This is a static archive of the previous Open Grid Forum GridForge content management system saved from host forge.ogf.org file /sf/wiki/do/viewPage/projects.fi-rg/wiki/CODO?showDetails=true at Sun, 06 Nov 2022 05:37:54 GMT SourceForge : View Wiki Page: CODO

Project Home

Tracker

Documents

Tasks

Source Code

Discussions

File Releases

Wiki

Project Admin
Search Wiki Pages Project: FI-RG     Wiki > CODO > View Wiki Page
wiki1655: CODO

Cooperative On-Demand Opening (CODO)

Authors: S. Son, B. Allcock, M. Livny

Affiliations: University of Wisconsin, Argonne National Laboratory


CODO is an extension of the Netfilter iptables software capable of configuring new filtering rules in response to valid requests from users' applications. Its main distinctive features are:

  • The use of SSL for the signaling channel.
  • The use of an memory table to register applications authorized to traverse the firewall.
  • The ability to control both incoming and outgoing connections.

The existing network firewall must be integrated with a CODO Firewall Agent. The firewall initially presents only three open ports. The CODO agent uses these ports to listen for signaling messages: one port is used by internal applications to register themselves as available destination entities; another port is used by external applications to request connections to internal destination entities; the third port is used by internal applications to request connections to external destination entities.

All signaling messages are exchanged over an SSL channel enforcing mutual authentication with X.509 digital certificates. The CODO agent defines in its configuration parameters a list of trusted Certification Authorities. Requests coming from external applications are allowed only if the destination entities are already registered in the memory table. If all controls are successfully passed the CODO agent adds a new filtering rule into the iptables firewall. This rule allows access to the destination host and port number only from the IP address and port number indicated in the connection request.


Contribute by Gian Luca Volpato, RRZN - Leibniz Universitaet Hannover

 



Versions Associations Attachments Back Links  
Version Version Comment Created By
Version 4 Gian Luca Volpato - 12/05/2006
Version 3 Gian Luca Volpato - 12/05/2006
Version 2 Gian Luca Volpato - 12/05/2006
Version 1 Gian Luca Volpato - 12/05/2006



The Open Grid Forum Contact Webmaster | Report a problem | GridForge Help
This is a static archive of the previous Open Grid Forum GridForge content management system saved from host forge.ogf.org file /sf/wiki/do/viewPage/projects.fi-rg/wiki/CODO?showDetails=true at Sun, 06 Nov 2022 05:38:00 GMT