[Twisted-Python] Mobile code using PB
Hi, I am looking for a way to have a mobile code feature using PB very similar to pyro. The idea is like this: There is a server and a client. The client trust the server completly. The server does not trust the client. The client gets arbitrary classes from the server and if a module of the class is missing it raises an exception that will ultimately result in downloading the module and injecting it. If the module exists locally (same ver or something like that) do not download it. Basically i can override the security options like so: pb.globalSecurity.isModuleAllowed=\ jelly.DummySecurityOptions().isModuleAllowed pb.globalSecurity.isClassAllowed=\ jelly.DummySecurityOptions().isClassAllowed pb.globalSecurity.isTypeAllowed=\ jelly.DummySecurityOptions().isTypeAllowed If i call a remote method and the returned value is an unknown class, i recieve importError as "failure" which i can handle and send the module to the client However, if i send an unknown class as a parameter for a remote method, the exception at the remote side is handled behind the scene and i can't seem to trap it. Though, i am getting the importError failure message on the calling side (so it is somehow manageable). Is there something that already exists so i won't have to reinvent the wheel? using this trust model, do i really need pb.copyable and pb.remotecopy? I.e. i want to replace these with custom isModuleAllowed isClassAllowed, etc... 10x. -- Regards, Tzahi. -- Tzahi Fadida Blog: http://tzahi.blogsite.org | Home Site: http://tzahi.webhop.info WARNING TO SPAMMERS: see at http://members.lycos.co.uk/my2nis/spamwarning.html
On Wed, 28 Jun 2006 02:51:21 +0300, Tzahi Fadida <tzahi.ml@gmail.com> wrote:
Basically i can override the security options like so:
Why not just do Broker(security=PermitEverything()) on the client? This is why SecurityOptions is parameterizeable. You shouldn't have to monkey-patch anything.
On Wednesday 28 June 2006 03:10, glyph@divmod.com wrote:
Thank you for your answer. I am sorry, but i am fairly new to twisted. I am using the PBClientFactory but it does not have any parameters. Do you suggest to use Broker class instead somehow, because it looks a lot more low level... Also, the documentation says "RemoteCopy provides the methods that tell the Jelly layer how to create the local object from the incoming serialized state" and the same thing for copyable. However, with security off, i send classes with no pb.copyable and pb.remote. Does this mean they are being serialized differently? unsecurely in the sense of being pickled instead of jellied? What is really the difference in stating the name module.classfoo in the isAllowed security options instead of using pb.copyable and pb.remotecopy. The main problem is that if you want to send objects of classes that are imports that is from some library then you cannot simply inherit the pb.copyable etc... 10x.
-- Regards, ��������Tzahi. -- Tzahi Fadida Blog: http://tzahi.blogsite.org | Home Site: http://tzahi.webhop.info WARNING TO SPAMMERS: �see at http://members.lycos.co.uk/my2nis/spamwarning.html
On Wed, 28 Jun 2006 02:51:21 +0300, Tzahi Fadida <tzahi.ml@gmail.com> wrote:
Basically i can override the security options like so:
Why not just do Broker(security=PermitEverything()) on the client? This is why SecurityOptions is parameterizeable. You shouldn't have to monkey-patch anything.
On Wednesday 28 June 2006 03:10, glyph@divmod.com wrote:
Thank you for your answer. I am sorry, but i am fairly new to twisted. I am using the PBClientFactory but it does not have any parameters. Do you suggest to use Broker class instead somehow, because it looks a lot more low level... Also, the documentation says "RemoteCopy provides the methods that tell the Jelly layer how to create the local object from the incoming serialized state" and the same thing for copyable. However, with security off, i send classes with no pb.copyable and pb.remote. Does this mean they are being serialized differently? unsecurely in the sense of being pickled instead of jellied? What is really the difference in stating the name module.classfoo in the isAllowed security options instead of using pb.copyable and pb.remotecopy. The main problem is that if you want to send objects of classes that are imports that is from some library then you cannot simply inherit the pb.copyable etc... 10x.
-- Regards, ��������Tzahi. -- Tzahi Fadida Blog: http://tzahi.blogsite.org | Home Site: http://tzahi.webhop.info WARNING TO SPAMMERS: �see at http://members.lycos.co.uk/my2nis/spamwarning.html
participants (2)
-
glyph＠divmod.com -
Tzahi Fadida