Bug 16645

Summary: Inetd(8) internal ident won't work with multiple interfaces
Product: Base System Reporter: venglin <venglin>
Component: binAssignee: freebsd-bugs (Nobody) <bugs>
Status: Closed FIXED    
Severity: Affects Only Me    
Priority: Normal    
Version: 3.4-STABLE   
Hardware: Any   
OS: Any   

Description venglin 2000-02-10 22:00:00 UTC 
	Internal auth service won't work if source IP address of TCP
	connection != target IP address of connection to ident server.

Fix: 

Unknown.
How-To-Repeat: 
lubi:venglin:~> netstat | grep own3d
tcp        0      0 lubi-e0.2202          own3d.telnet          ESTABLISHED

own3d:venglin:~> telnet lubi-e0 113
Trying 212.182.115.1...
Connected to lubi-e0.freebsd.lublin.pl.
Escape character is '^]'.
2202,23
2202 , 23 : USERID : UNKNOWN : venglin
Connection closed by foreign host.

own3d:venglin:~> telnet lubi 113
Trying 212.182.118.90...
Connected to lubi.gadaczka.org.
Escape character is '^]'.
2202,23
2202 , 23 : ERROR : No such file or directory
Connection closed by foreign host.
Comment 1 Bill Fenner 2000-02-10 22:14:25 UTC 
>	Internal auth service won't work if source IP address of TCP
>	connection != target IP address of connection to ident server.

This is how the ident protocol works.  The IP addresses used for the
ident connection are used as the IP addresses to combine with the ports
being queried.  See RFC 1413 for more information.

|   The information returned is that associated with the fully specified
|   TCP connection identified by <server-address>, <client-address>,
|   <port-on-server>, <port-on-client>, where <server-address> and
|   <client-address> are the local and foreign IP addresses of the
|   querying connection -- i.e., the TCP connection to the Identification
|   Protocol Server.

  Bill
Comment 2 Przemyslaw Frasunek 2000-02-10 22:24:11 UTC 
On 10-Feb-2000 Bill Fenner wrote:
>>      Internal auth service won't work if source IP address of TCP
>>      connection != target IP address of connection to ident server.
> This is how the ident protocol works.  The IP addresses used for the
> ident connection are used as the IP addresses to combine with the ports
> being queried.  See RFC 1413 for more information.

I've tried pidentd and there was no such problems. Maybe inetd should have some
parameter changing its behaviour (and breaking RFC...)?

-- 
* Fido: 2:480/124 ** WWW: http://www.freebsd.lublin.pl ** NIC-HDL: PMF9-RIPE *
* Inet: venglin@freebsd.lublin.pl ** PGP: D48684904685DF43  EA93AFA13BE170BF *
Comment 3 dwmalone freebsd_committer freebsd_triage 2001-05-07 19:29:00 UTC 
State Changed
From-To: open->closed

Builtin ident service is doing the right thing here and it would 
not be easy to impliment the other behaviour described.