From owner-freebsd-hackers@FreeBSD.ORG Thu Oct 30 06:42:15 2003 Return-Path: Delivered-To: freebsd-hackers@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 9155716A4CF for ; Thu, 30 Oct 2003 06:42:15 -0800 (PST) Received: from bast.unixathome.org (bast.unixathome.org [66.11.174.150]) by mx1.FreeBSD.org (Postfix) with ESMTP id CDE5943FCB for ; Thu, 30 Oct 2003 06:42:14 -0800 (PST) (envelope-from dan@langille.org) Received: from wocker (wocker.unixathome.org [192.168.0.99]) by bast.unixathome.org (Postfix) with ESMTP id AF36B3D28 for ; Thu, 30 Oct 2003 09:42:13 -0500 (EST) From: "Dan Langille" To: FreeBSD-hackers@freebsd.org Date: Thu, 30 Oct 2003 09:42:13 -0500 MIME-Version: 1.0 Message-ID: <3FA0DCF5.27646.1A027A88@localhost> Priority: normal X-mailer: Pegasus Mail for Windows (v4.02a) Content-type: text/plain; charset=US-ASCII Content-transfer-encoding: 7BIT Content-description: Mail message body Subject: libwrap crash X-BeenThere: freebsd-hackers@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Technical Discussions relating to FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 30 Oct 2003 14:42:15 -0000 I've been tracking down a libwrap call which crashes the application. The crash occurs on line 395 of contrib/tcp_wrappers/options.c, but I have no idea. The situation: - The daemon starts on the remote client. - Connection is attempted from another box via port 9102 - The daemon uses hosts_access(3) to see if the connection is allowed - /etc/hosts.allow contains no explit allow/deny for this connection which means this line is invoked: # The rest of the daemons are protected. ALL : ALL \ : severity auth.info \ : twist /bin/echo "You are not welcome to use %d from %h." When the host_acess calls invokes twist_option (contrib/tcp_wrappers/options.c:370), things blow up on this call: (void) execl("/bin/sh", "sh", "-c", value, (char *) 0); Any ideas? Suggestions? Thank you [root@bast:/usr/ports/sysutils/bacula/work/bacula-1.32b/src/filed] # gdb ./bacula-fd GNU gdb 4.18 (FreeBSD) Copyright 1998 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-unknown-freebsd"...Deprecated bfd_read called at /usr/src/gnu/usr.bin/binutils/gdb/../../../../con trib/gdb/gdb/dwarf2read.c line 3049 in dwarf2_read_section (gdb) source ~/debug Breakpoint 1 at 0x805a365: file bnet_server.c, line 152. Breakpoint 1, bnet_thread_server (bind_addr=0x0, port=9102, max_clients=10, client_wq=0x807c4a0, handle_client_request=0x804d3c0 ) at bnet_server.c:152 152 fromhost(&request); Current language: auto; currently c++ (gdb) n 153 if (!hosts_access(&request)) { (gdb) s 0x8049cc8 in hosts_access () at /usr/src/lib/libwrap/../../contrib/tcp_wrappers/hosts_access.c:126 126 (gdb) /usr/src/lib/libwrap/../../contrib/tcp_wrappers/options.c:395 Undefined command: "". Try "help". (gdb) b /usr/src/lib/libwrap/../../contrib/tcp_wrappers/options.c:395 Breakpoint 2 at 0x280a1766: file /usr/src/lib/libwrap/../../contrib/tcp_wrappers/options.c, line 395. (gdb) c Continuing. Breakpoint 2, twist_option (value=0xbfbfe890 "/bin/echo \"You are not welcome to use bast-fd from undef.unixathome.org.\"", request=0xbfbff574) at /usr/src/lib/libwrap/../../contrib/tcp_wrappers/options.c:395 395 (void) execl("/bin/sh", "sh", "-c", value, (char *) 0); Current language: auto; currently c (gdb) list 390 maybe_dup2(request->fd, 2) != 2) { 391 error = "twist_option: dup: %m"; 392 } else { 393 if (request->fd > 2) 394 close(request->fd); 395 (void) execl("/bin/sh", "sh", "-c", value, (char *) 0); 396 error = "twist_option: /bin/sh: %m"; 397 } 398 399 /* Something went wrong: we MUST terminate the process. */ (gdb) print value $1 = 0xbfbfe890 "/bin/echo \"You are not welcome to use bast-fd from undef.unixathome.org.\"" (gdb) n 0x2809fb4c in _init () from /usr/lib/libwrap.so.3 (gdb) n Single stepping until exit from function _init, which has no line number information. Error accessing memory address 0x281a1e84: Bad address. (gdb -- Dan Langille : http://www.langille.org/