Download QuO Users Guide

APOD TOOLKIT USERS’ GUIDE
•
addToWhiteList (in string host)
prevent host from ever being blocked
•
removeFromWhitelist ( in string host)
allow host to be blocked again
After installing the mechanism, you can defense-enable your application by using the sysconds provided in
this mechanism. This typically involves generating a QuO contract and/or QuO Delegate that makes calls on
the sysconds. The sysconds, in turn, make calls on the manager component, which executes the Linux
"iptables" command. Note that the sysconds and the manger are not necessarily collocated on the same
machine. It is necessary to start the manager on the host on which you want to control the firewall, via
> $APOD_ROOT/mechanisms/bin/IptablesManagerImpl -naming.class
<nclass> -naming.properties <pfile>
with the <nclass> being a supported naming class and <pfile> being the property file used for naming
purposes.(see documentation of objectserver).
The following figure shows the interactions between the two components syscond and manager. The syscond
is in the context of a contract that is attached to an object (marked “Client”) that makes CORBA call to
another CORBA object (marked “Object”).
Client
Contract
Object
execute(<function>)
IPtablesValueSC
longValue()
IPTablesManager
execute ("sudo iptables -add rule / -remove rule")
long=getValue()
sudo iptables -add rule / -remove rule
Operating System
Figure 2 Organization of the IPTables based packet filtering mechanism
BBN TECHNOLOGIES
17