swrup/mte
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

merge secmod

Browse source
This commit is contained in:
swrup 2025-12-15 15:01:40 +01:00
parent 50a6137967
commit 15c132829e
11 changed files with 348 additions and 404 deletions
Download patch file Download diff file Expand all files Collapse all files

89
src/management.ml
View file

@ -2,7 +2,7 @@ open Syntax
open Api
module Keys_get = struct
let mk_future_denom ~sm_denom_priv
let mk_future_denom ~sm_key_priv
({
pub;
priv= _;
@ -32,7 +32,7 @@ module Keys_get = struct
let duration_withdraw =
Timestamp.diff stamp_start stamp_expire_withdraw
in
sign ~key:sm_denom_priv
sign ~key:sm_key_priv
{ h_denom_pub; h_section_name; anchor_time; duration_withdraw }
in
FutureDenom.
@ -64,29 +64,24 @@ module Keys_get = struct
FutureSignKey.
{ key= pub; stamp_start; stamp_expire; stamp_end; signkey_secmod_sig }
let mk_future_keys_response ~(sm_signkey : Secmod_signkey.t)
~(sm_denom : Secmod_denom.t) =
let mk_future_keys_response ~sm =
let future_signkeys =
Secmod_signkey.get_signkeys sm_signkey
Secmod.get_signkeys sm
|> List.filter (fun k -> Option.is_none k.Signkey.master_sig)
|> List.map (fun signkey ->
let sm_signkey_priv =
(Secmod_signkey.get_sm_key sm_signkey).Signkey.priv
in
let sm_signkey_priv = Secmod.get_sm_key_priv sm in
mk_future_signkey ~sm_signkey_priv signkey)
in
let future_denoms =
Secmod_denom.get_denoms sm_denom
Secmod.get_denoms sm
|> List.filter (fun k -> Option.is_none k.Denomination.master_sig)
|> List.map (fun denom ->
let sm_denom_priv = (Secmod_denom.get_sm_key sm_denom).Signkey.priv in
mk_future_denom ~sm_denom_priv denom)
let sm_key_priv = Secmod.get_sm_key_priv sm in
mk_future_denom ~sm_key_priv denom)
in
let master_pub = Config.Exchange.master_public_key in
let denom_secmod_public_key = (Secmod_denom.get_sm_key sm_denom).pub in
let signkey_secmod_public_key =
(Secmod_signkey.get_sm_key sm_signkey).pub
in
let denom_secmod_public_key = Secmod.get_sm_key_pub sm in
let signkey_secmod_public_key = Secmod.get_sm_key_pub sm in
FutureKeysResponse.
{
future_denoms;
@ -100,10 +95,9 @@ module Keys_get = struct
let f req server _env =
Logs.info (fun m -> m "GET /management/keys/");
let sm_signkey = Vif.Server.device Devices.secmod_signkey server in
let sm_denom = Vif.Server.device Devices.secmod_denom server in
let sm = Vif.Server.device Devices.secmod server in
let res =
let v = mk_future_keys_response ~sm_signkey ~sm_denom in
let v = mk_future_keys_response ~sm in
let s = Api.encode_exn jsont v in
Ok s
in
@ -111,11 +105,10 @@ module Keys_get = struct
end
module Keys_post = struct
let verify_denom_signature ~sm_denom
DenomSignature.{ h_denom_pub; master_sig } =
let verify_denom_signature ~sm DenomSignature.{ h_denom_pub; master_sig } =
let denom_hash = HashCode.to_denomination_hash h_denom_pub in
let* denom =
Secmod_denom.get_denoms sm_denom
Secmod.get_denoms sm
|> List.find_opt (fun (denom : Denomination.t) ->
denom.h_pub = denom_hash)
|> function
@ -142,10 +135,9 @@ module Keys_post = struct
in
verify ~key:Config.master_public_key master_sig r
let verify_signkey_signature ~sm_signkey SignKeySignature.{ key; master_sig }
=
let verify_signkey_signature ~sm SignKeySignature.{ key; master_sig } =
let* signkey =
Secmod_signkey.get_signkeys sm_signkey
Secmod.get_signkeys sm
|> List.find_opt (fun (signkey : Signkey.t) -> signkey.pub = key)
|> function
| None ->
@ -165,15 +157,14 @@ module Keys_post = struct
in
verify ~key:Config.master_public_key master_sig r
let verify ~sm_signkey ~sm_denom MasterSignatures.{ denom_sigs; signkey_sigs }
=
let* () = list_iter (verify_denom_signature ~sm_denom) denom_sigs in
let* () = list_iter (verify_signkey_signature ~sm_signkey) signkey_sigs in
let verify ~sm MasterSignatures.{ denom_sigs; signkey_sigs } =
let* () = list_iter (verify_denom_signature ~sm) denom_sigs in
let* () = list_iter (verify_signkey_signature ~sm) signkey_sigs in
Ok ()
(* TODO move to test *)
let check_master_signatures_update ~db_conn ~sm_denom =
Secmod_denom.get_denoms sm_denom
let check_master_signatures_update ~db_conn ~sm =
Secmod.get_denoms sm
|> list_iter (fun denom ->
let error = Error "update_master_signatures sanity check failure" in
let* opt =
@ -201,22 +192,21 @@ module Keys_post = struct
let* () = check (age_mask = denom.age_mask) in
Ok ())
let do_ ~db_conn ~sm_signkey ~sm_denom
MasterSignatures.{ denom_sigs; signkey_sigs } =
let do_ ~db_conn ~sm MasterSignatures.{ denom_sigs; signkey_sigs } =
let* () =
signkey_sigs
|> List.map (fun SignKeySignature.{ key; master_sig } ->
(key, master_sig))
|> Secmod_signkey.add_master_signatures db_conn sm_signkey
|> Secmod.add_signkey_master_signatures db_conn sm
in
let* () =
denom_sigs
|> List.map (fun DenomSignature.{ h_denom_pub; master_sig } ->
let h_denom_pub = HashCode.to_denomination_hash h_denom_pub in
(h_denom_pub, master_sig))
|> Secmod_denom.add_master_signatures db_conn sm_denom
|> Secmod.add_denom_master_signatures db_conn sm
in
let* () = check_master_signatures_update ~db_conn ~sm_denom in
let* () = check_master_signatures_update ~db_conn ~sm in
Ok ()
let jsont = MasterSignatures.jsont
@ -224,12 +214,11 @@ module Keys_post = struct
let f req server _env =
Logs.info (fun m -> m "POST /management/keys/");
let db_conn = Vif.Server.device Devices.db_connection server in
let sm_signkey = Vif.Server.device Devices.secmod_signkey server in
let sm_denom = Vif.Server.device Devices.secmod_denom server in
let sm = Vif.Server.device Devices.secmod server in
let res =
let* v = Vif.Request.of_json req |> unwrap_err_msg in
let* () = verify ~sm_signkey ~sm_denom v in
let* () = do_ ~db_conn ~sm_signkey ~sm_denom v in
let* () = verify ~sm v in
let* () = do_ ~db_conn ~sm v in
Ok ""
in
Respond_util.respond_with_res res req
@ -240,11 +229,8 @@ module Denom_revoke = struct
let open Bin_sig.MasterDenominationKeyRevocation in
verify ~key:Config.Exchange.master_public_key master_sig { h_denom_pub }
let do_ ~db_conn ~sm_denom h_denom_pub DenomRevocationSignature.{ master_sig }
=
let* () =
Secmod_denom.revoke_denomination sm_denom h_denom_pub master_sig
in
let do_ ~db_conn ~sm h_denom_pub DenomRevocationSignature.{ master_sig } =
let* () = Secmod.revoke_denomination sm h_denom_pub master_sig in
let+ () =
Pg.insert_denomination_revocation db_conn h_denom_pub master_sig
|> unwrap_err_caqti
@ -256,13 +242,13 @@ module Denom_revoke = struct
let f req h_denom_pub server _env =
Logs.info (fun m -> m "POST /management/denominations/$H_DENOM_PUB/revoke/");
let db_conn = Vif.Server.device Devices.db_connection server in
let sm_denom = Vif.Server.device Devices.secmod_denom server in
let sm = Vif.Server.device Devices.secmod server in
let res =
let* h_denom_pub = HashCode.of_b32 h_denom_pub in
let h_denom_pub = HashCode.to_denomination_hash h_denom_pub in
let* v = Vif.Request.of_json req |> unwrap_err_msg in
let* () = verify h_denom_pub v in
let* () = do_ ~db_conn ~sm_denom h_denom_pub v in
let* () = do_ ~db_conn ~sm h_denom_pub v in
Ok ""
in
Respond_util.respond_with_res res req
@ -273,11 +259,8 @@ module Signkey_revoke = struct
let open Bin_sig.MasterSigningKeyRevocation in
verify ~key:Config.Exchange.master_public_key master_sig { exchange_pub }
let do_ ~db_conn ~sm_signkey exchange_pub
SignkeyRevocationSignature.{ master_sig } =
let* () =
Secmod_signkey.revoke_signkey sm_signkey exchange_pub master_sig
in
let do_ ~db_conn ~sm exchange_pub SignkeyRevocationSignature.{ master_sig } =
let* () = Secmod.revoke_signkey sm exchange_pub master_sig in
let+ () =
Pg.insert_signkey_revocation db_conn exchange_pub master_sig
|> unwrap_err_caqti
@ -289,12 +272,12 @@ module Signkey_revoke = struct
let f req exchange_pub server _env =
Logs.info (fun m -> m "POST /management/signkeys/$EXCHANGE_PUB/revoke/");
let db_conn = Vif.Server.device Devices.db_connection server in
let sm_signkey = Vif.Server.device Devices.secmod_signkey server in
let sm = Vif.Server.device Devices.secmod server in
let res =
let* exchange_pub = Crypto.EddsaPublicKey.of_b32 exchange_pub in
let* v = Vif.Request.of_json req |> unwrap_err_msg in
let* () = verify exchange_pub v in
let* () = do_ ~db_conn ~sm_signkey exchange_pub v in
let* () = do_ ~db_conn ~sm exchange_pub v in
Ok ""
in
Respond_util.respond_with_res res req