[Chapter 22] Wrappers and Proxies
Author: Simson Garfinkel & Gene Spafford
Date: 1999-02-04T00:17:06Z

#

| Chapter 22 |

# 22. Wrappers and Proxies

Contents:
Why Wrappers?
sendmail (smap/smapd) Wrapper
tcpwrapper
SOCKS
UDP Relayer
Writing Your Own Wrappers

A wrapper is a program that is used to control access to a second program. The wrapper literally wraps around the second program, allowing you to enforce a higher degree of security than the program can enforce on its own.

## 22.1 Why Wrappers?

Wrappers are a recent invention in UNIX security. These programs were born out of the need to modify operating systems without access to the systems' source code. However, their use has grown. and wrappers have become a rather elegant security tool for a variety of reasons:

- Because the security logic is encapsulated into a single program, wrappers are simple and easy to validate.

- Because the wrapped program remains a separate entity, it can be upgraded without a need to recertify the program that is wrapping it.

- Because wrappers call the wrapped program via the standard exec() system call, a single wrapper can be used to control access to a variety of wrapped programs.

One common use of wrappers is to limit the amount of information reaching a network-capable program. The default design of such programs can be too trusting, and can accept too much information without validation. We will discuss a few common examples later in this chapter.

This chapter describes three common wrappers:

- A `sendmail` wrapper (smap/smapd) developed by Trusted Information Systems (TIS)

- A general-purpose wrapper (tcpwrapper) for UDP and TCP daemons, developed by Wietse Venema

- SOCKS, a wrapper that permits outbound TCP/IP connections to tunnel through firewalls, developed by David Koblas and Michelle Koblas

This chapter also briefly describes the UDP Relayer, developed by Tom Fitzgerald. The final section of this chapter describes the situations in which you might wish to write wrappers of your own.

21.6 Final Comments |  | 22.2 sendmail (smap/smapd) Wrapper