Hide Forgot
Description of problem: line with more then 2048 character is ignored Version-Release number of selected component (if applicable): tcp_wrappers-7.6-58.el6 How reproducible: always Steps to Reproduce: 0. client: 192.168.122.159 server: 192.168.122.212 1, [hosts.allow_1] , more then 2048 characters from client: ssh root.122.212 ssh_exchange_identification: Connection closed by remote host 2, delete few records to have <2048 char from hosts.allow which is [hosts.allow_2] from client: ssh root.122.212 It works as expected here. It asks for password. Actual results: line is ignored Expected results: line is not ignored or if necessary log it visible that line is ignored Additional info:
Created attachment 1130464 [details] etc hosts with more then 2048char on one line
Created attachment 1130465 [details] etc hosts with less then 2048char on one line
For the reference: Debian bug [1]: > I do not know, but I do not look forward to modify mature security sensitive code which I do not know well. > Marco CentOS bug [2]: untouched Fixing it might take two ways: * moving hard limit which just moves the issue further * significantly rewrite xgets and/or the callee function to accommodate elastic buffer. Might introduce other bugs. As soon as I will have some prototype, I will update the bug. [1] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=648181 [2] https://bugs.centos.org/view.php?id=10017
Created attachment 1130854 [details] proposed patch I put together patch providing flexible buffer if we overrun the static one. For the most of the cases, the static one should be used. If we encounter longer line, we allocate longer buffer. Basic testing worked for me. Please consider if we really want this in RHEL6 and request ACKs. Here is scratch build for x86_64: http://brewweb.devel.redhat.com/brew/taskinfo?taskID=10566822
Development Management has reviewed and declined this request. You may appeal this decision by reopening this request.
This is a limitation of the software but hardly a security issue.