<html><head><meta name="color-scheme" content="light dark"></head><body><pre style="word-wrap: break-word; white-space: pre-wrap;">OBSOLETE Patch-ID# 108156-14
Keywords: ENCRYPTION EFS security international HA Logdump FTP fragmentation proxy
Synopsis: Obsoleted by: 108156-15 SunScreen EFS 3.0b (Sparc) miscellaneous fixes.
Date: Nov/20/2001

******************************************************
   The items made available through this website
   are subject to United States export laws and
   may be subject to export and import laws
   of other countries. You agree to strictly comply
   with all such laws and obtain licenses to
   export, re-export, or import as may be required.
   Unless expressly authorized by the United States
   Government to do so you will not, directly or
   indirectly, export or re-export the items made
   available through this website, nor direct the
   items therefrom, to any  embargoed or restricted
   country identified in the United States export
   laws, including but not limited to the Export
   Administration Regulations (15 C.F.R. Parts
   730-774).
******************************************************

Solaris Release: 2.6 7

SunOS Release: 5.6 5.7

Unbundled Product: SunScreen EFS

Unbundled Release: 3.0 Rev B

Xref: This patch is available for x86 as Patch 108157.

Topic: 

Relevant Architectures: 

BugId's fixed with this patch: 4231913 4231917 4253279 4257613 4258953 4259288 4259291 4263150 4263985 4267482 4268211 4269897 4271577 4272397 4273153 4273198 4273416 4274877 4275509 4276516 4278909 4279408 4280348 4280375 4281974 4286707 4287892 4291630 4291953 4292561 4297741 4302056 4302422 4306041 4310845 4313231 4314493 4317939 4326689 4328055 4329296 4333069 4347381 4347894 4347899 4347905 4351317 4355078 4355752 4365144 4366229 4368757 4370757 4371831 4373963 4373964 4377098 4377829 4378218 4380217 4395538 4400107 4409715 4412981 4415446 4431381 4432276 4432480 4464430 4485964 4489200

Changes incorporated in this version: 4432480 4485964 4489200

Patches accumulated and obsoleted by this patch: 

Patches which conflict with this patch: 

Patches required with this patch: 

Obsoleted by: 

Files included with this patch: 

	/etc/opt/SUNWicg/SunScreen/SunScreenEFS.x509
	/kernel/drv/screen
	/kernel/drv/sparcv9/screen
	/kernel/strmod/efs
	/kernel/strmod/sparcv9/efs
	/kernel/strmod/sparcv9/spf
	/kernel/strmod/spf
	/opt/SUNWicg/SunScreen/admin/cgi-bin/html_logdump
	/opt/SUNWicg/SunScreen/admin/com/sun/sunscreen/internal/ssadm/Session.class
	/opt/SUNWicg/SunScreen/admin/com/sun/sunscreen/internal/ssadm/nl_catd.class
	/opt/SUNWicg/SunScreen/admin/com/sun/sunscreen/internal/ssadm/nl_catd.so
	/opt/SUNWicg/SunScreen/admin/htdocs/lib/admin/com/sun/sunscreen/efs/internal/gui/ConfigListWindow.class
	/opt/SUNWicg/SunScreen/admin/htdocs/lib/admin/com/sun/sunscreen/efs/internal/gui/GetTextDialog.class
	/opt/SUNWicg/SunScreen/admin/htdocs/lib/admin/com/sun/sunscreen/efs/internal/gui/SearchPanel.class
	/opt/SUNWicg/SunScreen/admin/htdocs/lib/admin/com/sun/sunscreen/efs/internal/gui/SunScreenApplet.class
	/opt/SUNWicg/SunScreen/admin/htdocs/lib/admin/efsgui_en_us.class
	/opt/SUNWicg/SunScreen/admin/htdocs/lib/admin/sg_registry.jar
	/opt/SUNWicg/SunScreen/admin/htdocs/plugin/plugins/identitydb.obj
	/opt/SUNWicg/SunScreen/bin/ss_install
	/opt/SUNWicg/SunScreen/lib/authuser
	/opt/SUNWicg/SunScreen/lib/catgets
	/opt/SUNWicg/SunScreen/lib/datacompiler
	/opt/SUNWicg/SunScreen/lib/get_access
	/opt/SUNWicg/SunScreen/lib/getlog
	/opt/SUNWicg/SunScreen/lib/install_UDH_keys
	/opt/SUNWicg/SunScreen/lib/jar_hash
	/opt/SUNWicg/SunScreen/lib/jar_sig
	/opt/SUNWicg/SunScreen/lib/javaexec
	/opt/SUNWicg/SunScreen/lib/logbrfmt
	/opt/SUNWicg/SunScreen/lib/logdump
	/opt/SUNWicg/SunScreen/lib/logmsg
	/opt/SUNWicg/SunScreen/lib/mail_relay
	/opt/SUNWicg/SunScreen/lib/mail_spam
	/opt/SUNWicg/SunScreen/lib/proxyuser
	/opt/SUNWicg/SunScreen/lib/screeninfo
	/opt/SUNWicg/SunScreen/lib/ss_access
	/opt/SUNWicg/SunScreen/lib/ss_active_config
	/opt/SUNWicg/SunScreen/lib/ss_address
	/opt/SUNWicg/SunScreen/lib/ss_certificate
	/opt/SUNWicg/SunScreen/lib/ss_compiler
	/opt/SUNWicg/SunScreen/lib/ss_default_drop
	/opt/SUNWicg/SunScreen/lib/ss_disable_send
	/opt/SUNWicg/SunScreen/lib/ss_ha
	/opt/SUNWicg/SunScreen/lib/ss_ha_active_mode
	/opt/SUNWicg/SunScreen/lib/ss_ha_passive_mode
	/opt/SUNWicg/SunScreen/lib/ss_had
	/opt/SUNWicg/SunScreen/lib/ss_interfaces
	/opt/SUNWicg/SunScreen/lib/ss_logd
	/opt/SUNWicg/SunScreen/lib/ss_nat
	/opt/SUNWicg/SunScreen/lib/ss_rule
	/opt/SUNWicg/SunScreen/lib/ss_service
	/opt/SUNWicg/SunScreen/lib/ss_spam_list
	/opt/SUNWicg/SunScreen/lib/statetables
	/opt/SUNWicg/SunScreen/lib/statetables64
	/opt/SUNWicg/SunScreen/lib/strs
	/opt/SUNWicg/SunScreen/lib/user_authenticate
	/opt/SUNWicg/SunScreen/lib/vars
	/opt/SUNWicg/SunScreen/proxies/ftpp
	/opt/SUNWicg/SunScreen/proxies/httpp
	/opt/SUNWicg/SunScreen/proxies/smtpp
	/opt/SUNWicg/SunScreen/proxies/telnetp
	/opt/SUNWicg/SunScreen/ssadm/activate
	/opt/SUNWicg/SunScreen/ssadm/algorithm
	/opt/SUNWicg/SunScreen/ssadm/debug_level
	/opt/SUNWicg/SunScreen/ssadm/edit
	/opt/SUNWicg/SunScreen/ssadm/ha
	/opt/SUNWicg/SunScreen/ssadm/lock
	/opt/SUNWicg/SunScreen/ssadm/log
	/opt/SUNWicg/SunScreen/ssadm/logmacro
	/opt/SUNWicg/SunScreen/ssadm/logstats
	/opt/SUNWicg/SunScreen/ssadm/patch
	/opt/SUNWicg/SunScreen/ssadm/policy
	/opt/SUNWicg/SunScreen/ssadm/stateengine
	/opt/SUNWicg/SunScreen/ssadm/sys_info
	/opt/SUNWicg/SunScreen/ssadm/traffic_stats
	/opt/SUNWicg/SunScreen/support/findcore
	/opt/SUNWicg/SunScreen/support/nattables
	/opt/SUNWicg/SunScreen/support/nattables64
	/opt/SUNWicg/SunScreen/support/packages
	/opt/SUNWicg/SunScreen/support/stats
	/opt/SUNWicg/SunScreen/support/versions
	/usr/kernel/drv/screen_skip
	/usr/kernel/drv/sparcv9/screen_skip
	/usr/kernel/misc/screen_ftp
	/usr/kernel/misc/screen_normal
	/usr/kernel/misc/screen_sqlnet
	/usr/kernel/misc/sparcv9/screen_ftp
	/usr/kernel/misc/sparcv9/screen_normal
	/usr/kernel/misc/sparcv9/screen_sqlnet
/opt/SUNWicg/SunScreen/ssadm/logdump

Note: 64bit sparcv9 kernel modules not included in x86 patch.
Files changed in this version of the patch:
	/kernel/drv/screen
	/kernel/drv/sparcv9/screen
	/opt/SUNWicg/SunScreen/support/nattables
	/opt/SUNWicg/SunScreen/support/nattables64
	/usr/kernel/misc/screen_ftp
	/usr/kernel/misc/screen_sqlnet
	/usr/kernel/misc/sparcv9/screen_ftp
	/usr/kernel/misc/sparcv9/screen_sqlnet

Problem Description:

4432480 - Sunscreen NAT has performance problems in certain topologies
	4485964 - PASV ftp and DYNAMIC NAT broken
	4489200 - panic in statetable cleanup routines
 
	(from 108156-13)
 
        4432276 - Performance degradation due to inefficient TCP Hash function
 
        (from 108156-12)
 
        4464430 - problem installing binaries properly from patch
 
        (from 108156-11)
 
	4378218 - smtp proxy does not work with two rules
	4412981 - ftp state engine does not recognize RST
	4431381 - ftp state engine confused in certain instances when 
	          MicroSoft server is used
	4409715 - ss_had can die with Interrupted System Call
	4415446 - HA failover time longer than 15 seconds
 
	(from 108156-10)
	4355078 - performance in stealth mode slower than SPF-200
        4400107 - something consuming large amounts of kernel memory
        4395538 - ss_logd core dumps causing the system to hang
        4377829 - HA screen will become passive if  cable is unplugged.
        4377098 - ss_had has a file descriptor leak.
        4380217 - SunScreen 3.1 with patch 109734-01 can panic in stealth mode.
        4373963 - screeninfo output gets truncated.
        4266794 - screeninfo does not return if ip forwarding status
        4373976 - misc enhancements to screeninfo.
        4048429 - Configurations names with spaces don't work
        4373966 - screeninfo does not get SCCS versions of all files.
        4373972 - screeninfo should perform consistancy checks on  packages.
        4373964 - Patch information retrieved by screeninfo can be incorrect.
        4365144 - Fix not correctly implemented for Trusted Solaris.
 
	(from 108156-09)
        4347381 - ss_had stops when "ssadm activate" is done
        4351317 - HTTP POST does not work without CRLF
        4355752 - SunScreen http proxy core dumps when URI password 
                  included in URL
        4365144 - ftp state engine can't handle tcp option tstamp 
        4366229 - Possible for encryption rules to generate system panic
        4370757 - ftp with NAT has sequence number problem which was 
                  introduced after fix for PASV FTP attacks
        4371831 - "Fragmentation Needed but DF bit set" message sent out 
                  in error when encryption rules are used
 
	(from 108156-08)
        4347894 - Protection against PASV FTP attacks
        4347899 - File containing something that looks like FTP commands 
                  could be misinterpreted
        4347905 - Protection against jolt2.c fragmentation attacks
 
	(from 108156-07)
	4326689 - Passive HA stealth screen sends ARP's
	4333069 - traffic passes to undefined addresses when interface addr grp 
	          used in rules.
 
	(from 108156-06)
	4314493 - stealth mode floods network on incorrect broadcasts.
	4328055 - logdump -i file -x0 does not display hex dump of packet
	4329296 - IPSec fragments get dropped in stealth mode.
 
	(from 108156-05)
	4281974 - http proxy stops working.  connection limit problem.
	4297741 - doesn't show absolute time for SESSION logs
	4302422 - 64-bit kernel writes session log records incorrectly.
	4310845 - ICMP need to fragment pkts not translated in tunnel.
	4313231 - Mixed mode panic with non-ip panics &amp; tunnel of localhost.
	4317939 - GUI can fail in ssadm.nl_catd class(AppletSecurityException).
 
	(from 108156-04)
	4258953 - Cannot view online docs with java plugin
	4263985	- Mix of Dynamic NAT &amp; Encrypted tunnelling problems
	4292561 - ssadm ha active_mode &amp;&amp; ssadm ha passive_mode can set both
		  screens passive.
	4296011	- SYN/RST spoofed packets reset statetable entry (DoS)
	4302056	- screeninfo: replaced "arp -a" with "netstat -pn"
	4306041 - smtp proxy fails with large msg on very slow connections.
 
	(from 108156-03)
	4253279 - Using snoop, NAT not showing correct address.
	4275509 - Verify NAT address grps are not empty.
	4280375 - Kernel panic when empty stealth interface address grps 
		  are set with encrypted traffic.  Also compiler warning
		  when address group is empty and SPF tag not set on
		  screen object.
	4286707 - Disabled interface not cleared unless rebooted.
	4287892 - logwhy option not working.
	4291630	- Editor dumps core when "load" with no policy specified.
	4291953	- findcore will run off onto nfs &amp; automount directories
 
	(from 108156-02)
	4231913 - Admin user write does not have all privileges.
	4231917 - Admin user read does not have all privileges.
	4257613 - findcore should run "file" on all core files.
	4259288 - screeninfo needs to gather more information.
	4259291 - screeninfo gets java MalformedInputException on U5/U10.
	4263150 - Activate fails on CMG 24-48hr since last activate.
	4271577 - Http Proxy not handling cookies properly.
	4273153 - Undefined address in AccessRemote causes core.
	4278908 - SNMP not sending alerts.
	4280348 - Ether state engine not working.
 
	(from 108156-01)
	4267482 - i18n: The "status" information is displayed incorrectly
		  in zh locale.
	4268211 - i18n: Delete window of active configuration is not i18n
	4269897 - i18n: A policy with Chinese characters in its name can't
		  be activated.
	4272397 - execute skiplocal with C locale for parsable result.
	4273198 - removed space before macro for proper getmsg processing.
	4273416 - i18n: Object type pull down menu in common object area is
	          not i18n.
	4274877 - i18n: Some properties are duplicated.
	4276516 - Can not activate a l10n policy name via GUI admin.
	4279409 - i18n: 'ssadm logdump -x' causes Java exception.

Patch Installation Instructions:
--------------------------------
See Special Install Instructions.

Special Install Instructions:
-----------------------------
 
Installation Instructions for the Administration Station
---------------------------------------------------------
 
1. Become root on the Administration Station.
 
2. If you are running Solaris 2.6 on the administration station, ensure
   that you have already installed the latest version of Solaris patch 106125.
   Version 106125-06 is available on your EFS 3.0 CD. 
 
3. Transfer the patch file to the Administration Station.
 
4. Then type:
 
        # uncompress 108156-14.tar.Z
        # tar xf 108156-14.tar
        # patchadd 108156-14
 
 
Installation Instructions for Locally Administered Screens
----------------------------------------------------------
 
1. Become root on the Screen.
 
2. If you are running Solaris 2.6 on the Screen, ensure that you have 
   already installed the latest version of Solaris patch 106125.
   Version 106125-06 is available on your SunScreen EFS 3.0 Rev B CD.
 
3. Transfer patch file to the Screen using a diskette or ftp (with 3 MB free).
 
4. Type the following:
        # uncompress 108156-14.tar.Z
        # tar xf 108156-14.tar
        # patchadd 108156-14
 
5. Reboot the Screen.
 
 
Instructions for Remotely Administered Screens in Stealth Mode.
---------------------------------------------------------------
 
Use this procedure ONLY if you cannot otherwise transfer the patch to 
the Screen.
 
1. Become root on the Administration Station.
 
2. If you are running Solaris 2.6 on the Screen, ensure that you have 
   already installed the latest version of Solaris patch 106125.
   Version 106125-06 is available on your SunScreen EFS 3.0 Rev B CD.
 
3. Transfer the patch file to the Administration Station.
 
4. Type the following:
        # ssadm -r &lt;Name_of_Screen&gt; patch install &lt; 108156-14.tar.Z
 
 
Additional  Installation Instructions for Users of the Java Plug-In
for GUI Administration 
------------------------------------------------------------------------
 
Use this procedure only if you are using the Java plug-in for GUI 
administration.
 
If the file identitydb.obj is used only for use with the SunScreen EFS 3.0 Rev B
product, replace the existing identitydb.obj file with the new identitydb.obj
file included in this patch.  The new file is located on the Screen at
/opt/SUNWicg/SunScreen/admin/htdocs/plugin/plugins/identitydb.obj.
If you are running in stealth mode and do not have access to this
file, you can retrieve it from the actual patch files with 
the following commands run on your Administration Station:
 
        # uncompress 108156-14.tar.Z
        # tar xf 108156-14.tar
        # cp 108156-14/SUNWicgSS/reloc/SUNWicg/SunScreen/admin/htdocs/plugin/plugins/identitydb.obj /tmp/identitydb.obj 
 
If the file identitydb.obj is used by other applications, then add
SunScreen as one of the accepted signers to the file identitydb.obj
using the following steps:
 
1. Copy the old identitydb.obj to your home directory.
 
2. Type the following, substituting the path for the javakey binary 
   (/usr/java1.1) for $JAVA_HOME:
 
        % $JAVA_HOME/javakey -r SunScreenEFS
        % $JAVA_HOME/javakey -cs SunScreenEFS true
        % $JAVA_HOME/javakey -ic SunScreenEFS /etc/opt/SUNWicg/SunScreen/SunScreenEFS.x509
 
   If you are running in stealth mode and do not have access to this
   file, you can retrieve it from the actual patch files with the
   following commands run on your Administration Station:
 
        # uncompress 108156-14.tar.Z
        # tar xf 108156-14.tar
        # cp 108156-14/SUNWicgSS/root/etc/opt/SUNWicg/SunScreen/SunScreenEFS.x509 /tmp/SunScreenEFS.x509
 
3. Copy the file identitydb.obj to a diskette for distribution to other 
   Administration Stations and install it in the following directories:
 
        $HOME on UNIX systems
        C:\WINDOWS directory for single user Windows 95 systems 
        C:\WINDOWS\PROFILES\username for multiuser Windows 95 &amp; 98 systems
        C:\WINNT\PROFILES\username on Windows NT systems
 
 
Instructions for Identifying Patches Installed on System
--------------------------------------------------------
 
1. To identify the patch level on your locally administered Screen,
   type the commands:
 
        # ls -lt /var/sadm/patch &gt; screen.pkginfo
        # pkginfo -l &gt;&gt; screen.pkginfo
 
2. To identify the patch level on your remotely administered Screen
   in stealth mode: 
 
        # ssadm -r &lt;Name_of_Screen&gt; lib/support packages &gt; screen.pkginfo
 
   This shows (1) ls -lt /var/sadm/patch, (2) pkginfo -l, and
   (3) the contents of /var/log/patch.log.
 
3. To identify the patch level on your Administration Station, type 
   the commands:
 
        # ls -lt /var/sadm/patch &gt; admin.pkginfo
        # pkginfo -l &gt;&gt; admin.pkginfo
 
 
Instructions to remove the patch on the Administration Station
--------------------------------------------------------------
 
1. Become root on the Administration Station.
 
2. Then type:
 
        # patchrm 108156-14
 
 
Instructions to Remove the Patch on Locally Administered Screen
---------------------------------------------------------------
 
1. Become root on the Screen.
 
2. Type the following:
 
        # patchrm 108156-14
 
 
Instructions to Remove the Patch on Remotely Administered Screens in 
Stealth Mode
--------------------------------------------------------------------
 
Use this procedure ONLY if you cannot otherwise obtain access to a 
login prompt on the Screen.
 
1. Become root on the Administration Station.
 
2. If you are running Solaris 2.6 on the Screen, ensure that you have 
   already installed the latest version of Solaris patch 106125.
   Version 106125-06 is available on your SunScreen EFS 3.0 Rev B CD.
 
3. Type the following:
        # ssadm -r &lt;Name_of_Screen&gt; patch backout 108156-14
 
Patch Installation Instructions for High Availability (HA) clusters.
--------------------------------------------------------------------
 
 
1. Determine which screen is ACTIVE within the HA Cluster using the following
   command on each:
 
        # ssadm ha status
 
2. Follow appropriate patch installation instructions from this README file to
   install the patch on the CURRENTLY ACTIVE SCREEN within the HA Cluster
   (determined from the previous step).
 
3. Be sure to reboot that screen upon completion of the patch installation.
 
4. After the reboot, the screen which the patch was just installed on
   will come up in PASSIVE mode and some other member of the HA cluster
   will become ACTIVE.
 
5. Repeat steps 1-4 until the patch has been applied to all members of
  the HA cluster.
 
Notes on patching HA clusters:
 
If the patch is installed on a PASSIVE screen before it is installed on an
ACTIVE screen, the HA daemon ss_had can core dump, this gives symptoms similar
to bug 4347381.
 
The SunScreen HA model works by having 2 or more firewalls in parallel. Both
firewalls see the same packets and hence calculate the same statetable entries.
If a packet matches a statetable entry , then it is passed through the screen.
 
If the ACTIVE screen is rebooted, one of the PASSIVE firewall(s) will take over.
Existing connections will still be maintained as the PASSIVE firewall(s)
which has just become ACTIVE will have the statetable entries.
 
Once the originally ACTIVE firewall has been rebooted, it will have an empty
statetable. This firewall will add any new connections made since it was
rebooted to its statetable, but will not know about connections established
before it was rebooted. If the currently ACTIVE screen is rebooted , some
connections may get dropped.
 
Its not possible to say exactly how long it will take for both (all) the
firewalls to have the same statetable entries as this will depend on the
type of connection being passed and the lifetime of this connection.
Running the following command on both (all) firewalls in the cluster will
give the administrator a good indication of when it is safe to reboot
the second firewall, without significant loss of service:
 
        # ssadm lib/statetables | grep ESTABLISHED | wc -l
 
 
 
 
Additional Patch Installation Instructions
------------------------------------------
  Refer to the "Install.info" file within the patch for instructions on
  using the generic 'installpatch' and 'backoutpatch' scripts provided
  with each patch.

README -- Last modified date:  Friday, March 1, 2002

</pre></body></html>