| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
Simulations backing what the review's fixes changed, beyond their unit
tests:
* a_change_forged_under_another_members_actor (1145): a change made
under b's actor at the seq of b's last change, judged by a: refused
as forged, b not refused as a whole, b's next write taken.
* an_expired_remake_aborted_by_any_member (1150): under the policy, a
coordinator gone before it decides; b aborts its remake once it
expired a grace period ago, c takes the abort, nothing refused.
* a_strict_swarm (1155): a value alice signed for another swarm,
replacing the one there, is refused as such.
|
| |
|
|
|
|
|
|
|
|
|
|
| |
Review 3.1, part of finding 12: a signed value's payload bound path,
user, time and prev, but not the swarm. A user with the same name and
key in two swarms could have an envelope replayed from one into the
other, wherever the path holds no envelope yet (prev "").
The payload now names the swarm (`swarm`), and a node takes an envelope
only for its own. /auth/whoami says the swarm, and continuum-signed and
the example in api.md sign it. Wire version 44: nodes before this
refuse such envelopes, and those after refuse the old ones.
|
| |
|
|
|
|
|
| |
a_swarm_judging_every_change waited for c's forged write to be refused
by a, b and d each. The first to judge it tells c, which drops it before
the others may have it: wait for a refusal on any of them, then for c to
drop it.
|
| |
|
|
|
|
|
|
| |
In a_strict_swarm and sealed_values, c's forged writes were waited for
to be refused by a and by b. Whichever judges them first tells c, which
drops them before the other may have judged them (it waits for their
signature, or never gets them): wait for a refusal on either, then for
c to drop them.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The API checks the path a request asks for; the rules judge everything
the change does. Where they disagreed, the honest node's change was
refused by every other node, and with signatures required the node was
refused as a whole. The plan had both gates run the same judgement.
Under a policy, each change a node makes (its own writes and those
through the API) is now judged by rules::judge as receivers will judge
it, before it is signed or sent; one every node would refuse is rolled
back (the document forked at the heads before it, same actor: the
change never left) and the request refused with 403 (StoreError::
Refused). rules::judge_held, judging a change the document holds,
moves from swarm::refusals to access::rules for both.
The simulations that play a member past its own checks write with a
helper that bypasses them (forge).
Review finding 3 (the same judgement at both gates).
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
A REFUSALS naming the swarm's first change made the node receiving it
judge that change again in a document that isn't empty, refuse it as
"a change without dependencies that isn't the epoch's root", and drop
it with everything built on it: its whole document.
The first epoch's root is now the first change a document holds, as it
comes to an empty one or as it is in one; a change judged again on a
peer's word is never refused for having no dependencies; and
drop_taken refuses to drop an epoch's root, or anything that would
leave nothing kept, logging an error instead.
Review finding 1 (critical).
|
| |
|
|
|
|
|
|
| |
A member writing past its API's checks is refused, told, drops its
change and is taken again; a node under a policy it doesn't know
takes no writes and syncs on.
Auth plan M6 (tests).
|
| |
|
|
|
|
|
|
|
| |
A node refusing changes a peer brought tells it which broke a rule; the
peer judges them itself, and if its rules refuse them too, drops them
with all built on them (its document forked without them, a fresh
actor), quarantining its own writes among them. Wire version 42.
Auth plan M6 (rejoin on taint).
|
| |
|
|
|
|
|
|
|
| |
With signatures required, a member whose own change broke a rule is
refused as a whole: sent nothing, shown in /peers (refused), in stats
(sync.refusedPeers) and on the dashboard, until a change of its is
taken again or the epoch changes.
Auth plan M6 (diverged standing).
|
| |
|
|
|
|
|
| |
A value sealed for its declared readers goes everywhere; one sealed
for a stranger too, or plain, gets nothing past the others.
Auth plan M8.
|
| |
|
|
|
|
|
|
| |
Signed values everywhere, carried over by a remake and replaced after
it; a member writing the registry or a signed path plain gets nothing
past the others.
Auth plan M7.
|
| |
|
|
|
|
|
| |
The first users' SSH keys, recorded at genesis with their entries, so a
swarm can be strict from its start.
Auth plan M7.
|
|
|
A swarm judging every change: honest writes everywhere, a joining node
registers, a forged write stays where it was made; a compaction under
the policy refuses nothing honest.
Auth plan M6.
|
