Browse Source

Adding info on syntribos and a trivial change

- Adding info on syntribos to the section on security tools
- Rearranging sections for Bandit and Anchor in the
alphabetical order.

Change-Id: Ia68a02dffe95c4f22bd48fa5e84d00b8dba53ed1
Rahul Nair 2 years ago
parent
commit
87d5728b67
1 changed files with 32 additions and 11 deletions
  1. 32
    11
      doc/source/index.rst

+ 32
- 11
doc/source/index.rst View File

@@ -219,6 +219,20 @@ The Security project are constantly looking at ways to introduce tooling and
219 219
 automation to improve the overall security of OpenStack projects. Some of these
220 220
 projects are outlined below.
221 221
 
222
+Anchor - ephemeral PKI
223
+^^^^^^^^^^^^^^^^^^^^^^
224
+
225
+Anchor is a lightweight, open source, Public Key Infrastructure (PKI), which
226
+uses automated provisioning of short-term certificates to enable cryptographic
227
+trust in OpenStack services. Certificates are typically valid for 12-24 hours
228
+and are issued based on the result from a policy enforcing decision engine.
229
+Short term certificates enable passive revocation, to bypass the issues with
230
+the traditional revocation mechanisms used in most PKI deployments.
231
+
232
+* `Anchor Git Repository <https://git.openstack.org/cgit/openstack/anchor>`_
233
+* `Anchor Gerrit <https://review.openstack.org/#/q/anchor,n,z>`_
234
+* `Anchor Launchpad <https://bugs.launchpad.net/anchor>`_
235
+
222 236
 Bandit - static analysis for Python
223 237
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
224 238
 
@@ -243,16 +257,23 @@ and configuration.
243 257
 * `Bandit Gerrit <https://review.openstack.org/#/q/bandit,n,z>`_
244 258
 * `Bandit Launchpad <https://bugs.launchpad.net/bandit>`_
245 259
 
246
-Anchor - ephemeral PKI
247
-^^^^^^^^^^^^^^^^^^^^^^
260
+Syntribos - Python API security testing tool
261
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
248 262
 
249
-Anchor is a lightweight, open source, Public Key Infrastructure (PKI), which
250
-uses automated provisioning of short-term certificates to enable cryptographic
251
-trust in OpenStack services. Certificates are typically valid for 12-24 hours
252
-and are issued based on the result from a policy enforcing decision engine.
253
-Short term certificates enable passive revocation, to bypass the issues with
254
-the traditional revocation mechanisms used in most PKI deployments.
263
+Syntribos is an open source automated API security testing tool that is
264
+maintained by members of the `OpenStack Security Project <https://wiki.openstack.org/wiki/Security>`_.
255 265
 
256
-* `Anchor Git Repository <https://git.openstack.org/cgit/openstack/anchor>`_
257
-* `Anchor Gerrit <https://review.openstack.org/#/q/anchor,n,z>`_
258
-* `Anchor Launchpad <https://bugs.launchpad.net/anchor>`_
266
+Given a simple configuration file and an example HTTP request, syntribos
267
+can replace any API URL, URL parameter, HTTP header and request body
268
+field with a given set of strings. Syntribos iterates through each position
269
+in the request automatically. The tool aims to automatically detect common
270
+security defects such as SQL injection, LDAP injection, buffer overflow, etc.
271
+In addition, it can be used to help identify new security defects
272
+by automated fuzzing.
273
+
274
+Syntribos can be installed directly from `pypi with pip <https://pypi.python.org/pypi/pip>`_.
275
+
276
+* `Syntribos developer documentation <http://docs.openstack.org/developer/syntribos/>`_
277
+* `Syntribos Git Repository <https://git.openstack.org/cgit/openstack/syntribos>`_
278
+* `Syntribos Gerrit <https://review.openstack.org/#/q/syntribos,n,z>`_
279
+* `Syntribos Launchpad <https://bugs.launchpad.net/syntribos>`_

Loading…
Cancel
Save