Re: [Monotone-devel] [RFC] Monotone NETSYNC Hook Extension & Abstraction Layer

[Markus Schiltknecht]

Hi Ralf,

Ralf S. Engelschall wrote:
> - To achieve the rollback we now temporarily PER SESSION queue
>   the database operations resulting from such a bundle of received
>   {file,delta}*,revision,cert* chunks before actually writing it to the
>   database.

I'm not sure I fully understand what you are doing. From reading the 
patch, I think you are caching (in memory) one revision and it's certs 
until you can decide if it is acceptable, right? Do the certs of a 
revision always follow the revision in netsync?

What do you do if a revision comes without the required certs? A 
malicious peer could upload a revision (without offending certs) first, 
and then upload the cert in a later netsync run.

AFAIK, for the policy branches, we were always assuming that netsync 
could very well store offending revisions and certs in the database. 
Checking against the policy would happen later on. Much like suspending 
branches works. OTOH there's the advantage of always having a 'clean' 
database. What do others think?

> - In case any NETSYNC Lua hook denies the storage of some data we
>   "rollback" at least the current _bundle_ by clearing the mentioned queue
>   and dropping the NETSYNC session. This way we for instance never store a
>   revision without its corresponding certs in case the certs cause a Lua
>   hook to deny access to the database.

Hm.. what if Alice got some revisions from Crazy Bob, then Alice and 
Carol want to sync. But Carol already has a lua hook denying revisions 
from Crazy Bob. Given your implementation, netsync would abort after the 
first revision from Crazy Bob. And Alice would probably be unable to 
push all of its (perfectly legal) revisions to Carol.

For Alice to be able to sync again with Carol, she would have:

 a) figure out why netsync aborted,
 b) manually check and merge the policy (lua hooks) with Carol,
 c) manually remove the revisions from Crazy Bob.

It would probably be better not to abort netsync completely and just 
deny single revisions. I'm not sure, though.

While these hooks sometimes look to me like a short-sighted attempt to 
implement policy branches, I'd rather like to think of it as a building 
block for it. Although I'm not quite sure how feasible that is.

BTW: your website seems to be down at the moment, at least I can't 
connect to www.engelschall.com.

Regards

Markus