Understanding SQL*Net

Creating Special Address Parameters: PROTOCOL.ORA

PROTOCOL.ORA defines node specific and protocol specific addressing information for certain protocols. It also includes Validnode verification on those protocols that support it.

Protocol-Specific Address Parameters

The following protocols require parameters to be listed in PROTOCOL.ORA:

APPC/LU6.2

ASYNC

X.25

OSI4

This file contains node-specific non-global address parameters and other protocol specific configuration parameters. Protocols that require address information in PROTOCOL.ORA typically have LOCAL_LOOKUP=alias as one of their address parameters in TNSNAMES.ORA, LISTENER.ORA, or TNSNET.ORA. The LOCAL_LOOKUP parameter points to a non-global address in a PROTOCOL.ORA file. Oracle Network Manager does not create PROTOCOL.ORA files; they must be created by hand.

For example, consider the partial TNSNAMES.ORA, LISTENER.ORA, and PROTOCOL.ORA files for LU6.2 shown in Figure A - 3.

Figure A - 3. LOCAL_LOOKUP and PROTOCOL.ORA

The global information address information for the server HORNET.WORLD is contained in the TNSNAMES.ORA and LISTENER.ORA files. This information can be used by any client in the network. The PROTOCOL.ORA entry contains additional address parameters needed for a specific node to reach HORNET.WORLD.

See the Oracle operating system specific documentation for your platform for further information.

Validnode Verification

The objective of Validnode verification is to restrict connection access of network clients to those with enabling host privilege. The access list is in the PROTOCOL.ORA file. The list is dynamic and used by the Validnode component to decide on granting access to incoming connection requests.

To activate Validnode checking, the following parameter must be entered in PROTOCOL.ORA:

protocol.validnode_checking = yes

For example, for the TCP/IP protocol, the parameter would be:

tcp.validnode_checking = yes

The default is for Validnode checking to be off.

Note: The DECnet protocol does not currently support Validnode checking.

The access list for Validnode checking can take two forms: an INVITED_NODES list and an EXCLUDED_NODES list. The two lists are mutually exclusive. If both are present, the INVITED_NODES list takes precedence over the EXCLUDED_NODES list.

Sample Access List

The following is a sample access list in PROTOCOL.ORA for the TCP/IP protocol:

tcp.invited_nodes = (drummer.us.com,
				   139.185.5.73
				   139.185.5.111)

This list grants access to the three nodes listed, and excludes all others.

An alternative way of limiting connection requests is to exclude specific nodes. The following list provides access to all nodes except those listed:

tcp.excluded_nodes = (drummer.us.com,
				   139.185.5.73
				   139.185.5.111)

Note: Not all protocols and operating systems support Validnode verification. See the operating system-specific documentation for your platform for further details.