On Mon, Apr 08, 2002 at 09:39:16AM +1000, Reynolds, Alfred wrote: > > Okay, I haven't read the spec either (geez, I hope someone does ;) but I > suspect that the UPnP request contains some kind of "service-type" field in > the request,
So we are trusting the client apps now? > so you can allow (for example) VoIP but not Computer games > (previous emails described it using soap, and soap is great at having > millions of fields). Yes, but they have to be trustable. Why would I trust an app on a client box somewhere saying "I need this port and I promise not to use it for abuse"? > Without this service type field you are correct, UPnP sounds bloody useless. But even with it, I have to trust the client app that it will do good (and secure) with the hole in the firewall that I have allocated for it. > With it however, it could provide an easy way to firewall a network from > baddies outside but people you "trust" inside (perhaps a good halfway house, > paranoid, but not overly so ;) You can't trust who is inside these days either. The sending of e-mails from a client machine without the user's intervention is a perfect example. The user was not malicious to be sure, but their machine was still hijacked. Now giving that machine a blanket access outside the firewall again is just scary. > Am I right in assuming that once you have a UPnP service running you no > longer need conntracks? Well I think the ideas here are that the UPnP service would set up the conntracks much in the same way that the conntrack_ftp helper and conntrack_irc helpers do. > The programs themselves will poke holes in the > firewall and understand how to use them, so the SIP program (for a topical > example) would correctly reformat the SIP command stream to handle the > firewall as the external interface. Oh. I see what you are saying. Yes, I suppose the applications would be responsible for tracking which holes it has asked to be open and should close them when it's done. Perhaps the UPnP spec allows the application to specify that the UPnP server close the connection after a certain amount of idle time. b. -- Brian J. Murrell
msg00593/pgp00000.pgp
Description: PGP signature
