Patch-ID# 105047-17
Keywords: ENCRYPTION security NAT CDP ftp-related EFS
Synopsis: SunScreen SPF-200 1.0: patch for miscellaneous fixes
Date: Jul/06/98

********************************************************************************

	EXPORT INFORMATION: This patch kit is for a product which
	performs cryptographic functions, which are subject to U.S.
	export control, and must not be exported outside the U.S.
	without prior approval of the U.S. government.  Prior export
	approval must be obtained by the user of this product.

        Please contact your Sun Solution Center or other SunSoft
        authorized service provider (ASP) in the U.S. to obtain a
        copy of the actual patch kit.

	By obtaining this software, you are agreeing to comply with all
	of the United States and other applicable country laws and
	regulations when either exporting, re-exporting or importing
	this software or any underlying information or technology.
	Further, you acknowledge that you are not a national of Cuba,
	Iran, Iraq, Libya, North Korea, Sudan or Syria or a party that
	is listed in the U.S. Table of Denial Orders or U.S. Treasury
	Department's list of Specially Designated Nationals.

	Product is restricted from being used for the design or
	development of nuclear, chemical, biological, weapons or
	missile technology without the prior permission of the U.S.
	Government.

	The patch kit consists of:

	1) Installation diskette
	2) Uninstall diskette
	3) Patch Guide with instructions and graphics on
	   installing the 105047-17 patch on the SunScreen SPF-200
           Screen and the SunScreen SPF-200 Administration Station.

********************************************************************************

Solaris Release:

SunOS Release:

Unbundled Product: SunScreen SPF-200

Unbundled Release: 1.0

Relevant Architectures:

BugId's fixed with this patch: 4030235 4031724 4039375 4047032 4047722 4050031 4051749 4059903 4059755 4060737 4060904 4061468 4061678 4070166 4074678 4083582 4089713 4094076 4091790 4095765 4101297 4103464 4103474 4109363 4110326 4110830 4111324 4119033 4120691 4123705

Changes incorporated in this version:

Patches accumulated and obsoleted by this patch: 105047-16

Patches which conflict with this patch:

Patches required with this patch:

Obsoleted by:

Files included with this patch:

	SUNWicgSS
	/kernel/drv/screen
	/opt/SUNWicg/SunScreen/admin/cgi-bin/config_detail
	/opt/SUNWicg/SunScreen/bin/natcompiler
	/opt/SUNWicg/SunScreen/bin/ss_backup
	/opt/SUNWicg/SunScreen/bin/ss_certificate
	/opt/SUNWicg/SunScreen/bin/ss_compiler
	/opt/SUNWicg/SunScreen/bin/ss_logd
	/opt/SUNWicg/SunScreen/bin/ss_rule
	/opt/SUNWicg/SunScreen/bin/ss_getskip
	/opt/SUNWicg/SunScreen/bin/ss_putskip
	/opt/SUNWicg/SunScreen/bin/ss_xbackup
	/usr/kernel/misc/screen_ftp
	/usr/kernel/misc/screen_raudio
	/usr/kernel/drv/screen_skip

	SUNWicgSA
	/opt/SUNWicg/SunScreenAdmin/bin/.jumpstart/finish.spf
	/opt/SUNWicg/SunScreenAdmin/bin/sas_logdump
	/opt/SUNWicg/SunScreenAdmin/bin/spf_admin_install
	/opt/SUNWicg/SunScreenAdmin/bin/spf_remote_backup
	/opt/SUNWicg/SunScreenAdmin/bin/spf_remote_restore
	/opt/SUNWicg/SunScreenAdmin/lib/sas_rules
	/opt/SUNWicg/SunScreenAdmin/man/cat1m/spf_remote_backup.1m
	/opt/SUNWicg/SunScreenAdmin/man/man1m/spf_remote_backup.1m
	/opt/SUNWicg/SunScreenAdmin/man/cat1m/spf_remote_restore.1m
	/opt/SUNWicg/SunScreenAdmin/man/man1m/spf_remote_restore.1m
	/opt/SUNWicg/SunScreenAdmin/man/cat1m/ss_rule.1m
	/opt/SUNWicg/SunScreenAdmin/man/man1m/ss_rule.1m

	SUNWicgSP
	/kernel/strmod/spf

Problem Description:

	4123705 - remote restore does not restore all certificates (SUNWicgSS)

	(from 105047-16)
	4109363 - spf_backup fails if the diskette gets filled (SUNWicgSA)
	4110326 - spf_backup fails if more than 224 files written to DOS
	   diskette (SUNWicgSA)
	4119033 - SPF ss_certificate command fails if large number of certs
	   specified (SUNWicgSS)
	4120691 - Bad TCP checksum with NAT & FTP "PORT" command (SUNWicgSS)

	(from 105047-15)
	4030235 - Support for Backup/Restore from remote admin station
	   needed (SUNWicgSA, SUNWicgSS)
	4047722 - missing ability to sort rules by service, from, or to
	   address (SUNWicgSA, SUNWicgSS)
	4110830 - ftp with NAT fails if the public/private addresses
	   differ in length (SUNWicgSS)

	(from 105047-14)
	4111324 - Bad address rewrite using Dynamic NAT (SUNWicgSS)

	(from 105047-13)
	4095765 - SPF-200: Problems with NAT/Decrpytion, Admin Stn can't
	connect to Screen (SUNWicgSS)

	(from 105047-12)
	4103464 - memory leak with ICMP rejects on failed packets (SUNWicgSS)
	4103474 - memory leak with SNMP alerts on failed packets (SUNWicgSS)

	(from 105047-11)
	4101297 - SPF-200 screen mbuf leak (SUNWicgSS)

	(from 105047-10)
	4089713 - Compiler dumps core when compiling skip rule (SUNWicgSS)	
	4094076 Screen will panic when using Dynamic NAT with a one:one
	   relationship defined. (SUNWicgSS)

	(from 105047-08)
	4031724 realaudio pkts can fail why=261(invalid format) (SUNWicgSS)
	4061678 packets logged are missing their ethernet (MAC) header
	   (SUNWicgSA)
	4083582 screen reboots under special circumstances (port scanning
	   with ftp)(SUNWicgSS)

	(from 105047-07)

	4051749 Screen freezes - kernel memory leak handling big packets
	   (SUNWicgSS)
	4091790 cannot get session logging to work for encrypted rules
	   (SUNWicgSS)

	(from 105047-05)

	4074678 spf crashes processing UDP port 1640 packets that are not CDP
	   (SUNWicgSS)

	(from 105047-04)

	4070166 SPF proxy ARP'ing for private STATIC NAT addresses (SUNWicgSS)

	(from 105047-03)

	4061468 SPF-200's hme interfaces connected to 10Mbit stop working
	   (SUNWicgSP)

	(from 105047-02)

	4059755 public source address corrupted when mapping a list of networks
	   (SUNWicgSS)
	4060737 NAT occurs when it should not (between two private addresses)
	   (SUNWicgSS)
	4060904 passive ftp fails (SUNWicgSS)

	(from 105047-01)

	4039375 spf_admin_install netmask prompt looks like y/n question
	   (SUNWicgSA)
	4047032 screen can be accessed during install cycle (SUNWicgSA)
	4050031 Can delete active config - no warning - screen can't be managed
	   any longer (SUNWicgSS)
	4059903 rip broadcast packets dest=255.255.255.255 fail (SUNWicgSS)


Instructions to install patch on SunScreen SPF-200 Administration Station
-------------------------------------------------------------------------

Note:  Only the SUNWicgSA part of the patch will be applied to the
       Administration Station with this part of the procedure.

1.  Become root on the Admin Station.

2.  Insert the same patch floppy into the Admin Station's floppy drive.

3.  Then type:

	# volcheck
	# cd /floppy/floppy0/Patches
	# 105047-17/installpatch 105047-17

4.  Restart any SPF administrative applications.

Instructions to install patch on SunScreen SPF-200 Screen
---------------------------------------------------------

Note:  All three parts of the patch (SUNWicgSA, SUNWicgSS and
       SUNWicgSP) will be applied to the screen with this part
       of the procedure.

1.  Insert the install patch floppy into the Screen's floppy drive.

2.  Reminder: the SunScreen SPF-200 CD-ROM must be in the Screen's
    CD-ROM drive, as is usually the case.

3.  Turn the Screen off; wait ten seconds; turn the Screen on.

4.  Activation of the currently active configuration with a
    'Compile and Activate' using the Configuration page of the
    HTML manager is required to have the RIP broadcast bug
    (4059903) fix applied.


Instructions for identifying patches installed on system
--------------------------------------------------------

1. To identify the patch level on your SunScreen SPF-200 screen
  (since there is no keyboard or monitor), you must use this command:

	#ss_client <screen-name> packages > screen.pkginfo

   This shows (1) ls -lt /var/sadm/patch, (2) pkginfo -l, and
   (3) the contents of /var/log/patch.log.

2.  To identify the patch level on your SunScreen SPF-200 Administrative
    Workstation, execute the commands directly.

	%ls -lt /var/sadm/patch > admin.pkginfo
	%pkginfo -l >> admin.pkginfo


Instructions to backout patch on SunScreen SPF-200 Administration Station
-------------------------------------------------------------------------

1.  Become root on the Admin Station.

2.  Then type:

        # cd /var/sadm/patch
        # 105047-17/backoutpatch 105047-17


Instructions to backout patch on SunScreen SPF-200 Screen
---------------------------------------------------------

1.  Insert the backout patch floppy into the Screen's floppy drive.

2.  Reminder: the SunScreen SPF-200 CD-ROM must be in the Screen's
    CD-ROM drive, as is usually the case.

3.  Turn the Screen off; wait ten seconds; turn the Screen on.
