Mailing-List: contact dev-help@river.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@river.apache.org
Date: Tue, 14 Feb 2017 01:09:18 +1000 (AEST)
From: Peter <jini@zeus.net.au>
Subject: Re: OSGi NP Complete Was: OSGi - deserialization remote invocation strategy
To: "dev@river.apache.org" <dev@river.apache.org>
Message-ID: <fca83c4fb1cc6c782794eabc3981851a@org.tizen.email>
MIME-Version: 1.0
Content-Type: MULTIPART/ALTERNATIVE; BOUNDARY="8323328-1689486743-1486998558=:1309"
archived-at: Mon, 13 Feb 2017 15:10:32 -0000

--8323328-1689486743-1486998558=:1309
Content-Type: TEXT/plain; CHARSET=UTF-8
Content-Transfer-Encoding: QUOTED-PRINTABLE

I did notice that.=0A=0AAre you comnnected to a network and performing dese=
rialization without input validation? =C2=A0 Does the secure endpoint allow=
 anon clients? =C2=A0That is even if you are using client certificates does=
 the endpoint allow anon? =C2=A0Does your endpoint allow insecure cyphers?=
=0A=0AHave a look at the changes in JGDMS.=0A=0ASafeServiceRegistrar authen=
ticates and performs input validation first.=0A=0ARegards,=0A=0APeter.=0A=
=0ASent from my Samsung device.=0A=C2=A0=0A=C2=A0=C2=A0Include original mes=
sage=0A---- Original message ----=0AFrom: Micha=C5=82 K=C5=82eczek <michal@=
kleczek.org>=0ASent: 14/02/2017 12:42:43 am=0ATo: dev@river.apache.org=0ASu=
bject: Re: OSGi NP Complete Was: OSGi - deserialization remote invocation s=
trategy=0A=0AI=C2=A0fail=C2=A0to=C2=A0understand=C2=A0how=C2=A0you=C2=A0are=
=C2=A0more=C2=A0vulnerable=C2=A0because=C2=A0of=C2=A0trusted=C2=A0 =0Alocal=
=C2=A0class=C2=A0that=C2=A0securely=C2=A0downloads=C2=A0code=C2=A0on=C2=A0b=
ehalf=C2=A0of=C2=A0a=C2=A0service. =0A=0AAnd=C2=A0how=C2=A0in=C2=A0terms=C2=
=A0of=C2=A0security=C2=A0it=C2=A0is=C2=A0different=C2=A0from=C2=A0your=C2=
=A0 =0ASecureServiceRegistrar. =0A=0AThanks, =0AMichal =0A=0APeter=C2=A0wro=
te: =0A>=C2=A0Then=C2=A0you=C2=A0are=C2=A0vulnerable=C2=A0to=C2=A0deseriali=
zation=C2=A0gadget=C2=A0attacks,=C2=A0insecure=C2=A0cyphers=C2=A0anon=C2=A0certs=
=C2=A0etc.=C2=A0 =0A> =0A>=C2=A0JGDMS=C2=A0is=C2=A0as=C2=A0secure=C2=A0as=
=C2=A0possible=C2=A0with=C2=A0current=C2=A0cyphers,=C2=A0no=C2=A0anon=C2=A0=
certs,=C2=A0no=C2=A0known=C2=A0insecure=C2=A0cyphers=C2=A0(tlsv1.2),=C2=A0i=
nput=C2=A0validation=C2=A0during=C2=A0deserialization,=C2=A0delayed=C2=A0un=
marshalling=C2=A0with=C2=A0authentication. =0A> =0A>=C2=A0I=C2=A0don't=C2=
=A0see=C2=A0why=C2=A0a=C2=A0compelling=C2=A0reason=C2=A0to=C2=A0give=C2=A0t=
hat=C2=A0up=C2=A0for=C2=A0a=C2=A0local=C2=A0class=C2=A0with=C2=A0a=C2=A0rea=
dResolve=C2=A0method? =0A> =0A>=C2=A0Sorry. =0A> =0A>=C2=A0Regards, =0A> =
=0A>=C2=A0Peter. =0A>=C2=A0Sent=C2=A0from=C2=A0my=C2=A0Samsung=C2=A0device.=
 =0A>=C2=A0=C2=A0=C2=A0 =0A>=C2=A0=C2=A0=C2=A0=C2=A0Include=C2=A0original=
=C2=A0message =0A>=C2=A0----=C2=A0Original=C2=A0message=C2=A0---- =0A>=C2=
=A0From:=C2=A0Micha=C5=82=C2=A0K=C5=82eczek<michal@kleczek.org> =0A>=C2=A0S=
ent:=C2=A014/02/2017=C2=A012:14:41=C2=A0am =0A>=C2=A0To:=C2=A0dev@river.apa=
che.org =0A>=C2=A0Subject:=C2=A0Re:=C2=A0OSGi=C2=A0NP=C2=A0Complete=C2=A0Wa=
s:=C2=A0OSGi=C2=A0-=C2=A0deserialization=C2=A0remote=C2=A0invocation=C2=A0s=
trategy =0A> =0A> =0A>=C2=A0Peter=C2=A0wrote: =0A>>=C2=A0=C2=A0=C2=A0In=C2=
=A0jgdms=C2=A0I've=C2=A0enabled=C2=A0support=C2=A0for=C2=A0https=C2=A0unica=
st=C2=A0lookup=C2=A0in=C2=A0LookupLocator=C2=A0this=C2=A0establishes=C2=A0a=
=C2=A0connection=C2=A0to=C2=A0a=C2=A0Registrar=C2=A0only,=C2=A0not=C2=A0any=
=C2=A0service.=C2=A0=C2=A0This=C2=A0functionality=C2=A0doesn't=C2=A0exist=
=C2=A0in=C2=A0River. =0A>> =0A>>=C2=A0=C2=A0=C2=A0How=C2=A0do=C2=A0you=C2=A0propose=C2=A0establi=
shing=C2=A0a=C2=A0connection=C2=A0using=C2=A0one=C2=A0of=C2=A0these=C2=A0en=
dpoints? =0A>=C2=A0I=C2=A0am=C2=A0not=C2=A0sure=C2=A0I=C2=A0understand=C2=
=A0the=C2=A0question. =0A>=C2=A0In=C2=A0exactly=C2=A0the=C2=A0same=C2=A0way=
=C2=A0how=C2=A0today=C2=A0the=C2=A0connection=C2=A0is=C2=A0established=C2=
=A0by=C2=A0for=C2=A0 =0A>=C2=A0example=C2=A0a=C2=A0ProxyTrust=C2=A0instance=
 =0A> =0A>=C2=A0Thanks, =0A>=C2=A0Michal =0A> =0A> =0A=0A

--8323328-1689486743-1486998558=:1309--