Security: Context filtering

Sort of security in DLNA.

Introduction for UPnP/DLNA newcomers.

UPnP/DLNA have been developed with the concept that all components are running on trusted network. At this time, only HND (Home Network Device) were available and it was easy to define or setup a trusted network. Now we are in a world of mobility. You can connect devices from everywhere (restaurant, hotel, public places, ...) It's to be able to handle such mobility that a new class of device has been defined, the MHD (Mobile Handheld Device).

Security issues appears with the development of the wireless connectivity. Do you want your photos to be shared on a public network?

Security issues are not the same for servers and clients.
On the server side, you probably don't want to be visible and share data on untrusted networks. On the client side, you probably don't want to connect to untrusted servers that can send you damaged data.

The proposed solution is to managed a white list of trusted networks.
This is not a strong security system with password, trusted encrypted password server etc...

How would it work?

The solution is not new, is the one already implemented in Rygel. It's based on a white list. The white list could be composed of ip address, SSID or network type (eth, wlan, ...). Only interfaces defined in the white list will be trusted, the other ones will be rejected. An empty white list means all interfaces are trusted. This will ensure compatibility behavior with applications that already use GUPnP but doesn't manage white list.

How to implement it?

The solution is to implement the white list management in GUPnP, BUT NOT the white list settings/file management.

The concept is to manage the white list in memory by GUPnP. GUPnP is linked to an application, so the white list will be available only for this application. The file/setting will be managed by the applications (Rygel, dLeyna, others).
GUPnP will filter out available GUPnP context based on the white list.
The filter is dynamic, that means if the white list is updated by the application during it's lifetime, GUPnP context will be made available or discarded accordingly.

The comparison will be strict. "eth" will not match "eth0", "eth1".

Impacts on GUPnP applications?

Applications that will use the new GUPnP library but don't use the white list API, will have the same behavior, as the GUPnP default behavior is to disable the white list feature. Applications, like Rygel, that manage their own white list and would not use the new API, will have the same behavior. I will post another email in Rygel mailing list about Rygel application itself.

API proposal:

GUPnP: The white list APIs should be part of GUPnP Context.

void gupnp_context_white_list_enable(gboolean enable)
Enable or disable the white list.
When disabled, it will broadcast all available context.
This will also allow to build the white list using add/remove/reset API without performing filtering at each call of these functions. When enabled, it will filter out all available contexts, accordingly to the white list.
When enabled, each call to add/remove/reset has an immediate action.
This function doesn't change the content of the white list.

gboolean gupnp_context_white_list_is_enabled(void)
Return the status of the white list.

gboolean gupnp_context_white_list_add_interface(gchar* interface)
gchar* interface: is a semi colon separated string list of interface name. ("eth0" or ";") Add new interface(s) to the white list. It has an immediate effect only if it's enabled.
Return false if one can't be added to the white list.

gboolean gupnp_context_white_list_remove_interface(gchar* interface)
gchar* interface: is a semi colon separated string list of interface name. ("eth0" or ";") Remove new interface(s) to the white list. It has an immediate effect only if it's enabled.
Return false if all interfaces are not found, true otherwise.

gchar *gupnp_context_white_list_get_interface(void)
Return the list of interfaces in the white list.
It's a semi colon separated string list of interface name. ("eth0" or ";")

void gupnp_context_white_list_reset_interface(void)
Remove all interfaces in the white list.
It doesn't change the enabled flag.
As for add/remove, changes are immediate or no, depending of the enabled flag.

Firewall Zone
First, it's not a priority and could be implemented later.
It's only available with the new Network Manager (available in Ubuntu 13.04).
IMPORTANT: It's disabled by default!

What is Firewall Zone?
It simply the fact to enable a firewall locally, on your computer, not on your network, as your company by example. The firewall zone has the ability to affect different predefined firewall rules, to connections.
So you can tag connection as trusted, public or whatever.
The problem is that firewall could prevent DLNA device to works if the firewall rules blocks the needed communication ports or protocols.

There are 2 kinds of firewall.
The one you install yourself. In this case, we can't do anything at all.
The one installed by Ubuntu/Network Manager. In this case we can do a very small feature to simplify things a bit.

The firewall installed by Network Manager is called FirewallD and provide a dbus API. The only feature that interest us is the notification when the current active zone is changed.
This use case should be exceptional, but we can manage it.
In this case, GUPnP could perform a 'Refresh'. Depending of the new active firewall rules, servers will appears or disappears immediately in application (like dleyna). Otherwise we should wait, for the disappears case, the SSDP time out that is 30 min.

This feature should be implement in the Network Manager plug-in of GUPnP Connection Manager.

As I said, the feature is simple to implement, but it's very low priority.

Any comments are welcome.



Ludovic Ferrandis
Open Source Technology Center
Intel Corporation

Ludovic Ferrandis
Open Source Technology Center
Intel Corporation

[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]