h46720
s 00002/00002/01240
d D 1.46 95/05/22 00:18:48 dhd 46 45
c 
e
s 00004/00004/01238
d D 1.45 95/05/22 00:02:36 dhd 45 44
c 
e
s 00003/00001/01239
d D 1.44 95/05/21 23:20:59 dhd 44 43
c 
e
s 00006/00000/01234
d D 1.43 95/05/21 23:17:37 dhd 43 42
c 
e
s 00013/00012/01221
d D 1.42 95/05/21 23:14:03 dhd 42 41
c 
e
s 00066/00002/01167
d D 1.41 95/05/21 23:02:27 dhd 41 40
c 
e
s 00003/00001/01166
d D 1.40 95/05/21 22:06:56 dhd 40 39
c 
e
s 00018/00002/01149
d D 1.39 95/05/21 22:04:45 dhd 39 38
c 
e
s 00010/00009/01141
d D 1.38 95/05/21 21:55:00 dhd 38 37
c 
e
s 00001/00002/01149
d D 1.37 95/05/21 20:09:16 dhd 37 36
c 
e
s 00002/00001/01149
d D 1.36 95/05/21 18:02:32 dhd 36 35
c 
e
s 00002/00002/01148
d D 1.35 95/01/23 00:05:38 dhd 35 34
c 
e
s 00000/00000/01150
d D 1.34 95/01/23 00:00:30 dhd 34 33
c 
e
s 00014/00014/01136
d D 1.33 95/01/22 23:59:04 dhd 33 32
c 
e
s 00001/00001/01149
d D 1.32 95/01/22 23:42:48 dhd 32 31
c 
e
s 00000/00003/01150
d D 1.31 95/01/22 23:38:42 dhd 31 30
c 
e
s 00002/00002/01151
d D 1.30 95/01/22 23:38:18 dhd 30 29
c 
e
s 00008/00007/01145
d D 1.29 95/01/22 23:36:48 dhd 29 28
c 
e
s 00015/00015/01137
d D 1.28 95/01/22 23:32:26 dhd 28 27
c 
e
s 00025/00007/01127
d D 1.27 95/01/22 23:26:51 dhd 27 26
c 
e
s 00040/00068/01094
d D 1.26 95/01/22 23:16:56 dhd 26 25
c 
e
s 00208/00001/00954
d D 1.25 95/01/22 23:06:21 dhd 25 24
c 
e
s 00064/00000/00891
d D 1.24 95/01/22 22:48:26 dhd 24 23
c 
e
s 00055/00008/00836
d D 1.23 95/01/22 22:26:13 dhd 23 22
c 
e
s 00037/00001/00807
d D 1.22 95/01/22 22:09:08 dhd 22 21
c 
e
s 00009/00005/00799
d D 1.21 95/01/22 21:57:10 dhd 21 20
c 
e
s 00107/00138/00697
d D 1.20 95/01/22 21:55:21 dhd 20 19
c 
e
s 00049/00035/00786
d D 1.19 95/01/22 21:25:14 dhd 19 18
c 
e
s 00085/00016/00736
d D 1.18 95/01/22 19:57:34 dhd 18 17
c 
e
s 00077/00002/00675
d D 1.17 95/01/22 19:27:34 dhd 17 16
c 
e
s 00068/00032/00609
d D 1.16 95/01/22 18:49:08 dhd 16 15
c 
e
s 00122/00007/00519
d D 1.15 95/01/22 18:07:14 dhd 15 14
c 
e
s 00010/00182/00516
d D 1.14 95/01/22 16:43:23 dhd 14 13
c 
e
s 00030/00013/00668
d D 1.13 95/01/22 16:22:27 dhd 13 12
c 
e
s 00004/00000/00677
d D 1.12 94/10/08 18:38:42 dhd 12 11
c 
e
s 00002/00002/00675
d D 1.11 94/10/08 18:26:20 dhd 11 10
c 
e
s 00002/00015/00675
d D 1.10 94/10/08 18:19:12 dhd 10 9
c 
e
s 00059/00000/00631
d D 1.9 94/08/08 02:25:43 dhd 9 8
c 
e
s 00005/00006/00626
d D 1.8 94/08/08 02:10:10 dhd 8 7
c 
e
s 00001/00001/00631
d D 1.7 94/07/26 22:24:38 dhd 7 6
c 
e
s 00000/00000/00632
d D 1.6 94/07/26 22:10:33 dhd 6 5
c 
e
s 00016/00003/00616
d D 1.5 94/07/26 22:10:10 dhd 5 4
c 
e
s 00034/00050/00585
d D 1.4 94/07/26 22:01:20 dhd 4 3
c 
e
s 00584/00001/00051
d D 1.3 94/07/26 21:30:44 dhd 3 2
c 
e
s 00047/00001/00005
d D 1.2 94/07/26 21:15:20 dhd 2 1
c 
e
s 00006/00000/00000
d D 1.1 94/07/26 20:45:55 dhd 1 0
c date and time created 94/07/26 20:45:55 by dhd
e
u
U
f e 0
t
T
I 1
% %A% %E% %
\chapter{Introduction}\label{C-intro}
\WHATID{%I% %M% %E%%
}

D 2
Some text!
E 2
I 2
ExFilter has one main r\^ole: protecting your network from another
(untrusted) network, often the Internet.

You can use ExFilter to protect parts of your network from one another,
for example to protect your personnel department's computers and files
from other parts of your organisation to help keep sensitive data
secure while still allowing the personnel department to benefit from
your corporate IT investment.

D 10
For ExFilter to be able to do its job you must create, implement and
maintain a security policy---a fantastic safe is no good if you leave
it open.

We offer you some hints on producing and implementing such a policy in
Chapter~\ref{C-security-policy}.

E 10
ExFilter can be used in conjunction with other commercial and PD
software to produce a very secure but highly usable connection to
another untrusted network.

I 4
D 7
As well as protection ExFilter can imporove the perceived performance
E 7
I 7
D 10
As well as protection ExFilter can improve the perceived performance
E 10
I 10
As well as protection, ExFilter can improve the perceived performance
E 10
E 7
of your links.

E 4
D 8
ExFilter will also help you make the links perform well, and you can
stipulate how much of each type of traffic (eg mail, FTP, news, telnet)
you want on your link to fairly share the link.  ExFilter tries to
prevent the packet traffic jams that can build up on slower links
destroying interactive performance and not adding to overall
throughput.
E 8
I 8
D 13
ExFilter will help you make your links perform well, and you can
limit how much of each type of traffic (eg mail, FTP, news, telnet) you
want on your link to fairly share the link between its users.  ExFilter
tries to prevent the packet traffic jams that can build up on slower
links that destroy interactive performance.
E 13
I 13
To do this ExFilter helps you limit how much of each type of traffic
(eg mail, FTP, news, telnet) you want on your link to fairly share the
link between its users.  ExFilter tries to prevent the packet traffic
jams that can build up on slower links that destroy interactive
performance.
E 13
E 8

ExNet itself uses ExFilter to regulate and filter its connections to
the Internet.

D 22
ExFilter runs on Sun-3s or Sun-4s under SunOS~4.1.x (Solaris 1).
E 22
I 22
D 38
ExFilter runs on Sun-3s or Sun-4s under SunOS~4.1.x (Solaris~1).
E 38
I 38
ExFilter V1.1.3 runs on Sun-3s or Sun-4s under SunOS~4.1.x
(Solaris~1).
E 38
E 22

I 4
D 14
\section{What To Do Now}
E 14
I 14
\section{Overview}
E 14
E 4

I 9
D 14
You now need to do the following things before you can use ExFilter:
E 14
I 14
You now need to do the following things to use ExFilter:
E 14
\begin{enumerate}
E 9

I 9
    \item
    Acquire your firewall machine and configure it as per our instructions
    in Chapter~\ref{C-FirewallConfig}.

    \item
    Check the distribution media you were sent, disc or tape.

D 14
    Untar it into a temporary directory (say \TOK{tmp}) and check that
D 13
    you have the following four files:
E 13
I 13
    you have the following files:
E 14
I 14
    Un\TOK{tar} it into a temporary directory (say \TOK{/tmp}) and check
    that you have the following files:
E 14
E 13
    \begin{description}

D 13
        \item[\TOK{ExFilter.sun3}] the Sun-3 executable
E 13
I 13
        \item[\TOK{ExFilter.O.sun3-SunOS-4}:] the Sun-3 executable.
E 13

D 13
        \item[\TOK{ExFilter.sun4}] the Sun-4 executable
E 13
I 13
        \item[\TOK{ExFilter.O.sun4-SunOS-4}:] the Sun-4 executable.
E 13

D 13
        \item[\TOK{dp-2.3-mod.tar.Z}] the source of the Dialup-PPP package
            with some of our modifications to make it work better with
            ExFilter.  This is not supported by us but you may find it useful.
E 13
I 13
        \item[\TOK{ExFilter.G.sun4-SunOS-4}:] the Sun-4 executable
            compiled with \TOK{gcc}; we do not officially support this
            but you may find it runs a little faster than the \TOK{.O.}
            version.
E 13

I 43
	\item[\TOK{README}:] a very quick (plain ASCII) guide to
	    ExFilter.

D 46
	\item[\TOK{tinyeg.config}:] a very small example config file
	    for ExFilter.
E 46
I 46
        \item[\TOK{tinyeg.conf}:] a very small example config file for
            ExFilter.
E 46

E 43
D 13
        \item[\TOK{100359-10.tar.Z}] Sun's jumbo STREAMS patch for
            SunOS~4.1.x.
E 13
I 13
D 18
        \item[\TOK{unsupported/dp-2.3-patchlevel2-DamonMods.tar.Z}:] the
            source of the Dialup-PPP package with some of our
            modifications to make it work better with ExFilter.  This
            is not supported by us but you may find it useful.  We use
            it for some of our own IP leased-line connections.
E 18
I 18
D 21
	\item[\TOK{unsupported/dp-2.3-patchlevel2-DamonMods.tar.Z}:]
	    the source of the publicly-available Dialup-PPP package
	    with some of our modifications to make it work better with
	    ExFilter.  This is not supported by us but you may find it
	    useful.  We use it for our own IP WAN connections.
E 21
I 21
D 23
	\item[\TOK{spec.dvi}:] the {\TeX} `device-independent' version
	    of this documentation; you can view it with a program such
	    as \MITOK{xdvi}.
E 23
I 23
        \item[\TOK{spec.dvi}:] the {\TeX} `device-independent' version
            of this documentation; you can view it with a program such
            as \MITOK{xdvi}.
E 23

        \item[\TOK{unsupported/dp-2.3-patchlevel2-DamonMods.tar.Z}:]
D 33
            the source of the publicly-available Dialup-PPP package
E 33
I 33
            the source of the publicly-available Dialup-PPP package,
E 33
            with some of our modifications to make it work better with
            ExFilter.  This is not supported by us but you may find it
            useful.  We use it for our own IP WAN connections.
E 21
E 18

        \item[\TOK{unsupported/sping}:] a simple shell script we use to
            monitor link performance; set it to ping a host on the
            other side of a link you wish to monitor and it will
            provide a simple round-trip-time histogram on any
            terminal.

D 14
        \item[\TOK{unsupported/100359-10.tar.Z}:] Sun's jumbo STREAMS
E 14
I 14
        \item[\TOK{unsupported/100359-06.tar.Z}:] Sun's jumbo STREAMS
E 14
            patch for SunOS~4.1.x.  You may wish to see if they have a
            later version or if it is unnecessary for your release of
            the OS.  It may be unnecessary for 4.1.3\_U1 and later
            releases of Solaris~1---please check with the supplier of
            your OS.
E 13

    \end{description}

    To untar it you will need to type a command such as:

    \TOK{tar xvf - /dev/rst8}

    for tape, or, for floppy disc:

    \TOK{tar xvf - /dev/rfd0}

    \item
D 27
    Make sure you have designed, implemented and understand your security
    policy.
E 27
I 27
    Make sure you have designed, implemented and understand your
    security policy.  You may need help from an external consultant, at
    least initially.  There are many good books on firewall security
    available now, too.
E 27

    \item
D 27
    Load ExFilter onto your firewall machine and configure it and the machine
    as described in Chapter~\ref{C-ExFilterConfig}.
E 27
I 27
    Load ExFilter onto your firewall machine and configure it and the
    machine as described in Chapter~\ref{C-ExFilterConfig}.
E 27

    \item
    Back up your firewall machine and reboot.

    \item
D 27
    Test the configuration doesn't let through traffic you don't want it to,
    and conversely that it does let through what you do want it to.
E 27
I 27
    Ensure the configuration doesn't let through traffic you don't want
    it to, and conversely that it does let through what you do want it
    to.
E 27

    \item
D 10
    Enjoy.

    \item
E 10
    Periodically check the logs for refused traffic, and recheck that
    your firewall is stopping what you expect it too---don't just trust
    the logs on the firewall since the first things a cracker will do is
    tamper with the logs and logging.

\end{enumerate}
E 9

I 27
\section{Basic Operation}
E 27

I 27
ExFilter runs as a root d{\ae}mon process, and attaches itself to the
raw packet interface of each device you tell it about in its
configuration file.  It then looks at every packet that arrives on each
interface and decides whether or not to route it, and if so to which
other interface, depending on the packet's source and destination
addresses, protocol type, etc.  You must configure the kernel not to
D 38
route any packets since wit would short-cut ExFilter's filtering
E 38
I 38
route any packets since with would short-cut ExFilter's filtering
E 38
mechanisms that are used to screen out harmful packets.

ExFilter uses the \MITOK{NIT} (Network Interface Tap) connection, and
so can attach to any device (eg Ethernet, PPP, SLIP) device which
carries IP packets and provides an NIT interface.


E 27
D 10




E 10
D 4

E 4
D 3

E 3
I 3
%==============================================================================
I 5
D 14
\chapter{Preparation}

D 11
\section{Getting Legit IP Addresses}
E 11
I 11
\section{Getting Valid IP Addresses}
E 11

\section{Setting up DNS}

D 11
\section{Should I run NIS on the Firewall?}
E 11
I 11
\section{NIS on the Firewall}
E 11

\section{Your Firewall Machine}

\section{Firewall Consultancy}
I 10

E 10

%==============================================================================
E 14
E 5
E 3
D 29
\chapter{Setting Up Your Firewall System}
E 29
I 29
\chapter{Setting Up Your Firewall System}\label{C-FirewallConfig}
E 29

I 3
D 15
\section{Chosing What OS Software to Load}
E 15
I 15
To make a working firewall machine you need to strip down the kernel to
contain the minimum for speed and to provide the smallest possible
number of loop-holes and flaws for a hacker to break in through.  You
will need to turn off kernel routing so that ExFilter can choose what
to allow through and what to block.
E 15

I 15
You will also need to load and configure trusted software to provide
any application-level gateways you want to provide on the gateway, for
example an SMTP email gateway and proxy versions of programs such as
Telnet and FTP\@.  You may also want to provide (for example) a public
FTP service from the gateway.

You should not provide any user accounts other than a non-root
administrator account and root itself, and you should not allow remote
access to the machine over Telnet or a similar service---once entry is
D 28
gained via any unpriviledged account root access can usually be
E 28
I 28
gained via any unprivileged account root access can usually be
E 28
D 38
obtained fairly quickly by and experienced cracker (or UNIX sysadmin).
E 38
I 38
obtained fairly quickly by an experienced cracker (or UNIX sysadmin).
E 38
You should also turn off services such as NIS that may induce a
firewall machine to believe false information supplied form an external
source.  ExFilter, for example, uses static routing and avoids services
such as NIS as far as possible to prevent remote tampering with its
configuration.

I 18
Finally, you should turn off any non-essential services, such as
d{\ae}mons running from \MITOK{inetd}.

E 18
E 15
\section{Modifying Your Kernel}

D 4
One file you may wish to modify is your \TOK{/sys/netinet/in_proto.c}
E 4
I 4
D 14
One file you may wish to modify is your \verb|/sys/netinet/in_proto.c|
E 4
file, though not strictly necessary since all the changes I have made
can be made in the kernel configuration file (set \MITOK{FW}, below),
or adjusted at boot time with some on-the-fly kernel patches.

\begin{verbatimlisting}
/* MODIFIED TO CHANGE DEFAULT NETWORKING BEHAVIOUR FOR FIREWALL M/C. */
/* @(#) in_proto.c 1.2@(#) 94/03/06 for earlgrey. */

/*
 * Copyright (c) 1982, 1986 Regents of the University of California.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms are permitted
 * provided that this notice is preserved and that due credit is given
 * to the University of California at Berkeley. The name of the University
 * may not be used to endorse or promote products derived from this
 * software without specific prior written permission. This software
 * is provided ``as is'' without express or implied warranty.
 *
 *      @(#)in_proto.c 1.20 89/06/16 SMI; from UCB 7.2 12/7/87
 */

#include <sys/param.h>
#include <sys/socket.h>
#include <sys/protosw.h>
#include <sys/domain.h>
#include <sys/mbuf.h>

#include <netinet/in.h>
#include <netinet/in_systm.h>
#include <netinet/tcp_timer.h>

/*
 * TCP/IP protocol family: IP, ICMP, UDP, TCP.
 */
int     ip_output(),ip_ctloutput();
int     ip_init(),ip_slowtimo(),ip_drain();
int     icmp_input();
int     udp_input(),udp_ctlinput();
int     udp_usrreq();
int     udp_init();
int     tcp_input(),tcp_ctlinput();
int     tcp_usrreq(),tcp_ctloutput();
int     tcp_init(),tcp_fasttimo(),tcp_slowtimo(),tcp_drain();
int     rip_input(),rip_output(),rip_ctloutput();
extern  int raw_usrreq();

#ifdef NSIP
int     idpip_input(), nsip_ctlinput();
#endif

extern  struct domain inetdomain;

struct protosw inetsw[] = {
{ 0,            &inetdomain,    0,              0,
  0,            ip_output,      0,              0,
  0,
  ip_init,      0,              ip_slowtimo,    ip_drain,
},
{ SOCK_DGRAM,   &inetdomain,    IPPROTO_UDP,    PR_ATOMIC|PR_ADDR,
  udp_input,    0,              udp_ctlinput,   ip_ctloutput,
  udp_usrreq,
  udp_init,     0,              0,              0,
},
{ SOCK_STREAM,  &inetdomain,    IPPROTO_TCP,    PR_CONNREQUIRED|PR_WANTRCVD,
  tcp_input,    0,              tcp_ctlinput,   tcp_ctloutput,
  tcp_usrreq,
  tcp_init,     tcp_fasttimo,   tcp_slowtimo,   tcp_drain,
},
{ SOCK_RAW,     &inetdomain,    IPPROTO_RAW,    PR_ATOMIC|PR_ADDR,
  rip_input,    rip_output,     0,              rip_ctloutput,
  raw_usrreq,
  0,            0,              0,              0,
},
{ SOCK_RAW,     &inetdomain,    IPPROTO_ICMP,   PR_ATOMIC|PR_ADDR,
  icmp_input,   rip_output,     0,              rip_ctloutput,
  raw_usrreq,
  0,            0,              0,              0,
},
#ifdef NSIP
{ SOCK_RAW,     &inetdomain,    IPPROTO_IDP,    PR_ATOMIC|PR_ADDR,
  idpip_input,  rip_output,     nsip_ctlinput,  0,
  raw_usrreq,
  0,            0,              0,              0,
},
#endif
        /* raw wildcard */
{ SOCK_RAW,     &inetdomain,    0,              PR_ATOMIC|PR_ADDR,
  rip_input,    rip_output,     0,              rip_ctloutput,
  raw_usrreq,
  0,            0,              0,              0,
},
};

struct domain inetdomain =
    { AF_INET, "internet", 0, 0, 0, 
      inetsw, &inetsw[sizeof(inetsw)/sizeof(inetsw[0])] };

/*
 * ip_forwarding controls whether or not to forward packets:
 *      ip_forwarding == -1  -- never forward; never change this value.
 *      ip_forwarding ==  0  -- don't forward; set this value to 1 when two
 *                              interfaces are up.
 *      ip_forwarding ==  1  -- always forward.
 */

#ifndef IPFORWARDING
#define IPFORWARDING -1
#endif
int     ip_forwarding = IPFORWARDING;

#ifndef SUBNETSARELOCAL
#define SUBNETSARELOCAL 1
#endif
int ip_subnetslocal = SUBNETSARELOCAL;

#ifndef IPSENDREDIRECTS
#define IPSENDREDIRECTS 1
#endif
int     ip_sendredirects = IPSENDREDIRECTS;

#ifndef DIRECTED_BROADCAST
#define DIRECTED_BROADCAST 1
#endif
int     ip_dirbroadcast = DIRECTED_BROADCAST;   /* "letter-bombs" */

int     ip_printfs = 0;         /* enable debug printouts */

/*
 * Default TCP Maximum Segment Size - 512 to be conservative,
 * Higher for high-performance routers
 */
int     tcp_default_mss = 512;

/*
 * Default TCP buffer sizes (in bytes)
 */
int     tcp_sendspace = 1024*4;
int     tcp_recvspace = 1024*4;

/*
 * size of "keep alive" probes.
 */
int     tcp_keeplen = 1;        /* must be nonzero for 4.2 compat- XXX */
int     tcp_ttl = TCP_TTL;      /* default time to live for TCPs */
int     tcp_nodelack = 0;       /* turn off delayed acknowledgements */
int     tcp_keepidle = TCPTV_KEEP_IDLE; /* for Keep-alives */
int     tcp_keepintvl = TCPTV_KEEPINTVL;

int     udp_cksum = 1;          /* turn on to check & generate udp checksums */
int     udp_ttl = 120;          /* default time to live for UDPs */

/*
 * Default UDP buffer sizes (in bytes)
 */
int     udp_sendspace = 9000;           /* really max datagram size */
int     udp_recvspace = 2*(9000+sizeof(struct sockaddr)); /* 2 8K dgrams */
\end{verbatimlisting}

E 14
You will almost certainly need to build a stripped down kernel to
D 38
remove the most hackable bits (such as \MI{NFS}, which you should need
anyway since a firewall must be stand-alone), and to make your systems
as small and efficient as possible.
E 38
I 38
remove the most hackable bits (such as \MI{NFS}, which you should not
need anyway since a firewall must be stand-alone), and to make your
systems as small and efficient as possible.
E 38

I 15
In general do not configure into the OS kernel module, or load or
enable any OS software from the distribution, that you do not
absolutely need (you don't {\em need} NFS or NIS for example, life is
somewhat tiresome without them, but only experienced administrators
should be on the firewall host anyway).  In particular, avoid all
software that makes your host in anyway dependent on
externally-provided information that may compromise your security.
Again, avoid NIS and NFS (and RFS, etc), server and client, don't use
\TOK{inetd}, etc.  DNS is fine if you configure it properly, and
preferably make it a primary or secondary for the network you are
protecting so that it will only get data about your network directly
D 28
from authoratitive sources.
E 28
I 28
from authoritative sources.
E 28

E 15
It is {\em vital} that you completely disable packet forwarding in the
kernel of your firewall machine else the ExFilter will be
short-circuited and no filtering or protection will be provided at
all.

D 14
An example \MI{firewall kernel} for running ExFilter on, is:
E 14
I 14
D 19
An example \MI{firewall kernel} for running ExFilter on, in this case
for a Sun-3, is:
E 19
I 19
An example \MI{firewall kernel configuration} for running ExFilter on,
in this case for a Sun-3, is:
E 19
E 14

\begin{verbatimlisting}
# @(#) FW 1.13@(#) 94/03/06 #
#
# FIREWALL KERNEL.
#   * Minimum disc-bootable kernel for Sun-3/50, Sun-3/60 or Sun-3/110.
#   * Loadable PPP 2.3 is used instead and loaded at runtime.
D 14
#   * IP forwarding should be turned off with ip_forwarding = -1 (in_proto.c).
#     We do it here too with IPFORWARDING=-1.
E 14
I 14
#   * IP forwarding is turned off here with IPFORWARDING=-1.
E 14
D 38
#   * We should also configure udp_checksum = 1 (in_proto.c).
#   * We should also expand the udp_ttl to 120 in in_proto.c.
E 38
I 38
#   * We can also configure udp_checksum = 1 (in_proto.c).
#   * We can also expand the udp_ttl to 120 in in_proto.c.
E 38
#
# EDIT ../../netinet/in_proto.c IN ../FW BY HAND BEFORE BUILDING THE KERNEL.
#
# We allocate a little more space for file handles, etc, as we will be
# running a lot of networking daemons.
#
machine         "sun3"
cpu             "SUN3_50"       # Sun-3/50
cpu             "SUN3_60"       # Sun-3/60
cpu             "SUN3_110"      # Sun-3/110

#
# Name this kernel:
#
ident           "FW1.13"

# Expanded kernel for lots of UUCP/Sendmail/etc sessions.
maxusers        32

# Turn off all kernel IP forwarding.
options "IPFORWARDING=-1"

#options        QUOTA           # disk quotas for local disks
#options        SYSACCT         # process accounting, see acct(2) & sa(8)
#options        TCPDEBUG        # TCP debugging, see trpt(8)
options CRYPT           # software encryption
options INET            # basic networking support - mandatory
options OLDSCSI         # Old SCSI architecture - mandatory
options TMPFS           # tmp (anonymous memory) file system
options UFS             # filesystem code for local disks
options VDDRV           # loadable modules

config  vmunix  root on sd0 swap on sd0

pseudo-device   pty             # pseudo-tty's, also needed for SunView
pseudo-device   ether           # basic Ethernet support
pseudo-device   loop            # loopback network - mandatory
pseudo-device   win64           # window devices, allow 64 windows
pseudo-device   dtop2           # desktops (screens), allow 2
pseudo-device   ms              # mouse support
pseudo-device   kb              # keyboard support
pseudo-device   snit            # streams NIT
pseudo-device   pf              # packet filter
pseudo-device   nbuf            # NIT buffering module
pseudo-device   clone           # clone device

# connections for machine type 2 (SUN3_50)
controller      virtual 2 at nexus ?
controller      obmem 2 at nexus ?
controller      obio 2 at nexus ?

# connections for machine type 7 (SUN3_60)
controller      virtual 7 at nexus ?
controller      obmem 7 at nexus ?
controller      obio 7 at nexus ?

# connections for machine type 4 (SUN3_110)
controller      virtual 4 at nexus ?
controller      obmem 4 at nexus ?
controller      obio 4 at nexus ?
controller      vme16d16 4 at nexus ?
controller      vme24d16 4 at nexus ?
controller      vme32d16 4 at nexus ?
controller      vme16d32 4 at nexus ?
controller      vme24d32 4 at nexus ?
controller      vme32d32 4 at nexus ?

controller      si0 at obio ? csr 0x140000 priority 2
tape            st0 at si0 drive 040 flags 1
disk            sd0 at si0 drive 000 flags 0
device          zs0 at obio ? csr 0x20000 flags 3 priority 3
device          zs1 at obio ? csr 0x00000 flags 0x103 priority 3
device          le0 at obio ? csr 0x120000 priority 3
device          cgfour0 at obmem 7 csr 0xff300000 priority 4    # 3/60
device          cgfour0 at obmem 7 csr 0xff400000 priority 4    # 3/60
#device         cgsix0 at obmem 7 csr 0xff000000 priority 4     # 3/60
device          bwtwo0 at obmem 2 csr 0x100000 priority 4       # 3/50
device          bwtwo0 at obmem 7 csr 0xff000000 priority 4     # 3/60
device          bwtwo1 at obmem 7 csr 0xff300000 priority 4     # 3/60
#device         bwtwo1 at obmem 7 csr 0xff400000                # 3/60

# 3/110 stuff not in 3/50 or 3/60 config.
# comment out the sc0 lines to save memory if you don't have a SCSI-2 board
controller      sc0 at vme24d16 ? csr 0x200000 priority 2 vector scintr 0x40
tape            st0 at sc0 drive 040 flags 1
disk            sd0 at sc0 drive 000 flags 0
disk            sd1 at sc0 drive 001 flags 0
# comment out the si0 lines to save memory if you don't have a SCSI-3 board
controller      si0 at vme24d16 ? csr 0x200000 priority 2 vector siintr 0x40
device          ie0 at obio ? csr 0xc0000 priority 3
device          cgfour0 at obmem 4 csr 0xff000000 priority 4    # 3/110
#device         bwtwo0 at obmem 4 csr 0xff000000                # 3/110
\end{verbatimlisting}

I 17
A feature of this configuration is that it is short, because not much
is configured in.

D 19
The setup for a Sun-4 is very similar.  Start with a `Generic Small'
configuration and cut away options from that, such as NFS.
E 19
I 19
The setup for a Sun-4 is very similar.  Start with a ``Generic'' or
``Generic Small'' configuration and cut away options from that, such as
NFS server and client support.
E 19


E 17
%==============================================================================
E 3
D 33
\chapter{Designing Your ExFilter Configuration}
E 33
I 33
\chapter{Designing Your ExFilter Configuration}\label{C-ExFilterConfig}
E 33

I 3
An example \MITOK{/etc/ExFilter.conf} \MI{ExFilter configuration} file
D 17
is provided below:
E 17
I 17
D 41
is provided below.
E 41
I 41
is provided below.  For an explanation of the syntax, see
Chapter~\ref{C-Ref}.
E 41
E 17

I 19
This example is constructed for the following, realistic, configuration:
D 33

E 33
\begin{itemize}

D 20
Imagine you have an internal Class-C network number 1.2.3 (this is not
a valid Class-C network) on interface \MITOK{le0} (the standard
Ethernet interface for many Suns), and a PPP link to the internet on
\MITOK{dp2}.
E 20
I 20
\item
E 20

I 20
    You have an internal Class-C network number 1.2.3 (this is not a
D 38
    valid Class-C network) that you wish to connect to the internet
E 38
I 38
    valid Class-C network) that you wish to connect to the Internet
E 38
    through ExFilter.

\item

    This network is an Ethernet on interface \MITOK{le0}, and the
    firewall's address on this network is 1.2.3.1.

\item

    You make the ExFilter program appear to be at address 1.2.3.254
D 33
    piggybacked on all interfaces.
E 33
I 33
    piggybacked on all interfaces, with standard gateway options.
E 33

\item

    You have a dial-up or permanent PPP link to the Internet on
D 33
    interface \MITOK{dp2}, via a 14,000bps (V32.b) modem.  Your
    address for \TOK{dp2} is 2.3.4.5.
E 33
I 33
D 39
    interface \MITOK{dp2}, via a~14k4bps (V32.b) modem.  Your
    address for \TOK{dp2} is~2.3.4.5.
E 39
I 39
D 45
    interface \MITOK{dp2}, via a~14k4bps (V32.b) modem.  Your address
E 45
I 45
    interface \MITOK{dp2}, via a~14k4bps (V.32b) modem.  Your address
E 45
    for \TOK{dp2} is~2.3.4.5.
    
\item

D 45
    The raw, uncompressed bandwidth available through your~V32.b modem
    with V42 (error correction alone) is a little short of~1700cps; to
E 45
I 45
    The raw, uncompressed bandwidth available through your~V.32b modem
    with V.42 (error correction alone) is a little short of~1700cps; to
E 45
    keep average delay across the link down you should `throttle'
    bandwidth to somewhat less than this (delay increases sharply as
    the throughput approaches the available bandwidth).  Note that the
    `throttle' mechanism in ExFilter pretends that each packet takes up
    about the same number of bits as if passing across an Ethernet,
    which is roughly true though sometimes an underestimate and
    sometimes an overestimate, even ignoring the effects of any modem
D 45
    compression.  Turning on (V42.b) modem compression will usually
E 45
I 45
    compression.  Turning on (V.42b) modem compression will usually
E 45
    give somewhat higher available bandwidth in return for a longer
    round-trip delay, which usually manifests itself as poorer
    interactive performance.
E 39
E 33

\item

    You are running an SMTP gateway for inbound and outbound traffic on
    the firewall machine, but allow direct connections for incoming
    traffic to the internal mailserver (\MITOK{mailhost}, 1.2.3.4) for
    efficiency.  This is reasonable since only the SMTP port is
    reachable from outside your net and you have decided your SMTP
    mailer is fairly secure.

\item
    
    You wish to allow access to Internet facilities such as \MI{WWW},
    \MI{Telnet}, \MI{FTP}, \MITOK{whois}, and \MITOK{finger} from a
    single host, \MITOK{safehost}, 1.2.3.5, whose security you control
    more tightly than most hosts so you can watch for and forestall
    potential security breaches.

\item

    You want to block and monitor any attempts by external hosts to
    pretend to be one of our external hosts, and a few other potential
    horrors.

\item

    You are initially debugging the link and want to monitor
    ExFilter activity fairly closely.

E 20
\end{itemize}

E 19
I 17
Note that a comment is a hash (\verb|#|) at the start of a line,
followed by a space and then arbitrary text.  Comments cannot be added
to the end of other lines.

E 17
\begin{verbatimlisting}
D 4
# @(#) dhdfilter.conf 1.67@(#) 94/07/23 #
# Configuration file for the dhdfilter filter/router program on exnet.

E 4
# Set verbosity at just high enough to watch throttle activity, etc.
verbosity 5

# # Set verbosity just above zero; only important things will be reported.
# verbosity 1

D 20
# Throttle data to dp2 to 1100--1400B/s including all headers (etc).
E 20
I 20
# Throttle data to dp2 to 1100--1400B/s including all IP and other headers.
E 20
# This does not allow for (for example) TCP header compression for
# outgoing PPP/SLIP links, nor all the link-level framing overhead (though
# it does include enough to cover all the Ethernet link-level headers
# and any padding), nor does it allow for retries done at the link level
# due to corruption, etc.
#
# Raw uncompressed bandwidth available on V.32b/V.42 link is about
# 1700Bps; V.42b compression should improve this marginally.
#
# To try to avoid huge delays make around 1000--1450
throttleto dp2 1300

D 4
# Set target RTT on dp2 to 250ms with b/w of 1300B/s.
# throttleto dp2 1300 250

E 4
D 20
# Try to prevent traffic to/from our Ether getting out of hand!
E 20
I 20
# Try to prevent traffic to/from our Ethernet getting out of hand!
E 20
throttleto le0 200000

D 20
# We are interested in interfaces le0 and dp2 (and poss le0 for backup).
E 20
I 20
# We are interested in interfaces le0 and dp2.
E 20
if le0
D 4
# if dp0
E 4
if dp2

I 20
# This gateway appears at address 1.2.3.254.
#
E 20
# This gateway should behave itself and decrement TTLs on all packets
# passing through it, generate ICMP error packets where appropriate,
# and discard (not route) all incoming packets addressed directly
# to the underlying interfaces on the assumption that servers on the
D 20
# host will deal with any routing necessary if any.
E 20
I 20
D 40
# host will deal with any application-level routing necessary if any.
E 40
I 40
# host will deal with any application-level routing necessary.
E 40
# The gateway will check and generate IP header checksums for packets
# in transit and generated locally, and will not route packets with IP
# header options.
E 20
I 4
#
I 20
# We do not run in `trace' mode unless we want to debug all traffic
# through the gateway for some reason.
#
E 20
D 33
# We check and generate checksums, discard IP packets with header options
# and do not enable packet tracing.
E 33
E 4
D 19
gateway 193.128.132.254 decttl icmperrs parallel chksum noopts notrace
E 19
I 19
gateway 1.2.3.254 decttl icmperrs parallel chksum noopts notrace
E 19

D 4
# Make the lower hysteresis threshold 50% of maximum traffic to give
# us plenty of elbow room before we start throttling.
#
# hysteresis 50

E 4
# -----------------------------------------------------------------------------
# ROUTING DIRECTIVES
# ==================

# Drop all packets arriving for our own interface addresses or for
# broadcast addresses, etc.
# That includes ignoring all packets arriving on our Ether interfaces
# for any machines on those nets.
#
# Beware of us getting output packets getting fed back on our input
D 20
# by nit and counted as input traffic.  We should probably do one of
# the following:
E 20
I 20
# by nit and counted as input traffic.  This will distort throttling.
I 40
# (Some packet devices do this and some don't.  Sun's le0 Ethernet
# interface and out modified dp2.3 PPP drivers don't.)
E 40
E 20
#
D 20
#   * deny and `nocount' input traffic on an interface from its own address
#   * deny the above traffic but it as output traffic
#   * ignore this traffic altogether.
#
E 20
# With the `parallel' option some of these rules are redundant and the rest
# should be logged in case of nasty surprises.
D 4
# route deny le0 any any from    any any any to  193.128.132.0 255.255.255.0 any log
E 4
#
I 4
D 19
# route deny le0 any any from any any any to 193.128.132.0 255.255.255.0 any log
E 19
I 19
# route deny le0 any any from any any any to 1.2.3.0 255.255.255.0 any log
E 19
#
E 4
D 20
# Remember not to route packets destined for any of the interfaces
# since SunOS will reply for all of them in any interface, generating
# double replies potentially.
E 20
I 20
# Remember not to route packets destined for any of the other interfaces
# since SunOS will reply for all of them on any interface, generating
# double replies potentially in some cases.
#
E 20
D 19
route deny any any any between any any any and 193.128.132.1 only any
E 19
I 19
route deny any any any between any any any and 1.2.3.1 only any
E 19
D 20
route deny any any any between any any any and 158.152.8.149 only any
route deny any any any between any any any and 158.43.71.2 only any
E 20
I 20
route deny any any any between any any any and 2.3.4.5 only any
#
E 20
# Log strangely-addressed packets.
I 20
#
E 20
route deny any any any between any any any and 127.0.0.0 255.0.0.0 any log
route deny any any any between any any any and 0.0.0.0 only any log
I 20
#
E 20
D 4
# Ignore reboot attempts.
E 4
I 4
# Ignore discless-client reboot attempts.
I 20
#
E 20
E 4
route deny any any any between any any any and 255.255.255.255 only any
I 20
#
E 20
# Ignore attempts to talk to our broadcast addresses.
I 20
#
E 20
D 19
route deny any any any between any and any and 193.128.132.0 only any log
route deny any any any between any and any and 193.128.132.255 only any log
E 19
I 19
route deny any any any between any and any and 1.2.3.0 only any log
route deny any any any between any and any and 1.2.3.255 only any log
E 19

# ---------
# Spoofing attempts
# =================
#
D 20
# Block packets apparently from internal hosts on our subnets coming
# in from the connected Internet and log such packets.
E 20
I 20
# Block packets apparently from internal hosts on our subnet coming
# in from the connected Internet and log such packets.  It may be
# attempts by crackers to cripple or steal data from some of our
# machines by pretending to be our hosts.
#
E 20
D 19
route deny dp2 any any from 193.128.132.0 255.255.255.0 any to any any any log
E 19
I 19
route deny dp2 any any from 1.2.3.0 255.255.255.0 any to any any any log
E 19
D 20
route deny dp2 any any from 193.130.14.0 255.255.255.0 any to any any any log
E 20

# ---------
# NFS and other holes
# ===================
#
D 20
# Block all attempts to reach NFS ports on our internal hosts.
E 20
I 20
# Block all attempts to reach non-privileged NFS ports on our internal hosts.
E 20
#
# Log any traffic denied this way.
I 20
#
E 20
D 19
route deny dp2 le0 udp between any any any and 193.128.132.0 255.255.255.0 2049 log 
E 19
I 19
route deny dp2 le0 udp between any any any and 1.2.3.0 255.255.255.0 2049 log 
E 19

# ---------
D 20
# NTP
# ===
#
# We handle NTP packets ASAP to incur the minimum delay in the router.
#
# Route NTP server--server packets avoiding the throttle, but still counting
# this traffic toward the throttle limit.
#
# Allow traffic through to assam, cutncurl and ntp1 only from outside.
#
# NTP servers are on port 123 and use (small) UDP packets.
# Don't log or throttle these packets as they have to be timely.
D 4
route allow dp2 le0 udp between any any 123 and 193.128.132.9 only 123 nothrottle nofragment 
route allow dp2 le0 udp between any any 123 and 193.128.132.8 only 123 nothrottle nofragment 
route allow dp2 le0 udp between any any 123 and 193.128.132.4 only 123 nothrottle nofragment 
E 4
I 4
D 19
route allow dp2 le0 udp between any any 123 and 193.128.132.9 only 123 nothrottle
route allow dp2 le0 udp between any any 123 and 193.128.132.8 only 123 nothrottle
route allow dp2 le0 udp between any any 123 and 193.128.132.4 only 123 nothrottle
E 19
I 19
route allow dp2 le0 udp between any any 123 and 1.2.3.9 only 123 nothrottle
route allow dp2 le0 udp between any any 123 and 1.2.3.8 only 123 nothrottle
route allow dp2 le0 udp between any any 123 and 1.2.3.4 only 123 nothrottle
E 19
E 4
#
# Allow ftphost to probe other machines' NTP with ntptrace, ie any unpriv
# port on ftphost can talk to port 123 for UDP on any other host.
D 4
route allow dp2 le0 udp between any any 123 and 193.128.132.6 only nonpriv nothrottle nofragment 
E 4
I 4
D 19
route allow dp2 le0 udp between any any 123 and 193.128.132.6 only nonpriv nothrottle
E 19
I 19
route allow dp2 le0 udp between any any 123 and 1.2.3.6 only nonpriv nothrottle
E 19
E 4

D 4
#
# Allow Piete Brooks' swan.cl.cam.ac.uk talk to port 123 on
# ntp1 from any port.
route allow dp2 le0 udp between 128.232.0.56 only any and 193.128.132.9 only 123 nothrottle nofragment 
#
# Also allow ursa.cus.cam.ac.uk by special request of Piete Brooks:
# > Nice if you also allowed ursa.cus.cam.ac.uk, as that does the continuous
# > polling of UK NTP clocks, *BUT* it is available to all members of the
# > University, including some undergraduates.
route allow dp2 le0 udp between 131.111.8.6 only any and 193.128.132.9 only 123 nothrottle nofragment 

E 4
# ---------
# OUR PPP CUSTOMERS
# =================
#
# Allow packets through to all ports on all 193.130.14 hosts.  Only allow then
# 75% of our bandwidth.
D 4
route allow dp2 le0 any between any any any and 193.130.14.0 255.255.255.0 any throttle75 fragment 
E 4
I 4
route allow dp2 le0 any between any any any and 193.130.14.0 255.255.255.0 any throttle75
E 4

# ---------
E 20
# WWW
# ===
#
D 20
# Allow WWW packets to/from ftphost for calls originated on ftphost,
E 20
I 20
# Allow WWW packets to/from safehost for calls originated on safehost,
E 20
D 33
# ie allow tcp packets to or from port 80 on any external machine to
E 33
I 33
# ie allow hhtpd packets to or from port 80 on any external machine to
E 33
D 20
# any non-priv port on ftphost.
E 20
I 20
# any non-priv port on safehost.
E 20
#
# Limit to 50% of traffic when throttled.
D 4
route allow dp2 le0 tcp between any any 80 and 193.128.132.6 only nonpriv throttle50 fragment
E 4
I 4
D 19
route allow dp2 le0 tcp between any any 80 and 193.128.132.6 only nonpriv throttle50
E 19
I 19
D 20
route allow dp2 le0 tcp between any any 80 and 1.2.3.6 only nonpriv throttle50
E 20
I 20
route allow dp2 le0 tcp between any any 80 and 1.2.3.5 only nonpriv throttle50
E 20
E 19
E 4

# ---------
# TELNET/FTP
# ==========
#
D 20
# Allow telnet packets to/from ftphost for calls originated on ftphost,
E 20
I 20
# Allow telnet packets to/from safehost for calls originated on safehost,
E 20
# ie allow tcp packets to or from port 23 on any external machine to
D 20
# any non-priv port on ftphost.
E 20
I 20
# any non-priv port on safehost.
E 20
#
# Limit to 50% of traffic when throttled.
D 4
route allow dp2 le0 tcp between any any 23 and 193.128.132.6 only nonpriv throttle50 fragment
E 4
I 4
D 19
route allow dp2 le0 tcp between any any 23 and 193.128.132.6 only nonpriv throttle50
E 19
I 19
D 20
route allow dp2 le0 tcp between any any 23 and 1.2.3.6 only nonpriv throttle50
E 20
E 19
E 4
#
I 20
route allow dp2 le0 tcp between any any 23 and 1.2.3.5 only nonpriv throttle50
#
E 20
# Similarly for ftp on port 21 (and ftp-data on port 20)
#
# Limit to 50% of traffic when throttled.
D 4
route allow dp2 le0 tcp between any any 20 and 193.128.132.6 only nonpriv throttle50 fragment
route allow dp2 le0 tcp between any any 21 and 193.128.132.6 only nonpriv throttle50 fragment
E 4
I 4
D 19
route allow dp2 le0 tcp between any any 20 and 193.128.132.6 only nonpriv throttle50
route allow dp2 le0 tcp between any any 21 and 193.128.132.6 only nonpriv throttle50
E 19
I 19
D 20
route allow dp2 le0 tcp between any any 20 and 1.2.3.6 only nonpriv throttle50
route allow dp2 le0 tcp between any any 21 and 1.2.3.6 only nonpriv throttle50
E 20
I 20
route allow dp2 le0 tcp between any any 20 and 1.2.3.5 only nonpriv throttle50
route allow dp2 le0 tcp between any any 21 and 1.2.3.5 only nonpriv throttle50
E 20
E 19
E 4

# ---------
# FINGER/WHOIS
# ============
#
# Limit to 10% of traffic when throttled.
#
D 20
# Allow users on ftphost to finger any remote host.
D 4
route allow dp2 le0 tcp between any any 79 and 193.128.132.6 only nonpriv throttle10 fragment
E 4
I 4
D 19
route allow dp2 le0 tcp between any any 79 and 193.128.132.6 only nonpriv throttle10
E 19
I 19
route allow dp2 le0 tcp between any any 79 and 1.2.3.6 only nonpriv throttle10
E 20
I 20
# Allow users on safehost to finger any remote host.
E 20
E 19
E 4
#
I 20
route allow dp2 le0 tcp between any any 79 and 1.2.3.5 only nonpriv throttle10
#
E 20
# Similarly for whois on port 43.
D 4
route allow dp2 le0 tcp between any any 43 and 193.128.132.6 only nonpriv throttle10 fragment
E 4
I 4
D 19
route allow dp2 le0 tcp between any any 43 and 193.128.132.6 only nonpriv throttle10
E 19
I 19
D 20
route allow dp2 le0 tcp between any any 43 and 1.2.3.6 only nonpriv throttle10
E 20
I 20
#
route allow dp2 le0 tcp between any any 43 and 1.2.3.5 only nonpriv throttle10
E 20
E 19
E 4

# ---------
# MAIL
# ====
#
D 20
# Allow mail directly to the SMTP mailer on assam (tcp->port 25).
# This means not all mail will appear in the logs on mailgate.
E 20
I 20
# Allow mail directly to the SMTP mailer on mailhost (tcp->port 25).
E 20
#
# Mail does not have to be super-high-speed and so is limited to a lowish
# bandwidth.
#
# Limit to 15% of traffic when throttled.
D 4
route allow dp2 le0 tcp between any any any and 193.128.132.4 only 25 throttle15 fragment
E 4
I 4
D 19
route allow dp2 le0 tcp between any any any and 193.128.132.4 only 25 throttle15
E 19
I 19
D 20
route allow dp2 le0 tcp between any any any and 1.2.3.4 only 25 throttle15
E 20
E 19
E 4
#
D 20
# Also allow mail from assam (from a non-priv port) to any port 25.
# We have to assume that we have already screened out attacks on
# X-Windows, NFS, etc, by this point.
#
# Limit to 15% of traffic when throttled.
D 4
route allow dp2 le0 tcp between any any 25 and 193.128.132.4 only nonpriv throttle15 fragment
E 4
I 4
D 19
route allow dp2 le0 tcp between any any 25 and 193.128.132.4 only nonpriv throttle15
E 19
I 19
route allow dp2 le0 tcp between any any 25 and 1.2.3.4 only nonpriv throttle15
E 20
I 20
route allow dp2 le0 tcp between any any any and 1.2.3.4 only 25 throttle15
E 20
E 19
E 4

# ---------
D 20
# UUCP
# ====
#
# Allow UUCP/TCP directly from assam to slxsys/Nibmpcug.
#
# This should only be for backup newsfeeds and is low priority and therefore
# only gets a low percentage of bandwidth.
#
# Limit to 15% of traffic when throttled.
D 4
route allow dp2 le0 tcp between 192.65.144.4 only 540 and 193.128.132.4 only nonpriv throttle15 fragment
route allow dp2 le0 tcp between 192.68.174.65 only 540 and 193.128.132.4 only nonpriv throttle15 fragment
E 4
I 4
D 19
route allow dp2 le0 tcp between 192.65.144.4 only 540 and 193.128.132.4 only nonpriv throttle15
route allow dp2 le0 tcp between 192.68.174.65 only 540 and 193.128.132.4 only nonpriv throttle15
E 19
I 19
route allow dp2 le0 tcp between 192.65.144.4 only 540 and 1.2.3.4 only nonpriv throttle15
route allow dp2 le0 tcp between 192.68.174.65 only 540 and 1.2.3.4 only nonpriv throttle15
E 19
E 4

# ---------
# NNTP
# ====
#
# Allow NNTP/TCP directly to assam from any Pipex internal node.
#
# Limit to 60% of traffic when throttled.
# Note: n% of 1200cps = nMB/day.
D 4
route allow dp2 le0 tcp between 158.43.128.0 255.255.128.0 nonpriv and 193.128.132.4 only 119 throttle60 fragment
E 4
I 4
D 19
route allow dp2 le0 tcp between 158.43.128.0 255.255.128.0 nonpriv and 193.128.132.4 only 119 throttle60
E 19
I 19
route allow dp2 le0 tcp between 158.43.128.0 255.255.128.0 nonpriv and 1.2.3.4 only 119 throttle60
E 19
E 4
#
# Allow any non-priv port on assam to talk to the nntp port on news.bbc.co.uk
# and *.pipex.net to deliver news with nntpxmit or nntplink.
#
# Limit to 25% of (outgoing) traffic.  Should generally only need to be
# downstream postings to volume need not be large (and should be much
# less than incoming volume for example).
#
D 4
route allow dp2 le0 tcp between 158.43.128.0 255.255.128.0 119 and 193.128.132.4 only nonpriv throttle25 fragment
route allow dp2 le0 tcp between 132.185.132.10 only 119 and 193.128.132.4 only nonpriv throttle25 fragment
E 4
I 4
D 19
route allow dp2 le0 tcp between 158.43.128.0 255.255.128.0 119 and 193.128.132.4 only nonpriv throttle25
route allow dp2 le0 tcp between 132.185.132.10 only 119 and 193.128.132.4 only nonpriv throttle25
E 19
I 19
route allow dp2 le0 tcp between 158.43.128.0 255.255.128.0 119 and 1.2.3.4 only nonpriv throttle25
route allow dp2 le0 tcp between 132.185.132.10 only 119 and 1.2.3.4 only nonpriv throttle25
E 19
E 4

# ---------
# ICMP `semi-dangerous'
# ====
#
# Assuming we have anti-spoofing in action above so external nasty people
# can't quench or upset or divert traffic between our own machines, allow
# them to quench and announce `unreachables' to our hosts.  Don't bother
# with time exceeded (type 11) or parameter problem (type 12) as these
D 5
# are not a frequent occurence.
E 5
I 5
# are not a frequent occurrence.
E 5
# THIS SHOULD BE REVIEWED SINCE IT STILL ALLOWS DENIAL-OF-SERVICE ATTACKS.
#
# Do *NOT* allow redirect messages (type 5) at all.
#
# Allow Source Quench (type 4), Unreachable (type 3).
# We should be able to specify these with a range 3--4 in the port part
# but the syntax doesn't allow that yet.
#
D 5
# Also, only allow these messages htrough to hosts that should be
# processing IP connections to the connected net frequenctly, ie
E 5
I 5
# Also, only allow these messages through to hosts that should be
# processing IP connections to the connected net frequently, ie
E 5
# news, mail and ftp servers.  For the moment allow this to all internal
# hosts for simplicity---the security risk is minimal.
#
# Allow the messages in both directions.
#
# Limit to 1% (!) of traffic.
D 4
route allow dp2 le0 icmp between any any 3 and 193.128.132.0 255.255.255.0 3 throttle1 nofragment
route allow dp2 le0 icmp between any any 4 and 193.128.132.0 255.255.255.0 4 throttle1 nofragment
E 4
I 4
D 19
route allow dp2 le0 icmp between any any 3 and 193.128.132.0 255.255.255.0 3 throttle1
route allow dp2 le0 icmp between any any 4 and 193.128.132.0 255.255.255.0 4 throttle1
E 19
I 19
route allow dp2 le0 icmp between any any 3 and 1.2.3.0 255.255.255.0 3 throttle1
route allow dp2 le0 icmp between any any 4 and 1.2.3.0 255.255.255.0 4 throttle1
E 19
E 4

# ---------
E 20
# PING
# ====
#
# This should be nearly last on the list so as to measure worst-case
D 20
# performance from this software.
E 20
I 20
# performance from the network and ExFilter.
E 20
#
D 20
# Allow Echo and Echo Reply messages between anywhere and anywhere in our net.
E 20
I 20
# Allow pings to and from anywhere.
E 20
#
D 30
# Limit to 10% of traffic when throttled.
E 30
I 30
# Note that ICMP traffic cannot be throttled.
E 30
I 20
#
E 20
D 4
route allow dp2 le0 icmp between any any nonpriv and 193.128.132.0 255.255.255.0 nonpriv throttle10 nofragment
E 4
I 4
D 19
route allow dp2 le0 icmp between any any nonpriv and 193.128.132.0 255.255.255.0 nonpriv throttle10
E 19
I 19
D 30
route allow dp2 le0 icmp between any any nonpriv and 1.2.3.0 255.255.255.0 nonpriv throttle10
E 30
I 30
route allow dp2 le0 icmp between any any nonpriv and 1.2.3.0 255.255.255.0 nonpriv
E 30
E 19
E 4

# -----------------------------------------------------------------------------
# THINGS THAT SHOULDN'T GO THROUGH...

D 20
# Ignore attempts to contact our internal name servers.
E 20
I 20
# Block attempts to contact our internal DNS name servers.
#
E 20
D 4
route deny any any any between any any any and 193.128.132.0 255.255.255.0 53 nothrottle nofragment
E 4
I 4
D 19
route deny any any any between any any any and 193.128.132.0 255.255.255.0 53 nothrottle
E 19
I 19
route deny any any any between any any any and 1.2.3.0 255.255.255.0 53 nothrottle
E 19
E 4

# Ignore attempts to get to one interface from another; these attempts
# arise from our listing all (or most of) our external addresses for each
# application-level gateway on the firewall.
#
D 19
route deny any any any between any any any and 193.128.132.1 only any
E 19
I 19
route deny any any any between any any any and 1.2.3.1 only any
E 19
D 20
route deny any any any between any any any and 158.152.8.149 only any
route deny any any any between any any any and 158.43.71.2 only any
E 20
I 20
route deny any any any between any any any and 2.3.4.5 only any
E 20

# These are packets that shouldn't be getting here at all.
I 20
#
# Log them.
#
E 20
route deny any any any between any any any and any any any log
\end{verbatimlisting}

I 14

I 18
\section{Installing and Starting ExFilter}

D 28
First, you will need to select the approriate binary and copy it to the
firewall's local disc; suitable candidate locations might be
E 28
I 28
First, you will need to select the appropriate binary and copy it to
the firewall's local disc; suitable candidate locations might be
E 28
D 23
\TOK{/usr/local/bin} or \TOK{/usr/etc}.  You should then start up
ExFilter from \TOK{/etc/rc.local} after all interfaces are in place (ie
after any loadable interface drivers have been loaded and configured).
E 23
I 23
\MITOK{/usr/local/bin} or \MITOK{/usr/etc}.
E 23

I 23
You should then start up ExFilter from \MITOK{/etc/rc.local} after all
interfaces are in place (ie after any loadable interface drivers have
been loaded and configured).  ExFilter has to be run as root ({\em not}
D 42
set-uid root) to bind to the low-level interfaces.
E 42
I 42
set-uid root which might be a security hazard) to bind to the low-level
interfaces.
E 42
E 23

I 23
Suitable lines in \MITOK{rc.local} might be:
\begin{verbatimlisting}
EXFILTER=/usr/local/bin/ExFilter.O.sun4-SunOS-4
if [ -f $EXFILTER ]; then
        echo 'Starting Exfilter.'
        ($EXFILTER &)   > /dev/console
fi
\end{verbatimlisting}

Note that the initial \MITOK{verbosity} (debugging level) of the
d{\ae}mon can be set with the optional \MITOK{-v} flag, and the
location of the configuration file with the optional \MITOK{-f} flag.

So you might start ExFilter with a configuration file of
\TOK{/etc/altExFilter.conf} rather than the default
\TOK{/etc/ExFilter.conf}, and with a verbosity level of~50\% rather
D 29
than the default~1\!, with:
E 29
I 29
than the default~1\%, with:
E 29
\begin{verbatimlisting}
EXFILTER=/usr/local/bin/ExFilter.O.sun4-SunOS-4
if [ -f $EXFILTER ]; then
        echo 'Starting Exfilter in an alternative way.'
        ($EXFILTER -v 50 -f /etc/altExFilter.conf &)   > /dev/console
fi
\end{verbatimlisting}


E 23
E 18
E 14
%==============================================================================
I 12
D 15
\iffalse
E 12
E 3
\chapter{Designing and Implementing a Security Policy}
I 12
\fi
I 14

E 14
E 12
I 3

%==============================================================================
E 15
D 41
\chapter{ExFilter Reference Guide}
E 41
I 41
\chapter{ExFilter Reference Guide}\label{C-Ref}
E 41

D 4
\section{The Format of the Configuration File}
E 4
I 4
\section{The Format and Meaning of the Configuration File}
I 20

I 25
This section describes the format of the ExFilter configuration file,
D 33
by default found in \MITOK{/etc/ExFilter.conf}.
E 33
I 33
by default found in the file \MITOK{/etc/ExFilter.conf}, which should
be owned by, and only writable by, root.
E 33

The file consists of a series of one-line records with
whitespace-separated fields.  The order of records and fields is
important.

Completely blank lines are ignored.

The first field on a line (which must start in column one) determines
the type of the record that that line is.

Case of alpha characters is significant.

Records are of unlimited length, but exceeding 256 bytes is
inadvisable.

The following initial fields (ie, record types) are valid:

\begin{description}

\item[\#] (starts a comment record)

    The content of such records is ignored.

D 28
\item[thottleto] (starts a traffic throttle record)
E 28
I 28
\item[throttleto] (starts a traffic throttle record)
E 28

    Specifies the maximum amount of traffic in bytes per second that
    may flow out through an interface.  This is also taken to be the
    maximum data rate of traffic coming in through the interface to
    keep traffic roughly symmetrical and keep interactive response of
    (for example, telnet) sessions across the link good.

    The aim of the mechanism invoked by this record is to avoid
    saturating slow connections like PPP links to ensure reasonable
    responsiveness for interactive traffic.  Excess traffic is quenched
    where possible.

    Records referring to interfaces not mentioned in an \MITOK{if}
    record are invalid.

\item[verbosity] (starts a verbosity record)

    Says how verbose the filter program should be as a percentage.

\item[if] (starts an interface-name record)

    Names an interface we want to route packets to/from.

    The interface names \MITOK{none} and \MITOK{quench} are reserved.

\item[route] (starts a routing record)

D 28
    An ordered list (order in the file is signifcant---the first
E 28
I 28
    An ordered list (order in the file is significant---the first
E 28
    matching rule for an incoming packet is used) of instructions to
    route or drop packets with selection by protocol, source and
    destination address/mask/port, etc.  Packets can be specified to
    bypass any throttle.

    The port component is ignored for which it is meaningless, eg
    EGP.  It is mainly intended for UDP and TCP.

\item[gateway] (starts a gateway record)

    Sets overall parameters for the gateway.

\end{description}

D 33
\newcommand{\OR}{$\|$}
E 33
I 33
\newcommand{\OR}{$|$}
E 33

Valid record syntax, in EBNF, is (non-literal parameters are {\it
thus}):
I 33
D 35
\begin{sloppypars}
E 35
I 35
\begin{sloppypar}
E 35
E 33
\begin{description}

\item[\#] {\it any text}

\item[throttleto] {\it ifname} {\it Bps}

\item[verbosity] {\it percentage}

\item[if] {\it ifname}

\item[route]
        (deny{\OR}allow)
        ({\it Iif}{\OR}any) ({\it Oif}{\OR}any)
        ({\it proto}{\OR}any)
        (from{\OR}between)
        ({\it FRaddr}{\OR}any) ({\it FRmask}{\OR}any{\OR}only) {\it FRport}
        (to{\OR}and)
        ({\it TOaddr}{\OR}any) ({\it TOmask}{\OR}any{\OR}only) {\it TOport}
        [~[no]fragment~]
D 33
        [~[no]log~]
E 33
I 33
        [~[no]log~] \pagebreak[3]
E 33
        [~[no]throttle[{\it maxthpc}]~]

    (default options: fragment nolog throttle)

\item[gateway] IPaddr
        [~[no]chksum~]
        [~[no]decttl~]
        [~[no]icmperrs~]
        [~[no]parallel~]
        [~[no]opts~]
        [~[no]trace~]

    (default options: chksum nodecttl noicmperrs parallel noopts notrace)

\end{description}
I 33
D 35
\end{sloppypars}
E 35
I 35
\end{sloppypar}
E 35
E 33

Note that {\OR} indicates the item on the left {\rm or} the item on the
right.  Parentheses indicate grouping.  Square brackets indicate
optional items.

The meaning of the various parameters to the record types is given below.

\begin{description}

D 26
FRaddr, IPaddr, TOaddr: a dotted-quad host or net address.
E 26
I 26
\item[FRaddr, IPaddr, TOaddr:] a dotted-quad host or net IP address,
    eg~1.2.3.4.
E 26

D 26
fragment: do packet fragmentation if required.   Also allow fragments
    though, ie parts of packets that have already been fragmented,
    which means ignoring port checking on all but the first fragment.
E 26
I 26
\item[fragment:] do packet fragmentation if required.   Also allow
    fragments though, ie parts of packets that have already been
    fragmented, which means ignoring port checking (etc) on all but the
    first fragment.
E 26

D 26
FRmask, TOmask: a dotted-quad mask in the style of a netmask; 1 bits are
    those that will be matched.
E 26
I 26
\item[FRmask, TOmask:] a dotted-quad mask in the style of a netmask;
    non-zero bits are those that will be matched.
E 26

D 26
FRport, TOport: port number; ``any'' is any port, ``priv'' is any port <
    1024, and ``nonpriv'' is any port >= 1024.
E 26
I 26
\item[FRport, TOport:] port number; \MITOK{any} is any port,
    \MITOK{priv} is any port~$< 1024$ (privileged), and \MITOK{nonpriv}
    is any port~$>= 1024$.
E 26

    For protocols other than TCP and UDP this field is ignored with the
    following exception.

    For ICMP, if the FRaddr address matches then the FRport port value
    has the following meanings:

D 26
      * ``any'' means any ICMP message is allowed from the given
E 26
I 26
      * \MITOK{any} means any ICMP message is allowed from the given
E 26
        host(s).

D 26
      * A port number allows ICMP messages of that type through, eg
        4 is Source Quench.
E 26
I 26
      * A port number allows ICMP messages of that type through, eg~4
D 33
	is Source Quench.
E 33
I 33
        is Source Quench.
E 33
E 26

D 26
      * If `nonpriv'' only Echo and Echo Reply packets from that host
        are allowed.
E 26
I 26
      * If \MITOK{nonpriv}, only Echo and Echo Reply packets from that
D 33
	host are allowed.
E 33
I 33
        host are allowed.
E 33
E 26

D 26
    Note that when a ``between'' routing record is used, the
    corresponding ``TOport'' value is used for packets travelling in
    the reverse direction.
E 26
I 26
    Note that when a \MITOK{between} routing record is used, the
    corresponding TOport value is used for packets travelling in the
    reverse direction.
E 26

D 26
ifname,Iif,Oif: an interface name, eg ``le0''; this must be an
    interface available to the router through nit, and must be
    mentioned in an ``if'' record.
E 26
I 26
\item[ifname, Iif, Oif:] an interface name, eg \MITOK{le0}; this must
D 27
    be an interface available to the router through \MI{nit}, and must
E 27
I 27
    be an interface available to the router through \MI{NIT}, and must
E 27
    be mentioned in an \MITOK{if} record.
E 26

D 26
    The names ``none'' and ``quench'' are reserved and should not be
    declared as interface names in an ``if'' record.
E 26
I 26
    The names \MITOK{none} and \MITOK{quench} are reserved and should
    not be declared as interface names in an ``if'' record.
E 26

D 26
log: log every packet matching this rule.
E 26
I 26
\item[log:] log every packet matching this rule, whether blocked or
    routed.
E 26

D 26
maxthpc: the maximum throttle percentage.  If a link is being throttled
    (has a throttle in place and traffic is high enough to engage it)
    then this value (an integer in the closed (inclusive) range 0--100)
    determines the maximum percentage of link traffic that may be of
    this type (eg matching this rule.  This value only makes sense if
    used with ``throttle'' rather than ``nothrottle'' since it is
    ignored if traffic routes with the rule this is part of is not
    marked for throttling.  A rule marked for throttling but without a
    maxthpc value given is assumed to have a maxthpc of 100.  Packets
    matching this rule can match any unused bandwidth upto the throttle
    value, but may be delayed until it has been determined that that
    bandwidth is otherwise unused.
E 26
I 26
D 42
\item[maxthpc:] the maximum throttle percentage.  If a link is being
    throttled (has a throttle in place and traffic is high enough to
    engage it) then this value (an integer in the closed (inclusive)
E 42
I 42
\item[maxthpc:] the maximum throttle percentage.  If a link/route is
    being throttled (has a throttle in place and traffic is high enough
    to engage it) then this value (an integer in the closed (inclusive)
E 42
    range~0--100) determines the maximum percentage of link traffic
    that may be of this type, ie matching this rule.  This value only
    makes sense if used with \MITOK{throttle} rather than
    \MITOK{nothrottle} since it is ignored if traffic routes with the
    rule this is part of is not marked for throttling.  A rule marked
    for throttling but without a maxthpc value given is assumed to have
    a maxthpc of~100.
E 26

D 26
proto: a protocol, numeric or one of ``udp'', ``tcp'', ``icmp''.
E 26
I 26
\item[proto:] a IP protocol number, or one of \MITOK{udp}, \MITOK{tcp}
    or \MITOK{icmp}.
E 26

D 26
throttle: include this packet in any output throttling.
E 26
I 26
\item[throttle:] include packets routed by this rule in any output
    throttling.
I 41

\end{description}

\section{Gateway Parameters}

The \MITOK{gateway} record is used to set a number of general
D 42
parameters for ExFilter, and is, in effect, manditory.
E 42
I 42
parameters for ExFilter, and is, in effect, mandatory.
E 42

The first parameter is the address ExFilter should use on outgoing
packets it generates such as on ICMP error packets (when packets are
denied passage through ExFilter, or when Source-quench messages are
being sent to regulate traffic through ExFilter).  You should allocate
an otherwise unused address from the same subnet as the firewall on one
of its interfaces for this, though you {\em may} get away with using
one of the firewall's own addresses.  ExFilter will appear as host
piggybacking an all the firewall's IP connections with this address, so
you might want to put up a DNS record for it for the benefit of remote
network administrators.

Then zero or more flags can be set to control gateway behaviour.
Although there are defaults, it is recommended that you set explicit
values for all the parameters.  As an example, to allow ExFilter to
generate ICMP error messages (eg for throttling), the parameter
\MITOK{icmperrs} can be supplied.  To turn it off \MITOK{noicmperrs}
can be supplied instead.

The meanings of the flags are:
\begin{description}

\item[\MITOK{decttl}:]  ExFilter decrements the `Time-To-Live' counter
    for packets it forwards, and discards packets whose TTL count has
    reached zero.  If ExFilter is a true gateway/firewall on you
    network, you should switch this on.  The default is
    \MITOK{nodecttl}.

\item[\MITOK{icmperrs}:] ExFilter sends `not-reachable' ICMP error
    messages out to the source of a packet it discards due to a
    \MITOK{deny} routing rule.  ExFilter also sends Source-quench ICMP
    error messages out to hosts sending too much traffic through
    ExFilter when the load on one or more connections is too high to be
    usable for interactive traffic.  You must have set a sensible and
D 42
    unique gateway address to anble this.  The default is
E 42
I 42
    unique gateway address before enabling this.  The default is
E 42
    \MITOK{noicmperrs}.

\item[\MITOK{parallel}:] ExFilter discards any traffic sent to the
    network addresses of the host on which it is running, assuming that
    that host will deal with any such traffic itself.  This can be
    turned off with \MITOK{noparallel}, letting ExFilter examine all
    packets arriving at the interfaces, though this can be very
    CPU-intensive and require more complicated routing rules to handle
    properly.

\item[\MITOK{chksum}:] makes ExFilter check and generate IP header
    checksums in incoming and outgoing packets.  This should never
    normally be turned off, and is on by default.

\item[\MITOK{opts}:] lets ExFilter route packets with IP header
    options.  In fact, this is hardwired to \MITOK{noopts} for safety
    in this version of ExFilter.

\item[\MITOK{trace}:] turns on logging of all packets seen by ExFilter,
    and would only normally be wanted when debugging.  It is by default
    \MITOK{notrace}.
E 41
E 26

\end{description}
D 26
































E 26

E 25
\section{Logging}
E 20
E 4

I 24
D 42
    ExFilter does most of its logging to the \MITOK{syslog} facility.
    It logs information at five different internal levels (fatal,
    error, audit, information for tracing, and debugging) corresponding
    to the \TOK{syslog} levels \MITOK{ALERT}, \MITOK{ERR},
    \MITOK{WARNING}, \MITOK{INFO} and \MITOK{DEBUG}.
E 42
I 42
    ExFilter does most of its logging to the \MITOK{syslog}
    \MITOK{DAEMON} facility.  It logs information at five different
    internal levels (fatal, error, audit, information for tracing, and
    debugging) corresponding to the \TOK{syslog} levels \MITOK{ALERT},
    \MITOK{ERR}, \MITOK{WARNING}, \MITOK{INFO} and \MITOK{DEBUG}.
E 42

    ExFilter will log increasing amounts of information as its
    \MITOK{verbosity} level is increased.  Information logged at
    \MITOK{WARNING} and above relates to security and potential system
    failures and should find its way into audit trails and logs
    inspected from time to time by a human operator.  For example,
    warnings about packets that were `denied' transit by ExFilter are
    logged at \TOK{WARING} level.  Hourly stats reporting is also
    done at \TOK{WARNING} level.

    Information at \TOK{INFO} is of interest but not worth storing, so
    should probably go to the system console (throttling messages are
    logged at this level, for example), and \TOK{DEBUG} information
    will rarely be generated and you will probably want to make
    temporary changes to \TOK{syslog}'s configuration to capture it if
    you want it at all.

    The default level of \MITOK{verbosity} the system runs at is~1,
    which reports most important events and little else.  The level can
    be changes on the command line at start-up, in the configuration
    file, and with signals.

    In general, the volume of output increases as the \TOK{verbosity}
    increases.  The minimum level is~0 and the maximum~100.  Anything
    at~50 or above is really only for debugging the software, and~100
    will cripple the system with the amount of information generated,
    up to full dumps in hex of all packets seen.

    Although the exact levels may change in future, the following
    \TOK{verbosity} levels below~50 are currently implemented:
    \begin{description}

D 25
	\item[0:] Silent about all but major problems.
E 25
I 25
        \item[0:] Silent about all but major problems.
E 25

        \item[1:] All of~0 plus a few extra items.  This is the
            default.

        \item[2:] All of~1 plus description of interface configuration
            at start-up.

        \item[3:] All of~2 plus logging of line throttling going on and
             off.

        \item[4:] All of~3 plus reporting of overlong frames being
            dropped.

        \item[5:] All of~4 plus logging of setting up of routing
            tables.  This can be useful to ensure the machine
            interprets your routing instructions as you intended.

        \item[6:] All of~5 plus logging of ICMP Source Quench messages
            being sent.

        \item[7:] All of~6 plus logging of each packet being routed.

        \item[8:] All of~7 plus logging of each ARP-table lookup.

    \end{description}

E 24
\section{Signals}
I 22

    One aim of the design of ExFilter is to allow it to run non-stop.

    To change its configuration you do not have to kill it, change the
    configurations files and restart it, you can just update the
    configuration files and send ExFilter a signal with the
    \MITOK{kill} command to get it to reconfigure itself internally,
    dump statistics to the logs, etc.

    This causes minimal disturbance to the flow of data through
    ExFilter and thus to users of the filtered IP service.

    Those familiar with operation of the \MITOK{named} DNS/BIND
    d{\ae}mon will recognise the way that signals are used for
    interaction with ExFilter.

    When ExFilter starts it reads its configuration information from a
    file called \MITOK{/etc/ExFilter.conf}, of a format described
D 32
    above.  The ExFilter d{\aemon} writes its process ID to a file
E 32
I 32
    above.  The ExFilter d{\ae}mon writes its process ID to a file
E 32
D 28
    called \MITOK{/etc/ExFilter.pid}.  This makes signalling the
E 28
I 28
    called \MITOK{/etc/ExFilter.pid}.  This makes signaling the
E 28
    d{\ae}mon relatively painless.

    If you want to alter the configuration of ExFilter while it is
    running, edit the \TOK{/etc/ExFilter.conf} file appropriately, and
    send the ExFilter d{\ae}mon a `HUP' signal (see the UNIX manual
    pages for a discussion of the different signals and their original
    meanings) by issuing the shell command:

D 23
\begin{verbatimtext}
E 23
I 23
\begin{verbatimlisting}
E 23
    kill -HUP `cat /etc/ExFilter.pid`
D 23
\end{verbatimtext}
E 23
I 23
\end{verbatimlisting}
E 23

    The full list of signals and their effects is:
    \begin{description}
I 23

    \item[HUP] reloads the configuration file \TOK{/etc/ExFilter.conf},
        and gets ExFilter to reconfigure itself as if killed and
        restarted.

    \item[INT] causes ExFilter to exit gracefully, after tidying up a
        little.  Useful if ExFilter is being run in the foreground on
        the command-line during testing or debugging.

    \item[ABRT] causes ExFilter to dump some loading and throughput
        statistics to the logs; ExFilter automatically does this every
        hour anyway.

    \item[TERM] causes ExFilter to exit immediately, with an error
        status.

    \item[USR1] increments the verbosity (debugging) level by one.

D 28
    \item[USR2] sets the verbosty level to zero.
E 28
I 28
    \item[USR2] sets the verbosity level to zero.
E 28
E 23

    \end{description}
E 22
I 12

D 17
\section{Known Problems}
E 17
I 17
\section{Known Problems and Future Features}

There is a small number of known problems and missing features we would
like to provide in a future release.  These, and workarounds, are
listed below:
\begin{description}

\item[IP Packet Fragmentation]

    Packet fragmentation is not handled correctly, ie ExFilter cannot
    fragment outgoing packets going onto a connection with a smaller
    MTU than the packet.

D 18
    The solution it to ensure the MTU on all connections is either $>=
E 18
I 18
    The solution it to ensure the MTU on all connections is either~$>=
E 18
    536$ for WAN connections (since most hosts should stick to a
D 18
    conservative MTU of 512 bytes plus IP header for non-local
E 18
I 18
    conservative MTU of~512 bytes plus IP header for non-local
E 18
    traffic), or ensure the MTU on all interfaces is the same (we
    ensure it is~1500 for all connections routed by ExFilter), so it
    need never fragment.

    Incoming fragments are handled correctly, but can be discarded if
D 18
    the `nofrag' flag is used in the appropriate route description.
E 18
I 18
    the `\MITOK{nofrag}' flag is used in the appropriate route
    description.
E 18

I 18
\item[Hard Limits]

D 29
    Currently ExFilter can handle a maximum of~256 allow/deny routing
    directives and a maximum of~16 interfaces.  This is because the
    underlying tables are not dynamically sized.  A later release will
    fix this.  In addition, an interface name may not be longer than~16
    characters, though under Solaris~1 this is never a problem.
E 29
I 29
    Currently ExFilter can handle a maximum of~256 \MITOK{route}
    routing directives and a maximum of~16 interfaces.  This is because
    the underlying tables are not dynamically sized.  A later release
    will fix this.  In addition, an interface name may not be longer
    than~16 characters, though under Solaris~1 this is never a
    problem.
E 29

\item[Quenching and \TOK{throttle}ing]

    ExFilter relies on sending ICMP Source-Quench messages to hosts
    that are originating large volumes of traffic that are overloading
    \MITOK{throttle}d links.  Some hosts (wrongly) ignore these
D 28
    messages and \MITOK{thottle}ing will not be able to regulate link
E 28
I 28
    messages and \MITOK{throttle}ing will not be able to regulate link
E 28
    traffic as well as it should.

    ExFilter keeps a small hashed table of hosts/ports to which it has
    recently sent quench messages to try to send a maximum of one such
    quench on each `connection' each second; this table may overflow
    with a large number of different end-points communicating.

    ExFilter cannot easily account for traffic originating to and from
    the firewall host itself, and such traffic will not be seen by the
D 28
    throtting mechanism and may allow the link to be more loaded than
E 28
I 28
    throttling mechanism and may allow the link to be more loaded than
E 28
    is desirable.  Minimise the volume of traffic to/from processes on
    the firewall machine to minimise this problem.

    In a future release regulation by round-trip time (RTT) will be
    added to help overcome some of these difficulties.

    ExFilter does not specifically recognise and expedite `interactive'
    packets at the moment, but the \MITOK{throttle} feature should be
    used to keep interactive performance reasonable at all times.

\item[Kernel-Directed Routing and ARP]

    ExFilter ignores all external routing information (is purely
    static) for security reasons.  It would be useful to have
    kernel-based routes followed when specifically allowed by ExFilter
D 42
    rules for non-critical traffic of for load sharing.  A copy of
E 42
I 42
    rules for non-critical traffic or for load sharing.  A copy of
E 42
    \MITOK{gated} or some other intelligent routing system can be run
    on the firewall to set the kernel routes.  A future release will
    allow this limited following of externally-supplied, dynamic
    routes.

    Note also that ExFilter relies on the kernel's ARP tables and
    broadcasts packets it cannot find and entry for in the host's ARP
    tables.

    Port-number range support will be added to the routing rules in a
    future release, in addition to the current fixed number,
    \MITOK{priv} and \MITOK{nonpriv} values.

D 31
    The `\MITOK{quench}' pseudo-interface does not have exactly the
    expected semantics at the moment.

E 31
\item[Multicast IP]

    ExFilter has not been tested for multicast IP.

\item[SNMP]

    SMNP monitoring is not provided, partly for reasons of security.

E 18
\item[Copying and Efficiency]

    Under Solaris~1 we run the router entirely in user space, so
    packets have to be copied into user space even to be discarded.  A
    Solaris~2 version will move as much as possible of the routing into
    the kernel in a loadable module.

\item[IP Header Checksum Generation]

    We do not currently use the RFC-recommended algorithm for checksum
    generation.  In practice this has not proven to be a problem, but
    we will switch to the `official' algorithm in a future release.

\item[IP Header Options]

    ExFilter will not route packets with IP header options.  This is a
    security measure to prevent circumvention of the filtering rules by
    non-obvious means.

\item[ICMP Error Messages]

    Under certain rare circumstances ExFilter may generate ICMP error
D 28
    messages for the second and susequent fragments of a large packet.
E 28
I 28
    messages for the second and subsequent fragments of a large packet.
E 28
    This is an error but a fairly innocuous one.

\item[NIT Interface Interaction]

    ExFilter will best be able to monitor and modulate throughput with
D 28
    the \TOK{thottle} directive if the underlying interface does not
E 28
I 28
    the \TOK{throttle} directive if the underlying interface does not
E 28
    echo its output packets on the input side.  The supplied
    (unsupported) PPP has been modified to work this way.  Some Sun IP
    drivers work this way and some do not.
D 18

\item[Hard Limits]

    Currently ExFilter can handle a maximum of XXX allow/deny routing
    directives and a maximum of YYY interfaces.  That is because the
    underlying tables are not dynamically sized.  A later release will
    fix this.

E 18

\end{description}
E 17
I 15


%==============================================================================
\chapter{Licence and Warranty Terms, and Contact Details}

This details the terms of the Right-To-Use (RTU) licence that you, the
Customer, have purchased directly or indirectly from us, ExNet Systems
D 16
Ltd.
E 16
I 16
D 36
Ltd for use of the software package called ExFilter~V1.1.2.
E 36
I 36
D 37
Ltd for use of the software package called ExFilter~V1.1, including
V1.1.2 and V1.1.3.
E 37
I 37
Ltd for use of the software package called ExFilter~V1.1.3.
E 37
E 36
E 16

\begin{enumerate}

D 16
    In case of trouble please refer to the company you bought ExFilter
    from; they provide technical support and fixes and automatically
    forward to us those problems that we have to solve.
E 16
I 16
\item

    In case of trouble please refer first to the company you bought
    ExFilter from; they provide technical support and fixes and
    automatically forward to us those problems that we have to solve.
E 16

D 16
    If you do contact us you must provide us with details of where and when
    you bought the software, which version you are running and in what
    environment (host and OS versions) and your serial number.  We will not
    provide technical assistance if you cannot provide us with a serial
    number, nor if your supplier or distributor can provide you with the
    assistance you require.
E 16
I 16
\item
E 16

D 16
    This agreement can only be varied oe superceded by explicit notice
E 16
I 16
    If you do contact us you must provide us with details of where and
    when you bought the software, which version you are running and in
    what environment (host and OS versions) and your serial number.  We
    will not provide technical assistance if you cannot provide us with
    a serial number, nor if your supplier or distributor can provide
    you with the assistance you require.

\item

D 28
    This agreement can only be varied or superceded by explicit notice
E 28
I 28
    This agreement can only be varied or superseded by explicit notice
E 28
E 16
    in writing from a Director of ExNet Systems Ltd to the Customer.

D 16
    When you purchase an RTU (Right-To-Use) licence, you purchase the right
    to execute at most one copy of the software for each RTU you purchase.
    The RTU licence is non-exclusive and non-transferable, though with our
    explicit written consent, which will not be unreasonably withheld, you
    may transfer your licence to a third party; this automatically
    terminates your own licence for the copy or copies you have transfered,
    and confers any {\em remaining} period of warranty to the new licence
    holder.
E 16
I 16
\item
E 16

D 16
    If you do have to come directly to us and your warranty has not
    expired, we will, at our sole discretion, replace your software or
    refund the list price of the RTU licence or the price you paid,
    whichever is the lower.  If your warranty has expired we will charge
    time and materials for any fixes you require, or offer you an upgraded
    version at a suitable discount where that will assist you and a
    suitable upgrade is available.
E 16
I 16
    When you purchase an RTU (Right-To-Use) licence, you purchase the
    right to execute at most one copy of the software for each RTU you
    purchase.  The RTU licence is non-exclusive and non-transferable,
    though with our explicit written consent, which will not be
    unreasonably withheld, you may transfer your licence to a third
    party; this automatically terminates your own licence for the copy
D 28
    or copies you have transfered, and confers any {\em remaining}
E 28
I 28
    or copies you have transferred, and confers any {\em remaining}
E 28
D 44
    period of warranty (if any) to the new licence holder.
E 44
I 44
    period of warranty (if any) to the new licence holder.  Please
    note: you buy a licence to use the software, not the software
    itself, which remains the property of ExNet Systems Ltd.
E 44
E 16

I 16
\item

    You may, {\em for purposes of backup only}, keep more than one copy
    of the electronic and paper files and documentation provided; in no
    case will more than ten such copies be made of any file or
    document.

\item

    If you do have to come directly to us for assistance and your
    warranty has not expired, we will, at our sole discretion, replace
    your software or refund the list price of the RTU licence or the
    price you paid, whichever is the lower.  If your warranty has
    expired we will charge time and materials for any fixes you
    require, or offer you an upgraded version at a suitable discount
    where that will assist you and a suitable upgrade is available.

\item

E 16
    ExNet Systems Ltd warrants that the product supplied to you will be
D 16
    free of defects and fit for purpose for a period of three calendar
    months from purchase.
E 16
I 16
    free of defects and fit for the purposes described in the
    accompanying manual for a period of one year from the date of
    purchase from a distributor or supplier authorised by us.
E 16

I 16
\item

E 16
    Our liability is strictly limited to the recommended retail (list)
D 16
    price of the software or the price you paid for it, whichever is the
    lower.  WE ARE NOT LIABLE FOR CONSEQUENTIAL LOSSES UNDER ANY
    CIRCUMSTANCES\@.
E 16
I 16
    price of the software or the price you paid for it, whichever is
    the lower.  WE ARE NOT LIABLE FOR CONSEQUENTIAL LOSSES UNDER ANY
D 19
    CIRCUMSTANCES\@.  Your first redress is against the supplier you
    bought the software from.
E 19
I 19
    CIRCUMSTANCES\@.
    
    Your first redress is against the supplier you bought the software
    from.
E 19
E 16

I 16
\item

E 16
    If you do not accept these terms, we do not allow you to use the
D 16
    software.
E 16
I 16
    software and you must return it immediately, unused, to your
    supplier.
E 16

I 16
\item

E 16
    You agree to submit to this agreement when you remove the software
    from the packaging it was supplied to you in, or execute any
    component of the software on any computer or examine the contents
    of any of the paper and electronic files and documentation that is
    part of this software package.

I 16
\item

E 16
    You may cancel this licence at any time by sending a notice to us
    and your suppliers (where possible) in writing confirming that you
    have destroyed all copies of the the software and related files and
    data.  Your RTU for the appropriate copy or copies of the software
    is then terminated.

I 16
\item

E 16
    If any clause of this agreement cannot be enforced in law it shall
    be deemed struck out and the other clauses shall still stand.

I 16
\item

E 16
    If ExNet Systems Ltd cannot fulfill any part of this agreement due
    to circumstances beyond its reasonable control (including, but not
    limited to, industrial action, natural disasters and Acts of God)
    it shall not be liable in any way for those failures.
I 16

\item
E 16

    This agreement is governed by the laws of England, and both parties
D 28
    agree to submit to the jurisdition of the High Court of England,
E 28
I 28
    agree to submit to the jurisdiction of the High Court of England,
E 28
    though ExNet Systems Ltd may enforce this agreement in any court of
    its choosing.

\end{enumerate}

\vfill

ExNet Systems Ltd, London, UK; tel:~+44~181~244~0077,
fax:~+44~181~244~0078, email:~\MITOK{info@exnet.com}.

\mbox{}
E 15
E 12
E 3
E 2
E 1
