Subject: Spoof/smap question

From: Scott Campbell <[email-masked]>
Date: Wed, 8 Mar 2000 10:33:01 -0800 (PST)

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

I'm running fwtk 2.1 with the yao patch on a FreeBSD 3.2 box.  I get the
following entries in my messages file.

Mar  8 10:06:09 paperbox smap[91130]: securityalert: possible spoof
mx2-w.mail.home.com/24.0.0.206 != 24.0.0.52 name lookup mismatch
Mar  8 10:06:09 paperbox smap[91130]: connect host=unknown/24.0.0.206
Mar  8 10:06:09 paperbox /kernel: pid 91130 (smap), uid 1: exited on
signal 11

Third line exit process only happens when smap thinks that the host is
spoofed. If it can't reverse lookup the name then it accepts the mail fine
with "host=unknown/some.dot.host.ip"  I was looking through the smap
source for a variation on spoof unknown hosts and plain unknown hosts (c
isn't my strong point).

Is this suppose to happen to a possible spoof mail host? (Drop session)

Is there anyone else set up with FreeBSD who got around this problem?

Would any of the netperm-table entries create/remove this problem? (I
tryed setting "smap: unknown-host 1" without any change in the pattern.)

Thanks in advance

Scott E. Campbell
_______________________________
Computer Operations
Greater Victoria Public Library
Victoria BC CANADA

[email-masked]

---

From: [email-masked] (James Seymour)
Date: Thu, 9 Mar 2000 07:24:44 -0500 (EST)

> Date: Wed, 8 Mar 2000 10:33:01 -0800 (PST)
> From: Scott Campbell <[email-masked]>
> Subject: Spoof/smap question
> Message-ID: <[email-masked]>
> 
[snip]
> Mar  8 10:06:09 paperbox /kernel: pid 91130 (smap), uid 1: exited on
[snip]
> Is this suppose to happen to a possible spoof mail host? (Drop session)

Unlikely.  That's a SIGSEV - a signal resulting from a segment
violation. Smap tried to access memory that didn't belong to it.

[snip]
> tryed setting "smap: unknown-host 1" without any change in the pattern.)
[snip]

You've run into a bug in the code, one of the libraries it uses, your
compiler, or some combination of these.  Code is not *supposed* to
SIGSEV.  Ever.

Regards,
Jim
-- 
Jim Seymour                         | Medar, Inc.
[email-masked]                  | 24775 Crestview Ct.
Systems & Network Administrator     | Farmington Hills, MI. 48335
                                    | FAX: (248)477-8897