[Bug 23819] Add high-level API for FileTransfer

[bugzilla-daemon at freedesktop.org]

http://bugs.freedesktop.org/show_bug.cgi?id=23819





--- Comment #5 from Andre Moreira Magalhaes <andrunko at gmail.com>  2009-09-22 20:07:03 PST ---
> > > +    PendingVariant *pv = new PendingVariant(
> > > +            fileTransferInterface(BypassInterfaceCheck)->AcceptFile(SocketAddressTypeIPv4,
> > > +                SocketAccessControlLocalhost, QDBusVariant(QVariant(QString())),
> > > +                offset),
> > > +            this);
> > 
> > "Localhost" access control means that the CM will accept any connection from
> > any process on the local host, and give them your file (local privilege
> > escalation). We should do Port access control if the CM supports it, which is
> > done like this:
> > 
> > * create a TCP socket
> > * bind() to an unspecified port on localhost (127.0.0.1 port 0) - this will
> > make the kernel allocate a high port for you
> > * getsockname() to find out what port we got (suppose it's 12345)
> > * pass the address and port we were given in the access control parameter
> > * the CM will only allow connections from that port, closing the security hole
> > 
> > (I don't know how you do those things in Qt-land...)
> > 
> > This is not necessarily a merge blocker, but it's a release blocker.
> > 
> > If the CM is sufficiently deficient that it can't do Port access control, I
> > think it's acceptable to give up and rely on Localhost, though.
> > 
Done, but not tested as latest gabble does not support Port access control for
FT.


-- 
Configure bugmail: http://bugs.freedesktop.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the QA contact for the bug.