swrup/mte
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

clean up

Browse source
This commit is contained in:
swrup 2026-03-03 10:09:03 +01:00 • committed by Swrup
parent 93f2dcb292
commit 4bb62e369d
20 changed files with 112 additions and 130 deletions
Download patch file Download diff file Expand all files Collapse all files

6
src/amount.ml
View file

@ -1,8 +1,4 @@
(* TODO
have a currency agnostic amount_lib.ml
and specialize amount.ml to Config.currency??
have safe amount arithmetic *)
(* TODO implement operations on amounts *)
open Syntax
type sign =

3
src/api.ml
View file

@ -85,9 +85,6 @@ module Bytes64 = struct
~decode:of_octets Caqti_type.octets
end
(* TODO error response
- use GANA error codes
https://git.gnunet.org/gana.git/tree/gnu-taler-error-codes/registry.rec *)
module ErrorDetail = struct
type t = {
code: int;

4
src/crypto.ml
View file

@ -60,7 +60,7 @@ module Binary_format_rsa = struct
let* arr = z_array_of_octets ~nb:2 s in
match arr with
| [| n; e |] ->
let+ pub = Mirage_crypto_pk.Rsa.pub ~n ~e |> unwrap_err_msg in
let+ pub = Mirage_crypto_pk.Rsa.pub ~n ~e |> unwrap_msg in
pub
| _ -> assert false
@ -74,7 +74,7 @@ module Binary_format_rsa = struct
match arr with
| [| e; d; n; p; q; dp; dq; q' |] ->
let+ priv =
Mirage_crypto_pk.Rsa.priv ~e ~d ~n ~p ~q ~dp ~dq ~q' |> unwrap_err_msg
Mirage_crypto_pk.Rsa.priv ~e ~d ~n ~p ~q ~dp ~dq ~q' |> unwrap_msg
in
priv
| _ -> assert false

3
src/hash.ml
View file

@ -1,3 +1,6 @@
(* TODO hash over canonicalized json
https://docs.taler.net/design-documents/018-contract-json.html#canonicalized-hashing
https://datatracker.ietf.org/doc/html/rfc8785 *)
open Digestif
module type S = sig

3
src/headers.ml
View file

@ -6,7 +6,8 @@ let accept_header_value =
let avail_languages_header_value =
Fmt.str "%a" (Fmt.array ~sep:(Fmt.any ", ") Fmt.string) Assets.Language.arr
(* TODO Cohttp raises on invalid *)
(* TODO better headers_lib
Cohttp raises on invalid *)
let select_mimetype headers =
let opt = Vif.Headers.get headers "accept" in
Cohttp.Accept.media_ranges opt

25
src/keys.ml
View file

@ -1,7 +1,6 @@
open Syntax
open Crypto
(* TODO better error type *)
type 'a result = ('a, string) Result.t
module type S = sig
@ -33,8 +32,8 @@ module Make (Conn : Pg.CONN) : S = struct
let conn = (module Conn : Pg.CONN)
(* TODO
error "key not found", either:
(* TODO better error
can only be "key not found", either:
- we tried to sign with a key that is not ours
- key was revoked
- bad keyring state *)
@ -49,8 +48,8 @@ module Make (Conn : Pg.CONN) : S = struct
| Ok v -> v
(* - *)
let find_signkey pub = Pg.find_signkey conn pub |> unwrap_err_caqti
let find_denomination h_pub = Pg.find_denom conn h_pub |> unwrap_err_caqti
let find_signkey pub = Pg.find_signkey conn pub |> unwrap_caqti
let find_denomination h_pub = Pg.find_denom conn h_pub |> unwrap_caqti
let warn_key_state =
let first = ref true in
@ -65,7 +64,7 @@ module Make (Conn : Pg.CONN) : S = struct
let signkeys () : Signkey.t list result =
let now = Timestamp.of_ptime @@ Ptime_clock.now () in
let+ l = Pg.get_signkeys conn ~now |> unwrap_err_caqti in
let+ l = Pg.get_signkeys conn ~now |> unwrap_caqti in
let missing_l, l =
List.partition
(fun sk -> Option.is_none @@ Sm_eddsa.find_key sk.Signkey.pub)
@ -79,7 +78,7 @@ module Make (Conn : Pg.CONN) : S = struct
l
let denominations () =
let+ l = Pg.get_denominations conn () |> unwrap_err_caqti in
let+ l = Pg.get_denominations conn () |> unwrap_caqti in
let missing_l, l =
List.partition
(fun dn -> Option.is_none @@ Sm_rsa.find_key dn.Denomination.h_pub)
@ -201,7 +200,7 @@ module Make (Conn : Pg.CONN) : S = struct
let make_future_keys_response () =
let now = Timestamp.of_ptime @@ Ptime_clock.now () in
(* get keys from database to filter out keys already certified *)
let* sk_db_l = Pg.get_signkeys conn ~now |> unwrap_err_caqti in
let* sk_db_l = Pg.get_signkeys conn ~now |> unwrap_caqti in
let sk_ht = Hashtbl.create 0xff in
List.iter (fun sk -> Hashtbl.replace sk_ht sk.Signkey.pub ()) sk_db_l;
let future_signkeys =
@ -209,7 +208,7 @@ module Make (Conn : Pg.CONN) : S = struct
|> List.filter (fun (pub, _) -> not @@ Hashtbl.mem sk_ht pub)
|> List.map make_future_sk
in
let* dn_db_l = Pg.get_denominations conn () |> unwrap_err_caqti in
let* dn_db_l = Pg.get_denominations conn () |> unwrap_caqti in
let dn_ht = Hashtbl.create 0xff in
List.iter (fun dn -> Hashtbl.replace dn_ht dn.Denomination.h_pub ()) dn_db_l;
let future_denoms =
@ -303,7 +302,7 @@ module Make (Conn : Pg.CONN) : S = struct
(* rebuild it *)
let future_sk = make_future_sk (pub, (t1, t2)) in
let sk = sk_of_future_sk future_sk master_sig in
let+ () = Pg.insert_signkey conn sk |> unwrap_err_caqti in
let+ () = Pg.insert_signkey conn sk |> unwrap_caqti in
Logs.info (fun m ->
m "certified signkey `%s`" (EddsaPublicKey.to_b32 sk.pub));
())
@ -321,7 +320,7 @@ module Make (Conn : Pg.CONN) : S = struct
| None ->
let future_dn = make_future_dn (h_pub, (section_name, pub, t1)) in
let dn = dn_of_future_dn future_dn h_pub master_sig in
let+ () = Pg.insert_denom conn dn |> unwrap_err_caqti in
let+ () = Pg.insert_denom conn dn |> unwrap_caqti in
Logs.info (fun m ->
m "certified denomination `%s`"
(DenominationHash.to_b32 dn.h_pub));
@ -332,7 +331,7 @@ module Make (Conn : Pg.CONN) : S = struct
let* _sk = Option.to_result ~none:"signkey not found" opt in
let* () = Sm_eddsa.revoke pub in
let+ () =
Pg.insert_signkey_revocation conn pub revoked_sig |> unwrap_err_caqti
Pg.insert_signkey_revocation conn pub revoked_sig |> unwrap_caqti
in
Logs.info (fun m -> m "revoked signkey `%s`" (EddsaPublicKey.to_b32 pub));
()
@ -343,7 +342,7 @@ module Make (Conn : Pg.CONN) : S = struct
let* () = Sm_rsa.revoke dn.h_pub in
let+ () =
Pg.insert_denomination_revocation conn dn.h_pub revoked_sig
|> unwrap_err_caqti
|> unwrap_caqti
in
Logs.info (fun m ->
m "revoked denomination `%s`" (DenominationHash.to_b32 h_pub));

12
src/mte.ml
View file

@ -29,19 +29,19 @@ let routes =
let tos =
[
get rel --> hello;
get (v "terms") --> Http_terms.terms;
get (v "privacy") --> Http_terms.privacy;
get (v "terms") --> Mte_terms.terms;
get (v "privacy") --> Mte_terms.privacy;
]
in
let status_info =
[
get (v "seed") --> Http_info.seed;
get (v "config") --> Http_info.config;
get (v "keys") --> Http_info.keys;
get (v "seed") --> Mte_info.seed;
get (v "config") --> Mte_info.config;
get (v "keys") --> Mte_info.keys;
]
in
let management =
let open Http_management in
let open Mte_management in
let v s = v "management" / s in
[
get (v "keys") --> Keys_get.f;

8
src/http_info.ml → src/mte_info.ml
View file

@ -41,13 +41,11 @@ let mk_keys ~db_conn (module Keys : Keys.S) ~last_issue_date =
let stefan_lin = Config.stefan_lin in
(* type of the asset. "fiat", "crypto", "regional" or "stock". *)
let asset_type = "fiat" in
let* accounts = Pg.get_wire_accounts db_conn () |> unwrap_err_caqti in
let* accounts = Pg.get_wire_accounts db_conn () |> unwrap_caqti in
let* wire_fees =
(* wire_methods? *)
let wire_method = "x-taler-bank" in
let+ wire_fees =
Pg.get_wire_fees db_conn ~wire_method |> unwrap_err_caqti
in
let+ wire_fees = Pg.get_wire_fees db_conn ~wire_method |> unwrap_caqti in
String_map.singleton wire_method wire_fees
in
let wads = [] in
@ -111,7 +109,7 @@ let mk_keys ~db_conn (module Keys : Keys.S) ~last_issue_date =
let recoup = (* /recoup *) [] in
let* global_fees =
Pg.get_global_fees db_conn ~start_date:Timestamp.zero |> unwrap_err_caqti
Pg.get_global_fees db_conn ~start_date:Timestamp.zero |> unwrap_caqti
in
let* auditors =
(* /auditors/$AUDITOR_PUB/$H_DENOM_PUB *)

63
src/http_management.ml → src/mte_management.ml
View file

@ -33,7 +33,7 @@ module Keys_post = struct
Logs.info (fun m -> m "POST /management/keys/");
let keys = Vif.Server.device Devices.keys server in
let res =
let* v = Vif.Request.of_json req |> unwrap_err_msg in
let* v = Vif.Request.of_json req |> unwrap_msg in
let* () = verify keys v in
let* () = do_ keys v in
Ok ()
@ -59,7 +59,7 @@ module Denom_revoke = struct
let keys = Vif.Server.device Devices.keys server in
let res =
let* h_denom_pub = Crypto.DenominationHash.of_b32 h_denom_pub in
let* v = Vif.Request.of_json req |> unwrap_err_msg in
let* v = Vif.Request.of_json req |> unwrap_msg in
let* () = verify keys h_denom_pub v in
let* () = do_ keys h_denom_pub v in
Ok ()
@ -85,7 +85,7 @@ module Signkey_revoke = struct
let keys = Vif.Server.device Devices.keys server in
let res =
let* exchange_pub = Crypto.EddsaPublicKey.of_b32 exchange_pub in
let* v = Vif.Request.of_json req |> unwrap_err_msg in
let* v = Vif.Request.of_json req |> unwrap_msg in
let* () = verify keys exchange_pub v in
let* () = do_ keys exchange_pub v in
Ok ()
@ -114,18 +114,18 @@ module Auditors = struct
let do_ ~db_conn v =
let auditor_pub = v.AuditorSetupMessage.auditor_pub in
let validity_start = v.AuditorSetupMessage.validity_start in
let* opt = Pg.find_auditor db_conn auditor_pub |> unwrap_err_caqti in
let* opt = Pg.find_auditor db_conn auditor_pub |> unwrap_caqti in
match opt with
| None ->
let auditor = Auditor.of_setup_message v in
let+ () = Pg.update_auditor db_conn auditor |> unwrap_err_caqti in
let+ () = Pg.update_auditor db_conn auditor |> unwrap_caqti in
Logs.info (fun m -> m "enabled auditor");
()
| Some auditor ->
if Timestamp.compare validity_start auditor.last_change <= 0 then
Error "replay detected on enable-auditor"
else
let+ () = Pg.update_auditor db_conn auditor |> unwrap_err_caqti in
let+ () = Pg.update_auditor db_conn auditor |> unwrap_caqti in
Logs.info (fun m -> m "updated auditor");
()
@ -136,7 +136,7 @@ module Auditors = struct
let keys = Vif.Server.device Devices.keys server in
let db_conn = Vif.Server.device Devices.db_connection server in
let res =
let* v = Vif.Request.of_json req |> unwrap_err_msg in
let* v = Vif.Request.of_json req |> unwrap_msg in
let* () = verify keys v in
let* () = do_ ~db_conn v in
Ok ()
@ -153,7 +153,7 @@ module Auditors_disable = struct
let do_ ~db_conn auditor_pub
AuditorTeardownMessage.{ master_sig= _; validity_end } =
let* opt = Pg.find_auditor db_conn auditor_pub |> unwrap_err_caqti in
let* opt = Pg.find_auditor db_conn auditor_pub |> unwrap_caqti in
match opt with
| None -> Error "auditor not found"
| Some auditor -> (
@ -168,7 +168,7 @@ module Auditors_disable = struct
let auditor =
{ auditor with last_change= validity_end; is_active= false }
in
let+ () = Pg.update_auditor db_conn auditor |> unwrap_err_caqti in
let+ () = Pg.update_auditor db_conn auditor |> unwrap_caqti in
Logs.info (fun m ->
m "revoked auditor `%s`"
(Crypto.EddsaPublicKey.to_b32 auditor_pub));
@ -182,7 +182,7 @@ module Auditors_disable = struct
let db_conn = Vif.Server.device Devices.db_connection server in
let res =
let* auditor_pub = Crypto.EddsaPublicKey.of_b32 auditor_pub in
let* v = Vif.Request.of_json req |> unwrap_err_msg in
let* v = Vif.Request.of_json req |> unwrap_msg in
let* () = verify keys auditor_pub v in
let* () = do_ ~db_conn auditor_pub v in
Ok ()
@ -215,11 +215,11 @@ module Wire_fee = struct
let* wire_fees =
Pg.get_wire_fees_by_time db_conn ~wire_method:v.wire_method
~start_date:v.fee_start ~end_date:v.fee_end
|> unwrap_err_caqti
|> unwrap_caqti
in
match wire_fees with
| [] ->
let+ () = Pg.insert_wire_fee db_conn v |> unwrap_err_caqti in
let+ () = Pg.insert_wire_fee db_conn v |> unwrap_caqti in
Logs.info (fun m -> m "added wire fee");
()
| [ vv ] -> (
@ -241,7 +241,7 @@ module Wire_fee = struct
let keys = Vif.Server.device Devices.keys server in
let db_conn = Vif.Server.device Devices.db_connection server in
let res =
let* v = Vif.Request.of_json req |> unwrap_err_msg in
let* v = Vif.Request.of_json req |> unwrap_msg in
let* () = verify keys v in
let* () = do_ ~db_conn v in
Ok ()
@ -256,12 +256,11 @@ module Global_fees = struct
let* global_fees =
let start_date = v.GlobalFees.start_date in
let end_date = v.GlobalFees.end_date in
Pg.get_global_fees_by_time db_conn ~start_date ~end_date
|> unwrap_err_caqti
Pg.get_global_fees_by_time db_conn ~start_date ~end_date |> unwrap_caqti
in
match global_fees with
| [] ->
let+ () = Pg.insert_global_fees db_conn v |> unwrap_err_caqti in
let+ () = Pg.insert_global_fees db_conn v |> unwrap_caqti in
Logs.info (fun m -> m "added global fees");
()
| [ vv ] -> (
@ -287,7 +286,7 @@ module Global_fees = struct
Logs.info (fun m -> m "POST /management/global-fees/");
let db_conn = Vif.Server.device Devices.db_connection server in
let res =
let* v = Vif.Request.of_json req |> unwrap_err_msg in
let* v = Vif.Request.of_json req |> unwrap_msg in
let* () = verify v in
let* () = do_ ~db_conn v in
Ok ()
@ -325,6 +324,7 @@ module Wire = struct
in
let h_credit_restrictions = Hash.Cstring.H64.hash "" in
let h_debit_restrictions = Hash.Cstring.H64.hash "" in
(* - *)
let* () =
let open Signatures.MasterWireDetails in
verify Config.master_public_key master_sig_wire
@ -361,7 +361,7 @@ module Wire = struct
bank_label;
priority;
} =
let* opt = Pg.find_wire db_conn ~payto_uri |> unwrap_err_caqti in
let* opt = Pg.find_wire db_conn ~payto_uri |> unwrap_caqti in
match opt with
| None ->
let wire =
@ -379,7 +379,7 @@ module Wire = struct
let+ () =
Pg.update_wire db_conn ~is_active:true ~last_change:validity_start
wire
|> unwrap_err_caqti
|> unwrap_caqti
in
Logs.info (fun m -> m "added wire method");
()
@ -390,7 +390,7 @@ module Wire = struct
let+ () =
Pg.update_wire db_conn ~is_active:true ~last_change:validity_start
wire
|> unwrap_err_caqti
|> unwrap_caqti
in
Logs.info (fun m -> m "updated wire method");
()
@ -402,7 +402,7 @@ module Wire = struct
let keys = Vif.Server.device Devices.keys server in
let db_conn = Vif.Server.device Devices.db_connection server in
let res =
let* v = Vif.Request.of_json req |> unwrap_err_msg in
let* v = Vif.Request.of_json req |> unwrap_msg in
let* () = verify keys v in
let* () = do_ ~db_conn v in
Ok ()
@ -419,7 +419,7 @@ module Wire_disable = struct
let do_ ~db_conn
WireTeardownMessage.{ payto_uri; master_sig_del= _; validity_end } =
let* opt = Pg.find_wire db_conn ~payto_uri |> unwrap_err_caqti in
let* opt = Pg.find_wire db_conn ~payto_uri |> unwrap_caqti in
match opt with
| None -> Error "wire not found"
| Some (wire, _is_active, last_change) ->
@ -429,7 +429,7 @@ module Wire_disable = struct
let+ () =
Pg.update_wire db_conn ~is_active:false ~last_change:validity_end
wire
|> unwrap_err_caqti
|> unwrap_caqti
in
Logs.info (fun m -> m "disabled wire method");
()
@ -441,7 +441,7 @@ module Wire_disable = struct
let keys = Vif.Server.device Devices.keys server in
let db_conn = Vif.Server.device Devices.db_connection server in
let res =
let* v = Vif.Request.of_json req |> unwrap_err_msg in
let* v = Vif.Request.of_json req |> unwrap_msg in
let* () = verify keys v in
let* () = do_ ~db_conn v in
Ok ()
@ -472,15 +472,14 @@ module Drain = struct
let do_ ~db_conn v =
let* opt =
Pg.find_drain_profit db_conn v.DrainProfitsMessage.wtid
|> unwrap_err_caqti
Pg.find_drain_profit db_conn v.DrainProfitsMessage.wtid |> unwrap_caqti
in
match opt with
| Some _ ->
Logs.info (fun m -> m "drain profit message already added to database");
Ok ()
| None ->
let+ () = Pg.insert_drain_profit db_conn v |> unwrap_err_caqti in
let+ () = Pg.insert_drain_profit db_conn v |> unwrap_caqti in
Logs.info (fun m -> m "added drain profit message to database");
()
@ -491,7 +490,7 @@ module Drain = struct
let keys = Vif.Server.device Devices.keys server in
let db_conn = Vif.Server.device Devices.db_connection server in
let res =
let* v = Vif.Request.of_json req |> unwrap_err_msg in
let* v = Vif.Request.of_json req |> unwrap_msg in
let* () = verify keys v in
let* () = do_ ~db_conn v in
Ok ()
@ -521,7 +520,7 @@ module AmlOfficer = struct
}
let do_ ~db_conn v =
let+ _last_change = Pg.insert_aml_officer db_conn v |> unwrap_err_caqti in
let+ _last_change = Pg.insert_aml_officer db_conn v |> unwrap_caqti in
()
let jsont = AmlOfficerSetup.jsont
@ -531,7 +530,7 @@ module AmlOfficer = struct
let keys = Vif.Server.device Devices.keys server in
let db_conn = Vif.Server.device Devices.db_connection server in
let res =
let* v = Vif.Request.of_json req |> unwrap_err_msg in
let* v = Vif.Request.of_json req |> unwrap_msg in
let* () = verify keys v in
let* () = do_ ~db_conn v in
Ok ()
@ -563,7 +562,7 @@ module Partners = struct
}
let do_ ~db_conn v =
let+ () = Pg.insert_partner db_conn v |> unwrap_err_caqti in
let+ () = Pg.insert_partner db_conn v |> unwrap_caqti in
()
let jsont = ExchangePartnerSetupRequest.jsont
@ -573,7 +572,7 @@ module Partners = struct
let keys = Vif.Server.device Devices.keys server in
let db_conn = Vif.Server.device Devices.db_connection server in
let res =
let* v = Vif.Request.of_json req |> unwrap_err_msg in
let* v = Vif.Request.of_json req |> unwrap_msg in
let* () = verify keys v in
let* () = do_ ~db_conn v in
Ok ()

0
src/http_terms.ml → src/mte_terms.ml
View file

9
src/pg.ml
View file

@ -1,11 +1,6 @@
(* TODO
can we avoid amount tuple boilerplate?
clean up caqti error type
transaction
GNU Taler use of db-events?
it seems caqti/pgx does not support it *)
GNU Taler use of db-events? it seems caqti/pgx does not support it *)
module type CONN = Caqti_miou.CONNECTION
@ -162,7 +157,7 @@ let get_auditor_keys =
in
fun (module Conn : CONN) ->
let open Syntax in
let* l = Conn.collect_list req () |> unwrap_err_caqti in
let* l = Conn.collect_list req () |> unwrap_caqti in
let ht = Hashtbl.create 0xff in
List.iter
(fun (pub, url, name, denom_pub_h, auditor_sig) ->

3
src/respond.ml
View file

@ -1,6 +1,3 @@
(* TODO response
use ErrorDetail *)
let encode_error_detail err =
match Api.(encode ErrorDetail.jsont err) with
| Error e -> Fmt.failwith "json encoding error on `ErrorDetail`: %s." e

34
src/secmod_eddsa.ml
View file

@ -1,3 +1,12 @@
(* TODO
! use lock
schedule tasks
sign: check timestamps before signing
list_issue_date: save timestamp of key generation
key validity period:
more checks + do not exceed lookahead
refacto common parts with secmod_eddsa *)
let src = Logs.Src.create "mte.secmod_eddsa"
module Log = (val Logs.src_log src : Logs.LOG)
@ -46,13 +55,13 @@ let key_fpath k =
let read_key fpath =
Log.debug (fun m -> m "reading key file `%a`" Fpath.pp fpath);
let* data = Bos.OS.File.read fpath |> unwrap_err_msg in
let* data = Bos.OS.File.read fpath |> unwrap_msg in
EddsaPrivateKey.of_octets data
let write_eddsa fpath priv =
Log.debug (fun m -> m "writing key file `%a`" Fpath.pp fpath);
let data = EddsaPrivateKey.to_octets priv in
Bos.OS.File.write fpath data |> unwrap_err_msg
Bos.OS.File.write fpath data |> unwrap_msg
let write_key k = write_eddsa (key_fpath k) k.priv
@ -66,16 +75,14 @@ let delete_file fpath =
Fpath.pp fpath
in
Log.debug (fun m -> m "delete key file `%a`" Fpath.pp fpath);
let+ () = Bos.OS.File.delete ~must_exist:true fpath |> unwrap_err_msg in
let+ () = Bos.OS.File.delete ~must_exist:true fpath |> unwrap_msg in
()
let get_key_dir_contents dir =
let* dir = Fpath.of_string dir |> unwrap_err_msg in
let* b = Bos.OS.Dir.create ~mode:0o700 dir |> unwrap_err_msg in
let* dir = Fpath.of_string dir |> unwrap_msg in
let* b = Bos.OS.Dir.create ~mode:0o700 dir |> unwrap_msg in
if b then Log.info (fun m -> m "created directory `%a`" Fpath.pp dir);
let+ l =
Bos.OS.Dir.contents ~dotfiles:false ~rel:false dir |> unwrap_err_msg
in
let+ l = Bos.OS.Dir.contents ~dotfiles:false ~rel:false dir |> unwrap_msg in
List.map Fpath.normalize l
(* -- *)
@ -103,7 +110,6 @@ let split_in_periodes ~start ~end_ =
in
go acc start end_
(* TODO do not exceed lookahead (probably more important...) *)
(* try to not generate keys with validity start in the past *)
let gen_additional_keys_until_lookahead ~now l =
let start =
@ -118,11 +124,10 @@ let gen_additional_keys_until_lookahead ~now l =
let new_keys = List.map (fun (t1, t2) -> gen_key t1 t2) periodes in
new_keys
(* TODO config *)
let sm_key_fpath =
Result.get_ok
@@
let+ fpath = Fpath.of_string Cfg.sm_priv_key |> unwrap_err_msg in
let+ fpath = Fpath.of_string Cfg.sm_priv_key |> unwrap_msg in
Fpath.normalize fpath
(* we load sm_key separately
@ -216,10 +221,3 @@ module Make () = struct
let keys () = Hashtbl.to_seq_values t.ht |> List.of_seq |> List.map conv
let find_key pub = Hashtbl.find_opt t.ht pub |> Option.map conv
end
(* TODO
- more checks
- sign: check timestamps before signing
- schedule tasks
- !lock
*)

21
src/secmod_rsa.ml
View file

@ -1,4 +1,3 @@
(* TODO refacto common parts with secmod_eddsa *)
let src = Logs.Src.create "mte.secmod_rsa"
module Log = (val Logs.src_log src : Logs.LOG)
@ -80,22 +79,22 @@ let key_fpath k =
let read_eddsa fpath =
Log.debug (fun m -> m "reading key file `%a`" Fpath.pp fpath);
let* data = Bos.OS.File.read fpath |> unwrap_err_msg in
let* data = Bos.OS.File.read fpath |> unwrap_msg in
EddsaPrivateKey.of_octets data
let read_rsa fpath =
Log.debug (fun m -> m "reading key file `%a`" Fpath.pp fpath);
let* data = Bos.OS.File.read fpath |> unwrap_err_msg in
let* data = Bos.OS.File.read fpath |> unwrap_msg in
RsaPrivateKey.of_octets data
let write_eddsa fpath priv =
Log.debug (fun m -> m "writing key file `%a`" Fpath.pp fpath);
let data = EddsaPrivateKey.to_octets priv in
Bos.OS.File.write fpath data |> unwrap_err_msg
Bos.OS.File.write fpath data |> unwrap_msg
let write_rsa fpath priv =
let data = RsaPrivateKey.to_octets priv in
Bos.OS.File.write fpath data |> unwrap_err_msg
Bos.OS.File.write fpath data |> unwrap_msg
let write_key k = write_rsa (key_fpath k) k.priv
@ -109,14 +108,14 @@ let delete_file fpath =
Fpath.pp fpath
in
Log.debug (fun m -> m "delete key file `%a`" Fpath.pp fpath);
let+ () = Bos.OS.File.delete ~must_exist:true fpath |> unwrap_err_msg in
let+ () = Bos.OS.File.delete ~must_exist:true fpath |> unwrap_msg in
()
let get_key_dir_contents dir_fpath =
let* b = Bos.OS.Dir.create ~mode:0o700 dir_fpath |> unwrap_err_msg in
let* b = Bos.OS.Dir.create ~mode:0o700 dir_fpath |> unwrap_msg in
if b then Log.info (fun m -> m "created directory `%a`" Fpath.pp dir_fpath);
let+ l =
Bos.OS.Dir.contents ~dotfiles:false ~rel:false dir_fpath |> unwrap_err_msg
Bos.OS.Dir.contents ~dotfiles:false ~rel:false dir_fpath |> unwrap_msg
in
List.map Fpath.normalize l
@ -168,7 +167,7 @@ let gen_additional_keys_until_lookahead ~now ~section_name l =
let sm_key_fpath =
Result.get_ok
@@
let+ fpath = Fpath.of_string Cfg.sm_priv_key |> unwrap_err_msg in
let+ fpath = Fpath.of_string Cfg.sm_priv_key |> unwrap_msg in
Fpath.normalize fpath
(* we load sm_key separately
@ -199,9 +198,7 @@ let load () =
let sm_pub = EddsaPrivateKey.pub_of_priv sm_key_priv in
let ht = Hashtbl.create 0xff in
let () = List.iter (fun k -> Hashtbl.replace ht k.h_pub k) keys in
(* TODO list_issue_date
not ideal, not sure what to put here
it would be best to save keys creation time *)
(* TODO list_issue_date *)
let last_change = Timestamp.never in
Ok (Some { sm_key_priv; sm_pub; ht; last_change })

9
src/syntax.ml
View file

@ -1,10 +1,13 @@
let ( let* ) o f = match o with Ok v -> f v | Error _ as e -> e
let ( let+ ) o f = match o with Ok v -> Ok (f v) | Error _ as e -> e
(* TODO use polymorphic variant for errors *)
let unwrap_err_msg o = match o with Error (`Msg e) -> Error e | Ok v -> Ok v
(* TODO better errors
use polymorphic variant for errors
use GANA error codes:
https://git.gnunet.org/gana.git/tree/gnu-taler-error-codes/registry.rec *)
let unwrap_msg o = match o with Error (`Msg e) -> Error e | Ok v -> Ok v
let unwrap_err_caqti o =
let unwrap_caqti o =
match o with Error err -> Fmt.error "%a" Caqti_error.pp err | Ok v -> Ok v
let list_iter f l =

1
src/time.mli
View file

@ -50,7 +50,6 @@ module Timestamp : sig
val of_absolute : TimeAbsolute.t -> t
val of_ptime : Ptime.t -> t
(* TODO add pp *)
(* - *)
val bin : t Bin.t
val caqti : t Caqti_type.t

2
test/management.sh
View file

@ -10,6 +10,8 @@ auditor_pub="A17JXR3E6J4CXDPYT7S1H25PGJ3ABS26TQ38654QCX0TB59RPMF0"
master_key="./default/master_offline_private_key"
zero_kudos="KUDOS:0.0"
# TODO launch mte.exe and kill it a then end with its PID
offline_tool() {
dune exec offline -- "$@" > /dev/null
}

2
test/test.ml
View file

@ -34,8 +34,6 @@ let () =
check Timestamp.jsont {|{"t_s": "never"}|};
check_bad Timestamp.jsont {|{"t_s": "123456780"}|};
check_bad Timestamp.jsont {|{"t_s": "agagou"}|};
(* TODO CS not implemented *)
check_bad DenominationKey.jsont
{|{"cipher": "CS", "age_mask": 18, "cs_pub": "ouhagag"}|};
()

12
test/validate_response.ml
View file

@ -12,8 +12,8 @@ let keys content =
else Fmt.error "version incompatible"
in
(* TODO need hash over json..
validate ExchangeWireAccount *)
(* TODO json hash
validate wire *)
let* () =
let open AggregateTransferFee in
v.wire_fees
@ -51,11 +51,13 @@ let keys content =
let opt = List.find_opt (fun sk -> sk.Signkey.pub = v.exchange_pub) sk_l in
match opt with
| None -> Fmt.error "exchange_pub is not in signkeys list"
| Some sk ->
(* TODO will need to fake time to validate expired data *)
| Some _sk ->
(* todo add a --now option if we want to validate timestamps
let now = Timestamp.of_ptime (Ptime_clock.now ()) in
if Signkey.is_valid_at ~timestamp:now sk then Ok ()
else Fmt.error "exchange_pub is not valid at the current time"
*)
Ok ()
in
let* () =
let open Signatures.ExchangeKeySet in
@ -127,7 +129,7 @@ let keys_cmd =
@@
let+ input = input in
let* content =
Result.bind (Fpath.of_string input) Bos.OS.File.read |> unwrap_err_msg
Result.bind (Fpath.of_string input) Bos.OS.File.read |> unwrap_msg
in
keys content

22
tools/offline_impl.ml
View file

@ -145,10 +145,10 @@ end
(* -- *)
let read_file fname = Bos.OS.File.read (Fpath.v fname) |> unwrap_err_msg
let read_file fname = Bos.OS.File.read (Fpath.v fname) |> unwrap_msg
let write_file fname content =
Bos.OS.File.write (Fpath.v fname) content |> unwrap_err_msg
Bos.OS.File.write (Fpath.v fname) content |> unwrap_msg
let read_master_key_file filename =
let* master_key = read_file filename in
@ -167,7 +167,7 @@ let download ~output ~url =
% "-X"
% "GET"
% url)
|> unwrap_err_msg
|> unwrap_msg
let upload ~input ~url =
let open Bos in
@ -185,7 +185,7 @@ let upload ~input ~url =
% "--data"
% ("@" ^ input)
% url)
|> unwrap_err_msg
|> unwrap_msg
let setup ~output ~output_pubkey =
Mirage_crypto_rng_unix.use_default ();
@ -348,15 +348,8 @@ let wire_fee ~output ~master_key ~wire_method ~fee_start ~fee_end ~closing_fee
let* () = write_file output s in
Ok ()
(* TODO wire
hash over json, hash over string option?
~conversion_url ~credit_restrictions ~debit_restrictions *)
let enable_wire ~output ~master_key ~payto_uri ~bank_label ~priority =
let* key = read_master_key_file master_key in
let ns = Mtime_clock.now_ns () in
let validity_start = Timestamp.of_s @@ Int64.unsigned_div ns 1_000_000_000L in
let h_wire_details = Hash.FullPaytoHash.hash payto_uri in
(* TODO wire *)
let conversion_url = None in
let credit_restrictions = [] in
let debit_restrictions = [] in
@ -365,6 +358,11 @@ let enable_wire ~output ~master_key ~payto_uri ~bank_label ~priority =
in
let h_credit_restrictions = Hash.Cstring.H64.hash "" in
let h_debit_restrictions = Hash.Cstring.H64.hash "" in
(* - *)
let* key = read_master_key_file master_key in
let ns = Mtime_clock.now_ns () in
let validity_start = Timestamp.of_s @@ Int64.unsigned_div ns 1_000_000_000L in
let h_wire_details = Hash.FullPaytoHash.hash payto_uri in
let master_sig_wire =
let open Signatures.MasterWireDetails in
signf (EddsaSignature.sign ~key)