上面的Demo是用线程实现ClientDataSet的打开
对于Corba的跨路由,需要在网关上放置Corba GateWay,因此很难做到.
对于DCOM的跨路由,请看文章:
<P>
This article is intended to provide the reader with information on how to configure the Distributed Component Object Model (DCOM) to work through a firewall. It assumes that the reader is familiar with the Transmission Control Protocol (TCP) and the User Datagram Protocol (UDP), DCOM, and understands the basics of firewall technology. Please note that the port restriction procedures outlined below only work on Microsoft&reg;
Windows NT&reg;;
Microsoft Windows&reg;
95do
es not include this functionality at this time (don't worry, it isn't necessary in most cases). Also note that much of the discussion in this article is also relevant for remote procedure call (RPC) applications which use dynamic ports. This makes sense considering that the features mentioned below are really implemented in the RPC subsystem which DCOM leverages to communicate across the network.</P>
<P>
Unlike most Internet applications which have fixed TCP and/or UDP ports, DCOM dynamically assigns&#151at run time&#151one TCP port and one UDP port to each executable process serving DCOM objects on a computer. That is, even if a process is hosting 2,000 clients and 50,000 objects, any client wishing to communicate with objects owned by it will always connect to the same TCP or UDP port. Clients discover the port associated with a particular object by connecting to and using the services provided by DCOM's Service Control Manager (SCM). The SCM always operates at a fixed network port on every computer;
in the Internet case this is always port 135 for both TCP and UDP. The SCM offers several RPC-based (not DCOM/ORPC-based) services which handle operations like: &quot;create a new COM class object for me and tell me what TCP and UDP port it is on&quot;
or &quot;I have an interface pointer, tell me where I need to go to actually use it&quot;, etc. A much more technical explanation of this process and of the DCOM wire protocol in general isdo
cumented in the <a href="/isapi/gomsdn.asp?TARGET=/library/specs/distributedcomponentobjectmodelprotocoldcom10.htm">Distributed Component Object Model Protocol -- DCOM/1.0</a>.</P>
<P>
DCOM's dynamic port allocation feature offers great flexibility in that programmers and administrators alike are free from the burden of having to configure (or hard code) applications to specific ports, free from resolving conflicts between multiple applications attempting to use the same port(s), and so on. Unfortunately, because DCOM (by default) is free to use any port between 1024 and 65535 when it dynamically selects a port for an application, it is rather &quot;firewall unfriendly&quot;
out of the box. Configuring your firewall to leave such a wide range of ports open would present a serious security hole. Microsoft's developers realized this and have implemented a feature that allows you to restrict the range of ports that DCOM will use to assign to applications.</P>
<P>
You should be aware that callbacks in DCOM are <I>not</I> handled on the same connection that is used for client/server method calls. When a server makes a callback to a client, it creates a new connection to the client and sends method calls over that separate channel. In other words, DCOM treats callbacks just like any other client/server method call, except that your &quot;client&quot;
is really a server and the &quot;server&quot;
is really a client. In some circumstances (this is <I>very</I> rare), you may need to configure port restrictions on your clients if your firewall restricts what ports machines on the inside can connect to on the outside.</P>
<P>
Also note that if you want to use callbacks through a firewall, you must use TCP. The reason being that when the server makes a call to the client, the source port will not be within the range below and thus when the client sends a reply to the server's source port, it will not be able to penetrate the firewall. This is not a problem with TCP because most firewalls keep track of TCP connections and permit bidirectional traffic on connections, regardless of the source port, as long as they are opened from a machine on the inside.</P>
<P>
One last thing before I continue, the client <I>must</I> be able to reach the server by its actual IP address. You cannot use DCOM through firewalls thatdo
address translation (i.e. where a client connects to virtual address 198.252.145.1 which the firewall maps transparently to the server's actual address of, say, 192.100.81.101). This is because DCOM stores raw IP addresses in the interface marshaling packets and if the client cannot connect to the address specified in the packet, it won't work.</P>
<P> Please also read the <A HREF="#warning">warning</A> for the DCOMCNFG utility included with the Windows NT 4.0 Service Pack 4. </P>
<P> <A HREF="#top"><IMG SRC="/com/images/top-of-page.GIF" WIDTH="11" HEIGHT="15" BORDER="0" ALT="Up">Back to contents</A></P>
<H3><A NAME="config"></A>Configuring DCOM to Use TCP Only</H3>
<P>
Here is a rundown of the transport protocols that DCOM will use depending on the client/server platform:</P>
<P>
<table border="1">
<tr>
<td bgcolor="#3366cc"><font color="#FFFFFF"
face="Arial"><strong>Platform</strong></font></td>
<td bgcolor="#3366cc"><font color="#FFFFFF"
face="Arial"><strong>Protocol</strong></font></td>
</tr>
<tr>
<td><font size="2" face="Arial">Microsoft Windows NT 4.0
&lt;-&gt;
Windows NT 4.0</font></td>
<td><font size="2" face="Arial">UDP</font></td>
</tr>
<tr>
<td><font size="2" face="Arial">Microsoft Windows NT 5.0
&lt;-&gt;
Any</font></td>
<td><font size="2" face="Arial">TCP (*)</font></td>
</tr>
<tr>
<td><font size="2" face="Arial">Microsoft Windows 95 or Windows 98
&lt;-&gt;
Any</font></td>
<td><font size="2" face="Arial">TCP </font></td>
</tr>
<tr>
<td><font size="2" face="Arial">DCOM for UNIX
&lt;-&gt;
Any</font></td>
<td><font size="2" face="Arial">TCP</font></td>
</tr>
</table></P>
<P>
<cite>&#42;
When a Windows NT 4.0 client attempts to connect to a DCOM server running anything but Windows NT 4.0, there will be a 30-45 second delay while it attempts to connect via the UDP protocol. Windows 95 and Windows 98, Windows NT 5.0, and DCOM for UNIX (including Microsoft's DCOM for UNIX product and Software AG's EntireX product) always use the TCP protocol.</cite></P>
<P>
The Windows NT 4.0 implementation of DCOM uses UDP wherever it can because benchmarks show that it can outperform TCP in certain scenarios. Unfortunately, it is very difficult to make UDP applications work through firewalls without exposing your network to unnecessary risks. Before continuing, be sure you make TCP the default protocol on all Windows NT servers by moving the &quot;NCACN_IP_TCP&quot;
value to the top of the list in the <I>DCOM Protocols</I> named value of the <B>HKEY_LOCAL_MACHINE/Software/Microsoft/Rpc</B> registry key using regedt32.exe. To eliminate a 30-45 second delay when connecting to TCP only servers, the same change should also be made on Windows NT 4.0 clients. Note that this delay only occurs if you haven't connected to the target server in a while (RPC's connection caching features retain knowledge about the server so that multiple connections in a short period of time are resolved instantaneously).</P>
<P>The Windows NT 5.0 implementation of DCOM will likely default to TCP because it is not possible to implement the SSL and SNEGO security protocols over UDP.</P>
<P> <A HREF="#top"><IMG SRC="/com/images/top-of-page.GIF" WIDTH="11" HEIGHT="15" BORDER="0" ALT="Up">Back to contents</A></P>
<H3><A NAME="tcp"></A>Restricting the Range of TCP Ports</H3>
<P>There are several registry settings that control the DCOM port restriction functionality. All of the named values listed below are located under the <B>HKEY_LOCAL_MACHINE/Software/Microsoft/Rpc/Internet</B> registry key (which you must create). Remember that you only need todo
this on the server machine, clients will automatically pick up the right port numbers when they connect to the SCM on the server machine.</P>
<P>Note that you must use regedt32.exe to configure these settings, regedit.exedo
es not currently support the REG_MULTI_SZ type required by the <I>Ports</I> named value entry. Also, you must reboot your machine any time you make changes to any of the following registry settings in order for them to take effect.</P>
<P>
<table border="1">
<tr>
<td bgcolor="#3366cc"><font color="#FFFFFF"
face="Arial"><strong>Name </strong></font></td>
<td bgcolor="#3366cc"><font color="#FFFFFF"
face="Arial"><strong>Type</strong></font></td>
<td bgcolor="#3366cc"><font color="#FFFFFF"
face="Arial"><strong>Value</strong></font></td>
<td bgcolor="#3366cc"><font color="#FFFFFF"
face="Arial"><strong>Description</strong></font></td>
</tr>
<tr>
<td><font size="2" face="Arial">Ports</font></td>
<td><font size="2" face="Arial">REG_MULTI_SZ</font></td>
<td width="40%"><font size="2" face="Arial">Specify
one port range per line. <br>Example: </font><br><font
size="2" face="Arial">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;3000-4000<br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;5141</font>
</td>
<td><font size="2" face="Arial">One or more port
ranges. The options below determine the meaning of
this named value. </font></td>
</tr>
<tr>
<td><font size="2" face="Arial">PortsInternetAvailable</font></td>
<td><font size="2" face="Arial">REG_SZ</font></td>
<td><font size="2" face="Arial">&quot;Y&quot;
(don't
include quotes)</font></td>
<td><font size="2" face="Arial"><B>Always</B> set
this to &quot;Y&quot;. </font></td>
</tr>
<tr>
<td><font size="2" face="Arial">UseInternetPorts</font></td>
<td><font size="2" face="Arial">REG_SZ</font></td>
<td><font size="2" face="Arial">&quot;Y&quot;
or
&quot;N&quot;
(don't include quotes)</font></td>
<td><font size="2" face="Arial">If this value is set
to &quot;Y&quot;, then
the <I>Ports</I> named value
indicates which ports should be used for DCOM
applications. If this value is set to &quot;N&quot;,
then
the <I>Ports</I> named value indicates which
ports should NOT be used for DCOM applications.</font></td>
</tr>
</table></P>
<P>It is strongly recommended that you open up a range of ports above port 5000. Port numbers below 5000 may already be in use by other applications and could cause conflicts with your DCOM application(s).</P>
<P> <A HREF="#top"><IMG SRC="/com/images/top-of-page.GIF" WIDTH="11" HEIGHT="15" BORDER="0" ALT="Up">Back to contents</A>
<H3><A NAME="access"></A>Restricting the Internet Accessibility to Specific Applications</H3>
<P>An even greater level of security is afforded if you configure your system so that DCOM applications have to explicitly ask to be accessible through the Internet-accessible port range. To set this up:</P>
<OL>
<LI>
Change the <I>UseInternetPorts</I> named value above from &quot;<B>Y</B>&quot;
to &quot;<B>N</B>&quot;
so that DCOM object servers (and RPC servers) aren't reachable via the Internet-accessible ports automatically. Reboot your machine.</LI>
<LI>Insert the following piece of code before <B>CoInitializeEx()</B> into every DCOM object server application that should be accessible through the Internet-accessible port range:
<PRE><code>
RPC_POLICY rp;
p.Length = sizeof (RPC_POLICY);
rp.EndpointFlags = RPC_C_USE_INTERNET_PORT;
rp.NICFlags = RPC_C_BIND_TO_ALL_NICS;
hr = RpcServerUseAllProtseqsEx
(RPC_C_PROTSEQ_MAX_REQS_DEFAULT, NULL, &rp);
</PRE></code></LI>
<LI>Add &quot;<B>rpcrt4.lib</B>&quot;
to the link command line in your makefile.</LI>
</OL>
<P> <A HREF="#top"><IMG SRC="/com/images/top-of-page.GIF" WIDTH="11" HEIGHT="15" BORDER="0" ALT="Up">Back to contents</A></P>
<H3><A NAME="firewall"></A>Configuring Your Firewall</H3>
<P>The firewall between your server and the Internet should be configured as follows:</P>
<UL>
<LI>Deny all incoming traffic from the Internet to your server.</LI>
<LI>Permit incoming traffic from all clients to TCP port 135 (and UDP port 135, if necessary) on your server.</LI>
<LI>Permit incoming traffic from all clients to the TCP ports (and UDP ports, if necessary) on your server in the <I>Ports</I> range(s) specified above.</LI>
<LI>If you are using callbacks, permit incoming traffic on all ports where the TCP connection was initiated by your server.</LI>
</UL>
<P> <A HREF="#top"><IMG SRC="/com/images/top-of-page.GIF" WIDTH="11" HEIGHT="15" BORDER="0" ALT="Up">Back to contents</A></P>
<P><A NAME="warning"></a><font color=#E80000>WARNING : The DCOMCNFG utility included with Windows NT 4.0 Service Pack 4 provides a property page that allows you to configure port restrictions without having to edit registry entries. Unfortunately, using this property page will cause many of the applications that use RPC on your machine to stop functioning properly the next time your computer reboots. If this happens to you, please delete the <B>HKEY_LOCAL_MACHINE/Software/Microsoft/Rpc/Internet</B> registry key and reboot your computer.</font></P>
<P>&nbsp;<br>
ointer):longint;stdcall;