Subject: Re: Problem with ftphosts

From: [email-masked] (Andy Church)
Date: Fri, 20 Mar 1998 11:06:36 EST

>	Today I was  checking  the  functionality  of  ftphosts  file in
>	wu-ftpd-2.4.2-beta-15.  I  think  it   interprets   the   "deny"
>	directive  differently  than  what  it  actually  should  do.  I
>	specified following directive in the ftphosts file :
>
>	deny   root       some.host.name
>
>	But after  that any user  logging in as "root" is denied  access
>	irrespective  of the host from  where he has done ftp.  Actually
>	it   should   deny   access   only   to  the   "root"   user  of
>	"som.host.name".  Is this is a bug in code of  hostacc.c  file ?
>	Can anyone throw light on it ?

     There is indeed some suspicious-looking code in hostacc.c.  The
following patch is untested, but should correct the problem:

*** hostacc.c.old	Fri Mar 20 10:53:33 1998
--- hostacc.c	Fri Mar 20 11:05:20 1998
***************
*** 53,59 ****
          hacc_t  *ptHtmp;
          char    *pcHost;
          char    *ha_login;
!         int     iInd, iLineMatch = 0, iUserSeen = 0;
  
          switch(sethacc()){
          case 1:
--- 53,59 ----
          hacc_t  *ptHtmp;
          char    *pcHost;
          char    *ha_login;
!         int     iInd, iLineMatch = 0, iUserSeen = 0, iAllow = 1;
  
          switch(sethacc()){
          case 1:
***************
*** 85,93 ****
  
                  /*
                   * We have seen a line regarding the current user.
!                  * Remember this.
                   */
                  iUserSeen = 1;
  
                  for(iInd=0, pcHost=ptHtmp->ha_hosts[0];
                      ((pcHost != NULL) && !iLineMatch);
--- 85,95 ----
  
                  /*
                   * We have seen a line regarding the current user.
!                  * Remember this.  Also note whether this was an "allow" or
!                  * "deny" line.
                   */
                  iUserSeen = 1;
+                 iAllow = (ptHtmp->ha_type == ALLOW) ? 1 : 0;
  
                  for(iInd=0, pcHost=ptHtmp->ha_hosts[0];
                      ((pcHost != NULL) && !iLineMatch);
***************
*** 102,111 ****
                                  iLineMatch = !fnmatch(pcHost, pcRhost, NULL);
                          }
                          if (iLineMatch)
-                         {
-                                 iLineMatch = (ptHtmp->ha_type == ALLOW) ? 1 : 0;
                                  goto match;
-                         }
                  }
          }
  
--- 104,110 ----
***************
*** 123,130 ****
                  return(0);
          }
  
!         if (iUserSeen)
!                 return(ptHtmp == NULL) ? 0 : iLineMatch;
          else
                  /* Nothing at all about user in configfile, allow */
                  return(1);
--- 122,137 ----
                  return(0);
          }
  
!         if (iLineMatch)
!                 return iAllow;
!         else if (iUserSeen)
!                 /* The user was seen, but no hostnames matched.  If the
!                  * last line for this user was an "allow", deny access,
!                  * otherwise allow it.  What should the proper behavior be
!                  * in the presence of both "allow" and "deny" lines for the
!                  * same user?
!                  */
!                 return !iAllow;
          else
                  /* Nothing at all about user in configfile, allow */
                  return(1);

  --Andy Church                  | If Bell Atlantic really is the heart
    [email-masked]       | of communication, then it desperately
    www.dragonfire.net/~achurch/ | needs a quadruple bypass.

---

From: Harshal Savalia <[email-masked]>
Date: Sat, 21 Mar 1998 17:36:37 +0500 (IST)

Hello Andy,

	Thank  you  very  much for your  patch.  I will  apply  it on my
	hostacc.c file.

Best Regards,
Harshal

-- 
-------------------------------------------------------------------------------
Harshal Savalia					email : [email-masked]
-------------------------------------------------------------------------------