e615632
diff -up tcp_wrappers_7.6/hosts_access.c.patch12 tcp_wrappers_7.6/hosts_access.c
e615632
--- tcp_wrappers_7.6/hosts_access.c.patch12	2008-08-29 09:45:12.000000000 +0200
e615632
+++ tcp_wrappers_7.6/hosts_access.c	2008-08-29 09:45:12.000000000 +0200
e615632
@@ -66,6 +66,7 @@ static char sep[] = ", \t\r\n";
cvsdist f791644
 
cvsdist f791644
 #define	YES		1
cvsdist f791644
 #define	NO		0
cvsdist f791644
+#define ERR             -1
cvsdist f791644
 
cvsdist f791644
  /*
cvsdist f791644
   * These variables are globally visible so that they can be redirected in
e615632
@@ -106,7 +107,6 @@ int     hosts_access(request)
cvsdist f791644
 struct request_info *request;
cvsdist f791644
 {
cvsdist f791644
     int     verdict;
cvsdist f791644
-
cvsdist f791644
     /*
cvsdist f791644
      * If the (daemon, client) pair is matched by an entry in the file
cvsdist f791644
      * /etc/hosts.allow, access is granted. Otherwise, if the (daemon,
e615632
@@ -129,9 +129,9 @@ struct request_info *request;
cvsdist f791644
 	return (verdict == AC_PERMIT);
cvsdist f791644
     if (table_match(hosts_allow_table, request))
cvsdist f791644
 	return (YES);
cvsdist f791644
-    if (table_match(hosts_deny_table, request))
cvsdist f791644
-	return (NO);
cvsdist f791644
-    return (YES);
cvsdist f791644
+    if (table_match(hosts_deny_table, request) == NO)
cvsdist f791644
+	return (YES);
cvsdist f791644
+    return (NO);
cvsdist f791644
 }
cvsdist f791644
 
cvsdist f791644
 /* table_match - match table entries with (daemon, client) pair */
e615632
@@ -175,6 +175,7 @@ struct request_info *request;
cvsdist f791644
 	(void) fclose(fp);
cvsdist f791644
     } else if (errno != ENOENT) {
cvsdist f791644
 	tcpd_warn("cannot open %s: %m", table);
cvsdist f791644
+	match = ERR;
cvsdist f791644
     }
cvsdist f791644
     if (match) {
cvsdist f791644
 	if (hosts_access_verbose > 1)