tcp_wrappers
========================================================================
With this package you can monitor and filter incoming requests for the
SYSTAT, FINGER, FTP, TELNET, RLOGIN, RSH, EXEC, TFTP, TALK, and other
network services.

NOTE: For IPv6 operation, I suspect you may need to add the following
      to /etc/hosts (that is, %WINDIR%/system32/drivers/etc/hosts).

127.0.0.1           localhost
::1                 localhost
::ffff:127.0.0.1    localhost

However, unlike on many linux distributions, you do NOT want to add
mymachine or mymachine.mydomain to those entries.  Doing that will
truly mess up hostname matching for the loopback connection. (It
probably messes it up on linux, too, but they don't seem to use the
'paranoid' setting in /etc/hosts.allow, like we do).  If you insist,
you could add the mymachine entries to /etc/hosts, but you definitely
need to turn off 'paranoid' checking in /etc/hosts.allow.

Build requirements
  cygwin-1.7.25-1
  gcc-core-4.7.3-2
  binutils-2.23.51-1
  cygport-0.14.0

Canonical homepage:
  ftp://ftp.porcupine.org/pub/security/index.html
  
Canonical download:
  ftp://ftp.porcupine.org/pub/security/

License:
  MIT/X11 (more or less)

Language:
  C

========================================================================

Port Notes:

Incorporates the Debian extensions:
  
    * cygwrap-0.dll and libwrap.dll.a are available for dynamic linking.

    * You can blacklist a whole bunch of hosts at once by specifying a
      file that contains a list of those hosts instead of just naming
      a host. See the hosts_access(5) manpage.

    * You can allow or disallow access to a service depending on the
      exit status of a program. See the hosts_access(5) manpage.

    * CIDR support in hosts_access(5) functions.

    * %r and %R parameters in hosts_access(5) functions.

    * Servers can be matched by port number other than by process name.

    * IPv6 support: patches are applied and IPv6 is enabled for this
      cygwin-1.7-specific build.

    * manpages for installed tools not provided by upstream source

Build options:
========================================================================

STYLE           = "-DPROCESS_OPTIONS -DACLEXEC"

        Debian TCP Wrappers use the extended syntax for /etc/hosts.allow
        and /etc/hosts.deny. This particularly affects spawning other
        commands on connections, see the hosts_options(5) manpage for
        more details.

FACILITY        = LOG_DAEMON
SEVERITY        = LOG_INFO

        TCP Wrappers logs as daemon.info (rather than mail.info).
        This is a change from earlier cygwin releases of tcp_wrappers.

BUGS            = 

        Cygwin has no bugs. At least, none that the tcp_wrappers
        upstream developer knows about specifically.

VSYSLOG         =

        cygwin has vsyslog built in, since 1.5.6/2004Jan19 
        (patch applied 2003-09-29)

UMASK           = -DDAEMON_UMASK=022
NETGROUP        = 

RFC931_TIMEOUT  = 10
ACCESS          = -DHOSTS_ACCESS
TABLES          = -DHOSTS_DENY=\"/etc/hosts.deny\" -DHOSTS_ALLOW=\"/etc/hosts.allow\"
KILL_OPT        = -DKILL_IP_OPTIONS

LIBS            =

EXTRA_CFLAGS    = -DSYS_ERRLIST_DEFINED -Dsys_errlist=_sys_errlist
                  -Dsys_nerr=_sys_nerr -DHAVE_STRERROR -DHAVE_STRONGSYMS

        STRONGSYMS: the cygwin versions of cygwrap-0.dll AND libwrap.a
        (that is, both the DLL and the static library) explicitly provide
            int deny_severity
            int allow_severity
        symbols.  This means that clients must NOT define their own 
        versions of these symbols, as is the practice on *nix systems.
        Instead, clients should rely on the /declaration/ provided in
        tcpd.h:
            extern int deny_severity;
            extern int allow_severity;
        This may require code changes in clients that link against
        libwrap, but it was a necessary API change to enable DLL
        builds on cygwin.

========================================================================
MULTI-HOMED ISSUES

On a multi-homed machine, you sometimes can't rlogin (or rsh, or rexec,
etc) to localhost via its short hostname (but 'localhost' and the
fully-qualified name both work). This is because 'rlogin mymachine' will
actually create a connection to the server across the first interface it
finds, which may not necessarily be the one you expect.

For instance, my computer's main (wireless) interface is 192.168.1.3,
but I have a wired interface as well as a few VMWare virtual interfaces.
        192.168.199.1 (VMware)
        192.168.154.1 (VMware)
        192.168.1.42  (wired)
        192.168.1.3   (wireless)
Note that "inactive" -- e.g. disconnected -- interfaces would not show
up in this list.  However, the VMware virtual interfaces are always
"connected" unless I specifically disable them from the control panel.

Now, if I were to type 'rlogin mymachine', rlogin would create a
connection across the 192.168.199.1 interface, because 'mymachine'
resolves for each of those interfaces.  (OTOH, mymachine.mydomain
is interface specific, and would resolve only to 192.168.1.3).  Now,
rlogind recieves this connection and verifies that yes, 192.168.199.1
does in fact correspond to 'mymachine', and happily checks the IP
address against /etc/hosts.allow via libwrap.  And that's where the
problem occurs.  Since 192.168.1.* is my "main" network, I don't
have any rules in /etc/hosts.allow for the 192.168.199.* or
192.168.154.* networks -- and libwrap denies access.

Note that this really only affects loopback connections; remote
connections work fine. So, the solution is to do one of the following:
   1) use 'localhost'
   2) use FQDN mymachine.mydomain
   3) use explicit IP addr (192.168.1.3 or 127.0.0.1)
   4) disable all unused interfaces (*)

(*) In my case, I hardly ever use my VMware virtual network, so
    I can easily turn those off, and turn them back on only when
    needed.  Furthermore, the wired and wireless IPs are both in the
    same subnet, so whichever one of those gets used, things would
    still work ok.  Besides, "unplugged" networks don't show up in the
    list anyway, so...when the wireless is working, don't plug in the
    ethernet cable.

========================================================================

---- tcp_wrappers-7.6-22 -- 2013 Nov 06 ----
* Rely on cygport to autogenerate setup.hints
* Added debuginfo package
* First cygwin64 release

---- tcp_wrappers-7.6-21 -- 2010 Mar 28 ----
* Updated hosts.allow to add IPv4-in-IPv6 localhost alias
  [::ffff:127.0.0.1]/128
* Rebuilt using gcc4, against non-beta version of cygwin-1.7.x.
* Fixed a few thinkos with respect to the logging level variables.
* Restructured cygport to use cygport-0.9.x features
* Added note in README concerning /etc/hosts
* Added a lot of documentation concerning multi-homed computers.

---- tcp_wrappers-7.6-20 -- 2009 Mar 28 ----
* Modified cygport procedure
* Updated hosts.allow (added 'ALL : localhost 127.0.0.1/32 [::1]/128 : ALLOW' line)
* Updated to r16 (from r15) debian patchlevel

---- tcp_wrappers-7.6-5 -- 27 Apr 2008 ----
* Requires cygwin-1.7
* Update to latest debian fixes:
  + New patch catch-sigchld: unblocks and catches SIGCHLD from spawned
    shell commands and uses waitpid to prevent waiting for the childs of
    the calling application.
    (From the Fedora package, fixes RH #112975 and RH #156373.)
    https://bugzilla.redhat.com/show_bug.cgi?id=112975
    https://bugzilla.redhat.com/show_bug.cgi?id=156373
* IPv6 support turned on

---- tcp_wrappers-7.6-4 -- 22 Feb 2008 ----
* Switch to cygport build tool
* incorporate debian patches -- see README.Debian 
* build shared library
* split into multiple packages
* new maintainer

----- tcp_wrappers-7.6-3 -- 22 Feb 2008 ----
* -- unreleased --

----- tcp_wrappers-7.6-2 -- 14 Apr 2006 ----
* Simply moved documents to /usr/share per FHS.

----- tcp_wrappers-7.6-1 -- 26 Jun 2002 ----
* if /etc/hosts.deny or /etc/hosts.allow do not exist,
  then default versions are created.  The default version
  blocks everything except local services and sshd.

* Since tcp_wrappers must be built "in" the source directory,
  we use 'shtool' to make a symlink-farm "copy" of srcdir
  within .build.

========================================================================
Cygwin port maintained by: Charles Wilson <cygwin@cygwin.com>

