Hi Leon,
There are two discovery protocols, v1 and v2. V1 is deprecated.
ProxyTrust is in the process of being deprecated.
There are multiple discovery providers with various protocols:
Kerberos
TLS
https
X500
Some are not designed to be secure:
http, tcp and udp.
Multicast discovery is performed first, followed by unicast discovery
(multiple providers for each).
Security was a contraversial topic in the past, which has unfortunately
resulted in neglect of River's secure discovery protocols, we have
support nowadays to address security issues.
Security issues we're aware of in TLS, Https and X500 providers
(Kerberos pending) have been addressed in an external project fork along
with support for IPv6 and atomic input validation for deserialization,
this code is in the process of being donated back to River, but before
that can happen, River must be made modular, in order to allow the code
to be integrated in reviewable chunks, module by module.
It's a lot easier to understand the discovery protocols in the modular
build; since there's less code to digest and dependencies are easier to
understand. Best start with the package.html files, then work your way
though the code. The code is well documented.
https://github.com/pfirmstone/JGDMS/tree/trunk/JGDMS/jgdms-discovery-providers/src/main/java/org/apache/river/discovery
https://github.com/pfirmstone/JGDMS/tree/trunk/JGDMS/jgdms-platform/src/main/java/org/apache/river/discovery
https://github.com/pfirmstone/JGDMS/tree/trunk/JGDMS/jgdms-platform/src/main/java/net/jini/discovery
https://github.com/pfirmstone/JGDMS/blob/trunk/JGDMS/jgdms-platform/src/main/java/org/apache/river/api/io/AtomicMarshalInputStream.java
If you'd like to assist reviewing code or participating in River, jump
in. We'd certainly welcome third party review.
Cheers,
Peter.
On 10/10/2017 6:20 PM, Lion Hellstern wrote:
Hello,
I was not able to find out much information about the security of the service
discovery process in the apache river project.
Did I miss them and can you provide me links for them?
More Information and the background:
I study the security of service discovery protocols and right now I want to
have a look at apache river.
I read the documentation about the service discovery but there weren’t much
information. It says that you can protect the Standart Discovery Format Data
with encryption and a mac. What I am missing is a general security concept and
not just some encryption formats.
Best,
Lion
