Comments (8)
I'm not sure if this is related, but I did notice something a little troubling.
The code that generates interface IDs looks like this:
if_id = str(255 + int(ad_id) + int(nbr_ad_id))
This means the interface between ADs 11-14 and the interface between ADs 12-13 have the same ID (of course there are several other cases like this one as well).
I'm not sure if this actually causes a problem somewhere in the code but conceptually it seems wrong that two completely unrelated interfaces have the same identifier.
from scion.
@pszalach
So I think I've got the problem narrowed down to two parts.
- Race condition in _get_if_rev_token()
This function is called in both the "BS PCB propagation" thread and "BS register segments" thread.
Sometimes if we're unlucky both threads create a new revocation token, leading to two topologically equivalent paths. - PCBs carried over from previous iteration
When SCION is run multiple times, it keeps a PCB from the previous iteration.
So when beacon servers start up they register this PCB in the path server, then receive a newly created PCB from the core and register this as well, again creating two topologically equivalent paths.
While clearing ZooKeeper every time is probably not a good approach, I think we need some way to prevent duplicate paths resulting from this carry-over behavior.
from scion.
@aznair oh, right, probably zookeeper is a main culprit. Probably we should also keep (seeds of) revocation tokens in ZK. I'll think about that.
Yes, 1. looks as another potential problem.
Hopefully that's all, but maybe @shitz noticed such behavior previously?
from scion.
I have not, but then I haven't looked to closely to be honest. 1) does
indeed sound like a problem, but it should be easily fixable with a lock.
2) sounds more serious and I can't say much about this, since I haven't
looked too closely at the ZK code so far.
On Tue, May 5, 2015 at 3:46 PM, pszalach [email protected] wrote:
@aznair https://github.com/aznair oh, right, probably zookeeper is a
main culprit. Probably we should also keep (seeds of) revocation tokens in
ZK. I'll think about that.
Yes, 1. looks as another potential problem.
Hopefully that's all, but maybe @shitz https://github.com/shitz noticed
such behavior previously?—
Reply to this email directly or view it on GitHub
netsec-ethz#93 (comment).
from scion.
I think that solution for 2. may be generating (seeds for) revocation tokens in a deterministic way. For example using AD's secret key and paths'id (get_hops_hash()).
from scion.
You have to be careful though, since get_hops_hash() uses interface
revocation tokens and you might end up with a circular dependency. I could
see something like this working:
Seed for interface rev-token chain: secret-key + interface-ID
Seed for segment rev-token chain: secret-key + get_hops_hash()
However, you will run into problems when a hash chain gets exhausted, so
there needs to be some sort of versioning for the hash-chain as well.
On Wed, May 6, 2015 at 10:39 AM, pszalach [email protected] wrote:
I think that solution for 2. may be generating (seeds for) revocation
tokens in a deterministic way. For example using AD's secret key and
paths'id (get_hops_hash()).—
Reply to this email directly or view it on GitHub
netsec-ethz#93 (comment).
from scion.
Yes, I thought about something like that.
Probably, we will rotate the secret keys (~daily), hence it would help
with exhausted hash chain.
On 06.05.2015 11:32, shitz wrote:
You have to be careful though, since get_hops_hash() uses interface
revocation tokens and you might end up with a circular dependency. I could
see something like this working:Seed for interface rev-token chain: secret-key + interface-ID
Seed for segment rev-token chain: secret-key + get_hops_hash()However, you will run into problems when a hash chain gets exhausted, so
there needs to be some sort of versioning for the hash-chain as well.On Wed, May 6, 2015 at 10:39 AM, pszalach [email protected] wrote:
I think that solution for 2. may be generating (seeds for) revocation
tokens in a deterministic way. For example using AD's secret key and
paths'id (get_hops_hash()).—
Reply to this email directly or view it on GitHub
netsec-ethz#93 (comment).—
Reply to this email directly or view it on GitHub
netsec-ethz#93 (comment).
from scion.
please reopen if issue still exists
from scion.
Related Issues (20)
- protocol: segment ID is narrow
- snet/daemon: daemon Connector should cache local topology information
- doc: documentation for UDP underlay, manual for dispatcher
- router: remove redundant dispatched_port_start/end configuration option from router config .toml
- tools: update wireshark plugin after changes to end host port range
- snet: discard stray incoming packets on Dialed conn
- router: investigate performance of SCMP parsing in router
- snet: stop scmp error propagation
- snet: investigate overhead of port checks during Listen
- Adapt control plane API while implementing #4434 HOT 11
- Router code makes unnecessary copies and tmp objects.
- Native SCION Multicast Proposal
- router: drop packets with invalid IPv4/6 destination address
- pkg/private/common: delete the deprecated IfIDType definition HOT 5
- beaconing: "no TRC for ISD present" response
- [router] Batch writing error handling
- brload: socket closes early in some cases, causing benchmark to fail
- router: poor performance over real NICs, despite descent performance over veth
- private/app/path: IA ignored in Sort function HOT 1
- tools: wireshark plugin does not dissect first SCION packet HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from scion.