JANUS CLSOCK: Difference between revisions
(No difference)
|
Revision as of 21:41, 1 November 2011
<section begin="desc" />Defines rules for a Janus socket client<section end="desc" />
The JANUS CLSOCK command defines the rules for a Janus Sockets client CLSOCK or DEBUGGERCLIENT port. These rules control access to the port. System administrators always have access to a client port, so no CLSOCK rules are required to provide socket access to these users.
JANUS CLSOCK portname rule_type [optional parameters]
JANUS CLSOCK command syntax
Overview
The JANUS CLSOCK command is slightly different from most Janus commands in that it usually takes a set of commands to fully specify the rules for a port. For instance, it may take a number of commands to specify the various users and applications that may use a port on the socket-connection $function $Sock_Conn or object method New.
The order in which JANUS CLSOCK commands are specified also affects how they are processed.
The first two parameters are positional and are required:
| portname | A 1 - 30 character name of the port, or a pattern specifying a set of ports, for which the rule is being defined. Wildcards are allowed. |
|---|---|
| rule_type | The type of rule being specified for the port or ports. Valid rule_types are:
|
The ALLOW and DISALLOW rules are processed together, from most recent to oldest. The optional parameters allowed for the JANUS CLSOCK command depend on the rule_type value. The rule types are shown below, followed by a section giving examples and showing the interaction of JANUS CLSOCK commands.
Note that the JANUS CLSOCK and JANUS SRVSOCK commands differ from the corresponding rules available with the JANUS WEB command in the following ways:
- JANUS WEB does not allow any optional parameters (for example, USGROUP on the DISALLOW rule).
- The default access for WEBSERV non-SSL ports and SRVSOCK ports is ALLOW. The default access for WEBSERV SSL ports and CLSOCK ports is DISALLOW.
- ALLOW and DISALLOW are the only rule types for JANUS CLSOCK and JANUS SRVSOCK. There are a number of other rule types for JANUS WEB.
JANUS CLSOCK ALLOW
JANUS CLSOCK portname ALLOW - [NONE] | [USER userid | USGROUP usgroup] - [FILE procfile] - [PROC procname] - [SUBSYS subsysname] - [REMOTE rmt_host rmt_portnum]
JANUS CLSOCK ALLOW command syntax
The JANUS CLSOCK ALLOW command indicates a combination of conditions which, if all specified, allow a socket-connection $function $Sock_Conn or object method New invocation to access a CLSOCK or DEBUGGERCLIENT port that matches pattern portname.
The default access for all CLSOCK and DEBUGGERCLIENT ports is to disallow all access — except system administrators can access any CLSOCK port, regardless of rules (since a system administrator can always issue JANUS CLSOCK to grant access to herself). For a non-system administrator, access to a CLSOCK port on a $Sock_Conn or New method invocation depends on the most recent rule for that port that matches the conditions of the $Sock_Conn or New method call:
- If the conditions match all clauses on a JANUS CLSOCK ALLOW rule, access to the port is allowed.
- If the conditions match all clauses on a JANUS CLSOCK DISALLOW rule, access to the port is disallowed.
- If the conditions match neither an ALLOW nor DISALLOW rule, access to the port is disallowed.
If the JANUS CLSOCK ALLOW command is specified with no optional parameters, any $Sock_Conn or New method invocation can access the CLSOCK ports that match the pattern in portname.
The optional parameters for the JANUS CLSOCK ALLOW command are:
| NONE | Indicates that no $Sock_Conn or New method invocation is allowed to access portname. If NONE is specified, no other optional parameters may be specified. | ||||||
|---|---|---|---|---|---|---|---|
| USER userid | Indicates that the Model 204 user ID userid may issue $Sock_Conn or a New method call for portname. For example, if userid is HOMER, a user that logs in as HOMER will be allowed access to portname. If userid is SIMP*, a user that logs in as any user ID that begins with the string SIMP is allowed access to portname.
The USER parameter cannot be specified if the USGROUP parameter is specified. USER '' (that is, USER with the null string) is not allowed, since there is always a (non-null) user ID when a request is issued. USER * is allowed, but it is meaningless: it does not change which conditions a rule matches. | ||||||
| USGROUP usgroup | Indicates that a Model 204 user is allowed access to portname if his or her user ID matches an entry in the user group identified by usgroup. User groups are defined with the JANUS DEFINEUSGROUP command. The USGROUP parameter cannot be specified if the USER parameter is specified. | ||||||
| FILE procfile | Indicates that $Sock_Conn or a New method call is allowed to access portname if invoked by executing an outer procedure stored in a Model 204 file whose name matches the pattern procfile. FILE * indicates that access is allowed by any procedure except a temporary request or an instream procedure. FILE '' indicates that access is allowed only by a temporary request or an in-stream procedure. | ||||||
| PROC procname | Indicates that $Sock_Conn or a New method call is allowed to access portname if invoked by executing an outer procedure whose name matches the pattern procname. PROC * indicates that access is allowed by any procedure except a temporary request or an in-stream procedure. PROC '' indicates that access is allowed only by a temporary request or an in-stream procedure. | ||||||
| SUBSYS subsysname | Indicates that a $Sock_Conn or New method invocation is allowed to access portname if issued from an APSY subsystem with a name that matches the pattern subsysname. SUBSYS * indicates that access is allowed by any subsystem. SUBSYS '' indicates that access is allowed only by a non-subsystem procedure or temporary request, or by an in-stream procedure. | ||||||
| REMOTE rmt_host rmt_portnum | Indicates that a $Sock_Conn or New method invocation is allowed to access portname if the remote host and port number ($Sock_CONN or New method arguments, with their defaults from the REMOTE clause of the JANUS DEFINE command for the CLSOCK port) match rmt_host and rmt_portnum, respectively. Rmt_host can be any of the following:
Note that when the IPGROUP ipgroup or the ipaddr form is used, the rule can match whether a connection is specified by host name or IP address. If the connection is by host name, it is first translated to an IP address, which is then used to match the rule. rmt_portnum can be either of these:
|
JANUS CLSOCK DISALLOW
JANUS CLSOCK portname DISALLOW - [USER userid | USGROUP usgroup] - [FILE procfile] - [PROC procname] - [SUBSYS subsysname] - [REMOTE rmt_host rmt_portnum]
JANUS CLSOCK DISALLOW command syntax
The JANUS CLSOCK DISALLOW command indicates a combination of conditions which, if all specified, prevent a socket-connection $function $Sock_Conn or object method invocation from accessing the CLSOCK ports that match pattern portname.
The default access for all CLSOCK and DEBUGGERCLIENT ports is to disallow all access — except system administrators can access any CLSOCK port, regardless of rules (since a system administrator can always issue JANUS CLSOCK to grant access to herself). For a non-system administrator, access to a CLSOCK port on a $Sock_Conn or New method invocation depends on the most recent rule for that port that matches the conditions of the $Sock_Conn or New method call:
- If the conditions match all clauses on a JANUS CLSOCK DISALLOW rule, access to the port is not allowed.
- If the conditions match all clauses on a JANUS CLSOCK ALLOW rule, access to the port is allowed.
- If the conditions match neither an ALLOW nor DISALLOW rule, access to the port is disallowed.
If the JANUS CLSOCK DISALLOW command is specified with no optional parameters, no $Sock_Conn invocation can access the CLSOCK ports that match the pattern in portname.
The optional parameters for the JANUS CLSOCK DISALLOW command are:
| USER userid | Indicates that the Model 204 user ID userid may not issue $Sock_Conn or the New method for portname. For example, if userid is HOMER, a user that logs in as HOMER is not allowed access to portname. If userid is SIMP*, a user that logs in as any user ID that begins with the string SIMP is not allowed access to portname.
The USER parameter cannot be specified if the USGROUP parameter is specified.
USER * is allowed, but it is meaningless; it does not change which conditions a rule matches. | ||||||
|---|---|---|---|---|---|---|---|
| >USGROUP usgroup | Indicates that a Model 204 user is not allowed access to portname if his or her user ID matches an entry in the user group identified by usgroup. User groups are defined with the JANUS DEFINEUSGROUP command. The USGROUP parameter cannot be specified if the USER parameter is specified. | ||||||
| FILE procfile | Indicates that $Sock_Conn or the New method is not allowed to access portname if invoked by executing an outer procedure stored in a Model 204 file whose name matches the pattern procfile. FILE * indicates that access is allowed only by a temporary request or an in-stream procedure. FILE '' indicates that access is allowed by any procedure except a temporary request or an in-stream procedure. | ||||||
| PROC procname | Indicates that $Sock_Conn or the New method is not allowed to access portname if invoked by executing an outer procedure whose name matches the pattern procname. PROC * indicates that access is allowed only by a temporary request or an in-stream procedure. PROC '' indicates that access is allowed by any procedure except a temporary request or an instream procedure. | ||||||
| SUBSYS subsysname | Indicates that a $Sock_Conn or New method invocation is not allowed to access portname if issued from an APSY subsystem with a name that matches the pattern subsysname. SUBSYS * indicates that access is allowed only by a non-subsystem procedure or temporary request, or by an in-stream procedure. SUBSYS indicates that access is allowed by any subsystem. | ||||||
| REMOTE rmt_host rmt_portnum | Indicates that a $Sock_Conn or New method invocation is not allowed to access portname if the remote host and port number ($Sock_Conn or New method arguments, with their defaults from the REMOTE clause of the JANUS DEFINE command for the CLSOCK port) match rmt_host and rmt_portnum, respectively. Rmt_host can be any of the following:
Note that when the IPGROUP ipgroup or the ipaddr form is used, the rule can match whether a connection is specified by host name or IP address. If the connection is by host name, it is first translated to an IP address, which is then used to match the rule. Rmt_portnum can be either of these:
|
Rule matching order and examples
Each execution of a JANUS CLSOCK subcommand adds to the set of rules for the specified port. Individual rules cannot be deleted nor modified. All rules can be deleted only by stopping and deleting the port definition. Deleting a port definition, however, should not be necessary, as long as you follow the two golden rules:
- Specify the most general rules first and the most specific last.
- Specify an initial rule that “clears” all related rules.
The following example illustrates these principles:
JANUS CLSOCK TEST21 DISALLOW * JANUS CLSOCK TEST21 ALLOW SUBSYS ECOMMER* JANUS CLSOCK TEST21 ALLOW PROC FILETRANS - REMOTE IPADDR 169.84.111.0-24 9333 JANUS CLSOCK TEST21 ALLOW PROC FILETRANS - REMOTE IPADDR 169.84.112.0-24 9333 JANUS CLSOCK TEST21 ALLOW USER SIMP*
In this example, any previously specified ALLOW rules on port TEST21 are made obsolete by the first DISALLOW rule. Once the TEST21 access rules are cleared, the rules allow invocation of $Sock_Conn or the New method for port TEST21, if any of the following conditions are met:
- It is invoked from a subsystem whose name begins with the string
ECOMMER. - It is invoked for port number 9333 at a remote host that is on either the subnet 169.84.111.0 or the subnet 169.84.112.0.
- It is invoked by a Model 204 user whose ID begins with the string
SIMP.
References and links
See: Janus command list