Subject: [fwtk-users] FWTK - GPL - Sourceforge

From: Per Gustav Ousdal <[email-masked]>
Date: Thu, 14 Feb 2002 00:24:23 +0100

If any of this (which I am pretty sure it must have) have been discussed on 
this list before I appologize for making you all bored. But it's simply too 
"wide" a subject for me to wade trough some mailinglist archive to get the 
answers :)

I just did a search on sourceforge for firewall. Sadly (IMHO) most people 
seem to think of firewall == packetfilter. I am not saying they are totaly 
wrong, they are an important *part* of one, but... ;P 

There is the occational proxy for a spesific protocoll, but what good does 
that really do? (loads of different config files with different syntax. 
different log output. Why chose one over the other? How is the code quality?, 
etc..) Really sad situation if you ask me :( Since IMHO the concept (and even 
the name) of a firewall tool kit is simply brilliant. A collection of proxies 
sharing config file/syntax and "standarized" log output.

Why isn't there a sourceforge (or similar) project for the proxies (that have 
fwtk like config syntax) that are not written by TIS?

Can TIS claim any rights to the name "FWTK"? Is it like a trademark or 
something?   

What are the chances of FWTK ever turning into ("real") open source? 

Per

---
You are currently subscribed to fwtk-users as: [email-masked]
To unsubscribe send a blank email to [email-masked]

---

From: Keith Young <[email-masked]>
Date: Wed, 13 Feb 2002 17:33:45 -0500

> fwtk like config syntax) that are not written by TIS?

The closest thing to that would be the "addon" section in www.fwtk.org. 
There are contributed proxies that mimic FWTK and (in some cases) even 
use the netperm-table.

> Can TIS claim any rights to the name "FWTK"? Is it like a trademark or 

My guess is that it would fall under Section 2A in the license agreement:
	http://www.fwtk.org/fwtk/download/downloading.html#1.3

> What are the chances of FWTK ever turning into ("real") open source? 

I'm working on it, but with today's announcement regarding Secure Computing 

buying Gauntlet/PGP, the future is definately cloudy. They may even 
decide to pull the FWTK completely....

	http://biz.yahoo.com/prnews/020213/sfw069_1.html
-- 

-- 
--Keith Young
[email-masked]

---

---

From: [email-masked]
Date: Thu, 14 Feb 2002 02:17:39 +0300 (MSK)

>  wrong, they are an important *part* of one, but... ;P 

Speaking on packet filters (being offtopic here), Darren Reed's one is 
definitely the best ;)

>  different log output. Why chose one over the other? How is the code quality?, 
It depends. There are good ones (e.g., Zorp) and bad ones (e.g. Delegate) and
tons of those that are not so clear to see, but most of them do implement a
small and repeating set of protocols :(

>  Can TIS claim any rights to the name "FWTK"? Is it like a trademark or 

Dunno, free part of my project is called OpenFWTK but it is just first name
to come to my mind and i can change it if SC says they don't like it.

>  What are the chances of FWTK ever turning into ("real") open source? 

Will see. Maybe we can get similar functionality without legacy code prior to
that. All addons can now be compiled without using original core library,
i kept backwards compatibility close to 100%.

-- 
                                     _     _  _  _  _      _  _
 {::} {::} {::}  CU in Hell          _| o |_ | | _|| |   / _||_|   |_ |_ |_
 (##) (##) (##)        /Arkan#iD    |_  o  _||_| _||_| /   _|  | o |_||_||_|
 [||] [||] [||]            Do i believe in Bible? Hell,man,i've seen one!

---

---

From: Per Gustav Ousdal <[email-masked]>
Date: Thu, 14 Feb 2002 01:33:51 +0100

On Wednesday 13 February 2002 23:33, you wrote:
> Per Gustav Ousdal wrote:
> > Why isn't there a sourceforge (or similar) project for the proxies (that
> > have fwtk like config syntax) that are not written by TIS?
>

Yup, I noticed that one. And those are pretty much the proxies I am talking 
about. Don't get me wrong: You did a fine job on fwtk.org

I'd just like to see something that stimulates and drives forward development 
a bit more. As an addition to fwtk.org.   

I understand now from Arks (Is it Ark or Arkan?) previous post why some of 
his stuff is not there yet: It contains code from TIS.

What's the story on the other stuff there? I assume that since it's there 
it's not in violation of the TIS lisence? Is the other stuff mostly GPL?  

Just thinking out loud now: Could the sources for these be put on sourceforge 
(under a common toolkit project)? (even if the original developers have 
"retired") Would it have any value to do so? 

> 	http://www.fwtk.org/fwtk/download/downloading.html#1.3

Really? How? Can someone really own the term/name "FWTK" or even "Firewall 
Tool Kit"? (I am clueless when it comes to stuff like this, (and a whole heap 
of other things :)) 

> I'm working on it, but with today's announcement regarding Secure Computing

When you say you are working on it: What exactly does that mean?

> 	http://biz.yahoo.com/prnews/020213/sfw069_1.html

Ouch! Well, if they pull it I really hope there will be an "OpenFWTK" project 
that uses Gauntlet or FWTK like syntax for the configs, etc....

Per 

---

---

From: Per Gustav Ousdal <[email-masked]>
Date: Thu, 14 Feb 2002 02:15:08 +0100

> Speaking on packet filters (being offtopic here), Darren Reed's one is

:) I assume that this has some connection to *BSD being supperior to Linux? 
Correct? :) Well, when it comes to packet filters that's my impression too. I 
use both Linux and OpenBSD (and when it comes to firewalls that translates 
into security in depth, and don't put all your eggs in one basket). 

> >  There is the occational proxy for a spesific protocoll, but what good
> > does that really do? (loads of different config files with different
> > syntax. different log output. Why chose one over the other? How is the
> > code quality?,
>
> It depends. There are good ones (e.g., Zorp) and bad ones (e.g. Delegate)
> and tons of those that are not so clear to see, but most of them do
> implement a small and repeating set of protocols :(

Ah, now you are talking "toolkits" or "suites". Yes, I am aware that there 
are a few: But most seem to have horrible code and/or they are not gpl :( I 
didn't know Zorp, but it seems it's not free software either...

Do you have an opinion on fk? (http://hairy.beasts.org/fk/) 

I am unfortunatly not in a position to tell bad code from good code. And for 
people like us having something like an OpenFWTK is the next best thing to 
auditing the code personally. That's why ideally i'd like to see a community 
behind a "OpenFWTK".   

> >  Can TIS claim any rights to the name "FWTK"? Is it like a trademark or
> >  something?
>

Hmm, free part? What's the non free part? The TIS code? Or are you 
planning/making a non-free version also?

The name is hardly original :) Although I like it, sorta like a "standard" 
these days :) But it "sums" up excatly what the "product" is about, and so 
it's a great name...

> >  What are the chances of FWTK ever turning into ("real") open source?
>
> Will see. Maybe we can get similar functionality without legacy code prior
> to that. All addons can now be compiled without using original core
> library, i kept backwards compatibility close to 100%.

That's great :) What are your opinions on Sourceforge? And if ever, would you 
be willing to put your code there? 

Per

---

---

From: Rick Murphy <[email-masked]>
Date: Wed, 13 Feb 2002 19:37:18 -0500

At 05:33 PM 2/13/02 -0500, Keith Young wrote:
I'm working on it, but with today's announcement regarding Secure Computing
>buying Gauntlet/PGP, the future is definately cloudy. They may even decide 
>to pull the FWTK completely....
>

They can't.
Trusted Information Systems obtained funding for FWTK from DARPA under the 
condition that the toolkit would always be available for noncommercial 
usage. Secure Computing can refuse to make it public domain, but they can't 
restrict it further than it's already restricted.
         -Rick

---

---

From: [email-masked]
Date: Thu, 14 Feb 2002 16:15:54 +0300

-----BEGIN PGP SIGNED MESSAGE-----

BTW *was* it sold with Gauntlet/PGP? There was nothing about it in the news.

Any known official comments from SC or NAI?

                                     _     _  _  _  _      _  _

---

---

From: Michel Bardiaux <[email-masked]>
Date: Thu, 14 Feb 2002 14:47:35 +0100

Rick Murphy wrote:
[snip]

> restrict it further than it's already restricted.

The exact meaning of "noncommercial usage" in the FWTL license is a
recurring topic of discussion, and the conclusion of past threads has
always been that it meant "usage which is not commercialization of
FWTK". In other words, you cant distribute it for money (actually not
even for free IIRC), you cant ask money for consulting related to FWTK,
things like that. *But* you can use FWTK to build a firewall through
wich transit commercial data.

But is "noncommercial usage" taken with the same meaning in DARPA
grants?

Greetings,
-- 
Michel Bardiaux
Peaktime Belgium S.A.  Rue Margot, 37  B-1457 Nil St Vincent
Tel : +32 10 65.44.15  Fax : +32 10 65.44.10

---

---

From: [email-masked]
Date: Thu, 14 Feb 2002 17:24:34 +0300

-----BEGIN PGP SIGNED MESSAGE-----

nuqneH,

> Do you have an opinion on fk? (http://hairy.beasts.org/fk/) 

Yep, a good project, we discussed wih Matthew if we can share some code,
probably authentication server comes to mind first.
 
> auditing the code personally. That's why ideally i'd like to see a community 

Sure.
 
> planning/making a non-free version also?

There are bells'n'whistles like Java GUI (yes! we solved the problem TIS/NAI
gave up: making an administration GUI that represents text configs to higher
level intuitive concepts the only and adequate way so you can even monitor on 
the fly things that go to netperm-table, without involving any intermediate
langiage as it done in Gauntlet, real transparency instead), monitoring/reporting/alert tools,
some proxies that do exist in different versions but non-free provide better 
reporting,
pre-installed system (slightly modified OpenBSD on Intel hardware, ISP1100-based)
etc etc. Nothing that improves _functionality_, but some things to improve 
ease of use and makes bundled system one product, not a buch of tools. And - 
real technical support.

I have to do something for profit, otherwise i'd be forced do do something else
and have no free time to work on the toolkit, right?
 
> be willing to put your code there? 

Maybe. Sourceforge looks good. 

                                     _     _  _  _  _      _  _

---

---

From: Tim Sailer <[email-masked]>
Date: Thu, 14 Feb 2002 09:05:41 -0500

Has anyone looked at the T-Rex v1 source from opensourcefirewall.com? The
v1 source was open, I have a copy. The rest are not. I went with that due to
the support of RADIUS, which we needed for our mandated use of CryptoCard
OTP tokens. Maybe we can borrow from that too.

Tim

On Thu, Feb 14, 2002 at 05:24:34PM +0300, [email-masked] wrote:
> -----BEGIN PGP SIGNATURE-----
> Version: PGP 6.5.1i
> 
> iQCVAwUBPGvIoaH/mIJW9LeBAQG+UAQApw2tMyikMlGpbezI+SejOC7TrkHGxi3B
> MqQ9Ujef4vmqN5qdX5ogx7i6iDrYBwNTgNFIPy+zDMnRcDHyC7Z9tTEKu1CZPOxT
> HRBtjc0XPTiH5oIGchSSM/BK1xl8loUXZ896UOJl0z6LAddw8JUTl/tBPtPktaoi
> 3KhmRw8ktVQ=
> =QFpO
> -----END PGP SIGNATURE-----
> 
> ---
> You are currently subscribed to fwtk-users as: [email-masked]

-- 
Tim Sailer <[email-masked]> 
Brookhaven National Laboratory  (631) 344-3001

---

---

From: [email-masked]
Date: Thu, 14 Feb 2002 18:07:10 +0300

-----BEGIN PGP SIGNED MESSAGE-----

Me. Huge parts c'n'p'd from fwtk _without_ keeping copyrights, that i 
definitely do not consider as a honrable thing. Even variable and function names 
are the same, just slightly different text formatting.

Another complaint one may pose is that code is huge, questionable quality
(i'd never use things like dante) and does sometimes look as bunch of 
components that differ much in design and philosophy.

rpc proxy (udprelay-based) is nice.

About Cryptocards - do you mean those ansi x9.9 thingies, why not to use them
with fwtk?

                                     _     _  _  _  _      _  _

---

---

From: Tim Sailer <[email-masked]>
Date: Thu, 14 Feb 2002 09:52:05 -0500

> are the same, just slightly different text formatting.

I never compared.

> components that differ much in design and philosophy.

I'm using pieces, not the whole 'suite'.

> About Cryptocards - do you mean those ansi x9.9 thingies, why not to use them

No support, and we have the RADIUS server in place for this function. Having
the dialup, VPN, and proxies all use the same authentication is nice.

Tim

---

---

From: [email-masked]
Date: Thu, 14 Feb 2002 18:24:55 +0300

-----BEGIN PGP SIGNED MESSAGE-----

I think it is trivial task to teach authsrv to "proxy" authentication
requests to Radius. I hope i will include this functionality in my version.

                                     _     _  _  _  _      _  _

---

---

From: Per Gustav Ousdal <[email-masked]>
Date: Thu, 14 Feb 2002 16:04:59 +0100

> probably authentication server comes to mind first.

Well, this sounds good. I just hope that you intend to keep and agree on the 
Gauntlet/FWTK style config file and syntax. And I would prefer if they also 
shared their style of reporting/logging.

If you two would agree on at last those to things: IMHO it would make a lot 
of sense to put up an OpenFWTK on sourceforge. That's basically all you have 
to agree on to do such a thing, becoz if you ever disagree on the 
implementation of a spesific proxy, and/or other stuff these could simply be 
different branches/flavours. Sure that could be a little confusing to the 
avarage user: but to find the different branches all in one place, and with 
shared config/logging sure would be a lot better than the present situation.

It would also cater for intgrating the original FWTK into the site/project 
once (if) it turns Open Source.

> There are bells'n'whistles like Java GUI (yes! we solved the problem
> TIS/NAI gave up: making an administration GUI that represents text configs
> to higher level intuitive concepts the only and adequate way so you can
> even monitor on the fly things that go to netperm-table, without involving
> any intermediate langiage as it done in Gauntlet, real transparency
> instead), monitoring/reporting/alert tools, some proxies that do exist in
> different versions but non-free provide better reporting,
> pre-installed system (slightly modified OpenBSD on Intel hardware,
> ISP1100-based) etc etc. Nothing that improves _functionality_, but some
> things to improve ease of use and makes bundled system one product, not a
> buch of tools. And - real technical support.

Sounds awesome :) And I think you would benefit from keeping the firewall 
code on sourceforge. Lots of eyes to review it, and add fixes (good for 
security), community feeling etc (Should make more people eager to buy your 
product). Ofcoz there is always the chance that someone will start making a 
free "GUI" (yes I know its more than a GUI), (maybe even under the OpenFWTK 
project?), but that's a risk that will always be there anyways: Just means 
that you have to do and even better job on your product, and have real value 
in your support :)    

> I have to do something for profit, otherwise i'd be forced do do something
> else and have no free time to work on the toolkit, right?

:) Sure, I don't have a problem with that. Just tell me if you need a 
Norwegian distributor/reseller :)

> > That's great :) What are your opinions on Sourceforge? And if ever, would
> > you be willing to put your code there?
>

Now convince Matthew and go for it :)

Per

---

---

From: [email-masked]
Date: Thu, 14 Feb 2002 20:01:18 +0300

-----BEGIN PGP SIGNED MESSAGE-----

nuqneH,

> shared their style of reporting/logging.

Unfortunately he did not like this idea, that's why we still have 2 different
projects.
 
> once (if) it turns Open Source.

Yep, but we do not even know for sure if SC obtained it with Gauntlet or not :(
And what are they going to do with it. 
 
> Norwegian distributor/reseller :)

Yep, we need. Please contact me by personal mail, we should discuss that more
closely.
 
> Now convince Matthew and go for it :)

I think i will after i clean things up a bit. But convincing Matthew is not
that easy :(

                                     _     _  _  _  _      _  _

---

---

From: Keith Young <[email-masked]>
Date: Thu, 14 Feb 2002 11:41:27 -0500

> And what are they going to do with it. 

Last time that I spoke to someone at NAI, they mentioned that the intellectual
property of the FWTK was indeed supposed to be part of the sale. I don't know if it 

was part of the final SC sale though.

-- 

-- 
--Keith Young
[email-masked]

---

---

From: Per Gustav Ousdal <[email-masked]>
Date: Thu, 14 Feb 2002 21:02:38 +0100

On Thursday 14 February 2002 18:01, you wrote:
> > Well, this sounds good. I just hope that you intend to keep and agree on
> > the Gauntlet/FWTK style config file and syntax. And I would prefer if
> > they also shared their style of reporting/logging.
>
> Unfortunately he did not like this idea, that's why we still have 2
> different projects.

Ouch! What a shame...I just think there are so many good reasons to go with 
that syntax... 

> > It would also cater for intgrating the original FWTK into the
> > site/project once (if) it turns Open Source.
>
> Yep, but we do not even know for sure if SC obtained it with Gauntlet or
> not :( And what are they going to do with it.

That's true. But I don't think that should stop the realization of an 
OpenFWTK any longer. Like I said, either way... :) 

Also, depending on the status of Keiths work: Who knows? I could be an 
advantage? But I guess only Keith is in a position to judge that.

How does SC's stand on open source? (Did a quick search on their site: at 
least there seems to be a freeware version of smartfilter for Squid)

> Yep, we need. Please contact me by personal mail, we should discuss that
> more closely.

Okeedokee, I will.

> > > > That's great :) What are your opinions on Sourceforge? And if ever,
> > > > would you be willing to put your code there?
> > >

Well, I am crossing my fingers: Problem is I have been doing so for a long 
time, seems the situation has not changed much: status of the FWTK code, lack 
of decent open source "firewall toolkit/proxy suite" and please dont't take 
any offence, I appreciate your efforts: In your case there is "always" these 
legacy code issues :)

IMHO we need an opensource FWTK now, (and have for quite some time) And if 
you have the libraries all ported to GPL code. That would be a good start for 
a project where people could contribute FWTKish proxies.

Per 

---

---

From: [email-masked]
Date: Fri, 15 Feb 2002 13:49:39 +0300

-----BEGIN PGP SIGNED MESSAGE-----

nuqneH,

Actually there is not _that_ much legacy code.

The complete list follows:
authsrv - we need new one anyways, existing lacks some semi-vital features
ftp-gw - TIS ftp-gw is ugly hack and should be replaced asap
tn-gw, 
rlogin-gw - [email-masked] is now working on ssh-gw that will probably
do tn-gw too,
netacl - pretty trivial
that's all! or did i miss something?

                                     _     _  _  _  _      _  _

---

---

From: Michel Bardiaux <[email-masked]>
Date: Fri, 15 Feb 2002 16:37:42 +0100

> a project where people could contribute FWTKish proxies.
Is it already decided that the libraries would be GPL as opposed to
LGPL? 

Greetings,

---

---

From: [email-masked]
Date: Fri, 15 Feb 2002 19:30:14 +0300

-----BEGIN PGP SIGNED MESSAGE-----

I think license will be BSD-style.

                                     _     _  _  _  _      _  _

---

---

From: Michel Bardiaux <[email-masked]>
Date: Fri, 15 Feb 2002 17:20:38 +0100

> I think license will be BSD-style.

Ouch! For the library, that's the worst of all, since it allows the
making of proprietary, *incompatible* derivatives. It might be good for
the proxies, though.

---

---

From: [email-masked]
Date: Mon, 18 Feb 2002 19:03:53 +0300

-----BEGIN PGP SIGNED MESSAGE-----

Hmm, what is the reason for one to make incompatible library instead of
using standard documented (yes, there will be something like programmers
guide and style guide for syslog and configuration etc) one ?

                                     _     _  _  _  _      _  _

---

---

From: Michel Bardiaux <[email-masked]>
Date: Mon, 18 Feb 2002 16:58:46 +0100

> guide and style guide for syslog and configuration etc) one ?

No *good* reason, nevertheless they (the makers of proprietary software)
will do it unless prevented. They can't help it, it's a deep compulsion.

---