sybase-gw v0.3beta
^^^^^^^^^ ^^^^^^^^

This file is README for sybase-gw, a proxy for TDS protocol 5.0 and fwtk-style
firewalls. It should work and tested with Sybase 11. Another functionality
it provides is creating encrypted tunnel between two firewalls for database
applications.

setting up proxy
^^^^^^^ ^^ ^^^^^

Edit Makefile to add -DIPFILTER to c options and IPFILTER variable to point
to IPFilter source if you use IPFilter tranparency.

Compile the source and edit inetd.conf to point to the binary.
Requires libblowfish (available from ftp.funet.fi) and md5 library (if
your system does not have libmd5 you are probably running linux. try to
get it separately. Don't ask me where.)

Set up connection divertor if you use transparent operation.

netperm-table general options:

{permit-|deny-}hosts 			similar to fwtk

netperm-table hosts options:

-dest <list>				similar to fwtk

-transparent				tranparent operation

-plug-to <server>			plug to a pre-defined server

-port <port>				use this port number when connecting
					to server

-authuser <username>			similar to fwtk

-user <username-list>			specify the list of users allowed
					to access proxy. "!" modifier is
					valid.

-loguser 				log username when authenticating
					on database server

-client-encrypt <method>		use encryption on client side,
					blowfish only is implemented for now

-client-md5key <any string>		string hash will be encryption key

-server-encrypt <method>		use encryption on server side,
					blowfish only is implemented for now

-server-md5key <any string>		string hash will be encryption key

-extnd					turn extended permissions processing
					on (see authsrv documentation)

setting up client side
^^^^^^^ ^^ ^^^^^^ ^^^^

Use user@host syntax
to specify real destination for non-transparent operation.

For transparent operations no special client setup is required.


BUGS
^^^^

Just a beta release - so there should be some.

I think i should make it more portable. There are some possible problems
if your compliler does not understand pack() #pragma.

Packet check after authenitcation is embryonic.

Protocol seems to be quite brain-dead so expect slowdowns or something.

Encryption is far from being optimal.

ToDo
^^^^

Fix the above.

Implement more encryption and hash functions.

Think on 2-level authentication (if it is possible at all)

Get protocol specs from Sybase (all the code is based on reverse engineering
and non-reliable sources. it is much better than Gauntlet sybase proxy 
anyways ;)

Anything else?

For developers
^^^ ^^^^^^^^^^

Feel free to improve the program the way you want - but send me a
copy of your patches.


Revision history
^^^^^^^^ ^^^^^^^

0.1alpha		First version
0.2alpha		Bugfixes, workarounds
0.3beta			Attempt to fix (i think protocol, not mine) bug
			that caused connection to slow down.
			Some cosmetic changes and code cleanup, so i 
			call it beta now. 

Email
^^^^^

home: 	ark@mpak.convey.ru
work: 	ark@eltex.ru

                                     _     _  _  _  _      _  _
 {::} {::} {::}  CU in Hell          _| o |_ | | _|| |   / _||_|   |_ |_ |_
 (##) (##) (##)        /Arkan#iD    |_  o  _||_| _||_| /   _|  | o |_||_||_|
 [||] [||] [||]            Do i believe in Bible? Hell,man,i've seen one!
