Subject: RE: Transparency of FWTK with MS Proxy 2.0

From: Malcolm Tester <[email-masked]>
Date: Mon, 15 May 2000 15:51:48 -0600

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hmm, What about the UNIX client though?  The transparency patch doesn't seem
to work with that either.  I assumed that by installing the transparency
patch, I could then use (on the internal UNIX client) the normal "ftp"
command.  I.e. "ftp ftp.some.where.com"  with the /etc/defaultrouter == the
firewall.  That doesn't work for ftp or telnet.  Which, if I can get it to
work properly, I think might go a long while to solving MS proxy's problem
too.  I'll try the ideas you described below.  Maybe I'm not understanding
the proper use of the transparency patch, too.

Regards,
Malcolm Tester

Malcolm W. Tester II
Cambric Corporation
110 West Business Park Drive
Draper, Utah 84020
http://www.cambric.com

This message is intended only for the use of the individual or entity to
whom it is addressed and may contain information that is privileged,
confidential and exempt from disclosure under applicable law.  If the reader
of this message is not the intended recipient, or the employee or agent
responsible for delivering the message to the intended recipient, you are
hereby notified that any dissemination, distribution or copying of this
communication is strictly prohibited.  If you have received this
communication in error, please delete it from your system and notify the
sender identified above by e-mail.

> -----Original Message-----
> From: Ted Keller [mailto:[email-masked]]
> Sent: Monday, May 15, 2000 3:30 PM
> To: Malcolm Tester
> Cc: [email-masked]'
> Subject: Re: Transparency of FWTK with MS Proxy 2.0
> 
> 
> Malcolm,
> 
> For ftp, the problem may be related to the data port connection.  The
> msproxy server may be wanting to use the defined port 20 - as 
> opposed to a
> negotiated high port number.  There are a set of patches in 
> the archives
> which will use the defined port number.
> 
> ted keller
> 
> 
> On Mon, 15 May 2000, Malcolm Tester wrote:
> 
> > [To be removed from this list send the message "unsubscribe 
> fwtk-users" in the
> > BODY of a mail message to [email-masked].]
> > 
> > 
> > Hi,
> > 
> > In order to accomodate my Windoze users, I need to proxy 
> client_pc->MS Proxy
> > 2.0->fwtk->outside world.  Http, https, nntp, even real 
> audio works fine.
> > However, I am running into problems with ftp and telnet.  
> On a UNIX client
> > (i.e. bypassing the MSP), I can use the gate-ftp to get out 
> fine and using
> > an expect script, I can use Telnet.  I installed the transparency
> > patch...which installed perfectly...but it doesn't seem to 
> make a difference
> > (doesn't work).  The UNIX client just hangs at Trying 
> xxx.xxx.xxx.xxx....  I
> > also installed the secondary Transparency patch, with no 
> difference, though
> > I didn't expect any since that seems to be more of a 
> compile issue.  I'm
> > assuming that when MSP tries to pass a telnet or ftp 
> connection through,
> > it's getting hung up on the firewall, which is sitting 
> there waiting for a
> > "connect" command.
> > 
> > Preferably, i would like to get the transparency patch 
> working, which I
> > assume would fix the problem.  If not though, is there some 
> other way to get
> > around it?
> > 
> > The fwtk is 2.1 running on Solaris 2.6.
> > 
> > Regards and Tia,
> > 
> > 
> > Malcolm W. Tester II
> > Cambric Corporation
> > 110 West Business Park Drive
> > Draper, Utah 84020
> > http://www.cambric.com
> > 
> > 
> > This message is intended only for the use of the individual 
> or entity to
> > whom it is addressed and may contain information that is privileged,
> > confidential and exempt from disclosure under applicable 
> law.  If the reader
> > of this message is not the intended recipient, or the 
> employee or agent
> > responsible for delivering the message to the intended 
> recipient, you are
> > hereby notified that any dissemination, distribution or 
> copying of this
> > communication is strictly prohibited.  If you have received this
> > communication in error, please delete it from your system 
> and notify the
> > sender identified above by e-mail.
> > 
>

---

From: Malcolm Tester <[email-masked]>
Date: Wed, 17 May 2000 10:47:33 -0600

A little more info on the transparency patch.  After looking at the source,
it appears that the transparancy patch only works for linux or FreeBSD type
systems.  I modified lib/hnam.c to work for Solaris, though I think it would
work for all SYSV type systems. Except maybe HPUX.  Anyway, the patch works,
as I can tell by using syslog to debug the variables.  However, the code
that calls the getdsthost() actually loops if it works properly (doesn't
loop if getdsthost() returns NULL), so I think the original transparency
patch is flawed.

Does anyone know who wrote the transparancy patch?  Maybe that person could
shed a little more light on the subject.

The modifications I made follow.  After applying the trans patch from the
fwtk.org site, edit lib/hnam.c and under the #define for Free_BSD in
getdsthost(), add this code:

#if defined(SOLARIS)
        if(getsockname(fd, (struct sockaddr*)&sin, &sl) < 0)
                return NULL;
        if(ptr)
                * ptr = ntohs(sin.sin_port);
        sprintf(buf, "%s", inet_ntoa(sin.sin_addr));
        gethostname(hostbuf, 254);
        hp = gethostbyname(hostbuf);
	  syslog(LOG_ALERT, "Checking Hostname: %s\n", hostbuf); 
        while(hp->h_addr_list[i]) {
                bzero((char*)&sin, sizeof(struct sockaddr_in));
                memcpy(&sin.sin_addr, hp->h_addr_list[i++],
                        sizeof(hp->h_addr_list[i++]));
                if(!(strcmp(buf, inet_ntoa(sin.sin_addr)) == 0))
                        local_h++;
	          syslog(LOG_ALERT, "StrCmp, count: %i, buf: %s :and inet:
%s\n", local_h, buf, inet_ntoa(sin.sin_addr));
        }
        if(local_h)
                return (NULL);
        else {
                syslog(LOG_ALERT, "Transparancy succeeded for %s", buf);
                return (buf);
        }
#endif /* SOLARIS */

regards,
Malcolm

Malcolm W. Tester II
Cambric Corporation