pat[0] == '.') {
 	tcpd_warn("%s: user name begins with dot", pat);
     } else if (pat[strlen(pat) - 1] == '.') {
@@ -430,8 +434,13 @@
 static int check_host(pat)
 char   *pat;
 {
+    char    buf[BUFSIZ];
     char   *mask;
     int     addr_count = 1;
+    FILE   *fp;
+    struct tcpd_context saved_context;
+    char   *cp;
+    char   *wsp = " \t\r\n";

     if (pat[0] == '@') {			/* @netgroup */
 #ifdef NO_NETGRENT
@@ -450,6 +459,21 @@
 	tcpd_warn("netgroup support disabled");
 #endif
 #endif
+    } else if (pat[0] == '/') {			/* /path/name */
+	if ((fp = fopen(pat, "r")) != 0) {
+	    saved_context = tcpd_context;
+	    tcpd_context.file = pat;
+	    tcpd_context.line = 0;
+	    while (fgets(buf, sizeof(buf), fp)) {
+		tcpd_context.line++;
+		for (cp = strtok(buf, wsp); cp; cp = strtok((char *) 0, wsp))
+		    check_host(cp);
+	    }
+	    tcpd_context = saved_context;
+	    fclose(fp);
+	} else if (errno != ENOENT) {
+	    tcpd_warn("open %s: %m", pat);
+	}
     } else if (mask = split_at(pat, '/')) {	/* network/netmask */
 #ifdef INET6
 	int mask_len;

repo_name: dustdfg/dragora

license: mit


code:
diff -uN tcp_wrappers_7.6/hosts_access.c tcp_wrappers_7.6.new/hosts_access.c
--- tcp_wrappers_7.6/hosts_access.c	Mon May 20 14:00:56 2002
+++ tcp_wrappers_7.6.new/hosts_access.c	Mon May 20 14:25:05 2002
@@ -448,6 +448,15 @@
     int len, mask_len, i = 0;
     char ch;

+    /*
+     * Behavior of getaddrinfo() against IPv4-mapped IPv6 address is
+     * different between KAME and Solaris8.  While KAME returns
+     * AF_INET6, Solaris8 returns AF_INET.  So, we avoid this here.
+     */
+    if (STRN_EQ(string, "::ffff:", 7)
+	&& dot_quad_addr(string + 7) != INADDR_NONE)
+	return (masked_match4(net_tok, mask_tok, string + 7));
+
     memset(&hints, 0, sizeof(hints));
     hints.ai_family = AF_INET6;
     hints.ai_socktype = SOCK_STREAM;
@@ -457,13 +466,6 @@
     memcpy(&addr, res->ai_addr, sizeof(addr));
     freeaddrinfo(res);

-    if (IN6_IS_ADDR_V4MAPPED(&addr.sin6_addr)) {
-	if ((*(u_int32_t *)&net.sin6_addr.s6_addr[12] = dot_quad_addr(net_tok)) == INADDR_NONE
-	 || (mask = dot_quad_addr(mask_tok)) == INADDR_NONE)
-	    return (NO);
-	return ((*(u_int32_t *)&addr.sin6_addr.s6_addr[12] & mask) == *(u_int32_t *)&net.sin6_addr.s6_addr[12]);
-    }
-
     /* match IPv6 address against netnumber/prefixlen */
     len = strlen(net_tok);
     if (*net_tok != '[' || net_tok[len - 1] != ']')
diff -uN tcp_wrappers_7.6/socket.c tcp_wrappers_7.6.new/socket.c
--- tcp_wrappers_7.6/socket.c	Mon May 20 13:48:35 2002
+++ tcp_wrappers_7.6.new/socket.c	Mon May 20 14:22:27 2002
@@ -228,7 +228,7 @@
 	hints.ai_family = sin->sa_family;
 	hints.ai_socktype = SOCK_STREAM;
 	hints.ai_flags = AI_PASSIVE | AI_CANONNAME | AI_NUMERICHOST;
-	if ((err = getaddrinfo(host->name, NULL, &hints, &res0) == 0)) {
+	if ((err = getaddrinfo(host->name, NULL, &hints, &res0)) == 0) {
 	    freeaddrinfo(res0);
 	    res0 = NULL;
 	    tcpd_warn("host name/name mismatch: "


code:
--- a/Makefile
+++ b/Makefile
@@ -45,7 +45,7 @@ what:
 #
 # SysV.4 Solaris 2.x OSF AIX
 #REAL_DAEMON_DIR=/usr/sbin
-#
+REAL_DAEMON_DIR=/usr/sbin
 # BSD 4.4
 #REAL_DAEMON_DIR=/usr/libexec
 #
@@ -513,6 +513,7 @@ VSYSLOG	= -Dvsyslog=myvsyslog
 # (examples: allow, deny, banners, twist and spawn).
 #
 #STYLE	= -DPROCESS_OPTIONS	# Enable language extensions.
+STYLE = "-DPROCESS_OPTIONS -DACLEXEC"

 ################################################################
 # Optional: Changing the default disposition of logfile records
@@ -536,6 +537,7 @@ VSYSLOG	= -Dvsyslog=myvsyslog
 # The LOG_XXX names below are taken from the /usr/include/syslog.h file.

 FACILITY= LOG_MAIL	# LOG_MAIL is what most sendmail daemons use
+FACILITY= LOG_DAEMON

 # The syslog priority at which successful connections are logged.

@@ -632,6 +634,7 @@ TABLES	= -DHOSTS_DENY=\"/etc/hosts.deny\
 # lookups altogether, see the next section.

 PARANOID= -DPARANOID
+PARANOID=

 ########################################
 # Optional: turning off hostname lookups
@@ -645,6 +648,7 @@ PARANOID= -DPARANOID
 # mode (see previous section) and comment out the following definition.

 HOSTNAME= -DALWAYS_HOSTNAME
+HOSTNAME=

 #############################################
 # Optional: Turning on host ADDRESS checking
@@ -671,6 +675,7 @@ HOSTNAME= -DALWAYS_HOSTNAME
 # Solaris 2.x, and Linux. See your system documentation for details.
 #
 # KILL_OPT= -DKILL_IP_OPTIONS
+KILL_OPT= -DKILL_IP_OPTIONS

 ## End configuration options
 ############################
@@ -678,9 +683,10 @@ HOSTNAME= -DALWAYS_HOSTNAME
 # Protection against weird shells or weird make programs.

 SHELL	= /bin/sh
-.c.o:;	$(CC) $(CFLAGS) -c $*.c
+.c.o:;	$(CC) $(CFLAGS) -o $*.o -c $*.c

-CFLAGS	= -O -DFACILITY=$(FACILITY) $(ACCESS) $(PARANOID) $(NETGROUP) \
+COPTS	= -O2 -g
+CFLAGS	= $(COPTS) -DFACILITY=$(FACILITY) $(ACCESS) $(PARANOID) $(NETGROUP) \
 	$(BUGS) $(SYSTYPE) $(AUTH) $(UMASK) \
 	-DREAL_DAEMON_DIR=\"$(REAL_DAEMON_DIR)\" $(STYLE) $(KILL_OPT) \
 	-DSEVERITY=$(SEVERITY) -DRFC931_TIMEOUT=$(RFC931_TIMEOUT) \
@@ -713,11 +719,12 @@ all other: config-check tcpd tcpdmatch t

 config-check:
 	@set +e; test -n "$(REAL_DAEMON_DIR)" || { make; exit 1; }
-	@set +e; echo $(CFLAGS) >/tmp/cflags.$$$$ ; \
-	if cmp cflags /tmp/cflags.$$$$ ; \
-	then rm /tmp/cflags.$$$$ ; \
-	else mv /tmp/cflags.$$$$ cflags ; \
+	@set +e; echo $(CFLAGS) >cflags.new ; \
+	if cmp cflags cflags.new ; \
+	then rm cflags.new ; \
+	else mv cflags.new cflags ; \
 	fi >/dev/null 2>/dev/null
+	@if [ ! -d shared ]; then mkdir shared; fi

 $(LIB):	$(LIB_OBJ)
 	rm -f $(LIB)


code:
--- a/Makefile
+++ b/Makefile
@@ -150,15 +150,15 @@ netbsd:

 linux:
 	@make REAL_DAEMON_DIR=$(REAL_DAEMON_DIR) STYLE=$(STYLE) \
-	LIBS=-lnsl RANLIB=ranlib ARFLAGS=rv AUX_OBJ= \
+	LIBS=-lnsl RANLIB=ranlib ARFLAGS=rv AUX_OBJ=weak_symbols.o \
 	NETGROUP="-DNETGROUP" TLI= VSYSLOG= BUGS= \
-	EXTRA_CFLAGS="-DSYS_ERRLIST_DEFINED -DHAVE_STRERROR -DINET6=1 -Dss_family=__ss_family -Dss_len=__ss_len" all
+	EXTRA_CFLAGS="-DSYS_ERRLIST_DEFINED -DHAVE_STRERROR -DHAVE_WEAKSYMS -DINET6=1 -Dss_family=__ss_family -Dss_len=__ss_len" all

 gnu:
 	@make REAL_DAEMON_DIR=$(REAL_DAEMON_DIR) STYLE=$(STYLE) \
-	LIBS=-lnsl RANLIB=ranlib ARFLAGS=rv AUX_OBJ= \
+	LIBS=-lnsl RANLIB=ranlib ARFLAGS=rv AUX_OBJ=weak_symbols.o \
 	NETGROUP=-DNETGROUP TLI= VSYSLOG= BUGS= \
-	EXTRA_CFLAGS="-DSYS_ERRLIST_DEFINED -DHAVE_STRERROR -DINET6=1" all
+	EXTRA_CFLAGS="-DSYS_ERRLIST_DEFINED -DHAVE_STRERROR -DINET6=1 -DHAVE_WEAKSYMS -D_REENTRANT" all

 # This is good for many SYSV+BSD hybrids with NIS, probably also for HP-UX 7.x.
 hpux hpux8 hpux9 hpux10:
@@ -692,6 +692,7 @@ CFLAGS	= $(COPTS) -DFACILITY=$(FACILITY)
 	-DSEVERITY=$(SEVERITY) -DRFC931_TIMEOUT=$(RFC931_TIMEOUT) \
 	$(UCHAR) $(TABLES) $(STRINGS) $(TLI) $(EXTRA_CFLAGS) $(DOT) \
 	$(VSYSLOG) $(HOSTNAME)
+LDFLAGS = $(LDOPTS)

 LIB_OBJ= hosts_access.o options.o shell_cmd.o rfc931.o eval.o \
 	hosts_ctl.o refuse.o percent_x.o clean_exit.o $(AUX_OBJ) \
@@ -713,7 +714,22 @@ KIT	= README miscd.c tcpd.c fromhost.c h

 LIB	= libwrap.a

-all other: config-check tcpd tcpdmatch try-from safe_finger tcpdchk
+shared/%.o: %.c
+	$(CC) $(CFLAGS) $(SHCFLAGS) -c $< -o $@
+
+SOMAJOR = 0
+SOMINOR = 7.6
+
+SHLIB		= shared/libwrap.so.$(SOMAJOR).$(SOMINOR)
+SHLIBSOMAJ	= shared/libwrap.so.$(SOMAJOR)
+SHLIBSO		= shared/libwrap.so
+SHLIBFLAGS	= -Lshared -lwrap
+
+SHLINKFLAGS = -Bsymbolic-functions -shared -Wl,-soname=libwrap.so.$(SOMAJOR) -Wl,--version-script=libwrap.lds
+SHCFLAGS = -fpic
+SHLIB_OBJ= $(addprefix shared/, $(LIB_OBJ))
+
+all other: config-check tcpd tcpdmatch try-from safe_finger tcpdchk $(LIB)

 # Invalidate all object files when the compiler options (CFLAGS) have changed.

@@ -731,27 +747,33 @@ $(LIB):	$(LIB_OBJ)
 	$(AR) $(ARFLAGS) $(LIB) $(LIB_OBJ)
 	-$(RANLIB) $(LIB)

-tcpd:	tcpd.o $(LIB)
-	$(CC) $(CFLAGS) -o $@ tcpd.o $(LIB) $(LIBS)
+$(SHLIB): libwrap.lds $(SHLIB_OBJ)
+	rm -f $(SHLIB)
+	$(CC) $(CFLAGS) $(LDFLAGS) -o $(SHLIB) $(SHLINKFLAGS) $(SHLIB_OBJ) $(LIBS)
+	ln -sf $(notdir $(SHLIB)) $(SHLIBSOMAJ)
+	ln -sf $(notdir $(SHLIBSOMAJ)) $(SHLIBSO)
+
+tcpd:	tcpd.o $(SHLIB)
+	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ tcpd.o $(SHLIBFLAGS)

 miscd:	miscd.o $(LIB)
-	$(CC) $(CFLAGS) -o $@ miscd.o $(LIB) $(LIBS)
+	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ miscd.o $(LIB) $(LIBS)

-safe_finger: safe_finger.o $(LIB)
-	$(CC) $(CFLAGS) -o $@ safe_finger.o $(LIB) $(LIBS)
+safe_finger: safe_finger.o
+	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ safe_finger.o

 TCPDMATCH_OBJ = tcpdmatch.o fakelog.o inetcf.o scaffold.o

-tcpdmatch: $(TCPDMATCH_OBJ) $(LIB)
-	$(CC) $(CFLAGS) -o $@ $(TCPDMATCH_OBJ) $(LIB) $(LIBS)
+tcpdmatch: $(TCPDMATCH_OBJ) $(SHLIB)
+	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(TCPDMATCH_OBJ) $(SHLIBFLAGS)

-try-from: try-from.o fakelog.o $(LIB)
-	$(CC) $(CFLAGS) -o $@ try-from.o fakelog.o $(LIB) $(LIBS)
+try-from: try-from.o fakelog.o $(SHLIB)
+	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ try-from.o fakelog.o $(SHLIBFLAGS)

 TCPDCHK_OBJ = tcpdchk.o fakelog.o inetcf.o scaffold.o

-tcpdchk: $(TCPDCHK_OBJ) $(LIB)
-	$(CC) $(CFLAGS) -o $@ $(TCPDCHK_OBJ) $(LIB) $(LIBS)
+tcpdchk: $(TCPDCHK_OBJ) $(SHLIB)
+	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(TCPDCHK_OBJ) $(SHLIBFLAGS)

 shar:	$(KIT)
 	@shar $(KIT)
@@ -767,7 +789,9 @@ archive:

 clean:
 	rm -f tcpd miscd safe_finger tcpdmatch tcpdchk try-from *.[oa] core \
+	libwrap*.so* \
 	cflags
+	rm -rf shared/

 tidy:	clean
 	chmod -R a+r .
@@ -913,5 +937,6 @@ update.o: cflags
 update.o: mystdarg.h
 update.o: tcpd.h
 vfprintf.o: cflags
+weak_symbols.o: tcpd.h
 workarounds.o: cflags
 workarounds.o: tcpd.h
--- a/tcpd.h
+++ b/tcpd.h
@@ -4,6 +4,15 @@
   * Author: Wietse Venema, Eindhoven University of Technology, The Netherlands.
   */

+#ifndef _TCPWRAPPERS_TCPD_H
+#define _TCPWRAPPERS_TCPD_H
+
+/* Need definitions of struct sockaddr_in and FILE. */
+#include <netinet/in.h>
+#include <stdio.h>
+
+__BEGIN_DECLS
+
 /* Structure to describe one communications endpoint. */

 #define STRING_LENGTH	128		/* hosts, users, processes */
@@ -29,10 +38,10 @@ struct request_info {
     char    pid[10];			/* access via eval_pid(request) */
     struct host_info client[1];		/* client endpoint info */
     struct host_info server[1];		/* server endpoint info */
-    void  (*sink) ();			/* datagram sink function or 0 */
-    void  (*hostname) ();		/* address to printable hostname */
-    void  (*hostaddr) ();		/* address to printable address */
-    void  (*cleanup) ();		/* cleanup function or 0 */
+    void  (*sink) (int);		/* datagram sink function or 0 */
+    void  (*hostname) (struct host_info *); /* address to printable hostname */
+    void  (*hostaddr) (struct host_info *); /* address to printable address */
+    void  (*cleanup) (struct request_info *); /* cleanup function or 0 */
     struct netconfig *config;		/* netdir handle */
 };

@@ -70,20 +79,27 @@ extern void fromhost();			/* get/validat
 #define fromhost sock_host		/* no TLI support needed */
 #endif

-extern int hosts_access();		/* access control */
-extern void shell_cmd();		/* execute shell command */
-extern char *percent_x();		/* do %<char> expansion */
-extern void rfc931();			/* client name from RFC 931 daemon */
-extern void clean_exit();		/* clean up and exit */
-extern void refuse();			/* clean up and exit */
-extern char *xgets();			/* fgets() on steroids */
-extern char *split_at();		/* strchr() and split */
-extern unsigned long dot_quad_addr();	/* restricted inet_addr() */
+extern int hosts_access(struct request_info *request);	/* access control */
+extern void shell_cmd(char *);		/* execute shell command */
+extern char *percent_x(char *, int, char *, struct request_info *);
+					/* do %<char> expansion */
+extern void rfc931(struct sockaddr *, struct sockaddr *, char *);
+					/* client name from RFC 931 daemon */
+extern void clean_exit(struct request_info *);	/* clean up and exit */
+extern void refuse(struct request_info *);	/* clean up and exit */
+extern char *xgets(char *, int, FILE *);	/* fgets() on steroids */
+extern char *split_at(char *, int);		/* strchr() and split */
+extern unsigned long dot_quad_addr(char *);	/* restricted inet_addr() */

 /* Global variables. */

+#ifdef HAVE_WEAKSYMS
+extern int allow_severity __attribute__ ((weak)); /* for connection logging */
+extern int deny_severity __attribute__ ((weak)); /* for connection logging */
+#else
 extern int allow_severity;		/* for connection logging */
 extern int deny_severity;		/* for connection logging */
+#endif
 extern char *hosts_allow_table;		/* for verification mode redirection */
 extern char *hosts_deny_table;		/* for verification mode redirection */
 extern int hosts_access_verbose;	/* for verbose matching mode */
@@ -98,6 +114,8 @@ extern int resident;			/* > 0 if residen
 #ifdef __STDC__
 extern struct request_info *request_init(struct request_info *,...);
 extern struct request_info *request_set(struct request_info *,...);
+extern int hosts_ctl(char *daemon, char *client_name, char *client_addr,
+		char *client_user);
 #else
 extern struct request_info *request_init();	/* initialize request */
 extern struct request_info *request_set();	/* update request structure */
@@ -121,20 +139,23 @@ extern struct request_info *request_set(
   * host_info structures serve as caches for the lookup results.
   */

-extern char *eval_user();		/* client user */
-extern char *eval_hostname();		/* printable hostname */
-extern char *eval_hostaddr();		/* printable host address */
-extern char *eval_hostinfo();		/* host name or address */
-extern char *eval_client();		/* whatever is available */
-extern char *eval_server();		/* whatever is available */
+extern char *eval_user(struct request_info *);	/* client user */
+extern char *eval_hostname(struct host_info *);	/* printable hostname */
+extern char *eval_hostaddr(struct host_info *);	/* printable host address */
+extern char *eval_hostinfo(struct host_info *);	/* host name or address */
+extern char *eval_client(struct request_info *);/* whatever is available */
+extern char *eval_server(struct request_info *);/* whatever is available */
 #define eval_daemon(r)	((r)->daemon)	/* daemon process name */
 #define eval_pid(r)	((r)->pid)	/* process id */

 /* Socket-specific methods, including DNS hostname lookups. */

-extern void sock_host();		/* look up endpoint addresses */
-extern void sock_hostname();		/* translate address to hostname */
-extern void sock_hostaddr();		/* address to printable address */
+/* look up endpoint addresses */
+extern void sock_host(struct request_info *);
+/* translate address to hostname */
+extern void sock_hostname(struct host_info *);
+/* address to printable address */
+extern void sock_hostaddr(struct host_info *);
 #define sock_methods(r) \
 	{ (r)->hostname = sock_hostname; (r)->hostaddr = sock_hostaddr; }

@@ -182,7 +203,7 @@ extern struct tcpd_context tcpd_context;
   * behavior.
   */

-extern void process_options();		/* execute options */
+extern void process_options(char *, struct request_info *);/* execute options */
 extern int dry_run;			/* verification flag */

 /* Bug workarounds. */
@@ -221,3 +242,7 @@ extern char *fix_strtok();
 #define strtok	my_strtok
 extern char *my_strtok();
 #endif
+
+__END_DECLS
+
+#endif
--- /dev/null
+++ b/weak_symbols.c
@@ -0,0 +1,10 @@
+ /*
+  * Author: Anthony Towns <ajt@debian.org>
+  */
+
+#ifdef HAVE_WEAKSYMS
+#include "tcpd.h"
+#include <syslog.h>
+int deny_severity = LOG_WARNING;
+int allow_severity = SEVERITY;
+#endif
--- /dev/null
+++ b/libwrap.lds
@@ -0,0 +1,4 @@
+{
+  local:
+	aclexec_matched;
+};


code:
diff -ruN tcp_wrappers_7.6.orig/hosts_access.5 tcp_wrappers_7.6/hosts_access.5
--- tcp_wrappers_7.6.orig/hosts_access.5	2003-08-21 03:15:36.000000000 +0200
+++ tcp_wrappers_7.6/hosts_access.5	2003-08-21 03:15:31.000000000 +0200
@@ -90,6 +90,10 @@
 pattern `131.155.72.0/255.255.254.0\' matches every address in the
 range `131.155.72.0\' through `131.155.73.255\'.
 .IP \(bu
+An expression of the form `n.n.n.n/mm' is interpreted as a
+`net/masklength' pair, where `mm' is the number of consecutive `1'
+bits in the netmask applied to the `n.n.n.n' address.
+.IP \(bu
 An expression of the form `[n:n:n:n:n:n:n:n]/m\' is interpreted as a
 `[net]/prefixlen\' pair. An IPv6 host address is matched if
 `prefixlen\' bits of `net\' is equal to the `prefixlen\' bits of the
diff -ruN tcp_wrappers_7.6.orig/hosts_access.c tcp_wrappers_7.6/hosts_access.c
--- tcp_wrappers_7.6.orig/hosts_access.c	2003-08-21 03:15:36.000000000 +0200
+++ tcp_wrappers_7.6/hosts_access.c	2003-08-21 03:09:30.000000000 +0200
@@ -417,7 +417,8 @@
     if ((addr = dot_quad_addr(string)) == INADDR_NONE)
 	return (NO);
     if ((net = dot_quad_addr(net_tok)) == INADDR_NONE
-	|| (mask = dot_quad_addr(mask_tok)) == INADDR_NONE) {
+	|| ((mask = dot_quad_addr(mask_tok)) == INADDR_NONE
+	    && (mask = cidr_mask_addr(mask_tok)) == 0)) {
 #ifndef INET6
 	tcpd_warn("bad net/mask expression: %s/%s", net_tok, mask_tok);
 #endif
diff -ruN tcp_wrappers_7.6.orig/misc.c tcp_wrappers_7.6/misc.c
--- tcp_wrappers_7.6.orig/misc.c	2003-08-21 03:15:36.000000000 +0200
+++ tcp_wrappers_7.6/misc.c	2003-08-21 03:09:30.000000000 +0200
@@ -107,3 +107,17 @@
     }
     return (runs == 4 ? inet_addr(str) : INADDR_NONE);
 }
+
+/* cidr_mask_addr - convert cidr netmask length to internal form */
+
+unsigned long cidr_mask_addr(str)
+char   *str;
+{
+    int     maskbits;
+
+    maskbits = atoi(str);
+    if (maskbits < 1 || maskbits > 32)
+	return (0);
+    return htonl(0xFFFFFFFF << (32 - maskbits));
+}
+
diff -ruN tcp_wrappers_7.6.orig/tcpdchk.c tcp_wrappers_7.6/tcpdchk.c
--- tcp_wrappers_7.6.orig/tcpdchk.c	2003-08-21 03:15:36.000000000 +0200
+++ tcp_wrappers_7.6/tcpdchk.c	2003-08-21 03:09:30.000000000 +0200
@@ -497,12 +497,12 @@
 	int mask_len;

 	if ((dot_quad_addr(pat) == INADDR_NONE
-	    || dot_quad_addr(mask) == INADDR_NONE)
+	    || dot_quad_addr(mask) == INADDR_NONE && cidr_mask_addr(mask) == 0)
 	    && (!is_inet6_addr(pat)
 		|| ((mask_len = atoi(mask)) < 0 || mask_len > 128)))
 #else
 	if (dot_quad_addr(pat) == INADDR_NONE
-	    || dot_quad_addr(mask) == INADDR_NONE)
+	    || dot_quad_addr(mask) == INADDR_NONE && cidr_mask_addr(mask) == 0)
 #endif
 	    tcpd_warn("%s/%s: bad net/mask pattern", pat, mask);
     } else if (STR_EQ(pat, "FAIL")) {		/* obsolete */


code:
diff -ruN tcp_wrappers_7.6.orig/hosts_access.5 tcp_wrappers_7.6/hosts_access.5
--- tcp_wrappers_7.6.orig/hosts_access.5	2004-04-25 12:17:59.000000000 +0200
+++ tcp_wrappers_7.6/hosts_access.5	2004-04-25 12:17:53.000000000 +0200
@@ -89,6 +89,8 @@
 bitwise AND of the address and the `mask\'. For example, the net/mask
 pattern `131.155.72.0/255.255.254.0\' matches every address in the
 range `131.155.72.0\' through `131.155.73.255\'.
+`255.255.255.255\' is not a valid mask value, so a single host can be
+matched just by its IP.
 .IP \(bu
 An expression of the form `n.n.n.n/mm' is interpreted as a
 `net/masklength' pair, where `mm' is the number of consecutive `1'


code:
diff -ruNp tcp_wrappers_7.6.orig/hosts_access.c tcp_wrappers_7.6/hosts_access.c
--- tcp_wrappers_7.6.orig/hosts_access.c	2006-03-01 19:25:45.000000000 +0100
+++ tcp_wrappers_7.6/hosts_access.c	2006-03-01 19:23:58.000000000 +0100
@@ -82,6 +82,9 @@ int     hosts_access_verbose = 0;
   */

 int     resident = (-1);		/* -1, 0: unknown; +1: yes */
+#ifdef ACLEXEC
+int	aclexec_matched = 0;
+#endif

 /* Forward declarations. */

@@ -185,6 +188,12 @@ struct request_info *request;
 	if (sh_cmd) {
 #ifdef PROCESS_OPTIONS
 	    process_options(sh_cmd, request);
+# ifdef ACLEXEC
+	    if (aclexec_matched) {
+		syslog(LOG_INFO, "aclexec returned %d", aclexec_matched);
+		match = NO;
+	    }
+# endif
 #else
 	    char    cmd[BUFSIZ];
 	    shell_cmd(percent_x(cmd, sizeof(cmd), sh_cmd, request));
diff -ruNp tcp_wrappers_7.6.orig/options.c tcp_wrappers_7.6/options.c
--- tcp_wrappers_7.6.orig/options.c	1996-02-11 17:01:32.000000000 +0100
+++ tcp_wrappers_7.6/options.c	2006-03-01 19:24:25.000000000 +0100
@@ -47,6 +47,7 @@ static char sccsid[] = "@(#) options.c 1
 #include <ctype.h>
 #include <setjmp.h>
 #include <string.h>
+#include <sys/wait.h>

 #ifndef MAXPATHNAMELEN
 #define MAXPATHNAMELEN  BUFSIZ
@@ -76,6 +77,7 @@ static void group_option();		/* execute
 static void umask_option();		/* execute "umask mask" option */
 static void linger_option();		/* execute "linger time" option */
 static void keepalive_option();		/* execute "keepalive" option */
+static void aclexec_option();		/* execute "aclexec command" option */
 static void spawn_option();		/* execute "spawn command" option */
 static void twist_option();		/* execute "twist command" option */
 static void rfc931_option();		/* execute "rfc931" option */
@@ -113,6 +115,9 @@ static struct option option_table[] = {
     "umask", umask_option, NEED_ARG,
     "linger", linger_option, NEED_ARG,
     "keepalive", keepalive_option, 0,
+#ifdef ACLEXEC
+    "aclexec", aclexec_option, NEED_ARG | EXPAND_ARG,
+#endif
     "spawn", spawn_option, NEED_ARG | EXPAND_ARG,
     "twist", twist_option, NEED_ARG | EXPAND_ARG | USE_LAST,
     "rfc931", rfc931_option, OPT_ARG,
@@ -310,6 +315,54 @@ struct request_info *request;
 	shell_cmd(value);
 }

+#ifdef ACLEXEC
+/* aclexec_option - spawn a shell command and check status */
+
+/* ARGSUSED */
+
+static void aclexec_option(value, request)
+char   *value;
+struct request_info *request;
+{
+    int status, child_pid, wait_pid;
+    extern int aclexec_matched;
+
+    if (dry_run != 0)
+	    return;
+
+    child_pid = fork();
+
+    /* Something went wrong: we MUST terminate the process. */
+    if (child_pid < 0) {
+	tcpd_warn("aclexec_option: /bin/sh: %m");
+	clean_exit(request);
+    }
+
+    if (child_pid == 0) {
+	execl("/bin/sh", "sh", "-c", value, (char *) 0);
+
+        /* Something went wrong. We MUST terminate the child process. */
+        tcpd_warn("execl /bin/sh: %m");
+	_exit(0);
+    }
+
+    while ((wait_pid = wait(&status)) != -1 && wait_pid != child_pid)
+	/* void */ ;
+
+    aclexec_matched = 1;
+
+    if (WIFEXITED(status) && WEXITSTATUS(status) == 0) {
+	aclexec_matched = 0;
+    }
+
+    if (WIFSIGNALED(status))
+	tcpd_warn("process %d exited with signal %d", child_pid,
+	    WTERMSIG(status));
+
+    return;
+}
+#endif
+
 /* linger_option - set the socket linger time (Marc Boucher <marc@cam.org>) */

 /* ARGSUSED */
diff -ruNp tcp_wrappers_7.6.orig/hosts_options.5 tcp_wrappers_7.6/hosts_options.5
--- tcp_wrappers_7.6.orig/hosts_options.5	2006-03-01 21:48:43.000000000 +0100
+++ tcp_wrappers_7.6/hosts_options.5	2006-03-01 21:47:39.000000000 +0100
@@ -52,6 +52,23 @@ ALL: ALL: ALLOW
 .sp
 Notice the leading dot on the domain name patterns.
 .SH RUNNING OTHER COMMANDS
+.IP "aclexec shell_command"
+Execute, in a child process, the specified shell command, after
+performing the %<letter> expansions described in the hosts_access(5)
+manual page.  The command is executed with stdin, stdout and stderr
+connected to the null device, so that it won't mess up the
+conversation with the client host. Example:
+.sp
+.nf
+.ti +3
+smtp : ALL : aclexec checkdnsbl %a
+.fi
+.sp
+executes, in a background child process, the shell command "checkdnsbl %a"
+after replacing %a by the address of the remote host.
+.sp
+The connection will be allowed or refused depending on whether the
+command returns a true or false exit status.
 .IP "spawn shell_command"
 Execute, in a child process, the specified shell command, after
 performing the %<letter> expansions described in the hosts_access(5)


code:
--- tcp_wrappers_7.6/shell_cmd.c.sigchld	1994-12-28 17:42:44.000000000 +0100
+++ tcp_wrappers_7.6/shell_cmd.c	2007-06-28 15:42:17.000000000 +0200
@@ -20,6 +20,11 @@
 #include <stdio.h>
 #include <syslog.h>
 #include <string.h>
+#include <errno.h>
+#include <unistd.h>
+#include <sys/wait.h>
+#include <sys/stat.h>
+#include <fcntl.h>

 extern void exit();

@@ -31,13 +36,42 @@

 static void do_child();

+/*
+ * The sigchld handler. If there is a SIGCHLD caused by a child other than
+ * ours, we set a flag and raise the signal later.
+ */
+volatile static int foreign_sigchld;
+volatile static int our_child_pid;
+static void sigchld(int sig, siginfo_t *si, void *unused)
+{
+    if (si && si->si_pid != our_child_pid)
+	foreign_sigchld = 1;
+}
+
 /* shell_cmd - execute shell command */

 void    shell_cmd(command)
 char   *command;
 {
     int     child_pid;
-    int     wait_pid;
+
+    struct sigaction new_action, old_action;
+    sigset_t new_mask, old_mask, empty_mask;
+
+    new_action.sa_sigaction = &sigchld;
+    new_action.sa_flags = SA_SIGINFO;
+    sigemptyset(&new_action.sa_mask);
+    sigemptyset(&new_mask);
+    sigemptyset(&empty_mask);
+    sigaddset(&new_mask, SIGCHLD);
+
+    /*
+     * Set the variables for handler, set the handler and block the signal
+     * until we have the pid.
+     */
+    foreign_sigchld = 0; our_child_pid = 0;
+    sigprocmask(SIG_BLOCK, &new_mask, &old_mask);
+    sigaction(SIGCHLD, &new_action, &old_action);

     /*
      * Most of the work is done within the child process, to minimize the
@@ -49,12 +83,26 @@
 	tcpd_warn("cannot fork: %m");
 	break;
     case 00:					/* child */
+	/* Clear the blocked mask for the child not to be surprised. */
+	sigprocmask(SIG_SETMASK, &empty_mask, 0);
 	do_child(command);
 	/* NOTREACHED */
     default:					/* parent */
-	while ((wait_pid = wait((int *) 0)) != -1 && wait_pid != child_pid)
-	     /* void */ ;
+	our_child_pid = child_pid;
+	sigprocmask(SIG_UNBLOCK, &new_mask, 0);
+	while (waitpid(child_pid, (int *) 0, 0) == -1 && errno == EINTR);
     }
+
+    /*
+     * Revert the signal mask and the SIGCHLD handler.
+     */
+    sigprocmask(SIG_SETMASK, &old_mask, 0);
+    sigaction(SIGCHLD, &old_action, 0);
+
+    /* If there was a foreign SIGCHLD, raise it after we have restored the old
+     * mask and handler. */
+    if (foreign_sigchld)
+	raise(SIGCHLD);
 }

 /* do_child - exec command with { stdin, stdout, stderr } to /dev/null */


code:
diff -ruN tcp_wrappers_7.6.orig/eval.c tcp_wrappers_7.6/eval.c
--- tcp_wrappers_7.6.orig/eval.c	1995-01-30 19:51:46.000000000 +0100
+++ tcp_wrappers_7.6/eval.c	2004-11-04 13:59:01.000000000 +0100
@@ -98,6 +98,28 @@
     }
 }

+/* eval_port - return string with the port */
+char   *eval_port(saddr)
+#ifdef INET6
+struct sockaddr *saddr;
+#else
+struct sockaddr_in *saddr;
+#endif
+{
+    static char port[16];
+    if (saddr != 0) {
+        sprintf(port, "%u",
+#ifdef INET6
+            ntohs(((struct sockaddr_in *)saddr)->sin_port));
+#else
+            ntohs(saddr->sin_port));
+#endif
+    } else {
+	strcpy(port, "0");
+    }
+    return (port);
+}
+
 /* eval_client - return string with as much about the client as we know */

 char   *eval_client(request)
diff -ruN tcp_wrappers_7.6.orig/hosts_access.5 tcp_wrappers_7.6/hosts_access.5
--- tcp_wrappers_7.6.orig/hosts_access.5	2004-11-04 13:17:45.000000000 +0100
+++ tcp_wrappers_7.6/hosts_access.5	2004-11-04 13:55:32.000000000 +0100
@@ -175,6 +175,8 @@
 unavailable.
 .IP "%n (%N)"
 The client (server) host name (or "unknown" or "paranoid").
+.IP "%r (%R)"
+The clients (servers) port number (or "0").
 .IP %p
 The daemon process id.
 .IP %s
diff -ruN tcp_wrappers_7.6.orig/percent_x.c tcp_wrappers_7.6/percent_x.c
--- tcp_wrappers_7.6.orig/percent_x.c	1994-12-28 17:42:38.000000000 +0100
+++ tcp_wrappers_7.6/percent_x.c	2004-11-04 13:19:29.000000000 +0100
@@ -63,6 +63,8 @@
 		ch == 'n' ? eval_hostname(request->client) :
 		ch == 'N' ? eval_hostname(request->server) :
 		ch == 'p' ? eval_pid(request) :
+		ch == 'r' ? eval_port(request->client->sin) :
+		ch == 'R' ? eval_port(request->server->sin) :
 		ch == 's' ? eval_server(request) :
 		ch == 'u' ? eval_user(request) :
 		ch == '%' ? "%" : (tcpd_warn("unrecognized %%%c", ch), "");
diff -ruN tcp_wrappers_7.6.orig/tcpd.h tcp_wrappers_7.6/tcpd.h
--- tcp_wrappers_7.6.orig/tcpd.h	2004-11-04 13:17:45.000000000 +0100
+++ tcp_wrappers_7.6/tcpd.h	2004-11-04 13:19:13.000000000 +0100
@@ -145,6 +145,11 @@
 extern char *eval_hostinfo(struct host_info *);	/* host name or address */
 extern char *eval_client(struct request_info *);/* whatever is available */
 extern char *eval_server(struct request_info *);/* whatever is available */
+#ifdef INET6
+extern char *eval_port(struct sockaddr *);
+#else
+extern char *eval_port(struct sockaddr_in *);
+#endif
 #define eval_daemon(r)	((r)->daemon)	/* daemon process name */
 #define eval_pid(r)	((r)->pid)	/* process id */


code:
Description: Fix parsing of lines longer than 2047 characters
 If a line in /etc/hosts.{allow,deny} is longer than BUFLEN-1 (2047)
 characters then len will be set to 1 at the end of the xgets() loop.
 .
 At the next iteration, fgets will be passed a buffer of length 1, so it
 will only be able to read an empty string (the buffer must always have
 space for the trailing NUL).
 .
 strlen(3) on the empty string will return 0, so len will not be modified
 anymore and the last step will repeat forever.
 .
 To reproduce:
 perl -e 'print "#sshd: " . ("127.0.0.1, " x 210) . "\n"' > hosts.deny
 tcpdmatch -d test localhost
Author: Marco d'Itri <md@linux.it>
Bug-Debian: http://bugs.debian.org/596261

--- a/misc.c
+++ b/misc.c
@@ -45,6 +45,8 @@ FILE   *fp;
 	}
 	ptr += got;
 	len -= got;
+	if (len == 1)
+	    return(start);
 	ptr[0] = 0;
     }
     return (ptr > start ? start : 0);
--- a/hosts_access.c
+++ b/hosts_access.c
@@ -165,7 +165,9 @@ struct request_info *request;
 	while (match == NO && xgets(sv_list, sizeof(sv_list), fp) != 0) {
 	    if (sv_list[strlen(sv_list) - 1] != '\n') {
 		tcpd_warn("missing newline or line too long");
-		continue;
+		tcpd_warn("all the subsequent rules will be ignored");
+		match = ERR;
+		break;
 	    }
 	    if (sv_list[0] == '#' || sv_list[strspn(sv_list, " \t\r\n")] == 0)
 		continue;


code:
--- a/workarounds.c
+++ b/workarounds.c
@@ -8,7 +8,7 @@
   */

 #ifndef lint
-char    sccsid[] = "@(#) workarounds.c 1.6 96/03/19 16:22:25";
+static char    sccsid[] = "@(#) workarounds.c 1.6 96/03/19 16:22:25";
 #endif

 #include <sys/types.h>


code:
--- a/fix_options.c
+++ b/fix_options.c
@@ -32,7 +32,7 @@ static char sccsid[] = "@(#) fix_options

 /* fix_options - get rid of IP-level socket options */

-fix_options(request)
+void fix_options(request)
 struct request_info *request;
 {
 #ifdef IP_OPTIONS
@@ -46,7 +46,7 @@ struct request_info *request;
     struct in_addr dummy;
 #ifdef INET6
     struct sockaddr_storage ss;
-    int sslen;
+    socklen_t sslen;

     /*
      * check if this is AF_INET socket
--- a/options.c
+++ b/options.c
@@ -41,6 +41,7 @@ static char sccsid[] = "@(#) options.c 1
 #include <netinet/in.h>
 #include <netdb.h>
 #include <stdio.h>
+#include <unistd.h>
 #include <syslog.h>
 #include <pwd.h>
 #include <grp.h>
--- a/scaffold.c
+++ b/scaffold.c
@@ -17,6 +17,7 @@ static char sccs_id[] = "@(#) scaffold.c
 #include <arpa/inet.h>
 #include <netdb.h>
 #include <stdio.h>
+#include <stdlib.h>
 #include <syslog.h>
 #include <setjmp.h>
 #include <string.h>


code:
--- a/clean_exit.c
+++ b/clean_exit.c
@@ -13,6 +13,7 @@ static char sccsid[] = "@(#) clean_exit.
 #endif

 #include <stdio.h>
+#include <unistd.h>

 extern void exit();

--- a/hosts_access.c
+++ b/hosts_access.c
@@ -34,6 +34,7 @@ static char sccsid[] = "@(#) hosts_acces
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #include <stdio.h>
+#include <stdlib.h>
 #include <syslog.h>
 #include <ctype.h>
 #include <errno.h>
@@ -54,6 +55,9 @@ extern int errno;

 #include "tcpd.h"

+unsigned long cidr_mask_addr(char *str);
+int yp_get_default_domain(char **ptr);
+
 /* Error handling. */

 extern jmp_buf tcpd_buf;
--- a/misc.c
+++ b/misc.c
@@ -13,6 +13,7 @@ static char sccsic[] = "@(#) misc.c 1.2
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #include <stdio.h>
+#include <stdlib.h>
 #include <string.h>

 #include "tcpd.h"
--- a/options.c
+++ b/options.c
@@ -41,6 +41,7 @@ static char sccsid[] = "@(#) options.c 1
 #include <netinet/in.h>
 #include <netdb.h>
 #include <stdio.h>
+#include <stdlib.h>
 #include <unistd.h>
 #include <syslog.h>
 #include <pwd.h>
--- a/percent_x.c
+++ b/percent_x.c
@@ -17,6 +17,7 @@ static char sccsid[] = "@(#) percent_x.c
 /* System libraries. */

 #include <stdio.h>
+#include <unistd.h>
 #include <syslog.h>
 #include <string.h>

--- a/rfc931.c
+++ b/rfc931.c
@@ -16,6 +16,7 @@ static char sccsid[] = "@(#) rfc931.c 1.
 /* System libraries. */

 #include <stdio.h>
+#include <unistd.h>
 #include <syslog.h>
 #include <sys/types.h>
 #include <sys/socket.h>
--- a/tcpd.c
+++ b/tcpd.c
@@ -22,6 +22,7 @@ static char sccsid[] = "@(#) tcpd.c 1.10
 #include <sys/socket.h>
 #include <netinet/in.h>
 #include <stdio.h>
+#include <unistd.h>
 #include <syslog.h>
 #include <string.h>

@@ -38,10 +39,12 @@ static char sccsid[] = "@(#) tcpd.c 1.10
 #include "patchlevel.h"
 #include "tcpd.h"

+void fix_options(struct request_info *);
+
 int     allow_severity = SEVERITY;	/* run-time adjustable */
 int     deny_severity = LOG_WARNING;	/* ditto */

-main(argc, argv)
+int main(argc, argv)
 int     argc;
 char  **argv;
 {
--- a/update.c
+++ b/update.c
@@ -20,6 +20,7 @@ static char sccsid[] = "@(#) update.c 1.
 /* System libraries */

 #include <stdio.h>
+#include <unistd.h>
 #include <syslog.h>
 #include <string.h>

--- a/fakelog.c
+++ b/fakelog.c
@@ -17,7 +17,7 @@ static char sccsid[] = "@(#) fakelog.c 1

 /* ARGSUSED */

-openlog(name, logopt, facility)
+void openlog(name, logopt, facility)
 char   *name;
 int     logopt;
 int     facility;
@@ -27,7 +27,7 @@ int     facility;

 /* vsyslog - format one record */

-vsyslog(severity, fmt, ap)
+void vsyslog(severity, fmt, ap)
 int     severity;
 char   *fmt;
 va_list ap;
@@ -43,7 +43,7 @@ va_list ap;

 /* VARARGS */

-VARARGS(syslog, int, severity)
+void VARARGS(syslog, int, severity)
 {
     va_list ap;
     char   *fmt;
@@ -56,7 +56,7 @@ VARARGS(syslog, int, severity)

 /* closelog - dummy */

-closelog()
+void closelog()
 {
     /* void */
 }
--- a/safe_finger.c
+++ b/safe_finger.c
@@ -22,10 +22,15 @@ static char sccsid[] = "@(#) safe_finger

 #include <sys/types.h>
 #include <sys/stat.h>
+#include <sys/wait.h>
+#include <fcntl.h>
 #include <signal.h>
 #include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
 #include <ctype.h>
 #include <pwd.h>
+#include <grp.h>
 #include <syslog.h>

 extern void exit();
@@ -45,6 +50,8 @@ int     finger_pid;
 int	allow_severity = SEVERITY;
 int	deny_severity = LOG_WARNING;

+int     pipe_stdin(char **argv);
+
 void    cleanup(sig)
 int     sig;
 {
@@ -52,7 +59,7 @@ int     sig;
     exit(0);
 }

-main(argc, argv)
+int main(argc, argv)
 int     argc;
 char  **argv;
 {
--- a/tcpdchk.c
+++ b/tcpdchk.c
@@ -28,6 +28,8 @@ static char sccsid[] = "@(#) tcpdchk.c 1
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
 #include <syslog.h>
 #include <setjmp.h>
 #include <errno.h>
@@ -53,6 +55,8 @@ extern char *optarg;
 #include "inetcf.h"
 #include "scaffold.h"

+unsigned long cidr_mask_addr(char *str);
+
 /* list of programs which are known to be linked with libwrap in debian */
 static const char *const libwrap_programs[] = {
     "portmap", "mountd", "statd", "ugidd",
--- a/tcpdmatch.c
+++ b/tcpdmatch.c
@@ -26,6 +26,7 @@ static char sccsid[] = "@(#) tcpdmatch.c
 #include <arpa/inet.h>
 #include <netdb.h>
 #include <stdio.h>
+#include <unistd.h>
 #include <syslog.h>
 #include <setjmp.h>
 #include <string.h>
--- a/try-from.c
+++ b/try-from.c
@@ -37,7 +37,7 @@ static char sccsid[] = "@(#) try-from.c
 int     allow_severity = SEVERITY;	/* run-time adjustable */
 int     deny_severity = LOG_WARNING;	/* ditto */

-main(argc, argv)
+int main(argc, argv)
 int     argc;
 char  **argv;
 {
--- a/inetcf.c
+++ b/inetcf.c
@@ -12,6 +12,7 @@ static char sccsid[] = "@(#) inetcf.c 1.
 #include <sys/types.h>
 #include <sys/stat.h>
 #include <stdio.h>
+#include <stdlib.h>
 #include <errno.h>
 #include <string.h>

@@ -20,6 +21,7 @@ extern void exit();

 #include "tcpd.h"
 #include "inetcf.h"
+#include "scaffold.h"

  /*
   * Network configuration files may live in unusual places. Here are some


code:
diff -ruN tcp_wrappers_7.6.orig/percent_m.c tcp_wrappers_7.6/percent_m.c
--- tcp_wrappers_7.6.orig/percent_m.c	1994-12-28 17:42:37.000000000 +0100
+++ tcp_wrappers_7.6/percent_m.c	2003-08-21 02:45:31.000000000 +0200
@@ -29,11 +29,15 @@

     while (*bp = *cp)
 	if (*cp == '%' && cp[1] == 'm') {
+#ifdef HAVE_STRERROR
+	    strcpy(bp, strerror(errno));
+#else
 	    if (errno < sys_nerr && errno > 0) {
 		strcpy(bp, sys_errlist[errno]);
 	    } else {
 		sprintf(bp, "Unknown error %d", errno);
 	    }
+#endif
 	    bp += strlen(bp);
 	    cp += 2;
 	} else {


code:
--- a/inetcf.c
+++ b/inetcf.c
@@ -90,9 +90,7 @@ char   *conf;
 	for (i = 0; inet_files[i] && (fp = fopen(inet_files[i], "r")) == 0; i++)
 	     /* void */ ;
 	if (fp == 0) {
-	    fprintf(stderr, "Cannot find your inetd.conf or tlid.conf file.\n");
-	    fprintf(stderr, "Please specify its location.\n");
-	    exit(1);
+	    return inet_files[i];
 	}
 	conf = inet_files[i];
 	check_path(conf, &st);


code:
diff -up tcp_wrappers_7.6/options.c.initgroups tcp_wrappers_7.6/options.c
--- tcp_wrappers_7.6/options.c.initgroups	2011-08-11 23:10:43.610418714 +0200
+++ tcp_wrappers_7.6/options.c	2011-08-12 05:51:17.748481294 +0200
@@ -256,8 +256,12 @@ struct request_info *request;
 	tcpd_jump("unknown group: \"%s\"", value);
     endgrent();

-    if (dry_run == 0 && setgid(grp->gr_gid))
-	tcpd_jump("setgid(%s): %m", value);
+    if (dry_run != 0) {
+        if (setgid(grp->gr_gid))
+	   tcpd_jump("setgid(%s): %m", value);
+        if (setgroups(0, NULL))
+	   tcpd_jump("setgroups(%s): %m", value);
+    }
 }

 /* user_option - switch user id */
@@ -271,15 +275,26 @@ struct request_info *request;
     struct passwd *pwd;
     struct passwd *getpwnam();
     char   *group;
+    int    defaultgroup = 0;

     if ((group = split_at(value, '.')) != 0)
 	group_option(group, request);
+    else
+	defaultgroup = 1;
     if ((pwd = getpwnam(value)) == 0)
 	tcpd_jump("unknown user: \"%s\"", value);
     endpwent();

-    if (dry_run == 0 && setuid(pwd->pw_uid))
-	tcpd_jump("setuid(%s): %m", value);
+    if (dry_run != 0) {
+        if (setuid(pwd->pw_uid))
+	    tcpd_jump("setuid(%s): %m", value);
+	if (defaultgroup) {
+            if (setgid(pwd->pw_gid))
+	       tcpd_jump("setgid(%s): %m", value);
+            if (initgroups(value, pwd->pw_gid))
+	       tcpd_jump("initgroups(%s): %m", value);
+	}
+    }
 }

 /* umask_option - set file creation mask */
diff -up tcp_wrappers_7.6/safe_finger.c.initgroups tcp_wrappers_7.6/safe_finger.c
--- tcp_wrappers_7.6/safe_finger.c.initgroups	2011-08-12 05:54:06.068606291 +0200
+++ tcp_wrappers_7.6/safe_finger.c	2011-08-12 05:55:34.835483785 +0200
@@ -66,9 +66,11 @@ char  **argv;
     if (getuid() == 0 || geteuid() == 0) {
 	if ((pwd = getpwnam(UNPRIV_NAME)) && pwd->pw_uid > 0) {
 	    setgid(pwd->pw_gid);
+	    initgroups(UNPRIV_NAME, pwd->pw_gid);
 	    setuid(pwd->pw_uid);
 	} else {
 	    setgid(UNPRIV_UGID);
+	    setgroups(0, NULL);
 	    setuid(UNPRIV_UGID);
 	}
     }


code:
diff -ruN tcp_wrappers_7.6.orig/hosts_access.3 tcp_wrappers_7.6/hosts_access.3
--- tcp_wrappers_7.6.orig/hosts_access.3	2004-04-25 00:10:48.000000000 +0200
+++ tcp_wrappers_7.6/hosts_access.3	2004-04-25 00:09:36.000000000 +0200
@@ -14,6 +14,9 @@
 struct request_info *request_set(request, key, value, ..., 0)
 struct request_info *request;

+void fromhost(request)
+struct request_info *request;
+
 int hosts_access(request)
 struct request_info *request;

@@ -60,6 +63,7 @@
 is available, host names and client user names are looked up on demand,
 using the request structure as a cache.  hosts_access() returns zero if
 access should be denied.
+fromhost() must be called before hosts_access().
 .PP
 hosts_ctl() is a wrapper around the request_init() and hosts_access()
 routines with a perhaps more convenient interface (though it does not


code:
diff -ruNp tcp_wrappers_7.6.orig/hosts_access.c tcp_wrappers_7.6/hosts_access.c
--- tcp_wrappers_7.6.orig/hosts_access.c	2007-01-08 01:31:32.000000000 +0100
+++ tcp_wrappers_7.6/hosts_access.c	2007-01-08 01:31:08.000000000 +0100
@@ -232,6 +232,36 @@ int   (*match_fn) ();
     return (NO);
 }

+/*
+ * daemon_or_port_match - match server information: if the server endpoint
+ * pattern is a port number, match against port number of connection;
+ * otherwise match against daemon executable name
+ */
+
+static int daemon_or_port_match(char *tok, struct request_info *request) {
+    unsigned int port, sin_port;
+    char junk;
+
+    /* daemon name */
+    if (sscanf(tok, "%u%c", &port, &junk) != 1 || port > 65535)
+	return (string_match(tok, eval_daemon(request)));
+
+    /* port number */
+    if (!request->server->sin)
+	return (NO);
+
+#ifdef INET6
+    sin_port = ntohs(((struct sockaddr_in *)request->server->sin)->sin_port);
+#else
+    sin_port = ntohs(request->server->sin->sin_port);
+#endif
+
+    if (port == sin_port)
+	return (YES);
+    else
+	return (NO);
+}
+
 /* server_match - match server information */

 static int server_match(tok, request)
@@ -241,9 +271,9 @@ struct request_info *request;
     char   *host;

     if ((host = split_at(tok + 1, '@')) == 0) {	/* plain daemon */
-	return (string_match(tok, eval_daemon(request)));
+	return (daemon_or_port_match(tok, request));
     } else {					/* daemon@host */
-	return (string_match(tok, eval_daemon(request))
+	return (daemon_or_port_match(tok, request)
 		&& host_match(host, request->server));
     }
 }
diff -ruNp tcp_wrappers_7.6.orig/hosts_access.5 tcp_wrappers_7.6/hosts_access.5
--- tcp_wrappers_7.6.orig/hosts_access.5	2007-01-08 01:31:32.000000000 +0100
+++ tcp_wrappers_7.6/hosts_access.5	2007-01-08 01:30:18.000000000 +0100
@@ -51,7 +51,7 @@ being optional:
 daemon_list : client_list [ : shell_command ]
 .PP
 \fIdaemon_list\fR is a list of one or more daemon process names
-(argv[0] values) or wildcards (see below).
+(argv[0] values) or server port numbers or wildcards (see below).
 .PP
 \fIclient_list\fR is a list
 of one or more host names, host addresses, patterns or wildcards (see


code:
--- /dev/null
+++ tcp-wrappers-7.6.q/try-from.8
@@ -0,0 +1,28 @@
+.TH TRY-FROM 8 "21th June 1997" Linux "Linux Programmer's Manual"
+.SH NAME
+try-from \- test program for the tcp_wrapper
+.SH SYNOPSIS
+.B try-from
+.SH DESCRIPTION
+The
+.B try\-from
+command can be called via a remote shell command to find out
+if the hostname and address are properly recognized
+by the
+.B tcp_wrapper
+library, if username lookup works, and (SysV only) if the TLI
+on top of IP heuristics work. Diagnostics are reported through
+.BR syslog (3)
+and redirected to stderr.
+
+Example:
+
+rsh host /usr/sbin/try\-from
+
+.SH SEE ALSO
+.BR hosts_access (5),
+.BR hosts_options (5),
+.BR tcpd (8)
+.SH AUTHOR
+Wietse Venema, Eindhoven University of Technology, The Netherlands.
+
--- /dev/null
+++ tcp-wrappers-7.6.q/safe_finger.8
@@ -0,0 +1,34 @@
+.TH SAFE_FINGER 8 "21th June 1997" Linux "Linux Programmer's Manual"
+.SH NAME
+safe_finger \- finger client wrapper that protects against nasty stuff
+from finger servers
+.SH SYNOPSIS
+.B safe_finger [finger_options]
+.SH DESCRIPTION
+The
+.B safe_finger
+command protects against nasty stuff from finger servers. Use this
+program for automatic reverse finger probes from the
+.B tcp_wrapper
+.B (tcpd)
+, not the raw finger command. The
+.B safe_finger
+command makes sure that the finger client is not run with root
+privileges. It also runs the finger client with a defined PATH
+environment.
+.B safe_finger
+will also protect you from problems caused by the output of some
+finger servers. The problem: some programs may react to stuff in
+the first column. Other programs may get upset by thrash anywhere
+on a line. File systems may fill up as the finger server keeps
+sending data. Text editors may bomb out on extremely long lines.
+The finger server may take forever because it is somehow wedged.
+.B safe_finger
+takes care of all this badness.
+.SH SEE ALSO
+.BR hosts_access (5),
+.BR hosts_options (5),
+.BR tcpd (8)
+.SH AUTHOR
+Wietse Venema, Eindhoven University of Technology, The Netherlands.
+


code:
--- a/Makefile
+++ b/Makefile
@@ -154,6 +154,12 @@ linux:
 	NETGROUP="-DNETGROUP" TLI= VSYSLOG= BUGS= \
 	EXTRA_CFLAGS="-DSYS_ERRLIST_DEFINED -DHAVE_STRERROR -DHAVE_WEAKSYMS -DINET6=1 -Dss_family=__ss_family -Dss_len=__ss_len" all

+musl:
+	@make REAL_DAEMON_DIR=$(REAL_DAEMON_DIR) STYLE=$(STYLE) \
+	LIBS= RANLIB=ranlib ARFLAGS=rv AUX_OBJ=weak_symbols.o \
+	NETGROUP= TLI= VSYSLOG= BUGS= \
+	EXTRA_CFLAGS="-DSYS_ERRLIST_DEFINED -DHAVE_STRERROR -DHAVE_WEAKSYMS -DINET6=1 -Dss_family=__ss_family -Dss_len=__ss_len" all
+
 gnu:
 	@make REAL_DAEMON_DIR=$(REAL_DAEMON_DIR) STYLE=$(STYLE) \
 	LIBS=-lnsl RANLIB=ranlib ARFLAGS=rv AUX_OBJ=weak_symbols.o \
--- a/tcpd.h
+++ b/tcpd.h
@@ -11,6 +11,16 @@
 #include <netinet/in.h>
 #include <stdio.h>

+#ifndef __BEGIN_DECLS
+#ifdef __cplusplus
+#define __BEGIN_DECLS   extern "C" {
+#define __END_DECLS     }
+#else
+#define __BEGIN_DECLS
+#define __END_DECLS
+#endif
+#endif
+
 __BEGIN_DECLS

 /* Structure to describe one communications endpoint. */


code:
diff -ruN tcp_wrappers_7.6.orig/rfc931.c tcp_wrappers_7.6/rfc931.c
--- tcp_wrappers_7.6.orig/rfc931.c	2004-08-29 18:40:08.000000000 +0200
+++ tcp_wrappers_7.6/rfc931.c	2004-08-29 18:40:02.000000000 +0200
@@ -92,6 +92,8 @@
     char   *cp;
     char   *result = unknown;
     FILE   *fp;
+    unsigned saved_timeout;
+    struct sigaction nact, oact;

 #ifdef INET6
     /* address family must be the same */
@@ -134,7 +136,12 @@
 	 */

 	if (setjmp(timebuf) == 0) {
-	    signal(SIGALRM, timeout);
+	    /* Save SIGALRM timer and handler. Sudheer Abdul-Salam, SUN. */
+	    saved_timeout = alarm(0);
+	    nact.sa_handler = timeout;
+	    nact.sa_flags = 0;
+	    (void) sigemptyset(&nact.sa_mask);
+	    (void) sigaction(SIGALRM, &nact, &oact);
 	    alarm(rfc931_timeout);

 	    /*
@@ -223,6 +230,10 @@
 	    }
 	    alarm(0);
 	}
+	/* Restore SIGALRM timer and handler. Sudheer Abdul-Salam, SUN. */
+	(void) sigaction(SIGALRM, &oact, NULL);
+	if (saved_timeout > 0)
+	    alarm(saved_timeout);
 	fclose(fp);
     }
     STRN_CPY(dest, result, STRING_LENGTH);


code:
diff -ruNp tcp_wrappers_7.6.orig/scaffold.c tcp_wrappers_7.6/scaffold.c
--- tcp_wrappers_7.6.orig/scaffold.c	2005-03-09 18:22:04.000000000 +0100
+++ tcp_wrappers_7.6/scaffold.c	2005-03-09 18:20:47.000000000 +0100
@@ -237,10 +237,17 @@ struct request_info *request;

 /* ARGSUSED */

-void    rfc931(request)
-struct request_info *request;
+void    rfc931(rmt_sin, our_sin, dest)
+#ifdef INET6
+struct sockaddr *rmt_sin;
+struct sockaddr *our_sin;
+#else
+struct sockaddr_in *rmt_sin;
+struct sockaddr_in *our_sin;
+#endif
+char   *dest;
 {
-    strcpy(request->user, unknown);
+    strcpy(dest, unknown);
 }

 /* check_path - examine accessibility */
diff -ruNp tcp_wrappers_7.6.orig/tcpd.h tcp_wrappers_7.6/tcpd.h
--- tcp_wrappers_7.6.orig/tcpd.h	2005-03-09 18:22:04.000000000 +0100
+++ tcp_wrappers_7.6/tcpd.h	2005-03-09 18:21:23.000000000 +0100
@@ -83,7 +83,11 @@ extern int hosts_access(struct request_i
 extern void shell_cmd(char *);		/* execute shell command */
 extern char *percent_x(char *, int, char *, struct request_info *);
 					/* do %<char> expansion */
+#ifdef INET6
 extern void rfc931(struct sockaddr *, struct sockaddr *, char *);
+#else
+extern void rfc931(struct sockaddr_in *, struct sockaddr_in *, char *);
+#endif
 					/* client name from RFC 931 daemon */
 extern void clean_exit(struct request_info *);	/* clean up and exit */
 extern void refuse(struct request_info *);	/* clean up and exit */


code:
--- tcp-wrappers-7.6-ipv6.1.orig/safe_finger.c
+++ tcp-wrappers-7.6-ipv6.1/safe_finger.c
@@ -26,21 +26,24 @@
 #include <stdio.h>
 #include <ctype.h>
 #include <pwd.h>
+#include <syslog.h>

 extern void exit();

 /* Local stuff */

-char    path[] = "PATH=/bin:/usr/bin:/usr/ucb:/usr/bsd:/etc:/usr/etc:/usr/sbin";
+char    path[] = "PATH=/bin:/usr/bin:/sbin:/usr/sbin";

 #define	TIME_LIMIT	60		/* Do not keep listinging forever */
 #define	INPUT_LENGTH	100000		/* Do not keep listinging forever */
 #define	LINE_LENGTH	128		/* Editors can choke on long lines */
 #define	FINGER_PROGRAM	"finger"	/* Most, if not all, UNIX systems */
 #define	UNPRIV_NAME	"nobody"	/* Preferred privilege level */
-#define	UNPRIV_UGID	32767		/* Default uid and gid */
+#define	UNPRIV_UGID	65534		/* Default uid and gid */

 int     finger_pid;
+int	allow_severity = SEVERITY;
+int	deny_severity = LOG_WARNING;

 void    cleanup(sig)
 int     sig;


code:
00_man_quoting.diff
00_man_typos
01_man_portability
05_wildcard_matching
06_fix_gethostbyname
10_usagi-ipv6
11_tcpd_blacklist
11_usagi_fix
12_makefile_config
13_shlib_weaksym
14_cidr_support
15_match_clarify
musl_support
aclexec
expand_remote_port
catch-sigchld
fix_warnings
have_strerror
man_fromhost
more_man_pages
match_port
restore_sigalarm
rfc931.diff
safe_finger
sig_fix
siglongjmp
size_t
tcpdchk_libwrapped
fix_static
fix_parsing_long_lines
initgroups
ignore_missing_inetdconf
fix_warnings2


code:
* Fri May  6 2005 Thomas Woerner <twoerner@redhat.com> 7.6-39
- fixed sig patch (#141110). Thanks to Nikita Shulga for the patch

* Mon Feb 10 2003 Harald Hoyer <harald@redhat.de> 7.6-29
- added security patch tcp_wrappers-7.6-sig.patch

diff -ruNp tcp_wrappers_7.6.orig/hosts_access.c tcp_wrappers_7.6/hosts_access.c
--- tcp_wrappers_7.6.orig/hosts_access.c	2006-03-01 22:14:14.000000000 +0100
+++ tcp_wrappers_7.6/hosts_access.c	2006-03-01 22:14:11.000000000 +0100
@@ -66,6 +66,7 @@ static char sep[] = ", \t\r\n";

 #define	YES		1
 #define	NO		0
+#define ERR             -1

  /*
   * These variables are globally visible so that they can be redirected in
@@ -130,11 +131,11 @@ struct request_info *request;
     verdict = setjmp(tcpd_buf);
     if (verdict != 0)
 	return (verdict == AC_PERMIT);
-    if (table_match(hosts_allow_table, request))
+    if (table_match(hosts_allow_table, request) == YES)
 	return (YES);
-    if (table_match(hosts_deny_table, request))
-	return (NO);
-    return (YES);
+    if (table_match(hosts_deny_table, request) == NO)
+	return (YES);
+    return (NO);
 }

 /* table_match - match table entries with (daemon, client) pair */
@@ -178,8 +179,9 @@ struct request_info *request;
 	(void) fclose(fp);
     } else if (errno != ENOENT) {
 	tcpd_warn("cannot open %s: %m", table);
+	match = ERR;
     }
-    if (match) {
+    if (match == YES) {
 	if (hosts_access_verbose > 1)
 	    syslog(LOG_DEBUG, "matched:  %s line %d",
 		   tcpd_context.file, tcpd_context.line);


code:
diff -ruNp tcp_wrappers_7.6.orig/rfc931.c tcp_wrappers_7.6/rfc931.c
--- tcp_wrappers_7.6.orig/rfc931.c	2004-08-29 18:42:25.000000000 +0200
+++ tcp_wrappers_7.6/rfc931.c	2004-08-29 18:41:04.000000000 +0200
@@ -33,7 +33,7 @@ static char sccsid[] = "@(#) rfc931.c 1.

 int     rfc931_timeout = RFC931_TIMEOUT;/* Global so it can be changed */

-static jmp_buf timebuf;
+static sigjmp_buf timebuf;

 /* fsocket - open stdio stream on top of socket */

@@ -62,7 +62,7 @@ int     protocol;
 static void timeout(sig)
 int     sig;
 {
-    longjmp(timebuf, sig);
+    siglongjmp(timebuf, sig);
 }

 /* rfc931 - return remote user name, given socket structures */
@@ -135,7 +135,7 @@ char   *dest;
 	 * Set up a timer so we won't get stuck while waiting for the server.
 	 */

-	if (setjmp(timebuf) == 0) {
+	if (sigsetjmp(timebuf, 1) == 0) {
 	    /* Save SIGALRM timer and handler. Sudheer Abdul-Salam, SUN. */
 	    saved_timeout = alarm(0);
 	    nact.sa_handler = timeout;


code:
--- a/fix_options.c
+++ b/fix_options.c
@@ -38,7 +38,12 @@ struct request_info *request;
 #ifdef IP_OPTIONS
     unsigned char optbuf[BUFFER_SIZE / 3], *cp;
     char    lbuf[BUFFER_SIZE], *lp;
+#ifdef __GLIBC__
+    socklen_t optsize = sizeof(optbuf);
+    int     ipproto;
+#else
     int     optsize = sizeof(optbuf), ipproto;
+#endif
     struct protoent *ip;
     int     fd = request->fd;
     unsigned int opt;
--- a/socket.c
+++ b/socket.c
@@ -95,7 +95,11 @@ struct request_info *request;
     static struct sockaddr_in client;
     static struct sockaddr_in server;
 #endif
+#ifdef __GLIBC__
+    socklen_t  len;
+#else
     int     len;
+#endif
     char    buf[BUFSIZ];
     int     fd = request->fd;

@@ -426,7 +430,11 @@ int     fd;
 #else
     struct sockaddr_in sin;
 #endif
+#ifdef __GLIBC__
+    socklen_t  size = sizeof(sin);
+#else
     int     size = sizeof(sin);
+#endif

     /*
      * Eat up the not-yet received datagram. Some systems insist on a


code:
--- tcp_wrappers_7.6/tcpd.c.bug11881
+++ tcp_wrappers_7.6/tcpd.c
@@ -60,10 +60,10 @@
      */

     if (argv[0][0] == '/') {
-	strcpy(path, argv[0]);
+	strncpy(path, argv[0], sizeof(path));
 	argv[0] = strrchr(argv[0], '/') + 1;
     } else {
-	sprintf(path, "%s/%s", REAL_DAEMON_DIR, argv[0]);
+	snprintf(path, sizeof(path), "%s/%s", REAL_DAEMON_DIR, argv[0]);
     }

     /*
--- tcp_wrappers_7.6/eval.c.bug11881
+++ tcp_wrappers_7.6/eval.c
@@ -111,7 +111,7 @@
 	return (hostinfo);
 #endif
     if (STR_NE(eval_user(request), unknown)) {
-	sprintf(both, "%s@%s", request->user, hostinfo);
+	snprintf(both, sizeof(both), "%s@%s", request->user, hostinfo);
 	return (both);
     } else {
 	return (hostinfo);
@@ -128,7 +128,7 @@
     char   *daemon = eval_daemon(request);

     if (STR_NE(host, unknown)) {
-	sprintf(both, "%s@%s", daemon, host);
+	snprintf(both, sizeof(both), "%s@%s", daemon, host);
 	return (both);
     } else {
 	return (daemon);


code:
diff -Naur tcp_wrappers_7.6.orig/tcpd.h tcp_wrappers_7.6/tcpd.h
--- tcp_wrappers_7.6.orig/tcpd.h	2014-03-24 18:39:52.000000000 +0000
+++ tcp_wrappers_7.6/tcpd.h	2014-03-24 18:48:21.000000000 +0000
@@ -11,7 +11,9 @@
 #include <netinet/in.h>
 #include <stdio.h>

+#ifdef __cplusplus
 __BEGIN_DECLS
+#endif

 /* Structure to describe one communications endpoint. */

@@ -252,6 +254,8 @@
 extern char *my_strtok();
 #endif

+#ifdef __cplusplus
 __END_DECLS
+#endif

 #endif


code:
diff -ruN tcp_wrappers_7.6.orig/tcpdchk.c tcp_wrappers_7.6/tcpdchk.c
--- tcp_wrappers_7.6.orig/tcpdchk.c	2003-08-21 02:50:37.000000000 +0200
+++ tcp_wrappers_7.6/tcpdchk.c	2003-08-21 02:50:33.000000000 +0200
@@ -53,6 +53,24 @@
 #include "inetcf.h"
 #include "scaffold.h"

+/* list of programs which are known to be linked with libwrap in debian */
+static const char *const libwrap_programs[] = {
+    "portmap", "mountd", "statd", "ugidd",
+    "redir", "rlinetd",
+    "sshd",
+    "atftpd",
+    "diald",
+    "esound",
+    "gdm", "gnome-session",
+    "icecast", "icecast_admin", "icecast_client", "icecast_source",
+    "mysqld",
+    "ntop",
+    "pptpd",
+    "rquotad",
+    "sendmail", "smail",
+    NULL
+};
+
  /*
   * Stolen from hosts_access.c...
   */
@@ -147,8 +165,8 @@
     /*
      * These are not run from inetd but may have built-in access control.
      */
-    inet_set("portmap", WR_NOT);
-    inet_set("rpcbind", WR_NOT);
+    for (c = 0; libwrap_programs[c]; c++)
+	inet_set(libwrap_programs[c], WR_YES);

     /*
      * Check accessibility of access control files.


code:
--- tdebase-trinity-14.0.10/kicker/applets/clock/CMakeLists.txt.orig	2021-04-24 01:28:04.000000000 -0300
+++ tdebase-trinity-14.0.10/kicker/applets/clock/CMakeLists.txt	2021-05-10 19:56:35.734649946 -0300
@@ -45,6 +45,7 @@

 tde_add_library( ${target} STATIC_PIC AUTOMOC
   SOURCES ${${target}_SRCS}
+  DEPENDENCIES kickermain-shared
 )

 ##### clock_panelapplet (module) ################
@@ -57,7 +58,6 @@

 tde_add_kpart( ${target} AUTOMOC
   SOURCES ${${target}_SRCS}
-  DEPENDENCIES clock_panelapplet-static
   LINK kickermain-shared clock_panelapplet-static kickermain
   DESTINATION ${PLUGIN_INSTALL_DIR}
 )


code:
--- tdelibs-20211106_fa49e53a/tdecore/CMakeLists.txt~	2021-11-22 17:11:05.000000000 -0300
+++ tdelibs-20211106_fa49e53a/tdecore/CMakeLists.txt	2021-11-22 18:52:05.135635451 -0300
@@ -141,10 +141,10 @@
   SOURCES ${${target}_SRCS}
   VERSION 14.1.0
   EMBED tdecorenetwork-static
-  LINK DCOP-shared tdefx-shared ICE SM ${ZLIB_LIBRARIES}
-  LINK_PRIVATE ltdlc-static ${KDESVGICONS} ${XCOMPOSITE_LIBRARIES}
-    ${LIBIDN_LIBRARIES} ${LIBBFD_LIBRARIES} ${LIB_UTIL} ${GAMIN_LIBRARIES}
-    ${Backtrace_LIBRARY}
+  LINK ltdlc-static DCOP-shared tdefx-shared ICE SM ${ZLIB_LIBRARIES}
+   ${KDESVGICONS} ${XCOMPOSITE_LIBRARIES}
+  LINK_PRIVATE ${LIBIDN_LIBRARIES} ${LIBBFD_LIBRARIES} ${LIB_UTIL}
+   ${GAMIN_LIBRARIES} ${Backtrace_LIBRARY}
   DESTINATION ${LIB_INSTALL_DIR}
 )


code:
commit 13a8894fe2faa45b04033d7122a8fe7939ce6aa2
Author: Gavin Smith <gavinsmith0123@gmail.com>
Date:   Thu Sep 16 19:06:28 2021 +0100

    * tp/Texinfo/XS/parsetexi/end_line.c (parse_line_command_args)
    <@headings>: Add missing option value 'single'.  Report from
    Sergei Trofimovich <slyich@gmail.com>.

diff --git a/tp/Texinfo/XS/parsetexi/end_line.c b/tp/Texinfo/XS/parsetexi/end_line.c
index a5bd0ce52a..c973cc1230 100644
--- a/tp/Texinfo/XS/parsetexi/end_line.c
+++ b/tp/Texinfo/XS/parsetexi/end_line.c
@@ -778,8 +778,8 @@ kdbinputstyle_invalid:
     case CM_headings:
       {
         if (!strcmp (line, "off") || !strcmp (line, "on")
-            || !strcmp (line, "double") || !strcmp (line, "singleafter")
-            || !strcmp (line, "doubleafter"))
+            || !strcmp (line, "single") || !strcmp (line, "double")
+            || !strcmp (line, "singleafter") || !strcmp (line, "doubleafter"))
           {
             ADD_ARG(line);
           }


code:
# From https://github.com/sensslen/udevil/commit/7f19f932a76417f7f8f063b41c6f61a9d0bd7558
diff --git a/etc/udevil.conf b/etc/udevil.conf
index 75a4c0d..3027a6d 100644
--- a/etc/udevil.conf
+++ b/etc/udevil.conf
@@ -221,7 +221,7 @@ default_options_file      = nosuid, noexec, nodev, noatime, uid=$UID, gid=$GID,
 default_options_iso9660   = nosuid, noexec, nodev, noatime, uid=$UID, gid=$GID, ro, utf8
 default_options_udf       = nosuid, noexec, nodev, noatime, uid=$UID, gid=$GID
 default_options_vfat      = nosuid, noexec, nodev, noatime, fmask=0133, dmask=0022, uid=$UID, gid=$GID, utf8
-default_options_exfat     = nosuid, noexec, nodev, noatime, umask=0077, uid=$UID, gid=$GID, iocharset=utf8, namecase=0, nonempty
+default_options_exfat     = nosuid, noexec, nodev, noatime, umask=0077, uid=$UID, gid=$GID, iocharset=utf8, namecase=0
 default_options_msdos     = nosuid, noexec, nodev, noatime, fmask=0133, dmask=0022, uid=$UID, gid=$GID
 default_options_umsdos    = nosuid, noexec, nodev, noatime, fmask=0133, dmask=0022, uid=$UID, gid=$GID
 default_options_ntfs      = nosuid, noexec, nodev, noatime, fmask=0133, uid=$UID, gid=$GID, utf8


code:
From 754137e70cf58a64ad524b704a86b651ba0cde07 Mon Sep 17 00:00:00 2001
From: Petr Stodulka <pstodulk@redhat.com>
Date: Wed, 14 Dec 2016 16:30:36 +0100
Subject: [PATCH] Fix CVE-2016-9844 (rhbz#1404283)

Fixes buffer overflow in zipinfo in similar way like fix for
CVE-2014-9913 provided by upstream.
---
 zipinfo.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/zipinfo.c b/zipinfo.c
index c03620e..accca2a 100644
--- a/zipinfo.c
+++ b/zipinfo.c
@@ -1984,7 +1984,19 @@ static int zi_short(__G)   /* return PK-type error code */
         ush  dnum=(ush)((G.crec.general_purpose_bit_flag>>1) & 3);
         methbuf[3] = dtype[dnum];
     } else if (methnum >= NUM_METHODS) {   /* unknown */
-        sprintf(&methbuf[1], "%03u", G.crec.compression_method);
+        /* 2016-12-05 SMS.
+         * https://launchpad.net/bugs/1643750
+         * Unexpectedly large compression methods overflow
+         * &methbuf[].  Use the old, three-digit decimal format
+         * for values which fit.  Otherwise, sacrifice the "u",
+         * and use four-digit hexadecimal.
+         */
+        if (G.crec.compression_method <= 999) {
+              sprintf( &methbuf[ 1], "%03u", G.crec.compression_method);
+        } else {
+              sprintf( &methbuf[ 0], "%04X", G.crec.compression_method);
+        }
+
     }

     for (k = 0;  k < 15;  ++k)
--
2.5.5