[gnunet] 114/164: Added probabilistic security check for full sync

[gnunet]

This is an automated email from the git hooks/post-receive script.

grothoff pushed a commit to branch master
in repository gnunet.

commit 8eff00cafca5fe0987e09183203362bcee856d05
Author: Elias Summermatter <elias.summermatter@seccom.ch>
AuthorDate: Thu May 27 01:36:52 2021 +0200

    Added probabilistic security check for full sync
---
 src/setu/gnunet-service-setu.c          | 89 ++++++++++++++++++++++++++++-----
 src/setu/gnunet-service-setu_protocol.h |  4 +-
 2 files changed, 79 insertions(+), 14 deletions(-)

diff --git a/src/setu/gnunet-service-setu.c b/src/setu/gnunet-service-setu.c
index 2cc3ed894..9b2aee8b0 100644
--- a/src/setu/gnunet-service-setu.c
+++ b/src/setu/gnunet-service-setu.c
@@ -56,7 +56,7 @@
 #define SE_IBF_SIZE 79
 
 /**
- * Primes for all 4 different strata estimators 79,83,89,97
+ * Primes for all 4 different strata estimators 79,83,89,97 348
  */
 #define SE_IBFS_TOTAL_SIZE 348
 
@@ -506,7 +506,7 @@ struct Operation
     /**
      * Estimated or committed set difference at the start
     */
-    uint64_t set_diff;
+    uint64_t remote_set_diff;
 };
 
 
@@ -992,12 +992,12 @@ estimate_best_mode_of_operation(uint64_t avg_element_size,
     if (full_min < total_bytes_diff) {
         /* Decide between sending all element first or receiving all elements 
*/
         if (total_bytes_full_remote_send_first > 
total_bytes_full_local_send_first) {
-            return DIFFERENTIAL_SYNC; // FULL_SYNC_LOCAL_SENDING_FIRST;
+            return FULL_SYNC_LOCAL_SENDING_FIRST; // 
FULL_SYNC_LOCAL_SENDING_FIRST;
         } else {
-            return DIFFERENTIAL_SYNC; // FULL_SYNC_REMOTE_SENDING_FIRST;
+            return FULL_SYNC_LOCAL_SENDING_FIRST; // 
FULL_SYNC_REMOTE_SENDING_FIRST;
         }
     } else {
-        return DIFFERENTIAL_SYNC;
+        return FULL_SYNC_LOCAL_SENDING_FIRST;
     }
 }
 
@@ -1424,6 +1424,68 @@ fail_union_operation (struct Operation *op)
 }
 
 
+
+/**
+ * Function that checks if full sync is plausible runnig
+ * @param initial_local_elements_in_set
+ * @param estimated_set_difference
+ * @param repeated_elements
+ * @param fresh_elements
+ * @param op
+ * @return GNUNET_OK if
+ */
+
+static int
+full_sync_plausibility_check (struct Operation *op) {
+    uint32_t security_level_ub = 1 << 30;
+    long double security_level_lb = (1 / (long double) security_level_ub);
+    uint64_t duplicates = op->received_fresh - op->received_total;
+
+    /*
+     * Protect full sync from receiving double element when in FULL SENDING
+     */
+
+    if(GNUNET_YES == op->byzantine && PHASE_FULL_SENDING == op->phase) {
+        if(duplicates > 0)
+        {
+            LOG (GNUNET_ERROR_TYPE_ERROR,
+                 "PROTOCOL VIOLATION: Received duplicate element in full 
receiving "
+                 "mode of operation this is not allowed! Duplicates: %lu\n",
+                 duplicates);
+            GNUNET_break_op (0);
+            fail_union_operation (op);
+            return GNUNET_SYSERR;
+        }
+
+    }
+
+    /*
+     * Protect full sync with probabilistic algorithm
+     */
+    if(GNUNET_YES == op->byzantine && PHASE_FULL_RECEIVING == op->phase) {
+        if (0 == op->remote_set_diff)
+            op->remote_set_diff = 1;
+
+        long double base = (1 - (long double) (op->remote_set_diff /
+                                               (long double) (op->initial_size 
+ op->remote_set_diff)));
+        long double exponent = (op->received_total - (op->received_fresh * 
((long double) op->initial_size /
+                                                                            
(long double) op->remote_set_diff)));
+        long double value = powl(base, exponent);
+        if(value < security_level_lb || value > security_level_ub) {
+            LOG (GNUNET_ERROR_TYPE_ERROR,
+                 "PROTOCOL VIOLATION: Other peer violated probabilistic rule 
for receiving "
+                 "to many duplicated full element : %LF\n",
+                 value);
+            GNUNET_break_op (0);
+            fail_union_operation (op);
+            return GNUNET_SYSERR;
+        }
+    }
+    return GNUNET_OK;
+}
+
+
+
 /**
  * Derive the IBF key from a hash code and
  * a salt.
@@ -1999,6 +2061,7 @@ handle_union_p2p_strata_estimator (void *cls,
       strata_estimator_read (&msg[1],
                              len,
                              is_compressed,
+                             SE_IBFS_TOTAL_SIZE,
                              remote_se))
   {
     /* decompression failed */
@@ -2014,6 +2077,7 @@ handle_union_p2p_strata_estimator (void *cls,
   int diff_remote = remote_se->stratas[0]->strata[0]->remote_decoded_count;
   int diff_local = remote_se->stratas[0]->strata[0]->local_decoded_count;
   diff = diff_remote + diff_local;
+  op->remote_set_diff = diff_remote;
 
 
 
@@ -2091,7 +2155,7 @@ handle_union_p2p_strata_estimator (void *cls,
       struct TransmitFullMessage *signal_msg;
       struct GNUNET_MQ_Envelope *ev;
       ev = GNUNET_MQ_msg_extra(signal_msg,sizeof(struct 
TransmitFullMessage),GNUNET_MESSAGE_TYPE_SETU_P2P_SEND_FULL);
-      signal_msg->set_difference = htonl(diff_remote + diff_local);
+      signal_msg->remote_set_difference = htonl( diff_local);
       signal_msg->set_size = htonl(op->number_elements_local);
       GNUNET_MQ_send (op->mq,
                         ev);
@@ -2107,7 +2171,7 @@ handle_union_p2p_strata_estimator (void *cls,
       perf_rtt.request_full.sent += 1;
       struct TransmitFullMessage *signal_msg;
       ev = GNUNET_MQ_msg_extra(signal_msg,sizeof(struct 
TransmitFullMessage),GNUNET_MESSAGE_TYPE_SETU_P2P_REQUEST_FULL);
-      signal_msg->set_difference = htonl(diff_remote + diff_local);
+      signal_msg->remote_set_difference = htonl(diff_local);
       signal_msg->set_size = htonl(op->number_elements_local);
       GNUNET_MQ_send (op->mq,
                         ev);
@@ -2459,7 +2523,7 @@ handle_union_p2p_send_full (void *cls,
     }
 
     op->remote_element_count = ntohl(msg->set_size);
-    op->set_diff = ntohl(msg->set_size);
+    op->remote_set_diff = ntohl(msg->remote_set_difference);
     op->phase = PHASE_FULL_RECEIVING;
 }
 
@@ -2927,7 +2991,6 @@ handle_union_p2p_full_element (void *cls,
                             GNUNET_NO);
 
   op->received_total++;
-
   ke = op_get_element (op,
                        &ee->element_hash);
   if (NULL != ke)
@@ -2936,6 +2999,7 @@ handle_union_p2p_full_element (void *cls,
                               "# repeated elements",
                               1,
                               GNUNET_NO);
+    full_sync_plausibility_check(op);
     ke->received = GNUNET_YES;
     GNUNET_free (ee);
   }
@@ -2949,9 +3013,9 @@ handle_union_p2p_full_element (void *cls,
     send_client_element (op,
                          &ee->element,
                          GNUNET_SETU_STATUS_ADD_LOCAL);
+    full_sync_plausibility_check(op);
   }
 
-  uint64_t received_repeated = op->received_total - op->received_fresh;
 
   if ((GNUNET_YES == op->byzantine) &&
       op->received_total > op->remote_element_count)
@@ -3130,8 +3194,8 @@ handle_union_p2p_request_full (void *cls,
      return;
   }
 
-    op->remote_element_count = ntohl(msg->set_size);
-    op->set_diff = ntohl(msg->set_size);
+  op->remote_element_count = ntohl(msg->set_size);
+  op->remote_set_diff = ntohl(msg->remote_set_difference);
 
   perf_rtt.request_full.received += 1;
 
@@ -4626,6 +4690,7 @@ handle_client_accept (void *cls,
     se = op->se;
     buf = GNUNET_malloc (se->stratas[0]->strata_count * IBF_BUCKET_SIZE * 
SE_IBFS_TOTAL_SIZE);
     len = strata_estimator_write (se,
+                                  SE_IBFS_TOTAL_SIZE,
                                   buf);
     perf_rtt.se.sent += 1;
     perf_rtt.se.sent_var_bytes += len;
diff --git a/src/setu/gnunet-service-setu_protocol.h 
b/src/setu/gnunet-service-setu_protocol.h
index 64a99bb1b..d2cfd94c1 100644
--- a/src/setu/gnunet-service-setu_protocol.h
+++ b/src/setu/gnunet-service-setu_protocol.h
@@ -228,9 +228,9 @@ struct TransmitFullMessage
     struct GNUNET_MessageHeader header;
 
     /**
-     * Set difference Calculated with strata estimator
+     * Remote set difference calculated with strata estimator
      */
-    uint32_t set_difference;
+    uint32_t remote_set_difference;
 
     /**
      * Local set size

-- 
To stop receiving notification emails like this one, please contact
gnunet@gnunet.org.