slinkServer

Description

slink is "Secure Link" for connecting BNCS networks together over a wide area network.

It is very similar indeed to the FABIAN (but without a bookings engine of FABIAN) but supports SSL and 32 bit BNCS devices/indexes.

slinkServer usually works in conjunction with slinkClient but can inter-work with conventional FABIAN.

The server sends commands to BNCS device drivers and receiving responses. This it passes down a TCP to slinkClient.

Configuration

There can be more than one slinkServer.exe applications for any one system - so there must be more than one configuration file.

A "profile" can be supplied as a command line parameter. This is used to identify the server and define which config file to use.

The configuration file is very similar to the one used for FABIAN.

If no command line parameter is supplied slinkServer uses the configuration file

slinkServer_default.ini

in the usual configuration directory for your version of BNCS.

If a profile is supplied as the single command line parameter e.g.:

slinkServer.exe london

then the configuration is taken from

slinkServer_london.ini
[slink]
;  Bind address is optional and defines which IP address to listen out for connections on
BindAddress=0.0.0.0
; Domain name is important as this implies the filename to use for SSL certificate (if you use it)
domainname=localhost.bncs.tv
; Server port
Port=46277
; either 0 or 1 - defines whether connections should use SSL or not
SSL=0

; only hosts in this list will be allowed to connect (comma delimited list of IP addresses)
[whitelist]
Host_1=

; hosts in this list will be blocked (comma delimited list of IP addresses)
[blacklist]
Host_1=

; Numbered sections (the number itself is irrelevant so long as it's unique)
[User_001]
UserName=A
UserPass=B
ControlPass=C

; Both DevWriteAccess and DevReadAccess are of the same format:
;     <device>:<index>
; or
;     <device>:<start>-<end>
DevReadAccess_01=1:1-65535
DevReadAccess_02=2:1-65535
DevWriteAccess_01=1:1-65535
DevWriteAccess_02=2:1-65535

SSL

Think of the SSL as a means of stopping your server working rather than merely keeping it secure and you'll be approaching this with the correct frame of mind.

slinkServer acts much like a web server in that it presents a certificate to the client which is verified and used to encrypt the data. The server certificate is validated by other certificates "Trusted Root CA" that are already installed on your machine as part of the OS.

If you buy an SSL certificate from a commercial vendor you'll already have a top-level certificate on you machine able to verify the certificate the server presents is valid.

You can generate your own certificates but then must either live with SSL errors or install your own "Trusted Root CA". BNCS has one of these ("Trusted Root CA") which may be installed on your OS for zero-cost SSL certificates.

It's also possible to verify the identity of clients by using client verifiction. This requires valid SSL certificates for both clients and servers and is all part of the initiation of the TCP session. This is not currently implemented for slink but could easily be.

Installing BNCS root CA

You do not need to do this to make slink work. If you buy or use corporate SSL certificates then follow the instructions for using those. However, if you want to test slink using SSL this is a good (cheap!) way to do it.

Two ways to install:

Run the installer e.g. BNCS_rootCA_Win8.exe
manually copy the server.crt file to your system and install it by hand. When you open the file Windows will ask you what to do with it - just follow the prompts to install as "Trusted Root CA"
A working BNCS root CA should appear like this (type certlm.msc in Start->Run):

BNCS Root CA

Test Certificate

There is a test certificate that you can use to test/evaluate slink. This is validates domain name: slinkserver.bncs.tv. You do not need the DNS configured for this to work - you can do it locally by adding this to c:\windows\system32\drivers\etc\hosts. For example:

Windows Hosts File

Security certificates are not to be found in the usual file-tree of a V4-based system - otherwise both certificate and private key are likely to be copied and distributed widely. Instead they are to be found here:

%CC_ROOT%\certs

Place the files slinkserver.bncs.tv.crt and slinkserver.bncs.tv.key into this path, then set the slinkServer domain name to slinkserver.bncs.tv in it's configuration file (see above). Note: if you hit "Save as..." then be sure to remove the HTML headers/footers/formating

Benchmark tests

Delivery of 4096 revertives to PuTTY client

FabianServer32 | slinkServer
12 seconds | <0.5 second

Note: for best performance do not run FabianServer32 and slinkServer on the same machine sharing the same devices. The above test running both Fabian and slink together ran at the same (slow) speed.

Delivery of 4096 database names to PuTTY client

FabianServer32 | slinkServer
<0.5 second | <0.5 second

Version History

Version | Date | Notes
1.0.0.1 | 01.02.2016 | development version
1.0.0.2 | 16.02.2016 | correct params for ADC message
1.0.0.3 | ? |
1.0.0.4 | 20.02.2016 | adds readaccess control, increases registration range from 4096 to 4294967296, starts on tidying debug
1.0.0.5 | 21.02.2016 | adds whitelist/blacklist including live editor for same
1.0.0.6 | 22.02.2016 | database checksum (MD5), start on device profile, context menu to throw users out, access management editor done
1.0.0.7 | 23.02.2016 | adds a bit of user-management, tidies the docs a tiny bit, changes the greeting
1.0.0.8 | 18.03.2016 | adds disk log, some more meaningful logging, startup errors now caught, docs improved
1.0.0.9 | 29.03.2016 | Deleting user now forcibly closes any session open with that name
1.0.0.10 | 03.10.2017 | Step one of any job is now fix the things that were working but now aren't 'cause of a toolkit upgrade. https://bugreports.qt.io/browse/QTBUG-58706. Changes the SSL default to off (so that it at least works out of the box). Changes server edit menu option to open the file (rather than do nothing). Notes on dialogs about dynamic/static nature of changes
1.0.0.11 | 20.10.2017 | Crash fix to clear up registrations on client closing
1.0.0.12 | 26.10.2017 | Router modify handling (anti-howlround)
1.0.0.13 | 06.12.2017 | Closes with CSI
1.0.14.0 | 22/12/2017 | Changes significance of version numbers. Adds version history to docs. Working and entirely functional but clumsy "you missed these..." database syncing functions
1.0.15.0 | 03/01/2018 | Less clumsy database syncing functions
1.0.16.0 | 24/04/2018 | Removes extended range support
Build: master 3586 0d983c63 Atos © 2018


-----BEGIN CERTIFICATE-----
MIIC/zCCAmigAwIBAgIBGjANBgkqhkiG9w0BAQUFADCBgzELMAkGA1UEBhMCR0Ix
DzANBgNVBAgMBkxvbmRvbjEPMA0GA1UEBwwGTG9uZG9uMQ0wCwYDVQQKDARCTkNT
MQ0wCwYDVQQLDARCTkNTMRYwFAYDVQQDDA1jZXJ0cy5ibmNzLnR2MRwwGgYJKoZI
hvcNAQkBFg1jZXJ0c0BibmNzLnR2MB4XDTE2MDMyNDE0MDY1N1oXDTIxMDMyMzE0
MDY1N1owgYkxCzAJBgNVBAYTAkdCMQ8wDQYDVQQIDAZMb25kb24xDzANBgNVBAcM
BkxvbmRvbjENMAsGA1UECgwEQk5DUzENMAsGA1UECwwEQk5DUzEcMBoGA1UEAwwT
c2xpbmtzZXJ2ZXIuYm5jcy50djEcMBoGCSqGSIb3DQEJARYNY2VydHNAYm5jcy50
djCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAqf2MmteBOsP0Kaikxq5SCjxp
vqJy1Pt3dKOoVhxa+owc0GSJxNujWt1w5WbwGPBXodt1YSlNXdfwVKqYaFlMpR0Z
dal7llUjJL2VJ1yE5XAt/cbs8XOHN3wAUl7wVBeoFrwWMBeG7tUKiJdPMnKH0Whg
qeaEXQxTedYpzKnevQUCAwEAAaN7MHkwCQYDVR0TBAIwADAsBglghkgBhvhCAQ0E
HxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNhdGUwHQYDVR0OBBYEFKjgJa5I
vLFQhxDBse3haNw62bvpMB8GA1UdIwQYMBaAFK2CYERcip67ylVEC84PWzZwTPBM
MA0GCSqGSIb3DQEBBQUAA4GBAIXexOj18M7ym75rD36MDBPVrbkWJ5iAiRT5xDX+
QuZbBBIssTgS1OqLLDuwPjFG89hbz1a3q+LYJRKM3DuhrUmIN+d0RIo3njxHX1Pt
Esw6YihAwyDmMuo4bgsNaw9akQAmXJgWILv62qBXy1dS9vjcWyHjAscYCZ8A7xBm
1vIO
-----END CERTIFICATE-----


-----BEGIN RSA PRIVATE KEY-----
MIICXgIBAAKBgQCp/Yya14E6w/QpqKTGrlIKPGm+onLU+3d0o6hWHFr6jBzQZInE
26Na3XDlZvAY8Feh23VhKU1d1/BUqphoWUylHRl1qXuWVSMkvZUnXITlcC39xuzx
c4c3fABSXvBUF6gWvBYwF4bu1QqIl08ycofRaGCp5oRdDFN51inMqd69BQIDAQAB
AoGBAKcKkHBX9JVamUOWhNT314ZXd1HtMAo6UVg8ud5kXsJ1jJr7MKZRbmSL1bSX
Qrg+9N4IWX/wpiXhXDjWqo1fsv+yMVwSGu2XRw2ZlD5N8d2TvkI2QdKUcwVaucVM
aZWJvUW0bZpopomUqQdwY6uHmyKxGgsvOzOOdvHZuYhB377BAkEA4WkyMlxvwA75
lFYGVcuHn84GlvgcuIsiV7Z59izG+MxeSjBm2u7407mw26YDUiVJhr9WBvi1hACr
Bt64Ha++jwJBAMEPCcObjvH7yhnpO/wqV59KUSq5lPnNO3B82rzqFiux30ydB4rS
JfsCPtvc+QUCYvF67S6T+asiyWafN+3IFSsCQQCSJwAqES9QCyWeHWz8IfxtDEvP
hU4yBdydnK5VhND6LqCQX/PAzqO9vC/FK04J7C1RViw0Vvxye3BpAu3EKdhXAkEA
jA1TwQJ9fZByeb+YU4OIEzd/kGYW6+z1vNHmgPu0X7hmzJZyHUP8Z46meSthvz+O
9a1+mLaifYL75iWFFkt7BwJAEJRwsC5jJcV8cRl0hxyWq+czZTwvskpf4X0zy3JH
9azBlXdMRxk9yvHVp9tgDiRu6eiO0yHc/H65MYMAw1O91g==
-----END RSA PRIVATE KEY-----