Subject: [fwtk-users] Destination blocking & deny-destination

From: "Michael St. Laurent" <[email-masked]>
Date: Tue, 18 Dec 2001 16:52:31 -0800

Is the deny-destination parameter documented anywhere?  I can't seem to get
it to work.  For example, I placed the following in the netperm-table file:

Http-gw:	deny-destination www.microsoft.com

However, it didn't seem to make any difference.  If someone would loan me a
clue I promise to return it.  :-)

--------------------
Michael St. Laurent
Hartwell Corporation

[root@earth] root# rm -rf /bin/laden

---
You are currently subscribed to fwtk-users as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---

From: Rick Murphy <[email-masked]>
Date: Tue, 18 Dec 2001 21:21:38 -0500

>clue I promise to return it.  :-)

That looks like a Gauntlet thing to me. The only fwtk equivalent is
http-gw: permit-hosts <host> -dest {!www.microsoft.com}
         -Rick

---

---

From: "Michael St. Laurent" <[email-masked]>
Date: Tue, 18 Dec 2001 22:29:36 -0800

Ahhh.  I got it from a post on the fwtk mailing list so I just assumed that
it wasn't a Gauntlet thing.  Oh well.  My netperm-table file is set up sort
of like this:

*:	permit-hosts	system1.hartwellcorp.com
*:	permit-hosts	system2.hartwellcorp.com
<snip>
*:	permit-hosts	system139.hartwellcorp.com

What I need to do is make entries that will block access to particular
addresses/URLs and I would very much prefer not to duplicate them on every
line.  Is there any way to do this?  If so do I need a patch?

--------------------
Michael St. Laurent
Hartwell Corporation

> -----Original Message-----
> From: Rick Murphy [mailto:[email-masked]] 
> Sent: Tuesday, December 18, 2001 6:22 PM
> To: fwtk-users
> Subject: [fwtk-users] Re: Destination blocking & deny-destination
> 
> 
> You are currently subscribed to fwtk-users as: [email-masked]

---

---

From: "Todd Williams" <[email-masked]>
Date: Wed, 19 Dec 2001 15:12:24 -0500

Hi,

What's the right format to deny access to multiple hosts and permit the
rest?

I attempted to add a few limiting entries to our netperm-table file which
would deny users access to a few websites.  I found that without warning (or
any configuration changes), http-gw starts denying traffic to other valid
web sites intermittently.  Here's what I'm using:

http-gw: permit-hosts 192.168.22.* -dest !*.pager.yahoo.com -dest
!*.icq.com -dest !login.oscar.aol.com -dest *

It would seem that the majority of the time this works fine and it does deny
traffic to the sites that are specified, but occasionally http-gw will deny
traffic to other sites that is valid ("*") and should be allowed.  Perhaps
I'm not using the configuration correctly?

I made a change to the code in hmain.c after having logged/debugged it quite
a bit, and found that the hostmatch routine was somehow not correctly
comparing "*" to "whateversites.com" for some unknown reason...  Here's what
I did that seems to have partially fixed it, at least the way my
configuration was configured.  It no longer seems to intermittently deny
valid web requests.  Warning:  This may be a bogus fix, but it seemed to
work, at least partially, in our case.

					/* - if(hostmatch(*xp, rem_server)) { - */
                                if(hostmatch(*xp, rem_server) || ( **xp ==
'*' || **xp == 0 )) {
                                        break;
                                }

>From a logical standpoint, when http-gw is comparing (-dest) destinations
(*xp) to the site requested by the user (rem_server) - if the last item is a
"*" (a "!*" is handled differently) it should be permitted to pass, and the
hostmatch call is somewhat pointless?  A permit all is a permit all, with
matching or not, right?  Maybe I missed something.  If my -dest
configuration/usage in netperm-table is incorrect, this may all be moot.

However - having said all that, I've since noticed something else odd I've
not seen before in the logging before, although it's recurrence is
infrequent.  Likely a result of the code change?  Perhaps it's not the
correct fix to the problem, but I'm still trying to figure out the problem
at this point.  Here are two examples of what I saw (multiple occurrences of
the same message both times):

Dec 18 07:56:11 proxybox http-gw[22445]: securityalert: possible spoof - DNS
lookup for address 64.90.162.92 gives name bogusns.julianhaight.com but the
reverse lookup is |^C^I
----
Dec 18 19:10:12 proxybox http-gw[21240]: securityalert: possible spoof - DNS
lookup for address 64.77.49.6 gives name nikoncoolpix.com but the reverse
lookup is |^C^I

According to what I can see in "nama.c" this should return "lookup is
unknown" but it's seems to be spitting back garbage for the reverse lookup
(rev) because of a problem with the hostmatch routine?  Anybody have any
ideas?  "rev" is found by "rev = inet_ntoa(*hp_addr);" here.

<Snipped from nama.c>
	 if(!eq) {
                        syslog(LLEV,"securityalert: possible spoof - DNS
lookup for address %.20s gives name %.512s but the reverse lookup is %.20s",
                                name,nam,rev);
                        return(namatch(pat,"unknown"));
                }
<Snipped from nama.c>

Perhaps someone can shed some light on all this and on http-gw and
using -dest to block sites properly.

TIA,

Todd

-----Original Message-----
From: Rick Murphy [mailto:[email-masked]]
Sent: Tuesday, December 18, 2001 9:22 PM
To: fwtk-users
Subject: [fwtk-users] Re: Destination blocking & deny-destination

---

---

From: [email-masked]
Date: Wed, 19 Dec 2001 19:04:29 EST

Michael,

you should be able to do a "man http-gw" to see a description of options and
parameters.  One thing that I noticed in your email is that you have a capital
'H' for http-gw (IE first character).  Not sure if that was a type-o or not, 
but you
could validate that.

You should be able to add entries as follows:

policy-http-gw:  deny-destination abc.def.ghi.jkl
policy http-gw:  deny-destination etc...
policy-http-gw:  permit-destination *

Hope this helps,

John Madincea

In a message dated 12/18/2001 7:55:54 PM Eastern Standard Time, 
[email-masked] writes:

<< Is the deny-destination parameter documented anywhere?  I can't seem to get
 it to work.  For example, I placed the following in the netperm-table file:

 
 --------------------
 Michael St. Laurent >>

---

---

From: "Michael St. Laurent" <[email-masked]>
Date: Wed, 19 Dec 2001 16:35:59 -0800

Yeah, I've read the man pages many times but there is no mention of
policy-http-gw or deny-destination anywhere in them.  Also, Rick Murphy
stated in another email to the list that FWTK does not have the
deny-destination directive.  He seemed to think it was a Gauntlet thing.  Is
this possible in your case?

--------------------
Michael St. Laurent
Hartwell Corporation

> From: [email-masked] [mailto:[email-masked]] 
> Sent: Wednesday, December 19, 2001 4:04 PM
> To: fwtk-users

---

---

From: "Michael St. Laurent" <[email-masked]>
Date: Wed, 19 Dec 2001 16:38:24 -0800

Sure enough, I tried out the entries you suggested but http-gw just ignored
them.

--------------------
Michael St. Laurent
Hartwell Corporation

---

---

From: Rick Murphy <[email-masked]>
Date: Wed, 19 Dec 2001 19:56:19 -0500

>policy-http-gw:  permit-destination *

Unfortunately, those will only work on a Gauntlet (4.x or later) system.
The fwtk doesn't have the policy stuff.
         -Rick

---

---

From: Rick Murphy <[email-masked]>
Date: Wed, 19 Dec 2001 19:52:39 -0500

>!*.icq.com -dest !login.oscar.aol.com -dest *

You can simplify that:
http-gw: permit-hosts 192.168.22.* -dest { !*.pager.yahoo.com, !*icq.com, 
!login.oscar.aol.com, * }

>work, at least partially, in our case.

That's something I haven't seen - the "*" pattern should always match.
There are some problems that happen when the remote server's reverse lookup 
doesn't work - you may be seeing one of those cases.
         -Rick

---

---

From: "Michael St. Laurent" <[email-masked]>
Date: Thu, 20 Dec 2001 10:15:37 -0800

Can the -dest !*.block.this.com be put at the end of the deny unknown?  For
example:

http-gw	deny-hosts	unknown	-dest { !*.block.this.com, * }

--------------------
Michael St. Laurent
Hartwell Corporation

> Sent: Wednesday, December 19, 2001 4:53 PM
> To: fwtk-users

---

---

From: Rick Murphy <[email-masked]>
Date: Sat, 22 Dec 2001 23:03:06 -0500

>http-gw deny-hosts      unknown -dest { !*.block.this.com, * }

That will work, but I'm not sure where it makes sense.
"deny-hosts unknown" would apply *any* time the host that you're checking 
has no valid reverse DNS. Now, it's perfectly OK to have "deny-hosts 
unknown", the problem with what you have above is that the deny happens 
before destination checking is done. Once you deny a source host, you're 
done - destination checking is never invoked.
One of the changes we did for Gauntlet was to remove all the 
source/destination checking from proxies and put it into library functions 
so that we knew that worked consistently; for fwtk, each proxy implements a 
separate "accept_setdest" function that handles the destination checking. 
That's some of the changes that lead to the different configuration lines 
we've discussed recently.
         -Rick

---