FileFirewall: Handle Reply Codes Gracefully

[dragotin]

If the client connects to a server with a file firewall enabled, it should handle the reply codes sent by the firewall gracefully, ie. display proper error messages and not block the entire sync.

@MTRichards is it that?

@nickvergessen can you provide us with a list of the possible reply codes?

[dragotin]

@nickvergessen maybe you want take this issue, even though it's client? We do not expect that there is anything to code, just more testing.

[nickvergessen]

I have no idea of the firewall so far, but will put it on my todo for tomorrow.

[MTRichards]

Yep - This is correct - so adding more detail here.

There are really three conditions we need to check on the desktop client.
Assume that the file firewall is in operation on the server and that a rule is set.
Outcome 1) The file firewall rejects all requests because of the rule, for example the user is not on the corporate IP address range. Result: desktop client says this is the case and the sync run fails due to server file firewall rule settings. This is a complete rejection of the sync request.

Outcome 2) The file firewall rejects an upload or download for a specific folder or file, for example an mp3 upload, or a file / folder that is prohibited access from the desktop outside of the corporate network. This is a partial rejection - but the rest of the sync run and all of the other files and folders are synced properly. The ones that fail get errors on the file or folder.

More specifically, say a folder "financials" is prevented by the file firewall from being seen or synced by our clients. The client should red x that folder and everything in it, they don't get synced, but everything else not in the folder is still synced.

Outcome 3) The rule is passed and everything is allowed to be synced. This already works.

[nickvergessen]

Okay, looks like currently it just replies with 403. Will have a look for improvements

[dragotin]

@nickvergessen have had time to look into this? I think in case 1) the file firewall should reply with 503 to make the client silently disconnect (kindof).

[MTRichards]

Pushed to the next maintenance release for timing and availability.

[nickvergessen]

Sorry @dragotin I was away until sunday...

I had a quick look at the firewall code and it looks like all the rules just return a boolean. These booleans are then combined and the result is "block" or "pass". So I guess we need to change the logic of the firewall quite heavily, so we can get the reason of the fail in order to send it back as a status code.

As for the "blocking only the sync of a specific folder" point, I didn't find that feature/rule yet. All persons that ever worked on FW are not here anymore, so it will take a while until I find if that rule exists and how we can change the outcome of that.

[DeepDiver1975]

As for the "blocking only the sync of a specific folder" point, I didn't find that feature/rule yet. All persons that ever worked on FW are not here anymore, so it will take a while until I find if that rule exists and how we can change the outcome of that.

We do this the other way round:

We did request a representative rule set from PM and GCX - is the rule set in there?
No -> ignore

[DeepDiver1975]

We did request a representative rule set from PM and GCX - is the rule set in there?
No -> ignore

I'm sorry to sound rude - but this firewall nightmare is way to expensive when it comes down to time being eaten by core devs