FAQ
What is the RMI Doves?
RMI Doves is the package which contains client and server side RMI
socket factories. Those two factories allow clients to make outgoing RMI
calls and receive "callbacks" through chain of firewalls.
Why is it called "RMI
Doves"
Because RMI doves socket factory allows RMI client to get back to
their servers, similar to doves, which always return back.
What is the "Custom RMI Socket Factory"?
Look at http://java.sun.com/products/jdk/1.2/docs/guide/rmi/rmisocketfactory.doc.html
How to install the RMI Doves?
Include rmidoves.jar into your classpath. This jar contains ClientRmiDovesSocketFactory
and ServerRmiDovesSocketFactory classes from the com.rmidoves
package.
In which cases you recommend to
implement RMI Doves?
We recommend to to use ClientRmiDovesSocketFactory in all cases,
when you need to make outgoing RMI calls through client and server side
firewalls. It also allows client to receive "callbacks" from the
server. The ServerRmiDovesSocketFactory should be implemented only
if the server makes "callbacks" and at list one of its clients
implements ClientRmiDovesSocketFactory.
What kind of firewall the RMI Doves can tunnel through?
There are two types of firewalls: IP filtering firewalls and Proxy
Servers. An IP filtering firewall works at the Network layer. . It is
designed to control the flow of packets based the source, destination, port
and packet type information contained in each packet. You have a direct
connection to the Internet, but some traffic is not allowed to pass through.
In case of Proxy Server, you have no direct connection to the Internet, and
must connect through a proxy server that gets the data for you. Proxies work at
the Application Layer. They are mostly used to control, or monitor,
outbound traffic. Proxies can be transparent or not. If proxy is
transparent then client need not know about the proxy, otherwise it needs to
be configured to use it. RMI Doves can handle both packet filtering
firewalls, and Proxy Server firewalls, and if needed on top of each
other. If you want to know more about firewalls look here.
How does it compare with non-tunneling access (i.e. plain
port-to-port RMI with no firewalls) performance-wise? Sun, in their
description of the HTTP-based tunneling warns that this technique is
considerably slower than the port-to-port RMI connection.
Yes, the http-to-port tunneling is a least 3 times slower then "no
tunneling" and http-to-cgi is even slower. At the same time
RMI Doves in the "CONNECT" tunneling mode is practically at the
same speed as "no tunneling" variant.
Does it allow "Callback"?
Yes. It does! The only exception is HTTP-TO-PORT tunneling mode.
What is the CONNECT tunneling?
HTTP proxies can tunnel any application protocol, requesting connection
(usually SSL connection) with HTTP CONNECT method like this:
CONNECT host: port HTTP/1.0
As long as it's solely TCP based, which is the case for RMI. Look at
the HTTP 1.1 standard: http://www.ietf.org/rfc/rfc2616.txt
and here.
This tunneling has been implemented in number of Internet technologies. For
instance, in the VNC.
What is the HTTP-TO-PORT tunneling?
Look at http://java.sun.com/products/jdk/1.2/docs/guide/rmi/faq.html#firewall
Do you need to set the RMI Doves on the server side?
No.
Can the RMI Doves do the http-to-cgi tunneling?
No, it cannot. Also the
http-to-cgi tunneling option requires HTTP server and initialization
for java-rmi.cgi script for each remote call. Therefore it is very
inefficient. Also it needs HTTP server. In fact, if you employ RMI Doves you
don’t need to use http-to-cgi tunneling anymore.
If RMI fails to make a normal connection to the intended server, and it
notices that HTTP proxy server is configured, it doesn't always
attempt to tunnel RMI requests through that proxy server. Do you have the
problem in the RMI Doves?
No. RMI Doves is making outgoing RMI without trying different modes.
Tunneling mode must be set prior to RMI calls. By default it is
"NO-TUNNELING" mode.
How to determine type of the firewall the client is behind?
The simplest way is to look at the web browser configured at the client
machine. If Proxy Server is set in the internet options, then we definitely
deal with 'not transparent proxy server".
How to make sure that local proxy allows CONNECT method to the remote host?
In the UNIX/Linux world you would do following:
1.Telnet to local proxy i.e.:
$ telnet localProxyHost localProxyPort
You should get a response like this:
Trying... Connected to localProxyHost. Escape
character is '^]'.
2.Enter command: CONNECT remoteHost: remotePort HTTP/1.0
and press "Enter" twice!
If CONNECT method is allowed you should get response:
HTTP/ 200 Connection established
Can RMI Doves connect through
SOCKS Server?
No. If the SOCKS server is configured
in the local network, then you can use the system property socksProxyHost
and activate connection with the default implementation of sockets in the
JDK. You don’t need to activate the RMI Doves in the case.
What is SOCKS?
SOCKS is a networking proxy protocol that enables hosts on one side of a
SOCKS server to gain full access to hosts on the other side of the SOCKS
server without requiring direct IP-reachability. SOCKS is often used as a
network firewall, redirecting connection requests from hosts on opposite
sides of a SOCKS server. The SOCKS server authenticates and authorizes
requests, establishes a proxy connection, and relays data between hosts.
Proxy servers can request users authentication. Does RMI Doves
authenticate users?
Not at the moment. Number of authentication protocols is quite big, so we
decided to provide such service only on demand from particular customers.
What JDK version does RMI Doves support?
1.2 and up.
Can
we use the RMI Doves factory for particular remote object?
Yes, RMI Doves Socket factory extends RMISocketFactory and can be used in
applications as any other custom RMI socket factory
Does
RMI Doves support callbacks via NAT?
Yes.
Does
RMI Doves support SSL?
Not at the moment, but RMI Doves can be easily extended to provide
bi-directional SSL.
|
Functionality Chart
|
|
Chain of IP filtering Firewalls
|
Single Proxy Server
|
Chain of Proxy Servers
|
|
RMI Doves Socket
Factory
|
|
|
|
|
"NO-TUNNELING"
mode
|
B
|
N
|
N
|
|
"CONNECT-TUNNELING"
mode
|
B
|
B
|
B
|
|
"HTTP-TO-PORT
TUNNELING" mode
|
O
|
O
|
N
|
|
Standard
RMISocketFactory
|
|
|
|
|
"NO-TUNNELING"
mode
|
O
|
N
|
N
|
|
"HTTP-TO-PORT
TUNNELING" mode
|
O
|
O
|
N
|
|
"HTTP-TO-CGI
TUNNELING" mode
|
O
|
O
|
N
|
Notes: B -
bi-directional connection (outgoing RMI calls and "callbacks");
O - outgoing RMI calls only; N - no connection allowed
RMI Doves
API
You can see API online
RMI Doves
Demo
Introduction
The demo intent to give you first-hand experience in resolving RMI
firewall problem. This is fully functional application with the source code,
which is using ClientRmiDovesSocketFactory and ServerRmiDovesSocketFactory
. It demonstrates client ability to connect through firewall and
receive "callbacks". You have choice to run your own server
or access DemoServer through Internet at 24.82.83.214,
Port: 443 (subject to change). The only limitation for the demo is the fact
that it shows remainder, that it is demo version. To download RMI Doves Demo please click here. If after testing you decide to
purchase the software, please,contact us by E-mail.
"Smart Server" Configuration
When you expect that clients would connect from behind firewall, the server
configuration became major issue. As you will see later "smart
configuration" can help a lot:
- DemoServer exports all remote objects and create
registry at the same port:443. Assuming no help from the client firewall
administrators, to run your servers on `public' ports such as 80, 81,
8001, or 443 is the most common approach to the servers.
- DemoServer is deployed on Linux Red Hat
machine with IP Filtering firewall which redirect inbound TCP traffic
heading to port 80 to port 443.
Client is behind IP Filtering firewall or transparent Proxy Server
If TCP is allowed either on port 443 or 80, the DemoClient
should work in "No Tunneling" mode. All you need to provide is RMI
server hostname/IP and port.
If you press "Call Server" button, you will see in the
'logging" text area, that client connect to the server, calls remote
method and then receives 'callback" from the server. Chances that ports
443 or 80 allowed are very high, because 443 needs to be opened
for SSL(Secure Sockets Layer protocol) and 80 for HTTP, both are very
popular protocols for the Internet.
Client is behind not transparent Proxy Server
If HTTP CONNECT method on port 443 is allowed, then you should
choose "CONNECT" mode. All you need to provide is RMI
and Proxy Sever hostname/IP and port. If you press "Call Server"
button, you will see in the 'logging" text area, that client
connect to the server, calls remote method and then receives 'callback"
from the server. Chances are HTTP CONNECT method on port 443 is allowed are
very high, because the method must be allowed in order for SSL to work
through proxy. It is allowed by default in number of Proxy Servers, including
Appache (AllowCONNECT directive) and
Squid. This is the fastest solution, because in the case client establishes
direct socket connection to the RMI server.
But what do we if CONNECT is not
allowed? In this case we should use HTTP_TO_PORT tunneling mode, which is
much slower then CONNECT and doesn't allow "callbacks", but it
works in the case.
 Problems? Questions? Needs?
Send us E-mail
|
