5 ms·

The incompleteness of this article is stunning.... Replicate your database over a one way link. The problem is that replication typically uses TCP, which is a t

The incompleteness of this article is stunning.... Replicate your database over a one way link. The problem is that replication typically uses TCP, which is a two way protocol, not compatible with a one way link. You'll need to encapsulate the traffic in a one way protocol and fake the responses required by higher level two way protocols on either side. Also disconnecting one fiber, will result in a link down/no carrier link state with default networking drivers, so some patches are needed in this area. Love to see some open source software capable of this.

liotier 11y ago
Of course traffic over a data diode is UDP only (see http://actes.sstic.org/SSTIC06/Diode_ExeFilter/SSTIC06-article-Lagadec-Diode_ExeFilter.pdf http://actes.sstic.org/SSTIC06/Diode_ExeFilter/SSTIC06-artic... for an example application - if you can read French) Replication might be infeasible, but file transfer works. Developed specially for use with data diodes: BlindFTP - http://adullact.net/projects/blindftp/ http://adullact.net/projects/blindftp/ (French site, but there is a download link at http://adullact.net/frs/download.php/file/5406/BlindFTP_0.37.zip http://adullact.net/frs/download.php/file/5406/BlindFTP_0.37...)
deleted 11y ago
[deleted]
deutronium 11y ago
If you do need to modify the network driver, has anyone seen any patches for keeping the link active?
- walterbell 11y ago
  A Linux patchset from 2010, http://thread.gmane.org/gmane.linux.kernel/1028699 http://thread.gmane.org/gmane.linux.kernel/1028699
  - deutronium 11y ago
    Thanks a lot!
Spearchucker 11y ago
There are many ways of achieving replication (part two[1] describes using both TCP and UDP). System high could for instance stream to system low. I did two-way comms (not replication) via diodes once, in which a request was sent to a write-only endpoint, and the response came back from a read-only endpoint, both using UDP. I used correlation Ids (borrowed from message queues) to match a response to a request. It's just asynchronous comms. [1] http://blog.cimation.com/blog/data-diodes-and-security-in-the-real-world http://blog.cimation.com/blog/data-diodes-and-security-in-th...

liotier 11y ago

Of course traffic over a data diode is UDP only (see http://actes.sstic.org/SSTIC06/Diode_ExeFilter/SSTIC06-article-Lagadec-Diode_ExeFilter.pdf http://actes.sstic.org/SSTIC06/Diode_ExeFilter/SSTIC06-artic... for an example application - if you can read French) Replication might be infeasible, but file transfer works. Developed specially for use with data diodes: BlindFTP - http://adullact.net/projects/blindftp/ http://adullact.net/projects/blindftp/ (French site, but there is a download link at http://adullact.net/frs/download.php/file/5406/BlindFTP_0.37.zip http://adullact.net/frs/download.php/file/5406/BlindFTP_0.37...)

deleted 11y ago

[deleted]

deutronium 11y ago

If you do need to modify the network driver, has anyone seen any patches for keeping the link active?

walterbell 11y ago
A Linux patchset from 2010, http://thread.gmane.org/gmane.linux.kernel/1028699 http://thread.gmane.org/gmane.linux.kernel/1028699
- deutronium 11y ago
  Thanks a lot!

Spearchucker 11y ago

There are many ways of achieving replication (part two[1] describes using both TCP and UDP). System high could for instance stream to system low. I did two-way comms (not replication) via diodes once, in which a request was sent to a write-only endpoint, and the response came back from a read-only endpoint, both using UDP. I used correlation Ids (borrowed from message queues) to match a response to a request. It's just asynchronous comms. [1] http://blog.cimation.com/blog/data-diodes-and-security-in-the-real-world http://blog.cimation.com/blog/data-diodes-and-security-in-th...