keel vip check: without etcd, the proof that a node holds the VIP is weak #113

New issue

Open

opened 2026-10-08 22:24:59 -03:00 by marcos-mendez · 0 comments

marcos-mendez commented

2026-10-08 22:24:59 -03:00

(Migrated from github.com)

Found in the security review of #111 (keel#104).

Without etcd, the VIP on wg0 has no lifetime (keel/mesh/vipnet.py, carry with no valid_lft). The address stays until keel removes it or the node boots. keel database follow takes the address on wg0 as the proof that this node holds the VIP.

keel vip check (keel/mesh/vippromote.py, checked) adds the VIP again after a restart when any peer answered and no peer that answered knows a newer claim. A third node that did not learn the newer epoch can answer, while the other member of the pair, which holds the newer claim, does not.

Wanted:

keel vip check adds the VIP again only when the other member of the pair itself answered and knows no newer claim.
Consider a lifetime on the address without etcd too, renewed by keel vip check while the pair peer answers, so that the proof expires.
A test with the pair peer unreachable and a third node that answers with the old epoch.

docs/replication.md (in #111) says the cloud simple proof is weaker and names this issue.

Found in the security review of #111 (keel#104). Without etcd, the VIP on `wg0` has no lifetime (`keel/mesh/vipnet.py`, `carry` with no `valid_lft`). The address stays until keel removes it or the node boots. `keel database follow` takes the address on `wg0` as the proof that this node holds the VIP. `keel vip check` (`keel/mesh/vippromote.py`, `checked`) adds the VIP again after a restart when *any* peer answered and no peer that answered knows a newer claim. A third node that did not learn the newer epoch can answer, while the other member of the pair, which holds the newer claim, does not. Wanted: - `keel vip check` adds the VIP again only when the other member of the pair itself answered and knows no newer claim. - Consider a lifetime on the address without etcd too, renewed by `keel vip check` while the pair peer answers, so that the proof expires. - A test with the pair peer unreachable and a third node that answers with the old epoch. docs/replication.md (in #111) says the cloud simple proof is weaker and names this issue.