Subject: Re: FWTK x-gw Security Advisory [GSA2000-01]

From: pre <[email-masked]>
Date: Sat, 28 Oct 2000 12:25:01 +0100

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Whilst that may be true, mjr's coding style isn't exactly good. And he
seems to have lost the plot completly lately.

-pre

[email-masked] said:
> 
> BTW mjr warned me that x-gw is potentially dangerous
> some years ago ;) 
> a brief look at the code shows why - it is far from
> being as simple and elegant
> as other fwtk components are.. but i had no time to
> examine it closer :(

---

From: [email-masked]
Date: Tue, 31 Oct 2000 14:36:33 +0300

nuqneH,

Ok, he abused copy-block programming somehow, but it is much better than
things written by TIS/NAI after he left anyways ;).

> > as other fwtk components are.. but i had no time to

                                     _     _  _  _  _      _  _
 {::} {::} {::}  CU in Hell          _| o |_ | | _|| |   / _||_|   |_ |_ |_
 (##) (##) (##)        /Arkan#iD    |_  o  _||_| _||_| /   _|  | o |_||_||_|
 [||] [||] [||]            Do i believe in Bible? Hell,man,i've seen one!

---

From: Rick Murphy <[email-masked]>
Date: Tue, 31 Oct 2000 17:31:38 -0500

>things written by TIS/NAI after he left anyways ;).

Just FYI: Marcus didn't write all of the FWTK. I don't think any of x-gw is 
his code.
Nor is any of http-gw.

I do appreciate the 'compliment' though. Gee, I thought I wrote pretty good 
code.
Actually, I'd say that some of the firewall code written after Marcus left 
- particularly the Gauntlet for NT proxies - were quite an improvement. (I 
can say that unbiased since I didn't write any of it.)

I haven't seen Gauntlet for Unix source since 4.0 so I can't judge the 
quality. I assume you have seen recent Gauntlet source or have some other 
reason to deem the recent code not worthy. :-)
         -Rick

---

From: [email-masked]
Date: Wed, 1 Nov 2000 02:42:43 +0300 (MSK)

nuqneH,

> Just FYI: Marcus didn't write all of the FWTK. I don't think any of x-gw is 

I know. I also don't use http-gw because squid-gw looks better for me ;)

> I do appreciate the 'compliment' though. Gee, I thought I wrote pretty good 

Sorry, you misunderstood me - i was talking about http-gw (not to say http-gw
is really bad - but it looks too big for such programming style), x-gw and 
things that did not go into fwtk but are/were present in Gauntlet. 
(some are really nasty)

> can say that unbiased since I didn't write any of it.)

Sure it is possible, but..

> reason to deem the recent code not worthy. :-)

Nope, i was talking about 3.2 and 4.0 - i don't have newer code too :(
(it would be interesting to have a look, though)

                                     _     _  _  _  _      _  _

---

From: Carson Gaspar <[email-masked]>
Date: Tue, 31 Oct 2000 17:14:07 -0800

--On Tuesday, October 31, 2000 5:31 PM -0500 Rick Murphy 
<[email-masked]> wrote:

> reason to deem the recent code not worthy. :-) -Rick

I have seen it. The new code is better at first glance, but a lot of old 
bad code is still lying around. As of 5.5 (and supposedly patched 5.0 - I 
don't have patch source so I can't tell for sure), all the _really_ nasty 
things I'd found have been fixed. SMAP was still a disaster in 5.5 - it 
leaves files littering your spool directory until you manually delete them 
due to bad file locking design and clients that abort mail transmissions. 
It also doesn't log failures under various edge conditions. There were 
still signal races in some proxies as well, as I recall, but I think 
they've been patched since 5.5's release.

I will definitely agree that the 4.x code base was, ummm..., differently 
coded. :)

I have yet to do a real audit of the PDK code. At this point I'm waiting 
'till I get the 6.0 code, rather than look at 5.5 code and finding bugs 
that have already been fixed. I also have to get motivated enough to trudge 
through thread locking stuff :)

-- 
Carson Gaspar - [email-masked]
Queen trapped in a butch body

---

From: Rick Murphy <[email-masked]>
Date: Tue, 31 Oct 2000 22:06:57 -0500

>things that did not go into fwtk but are/were present in Gauntlet.

No, didn't misunderstand - just pointing out that the reality isn't so 
black and white. Someone who takes credit for fwtk gets credit for it all, 
warts included.
Just giving you a bit of a tweak. :-)
         -Rick