This commit is contained in:
parent
0fcc22e213
commit
62050dc883
1 changed files with 17 additions and 19 deletions
36
src/keys.ml
36
src/keys.ml
|
|
@ -205,13 +205,13 @@ module Make (Conn : Pg.CONN) = struct
|
||||||
let database_find_sk conn pub =
|
let database_find_sk conn pub =
|
||||||
let* opt = Pg.find_signkey conn pub |> unwrap_err_caqti in
|
let* opt = Pg.find_signkey conn pub |> unwrap_err_caqti in
|
||||||
match opt with
|
match opt with
|
||||||
| None -> Fmt.error "secmod: signkey data not found in database"
|
| None -> Fmt.error "Keys: signkey data not found in database"
|
||||||
| Some sk_data -> Ok sk_data
|
| Some sk_data -> Ok sk_data
|
||||||
|
|
||||||
let database_find_dn conn h_pub =
|
let database_find_dn conn h_pub =
|
||||||
let* opt = Pg.find_denom conn h_pub |> unwrap_err_caqti in
|
let* opt = Pg.find_denom conn h_pub |> unwrap_err_caqti in
|
||||||
match opt with
|
match opt with
|
||||||
| None -> Fmt.error "secmod: denomination data not found in database"
|
| None -> Fmt.error "Keys: denomination data not found in database"
|
||||||
| Some dn_data -> Ok dn_data
|
| Some dn_data -> Ok dn_data
|
||||||
|
|
||||||
let list_to_ht l = Hashtbl.of_seq (List.to_seq l)
|
let list_to_ht l = Hashtbl.of_seq (List.to_seq l)
|
||||||
|
|
@ -282,25 +282,24 @@ module Make (Conn : Pg.CONN) = struct
|
||||||
let init () =
|
let init () =
|
||||||
let dir = Config.secmod_dir in
|
let dir = Config.secmod_dir in
|
||||||
let* b = Bos.OS.Dir.create ~mode:0o700 dir |> unwrap_err_msg in
|
let* b = Bos.OS.Dir.create ~mode:0o700 dir |> unwrap_err_msg in
|
||||||
if b then
|
if b then Logs.info (fun m -> m "Keys: created directory `%a`" Fpath.pp dir);
|
||||||
Logs.info (fun m -> m "secmod: created directory `%a`" Fpath.pp dir);
|
|
||||||
let* l =
|
let* l =
|
||||||
Bos.OS.Dir.contents ~dotfiles:false ~rel:false dir |> unwrap_err_msg
|
Bos.OS.Dir.contents ~dotfiles:false ~rel:false dir |> unwrap_err_msg
|
||||||
in
|
in
|
||||||
match List.is_empty l with
|
match List.is_empty l with
|
||||||
| true ->
|
| true ->
|
||||||
Logs.info (fun m -> m "secmod: empty storage, generating fresh keys");
|
Logs.info (fun m -> m "Keys: empty storage, generating fresh keys");
|
||||||
let t = make_new () in
|
let t = make_new () in
|
||||||
Ok t
|
Ok t
|
||||||
| false ->
|
| false ->
|
||||||
Logs.info (fun m -> m "secmod: loading keys from storage");
|
Logs.info (fun m -> m "Keys: loading keys from storage");
|
||||||
load ()
|
load ()
|
||||||
|
|
||||||
let t =
|
let t =
|
||||||
match init () with
|
match init () with
|
||||||
| Error e -> Fmt.failwith "secmod initialization failure: `%s`." e
|
| Error e -> Fmt.failwith "Keys: initialization failure: `%s`." e
|
||||||
| Ok t ->
|
| Ok t ->
|
||||||
Logs.info (fun m -> m "secmod initialized");
|
Logs.info (fun m -> m "Keys: initialized");
|
||||||
t
|
t
|
||||||
|
|
||||||
let sm_pubkey = t.sm_pubkey
|
let sm_pubkey = t.sm_pubkey
|
||||||
|
|
@ -308,7 +307,7 @@ module Make (Conn : Pg.CONN) = struct
|
||||||
|
|
||||||
let sign_with_signkey ~pub s =
|
let sign_with_signkey ~pub s =
|
||||||
match Hashtbl.find_opt t.sk_key_ht pub with
|
match Hashtbl.find_opt t.sk_key_ht pub with
|
||||||
| None -> Fmt.failwith "secmod sign_with_signkey failure: not found."
|
| None -> Fmt.failwith "Keys sign_with_signkey failure: not found."
|
||||||
| Some priv -> EddsaSignature.sign ~key:priv s
|
| Some priv -> EddsaSignature.sign ~key:priv s
|
||||||
|
|
||||||
let verify_with_sm_key s ~msg = EddsaSignature.verify ~key:t.sm_pubkey s ~msg
|
let verify_with_sm_key s ~msg = EddsaSignature.verify ~key:t.sm_pubkey s ~msg
|
||||||
|
|
@ -318,7 +317,7 @@ module Make (Conn : Pg.CONN) = struct
|
||||||
|
|
||||||
let verify_with_signkey ~pub s ~msg =
|
let verify_with_signkey ~pub s ~msg =
|
||||||
match Hashtbl.find_opt t.sk_ht pub with
|
match Hashtbl.find_opt t.sk_ht pub with
|
||||||
| None -> Fmt.failwith "secmod verify_with_signkey failure: not found."
|
| None -> Fmt.failwith "Keys verify_with_signkey failure: not found."
|
||||||
| Some _sk -> EddsaSignature.verify ~key:pub s ~msg
|
| Some _sk -> EddsaSignature.verify ~key:pub s ~msg
|
||||||
|
|
||||||
let get_signkeys () = t.sk_ht |> Hashtbl.to_seq_values |> List.of_seq
|
let get_signkeys () = t.sk_ht |> Hashtbl.to_seq_values |> List.of_seq
|
||||||
|
|
@ -341,10 +340,10 @@ module Make (Conn : Pg.CONN) = struct
|
||||||
Hashtbl.find_opt t.future_sk_key_ht pub )
|
Hashtbl.find_opt t.future_sk_key_ht pub )
|
||||||
with
|
with
|
||||||
| None, _ | _, None ->
|
| None, _ | _, None ->
|
||||||
Error "secmod certify_future_signkey: future signkey not found."
|
Error "Keys certify_future_signkey: future signkey not found."
|
||||||
| Some future_sk, Some priv -> (
|
| Some future_sk, Some priv -> (
|
||||||
match Hashtbl.find_opt t.sk_ht pub with
|
match Hashtbl.find_opt t.sk_ht pub with
|
||||||
| Some _sk -> Error "secmod certify_future_signkey: already certified"
|
| Some _sk -> Error "Keys certify_future_signkey: already certified"
|
||||||
| None ->
|
| None ->
|
||||||
let Api.FutureSignKey.
|
let Api.FutureSignKey.
|
||||||
{
|
{
|
||||||
|
|
@ -381,12 +380,11 @@ module Make (Conn : Pg.CONN) = struct
|
||||||
Hashtbl.find_opt t.future_dn_key_ht h_pub )
|
Hashtbl.find_opt t.future_dn_key_ht h_pub )
|
||||||
with
|
with
|
||||||
| None, _ | _, None ->
|
| None, _ | _, None ->
|
||||||
Error
|
Error "Keys certify_future_denomination: future denomination not found."
|
||||||
"secmod certify_future_denomination: future denomination not found."
|
|
||||||
| Some future_dn, Some priv -> (
|
| Some future_dn, Some priv -> (
|
||||||
match Hashtbl.find_opt t.dn_ht h_pub with
|
match Hashtbl.find_opt t.dn_ht h_pub with
|
||||||
| Some _dn ->
|
| Some _dn ->
|
||||||
Error "secmod certify_future_denomination: already certified"
|
Error "Keys certify_future_denomination: already certified"
|
||||||
| None ->
|
| None ->
|
||||||
let Api.FutureDenom.
|
let Api.FutureDenom.
|
||||||
{
|
{
|
||||||
|
|
@ -439,7 +437,7 @@ module Make (Conn : Pg.CONN) = struct
|
||||||
|
|
||||||
let revoke_signkey pub revoked_sig =
|
let revoke_signkey pub revoked_sig =
|
||||||
match Hashtbl.find_opt t.sk_ht pub with
|
match Hashtbl.find_opt t.sk_ht pub with
|
||||||
| None -> Error "secmod revoke_signkey: signkey not found."
|
| None -> Error "Keys revoke_signkey: signkey not found."
|
||||||
| Some sk ->
|
| Some sk ->
|
||||||
let sk = { sk with revoked_sig= Some revoked_sig } in
|
let sk = { sk with revoked_sig= Some revoked_sig } in
|
||||||
Hashtbl.replace t.sk_ht pub sk;
|
Hashtbl.replace t.sk_ht pub sk;
|
||||||
|
|
@ -449,7 +447,7 @@ module Make (Conn : Pg.CONN) = struct
|
||||||
|
|
||||||
let revoke_denomination pub revoked_sig =
|
let revoke_denomination pub revoked_sig =
|
||||||
match Hashtbl.find_opt t.dn_ht pub with
|
match Hashtbl.find_opt t.dn_ht pub with
|
||||||
| None -> Error "secmod revoke_denomination: denomination not found."
|
| None -> Error "Keys revoke_denomination: denomination not found."
|
||||||
| Some dn ->
|
| Some dn ->
|
||||||
let dn = { dn with revoked_sig= Some revoked_sig } in
|
let dn = { dn with revoked_sig= Some revoked_sig } in
|
||||||
Hashtbl.replace t.dn_ht pub dn;
|
Hashtbl.replace t.dn_ht pub dn;
|
||||||
|
|
@ -470,9 +468,9 @@ module Make (Conn : Pg.CONN) = struct
|
||||||
|> List.of_seq
|
|> List.of_seq
|
||||||
|> list_iter (fun (h_pub, priv) ->
|
|> list_iter (fun (h_pub, priv) ->
|
||||||
match Hashtbl.find_opt t.dn_section_name_ht h_pub with
|
match Hashtbl.find_opt t.dn_section_name_ht h_pub with
|
||||||
| None -> Error "secmod save: invalid state, section_name not found"
|
| None -> Error "Keys save: invalid state, section_name not found"
|
||||||
| Some section_name -> write_rsa (dn_fname section_name) priv)
|
| Some section_name -> write_rsa (dn_fname section_name) priv)
|
||||||
in
|
in
|
||||||
Logs.info (fun m -> m "saved secmod private keys data");
|
Logs.info (fun m -> m "saved private keys data");
|
||||||
Ok ()
|
Ok ()
|
||||||
end
|
end
|
||||||
|
|
|
||||||
Loading…
Add table
Add a link
Reference in a new issue