30 lines
1.7 KiB
30 lines
1.7 KiB
SECURITY |
|
-------- |
|
The fetch and push protocols are not designed to prevent one side from |
|
stealing data from the other repository that was not intended to be |
|
shared. If you have private data that you need to protect from a malicious |
|
peer, your best option is to store it in another repository. This applies |
|
to both clients and servers. In particular, namespaces on a server are not |
|
effective for read access control; you should only grant read access to a |
|
namespace to clients that you would trust with read access to the entire |
|
repository. |
|
|
|
The known attack vectors are as follows: |
|
|
|
. The victim sends "have" lines advertising the IDs of objects it has that |
|
are not explicitly intended to be shared but can be used to optimize the |
|
transfer if the peer also has them. The attacker chooses an object ID X |
|
to steal and sends a ref to X, but isn't required to send the content of |
|
X because the victim already has it. Now the victim believes that the |
|
attacker has X, and it sends the content of X back to the attacker |
|
later. (This attack is most straightforward for a client to perform on a |
|
server, by creating a ref to X in the namespace the client has access |
|
to and then fetching it. The most likely way for a server to perform it |
|
on a client is to "merge" X into a public branch and hope that the user |
|
does additional work on this branch and pushes it back to the server |
|
without noticing the merge.) |
|
|
|
. As in #1, the attacker chooses an object ID X to steal. The victim sends |
|
an object Y that the attacker already has, and the attacker falsely |
|
claims to have X and not Y, so the victim sends Y as a delta against X. |
|
The delta reveals regions of X that are similar to Y to the attacker.
|
|
|