PROPOSAL: Remove network discovery services

8 views

Skip to first unread message

Jeff Thompson

unread,

Jan 30, 2020, 11:48:02 AM1/30/20

to Jenkins User Mailing List, Jenkins Developers

Hi,

Dating back many years, Jenkins has supported two network discovery services (UDP multicast/broadcast and DNS multicast). When this was first implemented this may have been a reasonable way to provide useful lookup services. With modern Jenkins capabilities, networks, and security considerations, this is no longer a good mechanism. There are now other ways to better accomplish pretty much everything this does.

With Jenkins Security Advisory 2020-01-29 ( https://jenkins.io/security/advisory/2020-01-29/ ) these services were disabled by default because of SECURITY-1641 / CVE-2020-2100.

The tests for these services have long been problematic because of various system issues. They have never passed for me on my development machine and others have reported the same. The issues are exacerbated with Java 11.

We propose to remove these network discovery services. See https://issues.jenkins-ci.org/browse/JENKINS-60913 and https://github.com/jenkinsci/jenkins/pull/4460 .

Please respond with any agreement or if you have any important implementations that require these capabilities. Perhaps if this is still needed, the capabilities could be pulled out of core into a plugin, maintained by someone that uses it.