Firewall For Dynamically Activated Resources
A facility is described for providing a firewall for dynamically activated resources. In various embodiments, the facility registers a component for processing a message. The registration includes storing a unique identifier associated with the component. When the facility receives a message, it determines whether the message contains a unique identifier and, if so, identifies a component for processing the message based on the identifier and forwards the message to the identified component.
1 . A method performed by a computer system for providing a firewall for dynamically activated resources, comprising:
receiving an indication to register a component that processes messages associated with a dynamically activated resource, the indication including a unique identifier associated with the component;
receiving a message;
determining whether the received message contains the unique identifier;
when the received message contains the unique identifier, determining whether the identified component having the unique identifier is enabled; and
when the identified component having the unique identifier is enabled, forwarding the received message to the identified component having the unique identifier; and
when the identified component having the unique identifier is disabled, filtering out the message.
2 . The method of claim 1 wherein the received message contains a remote procedure call.
3 . The method of claim 1 wherein the received message is from a distributed component object model component.
4 . The method of claim 1 wherein the determining includes analyzing contents of the received message.
5 . The method of claim 1 wherein the identifying includes looking for the identifier contained in the message in a table providing correspondences between identifiers and registered components.
6 . The method of claim 1 further comprising receiving from a user an indication that the component is to be enabled, the indication identifying a name associated with the component, the name appearing in a human-readable form.
7 . The method of claim 1 wherein the message is received at a well known port.
8 . The method of claim 1 wherein the message is forwarded to the component at a port different from a port at which the message was received.
9 . A computer-readable medium having computer-executable instructions that, when executed, cause a computer system to perform a method of providing a firewall for dynamically activated resources, the method comprising:
registering a component that processes messages associated with a dynamically activated resource, the registering including storing a unique identifier associated with the component;
receiving a message;
determining whether the received message contains the unique identifier; and
identifying the component for processing the message based on the received identifier.
10 . The computer-readable medium of claim 9 further comprising forwarding the received message to the identified component when the identified component is enabled.
11 . The computer-readable medium of claim 9 wherein the registering includes storing the received information so that when a message arrives, a component for handling the message can be determined based on a unique identifier indicated by the message.
12 . The computer-readable medium of claim 9 wherein the unique identifier identifies an interface provided by the registered component.
13 . The computer-readable medium of claim 12 wherein the registered component has multiple interfaces.
14 . The computer-readable medium of claim 13 wherein some of the interfaces are not enabled.
15 . The computer-readable medium of claim 14 wherein when the message identifies a unique identifier associated with an interface that is not enabled, the message is filtered out.
16 . A system for providing a firewall for dynamically activated resources, comprising:
an endpoint mapper that receives a message at a well known port, determines whether the message identifies a registered and enabled component that receives messages at another port, and forwards the received message to the other port; and
a filtering component that, upon receiving a message, determines whether the received message identifies the registered and enabled component, and causes the endpoint mapper to forward the received message to the identified component.
17 . The system of claim 16 wherein the message identifies a component by specifying a universally unique identifier.
18 . The system of claim 16 wherein the endpoint mapper provides the message to the filtering component.
19 . The system of claim 18 wherein the message contains a remote procedure call and the filtering component determines whether the message identifies a unique identifier that appears in a list of exceptions to a general rule that filters out all messages containing remote procedure calls.
20 . The system of claim 16 further comprising a client component that sends a message to the well known port wherein the identified component is a service provider component that receives and processes the sent message.