Great Circle Associates Firewalls
(March 1994)
 

Indexed By Date: [Previous] [Next] Indexed By Thread: [Previous] [Next]

Subject: Re: svr4 and wollongong for bastion host - good idea?
From: Ng Pheng Siong <ngps @ nova . np . ac . sg>
Date: Wed, 9 Mar 1994 08:23:30 +0800 (SST)
To: john . corb @ UnitedKingdom . NCR . COM
Cc: firewalls @ greatcircle . com
In-reply-to: <9403070820 . aa19648 @ ncrhub1 . NCR . COM> from "John Corb" at Mar 7, 94 12:37:33 pm

> 	i've never heard even rumours of a bastion host running wollongong's
> 	implementation of tcp/ip, is this because no one's tried or is it
> 	because it isn't a good choice?
> 
> 	is the tis toolkit good on svr4? i've compiled it ok but haven't had
> 	a chance to set up any real testing yet

I have tried. ;)

Netacl runs fine on SVR4/WINTCP. Ftp-gw, which was the second thing 
I tried, does not. I quote Jerry Whelan <guru @
 stasi .
 bradley .
 edu> 
(whom I'm sure doesn't mind my doing so):

> -} Hi. Has anyone managed to get ncftp to work on an SSE running SVR4 v3.0?
> -} I have built 3 versions on seperate occasions - build was fine, connect
> -} was fine, but when I do "ls", nothing happens. Turning on debug mode,
> -} I see that ncftp was somehow representing my IP address as 0.0.0.0. ;|
> -} (BTW, anyone knows what/where is the latest version?)
> -} 
> -} On a related note, my site has been using the excellent Lynx browser.
> -} (Kinda like a character-mode Mosaic.) I can never get to a file/ftp
> -} URL. I've just built a debug version of Lynx and will be going thru it,
> -} but think it may have something in common with the a/m ncftp problem. 
> 
> 	Both of these problems are related and the answer is usually
> ugly.  The problem lies in the way the &^% @
 #%^ Wollongong TCP/IP that
> AT&T/NCR uses thinks connect() and listen() (and getsockname()) ought
> to work.  On every other tcp/ip implementation known to man, doing
> a listen() on a server socket is sufficient for a client connect()
> to succeed.  With Wollongong, the server has to do an accept() before
> the client's connect() completes.  In the typical ftp implementation,
> initiating a data transfer requires the ftp client to listen() on the
> data socket and simultaneously check for an error message on the
> control socket.  With the Wollongong tcp/ip this situation results in
> deadlock.  The solution is to listen() on the data socket and then
> select() on both the data and control sockets.  Ugly, but I've done
> it for NCSA Mosaic and you can find a static-motif binary of Mosaic
> on ftp.ncsa.uiuc.edu Web/mosaic-contrib.  If you want to see the
> source changes I made, mail me.
> 	As for ncftp telling the other host that your ip number is 0.0.0.0,
> that is related to getsockname() being broken.  On all other ip
> implementations, getsockname() returns (among other things) the ip
> address of the other end of the socket connection.  Under Wollongong,
> it returns the ip address of the local end of the socket, which in most
> cases is localhost, i.e. 0.0.0.0.  The solution is to use something
> like gethostbyname("hostname") and use that data instead.

Ditto for ftp-gw. I am currently working on it.
I haven't tried any of the other gw's. 

Cheers.

- PS
-- 
Ng Pheng Siong * ngps @
 np .
 ac .
 sg * ngps @
 technet .
 sg
Computer Centre, Ngee Ann Polytechnic, Singapore


Follow-Ups:
References:
Indexed By Date Previous: Novice firewall questions
From: jahangir!bvk @ uunet . UU . NET (Brett Kuehner)
Next: opening the door just a little...
From: Danny Thomas <D . Thomas @ vthrc . uq . edu . au>
Indexed By Thread Previous: svr4 and wollongong for bastion host - good idea?
From: John Corb <root @ acid . unitedkingdom . NCR . COM>
Next: Re: svr4 and wollongong for bastion host - good idea?
From: "Anthony J. Lill" <ajlill @ ajlc . waterloo . on . ca>

Google
 
Search Internet Search www.greatcircle.com