UserAgent patch for FusionInventory

[Walid nouh]

Hello,

First of all congratulations for the release of OCS 2.0 rc1, it's a
great step for the OCS Inventory project !

We did a small patch to allow FusionInventory-Agent to send inventory to
the OCS 2.0 rc1 server:
http://forge.fusioninventory.org/attachments/201/patch_2.0-rc1.patch

Could you please integrate it for the 2.0 rc2 ?
By the way, the best option would be to add an option to configure the
list of allowed user-agents.

Thanks in advance,
Regards,
Walid.

[Gonéri Le Bouder]

Post by Walid nouh
Could you please integrate it for the 2.0 rc2 ?
By the way, the best option would be to add an option to configure
the list of allowed user-agents.

Hi,

Do you have some news regarding this bug?

Best regards,

Gonéri Le Bouder

[Guillaume PROTET]

Hi,

Your patch won't be integrated as is because, for security reasons, it is inconceivable for us to integrate by default an agent not supported by OCS.
However, we are a looking for a solution to give the availibilty to your users to allow your agent to connect to their OCS server more easily than actually. We will give you some news when it will be implemented.

Kind regards,

--
Guillaume



----- Mail original -----
De: "Gonéri Le Bouder" <goneri-***@public.gmane.org>
À: "developers en" <developers.en-XRi04JE7P7s3GMRc9dnpK0B+***@public.gmane.org>
Cc: fusioninventory-devel-XbBxUvOt3X2LieD7tvxI8l/***@public.gmane.org
Envoyé: Jeudi 6 Janvier 2011 22:15:12
Objet: Re: UserAgent patch for FusionInventory

Post by Walid nouh
Could you please integrate it for the 2.0 rc2 ?
By the way, the best option would be to add an option to configure
the list of allowed user-agents.

Hi,

Do you have some news regarding this bug?

Best regards,

Gonéri Le Bouder

[Guillaume Rousse]

Post by Guillaume PROTET
Hi,
Your patch won't be integrated as is because, for security reasons, it is inconceivable for us to integrate by default an agent not supported by OCS.

I fail to see how decing to examine or reject a message, just because of
client-managed user-agent string, would provide any kind of security
benefit. You'd better validate the content of the message against a
grammar, to check what is said, rather than blindy believe the client
claiming who he is.

Or find another excuse than 'security'.

[Stéphane Urbanovski]

Post by Guillaume Rousse

Post by Guillaume PROTET
Hi,
Your patch won't be integrated as is because, for security reasons, it is inconceivable for us to integrate by default an agent not supported by OCS.

I fail to see how decing to examine or reject a message, just because of
client-managed user-agent string, would provide any kind of security
benefit. You'd better validate the content of the message against a
grammar, to check what is said, rather than blindy believe the client
claiming who he is.
Or find another excuse than 'security'.

+1

[Guillaume PROTET]

Hi,

We plan to use useragent and agent version to control API changes and control that data sent by agent are compatible with OCS server. It is what we mean about "security".

Don't forget that we are searching a solution for your agent that is not supported by OCS community, so consider that you are privileged.

Kind regards,

--
Guillaume



----- Mail original -----
De: "Stéphane Urbanovski" <s.urbanovski-***@public.gmane.org>
À: "FusionInventory Developer discussion" <fusioninventory-***@lists.alioth.debian.org>
Cc: "developers en" <developers.en-XRi04JE7P7s3GMRc9dnpK0B+***@public.gmane.org>
Envoyé: Vendredi 7 Janvier 2011 14:13:11
Objet: Re: [Fusioninventory-devel] UserAgent patch for FusionInventory

Post by Guillaume Rousse

Post by Guillaume PROTET
Hi,
Your patch won't be integrated as is because, for security reasons, it is inconceivable for us to integrate by default an agent not supported by OCS.

I fail to see how decing to examine or reject a message, just because of
client-managed user-agent string, would provide any kind of security
benefit. You'd better validate the content of the message against a
grammar, to check what is said, rather than blindy believe the client
claiming who he is.
Or find another excuse than 'security'.

+1