Internet Info 1994 March/Internet Info CD-ROM (Walnut Creek) (March 1994).iso/security/log_tcp_5.0-to-5.1

Internet Message Format | 1993-03-25 | 6.7 KB

From comp.sources.misc Thu Mar 25 10:43:44 1993
Newsgroups: comp.sources.misc
Path: svin09.info.win.tue.nl!ruuinf!sun4nl!mcsun!uunet!sparky!kent
From: [e-mail] (Wietse Venema)
Subject: v36i068:  log_tcp - TCP/IP daemon wrapper, v5.0, Patch01
Message-ID: <[e-mail]>
Followup-To: comp.sources.d
X-Md4-Signature: 4dfd3a313cbdaeb28f014f5f40d570c0
Keywords: log_tcp, tcpd, tcp wrapper, frontd
Sender: [e-mail] (Kent Landfield)
Organization: Eindhoven University of Technology, The Netherlands
References: <csm-v36i004=[e-mail]>
Date: Thu, 25 Mar 1993 04:57:52 GMT
Approved: [e-mail]
Lines: 173

Submitted-by: [e-mail] (Wietse Venema)
Posting-number: Volume 36, Issue 68
Archive-name: log_tcp/patch01
Environment: UNIX
Patch-To: log_tcp: Volume 36, Issue 4-6

A bug in the SunOS 4.x implementation of the getsockopt() system call
can cause occasional kernal panics (BAD TRAP, Data fault). This happens
only when the protection against source-routing attacks is enabled. The
workaround is to disable this protection by default.

    Wietse

*** ./patchlevel.h-    Sun Mar  7 22:48:02 1993
--- ./patchlevel.h    Wed Mar 24 22:42:54 1993
***************
*** 1,3 ****
  #ifndef lint
! static char patchlevel[] = "@(#) patchlevel 5.0";
  #endif
--- 1,3 ----
  #ifndef lint
! static char patchlevel[] = "@(#) patchlevel 5.1";
  #endif
*** ./BLURB-    Sun Mar  7 22:47:51 1993
--- ./BLURB    Wed Mar 24 22:42:40 1993
***************
*** 1,4 ****
! @(#) BLURB 1.7 93/03/07 22:47:49

  With the programs that come with this kit you can monitor incoming
  requests for IP services such as TFTP, EXEC, FTP, RSH, TELNET, RLOGIN,
--- 1,4 ----
! @(#) BLURB 1.8 93/03/24 22:42:37

  With the programs that come with this kit you can monitor incoming
  requests for IP services such as TFTP, EXEC, FTP, RSH, TELNET, RLOGIN,
***************
*** 16,22 ****

  The most notable differences with respect to the previous release are:

!     - Additional protection against attacks from hosts that pretend to
      have someone elses network address. For example, the address of a
      trusted host within your own network.

--- 16,22 ----

  The most notable differences with respect to the previous release are:

!     - Optional protection against attacks from hosts that pretend to
      have someone elses network address. For example, the address of a
      trusted host within your own network.

***************
*** 38,45 ****
      - Still more documentation. The README file now provides tutorial
      sections with introductions to client, server, inetd and syslogd.

! With the exception of source routed connections, the default mode of
! operation should be backwards compatible with earlier versions.

      Wietse Venema ([e-mail]),
      Department of Mathematics and Computing Science,
--- 38,45 ----
      - Still more documentation. The README file now provides tutorial
      sections with introductions to client, server, inetd and syslogd.

! The default mode of operation should be backwards compatible with
! earlier versions.

      Wietse Venema ([e-mail]),
      Department of Mathematics and Computing Science,
*** ./README-    Sun Mar  7 22:47:27 1993
--- ./README    Wed Mar 24 22:42:51 1993
***************
*** 1,4 ****
! @(#) README 1.9 93/03/07 22:47:24


  Table of contents
--- 1,4 ----
! @(#) README 1.10 93/03/24 22:42:46


  Table of contents
***************
*** 281,287 ****
  will be disabled for all TCP connections that are handled by the
  wrapper programs.

! The feature is enabled by default. It can be turned off by editing the
  Makefile.  The configuration and installation section below describes
  the Makefile editing process.

--- 281,292 ----
  will be disabled for all TCP connections that are handled by the
  wrapper programs.

! All this cannot be used with SunOS 4.x because of a kernel bug in the
! implementation of the getsockopt() system call. Kernel panics have been
! reported for SunOS 4.1.1 and SunOS 4.1.2. The symptoms are "BAD TRAP"
! and "Data fault" while executing the tcp_ctloutput() kernel function.
!
! The feature is disabled by default. It can be turned on by editing the
  Makefile.  The configuration and installation section below describes
  the Makefile editing process.

*** ./Makefile.dist-    Sun Mar  7 22:47:46 1993
--- ./Makefile.dist    Wed Mar 24 22:42:44 1993
***************
*** 1,4 ****
! # @(#) Makefile.dist 1.1 93/03/07 22:47:45
  #
  # If you did not already do so, copy the file Makefile.dist to Makefile
  # and edit the copy, not the original. Have a copy of the README file at
--- 1,4 ----
! # @(#) Makefile.dist 1.2 93/03/24 22:42:41
  #
  # If you did not already do so, copy the file Makefile.dist to Makefile
  # and edit the copy, not the original. Have a copy of the README file at
***************
*** 272,281 ****

  PARANOID= -DPARANOID

! ##############################################
! # Turning off host ADDRESS checking (Optional)
  #
! # By default, the software tries to protect against hosts that pretend to
  # have someone elses host address. This is relevant for network services
  # whose authentication depends on host names, such as rsh and rlogin,
  # because the network address is used to look up the remote host name.
--- 272,281 ----

  PARANOID= -DPARANOID

! #############################################
! # Turning on host ADDRESS checking (Optional)
  #
! # Optionally, the software tries to protect against hosts that pretend to
  # have someone elses host address. This is relevant for network services
  # whose authentication depends on host names, such as rsh and rlogin,
  # because the network address is used to look up the remote host name.
***************
*** 286,295 ****
  # My site has been running rlogind and rshd daemons that implement this
  # feature for more than 2 years, and without any ill effects.
  #
! # Comment out the following definition if you do not need the additional
! # protection.
!
! KILL_OPT= -DKILL_IP_OPTIONS

  ## End configuration options
  ############################
--- 286,299 ----
  # My site has been running rlogind and rshd daemons that implement this
  # feature for more than 2 years, and without any ill effects.
  #
! # This feature cannot be used with SunOS 4.x because of a kernel bug in
! # the implementation of the getsockopt() system call. Kernel panics have
! # been reported for SunOS 4.1.1 and SunOS 4.1.2. Symptoms are "BAD TRAP"
! # and "Data fault" while executing the tcp_ctloutput() kernel function.
! #
! # Uncomment the following macro definition if your getsockopt() is OK.
! #
! # KILL_OPT= -DKILL_IP_OPTIONS

  ## End configuration options
  ############################

exit 0 # Just in case...