http-gw8

Usage

Overview

HTTP-GW provides Gopher and HTTP proxy services with logging and access control. It allows Gopher and Gopher+ client to access Gopher, Gopher+, and FTP servers. It also allows WWW clients such as Mosaic to access HTTP, Gopher and FTP servers. Both standard and proxy aware WWW clients are supported. The proxy supports common use of the Gopher, Gopher+ and HTTP protocols. Except where noted, client means Gopher, Gopher+, WWW, or proxy aware WWW clients, server means Gopher, Gopher+, HTTP, or FTP servers.

Proxy aware clients should be configured to use the proxy. Non proxy aware clients should be setup so that their HOME PAGE is the proxy. If you are installing a firewall where you already have users using Gopher or WWW, then they need to edit their Hotlists to route the requests through the proxy.

WWW (URLs)

Insert the string http://firewall/ in front of the existing URL.

Gopher

Change the Gopher menu information from

Options

-d file This option can only be used if the proxy was compiled with BINDDEBUG. It allows debugging information to be written to the specified file.

-D This option turns on the debugging log if specified. The proxy must be compiled with BINDDEBUG for the option to be recognised.

Operation

HTTP-GW is invoked from inetd(8), it reads its configuration and checks to see if the system that has just connected is permitted to use the proxy. If not, it returns a message/menu and logs the connection. If the peer is permitted to use the proxy, HTTP-GW reads in a single line request which it then decodes. If needed, more lines are read from the client. Most requests carry the information that the proxy needs in the first line.

When a user initiates a request, the client determines three pieces of information. These are host, port and a selector. The client then connects to the host on the port and sends the selector. When using a proxy, the host and port refer to the proxy itself. The proxy has to determine the host and port from information contained in the selector. The proxy does this by re-writing the information it passes back to the client. Both Gopher and WWW clients do none or only minimal processing on the selector. If the proxy cannot find it's special information in the selector, it looks in it's configuration file to see if a server has been defined that the request can be handed off to.

There are three main types of information that the proxy has to process.

Gopher menus

these contain a description (to be displayed to the user), a selector, a host, and a port. The first character of the description is used to tell the client the sort of information that the entry refers to.

HTML files

contain Hypertext which can contain embedded links to other documents. The proxy has to parse the HTML file and re-write the links so that the client routes the request through the proxy.

other data files

these can be roughly classified as text or binary data. The proxy just passes the data through without changing it.

The proxy encodes the extra information into the selector by converting it into a URL (Universal Resource Locator) This is also the form of selector that is used in HTML documents.

When building a Gopher Menu from an FTP directory list, the proxy has to guess what Gopher type to specify by looking at the file extension.

Configuration

HTTP-GW reads its configuration rules and permissions information from the firewall configuration table netperm-table, retrieving all rules specified for "http-gw". The "ftp-gw" rules are also retrieved. The "ftp-gw" rules are consulted when looking for host rules once the "http-gw" ones have been searched. The following configuration rules are recognized:

userid user

specify a numeric user-id or the name of a password file entry. If this value is specified, HTTP-GW will set its user-id before providing service. Note that this option is included mostly for completeness, as HTTP-GW performs no local operations that are likely to introduce a security hole.

directory pathname

specifies a directory to which HTTP-GW will chroot(2) prior to providing service.

timeout secondsvalue

This value is used as a dead-watch timer when the proxy is reading data from the net. Defaults to 60 minutes.

default-gopher server

define a gopher server to which requests can be handed off.

default-httpd server

define an HTTP server to which requests can be handed off if they came from a WWW client using the HTTP protocol.

ftp-proxy server

define an ftp-gw that should be used to access FTP servers. If not specified, the proxy will do the FTP transaction with the FTP server. Since the ftp-gw rules will be used if there are no relevant HTTP-GW rules then this is not a major problem.

hosts host-pattern [host-pattern ...] [options]

permit-hosts host-pattern [host-pattern ...] [options]
deny-hosts host-pattern [host-pattern ...]

rules specify host and access permissions. Typically, a hosts rule will be in the form of:

http-gw: deny-hosts unknown
http-gw: hosts 192.33.112.* 192.94.214.*

There may be several host patterns following the "hosts" keyword, ending with the first optional parameter beginning with '-'. Optional parameters permit the selective enabling or disabling of logging information, etc.

permit-hosts options

permit-hosts rules may take options. Some of the options take parameters. The functions are defined later (see gopher functions)

-permit function

-permit { function [function ...] }

Only the specified functions are permitted. Other functions will be denyed. If this option is not specified then all functions are initially permitted.

-deny function

-deny { function [function ...] }

specifies a list of Gopher/HTTP functions to deny.

-gopher server

Make server the default server for this transaction.

-httpd server

Make server the default HTTP server for this transaction. Will be used if the request came in via the HTTP protocol.

-filter function

-filter { function [function ...] }

will remove the specified functions when re-writing selectors and URL's. Does not stop the user from entering selectors that the client will execute locally but can be used to remove them from retrieved documents.

The following options are also recognised and processed since they may be specified on an ftp-gw config line.

-noinput

Disables data read functions.

-nooutput

Disables data write functions.

-log function

-log { function [function ...] }

specifies that a log entry to the system log should be made whenever the listed functions are performed through the proxy.

-authall

specifies that all functions require the user to be authenticated.

-auth function

-auth { function [function ...] }

specifies that the functions listed require the user to be authenticated.

-dest pattern

-dest { pattern [pattern ...] }

specifies a list of valid destinations. If no list is specified, all destinations are considered valid. The -dest list is processed in order as it appears on the options line. -dest entries preceeded with a '!' character are treated as negation entries. Therefore the rule:

-dest !*.mit.edu -dest *

will permit hosts that are not in the domain "mit.edu" to be connected to.

gopher functions

The proxy characterizes each transaction as one of a number of functions. For the deny options it is the request that is used. For filter options it is the returned selectors that are used.

FunctionDescription

 

Fetching an HTML document (This is being studied)

 

readFetching a file of any type. 

HTML files are treated as read even though 

they are also dir

 

writePutting a file of any type.

Needs plus since only available to Gopher+ 

and HTTP/1.x

 

ftpAccessing an FTP server

 

plusGopher+ operations

HTTP methods other than GET

 

waisWAIS index operations

 

execOperations that require a program to be run, 

e.g. telnet. (See SECURITY)

 

Security

There are a number of situations that the user needs to know about. The most important of which is the way that certain functions are handled by the client, server, and proxy programs. When the client wants to perform certain actions such as telnet then the client program often runs the telnet command to perform the function. If the client passes arguments to the program then there is a chance that rogue commands could be executed as well as the intended one. Gopher requests to do FTP operations cause the server to run the FTP program. Again there is the chance that the server could be tricked into running rogue commands as well as the intended one.

Most client programs only know how to display a small number of data types and they rely on external viewers to handle the other data types. Again, there is a chance that client programs can be tricked into running rogue commands as well as the intended ones.

Installation

To install HTTP-GW first place the executable in a system area, then modify /etc/inetd.conf. The TCP service port on which to install the Gopher/HTTP proxy will depend on local site configuration. You would normally configure the proxy to be on ports 70 and 80. 70 is the normal Gopher port and 80 is the normal HTTP port. Once inetd.conf has been modified, restart or reload inetd. Verify installation by attempting a connection and monitoring the system logs.

Typical configuration of the proxy in a firewall situation involves rules to block all systems that are not in the DNS from using the proxy, but to permit all systems on the internal protected network to use the proxy. I.e.:

http-gw: deny-hosts unknown
http-gw: hosts 192.33.112.* 192.94.214.*

Files

/etc/inetd.conf

/etc/services netperm-table