TEST_SOCKD_CONF(8)

NAME
test_sockd_conf - Test the configuration file of sockd proxy server

SYNOPSIS
test_sockd_conf [ -I | -i | -B ] [ -R route_file] [ -C sockd_conf ] user src_addr dst_addr dst_port

DESCRIPTION
test_sockd_conf is used for testing whether your configuration file for the sockd proxy server is set up correctly. See sockd(8) and sockd.conf(5) for details on the proxy server and the format of the configuration file. sockd uses the configuration file to determine whether a request for its service should be granted or denied, based on who the requesting user is, from which host the request originates, which host the request is trying to reach, and to which port number the request is trying to connect. It is not always obvious by looking at the configuration file whether it indeed grants all legitimate service requests and blocks all undesirable ones. You can use test_sockd_conf to make sure that the configuration does what you want it to do. For the multi-homed version of sockd, this program also checks the routing file /etc/sockd.route to indicated which interface on the server host will be used to reach the destination host. See sockd.route(5). user is the id of an user on the request host. src_addr is the IP address of the request host. dst_addr is the IP address of the destination host. You may use domain names in place of the IP addresses if your system can resolve the names properly. dst_port is the port number on the destination host that the request wants to connect to. It can be replaced by the equivalent services name as specified in file /etc/services, e.g., telnet and 23 are equivalent in this field. These parameters together forms a hypothetical service request which test_sockd_conf feeds to the access control mechanism of sockd. test_sockd_conf echoes the aguments, then prints either the line in the configuration file which matches the request if one is found or an indication that access is denied if no match if found in the entire file. If the matching line contains the optional shell command field, the command(s) will be executed. The program also produces log entries similar to what sockd does, which usually appear in file /var/adm/messages. You can also test the special entries #NO_IDENTD: and #BAD_ID: by specifying option -I, -i, or -B. For multi-homed version, it also search the routing file to decide which network interface should be used for connection to the destination host. The program exits with code 1 if the request is permitted, 0 if denied. If errors in the arguments are found, it exits with code -1.

OPTION

-C sockd_conf
    Use sockd_conf as the configuration file to be tested. File /etc/sockd.conf is used by default.

Simulate the situation when sockd is run with option -I and
    the client host does not run identd.

Simulate the situation when sockd is run with option -i and
    the client host does not run identd.

Simulate the situation when sockd is run with either -I or
    -i and the identd on the client host reports a user-id different from what the client program claims.

Use route_file as the routing file to be tested. File
    /etc/sockd.route is used by default. This option is allowed only with multi-homed version of SOCKS server.

EXAMPLES
Assume that file /etc/sockd.conf consists of these lines:
deny	*=clyde	128.12.6.0 255.255.255.0 : /usr/ucb/mail -s 'Rejected SOCKS access by %u' root
permit	*=root	128.12.6.4 255.255.255.255 137.12.0.0 255.255.0.0
deny		128.12.0.0 255.255.0.0 eq telnet
permit		128.12.0.0 255.255.0.0
#NO_IDENTD: /usr/ucb/mail -s 'please run identd on %A' root@%A
#BAD_ID: /usr/ucb/mail -s '%U pretends to be %u on %A' root
Also assume that the file /etc/sockd.route consists of these line:
129.10.1.2	10.0.0.0.0 255.0.0.0
129.10.7.10	137.12.0.0 255.255.0.0
129.10.254.1	0.0.0.0 0.0.0.0
Following are the results of a few tests.
test_sockd_conf clyde 128.12.6.34 112.3.24.1 ftp
USER:clyde,  SRC:128.12.6.34,  DST:112.3.24.1, PORT:21
Line 1: deny	*=clyde	128.12.6.0 255.255.255.0 : /usr/ucb/mail -s 'Rejected SOCKS access by %u' root
A mail message is sent to root with the subject line 'Rejected SOCKS access by clyde'.
test_sockd_conf root 128.12.6.4 137.12.4.15 telnet
USER:root,  SRC:128.12.6.4,  DST:137.12.4.15, PORT:23
Line 2: permit	*=root	128.12.6.4 255.255.255.255 137.12.0.0 255.255.0.0
==== Checking routing file (sockd.route)...
Line 2: 129.10.7.10	137.12.0.0 255.255.0.0
test_sockd_conf jane 128.12.2.13 137.12.4.15 telnet
USER:jane,  SRC:128.12.2.13,  DST:137.12.4.15, PORT:23
Line 3: deny    128.12.0.0 255.255.0.0 eq telnet
test_sockd_conf jim 128.12.6.4 126.87.13.2 telnet
USER:jim,  SRC:128.12.6.4,  DST:126.87.13.2, PORT:23
Line 3: deny    128.12.0.0 255.255.0.0 eq telnet
test_sockd_conf root 128.12.6.4 126.87.13.2 ftp
USER:root,  SRC:128.12.6.4,  DST:126.87.13.2, PORT:21
Line 4: permit  128.12.0.0 255.255.0.0
==== Checking routing file (sockd.route)...
Line 3: 129.10.254.1	0.0.0.0 0.0.0.0
test_sockd_conf sam 128.12.36.7 10.53.23.1 70
USER:sam,  SRC:128.12.36.7,  DST:10.53.23.1, PORT:70
Line 4: permit  128.12.0.0 255.255.0.0
==== Checking routing file (sockd.route)...
Line 1: 129.10.1.2	10.0.0.0 255.0.0.0
test_sockd_conf don 23.2.6.127 10.53.23.1 70
USER:don,  SRC:23.2.6.127,  DST:10.53.23.1, PORT:70
 *** No match with any line. Access denied.
test_sockd_conf clyde 128.12.1.62 112.3.24.1 ftp
USER:clyde,  SRC:128.12.1.62,  DST:112.3.24.1, PORT:21
Line 4: permit  128.12.0.0 255.255.0.0
==== Checking routing file (sockd.route)...
Line 3: 129.10.254.1	0.0.0.0 0.0.0.0
test_sockd_conf -I joe 128.12.6.4 126.87.13.2 ftp
USER:joe,  SRC:128.12.6.4,  DST:126.87.13.2, PORT:21
Line 5: #NO_IDENTD: /usr/ucb/mail -s 'please run identd on %a' root@%A
Access denied: cannot verify user-id.
A mail message is sent to root of the host 128.12.6.4 with the subject line 'please run identd on 128.12.6.4'.
test_sockd_conf -i joe 128.12.6.4 126.87.13.2 ftp
USER:joe,  SRC:128.12.6.4,  DST:126.87.13.2, PORT:21
Line 5: #NO_IDENTD: /usr/ucb/mail -s 'please run identd on %a' root@%A
Line 4: permit          128.12.0.0 0.0.255.255
==== Checking routing file (sockd.route)...
Line 3: 129.10.254.1	0.0.0.0 0.0.0.0
A mail message is sent to root of the host 128.12.6.4 with the subject line 'please run identd on 128.12.6.4'.
test_sockd_conf -i jim 128.12.6.4 126.87.13.2 telnet
USER:jim,  SRC:128.12.6.4,  DST:126.87.13.2, PORT:23
Line 5: #NO_IDENTD: /usr/ucb/mail -s 'please run identd on %a' root@%A
Line 3: deny    128.12.0.0 0.0.255.255 eq telnet
A mail message is sent to root of the host 128.12.6.4 with the subject line 'please run identd on 128.12.6.4'.
test_sockd_conf -B joe 128.12.6.4 126.87.13.2 ftp
USER:joe,  SRC:128.12.6.4,  DST:126.87.13.2, PORT:21
Line 6: #BAD_ID: /usr/ucb/mail -s '%U pretends to be %u on %A' root
Access denied: bad user-id.
A mail message is sent to root with the subject line 'unknown pretends to be joe on 128.12.6.4'. Note that lines in a configuration file may combine to act in a way that could surprise you. Be sure you run through a thorough sequence of tests after every modification. You may be caught surprise if you only run tests on the types of requests that you believe you are trying to affect.

FILES
/etc/sockd.conf, /var/adm/messages

SEE ALSO
sockd(8), sockd.conf(5), sockd.route(5), socks.conf(5), socks_clients(1)

AUTHOR
Ying-Da Lee, ylee@syl.dl.nec.com