1*0Sstevel@tonic-gateRequest: after building the programs, please run the `tcpdchk' wrapper 2*0Sstevel@tonic-gateconfiguration checker. See the `tcpdchk.8' manual page (`nroff -man' 3*0Sstevel@tonic-gateformat) for instructions. `tcpdchk' automatically identifies the most 4*0Sstevel@tonic-gatecommon configuration problems, and will save you and me a lot of time. 5*0Sstevel@tonic-gate 6*0Sstevel@tonic-gateChanges per release 7.6 (Mar 1997) 7*0Sstevel@tonic-gate================================== 8*0Sstevel@tonic-gate 9*0Sstevel@tonic-gate- Improved the anti source-routing protection. The code in version 10*0Sstevel@tonic-gate7.5 was not as strong as it could be, because I tried to be compatible 11*0Sstevel@tonic-gatewith Linux. That was a mistake. Sorry for the inconvenience. 12*0Sstevel@tonic-gate 13*0Sstevel@tonic-gate- The program no longer terminates case of a source-routed connection, 14*0Sstevel@tonic-gatemaking the IP-spoofing code more usable for long-running daemons. 15*0Sstevel@tonic-gate 16*0Sstevel@tonic-gate- When syslogging DNS hostname problems, always stop after a limited 17*0Sstevel@tonic-gatenumber of characters. 18*0Sstevel@tonic-gate 19*0Sstevel@tonic-gateChanges per release 7.5 (Feb 1997) 20*0Sstevel@tonic-gate================================== 21*0Sstevel@tonic-gate 22*0Sstevel@tonic-gate- Optionally refuse source-routed TCP connections requests altogether. 23*0Sstevel@tonic-gateCredits to Niels Provos of Universitaet Hamburg. File: fix_options.c. 24*0Sstevel@tonic-gate 25*0Sstevel@tonic-gate- Support for IRIX 6 (Lael Tucker). 26*0Sstevel@tonic-gate 27*0Sstevel@tonic-gate- Support for Amdahl UTS 2.1.5 (Richard E. Richmond). 28*0Sstevel@tonic-gate 29*0Sstevel@tonic-gate- Support for SINIX 5.42 (Klaus Nielsen). 30*0Sstevel@tonic-gate 31*0Sstevel@tonic-gate- SCO 5 now has vsyslog() (Bill Golden). 32*0Sstevel@tonic-gate 33*0Sstevel@tonic-gate- Hints and tips for dealing with IRIX inetd (Niko Makila, Aaron 34*0Sstevel@tonic-gateM Lee). 35*0Sstevel@tonic-gate 36*0Sstevel@tonic-gate- Support for BSD/OS (Paul Borman). 37*0Sstevel@tonic-gate 38*0Sstevel@tonic-gate- Support for Tandem (Emad Qawas). 39*0Sstevel@tonic-gate 40*0Sstevel@tonic-gate- Support for ISC (Frederick B. Cohen). 41*0Sstevel@tonic-gate 42*0Sstevel@tonic-gate- Workaround for UNICOS - it would choke on a setjmp() expression 43*0Sstevel@tonic-gate(Bruce Kelly). File: hosts_access.c, tcpdchk.c. 44*0Sstevel@tonic-gate 45*0Sstevel@tonic-gate- Increased the level of buffer overflow paranoia when printing 46*0Sstevel@tonic-gateunwanted IP options. File: fix_options.c. 47*0Sstevel@tonic-gate 48*0Sstevel@tonic-gateChanges per release 7.4 (Mar 1996) 49*0Sstevel@tonic-gate================================== 50*0Sstevel@tonic-gate 51*0Sstevel@tonic-gate- IRIX 5.3 (and possibly, earlier releases, too) library routines call 52*0Sstevel@tonic-gatethe non-reentrant strtok() routine. The result is that hosts may slip 53*0Sstevel@tonic-gatethrough allow/deny filters. Workaround is to not rely on the vendor's 54*0Sstevel@tonic-gatestrtok() routine (#ifdef LIBC_CALLS_STRTOK). Credits to Th. Eifert 55*0Sstevel@tonic-gate(Aachen University) for spotting this one. This fix supersedes the 56*0Sstevel@tonic-gateearlier workaround for a similar problem in FreeBSD 2.0. 57*0Sstevel@tonic-gate 58*0Sstevel@tonic-gateChanges per release 7.3 (Feb 1996) 59*0Sstevel@tonic-gate================================== 60*0Sstevel@tonic-gate 61*0Sstevel@tonic-gate- More tests added to tcpdchk and tcpdmatch: make sure that the 62*0Sstevel@tonic-gateREAL_DAEMON_DIR actually is a directory and not a regular file; 63*0Sstevel@tonic-gatedetect if tcpd recursively calls itself. 64*0Sstevel@tonic-gate 65*0Sstevel@tonic-gate- Edwin Kremer found an amusing fencepost error in the xgets() 66*0Sstevel@tonic-gateroutine: lines longer than BUFLEN characters would be garbled. 67*0Sstevel@tonic-gate 68*0Sstevel@tonic-gate- The access control routines now refuse to execute "dangerous" actions 69*0Sstevel@tonic-gatesuch as `twist' when they are called from within a resident process. 70*0Sstevel@tonic-gateThis prevents you from shooting yourself into the foot with critical 71*0Sstevel@tonic-gatesystems programs such as, e.g., portmap or rpcbind. 72*0Sstevel@tonic-gate 73*0Sstevel@tonic-gate- Support for Unicos 8.x (Bruce Kelly). The program now closes the 74*0Sstevel@tonic-gatesyslog client socket before running the real daemon: Cray UNICOS 75*0Sstevel@tonic-gaterefuses to checkpoint processes with open network ports. 76*0Sstevel@tonic-gate 77*0Sstevel@tonic-gate- Support for MachTen UNIX (Albert M.C Tam). 78*0Sstevel@tonic-gate 79*0Sstevel@tonic-gate- Support for Interactive UNIX R3.2 V4.0 (Bobby D. Wright). 80*0Sstevel@tonic-gate 81*0Sstevel@tonic-gate- Support for SCO 3.2v5.0.0 OpenServer 5 (bob@odt.handy.com) 82*0Sstevel@tonic-gate 83*0Sstevel@tonic-gate- Support for Unixware 1.x and Unixware 2.x. The old Unixware Makefile 84*0Sstevel@tonic-gaterule was broken. Sorry about that. 85*0Sstevel@tonic-gate 86*0Sstevel@tonic-gate- Some FreeBSD 2.0 libc routines call strtok() and severely mess up the 87*0Sstevel@tonic-gateallow/deny rule processing. This is very bad. Workaround: call our own 88*0Sstevel@tonic-gatestrtok() clone (#ifdef USE_STRSEP). 89*0Sstevel@tonic-gate 90*0Sstevel@tonic-gate- The programs now log a warning when they detect that a non-existent 91*0Sstevel@tonic-gatebanner directory is specified. 92*0Sstevel@tonic-gate 93*0Sstevel@tonic-gate- The hosts_access.3 manual page used obsolete names for the RQ_* 94*0Sstevel@tonic-gateconstants. 95*0Sstevel@tonic-gate 96*0Sstevel@tonic-gateChanges per release 7.2 (Jan 1995) 97*0Sstevel@tonic-gate================================== 98*0Sstevel@tonic-gate 99*0Sstevel@tonic-gate- Added a note to the README and manpages on using the IDENT service to 100*0Sstevel@tonic-gatedetect sequence number spoofing and other host impersonation attacks. 101*0Sstevel@tonic-gate 102*0Sstevel@tonic-gate- Portability: ConvexOS puts RPC version numbers before the daemon path 103*0Sstevel@tonic-gatename (Jukka Ukkonen). 104*0Sstevel@tonic-gate 105*0Sstevel@tonic-gate- Portability: the AIX compiler disliked the strchr() declaration 106*0Sstevel@tonic-gatein socket.c. I should have removed it when I included <string.h>. 107*0Sstevel@tonic-gate 108*0Sstevel@tonic-gate- Backwards compatibility: some people relied on the old leading dot or 109*0Sstevel@tonic-gatetrailing dot magic in daemon process names. 110*0Sstevel@tonic-gate 111*0Sstevel@tonic-gate- Backwards compatibility: hostname lookup remains enabled when 112*0Sstevel@tonic-gate-DPARANOID is turned off. In order to disable hostname lookups you 113*0Sstevel@tonic-gatemust turn off -DALWAYS_HOSTNAME. 114*0Sstevel@tonic-gate 115*0Sstevel@tonic-gate- Eliminated false complaints from the tcpdmatch/tcpdchk configuration 116*0Sstevel@tonic-gatechecking programs about process names not in inetd.conf or about KNOWN 117*0Sstevel@tonic-gateusername patterns. 118*0Sstevel@tonic-gate 119*0Sstevel@tonic-gateChanges per release 7.1 (Jan 1995) 120*0Sstevel@tonic-gate================================== 121*0Sstevel@tonic-gate 122*0Sstevel@tonic-gate- Portability: HP-UX permits you to break inetd.conf entries with 123*0Sstevel@tonic-gatebackslash-newline. 124*0Sstevel@tonic-gate 125*0Sstevel@tonic-gate- Portability: EP/IX has no putenv() and some inetd.conf entries are 126*0Sstevel@tonic-gatespread out over two lines. 127*0Sstevel@tonic-gate 128*0Sstevel@tonic-gate- Portability: SCO with NIS support has no *netgrent() routines. 129*0Sstevel@tonic-gate 130*0Sstevel@tonic-gateChanges per release 7.0 (Jan 1995) 131*0Sstevel@tonic-gate================================== 132*0Sstevel@tonic-gate 133*0Sstevel@tonic-gate- Added a last-minute workaround for a Solaris 2.4 gethostbyname() 134*0Sstevel@tonic-gatefoulup with multi-homed hosts in DNS through NIS mode. 135*0Sstevel@tonic-gate 136*0Sstevel@tonic-gate- Added a last-minute defense against TLI weirdness: address lookups 137*0Sstevel@tonic-gateapparently succeed but the result netbuf is empty (ticlts transport). 138*0Sstevel@tonic-gate 139*0Sstevel@tonic-gate- Dropped several new solutions that were in need of a problem. Beta 140*0Sstevel@tonic-gatetesters may recognize what new features were kicked out during the last 141*0Sstevel@tonic-gateweeks before release 7.0 came out. Such is life. 142*0Sstevel@tonic-gate 143*0Sstevel@tonic-gate- Got rid of out the environment replacement routines, at least for 144*0Sstevel@tonic-gatemost architectures. One should not have to replace working system 145*0Sstevel@tonic-gatesoftware when all that is needed is a 4.4BSD setenv() emulator. 146*0Sstevel@tonic-gate 147*0Sstevel@tonic-gate- By popular request I have added an option to send banner messages to 148*0Sstevel@tonic-gateclients. There is a Banners.Makefile that gives some aid for sites that 149*0Sstevel@tonic-gateare going to use this feature. John C. Wingenbach did some pioneering 150*0Sstevel@tonic-gatework here. I used to think that banners are frivolous. Now that I had 151*0Sstevel@tonic-gatea personal need for them I know that banners can be useful. 152*0Sstevel@tonic-gate 153*0Sstevel@tonic-gate- At last: an extensible functional interface to the pattern matching 154*0Sstevel@tonic-gateengine. request_init() and request_set() accept a variable-length 155*0Sstevel@tonic-gatename-value argument list. The result can be passed to hosts_access(). 156*0Sstevel@tonic-gate 157*0Sstevel@tonic-gate- When PARANOID mode is disabled (compile time), the wrapper does no 158*0Sstevel@tonic-gatehostname lookup or hostname double checks unless required by %letter 159*0Sstevel@tonic-gateexpansions, or by access control rules that match host names. This is 160*0Sstevel@tonic-gateuseful for sites that don't care about internet hostnames anyway. 161*0Sstevel@tonic-gateInspired by the authors of the firewalls and internet security book. 162*0Sstevel@tonic-gate 163*0Sstevel@tonic-gate- When PARANOID mode is disabled (compile time), hosts with a name/name 164*0Sstevel@tonic-gateor name/address conflict can be matched with the PARANOID host wildcard 165*0Sstevel@tonic-gatepattern, so that you can take some intelligent action instead of just 166*0Sstevel@tonic-gatedropping clients. Like showing a banner that explains the problem. 167*0Sstevel@tonic-gate 168*0Sstevel@tonic-gate- New percent escapes: %A expands to the server address; %H expands to 169*0Sstevel@tonic-gatethe corresponding hostname (or address if no name is available); %n and 170*0Sstevel@tonic-gate%N expand to the client and server hostname (or "unknown"); %s expands 171*0Sstevel@tonic-gateto everything we know about the server endpoint (the opposite of the %c 172*0Sstevel@tonic-gatesequence for client information). 173*0Sstevel@tonic-gate 174*0Sstevel@tonic-gate- Symmetry: server and client host information is now treated on equal 175*0Sstevel@tonic-gatefooting, so that we can reuse a lot of code. 176*0Sstevel@tonic-gate 177*0Sstevel@tonic-gate- Lazy evaluation of host names, host addresses, usernames, and so on, 178*0Sstevel@tonic-gateto avoid doing unnecessary work. 179*0Sstevel@tonic-gate 180*0Sstevel@tonic-gate- Dropping #ifdefs for some archaic systems made the code simpler. 181*0Sstevel@tonic-gate 182*0Sstevel@tonic-gate- Dropping the FAIL pattern made the pattern matcher much simpler. Run 183*0Sstevel@tonic-gatethe "tcpdchk" program to scan your access control files for any uses of 184*0Sstevel@tonic-gatethis obscure language feature. 185*0Sstevel@tonic-gate 186*0Sstevel@tonic-gate- Moving host-specific pattern matching from string_match() to the 187*0Sstevel@tonic-gatehost_match() routine made the code more accurate. Run the "tcpdchk" 188*0Sstevel@tonic-gateprogram to scan your access control files for any dependencies on 189*0Sstevel@tonic-gateundocumented or obscure language features that are gone. 190*0Sstevel@tonic-gate 191*0Sstevel@tonic-gate- daemon@host patterns trigger on clients that connect to a specific 192*0Sstevel@tonic-gateinternet address. This can be useful for service providers that offer 193*0Sstevel@tonic-gatemultiple ftp or www archives on different internet addresses, all 194*0Sstevel@tonic-gatebelonging to one and the same host (www.foo.com, ftp.bar.com, you get 195*0Sstevel@tonic-gatethe idea). Inspired by a discussion with Rop Gonggrijp, Cor Bosman, 196*0Sstevel@tonic-gateand Casper Dik, and earlier discussions with Adrian van Bloois. 197*0Sstevel@tonic-gate 198*0Sstevel@tonic-gate- The new "tcpdchk" program critcizes all your access control rules and 199*0Sstevel@tonic-gateinetd.conf entries. Great for spotting obscure bugs in my own hosts.xxx 200*0Sstevel@tonic-gatefiles. This program also detects hosts with name/address conflicts and 201*0Sstevel@tonic-gatewith other DNS-related problems. See the "tcpdchk.8" manual page. 202*0Sstevel@tonic-gate 203*0Sstevel@tonic-gate- The "tcpdmatch" program replaces the poor old "try" command. The new 204*0Sstevel@tonic-gateprogram looks in your inetd.conf file and therefore produces much more 205*0Sstevel@tonic-gateaccurate predictions. In addition, it detects hosts with name/address 206*0Sstevel@tonic-gateconflicts and with other DNS-related problems. See the "tcpdmatch.8" 207*0Sstevel@tonic-gatemanual page. The inetd.conf lookup was suggested by Everett F Batey. 208*0Sstevel@tonic-gate 209*0Sstevel@tonic-gate- In the access control tables, the `=' between option name and value 210*0Sstevel@tonic-gateis no longer required. 211*0Sstevel@tonic-gate 212*0Sstevel@tonic-gate- Added 60-second timeout to the safe_finger command, to cover another 213*0Sstevel@tonic-gatepotential problem. Suggested by Peter Wemm. 214*0Sstevel@tonic-gate 215*0Sstevel@tonic-gate- Andrew Maffei provided code that works with WIN-TCP on NCR System V.4 216*0Sstevel@tonic-gateUNIX. It reportedly works with versions 02.02.01 and 02.03.00. The code 217*0Sstevel@tonic-gatepops off all streams modules above the device driver, pushes the timod 218*0Sstevel@tonic-gatemodule to get at the peer address, and then restores the streams stack 219*0Sstevel@tonic-gateto the initial state. 220*0Sstevel@tonic-gate 221*0Sstevel@tonic-gateChanges per release 6.3 (Mar 1994) 222*0Sstevel@tonic-gate================================== 223*0Sstevel@tonic-gate 224*0Sstevel@tonic-gate- Keepalives option, to get rid of stuck daemons when people turn off 225*0Sstevel@tonic-gatetheir PC while still connected. Files: options.c, hosts_options.5. 226*0Sstevel@tonic-gate 227*0Sstevel@tonic-gate- Nice option, to calm down network daemons that take away too much CPU 228*0Sstevel@tonic-gatetime. Files: options.c, hosts_options.5. 229*0Sstevel@tonic-gate 230*0Sstevel@tonic-gate- Ultrix perversion: the environ global pointer may be null. The 231*0Sstevel@tonic-gateenvironment replacement routines now check for this. File: environ.c. 232*0Sstevel@tonic-gate 233*0Sstevel@tonic-gate- Fixed a few places that still assumed the socket is on standard 234*0Sstevel@tonic-gateinput. Fixed some error messages that did not provide access control 235*0Sstevel@tonic-gatefile name and line number. File: options.c. 236*0Sstevel@tonic-gate 237*0Sstevel@tonic-gate- Just when I was going to release 6.2 I received code for Dynix/PTX. 238*0Sstevel@tonic-gateThat code is specific to PTX 2.x, so I'll keep around my generic 239*0Sstevel@tonic-gatePTX code just in case. The difference is in the handling of UDP 240*0Sstevel@tonic-gateservices. Files: tli_sequent.[hc]. 241*0Sstevel@tonic-gate 242*0Sstevel@tonic-gateChanges per release 6.2 (Feb 1994) 243*0Sstevel@tonic-gate================================== 244*0Sstevel@tonic-gate 245*0Sstevel@tonic-gate- Resurrected my year-old code to reduce DNS load by appending a dot to 246*0Sstevel@tonic-gatethe gethostbyname() argument. This feature is still experimental and it 247*0Sstevel@tonic-gatemay go away if it causes more problems than it solves. File: socket.c. 248*0Sstevel@tonic-gate 249*0Sstevel@tonic-gate- Auxiliary code for the Pyramid, BSD universe. Karl Vogel figured out 250*0Sstevel@tonic-gatewhat was missing: yp_get_default_domain() and vfprintf(). Files: 251*0Sstevel@tonic-gateworkarounds.c, vfprintf.c. 252*0Sstevel@tonic-gate 253*0Sstevel@tonic-gate- Improved support for Dynix/PTX. The wrapper should now be able to 254*0Sstevel@tonic-gatedeal with all TLI over IP services. File: ptx.c. 255*0Sstevel@tonic-gate 256*0Sstevel@tonic-gate- The try command now uses the hostname that gethostbyaddr() would 257*0Sstevel@tonic-gatereturn, instead of the hostname returned by gethostbyname(). This can 258*0Sstevel@tonic-gatebe significant on systems with NIS that have short host names in the 259*0Sstevel@tonic-gatehosts map. For example, gethostbyname("wzv.win.tue.nl") returns 260*0Sstevel@tonic-gate"wzv.win.tue.nl"; gethostbyaddr(131.155.210.17) returns "wzv", and 261*0Sstevel@tonic-gatethat is what we should test with. File: try.c. 262*0Sstevel@tonic-gate 263*0Sstevel@tonic-gateChanges per release 6.1 (Dec 1993) 264*0Sstevel@tonic-gate================================== 265*0Sstevel@tonic-gate 266*0Sstevel@tonic-gate- Re-implemented all environment access routines. Most systems have 267*0Sstevel@tonic-gateputenv() but no setenv(), some systems have setenv() but no putenv(), 268*0Sstevel@tonic-gateand there are even systems that have neither setenv() nor putenv(). The 269*0Sstevel@tonic-gatebenefit of all this is that more systems can now be treated in the same 270*0Sstevel@tonic-gateway. File: environ.c. 271*0Sstevel@tonic-gate 272*0Sstevel@tonic-gate- Workaround for a weird problem with DG/UX when the wrapper is run as 273*0Sstevel@tonic-gatenobody (i.e. fingerd). For some reason the ioctl(fd, I_FIND, "sockmod") 274*0Sstevel@tonic-gatecall fails even with socket-based applications. The "fix" is to always 275*0Sstevel@tonic-gateassume sockets when the ioctl(fd, I_FIND, "timod") call fails. File: 276*0Sstevel@tonic-gatefromhost.c. Thanks to Paul de Vries (vries@dutentb.et.tudelft.nl) for 277*0Sstevel@tonic-gatehelping me to figure out this one. 278*0Sstevel@tonic-gate 279*0Sstevel@tonic-gate- Implemented a workaround for Dynix/PTX and other systems with TLI 280*0Sstevel@tonic-gatethat lack some essential support routines. Thanks to Bugs Brouillard 281*0Sstevel@tonic-gate(brouill@hsuseq.humboldt.edu) for the hospitality to try things out. 282*0Sstevel@tonic-gateThe trick is to temporarily switch to the socket API to identify the 283*0Sstevel@tonic-gateclient, and to switch back to TLI when done. It still does not work 284*0Sstevel@tonic-gateright for basic network services such as telnet. File: fromhost.c. 285*0Sstevel@tonic-gate 286*0Sstevel@tonic-gate- Easy-to-build procedures for SCO UNIX, ConvexOS with UltraNet, EP/IX, 287*0Sstevel@tonic-gateDynix 3.2, Dynix/PTX. File: Makefile. 288*0Sstevel@tonic-gate 289*0Sstevel@tonic-gate- Variable rfc931 timeout. Files: rfc931.c, options.c, log_tcp.h, try.c. 290*0Sstevel@tonic-gate 291*0Sstevel@tonic-gate- Further simplification of the rfc931 code. File: rfc931.c. 292*0Sstevel@tonic-gate 293*0Sstevel@tonic-gate- The fromhost() interface stinks: I cannot change that, but at least 294*0Sstevel@tonic-gatethe from_sock() and from_tli() functions now accept a file descriptor 295*0Sstevel@tonic-gateargument. 296*0Sstevel@tonic-gate 297*0Sstevel@tonic-gate- Fixed a buglet: fromhost() would pass a garbage file descriptor to 298*0Sstevel@tonic-gatethe isastream() call. 299*0Sstevel@tonic-gate 300*0Sstevel@tonic-gate- On some systems the finger client program lives in /usr/bsd. File: 301*0Sstevel@tonic-gatesafe_finger.c. 302*0Sstevel@tonic-gate 303*0Sstevel@tonic-gateChanges per release 6.0 (Sept 1993) 304*0Sstevel@tonic-gate=================================== 305*0Sstevel@tonic-gate 306*0Sstevel@tonic-gate- Easy build procedures for common platforms (sun, ultrix, aix, hpux 307*0Sstevel@tonic-gateand others). 308*0Sstevel@tonic-gate 309*0Sstevel@tonic-gate- TLI support, System V.4 style (Solaris, DG/UX). 310*0Sstevel@tonic-gate 311*0Sstevel@tonic-gate- Username lookup integrated with the access control language. 312*0Sstevel@tonic-gateSelective username lookups are now the default (was: no username 313*0Sstevel@tonic-gatelookups). 314*0Sstevel@tonic-gate 315*0Sstevel@tonic-gate- A safer finger command for booby traps. This one solves a host of 316*0Sstevel@tonic-gatepossible problems with automatic reverse fingers. Thanks, Borja Marcos 317*0Sstevel@tonic-gate(borjam@we.lc.ehu.es) for some inspiring discussions. 318*0Sstevel@tonic-gate 319*0Sstevel@tonic-gate- KNOWN pattern that matches hosts whose name and address are known. 320*0Sstevel@tonic-gate 321*0Sstevel@tonic-gate- Cleanup of diagnostics. Errors in access-control files are now shown 322*0Sstevel@tonic-gatewith file name and line number. 323*0Sstevel@tonic-gate 324*0Sstevel@tonic-gate- With AIX 3.2, hostnames longer than 32 would be truncated. This 325*0Sstevel@tonic-gatecaused hostname verification failures, so that service would be refused 326*0Sstevel@tonic-gatewhen paranoid mode was enabled. Found by: Adrian van Bloois 327*0Sstevel@tonic-gate(A.vanBloois@info.nic.surfnet.nl). 328*0Sstevel@tonic-gate 329*0Sstevel@tonic-gate- With some IRIX versions, remote username lookups failed because the 330*0Sstevel@tonic-gatefgets() library function does not handle partial read()s from sockets. 331*0Sstevel@tonic-gateFound by: Daniel O'Callaghan (danny@austin.unimelb.edu.au). 332*0Sstevel@tonic-gate 333*0Sstevel@tonic-gate- Added a DISCLAIMER document to help you satisfy legal departments. 334*0Sstevel@tonic-gate 335*0Sstevel@tonic-gateThe extension language module has undergone major revisions and 336*0Sstevel@tonic-gateextensions. Thanks, John P. Rouillard (rouilj@ra.cs.umb.edu) for 337*0Sstevel@tonic-gatediscussions, experiments, and for being a good guinea pig. The 338*0Sstevel@tonic-gateextensions are documented in hosts_options.5, and are enabled by 339*0Sstevel@tonic-gateediting the Makefile STYLE macro definition. 340*0Sstevel@tonic-gate 341*0Sstevel@tonic-gate- (Extension language) The ":" separator may now occur within options 342*0Sstevel@tonic-gateas long as it is protected with a backslash. A warning is issued when 343*0Sstevel@tonic-gatea rule ends on ":". 344*0Sstevel@tonic-gate 345*0Sstevel@tonic-gate- (Extension language) Better verification mode. When the `try' command 346*0Sstevel@tonic-gateis run, each option function now explains what it would do. 347*0Sstevel@tonic-gate 348*0Sstevel@tonic-gate- (Extension language) New "allow" and "deny" keywords so you can now 349*0Sstevel@tonic-gatehave all rules within a single file. See "nroff -man hosts_options.5" 350*0Sstevel@tonic-gatefor examples. 351*0Sstevel@tonic-gate 352*0Sstevel@tonic-gate- (Extension language) "linger" keyword to set the socket linger time 353*0Sstevel@tonic-gate(SO_LINGER). From: Marc Boucher <marc@cam.org>. 354*0Sstevel@tonic-gate 355*0Sstevel@tonic-gate- (Extension language) "severity" keyword to turn the logging noise up 356*0Sstevel@tonic-gateor down. Many sites wanted a means to shut up the program; other sites 357*0Sstevel@tonic-gatewanted to emphasize specific events. Adapted from code contributed 358*0Sstevel@tonic-gateby Dave Mitchell <D.Mitchell@dcs.shef.ac.uk>. 359*0Sstevel@tonic-gate 360*0Sstevel@tonic-gateChanges per release 5.1 (Mar 1993) 361*0Sstevel@tonic-gate================================== 362*0Sstevel@tonic-gate 363*0Sstevel@tonic-gate- The additional protection against source-routing attacks from hosts 364*0Sstevel@tonic-gatethat pretend to have someone elses network address has become optional 365*0Sstevel@tonic-gatebecause it causes kernel panics with SunOS <= 4.1.3. 366*0Sstevel@tonic-gate 367*0Sstevel@tonic-gateChanges per release 5.0 (Mar 1993) 368*0Sstevel@tonic-gate================================== 369*0Sstevel@tonic-gate 370*0Sstevel@tonic-gate- Additional protection against source-routing attacks from hosts that 371*0Sstevel@tonic-gatepretend to have someone elses network address. For example, the address 372*0Sstevel@tonic-gateof a trusted host within your own network. 373*0Sstevel@tonic-gate 374*0Sstevel@tonic-gate- The access control language has been extended with a simple but 375*0Sstevel@tonic-gatepowerful operator that greatly simplifies the design of rule sets (ALL: 376*0Sstevel@tonic-gate.foo.edu EXCEPT dialup.foo.edu). Blank lines are permitted, and long 377*0Sstevel@tonic-gatelines can be continued with backslash-newline. 378*0Sstevel@tonic-gate 379*0Sstevel@tonic-gate- All configurable stuff, including path names, has been moved into the 380*0Sstevel@tonic-gateMakefile so that you no longer have to hack source code to just 381*0Sstevel@tonic-gateconfigure the programs. 382*0Sstevel@tonic-gate 383*0Sstevel@tonic-gate- Ported to Solaris 2. TLI-based applications not yet supported. 384*0Sstevel@tonic-gateSeveral workarounds for System V bugs. 385*0Sstevel@tonic-gate 386*0Sstevel@tonic-gate- A small loophole in the netgroup lookup code was closed, and the 387*0Sstevel@tonic-gateremote username lookup code was made more portable. 388*0Sstevel@tonic-gate 389*0Sstevel@tonic-gate- Still more documentation. The README file now provides tutorial 390*0Sstevel@tonic-gatesections with introductions to client, server, inetd and syslogd. 391*0Sstevel@tonic-gate 392*0Sstevel@tonic-gateChanges per release 4.3 (Aug 1992) 393*0Sstevel@tonic-gate================================== 394*0Sstevel@tonic-gate 395*0Sstevel@tonic-gate- Some sites reported that connections would be rejected because 396*0Sstevel@tonic-gatelocalhost != localhost.domain. The host name checking code now 397*0Sstevel@tonic-gatespecial-cases localhost (problem reported by several sites). 398*0Sstevel@tonic-gate 399*0Sstevel@tonic-gate- The programs now report an error if an existing access control file 400*0Sstevel@tonic-gatecannot be opened (e.g. due to lack of privileges). Until now, the 401*0Sstevel@tonic-gateprograms would just pretend that the access control file does not exist 402*0Sstevel@tonic-gate(reported by Darren Reed, avalon@coombs.anu.edu.au). 403*0Sstevel@tonic-gate 404*0Sstevel@tonic-gate- The timeout period for remote userid lookups was upped to 30 seconds, 405*0Sstevel@tonic-gatein order to cope with slow hosts or networks. If this is too long for 406*0Sstevel@tonic-gateyou, adjust the TIMEOUT definition in file rfc931.c (problem reported 407*0Sstevel@tonic-gateby several sites). 408*0Sstevel@tonic-gate 409*0Sstevel@tonic-gate- On hosts with more than one IP network interface, remote userid 410*0Sstevel@tonic-gatelookups could use the IP address of the "wrong" local interface. The 411*0Sstevel@tonic-gateproblem and its solution were discussed on the rfc931-users mailing 412*0Sstevel@tonic-gatelist. Scott Schwartz (schwartz@cs.psu.edu) folded the fix into the 413*0Sstevel@tonic-gaterfc931.c module. 414*0Sstevel@tonic-gate 415*0Sstevel@tonic-gate- The result of % expansion (in shell commands) is now checked for 416*0Sstevel@tonic-gatestuff that may confuse the shell; it is replaced by underscores 417*0Sstevel@tonic-gate(problem reported by Icarus Sparry, I.Sparry@gdr.bath.ac.uk). 418*0Sstevel@tonic-gate 419*0Sstevel@tonic-gate- A portability problem was fixed that caused compile-time problems 420*0Sstevel@tonic-gateon a CRAY (problem reported by Michael Barnett, mikeb@rmit.edu.au). 421*0Sstevel@tonic-gate 422*0Sstevel@tonic-gateChanges per release 4.0 (Jun 1992) 423*0Sstevel@tonic-gate================================== 424*0Sstevel@tonic-gate 425*0Sstevel@tonic-gate1 - network daemons no longer have to live within a common directory 426*0Sstevel@tonic-gate2 - the access control code now uses both the host address and name 427*0Sstevel@tonic-gate3 - an access control pattern that supports netmasks 428*0Sstevel@tonic-gate4 - additional protection against forged host names 429*0Sstevel@tonic-gate5 - a pattern that matches hosts whose name or address lookup fails 430*0Sstevel@tonic-gate6 - an operator that prevents hosts or services from being matched 431*0Sstevel@tonic-gate7 - optional remote username lookup with the RFC 931 protocol 432*0Sstevel@tonic-gate8 - an optional umask to prevent the creation of world-writable files 433*0Sstevel@tonic-gate9 - hooks for access control language extensions 434*0Sstevel@tonic-gate10 - last but not least, thoroughly revised documentation. 435*0Sstevel@tonic-gate 436*0Sstevel@tonic-gateChanges per release 3.0 (Oct 1991) 437*0Sstevel@tonic-gate================================== 438*0Sstevel@tonic-gate 439*0Sstevel@tonic-gateEnhancements over the previous release are: support for datagram (UDP 440*0Sstevel@tonic-gateand RPC) services, and execution of shell commands when a (remote host, 441*0Sstevel@tonic-gaterequested service) pair matches a pattern in the access control tables. 442*0Sstevel@tonic-gate 443*0Sstevel@tonic-gateChanges per release 2.0 (May 1991) 444*0Sstevel@tonic-gate================================== 445*0Sstevel@tonic-gate 446*0Sstevel@tonic-gateEnhancements over the previous release are: protection against rlogin 447*0Sstevel@tonic-gateand rsh attacks through compromised domain name servers, optional 448*0Sstevel@tonic-gatenetgroup support for systems with NIS (formerly YP), and an extension 449*0Sstevel@tonic-gateof the wild card patterns supported by the access control files. 450*0Sstevel@tonic-gate 451*0Sstevel@tonic-gateRelease 1.0 (Jan 1991) 452