IPv6 support for nfs-utils tcpwrapper shim

These patches provide IPv6 support for the tcpwrapper shim inside nfs-utils. It assumes that the generic tcpwrapper library can support IPv6 addresses. It has not been extensively tested, but I think the framework is reasonable, and only minor bug fixes might be needed as we go along.

---

Chuck Lever (6):
tcpwrapper: Add support for IPv6
tcpwrapper: Eliminated shadowed declaration warnings
tcpwrapper: Fix signage problems in the tcp_wrappers hash function
tcp_wrapper: Clean up logit()
tcp_wrappers: Use getifaddrs(3) if it is available
tcpwrappers: Use xlog() instead of perror(3) and syslog(2)

 aclocal/ipv6.m4               |    4 -
 configure.ac                  |    2 
 support/include/tcpwrapper.h  |   12 +-
 support/misc/from_local.c     |  112 +++++++++++++++++++----
 support/misc/tcpwrapper.c     |  203 ++++++++++++++++++++++++-----------------
 utils/mountd/mount_dispatch.c |    6 -
 utils/statd/statd.c           |    5 -
 utils/statd/statd.man         |    3 -
 8 files changed, 223 insertions(+), 124 deletions(-)

chuck[dot]lever[at]oracle[dot]com

Clean up: Replace calls to syslog(2) and perror(3) in from_local.c with calls to xlog(). The problems displayed by the perror(3) calls especially should be reported. Currently they are never seen in the system log.

As part of a build test, I defined TEST, and found a couple of problems with main(), which are also addressed in this patch.

---

 support/misc/from_local.c |   25 +++++++++++++------------
 1 files changed, 13 insertions(+), 12 deletions(-)

index 89ccc4a..3f46b99 100644
@@ -37,8 +37,8 @@
 static char sccsid[] = "@(#) from_local.c 1.3 96/05/31 15:52:57";
 #endif
 
-#ifdef TEST
-#undef perror
+#ifdef HAVE_CONFIG_H
+#include <config.h>
 #endif
 
 #include <sys/types.h>

@@ -49,10 +49,12 @@ static char sccsid[] = "@(#) from_local.c 1.3 96/05/31 15:52:57";
 #include <netinet/in.h>
 #include <net/if.h>
 #include <sys/ioctl.h>
-#include <syslog.h>
 #include <stdlib.h>
 #include <string.h>
 
+#include "tcpwrapper.h"
+#include "xlog.h"
+
 #ifndef TRUE
 #define	TRUE	1
 #define FALSE	0

@@ -81,7 +83,7 @@ static int grow_addrs(void)
     new_num = (addrs == 0) ? 1 : num_addrs + num_addrs;
     new_addrs = (struct in_addr *) malloc(sizeof(*addrs) * new_num);
     if (new_addrs == 0) {
-	perror("portmap: out of memory");
+	xlog_warn("%s: out of memory", __func__);
 	return (0);
     } else {
 	if (addrs != 0) {

@@ -112,13 +114,13 @@ find_local(void)
      */
 
     if ((sock = socket(PF_INET, SOCK_DGRAM, 0)) < 0) {
-	perror("socket");
+	xlog_warn("%s: socket(2): %m", __func__);
 	return (0);
     }
     ifc.ifc_len = sizeof(buf);
     ifc.ifc_buf = buf;
     if (ioctl(sock, SIOCGIFCONF, (char *) &ifc) < 0) {
-	perror("SIOCGIFCONF");
+	xlog_warn("%s: ioctl(SIOCGIFCONF): %m", __func__);
 	(void) close(sock);
 	return (0);
     }

@@ -130,10 +132,10 @@ find_local(void)
 	if (ifr->ifr_addr.sa_family == AF_INET) {	/* IP net interface */
 	    ifreq = *ifr;
 	    if (ioctl(sock, SIOCGIFFLAGS, (char *) &ifreq) < 0) {
-		perror("SIOCGIFFLAGS");
+		xlog_warn("%s: ioctl(SIOCGIFFLAGS): %m", __func__);
 	    } else if (ifreq.ifr_flags & IFF_UP) {	/* active interface */
 		if (ioctl(sock, SIOCGIFADDR, (char *) &ifreq) < 0) {
-		    perror("SIOCGIFADDR");
+		    xlog_warn("%s: ioctl(SIOCGIFADDR): %m", __func__);
 		} else {
 		    if (num_local >= num_addrs)
 			if (grow_addrs() == 0)

@@ -160,7 +162,7 @@ from_local(struct sockaddr_in *addr)
     int     i;
 
     if (addrs == 0 && find_local() == 0)
-	syslog(LOG_ERR, "cannot find any active local network interfaces");
+	xlog(L_ERROR, "Cannot find any active local network interfaces");
 
     for (i = 0; i < num_local; i++) {
 	if (memcmp((char *) &(addr->sin_addr), (char *) &(addrs[i]),

@@ -172,9 +174,8 @@ from_local(struct sockaddr_in *addr)
 
 #ifdef TEST
 
-main()
+int main(void)
 {
-    char   *inet_ntoa();
     int     i;
 
     find_local();

@@ -182,4 +183,4 @@ main()
 	printf("%s\n", inet_ntoa(addrs[i]));
 }
 
-#endif
+#endif	/* TEST */

After glibc 2.3.3, getifaddrs(3) can return AF_INET6 addresses for local network interfaces. Using the library call is easier than trying to update the open code in from_local(), and means we have less to maintain in nfs-utils.

Since from_local() can now support IPv6, change its synopsis to take a "struct sockaddr *" .

Note that the original code discovers local addresses once. These days, with wifi, DHCP, and NetworkManager, the local network configuration can change dynamically over time. So, call getifaddrs() more often to ensure from_local() has up-to-date network configuration information.

---

 aclocal/ipv6.m4              |    4 +-
 configure.ac                 |    2 -
 support/include/tcpwrapper.h |    2 -
 support/misc/from_local.c    |   87 +++++++++++++++++++++++++++++++++++++++---
 support/misc/tcpwrapper.c    |    2 -
 5 files changed, 85 insertions(+), 12 deletions(-)

index 2490f3d..5ee8fb6 100644
@@ -15,8 +15,8 @@ AC_DEFUN([AC_IPV6], [
     fi
 
     dnl IPv6-enabled networking functions required for IPv6
-    AC_CHECK_FUNCS([getnameinfo bindresvport_sa], ,
-                   [AC_MSG_ERROR([Missing functions needed for IPv6.])])
+    AC_CHECK_FUNCS([getifaddrs getnameinfo bindresvport_sa], ,
+                   [AC_MSG_ERROR([Missing library functions needed for IPv6.])])
 
     dnl Need to detect presence of IPv6 networking at run time via
     dnl getaddrinfo(3); old versions of glibc do not support ADDRCONFIG

index c77c5ba..1dc4249 100644
@@ -330,7 +330,7 @@ AC_FUNC_STAT
 AC_FUNC_VPRINTF
 AC_CHECK_FUNCS([alarm atexit dup2 fdatasync ftruncate getcwd \
                gethostbyaddr gethostbyname gethostname getmntent \
-               getnameinfo getrpcbyname \
+               getnameinfo getrpcbyname getifaddrs \
                gettimeofday hasmntopt inet_ntoa innetgr memset mkdir pathconf \
                realpath rmdir select socket strcasecmp strchr strdup \
                strerror strrchr strtol strtoul sigprocmask])

index 98cf806..f1145bd 100644
@@ -11,7 +11,7 @@ extern int allow_severity;
 extern int deny_severity;
 
 extern int good_client(char *daemon, struct sockaddr_in *addr);
-extern int from_local (struct sockaddr_in *addr);
+extern int from_local(const struct sockaddr *sap);
 extern int check_default(char *daemon, struct sockaddr_in *addr,
 			 u_long proc, u_long prog);
 

index 1da6020..af626ad 100644
@@ -202,7 +202,7 @@ u_long  prog;
 	if (acc && changed == 0)
 		return (acc->access);
 
-	if (!(from_local(addr) || good_client(daemon, addr))) {
+	if (!(from_local((struct sockaddr *)addr) || good_client(daemon, addr))) {
 		log_bad_host(addr, proc, prog);
 		if (acc)
 			acc->access = FALSE;

Eliminate these compiler warnings:

tcpwrapper.c: In function =E2=80=98logit=E2=80=99:
tcpwrapper.c:225: warning: unused parameter =E2=80=98procnum=E2=80=99 tcpwrapper.c:225: warning: unused parameter =E2=80=98prognum=E2=80=99

Actually, @procnum is not used anywhere in our tcpwrapper.c, so let's just get rid of it.

Since there is only one logit() call site in tcpwrapper.c, the macro wrapper just adds needless clutter. Let's get rid of that too.

=46inally, both mountd and statd now use xlog(), which adds an appropriate program name prefix to every message. Replace the open-coded syslog(2) call with an xlog() call in order to consistently identify the RPC service reporting the intrusion.

Since logit() no longer references "deny_severity" and no nfs-utils caller sets either allow_severity or deny_severity, we remove them.

---

 support/include/tcpwrapper.h  |    8 +-----
 support/misc/tcpwrapper.c     |   56 ++++++++++++++++++---------------=
--------
 utils/mountd/mount_dispatch.c |    2 +
 utils/statd/statd.c           |    2 +
 4 files changed, 27 insertions(+), 41 deletions(-)

h
index f1145bd..941394e 100644

@@ -5,14 +5,8 @@
 #include <netinet/in.h>
 #include <arpa/inet.h>

=20
-extern int verboselog;
-
-extern int allow_severity;
-extern int deny_severity;
-
extern int good_client(char *daemon, struct sockaddr_in *addr); extern int from_local(const struct sockaddr *sap);
-extern int check_default(char *daemon, struct sockaddr_in *addr,
- u_long proc, u_long prog);
+extern int check_default(char *daemon, struct sockaddr_in *addr, u_lon= g prog);
=20
#endif /* TCP_WRAPPER_H */

index af626ad..b981d58 100644
@@ -34,13 +34,12 @@
 #ifdef HAVE_CONFIG_H
 #include <config.h>
 #endif
+
 #ifdef HAVE_LIBWRAP
-#include <tcpwrapper.h>
 #include <unistd.h>
 #include <string.h>
 #include <rpc/rpc.h>
 #include <rpc/pmap_prot.h>
-#include <syslog.h>
 #include <netdb.h>
 #include <pwd.h>
 #include <sys/types.h>

@@ -49,6 +48,7 @@
 #include <sys/stat.h>
 #include <tcpd.h>

=20
+#include "tcpwrapper.h"
#include "xlog.h"
=20
#ifdef SYSV40
@@ -56,21 +56,8 @@
#include <rpc/rpcent.h>
#endif
=20
-static void logit(int severity, struct sockaddr_in *addr,
- u_long procnum, u_long prognum, char *text);
static int check_files(void);
=20
-/*
- * These need to exist since they are externed=20
- * public header files.
- */

-int     verboselog =3D 0;
-int     allow_severity =3D LOG_INFO;
-int     deny_severity =3D LOG_WARNING;

-
-#define log_bad_host(addr, proc, prog) \
- logit(deny_severity, addr, proc, prog, "request from unauthorized ho= st")
-
#define ALLOW 1
#define DENY 0
=20
@@ -143,6 +130,16 @@ haccess_t *haccess_lookup(struct sockaddr_in *addr= , u_long prog)
return NULL;
}
=20
+static void
+logit(const struct sockaddr_in *sin)
+{
+ char buf[INET_ADDRSTRLEN];
+
+ xlog_warn("connect from %s denied: request from unauthorized host",
+ inet_ntop(AF_INET, &sin->sin_addr, buf, sizeof(buf)));
+ =09
+}
+
int
good_client(daemon, addr)
char *daemon;
@@ -186,14 +183,17 @@ static int check_files()
return changed;
}
=20
-/* check_default - additional checks for NULL, DUMP, GETPORT and unkno= wn */
-
+/**
+ * check_default - additional checks for NULL, DUMP, GETPORT and unkno= wn
+ * @daemon: pointer to '\0'-terminated ASCII string containing name of= the
+ * daemon requesting the access check
+ * @addr: pointer to socket address containing address of caller
+ * @prog: RPC program number caller is attempting to access
+ *
+ * Returns TRUE if the caller is allowed access; otherwise FALSE is re= turned.
+ */
int
-check_default(daemon, addr, proc, prog)
-char *daemon;
-struct sockaddr_in *addr;
-u_long proc;
-u_long prog;
+check_default(char *daemon, struct sockaddr_in *addr, u_long prog)
{
haccess_t *acc =3D NULL;
int changed =3D check_files();
@@ -203,7 +203,7 @@ u_long prog;
return (acc->access);
=20
if (!(from_local((struct sockaddr *)addr) || good_client(daemon, addr=
))) {
- log_bad_host(addr, proc, prog);
+ logit(addr);
if (acc)
acc->access =3D FALSE;
else=20

@@ -219,12 +219,4 @@ u_long  prog;
     return (TRUE);

}
=20
-/* logit - report events of interest via the syslog daemon */ -
-static void logit(int severity, struct sockaddr_in *addr,
- u_long procnum, u_long prognum, char *text)
-{
- syslog(severity, "connect from %s denied: %s",
- inet_ntoa(addr->sin_addr), text);
-}
-#endif
+#endif /* HAVE_LIBWRAP */

h.c
index 199fcec..d2802ef 100644

@@ -75,7 +75,7 @@ mount_dispatch(struct svc_req *rqstp, SVCXPRT *transp=

)
=20
/* remote host authorization check */ if (sin->sin_family =3D=3D AF_INET &&
- !check_default("mountd", sin, rqstp->rq_proc, MOUNTPROG)) {
+ !check_default("mountd", sin, MOUNTPROG)) {
svcerr_auth (transp, AUTH_FAILED); return;
}

index 7be6454..fa3c6d5 100644
@@ -79,7 +79,7 @@ sm_prog_1_wrapper (struct svc_req *rqstp, register SV=

CXPRT *transp)
=20
/* remote host authorization check */ if (sin->sin_family =3D=3D AF_INET &&
- !check_default("statd", sin, rqstp->rq_proc, SM_PROG)) {
+ !check_default("statd", sin, SM_PROG)) {
svcerr_auth (transp, AUTH_FAILED); return;
}

Eliminate the following compiler warnings:

tcpwrapper.c:78: warning: no previous prototype for =E2=80=98strtoint=E2= =80=99
tcpwrapper.c: In function =E2=80=98strtoint=E2=80=99:
tcpwrapper.c:81: warning: conversion to =E2=80=98int=E2=80=99 from =E2=80= =98size_t=E2=80=99 may change the sign of the result tcpwrapper.c:85: warning: conversion to =E2=80=98unsigned int=E2=80=99 = from =E2=80=98int=E2=80=99 may change the sign of the result tcpwrapper.c: In function =E2=80=98hashint=E2=80=99:
tcpwrapper.c:91: warning: conversion to =E2=80=98int=E2=80=99 from =E2=80= =98unsigned int=E2=80=99 may change the sign of the result

The hash value is probably computed consistently even with unexpected sign inversions.

---

 support/misc/tcpwrapper.c |   34 ++++++++++++++++++++--------------
 1 files changed, 20 insertions(+), 14 deletions(-)

index b981d58..6f65c13 100644
@@ -75,29 +75,35 @@ hash_head haccess_tbl[HASH_TABLE_SIZE];
 static haccess_t *haccess_lookup(struct sockaddr_in *addr, u_long);
 static void haccess_add(struct sockaddr_in *addr, u_long, int);

=20
-inline unsigned int strtoint(char *str)
+static unsigned long
+strtoint(const char *str)
{
- unsigned int n =3D 0;
- int len =3D strlen(str);
- int i;
+ unsigned long i, n =3D 0;
+ size_t len =3D strlen(str);
=20
- for (i=3D0; i < len; i++)
- n+=3D((int)str[i])*i;
+ for (i =3D 0; i < len; i++)
+ n +=3D (unsigned char)str[i] * i;
=20
return n;
}
-static inline int hashint(unsigned int num)
+
+static unsigned int
+hashint(const unsigned long num)
+{
+ return (unsigned int)(num % HASH_TABLE_SIZE);
+}
+
+static unsigned int
+HASH(const char *addr, const unsigned long program)
{
- return num % HASH_TABLE_SIZE;
+ return hashint(strtoint(addr) + program);
}
-#define HASH(_addr, _prog) \
- hashint((strtoint((_addr))+(_prog)))
=20
void haccess_add(struct sockaddr_in *addr, u_long prog, int access) {
hash_head *head;
- haccess_t *hptr;
- int hash;
+ haccess_t *hptr;
+ unsigned int hash;
=20
hptr =3D (haccess_t *)malloc(sizeof(haccess_t));
if (hptr =3D=3D NULL)
@@ -117,8 +123,8 @@ void haccess_add(struct sockaddr_in *addr, u_long p= rog, int access)
haccess_t *haccess_lookup(struct sockaddr_in *addr, u_long prog) {
hash_head *head;
- haccess_t *hptr;
- int hash;
+ haccess_t *hptr;
+ unsigned int hash;
=20
hash =3D HASH(inet_ntoa(addr->sin_addr), prog);
head =3D &(haccess_tbl[hash]);

Clean up: the use of identifiers called "access" and "daemon" shadow function declarations in unistd.h. Seen with "-Wextra -pedantic".

tcpwrapper.c: In function =E2=80=98haccess_add=E2=80=99:
tcpwrapper.c:112: warning: declaration of =E2=80=98access=E2=80=99 shad= ows a global
declaration
/usr/include/unistd.h:288: warning: shadowed declaration is here tcpwrapper.c: In function =E2=80=98good_client=E2=80=99:
tcpwrapper.c:161: warning: declaration of =E2=80=98daemon=E2=80=99 shad= ows a global
declaration
/usr/include/unistd.h:953: warning: shadowed declaration is here tcpwrapper.c: In function =E2=80=98check_default=E2=80=99:
tcpwrapper.c:212: warning: declaration of =E2=80=98daemon=E2=80=99 shad= ows a global
declaration
/usr/include/unistd.h:953: warning: shadowed declaration is here

Note that good_client() is used only in support/misc/tcpwrapper.c, so make it static (and update its prototype to c99 standard form).

---

 support/include/tcpwrapper.h |    3 +--
 support/misc/tcpwrapper.c    |   32 +++++++++++++++-----------------
 2 files changed, 16 insertions(+), 19 deletions(-)

h
index 941394e..930ec6a 100644

@@ -5,8 +5,7 @@
 #include <netinet/in.h>
 #include <arpa/inet.h>

=20
-extern int good_client(char *daemon, struct sockaddr_in *addr);
extern int from_local(const struct sockaddr *sap);
-extern int check_default(char *daemon, struct sockaddr_in *addr, u_lon= g prog);
+extern int check_default(char *name, struct sockaddr_in *addr, u_long = prog);
=20
#endif /* TCP_WRAPPER_H */

index 6f65c13..03f5dc4 100644
@@ -62,9 +62,9 @@ static int check_files(void);
 #define DENY 0

=20
typedef struct _haccess_t {
- TAILQ_ENTRY(_haccess_t) list;
- int access;
- struct in_addr addr;
+ TAILQ_ENTRY(_haccess_t) list;
+ int allowed;
+ struct in_addr addr;
} haccess_t;
=20
#define HASH_TABLE_SIZE 1021
@@ -73,7 +73,6 @@ typedef struct _hash_head {
} hash_head;
hash_head haccess_tbl[HASH_TABLE_SIZE];
static haccess_t *haccess_lookup(struct sockaddr_in *addr, u_long);
-static void haccess_add(struct sockaddr_in *addr, u_long, int); =20
static unsigned long
strtoint(const char *str)
@@ -99,7 +98,8 @@ HASH(const char *addr, const unsigned long program)
return hashint(strtoint(addr) + program);
}
=20
-void haccess_add(struct sockaddr_in *addr, u_long prog, int access) +static void
+haccess_add(struct sockaddr_in *addr, u_long prog, int allowed)
{
hash_head *head;
haccess_t *hptr;
@@ -112,7 +112,7 @@ void haccess_add(struct sockaddr_in *addr, u_long p= rog, int access)
hash =3D HASH(inet_ntoa(addr->sin_addr), prog);
head =3D &(haccess_tbl[hash]);
=20
- hptr->access =3D access;
+ hptr->allowed =3D allowed;
hptr->addr.s_addr =3D addr->sin_addr.s_addr;
=20
if (TAILQ_EMPTY(&head->h_head))
@@ -146,14 +146,12 @@ logit(const struct sockaddr_in *sin)
=09
}
=20
-int
-good_client(daemon, addr)
-char *daemon;
-struct sockaddr_in *addr;
+static int
+good_client(char *name, struct sockaddr_in *addr)
{
struct request_info req;
=20
- request_init(&req, RQ_DAEMON, daemon, RQ_CLIENT_SIN, addr, 0);
+ request_init(&req, RQ_DAEMON, name, RQ_CLIENT_SIN, addr, 0);
sock_methods(&req);
=20
if (hosts_access(&req))=20
@@ -191,7 +189,7 @@ static int check_files()
=20
/**
* check_default - additional checks for NULL, DUMP, GETPORT and unkno=
wn
- * @daemon: pointer to '\0'-terminated ASCII string containing name of= the
+ * @name: pointer to '\0'-terminated ASCII string containing name of t= he
* daemon requesting the access check
* @addr: pointer to socket address containing address of caller
* @prog: RPC program number caller is attempting to access
@@ -199,26 +197,26 @@ static int check_files()
* Returns TRUE if the caller is allowed access; otherwise FALSE is re=
turned.
*/
int
-check_default(char *daemon, struct sockaddr_in *addr, u_long prog) +check_default(char *name, struct sockaddr_in *addr, u_long prog)
{
haccess_t *acc =3D NULL;
int changed =3D check_files();
=20
acc =3D haccess_lookup(addr, prog);
if (acc && changed =3D=3D 0)
- return (acc->access);
+ return acc->allowed;
=20
- if (!(from_local((struct sockaddr *)addr) || good_client(daemon, addr=
))) {
+ if (!(from_local((struct sockaddr *)addr) || good_client(name, addr))=
) {
logit(addr);
if (acc)
- acc->access =3D FALSE;
+ acc->allowed =3D FALSE;
else=20
haccess_add(addr, prog, FALSE);
return (FALSE);
}
=20
if (acc)
- acc->access =3D TRUE;
+ acc->allowed =3D TRUE;
else=20
haccess_add(addr, prog, TRUE);
=20

Assuming the tcp_wrappers library can actually support IPv6 addresses, here's a crack at IPv6 support in nfs-utils' TCP wrapper shim.

Some reorganization is done to limit the number of times that @sap is converted to a presentation address string.

---

 support/include/tcpwrapper.h  |    3 +
 support/misc/tcpwrapper.c     |  115 ++++++++++++++++++++++++++++-------------
 utils/mountd/mount_dispatch.c |    6 +-
 utils/statd/statd.c           |    5 --
 utils/statd/statd.man         |    3 -
 5 files changed, 84 insertions(+), 48 deletions(-)

index 930ec6a..f735106 100644
@@ -6,6 +6,7 @@
 #include <arpa/inet.h>
 
 extern int from_local(const struct sockaddr *sap);
-extern int check_default(char *name, struct sockaddr_in *addr, u_long prog);
+extern int check_default(char *name, struct sockaddr *sap,
+			const unsigned long program);
 
 #endif /* TCP_WRAPPER_H */

index d2802ef..ba6981d 100644
@@ -70,12 +70,10 @@ mount_dispatch(struct svc_req *rqstp, SVCXPRT *transp)
 {
 	union mountd_arguments 	argument;
 	union mountd_results	result;
-#ifdef HAVE_TCP_WRAPPER
-	struct sockaddr_in *sin = nfs_getrpccaller_in(transp);
 
+#ifdef HAVE_TCP_WRAPPER
 	/* remote host authorization check */
-	if (sin->sin_family == AF_INET &&
-	    !check_default("mountd", sin, MOUNTPROG)) {
+	if (!check_default("mountd", nfs_getrpccaller(transp), MOUNTPROG)) {
 		svcerr_auth (transp, AUTH_FAILED);
 		return;
 	}

index fa3c6d5..01fdb41 100644
@@ -75,11 +75,8 @@ extern void simulator (int, char **);
 static void 
 sm_prog_1_wrapper (struct svc_req *rqstp, register SVCXPRT *transp)
 {
-	struct sockaddr_in *sin = nfs_getrpccaller_in(transp);
-
 	/* remote host authorization check */
-	if (sin->sin_family == AF_INET &&
-	    !check_default("statd", sin, SM_PROG)) {
+	if (!check_default("statd", nfs_getrpccaller(transp), SM_PROG)) {
 		svcerr_auth (transp, AUTH_FAILED);
 		return;
 	}

index 4ddb634..ffc5e95 100644
@@ -274,9 +274,6 @@ listeners using the
 .B tcp_wrapper
 library or
 .BR iptables (8).
-Note that the
-.B tcp_wrapper
-library supports only IPv4 networking.
 To use the
 .B tcp_wrapper
 library, add the hostnames of peers that should be allowed access to

Did you do any simple "hello world" testing?

steved.

I've build-tested them. Jeff and I had them applied while doing the statd testing. They don't appear to cause problems when no allow/deny sets exist.

I thought we would have more time to test and review these, so I haven't done more extensive testing so far. In any case, I don't think they will be harmful, and can serve as a place marker for that feature as the beta moves forward.

--
Chuck Lever
chuck[dot]lever[at]oracle[dot]com

Unfortunately I have broken these before and it was awful painful... :-( Right or wrong... there is still a large number of people that depend on this archaic routines... we need to be very careful...

steved.

Do you have tests I can run to validate these patches to your satisfaction?

--
Chuck Lever
chuck[dot]lever[at]oracle[dot]com

No... I wish I did... I just do the testing by hand...

steved.