IT-SC book: Advanced CORBA® Programming with C++

firewall. Make sure that you do not forget to add the appropriate rules to lock down your ORB environment.

14.8.3 IIOP Through Firewalls

If you have clients that need to access servers through a firewall, you need to configure the firewall to permit IIOP traffic from the outside. This can be difficult, particularly if servers are started on demand and change port numbers every time they are started.

The easiest way around this problem is to start servers at a fixed port number and to configure your firewall accordingly (many repositories allow you to set a port number for each server).

Some vendors also offer various tunneling solutions. For example, it is possible to install a dedicated server that tunnels IIOP requests via HTTP through a firewall. The server acts as a bridge and forwards tunneled requests via IIOP to the actual servers, which are invisible behind the firewall. The problem with tunneling is that it obscures what is going on (by hiding IIOP requests inside HTTP packets). This means that your IIOP security policy can only be as good as your HTTP security policy.

Another approach offered by some vendors is to run a proxy server at a fixed address and port number. The proxy server acts as a firewall by offering a proxy object to the outside world for each protected object. The proxy server is typically implemented using the DII and DSI and acts as a simple delegation front end; the proxy server decides whether it should delegate a request from the outside world to a protected object by consulting a rule database. The proxy server approach offers greater flexibility and security than HTTP tunneling, but it has the drawback that scalability can become a problem; all requests to CORBA objects inside the protected domain are squeezed through the proxy server.

Currently, all IIOP tunneling and proxy solutions are proprietary, so they cannot be used with servers from different ORB vendors. Also, before you commit to a solution, you should ensure that you have confidence in the implementation. In effect, the tunneling or proxy server takes on the role of a firewall for IIOP requests. Bugs in the implementation of the server may well cause security breaches.

The OMG is in the process of standardizing access to CORBA objects through firewalls (see [19]). At the time of writing, the specification is not finalized, so we do not cover it in this book.

14.9 Summary

The implementation repository enables an ORB to provide persistent references without requiring servers to remain at fixed addresses for the lifetime of a system. In addition, an implementation repository can start servers on demand as clients send requests, so the servers for a system need not run continuously. Because CORBA does not standardize

572

IT-SC book: Advanced CORBA® Programming with C++

the implementation repository, vendors have considerable flexibility in repository design. Design choices have profound influence on flexibility, performance, and scalability of an ORB, so it is important to be aware of the capabilities of your particular implementation. Implementation repositories raise security concerns because they can potentially be misused by an intruder to gain unauthorized access to a system. To secure your system correctly, you must be fully aware of how your repository addresses such concerns.

573