TLSWRAP v0.7 final
------------------

Copyright (c) 2002 Tomas Svensson <tsn@gbdev.net>

TLSWRAP is a TLS/SSL FTP wrapper/proxy for UNIX and WIN32. This means that
you can use your favourite FTP client with any TLS/SSL enabled FTP server.

Features:

* Full encryption of both control and data connections (it's now possible to
  only encrypt the control channel).

* One process handles all connections (non-blocking I/O).

* A helper process does all hostname lookups so that the main process is free
  for other work during slow lookups.

* IPv6 supported except for one function, will be fixed when I have time.

* Both C source and Win32 (Cygwin) executable available.

Current limitations:

* You *must* use passive FTP (PASV) or Extended Passive (EPSV). Active
  FTP (PORT) will probably be supported in the future.

Tested and confirmed to work on the following operating systems (using GCC
unless specified otherwise):

FreeBSD 4.5 (i386)
OpenBSD 3.0 (i386, Alpha)
NetBSD 1.5.2 (i386, Alpha)
Debian GNU/Linux 2.2r5 (i386, StrongARM)
Slackware Linux 8.0 (i386)
Redhat Linux 7.1 (i386 with Intel(R) C++ Compiler for 32-bit applications,
                  Version 5.0.1)
Redhat Linux 7.2 (IA64 with Intel(R) C++ Itanium(TM) Compiler 5.0.1)
Solaris 7 (SPARC with both GCC and WorkShop Compilers 5.0 98/12/15 C 5.0)
Compaq Tru64 UNIX V5.1A (Alpha with Compaq C V6.4-009)
Windows 2000 (i386 with Cygwin)

How to install:

./configure
make
make install

If your system lacks /dev/urandom, do NOT link a possibly existing
/dev/random but instead use a entropy gathering daemon like PRNGD (PRNGD
is never drained and can never block (unlike the original EGD or
/dev/random). PRNGD can be found on:
http://www.aet.tu-cottbus.de/personen/jaenicke/postfix_tls/prngd.html

How to use it:

TLSWRAP listens to port 7000 by default, see below how to change it. Connect
to this port (127.0.0.1:7000) instead of the normal FTP server and replace
your username with username@hostname:port and use your password as normal.
If you put a # in from of the username, the data channel encryption will be
disabled and you can do site-to-site transfers ("FXP" or "ftp proxy").

You can also connect from a remote computer, for example if you have a
UNIX-based Internet/NAT router then run this on the server and you can
connect with Windows clients and connect safely over the Internet.

New since 0.7 beta 3: You who connect remotely *must* specify an IP
to listen to with -h, since the default (127.0.0.1) is only available
locally.

Command line options:

        -c max  
	        Maximum number of client connections to handle. Defaults
		to 5.

        -C list
                Select permitted SSL ciphers each separated by a colon.
                Defaults to RC4-SHA:RC4-MD5:DHE-DSS-RC4-SHA:DES-CBC3-SHA:
		DES-CBC3-MD5:EDH-RSA-DES-CBC3-SHA:EDH-DSS-DES-CBC3-SHA,
		you may want ALL instead. 

        -d      Debug mode. Causes the program not to detach from the
                controlling terminal and to print debug information to
                standard output.

	-E socket
		Entropy Gathering Daemon socket to use to feed OpenSSL
		random number generator (Available only if compiled
		with OpenSSL 0.9.5a or higher). Default locations will
		be searched even without this option (/var/run/egd-pool,
		/dev/egd-pool and /etc/egd-pool).

	-h host
		Specify the hostname or IP to bind the listening socket
		to. Defaults to 127.0.0.1.

        -l port
                Port to listen for clients on, defaults to 7000.

        -t tokens
                Specify the 3 characters to 1) disable data encryption,
		2) separate the username and the hostname and 3) separate
		the hostname and port. defaults to "#@:".

Contact info:

Send bugreports to tsn@gbdev.net.
