mirror of
https://github.com/freebsd/freebsd-src
synced 2024-09-06 17:18:32 +00:00
452 lines
19 KiB
Plaintext
452 lines
19 KiB
Plaintext
Request: after building the programs, please run the `tcpdchk' wrapper
|
|
configuration checker. See the `tcpdchk.8' manual page (`nroff -man'
|
|
format) for instructions. `tcpdchk' automatically identifies the most
|
|
common configuration problems, and will save you and me a lot of time.
|
|
|
|
Changes per release 7.6 (Mar 1997)
|
|
==================================
|
|
|
|
- Improved the anti source-routing protection. The code in version
|
|
7.5 was not as strong as it could be, because I tried to be compatible
|
|
with Linux. That was a mistake. Sorry for the inconvenience.
|
|
|
|
- The program no longer terminates case of a source-routed connection,
|
|
making the IP-spoofing code more usable for long-running daemons.
|
|
|
|
- When syslogging DNS hostname problems, always stop after a limited
|
|
number of characters.
|
|
|
|
Changes per release 7.5 (Feb 1997)
|
|
==================================
|
|
|
|
- Optionally refuse source-routed TCP connections requests altogether.
|
|
Credits to Niels Provos of Universitaet Hamburg. File: fix_options.c.
|
|
|
|
- Support for IRIX 6 (Lael Tucker).
|
|
|
|
- Support for Amdahl UTS 2.1.5 (Richard E. Richmond).
|
|
|
|
- Support for SINIX 5.42 (Klaus Nielsen).
|
|
|
|
- SCO 5 now has vsyslog() (Bill Golden).
|
|
|
|
- Hints and tips for dealing with IRIX inetd (Niko Makila, Aaron
|
|
M Lee).
|
|
|
|
- Support for BSD/OS (Paul Borman).
|
|
|
|
- Support for Tandem (Emad Qawas).
|
|
|
|
- Support for ISC (Frederick B. Cohen).
|
|
|
|
- Workaround for UNICOS - it would choke on a setjmp() expression
|
|
(Bruce Kelly). File: hosts_access.c, tcpdchk.c.
|
|
|
|
- Increased the level of buffer overflow paranoia when printing
|
|
unwanted IP options. File: fix_options.c.
|
|
|
|
Changes per release 7.4 (Mar 1996)
|
|
==================================
|
|
|
|
- IRIX 5.3 (and possibly, earlier releases, too) library routines call
|
|
the non-reentrant strtok() routine. The result is that hosts may slip
|
|
through allow/deny filters. Workaround is to not rely on the vendor's
|
|
strtok() routine (#ifdef LIBC_CALLS_STRTOK). Credits to Th. Eifert
|
|
(Aachen University) for spotting this one. This fix supersedes the
|
|
earlier workaround for a similar problem in FreeBSD 2.0.
|
|
|
|
Changes per release 7.3 (Feb 1996)
|
|
==================================
|
|
|
|
- More tests added to tcpdchk and tcpdmatch: make sure that the
|
|
REAL_DAEMON_DIR actually is a directory and not a regular file;
|
|
detect if tcpd recursively calls itself.
|
|
|
|
- Edwin Kremer found an amusing fencepost error in the xgets()
|
|
routine: lines longer than BUFLEN characters would be garbled.
|
|
|
|
- The access control routines now refuse to execute "dangerous" actions
|
|
such as `twist' when they are called from within a resident process.
|
|
This prevents you from shooting yourself into the foot with critical
|
|
systems programs such as, e.g., portmap or rpcbind.
|
|
|
|
- Support for Unicos 8.x (Bruce Kelly). The program now closes the
|
|
syslog client socket before running the real daemon: Cray UNICOS
|
|
refuses to checkpoint processes with open network ports.
|
|
|
|
- Support for MachTen UNIX (Albert M.C Tam).
|
|
|
|
- Support for Interactive UNIX R3.2 V4.0 (Bobby D. Wright).
|
|
|
|
- Support for SCO 3.2v5.0.0 OpenServer 5 (bob@odt.handy.com)
|
|
|
|
- Support for Unixware 1.x and Unixware 2.x. The old Unixware Makefile
|
|
rule was broken. Sorry about that.
|
|
|
|
- Some FreeBSD 2.0 libc routines call strtok() and severely mess up the
|
|
allow/deny rule processing. This is very bad. Workaround: call our own
|
|
strtok() clone (#ifdef USE_STRSEP).
|
|
|
|
- The programs now log a warning when they detect that a non-existent
|
|
banner directory is specified.
|
|
|
|
- The hosts_access.3 manual page used obsolete names for the RQ_*
|
|
constants.
|
|
|
|
Changes per release 7.2 (Jan 1995)
|
|
==================================
|
|
|
|
- Added a note to the README and manpages on using the IDENT service to
|
|
detect sequence number spoofing and other host impersonation attacks.
|
|
|
|
- Portability: ConvexOS puts RPC version numbers before the daemon path
|
|
name (Jukka Ukkonen).
|
|
|
|
- Portability: the AIX compiler disliked the strchr() declaration
|
|
in socket.c. I should have removed it when I included <string.h>.
|
|
|
|
- Backwards compatibility: some people relied on the old leading dot or
|
|
trailing dot magic in daemon process names.
|
|
|
|
- Backwards compatibility: hostname lookup remains enabled when
|
|
-DPARANOID is turned off. In order to disable hostname lookups you
|
|
must turn off -DALWAYS_HOSTNAME.
|
|
|
|
- Eliminated false complaints from the tcpdmatch/tcpdchk configuration
|
|
checking programs about process names not in inetd.conf or about KNOWN
|
|
username patterns.
|
|
|
|
Changes per release 7.1 (Jan 1995)
|
|
==================================
|
|
|
|
- Portability: HP-UX permits you to break inetd.conf entries with
|
|
backslash-newline.
|
|
|
|
- Portability: EP/IX has no putenv() and some inetd.conf entries are
|
|
spread out over two lines.
|
|
|
|
- Portability: SCO with NIS support has no *netgrent() routines.
|
|
|
|
Changes per release 7.0 (Jan 1995)
|
|
==================================
|
|
|
|
- Added a last-minute workaround for a Solaris 2.4 gethostbyname()
|
|
foulup with multi-homed hosts in DNS through NIS mode.
|
|
|
|
- Added a last-minute defense against TLI weirdness: address lookups
|
|
apparently succeed but the result netbuf is empty (ticlts transport).
|
|
|
|
- Dropped several new solutions that were in need of a problem. Beta
|
|
testers may recognize what new features were kicked out during the last
|
|
weeks before release 7.0 came out. Such is life.
|
|
|
|
- Got rid of out the environment replacement routines, at least for
|
|
most architectures. One should not have to replace working system
|
|
software when all that is needed is a 4.4BSD setenv() emulator.
|
|
|
|
- By popular request I have added an option to send banner messages to
|
|
clients. There is a Banners.Makefile that gives some aid for sites that
|
|
are going to use this feature. John C. Wingenbach did some pioneering
|
|
work here. I used to think that banners are frivolous. Now that I had
|
|
a personal need for them I know that banners can be useful.
|
|
|
|
- At last: an extensible functional interface to the pattern matching
|
|
engine. request_init() and request_set() accept a variable-length
|
|
name-value argument list. The result can be passed to hosts_access().
|
|
|
|
- When PARANOID mode is disabled (compile time), the wrapper does no
|
|
hostname lookup or hostname double checks unless required by %letter
|
|
expansions, or by access control rules that match host names. This is
|
|
useful for sites that don't care about internet hostnames anyway.
|
|
Inspired by the authors of the firewalls and internet security book.
|
|
|
|
- When PARANOID mode is disabled (compile time), hosts with a name/name
|
|
or name/address conflict can be matched with the PARANOID host wildcard
|
|
pattern, so that you can take some intelligent action instead of just
|
|
dropping clients. Like showing a banner that explains the problem.
|
|
|
|
- New percent escapes: %A expands to the server address; %H expands to
|
|
the corresponding hostname (or address if no name is available); %n and
|
|
%N expand to the client and server hostname (or "unknown"); %s expands
|
|
to everything we know about the server endpoint (the opposite of the %c
|
|
sequence for client information).
|
|
|
|
- Symmetry: server and client host information is now treated on equal
|
|
footing, so that we can reuse a lot of code.
|
|
|
|
- Lazy evaluation of host names, host addresses, usernames, and so on,
|
|
to avoid doing unnecessary work.
|
|
|
|
- Dropping #ifdefs for some archaic systems made the code simpler.
|
|
|
|
- Dropping the FAIL pattern made the pattern matcher much simpler. Run
|
|
the "tcpdchk" program to scan your access control files for any uses of
|
|
this obscure language feature.
|
|
|
|
- Moving host-specific pattern matching from string_match() to the
|
|
host_match() routine made the code more accurate. Run the "tcpdchk"
|
|
program to scan your access control files for any dependencies on
|
|
undocumented or obscure language features that are gone.
|
|
|
|
- daemon@host patterns trigger on clients that connect to a specific
|
|
internet address. This can be useful for service providers that offer
|
|
multiple ftp or www archives on different internet addresses, all
|
|
belonging to one and the same host (www.foo.com, ftp.bar.com, you get
|
|
the idea). Inspired by a discussion with Rop Gonggrijp, Cor Bosman,
|
|
and Casper Dik, and earlier discussions with Adrian van Bloois.
|
|
|
|
- The new "tcpdchk" program critcizes all your access control rules and
|
|
inetd.conf entries. Great for spotting obscure bugs in my own hosts.xxx
|
|
files. This program also detects hosts with name/address conflicts and
|
|
with other DNS-related problems. See the "tcpdchk.8" manual page.
|
|
|
|
- The "tcpdmatch" program replaces the poor old "try" command. The new
|
|
program looks in your inetd.conf file and therefore produces much more
|
|
accurate predictions. In addition, it detects hosts with name/address
|
|
conflicts and with other DNS-related problems. See the "tcpdmatch.8"
|
|
manual page. The inetd.conf lookup was suggested by Everett F Batey.
|
|
|
|
- In the access control tables, the `=' between option name and value
|
|
is no longer required.
|
|
|
|
- Added 60-second timeout to the safe_finger command, to cover another
|
|
potential problem. Suggested by Peter Wemm.
|
|
|
|
- Andrew Maffei provided code that works with WIN-TCP on NCR System V.4
|
|
UNIX. It reportedly works with versions 02.02.01 and 02.03.00. The code
|
|
pops off all streams modules above the device driver, pushes the timod
|
|
module to get at the peer address, and then restores the streams stack
|
|
to the initial state.
|
|
|
|
Changes per release 6.3 (Mar 1994)
|
|
==================================
|
|
|
|
- Keepalives option, to get rid of stuck daemons when people turn off
|
|
their PC while still connected. Files: options.c, hosts_options.5.
|
|
|
|
- Nice option, to calm down network daemons that take away too much CPU
|
|
time. Files: options.c, hosts_options.5.
|
|
|
|
- Ultrix perversion: the environ global pointer may be null. The
|
|
environment replacement routines now check for this. File: environ.c.
|
|
|
|
- Fixed a few places that still assumed the socket is on standard
|
|
input. Fixed some error messages that did not provide access control
|
|
file name and line number. File: options.c.
|
|
|
|
- Just when I was going to release 6.2 I received code for Dynix/PTX.
|
|
That code is specific to PTX 2.x, so I'll keep around my generic
|
|
PTX code just in case. The difference is in the handling of UDP
|
|
services. Files: tli_sequent.[hc].
|
|
|
|
Changes per release 6.2 (Feb 1994)
|
|
==================================
|
|
|
|
- Resurrected my year-old code to reduce DNS load by appending a dot to
|
|
the gethostbyname() argument. This feature is still experimental and it
|
|
may go away if it causes more problems than it solves. File: socket.c.
|
|
|
|
- Auxiliary code for the Pyramid, BSD universe. Karl Vogel figured out
|
|
what was missing: yp_get_default_domain() and vfprintf(). Files:
|
|
workarounds.c, vfprintf.c.
|
|
|
|
- Improved support for Dynix/PTX. The wrapper should now be able to
|
|
deal with all TLI over IP services. File: ptx.c.
|
|
|
|
- The try command now uses the hostname that gethostbyaddr() would
|
|
return, instead of the hostname returned by gethostbyname(). This can
|
|
be significant on systems with NIS that have short host names in the
|
|
hosts map. For example, gethostbyname("wzv.win.tue.nl") returns
|
|
"wzv.win.tue.nl"; gethostbyaddr(131.155.210.17) returns "wzv", and
|
|
that is what we should test with. File: try.c.
|
|
|
|
Changes per release 6.1 (Dec 1993)
|
|
==================================
|
|
|
|
- Re-implemented all environment access routines. Most systems have
|
|
putenv() but no setenv(), some systems have setenv() but no putenv(),
|
|
and there are even systems that have neither setenv() nor putenv(). The
|
|
benefit of all this is that more systems can now be treated in the same
|
|
way. File: environ.c.
|
|
|
|
- Workaround for a weird problem with DG/UX when the wrapper is run as
|
|
nobody (i.e. fingerd). For some reason the ioctl(fd, I_FIND, "sockmod")
|
|
call fails even with socket-based applications. The "fix" is to always
|
|
assume sockets when the ioctl(fd, I_FIND, "timod") call fails. File:
|
|
fromhost.c. Thanks to Paul de Vries (vries@dutentb.et.tudelft.nl) for
|
|
helping me to figure out this one.
|
|
|
|
- Implemented a workaround for Dynix/PTX and other systems with TLI
|
|
that lack some essential support routines. Thanks to Bugs Brouillard
|
|
(brouill@hsuseq.humboldt.edu) for the hospitality to try things out.
|
|
The trick is to temporarily switch to the socket API to identify the
|
|
client, and to switch back to TLI when done. It still does not work
|
|
right for basic network services such as telnet. File: fromhost.c.
|
|
|
|
- Easy-to-build procedures for SCO UNIX, ConvexOS with UltraNet, EP/IX,
|
|
Dynix 3.2, Dynix/PTX. File: Makefile.
|
|
|
|
- Variable rfc931 timeout. Files: rfc931.c, options.c, log_tcp.h, try.c.
|
|
|
|
- Further simplification of the rfc931 code. File: rfc931.c.
|
|
|
|
- The fromhost() interface stinks: I cannot change that, but at least
|
|
the from_sock() and from_tli() functions now accept a file descriptor
|
|
argument.
|
|
|
|
- Fixed a buglet: fromhost() would pass a garbage file descriptor to
|
|
the isastream() call.
|
|
|
|
- On some systems the finger client program lives in /usr/bsd. File:
|
|
safe_finger.c.
|
|
|
|
Changes per release 6.0 (Sept 1993)
|
|
===================================
|
|
|
|
- Easy build procedures for common platforms (sun, ultrix, aix, hpux
|
|
and others).
|
|
|
|
- TLI support, System V.4 style (Solaris, DG/UX).
|
|
|
|
- Username lookup integrated with the access control language.
|
|
Selective username lookups are now the default (was: no username
|
|
lookups).
|
|
|
|
- A safer finger command for booby traps. This one solves a host of
|
|
possible problems with automatic reverse fingers. Thanks, Borja Marcos
|
|
(borjam@we.lc.ehu.es) for some inspiring discussions.
|
|
|
|
- KNOWN pattern that matches hosts whose name and address are known.
|
|
|
|
- Cleanup of diagnostics. Errors in access-control files are now shown
|
|
with file name and line number.
|
|
|
|
- With AIX 3.2, hostnames longer than 32 would be truncated. This
|
|
caused hostname verification failures, so that service would be refused
|
|
when paranoid mode was enabled. Found by: Adrian van Bloois
|
|
(A.vanBloois@info.nic.surfnet.nl).
|
|
|
|
- With some IRIX versions, remote username lookups failed because the
|
|
fgets() library function does not handle partial read()s from sockets.
|
|
Found by: Daniel O'Callaghan (danny@austin.unimelb.edu.au).
|
|
|
|
- Added a DISCLAIMER document to help you satisfy legal departments.
|
|
|
|
The extension language module has undergone major revisions and
|
|
extensions. Thanks, John P. Rouillard (rouilj@ra.cs.umb.edu) for
|
|
discussions, experiments, and for being a good guinea pig. The
|
|
extensions are documented in hosts_options.5, and are enabled by
|
|
editing the Makefile STYLE macro definition.
|
|
|
|
- (Extension language) The ":" separator may now occur within options
|
|
as long as it is protected with a backslash. A warning is issued when
|
|
a rule ends on ":".
|
|
|
|
- (Extension language) Better verification mode. When the `try' command
|
|
is run, each option function now explains what it would do.
|
|
|
|
- (Extension language) New "allow" and "deny" keywords so you can now
|
|
have all rules within a single file. See "nroff -man hosts_options.5"
|
|
for examples.
|
|
|
|
- (Extension language) "linger" keyword to set the socket linger time
|
|
(SO_LINGER). From: Marc Boucher <marc@cam.org>.
|
|
|
|
- (Extension language) "severity" keyword to turn the logging noise up
|
|
or down. Many sites wanted a means to shut up the program; other sites
|
|
wanted to emphasize specific events. Adapted from code contributed
|
|
by Dave Mitchell <D.Mitchell@dcs.shef.ac.uk>.
|
|
|
|
Changes per release 5.1 (Mar 1993)
|
|
==================================
|
|
|
|
- The additional protection against source-routing attacks from hosts
|
|
that pretend to have someone elses network address has become optional
|
|
because it causes kernel panics with SunOS <= 4.1.3.
|
|
|
|
Changes per release 5.0 (Mar 1993)
|
|
==================================
|
|
|
|
- Additional protection against source-routing attacks from hosts that
|
|
pretend to have someone elses network address. For example, the address
|
|
of a trusted host within your own network.
|
|
|
|
- The access control language has been extended with a simple but
|
|
powerful operator that greatly simplifies the design of rule sets (ALL:
|
|
.foo.edu EXCEPT dialup.foo.edu). Blank lines are permitted, and long
|
|
lines can be continued with backslash-newline.
|
|
|
|
- All configurable stuff, including path names, has been moved into the
|
|
Makefile so that you no longer have to hack source code to just
|
|
configure the programs.
|
|
|
|
- Ported to Solaris 2. TLI-based applications not yet supported.
|
|
Several workarounds for System V bugs.
|
|
|
|
- A small loophole in the netgroup lookup code was closed, and the
|
|
remote username lookup code was made more portable.
|
|
|
|
- Still more documentation. The README file now provides tutorial
|
|
sections with introductions to client, server, inetd and syslogd.
|
|
|
|
Changes per release 4.3 (Aug 1992)
|
|
==================================
|
|
|
|
- Some sites reported that connections would be rejected because
|
|
localhost != localhost.domain. The host name checking code now
|
|
special-cases localhost (problem reported by several sites).
|
|
|
|
- The programs now report an error if an existing access control file
|
|
cannot be opened (e.g. due to lack of privileges). Until now, the
|
|
programs would just pretend that the access control file does not exist
|
|
(reported by Darren Reed, avalon@coombs.anu.edu.au).
|
|
|
|
- The timeout period for remote userid lookups was upped to 30 seconds,
|
|
in order to cope with slow hosts or networks. If this is too long for
|
|
you, adjust the TIMEOUT definition in file rfc931.c (problem reported
|
|
by several sites).
|
|
|
|
- On hosts with more than one IP network interface, remote userid
|
|
lookups could use the IP address of the "wrong" local interface. The
|
|
problem and its solution were discussed on the rfc931-users mailing
|
|
list. Scott Schwartz (schwartz@cs.psu.edu) folded the fix into the
|
|
rfc931.c module.
|
|
|
|
- The result of % expansion (in shell commands) is now checked for
|
|
stuff that may confuse the shell; it is replaced by underscores
|
|
(problem reported by Icarus Sparry, I.Sparry@gdr.bath.ac.uk).
|
|
|
|
- A portability problem was fixed that caused compile-time problems
|
|
on a CRAY (problem reported by Michael Barnett, mikeb@rmit.edu.au).
|
|
|
|
Changes per release 4.0 (Jun 1992)
|
|
==================================
|
|
|
|
1 - network daemons no longer have to live within a common directory
|
|
2 - the access control code now uses both the host address and name
|
|
3 - an access control pattern that supports netmasks
|
|
4 - additional protection against forged host names
|
|
5 - a pattern that matches hosts whose name or address lookup fails
|
|
6 - an operator that prevents hosts or services from being matched
|
|
7 - optional remote username lookup with the RFC 931 protocol
|
|
8 - an optional umask to prevent the creation of world-writable files
|
|
9 - hooks for access control language extensions
|
|
10 - last but not least, thoroughly revised documentation.
|
|
|
|
Changes per release 3.0 (Oct 1991)
|
|
==================================
|
|
|
|
Enhancements over the previous release are: support for datagram (UDP
|
|
and RPC) services, and execution of shell commands when a (remote host,
|
|
requested service) pair matches a pattern in the access control tables.
|
|
|
|
Changes per release 2.0 (May 1991)
|
|
==================================
|
|
|
|
Enhancements over the previous release are: protection against rlogin
|
|
and rsh attacks through compromised domain name servers, optional
|
|
netgroup support for systems with NIS (formerly YP), and an extension
|
|
of the wild card patterns supported by the access control files.
|
|
|
|
Release 1.0 (Jan 1991)
|