Re: New Profile which requires TLS for IDXP available [was: (no subject)]

Jonas, Francis,

thank you for your input. I finally created a profile I called RRTLSIDXP
which requires TLS to be set up for IDXP to be transfered. It is
available via our projects site via CVS
(http://sourceforge.net/projects/threatman).

Any comments, suggestions are appreciated.

Again, thank you very much for your help!

Regards,
Sandro

Jonas Borgström wrote:
> 
> Sandro Poppi <[email protected]> writes:
> 
> > Hi again,
> >
> > I tried to write such a profile (I called it FORCE ;) but I found that
> > using server_init is not sufficient because it is called after a start
> > request of a client is received for the profile. But if a client does
> > not support the force profile it will never be called and thus -
> > assuming the server accepts other profiles - the client can start a
> > session using server supported profiles.
> >
> Hi,
> 
> I'm assuming that you want your server to only allow connecting
> clients to start an IDXP channel if the connection has been tuned
> for TLS encryption.
> 
> It isn't enough just to check if the client
> supports the TLS profile you have to check if encryption has
> been enabled (rr_tls_privatize has been called).
> 
> The best way is if the profile on the server side can be configured
> to only accept encrypted connection. But with profiles which doesn't
> support this (like IDXP) you can do as Francis suggested.
> Create a new profile (MyIDXP) that extends RRIDXP and just overrides
> the server_init function. It shouldn't do anything more like changing the
> profile identification URI or overriding some other functions.
> 
> Your modified server_init function should look something like this:
> 
> static gboolean
> server_init (RRChannel *channel, const gchar *piggyback, GError **error)
> {
>         /* Make sure the connection is encrypted */
>         if (rr_tls_is_strong_enough (rr_channel_get_connection (channel),
>                                      128) == FALSE) {
> 
>                 /* if not, return FALSE so the channel start-up is aborted */
>                 g_set_error (error, RR_BEEP_ERROR,
>                              RR_BEEP_CODE_ACTION_NOT_TAKEN,
>                              "Use TLS!");
>                 return FALSE;
>         }
>         /* Call the super class version of this function */
>         return RR_TLS_CLASS (parent_class)->server_init (channel, piggyback,
>                                                          error);
> }
> 
> > What I'm now thinking of is to extend rr_init to check for required
> > profiles.
> >
> rr_init initializes the RoadRunner library. This is probably not the
> right place to check for required profiles.
> 
> > What do you think of such a solution? What are the pros and cons from
> > your point of view? Or is there another solution for this problem I
> > didn't think of yet?
> >
> See the above.
> 
> > Any other comments? (Of course I would publish the patches on this list
> > if I do it this way so Codefactory may incorporate them into the rr
> > distribution ;)
> >
> It depends. A patch to make the IDXP profile configurable to only
> allow new channels when the connection has been tuned for encryption
> is appreciated.
> 
> / Jonas
> --
> Jonas Borgström                  [email protected]
> CodeFactory AB                   http://www.codefactory.se/
> Office: +46 (0)90 71 86 14
> _______________________________________________
> Roadrunner mailing list
> [email protected]
> http://lists.codefactory.se/mailman/listinfo/roadrunner

-- 
"Linux is like a wigwam: no windows, no gates ... apache inside!"

http://spoppi.home.pages.de/
http://www.lug-burghausen.org/