Grid: secure 0mq

[adamgoucher]

The default 0mq event bus should be able to be secured via configuration.

[diemol]

@adamgoucher Could you please provide some hints on how can this be implemented? Next steps?

[adamgoucher]

My idea was to use the Stonehouse pattern (http://hintjens.com/blog:49#toc5) and use the certificates people were providing to speak https to the server. If you don’t speak https to the server, then you don’t care about security so just use unencrypted (Grassland) connections with 0mq.

…

On Apr 21, 2020, at 11:05 AM, Diego Molina ***@***.***> wrote: @adamgoucher Could you please provide some hints on how can this be implemented? Next steps? — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub, or unsubscribe.

[adamgoucher]

Further clarifications (since I've got busy and my placeholder for myself is only useful to myself). If memory serves, we are using https://github.com/zeromq/jeromq as the java 0mq implementation. It supports 'curve' security (http://curvezmq.org/). The idea here is that if someone gives the various components certificates to run the webdriver protocol over https, that they also be used to secure communication between the various components and 0mq. (If they don't set the certificate, then they will be sending all their commands via http, so it makes little sense to go through the hassle of setting up secure internal communication.)

From the jzeromq project, here are some links to show the implementation of it;

• https://github.com/zeromq/jeromq/blob/master/doc/security/curve.md
• Getting CurveMQ working zeromq/jeromq#521
• https://www.javadoc.io/static/org.zeromq/jeromq/0.5.1/org/zeromq/ZMQ.Curve.html

[raju249]

@adamgoucher Are you working on this or Can I pick this issue to work?

[raju249]

@adamgoucher @diemol I am picking up this issue.

Thanks!

[shs96c]

I had to back out this change because it was causing the EndToEndTest to fail.

[AutomatedTester]

Rajendra, please fix and submit a new PR.

…

On Sep 24, 2020, 6:10 PM +0100, Simon Stewart ***@***.***>, wrote: Reopened #7856. — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub, or unsubscribe.