Security Documentation / Information

[Lion Hellstern <li...@gmail.com>]

Hello,

I was not able to find out much information about the security of the service discovery process in the apache river project.
Did I miss them and can you provide me links for them?


More Information and the background:
I study the security of service discovery protocols and right now I want to have a look at apache river.
I read the documentation about the service discovery but there weren’t much information. It says that you can protect the Standart Discovery Format Data with encryption and a mac. What I am missing is a general security concept and not just some encryption formats.


Best,
Lion

Re: Security Documentation / Information

[Peter <ji...@zeus.net.au>]

Hi Leon,

There are two discovery protocols, v1 and v2.  V1 is deprecated.  
ProxyTrust is in the process of being deprecated.

There are multiple discovery providers with various protocols:

Kerberos
TLS
https
X500

Some are not designed to be secure:
http, tcp and udp.

Multicast discovery is performed first, followed by unicast discovery 
(multiple providers for each).

Security was a contraversial topic in the past, which has unfortunately 
resulted in neglect of River's secure discovery protocols, we have 
support nowadays to address security issues.

Security issues we're aware of in TLS, Https and X500 providers 
(Kerberos pending) have been addressed in an external project fork along 
with support for IPv6 and atomic input validation for deserialization, 
this code is in the process of being donated back to River, but before 
that can happen, River must be made modular, in order to allow the code 
to be integrated in reviewable chunks, module by module.

It's a lot easier to understand the discovery protocols in the modular 
build; since there's less code to digest and dependencies are easier to 
understand.   Best start with the package.html files, then work your way 
though the code.  The code is well documented.

https://github.com/pfirmstone/JGDMS/tree/trunk/JGDMS/jgdms-discovery-providers/src/main/java/org/apache/river/discovery
https://github.com/pfirmstone/JGDMS/tree/trunk/JGDMS/jgdms-platform/src/main/java/org/apache/river/discovery
https://github.com/pfirmstone/JGDMS/tree/trunk/JGDMS/jgdms-platform/src/main/java/net/jini/discovery
https://github.com/pfirmstone/JGDMS/blob/trunk/JGDMS/jgdms-platform/src/main/java/org/apache/river/api/io/AtomicMarshalInputStream.java

If you'd like to assist reviewing code or participating in River, jump 
in.  We'd certainly welcome third party review.

Cheers,

Peter.

On 10/10/2017 6:20 PM, Lion Hellstern wrote:
> Hello,
>
> I was not able to find out much information about the security of the service discovery process in the apache river project.
> Did I miss them and can you provide me links for them?
>
>
> More Information and the background:
> I study the security of service discovery protocols and right now I want to have a look at apache river.
> I read the documentation about the service discovery but there weren’t much information. It says that you can protect the Standart Discovery Format Data with encryption and a mac. What I am missing is a general security concept and not just some encryption formats.
>
>
> Best,
> Lion