Bug 1311916 - line with more then 2048 character is ignored
line with more then 2048 character is ignored
Status: CLOSED WONTFIX
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: tcp_wrappers (Show other bugs)
6.8
Unspecified Unspecified
low Severity low
: rc
: ---
Assigned To: Jakub Jelen
qe-baseos-daemons
: Reopened, Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2016-02-25 05:19 EST by Petr Sklenar
Modified: 2016-05-24 08:34 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-05-24 08:34:04 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
etc hosts with more then 2048char on one line (2.45 KB, text/plain)
2016-02-25 05:21 EST, Petr Sklenar
no flags Details
etc hosts with less then 2048char on one line (2.40 KB, text/plain)
2016-02-25 05:21 EST, Petr Sklenar
no flags Details
proposed patch (2.58 KB, patch)
2016-02-26 09:59 EST, Jakub Jelen
no flags Details | Diff

  None (edit)
Description Petr Sklenar 2016-02-25 05:19:56 EST
Description of problem:
line with more then 2048 character is ignored

Version-Release number of selected component (if applicable):
tcp_wrappers-7.6-58.el6

How reproducible:
always

Steps to Reproduce:
0.
client: 192.168.122.159
server: 192.168.122.212

1, [hosts.allow_1] , more then 2048 characters

from client: ssh root@192.168.122.212
ssh_exchange_identification: Connection closed by remote host

2, delete few records to have  <2048 char from hosts.allow which is  [hosts.allow_2]

from client: ssh root@192.168.122.212
It works as expected here. It asks for password.

Actual results:
line is ignored

Expected results:
line is not ignored
or
if necessary log it visible that line is ignored

Additional info:
Comment 2 Petr Sklenar 2016-02-25 05:21 EST
Created attachment 1130464 [details]
etc hosts with more then 2048char on one line
Comment 3 Petr Sklenar 2016-02-25 05:21 EST
Created attachment 1130465 [details]
etc hosts with less then 2048char on one line
Comment 4 Jakub Jelen 2016-02-25 10:31:31 EST
For the reference:

Debian bug [1]:

> I do not know, but I do not look forward to modify mature security sensitive code which I do not know well.
>     Marco

CentOS bug [2]:
untouched

Fixing it might take two ways:
 * moving hard limit which just moves the issue further
 * significantly rewrite xgets and/or the callee function to accommodate elastic buffer. Might introduce other bugs. As soon as I will have some prototype, I will update the bug.

[1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=648181
[2] https://bugs.centos.org/view.php?id=10017
Comment 5 Jakub Jelen 2016-02-26 09:59 EST
Created attachment 1130854 [details]
proposed patch

I put together patch providing flexible buffer if we overrun the static one. For the most of the cases, the static one should be used. If we encounter longer line, we allocate longer buffer.

Basic testing worked for me. Please consider if we really want this in RHEL6 and request ACKs.

Here is scratch build for x86_64:
http://brewweb.devel.redhat.com/brew/taskinfo?taskID=10566822
Comment 7 RHEL Product and Program Management 2016-02-26 15:35:56 EST
Development Management has reviewed and declined this request.
You may appeal this decision by reopening this request.
Comment 17 Nikos Mavrogiannopoulos 2016-05-24 08:34:04 EDT
This is a limitation of the software but hardly a security issue.

Note You need to log in before you can comment on or make changes to this bug.