3 ms·

How have you dealt with the issue of byzantine streams? This is something that we have wanted to solve for a while, but it's a really nasty issue -- and at the

How have you dealt with the issue of byzantine streams? This is something that we have wanted to solve for a while, but it's a really nasty issue -- and at the recent OpenZFS Developers Summit we concluded that it wasn't practical. Instead, we're looking to tack more towards signed ZFS streams[1] -- though that work is only in the design stage. How has rsync.net solved this? [1] https://github.com/joyent/rfd/blob/master/rfd/0014/README.md https://github.com/joyent/rfd/blob/master/rfd/0014/README.md

rsync 11y ago
I think I know what you're referring to, but we've never called them "byzantine streams". Are you talking about snapshots that have been broken by extended attributes bugs, or "disappearing" snapshots ... and then what happens when you send/recv them ? Actually, either way, would you email info@rsync.net so we can chat over email ?
- bcantrill 11y ago
  I'm talking about a ZFS stream that has been deliberately corrupted and then sent to you to be received as a filesystem -- when it will in fact cause ZFS to panic (or worse). So I mean "byzantine" in the "characterized by deviousness" sense: someone actively trying to do harm to you. Or perhaps I have misunderstood the functionality that you offer?
  - rsync 11y ago
    Ok, that is not what I was thinking of. We have made no specific provisions for this. However, we were scared enough about "unknown unknowns" that we set up this aspect of our service such that every ZFS send/recv customer gets their own zpool inside their own bhyve. So it might be a DOS attack, but I don't think there is a data attack against rsync.net here. Comments ? Unrelated: I'm curious - when I speak of snapshots corrupted by extended attributes or "disappearing snapshots", do you know what I mean ? Maybe we should talk :)
    - bcantrill 11y ago
      I don't know enough about bhyve or your implementation to be able to comment, but if you assume that any system that has ever received a ZFS stream from a user is entirely compromised, then perhaps you can work around it that way. I'm not aware of a disappearing snapshot problem; has there been something sent to the ZFS list about this? Would have been a good topic of discussion for the OpenZFS Developers Summit a few weeks ago... ;)
      - rsync 11y ago
        Yes, that's exactly the model - these users have their own zpool inside their own VM.

rsync 11y ago

I think I know what you're referring to, but we've never called them "byzantine streams". Are you talking about snapshots that have been broken by extended attributes bugs, or "disappearing" snapshots ... and then what happens when you send/recv them ? Actually, either way, would you email info@rsync.net so we can chat over email ?

bcantrill 11y ago
I'm talking about a ZFS stream that has been deliberately corrupted and then sent to you to be received as a filesystem -- when it will in fact cause ZFS to panic (or worse). So I mean "byzantine" in the "characterized by deviousness" sense: someone actively trying to do harm to you. Or perhaps I have misunderstood the functionality that you offer?
- rsync 11y ago
  Ok, that is not what I was thinking of. We have made no specific provisions for this. However, we were scared enough about "unknown unknowns" that we set up this aspect of our service such that every ZFS send/recv customer gets their own zpool inside their own bhyve. So it might be a DOS attack, but I don't think there is a data attack against rsync.net here. Comments ? Unrelated: I'm curious - when I speak of snapshots corrupted by extended attributes or "disappearing snapshots", do you know what I mean ? Maybe we should talk :)
  - bcantrill 11y ago
    I don't know enough about bhyve or your implementation to be able to comment, but if you assume that any system that has ever received a ZFS stream from a user is entirely compromised, then perhaps you can work around it that way. I'm not aware of a disappearing snapshot problem; has there been something sent to the ZFS list about this? Would have been a good topic of discussion for the OpenZFS Developers Summit a few weeks ago... ;)
    - rsync 11y ago
      Yes, that's exactly the model - these users have their own zpool inside their own VM.