Re: [Monotone-devel] netsync status

[graydon hoare]

[CC'ing back to the list, they're good questions]

Will wrote:

> Graydon,
>  By 'throw out the old network code' do you mean the NNTP/SMTP/Depot  code?

that is what I meant, yeah.

>  If so, I have to admit this is one of the things I found particularly  
> cool about Monotone:  I can wget (or even sneaker-net) a file of  
> Monotone packets instead of requiring a fully-capable network  connection.
>  This made it very convenient because our firewall makes it difficult  
> to connect to anything outside HTTP/FTP.  Even direct SMTP is not  allowed.

ok. this is something I am not completely clear on the facts of. many 
people (myself included) have "marketed" HTTP-based transports as 
"firewall friendly". I don't know how much that's true. in particular I 
don't know whether:

  - most firewalls people work on really do block outbound-initiated
    connections on non-HTTP ports

  - most admins aren't willing to listen to reason on extra cases, eg
    can you convince your admin to let you use cvs pserver?

  - the filtering of non-HTTP traffic (assuming it exists) is mostly
    done by port filtering or application protocol proxying / monitoring

I'll admit to being somewhat pleased with the old "any source of packets 
will do" approach, too. it's just that, well, it had too many ways of 
going wrong. if it still gets use I guess I'll maintain it for a while, 
I just think it would be .. tidier .. to have 1 networking system rather 
than 2.

I'd appreciate if other people who feel the older system had desirable 
properties -- concretely, in real world use, not just on paper -- could 
speak up so I can get a feel for it. I don't want to be rude and remove 
stuff people have come to like.

>  Also, how much protection does the 'netsync' server give itself, e.g.  
> authentication, perhaps encryption (if it's appropriate), DOS...  or is  
> this going to be based on the packet-signing such that when it's  
> discovered that someone was sending Trojan packets, they can easily be  
> removed from the repository or 'tagged' as dodgy.

it tries to resist DoS attacks by limiting the number of active 
connections, the input buffer allocated to each, and the idle time on 
each. it won't do any database access until it authenticates, and the 
authentication is based on the existing RSA keys signing nonces. in 
theory you could DoS it by generating a stream of bogus authentication 
requests, keeping it in a permanent connect-RSA-verification-fail loop, 
but this could also be rate-limited without much work. once you get past 
the RSA authentication you can definitely DoS it, but that's sort of the 
point.

there is no encryption at the moment, and after authentication a remote 
party can only gain authorization to (at worst) add objects to your 
database or read objects back from it (not delete any). specific 
read/write authorization is controlled on a per-key and per-collection 
basis in a lua hook you have to provide. after that, like always, 
monotone makes its security decisions based on evaluating certificates 
it has on-hand, not based on "where they came from" or any such thing.

there are possibly errors in the decoder functions. that's true of most 
code that reads from the network, though (ASN.1 anyone?). the question 
of finding them -- or proving them to not exist -- weighs heavily on my 
mind.

-graydon