Subject: Re: host name match bug

From: Shane Castle <[email-masked]>
Date: Fri, 18 Aug 1995 09:53:27 -0600 (MDT)

On Fri Aug 18 09:30:23 1995, Ric Anderson wrote:

>In tracking down why a user specifically allowed by ftphosts was
>being denied access, I found that the host/domain matching done
>by hostacc.c was case sensitive.  This could pose a security
>problem if, for example, your ftphosts contained
>	deny	*	*.foo.com
>and foo.com changed itself to be "Foo.COM".

>The fix is simple.  However, you have to use a numeric rather
>than symbolic option to fnmatch(), since fnmatch's options aren't
>available at compile time (no .h file).

>Ric (<[email-masked]> "Ric Anderson", using RTD's public internet access)
>--begin hostacc.c patch--
>*** /tmp/T0a001_Q	Fri Aug 18 08:27:46 1995
>--- src/hostacc.c	Fri Aug 18 07:58:51 1995
>***************
>*** 88,94 ****
>                          }
>                          else
>                          {
>!                                 iLineMatch = fnmatch(pcHost, pcRhost, NULL);
>                          }
>                          if (iLineMatch)
>                          {
>--- 88,94 ----
>                          }
>                          else
>                          {
>!                                 iLineMatch = fnmatch(pcHost, pcRhost, 0x4 /*FNM_NOCASE*/);
>                          }
>                          if (iLineMatch)
>                          {
>--end hostacc.c patch--

Here is a patch that uses a symbolic option to fnmatch().  Note the
addition of the #include line.
------------------------------------------------------------
--- hostacc.c.dist	Fri Apr  1 12:03:44 1994
+++ hostacc.c	Fri Aug 18 09:49:07 1995
@@ -25,6 +25,7 @@
 #ifdef  HOST_ACCESS
 
 #include "hostacc.h"
+#include "extensions.h"
 
 static  char    linbuf[MAXLEN];  /* Buffer to hold one line of config-file  */
 static  char    unibuf[MAXLEN];  /* Buffer to hold unified line             */
@@ -89,7 +90,7 @@
                         }
                         else
                         {
-                                iLineMatch = fnmatch(pcHost, pcRhost, NULL);
+                                iLineMatch = fnmatch(pcHost, pcRhost, FNM_NOCASE);
                         }
                         if (iLineMatch)
                         {

Shane Castle             | "Perfection, then, is finally achieved, not
Boulder County Info Svcs | when there is nothing left to add, but when
Boulder CO USA           | there is nothing left to take away."
                         |                - Antoine de Saint-Exupery

---

From: Ric Anderson <[email-masked]>
Date: Fri, 18 Aug 1995 08:30:23 -0700