Debian Bug report logs - #324788
tcpd: No way to block depending on socket options

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Teddy Hogeborn <teddy@fukt.bth.se>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: tcpd: No way to block depending on socket options

Date: Wed, 24 Aug 2005 02:06:06 +0200

Package: tcpd
Version: 7.6.dbs-8
Severity: wishlist

I use IPsec. I would like to block connections to a service if the
client is not using IPsec (similar to only allowing IMAPS and not
IMAP).  IPsec use can be detected by a socket option
(IP_IPSEC_POLICY).  It would therefore be useful to me to be able to
specify required socket options on a socket and not only client
addresses.

The shell command options ("spawn" and "twist") are not adequate
because they run with /dev/null as stdin and stdout/stderr and have
no way to access the socket.  There is also no way to predicate the
access on the result of such an external command.

I could, I suppose, use the "twist" option to run my own checker which
then runs the service (if allowed), but then there would be no need to
actually use the wrapper and I could just call the checker from inetd
directly.  And I feel that tcpd is the proper place for this kind of
functionality.

Or maybe this is what the IPsec SPD is for, but I never found any
sensible documentation for that stuff.

/Teddy

-- System Information:
Debian Release: 3.1
Architecture: i386 (i686)
Kernel: Linux 2.4.27-2-686
Locale: LANG=C, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)

Versions of packages tcpd depends on:
ii  debconf [debconf-2.0]       1.4.30.13    Debian configuration management sy
ii  libc6                       2.3.2.ds1-22 GNU C Library: Shared libraries an
ii  libwrap0                    7.6.dbs-8    Wietse Venema's TCP wrappers libra

-- debconf information:
  tcpd/paranoid-mode: false

Message #10 received at 324788@bugs.debian.org (full text, mbox, reply):

From: md@Linux.IT (Marco d'Itri)

To: Teddy Hogeborn <teddy@fukt.bth.se>, 324788@bugs.debian.org

Subject: Re: Bug#324788: tcpd: No way to block depending on socket options

Date: Wed, 24 Aug 2005 02:22:44 +0200

[Message part 1 (text/plain, inline)]

On Aug 24, Teddy Hogeborn <teddy@fukt.bth.se> wrote:

> I use IPsec. I would like to block connections to a service if the
> client is not using IPsec (similar to only allowing IMAPS and not
Send a patch, and test it well.

-- 
ciao,
Marco

[signature.asc (application/pgp-signature, inline)]

Message #15 received at 324788@bugs.debian.org (full text, mbox, reply):

From: md@Linux.IT (Marco d'Itri)

To: Teddy Hogeborn <teddy@fukt.bth.se>, 324788@bugs.debian.org

Subject: Re: Bug#324788: tcpd: No way to block depending on socket options

Date: Thu, 17 Aug 2006 20:56:01 +0200

[Message part 1 (text/plain, inline)]

On Aug 24, Marco d'Itri <md@Linux.IT> wrote:

> > I use IPsec. I would like to block connections to a service if the
> > client is not using IPsec (similar to only allowing IMAPS and not
> Send a patch, and test it well.
Do you have any plan to work on this?

-- 
ciao,
Marco

[signature.asc (application/pgp-signature, inline)]

Message #22 received at 324788@bugs.debian.org (full text, mbox, reply):

From: Teddy Hogeborn <teddy@fukt.bsnet.se>

To: Marco d'Itri <md@Linux.IT>

Cc: 324788@bugs.debian.org

Subject: Re: Bug#324788: tcpd: No way to block depending on socket options

Date: Sun, 27 Aug 2006 02:11:06 +0200

> > > I use IPsec. I would like to block connections to a service if
> > > the client is not using IPsec (similar to only allowing IMAPS

md@Linux.IT (Marco d'Itri) writes:

> > Send a patch, and test it well.
> Do you have any plan to work on this?

No.  Should I have?  I am not a programmer.  I am reporting a
potentially useful missing feature, not volunteering to implement it.
This is what "wishlist" bugs are for, are they not?

Why are you closing the bug report?  Have you forwarded this issue
upstream?  Has upstream decided that the feature is a bad idea?

(Sorry for not replying, my email domain has changed.)

/Teddy

Message #27 received at 324788@bugs.debian.org (full text, mbox, reply):

From: md@Linux.IT (Marco d'Itri)

To: Teddy Hogeborn <teddy@fukt.bsnet.se>

Cc: 324788@bugs.debian.org

Subject: Re: Bug#324788: tcpd: No way to block depending on socket options

Date: Sun, 27 Aug 2006 10:33:14 +0200

[Message part 1 (text/plain, inline)]

On Aug 27, Teddy Hogeborn <teddy@fukt.bsnet.se> wrote:

> No.  Should I have?  I am not a programmer.  I am reporting a
> potentially useful missing feature, not volunteering to implement it.
> This is what "wishlist" bugs are for, are they not?

> Why are you closing the bug report?  Have you forwarded this issue
Because you are not going to implement it, I am not going to implement
it and apparently nobody else is.
So there is no reason for keeping around the bug for a feature request
which is not going to be implemented.

> upstream?  Has upstream decided that the feature is a bad idea?
The upstream maintainer has not added new features in many many years.

-- 
ciao,
Marco

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.