| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
|
| |
a_swarm_judging_every_change waited for c's forged write to be refused
by a, b and d each. The first to judge it tells c, which drops it before
the others may have it: wait for a refusal on any of them, then for c to
drop it.
|
| |
|
|
|
|
|
|
| |
In a_strict_swarm and sealed_values, c's forged writes were waited for
to be refused by a and by b. Whichever judges them first tells c, which
drops them before the other may have judged them (it waits for their
signature, or never gets them): wait for a refusal on either, then for
c to drop them.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
The API checks the path a request asks for; the rules judge everything
the change does. Where they disagreed, the honest node's change was
refused by every other node, and with signatures required the node was
refused as a whole. The plan had both gates run the same judgement.
Under a policy, each change a node makes (its own writes and those
through the API) is now judged by rules::judge as receivers will judge
it, before it is signed or sent; one every node would refuse is rolled
back (the document forked at the heads before it, same actor: the
change never left) and the request refused with 403 (StoreError::
Refused). rules::judge_held, judging a change the document holds,
moves from swarm::refusals to access::rules for both.
The simulations that play a member past its own checks write with a
helper that bypasses them (forge).
Review finding 3 (the same judgement at both gates).
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
A REFUSALS naming the swarm's first change made the node receiving it
judge that change again in a document that isn't empty, refuse it as
"a change without dependencies that isn't the epoch's root", and drop
it with everything built on it: its whole document.
The first epoch's root is now the first change a document holds, as it
comes to an empty one or as it is in one; a change judged again on a
peer's word is never refused for having no dependencies; and
drop_taken refuses to drop an epoch's root, or anything that would
leave nothing kept, logging an error instead.
Review finding 1 (critical).
|
| |
|
|
|
|
|
|
| |
A member writing past its API's checks is refused, told, drops its
change and is taken again; a node under a policy it doesn't know
takes no writes and syncs on.
Auth plan M6 (tests).
|
| |
|
|
|
|
|
|
|
| |
A node refusing changes a peer brought tells it which broke a rule; the
peer judges them itself, and if its rules refuse them too, drops them
with all built on them (its document forked without them, a fresh
actor), quarantining its own writes among them. Wire version 42.
Auth plan M6 (rejoin on taint).
|
| |
|
|
|
|
|
|
|
| |
With signatures required, a member whose own change broke a rule is
refused as a whole: sent nothing, shown in /peers (refused), in stats
(sync.refusedPeers) and on the dashboard, until a change of its is
taken again or the epoch changes.
Auth plan M6 (diverged standing).
|
| |
|
|
|
|
|
| |
A value sealed for its declared readers goes everywhere; one sealed
for a stranger too, or plain, gets nothing past the others.
Auth plan M8.
|
| |
|
|
|
|
|
|
| |
Signed values everywhere, carried over by a remake and replaced after
it; a member writing the registry or a signed path plain gets nothing
past the others.
Auth plan M7.
|
| |
|
|
|
|
|
| |
The first users' SSH keys, recorded at genesis with their entries, so a
swarm can be strict from its start.
Auth plan M7.
|
|
|
A swarm judging every change: honest writes everywhere, a joining node
registers, a forged write stays where it was made; a compaction under
the policy refuses nothing honest.
Auth plan M6.
|
