Subject: Re: ver. 2.5.0 ftpaccess (deny !nameserved failed)

From: Craig A Summerhill <[email-masked]>
Date: Tue, 25 May 1999 22:14:11 -0400 (EDT)

Gregory A. Lundberg <[email-masked]> wrote:
> 
> On Tue, 25 May 1999, Craig A Summerhill wrote:
> > 
> >    deny !nameserved /usr/local/etc/msg.denied-IP
> 
> check the permissions on /usr/local/etc/msg.denied-IP to be sure it's
> world-readable and the directories containing it are all world-executable.
> 
> other than that, I'm at a loss .. it works fine for me when I test it; but
> I don't use message files (ever) so that could be the problem.

The file in question has 644 permissions, and every directory in 
the path has 755 permissions.

For what it is worth, I think you misunderstood the problem as I 
originally stated it...

ftpd is not failing to show the message in question.  The problem 
is that ftpd is displaying the message and then denying access.  This 
is happening even when the connection is coming from the same machine
running ftpd.  There is something wrong with this function in the 2.5.0
code.  How can a DNS lookup fail for the local hostname?
-- 

   Craig A.  Summerhill, Systems Coordinator and Program Officer
   Coalition for Networked Information
   21 Dupont Circle, N.W., Washington, D.C.   20036
   Internet: [email-masked]   AT&Tnet (202) 296-5098

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 26 May 1999 09:32:10 -0400 (EDT)

Available from

  ftp://ftp.wu-ftpd.org/pub/wu-ftpd/quickfixes/apply_to_2.5.0/

After release of 2.5.0, two separate reports of problems with
  deny !nameserved msgfile
were received.  Basically, the daemon was treating '!nameserved' as
a host name and not fully giving it the special treatment it needs.
This problem has been in the daemon since, at least, version 2.4
was not unmasked until VR9 changed the details of how hostmatch()
does its thing.

Index: src/access.c
===================================================================
RCS file: /cvsroot/wu-ftpd-stable/src/access.c,v
retrieving revision 1.6
diff -c -r1.6 access.c
*** src/access.c	1999/05/20 10:48:54	1.6
--- src/access.c	1999/05/26 13:17:13
***************
*** 1128,1138 ****
      while (getaclentry("deny", &entry)) {
          if (!ARG0)
              continue;
!         if (!nameserved && !strcasecmp(ARG0, "!nameserved")) {
              if (ARG1)
                  strcpy(msgpathbuf, entry->arg[1]);
              return (1);
          }
          if (hostmatch(ARG0,remoteaddr,remotehost)) {
              if (ARG1)
                  strcpy(msgpathbuf, entry->arg[1]);
--- 1128,1141 ----
      while (getaclentry("deny", &entry)) {
          if (!ARG0)
              continue;
! 	if (strcasecmp(ARG0, "!nameserved") == 0) {
!           if (!nameserved) {
              if (ARG1)
                  strcpy(msgpathbuf, entry->arg[1]);
              return (1);
+           }
          }
+         else
          if (hostmatch(ARG0,remoteaddr,remotehost)) {
              if (ARG1)
                  strcpy(msgpathbuf, entry->arg[1]);

-- 

Gregory A Lundberg              Senior Partner, VRnet Company
1441 Elmdale Drive              [email-masked]
Kettering, OH 45409-1615 USA    1-800-809-2195

---

From: Gregory A Lundberg <[email-masked]>
Date: Wed, 26 May 1999 10:05:53 -0400 (EDT)

> was not unmasked until VR9 changed the details of how hostmatch()

On looking a bit further, the problem was unmasked when 2.5.0 added '!'
syntax to hostmatch() so you could say things like:
  class notlocalnet anonymous,guest,real !127.0.0.0/8

This change caused hostmatch () to return TRUE meaning 'Yes, "nameserved"
does not match the remote name or IP address.'

Before this change, hostmatch() returned FALSE meaning 'No, "!nameserved"
does not match the remote name or IP address.'

--

---

From: "Steve D'Angona" <[email-masked]>
Date: Wed, 26 May 1999 12:41:55 -0400 (EDT)

This problem is also occuring on my AIX box.

If I remove the "deny !nameservd" line from ftpaccess, then access is
allowed. 

Sounds to me like dns lookups have been adversely affected.

On Tue, 25 May 1999, Craig A Summerhill wrote:

> Date: Tue, 25 May 1999 22:14:11 -0400 (EDT)
> From: Craig A Summerhill <[email-masked]>
> To: [email-masked]
> Cc: [email-masked]
> Subject: Re: ver. 2.5.0 ftpaccess (deny !nameserved failed)
>