HOSTS_ACCESS(3)

💖 HOSTS_ACCESS(3) — the access control library, bestie edition 💖

okay so this is a page from the Library Functions Manual, and it's about hosts_access, hosts_ctl, request_init and request_set — the whole access-control-library friend group 🫶. It's the HOSTS_ACCESS(3) manual, so like, section 3, library functions, you know the vibe. Let's get into it ✨

---

✨ NAME ✨

hosts_access, hosts_ctl, request_init, request_set — access control library 💅

---

🌸 SYNOPSIS 🌸

#include <tcpd.h>

extern int allow_severity;
extern int deny_severity;

struct request_info *request_init(request, key, value, ..., 0)
struct request_info *request;

struct request_info *request_set(request, key, value, ..., 0)
struct request_info *request;

void fromhost(request)
struct request_info *request;

int hosts_access(request)
struct request_info *request;

int hosts_ctl(daemon, client_name, client_addr, client_user)
char *daemon;
char *client_name;
char *client_addr;
char *client_user;

---

🦋 DESCRIPTION 🦋

so. the routines described in this doc are part of the libwrap.a library 🎀. what they do is implement a rule-based access control language, and ngl the plot twist is that it can run optional shell commands whenever a rule fires 😭 iconic behavior fr fr.

request_init() initializes a structure with information about a client request ✨. request_set() updates a request structure that's already been initialized. Both of these functions take a variable-length list of key-value pairs and return their first argument 🫶. The argument lists are terminated with a zero key value. All string-valued arguments are copied. no cap. 👑

The expected keys (and their corresponding value types) are:

• RQ_FILE (int) — the file descriptor that's associated with the request 🍓
• RQ_CLIENT_NAME (char *) — the client host name 💜
• RQ_CLIENT_ADDR (char *) — a printable representation of the client network address 🌈
• RQ_CLIENT_SIN (struct sockaddr_in *) — an internal representation of the client network address and port. Heads up: the contents of the structure are not copied ⚠️
• RQ_SERVER_NAME (char *) — the hostname associated with the server endpoint address ✨
• RQ_SERVER_ADDR (char *) — a printable representation of the server endpoint address 🌸
• RQ_SERVER_SIN (struct sockaddr_in *) — an internal representation of the server endpoint address and port. Same deal as before: the contents of the structure are not copied ⚠️
• RQ_DAEMON (char *) — the name of the daemon process running on the server host 💅
• RQ_USER (char *) — the name of the user on whose behalf the client host makes the request 👑

hosts_access() consults the access control tables described in the hosts_access(5) manual page 📖. When internal endpoint information is available, host names and client user names are looked up on demand, using the request structure as a cache 🧠✨. hosts_access() returns zero if access should be denied 🚫. And important: fromhost() must be called before hosts_access() — like, that's not optional bestie, that's the order of operations 😤

hosts_ctl() is a wrapper around the request_init() and hosts_access() routines, with a maybe-more-convenient interface 🎀 (though, lowkey, it does not pass on enough information to support automated client username lookups 🙈). The client host address, client host name and username arguments should contain valid data or STRING_UNKNOWN. hosts_ctl() returns zero if access should be denied 🚫.

The allow_severity and deny_severity variables determine how accepted and rejected requests may be logged 📝. They must be provided by the caller, and they may be modified by rules in the access control tables 👀.

---

😭 DIAGNOSTICS 😭

Problems are reported via the syslog daemon 📢. (so if something's going wrong, that's where the tea gets spilled.)

---

🌈 SEE ALSO 🌈

• hosts_access(5) — format of the access control tables 📋
• hosts_options(5) — optional extensions to the base language ✨

---

🎀 FILES 🎀

• /etc/hosts.allow, /etc/hosts.deny — access control tables 💖

---

💀 BUGS 💀

hosts_access() uses the strtok() library function. This may interfere with other code that relies on strtok(). so yeah, watch out for that collision, it's giving messy 😬

---

👑 AUTHOR 👑

Wietse Venema (wietse@wzv.win.tue.nl) Department of Mathematics and Computing Science Eindhoven University of Technology Den Dolech 2, P.O. Box 513, 5600 MB Eindhoven, The Netherlands 🌷

---

okay and that's the whole page!! it came from the Library Functions Manual, section HOSTS_ACCESS(3) — yes that's the version/source tag and it's also literally the title, we love a self-referential queen 👑. thanks for reading bestie, go call fromhost() before hosts_access() or I will find out 💅✨🦋