Includes the Buffer Overflow security fix.
	The maximum number of digits the counter can count and display can be very high. By default the maximum number of hits can be (10^80)-1, which is a very large number, that is if data is not edited by hand, practically it is impossible to overflow the counter.
	Wild card can be used in the IP's in ignore host block in the config file. There is no limit for number of IP's (as long as memory is not exhausted).
	Wild card can be used in the hosts/IP's in the auth block of the config file. There is no limit for number of hosts/IP's (as long as memory is not exhausted).
	The counter can count with image= parameter if df= parameter is specified.
	Consecutive "Reload" from the same host will not increment the counter. This feature can be turned off at compile time if desired.
	"cache" and expires" parameters can be used to change the caching behavior of certain browsers.
	Date in clock is Year 2000 safe. Note, you will not see full year in the counter until the year 2000 arrives.
	The source distribution has VMS support now, that means, the source can be compiled on Unix, NT and VMS. VMS port is done by Phil Ottewell phil@pottsoft.demon.co.uk. (Nov-30-1997).
	Meaning of BLOCK 3 of the count.cfg file differs with that of Count 2.3. So if you're using an older config file, change the Boolean in this block.

	A C compiler (ANSI or non-ANSI).
	You should be familiar with Unix operating system in order to install it on Unix. I think if you know what ls command is, you qualify. If your site is configured to run CGI programs from users' space, then you will not need root access otherwise root access is needed.
	You must run a web server. The web server must be capable of running CGI programs. If you run several web servers in your domain, you can install the counter in one server and allow the users at other servers to access the counter remotely.
	The web server must be running on any of the Unix, NT, OS/2, VMS or Amiga Operating System.

It is reported that the Count 2.3 runs on the following platforms, hopefully 2.4 will be portable as well.

Operating System	First reported by
AIX 3.2.5	robtuck@coeibm.rutgers.edu
Amiga	albertv@spinnewiel.xs4all.n (ported by)
AU/X	jussi.haro@tothepoint.fi
BSDI	chris@technonet.com
DEC OSF1	ma_muquit@fccc.edu
DG/UX	irrigacion@planet.losandes.com.ar
DomainOS 10.4.1 (on Apollo Workstns)	philippe.hubaut@etud.insa-tlse.fr
FreeBSD 2.1.5	tomcat@1lo.lublin.pl
HP-UX	takao.tsukiyama@tokyo.tohmatsu.co.jp
Linux	ashley@photocraftlab.com
NetBSD	makoto@komekome.bay.prug.or.jp
NEXTSTEP 3.3,3.2,4.0 for Mach (Motorola,Intel)	jk@exnext.com
NT 3.51 (intel)	ma_muquit@fccc.edu
NT 4.0 with IIS 2.0	srakhtar@ix.netcom.com
SunOS 4.1.x	ma_muquit@fccc.edu
Solaris 2.x	ma_muquit@fccc.edu
SCO	yuqiao@UDel.Edu
SGI	ma_muquit@fccc.edu
SINIX 5.4 (SVR4, MX500I by Siemens	Richard.Bothe@mch.sni.de
ULTRIX 4.3	mbarria@ing.puc.cl
UnixWare 2/2.03	ebh@fpk.hp.com ivanlan@tzuk-te.callware.com
VMS	phil@pottsoft.demon.co.uk (ported by)
Win95	null@dent.showa-u.ac.jp
OS/2	dshields@direct.ca (2.3) [ported by)

Does not require server-side includes. The maximum number of digits the counter can count and display can be very high. By default the maximum number of hits can be (10^80)-1, which is a very large number, that is if data is not edited by hand, practically it is impossible to overflow the counter. (new in this release). Wild card can be used in the IP's in ignore host block in the config file. There is no limit for number of IP's (as long as memory is not exhausted). (new in this release). Wild card can be used in the hosts/IP's in the auth block of the config file. There is no limit for number of hosts/IP's (as long as memory is not exhausted). (new in this release). The counter can count with image= parameter if df= parameter is specified. (new in this release). Consecutive "Reload" from the same host will not increment the counter. This feature can be turned off at compile time if desired. (new in this release). "cache" and expires" parameters can be used to change the caching behavior of certain browsers. (new in this release). Date in clock is Year 2000 safe. Note, you will not see full year in the counter until the year 2000 arrives. (new in this release). Uses image strip as well as individual digit images. Using an image strip reduces disk I/o significantly, therefore, it's faster. A program (mkstrip) is supplied to create an image strip from individual digit images. Comma can be displayed after every 3rd digit from right. Any one color of the image can be changed on the fly. Uses netmasks to mask out a range of hosts in the network or the entire network. Automatic datafile creation, strict mode, use of rgb color database can be controlled from the cfg file at run time. Any arbitrary GIF file can be displayed. Frame and other attributes of the counter can be applied to the GIF file. Count 2.0 is backward compatible with Count1.5's URL. One thing to note, the keyword wxh has no meaning in Count 2.0. It was used in Count 1.5 to specify digit dimensions. In Count 2.0 it is not required, because the digit dimensions are determined automatically. Therefore, you can use variable width digit images in this version. Reasonable default for all QUERY_STRING parameters. The same program can be used to display time or date. The time and date of any time zone in the world can be displayed. The time can be displayed in 12 or in 24 hour format. Supports digit images with variable width. Counter can be displayed without incrementing (for monitoring etc.) A literal digit string can be displayed. A random digit string can be displayed. The color of the digits can be negated. The counter can be rotated (only integral of 90 degrees, 90,180,270). The default rotation is 270 degrees. An ornamental 3D frame can be wrapped around the counter image with user defined thickness and color at run time. The frame and transparent color can be a name (e.g. red,green,pink etc.). The color can be specified as a hex string, e.g. ffffff, ff0000 etc. as well as RGB triplets as before. Single program for any number of users for any number of web pages. Any color of the counter image can be made transparent at run time. Style of digits can be specified at run time. Authorized host names can be in the configuration file. Authorized hosts are those which can run the counter remotely. Do not confuse this with visitors from certain hosts. IP filtering through a configuration file at run time. Any number of hosts can be ignored from counting. A netmask can be used to filter out a specific range of host in a network or to filter out the entire network. It's a good idea to ignore your own host or entire domain. Gen-conf program will let you create the configuration file interactively. Data file locking. Data file will not get clobbered by simultaneous Count.cgi processes. NOTE, locking may not work if the counter's datafile is on a NFS partition. Maximum number of digits can be set or counter can be displayed with exact number of digits at run time. User will be able to specify a start-up counter value at run time. This will take effect if the data file does not exist. You will be prompted by the configuration program if you want this feature or not. If you do not want to display the counter but like to keep the hits on your page, sh=0 can be defined in the QUERY_STRING at run time. It will write a 1x1 transparent GIF image to the browser but the counter in the data file will be incremented all right.

Before going to the configuration procedure, please browse through the default directory structure below. It will help you answering questions of the configuration script. You can change the name of the directories as you please, but keep the directory structure same, it will make your life much easier. You do not have to create any of these directories, they will be created for you by the Count-install program. Only thing you probably have to create are the individual datafiles (keep reading).

/usr/local/etc/Counter          <- Base Directory
    |-- Log                     <- Log Directory
    |   `-- CountX.X.log        <- Log file
    |-- conf                    <- Conf Directory
    |   `-- count.cfg           <- Configuration file
    |-- data                    <- Data Directory
    |   |-- sample.dat          <- data files
    |   |-- joe.dat
    |   |-- harry.dat
    |   `--
    |
    |-- digits                  <- Digit Directory
    |   |-- A
    |   |   `-- strip.gif       
    |   |-- B
    |   |   `-- strip.gif
    |   |-- C                   Digit sub-directories and
    |   |   `-- strip.gif       image strip of different styles
    |   |-- D
    |   |   |-- lenna.gif
    |   |   `-- strip.gif
    |   |-- E
    |   |   `-- strip.gif
    |   `--
    `-- rgb.txt                 <- color name database

Base Directory is the directory where all the sub-directories and the files related to counter reside.

Log Directory is the directory which holds the counter Log file. Counter error messages or if someone tries to access your counter remotely, warning message regarding this is written to this file.

conf directory holds the configuration file for the counter. configuration file holds information in 4 blocks. Each block resides between a left and right curly brace. This file is created by the program Gen-conf and can be hand crafted later. After creating the file, please read the comments in the file.

data directory holds all the datafiles for the counter. The datafiles stores the access counts of web pages. Each page must have a separate datafile. The datafile is specified at run-time. You will know about it later.

digits directory holds sub-directories with various styles of GIF digits. For example, A sub-directory holds the green led digits. The sub-directories have GIF digit files named zero.gif, one.gif...nine.gif. you will know about it later.

rgb.txt file is used to convert a color name (for example, cyan) to the appropriate red, green and blue color component. This file came from X consortium and supplied with the distribution. You will know about the file later.

 

The digits used in this program can be individual GIF files or all the digits can be in a single image strip. This gives flexibility of using digits of your choice. In case of individual digit images, they are named as zero.gif, one.gif,.... nine.gif. In case of image strip, the strip is named as strip.gif. At run-time, simply the directory of the images is specified to use a different style. Therefore, a single program can display digits of various styles. Here are the supplied digit styles. I will not supply individual digit images anymore. All the styles of digits are supplied as a single image strip. Note the order of the digits (you will know about it later).

Style A		designed by the author (digits/A/strip.gif)
Style B		Borrowed from HTML-access counter. (digits/B/strip.gif)
Style C		designed by benjamin@pop3.oro.net (digits/C/strip.gif)
Style D		designed by the author (digits/D/strip.gif)
Style E		designed by the author (digits/E/strip.gif)

For a huge collection of GIF digits, check out the Digit Mania page.

This program will work with any digits from the Digit Mania page. To use those digits, create subdirectories say, F, G, H, foo etc. inside the digits directory and rename the images to zero.gif, one.gif..nine.gif. I suggest create an image strip out of these digits and use it instead of using individual images.

Before using these digits, please read the sections How to use other styles of digits and How to create an image strip.

 

You can refer to the program from web page like this:

<img src="/cgi-sys/counter.cgi?df=sample.dat" align=absmiddle>

The string between ? and " is called the QUERY_STRING. Make sure there is no newlines in the <img src= line and no space in the QUERY_STRING. Here in, df=sample.dat, df means datafile and sample.dat is the counter datafile. The counter stores the hits in this file. This datafile is supplied. If you configured the counter to allow automatic datafile creation (look at count.cfg file), you can specify a datafile with df like df=count.dat. The file count.dat will be created for you if the permission to the data directory is correct.

If you configured not to allow automatic datafile creation (good thing), you have to create this file in the data directory. cd to the data directory and type:

    echo 1 > count.dat

The counter program has lots of options, you can make it work and look the way you desire. In the query string, you can use the options described in the table below. The options can be separated by a | or a &. You can use either one or combination of both. Here is an example:

<img src="/cgi-sys/counter.cgi?ft=T&frgb=gold|df=sample.dat" align=absmiddle>

The options can be in any order and not case sensitive.

Anyway, look at this Example Page you will get the picture.

If you have individual digit images, you can create an image strip out of them. Image strip reduces disk i/o significantly, because the counter will need to read only one image instead of many and the size of the image in most cases will be less than the combined size of the individual images.

A program called mkstrip is supplied to create the image strip from individual digit images. Another program called extdgts is supplied to extract individual GIF images from the strip.gif (made with mkstrip). extdgts is there to help you out if you need to extract the digit images for some reason.

To compile the programs, go to the utils directory and at the shell prompt, type:

    make

Before using them, copy mkstrip and extdgts somewhere in your path, otherwise you'll get error "command not found."

Now, go to the directory where all the individual digit images are and type:

mkstrip zero.gif one.gif two.gif .... nine.gif colon.gif am.gif pm.gif > strip.gif

Note, the file names are not important but the order is very important. For example, the file names may be 0x.gif, 1x.gif etc.

Create a directory say F inside the digits directory and copy or move the file strip.gif to F. You can use this strip with dd=F.

The above strip can be used for counter and clock but not date. It also can NOT be used if you want to display comma. If you want to use date and comma, you must have the image for comma and dash. For example, the strip of digit style A is created with the command:

mkstrip zero.gif one.gif ... nine.gif colon.gif am.gif pm.gif comma.gif \
    dash.gif > strip.gif

Please note the order of the images used in arguments carefully. The program mkstrip puts the necessary information in the GIF comment extension about the strip. The counter program parses the comment extension to determine the width of the individual digits in the strip. Therefore, the strip can have digit segments of variable width.

For example, the comment of the image strip of digit style A is:

15:0:15:30:45:60:75:90:105:120:135:150:165:180:195:210:225

The leftmost integer 15 indicates there are 15 individual digits in the image and the next colon separated pairs are the location of left and right side of the segment of the individual images from the leftmost edge. If you look carefully you will see that the individual segment of the strip is 15 pixel wide. The height is determined by reading the image. If you use the program mkstrip, you do not need to know anything about the comment, it will be created correctly for you. It is mentioned here because it is possible you obtained a strip from somewhere and you want to add the comment to the image.

2.I get errors while compiling on SGI, what's the problem?

Answer: In SGI you might get errors like:

       : libCombine.a
       : - Too many arguments
       *** Error code 1 (bu21)
       *** Error code 1 (bu21)

To make it work, in libs/combine/Makefile, remove the line

    $(RANLIB) $@ 

Or, try setting SHELL to sh, for example: setenv SHELL "/bin/sh" Thanks to avarro@CENTRCN.UMontreal.CA (12/07/95)

4. The counter does not compile on UnixWare with cc, why?

Note for UnixWare 2: Before running the configure script, set and export the environment variable CC to the string

    cc -Xc

Thanks to Ed Horch, ebh@fpk.hp.com

9. I get an error message "Host foo.com is not authorized". What's the problem?

Answer: Find the file count.cfg. Edit it with your favorite text editor. Add the hostname in the error message at block 5. If you do not have access to the file, you have to ask the person who installed the counter.

If you are running a system with many virtual domains, you will probably want to list your IP addresses with wildcards. This prevents you from having to add an entry every time a new virtual domain is added. As of version 2.4, the referrer host will be looked up in DNS if the USE_DNS directive is defined during compilation. Look at the comments in file src/Makefile.in for instruction.

For example, if you have the class C IP address of 192.160.166.[1-254], instead of listing every virtual host in this domain you could add:

192.160.166.*

to your config file at block 5. Note that this feature will NOT work with versions prior to Count 2.4.

10. What's the format of the data file?

Answer: The counter data file is a text file. The format of this file is:

        digits:IP

     Example:
        5678765456723456787567876567856:131.349.3.10
    

The digits are the numeric ASCII characters and IP is the IP number of the last host visited the page. However, if you compiled with the flag COUNT_RELOAD= -DCOUNT_RELOAD=1 in src/Makefile, then the datafile will only have the digit part.

12. How this program handles remote execution?

Answer: If you do not know, in most cases any CGI program can be executed remotely without visiting the page with a browser. For example, a CGI program x.cgi (say it returns an in-lined image) in foo. com can be called from foobar.com as follows:

    <img src="http://foo.com/cgi-bin/x.cgi">

That is, someone somewhere on the Internet can refer to your counter and increase the hits and you will not have a clue. You will get the false impression of many people visiting your page.

So how this program handles this? The counter program tries to get a environment variable called HTTP_REFERER for remote referrer. It is necessary to check this variable because when someone remotely refer to a CGI program to your machine, the variable REMOTE_ADDR will be the address of your machine. So checking REMOTE_ADDR will not work. Most of the modern browsers returns the env variable HTTP_REFERER. If the browser does not return the variable, counter will be served anyway. But you are not lost totally here. If you decided to ignore count for your host running httpd, the counter will be served but it will not be increased. So, I suggest ignore count for your own host. Gen-conf program is used for generating the configuration file.

Note this is a simple solution of a complex problem. Due to the architecture of the web itself, a determined evil hacker can always circumvent it.

21: While compiling, I get a message sh: ar: not found, what's the problem?

Answer: You see this message, because the location of the program ar is not in your PATH. You need to find out the location of ar first. To do this at the shell prompt type:

       find / -name ar -print

If you are on a Solaris box, the output might look like: /usr/ccs/bin/ar . Here /usr/ccs/bin is the directory where ar is located. You need to add this location to your path. To do this, if your shell is csh or its variant, edit the file .cshrc and put a like like:

       set path = ( $path /usr/ccs/bin )

Then source the file by typing: source .cshrc
If your shell is sh, bash or a variant of sh, edit the file .profile or .bashrc and put a like like:

    PATH=$PATH:/usr/ccs/bin
    export PATH

Then source the file by typing: . .bashrc

	Make this documentation better. Check for typos, grammatical mistakes and inconsistencies.
	If you port it to a new platform, encapsulate the platform specific code with ifdef.
	If you have some cool idea, let me know.
	Report bugs.

	Count-install is changed. If you're installing as root and specify the user and group the web server run as, the install program will change the ownership and group of the datafile and the log directory to that user and group only. Before everything was owned by the user, which is not necessary. (May-09-1998).
	bigplus library was called without initializing properly. I got some reports that on certain platforms, counter increments by 1000 sometimes. This should fix it. (Apr-26-1998).
	Thanks to Robert Edmonds and Muhammad Riza cadmandu@cbn.net.id for explaining the mystery of IE 4.01 and gzip compressed files with .gz extension. (Mar-25-1998).
	Added valign=top to the options table, it looks nicer now. Suggested by m.c. schraefelmschrae@uvvm.uvic.ca. (Jan-03-1998)
	Added the FAQ about virtual servers. (Jan-03-1998).
	People running virtual hosts can list only there IP addresses instead of having to add each virtual domain name to cfg file. Can be activated the code at compile time with the flag -DUSE_DNS at src/Makefile.in. Patch sent by Sean Reifschneider, jafo@tummy.com. (Nov-22-1997).
	Count-config was not working properly. Thanks to Ashley M. Kirchner, shley@photocraftlab.com. (Nov-22-1997).
	It was reported that counter sometime leaves zero size datafiles. Now, before calling ftrucate(), check if there's anything to write. truncate only if there's something to write. Thanks to xsw@ornl.gov, Brian S. Wallace. (Nov-21-1997).
	mkstrip directory is moved from utils to utils/mkstrip. (Nov-15-1997).
	The colon digit in digit style D was not black. Thanks to Engler, Eric, englere@smtps.saia.af.mil. (Nov-13-1997).
	A bug in Count-install script showed up due to the change in source directory structure. The location of Count.cgi was hard coded at the current working directory. Thanks to Chris Bowlby 015940b@dragon.acadiau.ca. (Nov-11-1997).
	to_str in safeStrcpy() was not getting NULL terminated all the time. mhpower@mit.edu (Nov-10-1997).
	More security patches by Matt Power, mhpower@mit.edu. It was possible to overflow some static buffers used in sprintf. (Nov-09-1997).
	Changes in source code structure. The main source has been moved to src directory. A toplevel Makefile is provided. (Nov-07-1997).
	The users who are getting "Source buffer is NULL in safeStrcat()" should be fixed now. Thanks to Wincom Administrator, admin@wcis.com. (Nov-07-1997, 11:25 PM EST)
	Some security patches by Matt Power, mhpower@mit.edu. It was possible to overflow some static buffers. (Nov-07-1997).
	There were some typos in Gen-conf and parse.c. Thanks to Craig Brockmeier, craig@picasso.ppco.com. (Nov-05-1997).
	A malloc bug was in utils.c. Thanks to Steven D. Chen, steven.d.chen@boeing.com. (Nov-05-1997).
	Implementation of safeStrcat() was incorrect. patch sent by Matt Power, mhpower@mit.edu. (Nov-03-1997).
	If "image" parameter is used and no datafile is specified, ignore counting silently. (Nov-02-1997).
	"Reload Ignore" feature can be turned off at compile time by defining the directive COUNT_IGNORE in src/Makefile. (Nov-01-1997).
	If the content of the datafile was 0, IP as not getting added to the content at all. (Oct-30-1997).
	If QUERY_STRING is empty, it was not showing the proper error message. Thanks to Mark Gilmore, mark@smtek.com. (Oct-30-1997).
	Hostnames in auth block was case sensitive. Patch sent by Takeshi OKURA, okura@osa.ncs.co.jp. (Oct-30-1997).
	There was a bug in date display in 24 hr format with "tformat=24". I don't remember who reported it. (Oct-28-1997).
	Some unnecessary include headers were left in bigplus.c. Compilation was failing on FreeBSD. Thanks to Greg King ,king@c-com.net. (Oct-25-1997)
	It was possible to go up directories with dd= parameter. Thanks to Pauli Ojanpera, ojapa@japo.fi. (Oct-21-1997)
	Gen-conf was creating wrong count.cfg file about rgb.txt. Thanks to Bill O'Neill, woneill@pobox.com. (oct-21-1997)
	Makefile.in in utils directory was wrong. Thanks to Heicher, hexular@concentric.net. (Oct-21-1997)
	comma=T used to core dump on Solaris 2.5. patch sent by James Burton, jamesb@aone.com.au (Oct-21-1997)

Buffer overflow vulnerabilities are fixed. They are very quick fix and I might have overlooked something. Please let me know. There was a bug with image= parameter related to relative path. It's fixed as well . These fixes only apply to the source distribution. The binary distributions of other platforms still have these bugs. (Oct-17-1997)

	There was a logic problem in determining AM and PM. Thanks to (stephen@txdirect.net). 01/18/96
	Strict mode (detect if browser returns HTTP_REFERER) is a configurable option.
	An error was in the code related to ACCESS_AUTH directive. Reported by c2dhanle@CompApp.DCU.IE

	The bug related to st parameter is fixed.
	The same program an be used to display time or date.

	Configuration scripts. You should not to need to hand edit any file in order to compile and install the counter.
	Reasonable defaults for all QUERY_STRING parameters. Implemented by Kevin J. Walsh
	QUERY_STRING parameters can be in any order and not case sensitive. Implemented by Kevin J. Walsh
	Counter can be displayed without incrementing. Implemented by Kevin J. Walsh
	A literal digit string can be displayed. Implemented by Kevin J. Walsh
	A random digit string can be displayed as counter. Implemented by Kevin J. Walsh
	Colors can be negated, that is counter can be displayed as a negative copy.
	The counter can be rotated (integral of 90 degrees, 90,180,270 degrees).
	No need to specify width and height of digit images.
	The frame and transparent color can be a name (e.g. red, violet etc), a hex string (e.g. ffffff, ff00ff, dddddd etc.) as well as RGB triplets (e.g. 160;255;0, 0;0;0 etc) as before. Implemented by Kevin J. Walsh
	The counter can be called as simply as: <img src="/cgi-bin/Count.cgi?df=count.dat"> or as complex as before. or any attribute can be set independently.

Log directory was not created by the Count-install script. (Thanks to robertg@zoom.com). (12/07/95).

can be compiled with -DALLOW_FILE_CREATION option. if compiled with this option, the data file will be created if it does not exist in the directory defined with DataDir and the value defined with st in QUERY_STRING will be written to it. (suggested by John Anthony Ruchak.

	Advisory data file locking. Datafile will not get messed up by simultaneous Count.cgi processes.
	Error messages are converted directly from string to image. No included GIF images are needed, will be beneficial for system with low memory. I borrowed the font array and some code from gd library. Thanks to Tom Boutell
	Authorized host names can be in configuration file.
	The hits on the web page can be counted without displaying the digits. suggested by Andres Sepulveda.

	wigingto@umr.edu suggested to use HTTP_REFERER for checking remote access to the counter.
	randerso@bite.db.uth.tmc.edu sent some code segment to account for port numbers at the end of a referrer URL.
	Ornamental frame with user defined color and thickness on the fly.
	maximum number of digits can be >= 5 or <= 10 (if you use md) (on the fly).
	if pad=0, the exact number of digits will be displayed without left padding with zeros (on the fly).
	Any color of the digits can be made transparent on the fly.
	Digit style can be provided on the fly.
	sdw@iadfw.net suggested to keep configuration file, data file, digits, log file in separate directories. It will fix a security hole.
	datafile can be edited.

Hardcoded the base directory of the counter data files. This will fix a security hole. Thanks to carsten@group.com