From 472463e68b250298b3283f6b509bac1d1ec56133 Mon Sep 17 00:00:00 2001 From: swrup Date: Sun, 7 Dec 2025 17:21:08 +0100 Subject: [PATCH] add denom revoke --- src/api.ml | 2 ++ src/handler.ml | 24 +++++++++++++++++++++--- src/management.ml | 15 +++++++++++++++ src/mte.ml | 9 +++++++-- src/pg.ml | 11 +++++++++++ src/secmod_denom.ml | 24 +++++++++++++++++++++--- src/secmod_denom.mli | 8 +++++++- 7 files changed, 84 insertions(+), 9 deletions(-) diff --git a/src/api.ml b/src/api.ml index e1f36ddc..c3377f43 100644 --- a/src/api.ml +++ b/src/api.ml @@ -69,6 +69,7 @@ module HashCode : sig type t val hash : string -> t + val of_b32 : B32.t -> (t, string) result val to_denomination_hash : t -> Bin_type.DenominationHash.t val jsont : t Jsont.t end = struct @@ -80,6 +81,7 @@ end = struct let open Digestif.SHA512 in s |> digest_string |> to_raw_string + let of_b32 = B32.decode let jsont = B32.jsont end diff --git a/src/handler.ml b/src/handler.ml index 259592fe..a9fb82d8 100644 --- a/src/handler.ml +++ b/src/handler.ml @@ -26,7 +26,7 @@ end include Respond_util open Api -let keys_get req server _env = +let management_keys_get req server _env = let sm_signkey = Vif.Server.device Devices.secmod_signkey server in let sm_denom = Vif.Server.device Devices.secmod_denom server in let res = @@ -36,9 +36,9 @@ let keys_get req server _env = in respond_with_res res req -let keys_post_jsont = MasterSignatures.jsont +let management_keys_post_jsont = MasterSignatures.jsont -let keys_post req server _env = +let management_keys_post req server _env = let open Syntax in let open Management in let db_conn = Vif.Server.device Devices.db_connection server in @@ -55,3 +55,21 @@ let keys_post req server _env = Ok "" in respond_with_res res req + +let management_denom_revoke_jsont = DenomRevocationSignature.jsont + +let management_denom_revoke req h_denom_pub server _env = + let open Syntax in + let open Management in + let db_conn = Vif.Server.device Devices.db_connection server in + let _sm_signkey = Vif.Server.device Devices.secmod_signkey server in + let sm_denom = Vif.Server.device Devices.secmod_denom server in + let res = + let* h_denom_pub = HashCode.of_b32 h_denom_pub in + let h_denom_pub = HashCode.to_denomination_hash h_denom_pub in + let* v = Vif.Request.of_json req |> unwrap_err_msg in + let* () = verify_denom_revocation_sig h_denom_pub v in + let* () = update_denom_revocation ~db_conn ~sm_denom h_denom_pub v in + Ok "" + in + respond_with_res res req diff --git a/src/management.ml b/src/management.ml index 580b1758..5a22bd8e 100644 --- a/src/management.ml +++ b/src/management.ml @@ -213,3 +213,18 @@ let update_master_signatures ~db_conn ~sm_signkey ~sm_denom in let* () = check_master_signatures_update ~db_conn ~sm_denom in Ok () + +let verify_denom_revocation_sig h_denom_pub + DenomRevocationSignature.{ master_sig } = + let open Bin_sig.MasterDenominationKeyRevocation in + verify ~key:Config.Exchange.master_public_key master_sig { h_denom_pub } + +let update_denom_revocation ~db_conn ~sm_denom h_denom_pub + DenomRevocationSignature.{ master_sig } = + let open Syntax in + let* () = Secmod_denom.revoke_denomination sm_denom h_denom_pub master_sig in + let* () = + Pg.insert_denomination_revocation db_conn h_denom_pub master_sig + |> unwrap_err_caqti + in + Ok () diff --git a/src/mte.ml b/src/mte.ml index b164d851..3e82c256 100644 --- a/src/mte.ml +++ b/src/mte.ml @@ -32,8 +32,13 @@ let routes = get_ rel --> hello; get_ (v "terms") --> Static.terms; get_ (v "privacy") --> Static.privacy; - get_ (v "management" / "keys") --> keys_get; - post (v "management" / "keys") keys_post_jsont --> keys_post; + get_ (v "management" / "keys") --> management_keys_get; + post (v "management" / "keys") management_keys_post_jsont + --> management_keys_post; + post + (v "management" / "denominations" /% string `Path / "revoke") + management_denom_revoke_jsont + --> management_denom_revoke; ] let () = diff --git a/src/pg.ml b/src/pg.ml index dbdfdbd6..f6146e74 100644 --- a/src/pg.ml +++ b/src/pg.ml @@ -158,3 +158,14 @@ let add_denomination_key = fee_deposit, fee_refresh, (fee_refund, age_mask) ) + +let insert_denomination_revocation = + let denomination_revocation_insert = + let master_sig = Bin_sig.MasterDenominationKeyRevocation.caqti in + Caqti_type.(t2 denomination_hash master_sig ->. unit) + "INSERT INTO denomination_revocations (denominations_serial, master_sig) \ + SELECT denominations_serial, $2 FROM denominations WHERE \ + denom_pub_hash=$1" + in + fun (module Conn : CONN) h_denom_pub master_sig -> + Conn.exec denomination_revocation_insert (h_denom_pub, master_sig) diff --git a/src/secmod_denom.ml b/src/secmod_denom.ml index f4fc2ac6..b1bdcc4d 100644 --- a/src/secmod_denom.ml +++ b/src/secmod_denom.ml @@ -1,9 +1,15 @@ open Syntax +type h_denom_pub = Bin_type.DenominationHash.t + type t = { lock: Miou.Mutex.t; sm_key: Signkey.t; - denom_ht: (Bin_type.DenominationHash.t, Denomination.t) Hashtbl.t; + denom_ht: (h_denom_pub, Denomination.t) Hashtbl.t; + revoked_ht: + ( h_denom_pub, + Denomination.t * Bin_sig.MasterDenominationKeyRevocation.t ) + Hashtbl.t; } let get_sm_key t = t.sm_key @@ -27,8 +33,18 @@ let add_master_signatures conn t l = Ok ()) l +let revoke_denomination t h_denom_pub master_sig = + Miou.Mutex.protect t.lock @@ fun () -> + match Hashtbl.find_opt t.denom_ht h_denom_pub with + | None -> Error "secmod_denom failure: denomination hash not found." + | Some denom -> + Hashtbl.remove t.denom_ht h_denom_pub; + Hashtbl.replace t.revoked_ht h_denom_pub (denom, master_sig); + Ok () + let dir = Fpath.(v "data" / "secmod_signkey") +(* TODO secmod store *) let _store_secmod_data t = let* () = Data_file.write_eddsa Fpath.(dir / "sm_key") t.sm_key.priv in get_denoms t @@ -67,7 +83,8 @@ let load conn = |> List.to_seq |> Hashtbl.of_seq in - Ok (Some { lock; sm_key; denom_ht }) + let revoked_ht = Hashtbl.create 0xff in + Ok (Some { lock; sm_key; denom_ht; revoked_ht }) | _, _ -> error_invalid_state let make_new () = @@ -80,7 +97,8 @@ let make_new () = |> List.to_seq |> Hashtbl.of_seq in - { lock; sm_key; denom_ht } + let revoked_ht = Hashtbl.create 0xff in + { lock; sm_key; denom_ht; revoked_ht } let init conn = match load conn with diff --git a/src/secmod_denom.mli b/src/secmod_denom.mli index d771791c..117e1c97 100644 --- a/src/secmod_denom.mli +++ b/src/secmod_denom.mli @@ -1,3 +1,6 @@ +open Bin_sig + +type h_denom_pub = Bin_type.DenominationHash.t type t val get_sm_key : t -> Signkey.t @@ -6,7 +9,10 @@ val get_denoms : t -> Denomination.t list val add_master_signatures : (module Pg.CONN) -> t -> - (Bin_type.DenominationHash.t * Bin_sig.DenominationKeyValidity.t) list -> + (h_denom_pub * DenominationKeyValidity.t) list -> (unit, string) result +val revoke_denomination : + t -> h_denom_pub -> MasterDenominationKeyRevocation.t -> (unit, string) result + val init : (module Pg.CONN) -> t