ATTENTION.

You must have the root privileges for using of this system. This system was
developed and tested for NeXT hardware OS NeXTSTEP 3.0.  I didn't test this
system on NeXT OS NeXTSTEP 3.[1-3] and you can get a panic trap window as a
result B-(. But I hope that all will be OK. 

		HELP-PARODY.
		
Launch the application and switch on the system by using the SWITCH ON button 
or "COMMAND-O" keys. After that you should edit the access file. Choose the
ACCESS/EDIT button on the application menu or press "COMMAND-E" keys. After
editing you should synch the contents of this file to the security system.
Choose ACCESS/SYNCH button or press "COMMAND-S". Now you can start a IP 
statistics window. Choose STATISTICS/WINDOW button or press "COMMAND-D" keys.
Every message of statistics daemon corresponds to one network operation and 
has ten columns.  The first column means a time in seconds since 1.1.1970.
The second column is a number of the  UNIX process, witch making a current
network request. The third and fourth columns - uid and gid of this process.
The fifth column means the type of the network request. 6th column is a number or name of the IP protocol. 7th - remote IP address. 8th - local UDP or TCP port. 9th - remote UDP or TCP port. 10th - errno status of the network request.
Warning !!!! Some kernel Internet services ( NFS, NSWS, PING ) _IS__NOT_  
under the ascedancy of this system. 

		TYPES OF THE NETWORK OPERATIONS.
	a- Successful passive TCP/IP connection from the remote host.
	@- Successful TCP/IP connection will be broken by the IP Security		System. Permission denied !!!!!
	A- Unsuccessful passive TCP/IP connection from the remote host.
	c- Successful active TCP/IP or UDP/IP connection to the remote host.
	C- Unsuccessful active TCP/IP or UDP/IP connection to the remote host.
	r- Successful receiving of the IP packet (all IP protocols except TCP).  
	R- Unsuccessful receiving of the IP packet.
	s- Successful sending of the IP packet (all IP protocols except TCP).
	S- Unsuccessful sending of the IP packet.
	x- Closing TCP/IP or UDP/IP connections.

 		STRUCTURE OF THE ACCESS FILE. 

Every no comment line is looked as element of description of the access and 
has the following format: 

ACCESS:USERMIN:USERMAX:GROUPMIN:GROUPMAX:HOST:MASK:PROTOMIN:PROTOMAX:PORTMIN:PORTMAX

ACCESS field defines a code of the access. It contains some subset of the "+-srcaf" symbols.

Symbol '+' means allow.

Symbol '-' means prohibit.

Symbol 'a' means access to your local host from the remote hosts or 
	from the local host by using TCP/IP protocol.

Symbol 'c' means access to the remote hosts or to the local host from the 
	your local host by using TCP/IP or UDP/IP ( in a virtual connection
	case).

Symbol 's' means transmission of the Internet packets ( without virtual 
	connection ) by using all IP protocols, except TCP/IP protocol.

Symbol 'r' means receiving of the Internet packets ( without virtual 
	connection ) by using all IP protocols, except TCP/IP protocol. 

Symbol 'f' means that current line won't be corrected by a following lines.

USERMIN and USERMAX defines a range of UNIX uids. 65535 corresponds to 
	-1 uid, 65535 corresponds to -2 uid and so on.  You may use some
	symbolic name of users. For example 13:user1 or user2:user4 or 
	256:456.  
	All users is enveloped by the 0:65535 range.

GROUPMIN and GROUPMAX defines a range of UNIX user gids. 65535 corresponds to 
	-1 gid, 65535 corresponds to -2 gid and so on.  You may not use some
	symbolic name of groups. For example  256:456.  
	All groups is enveloped by the 0:65535 range.

HOSTADDR and HOSTMASK defines a range of IP addresses. IP address <addr>
	falls into the range if the following condition is true:

	 HOSTADDR & HOSTMASK ==	<addr> & HOSTMASK

	For example:
		SOME_HOST:0xffffffff - one SOME_HOST host
		193.124.100.0:255.255.255.0 -  network 193.124.100.0 (class C)
		0:0  - all hosts into the IP world. 

	You may use some symbolic names of the hosts, networks, etc.

PROTOMIN and PROTOMAX defines a range of IP protocols.
	0:255 - all protocols;
	tcp:tcp - protocol TCP/IP;
	17:17   - protocol UDP/IP.

PORTMIN and PORTMAX defines a range of TCP/IP and UDP/IP ports.
	ftp:ftp - port number 21 ( ftp service ).
	0:1023  - range of the privileged ports.
	0:65535 - all ports.

Description example:

	a+:user:user:0:65535:example.com:255.255.255.255:tcp:tcp:15000:15010

This element of description of the access allows to EXAMPLE.COM host to fulfil
a connection with something server on your local host by using TCP/IP protocol
and from 15000 to 15010 port range. That server should be run by the user USER.

	srac-:0:65535:0:65535:0:0:0:255:0:65535

Universal prohibition  !!!

Elements of descriptions of the access ( E.D.A. ) can be corrected by other E.D.A.: 

	srac-:0:65535:0:65535:0:0:0:255:0:65535
	srac+:0:65535:0:65535:127.0.0.1:0xffffffff:0:255:0:65535

The first E.D.A. is corrected by the second E.D.A. It means that all network
operations are prohibited ( 1 ) except a access from/to LOCALHOST host (2). 
But if ACCESS field has a symbol 'f' then current E.D.A. will not be
corrected.

		THE SYSTEM RESOURCES.

IP Security system borrows the 13000 and 13001 TCP/IP ports.

P.S. All suggestions and reprimands send to 
		saty@next2.togliatti.su
NeXT mail will be accepted !!!!.