This commit is contained in:
swrup 2026-02-18 17:41:01 +01:00
parent 0fcc22e213
commit 62050dc883

View file

@ -205,13 +205,13 @@ module Make (Conn : Pg.CONN) = struct
let database_find_sk conn pub = let database_find_sk conn pub =
let* opt = Pg.find_signkey conn pub |> unwrap_err_caqti in let* opt = Pg.find_signkey conn pub |> unwrap_err_caqti in
match opt with match opt with
| None -> Fmt.error "secmod: signkey data not found in database" | None -> Fmt.error "Keys: signkey data not found in database"
| Some sk_data -> Ok sk_data | Some sk_data -> Ok sk_data
let database_find_dn conn h_pub = let database_find_dn conn h_pub =
let* opt = Pg.find_denom conn h_pub |> unwrap_err_caqti in let* opt = Pg.find_denom conn h_pub |> unwrap_err_caqti in
match opt with match opt with
| None -> Fmt.error "secmod: denomination data not found in database" | None -> Fmt.error "Keys: denomination data not found in database"
| Some dn_data -> Ok dn_data | Some dn_data -> Ok dn_data
let list_to_ht l = Hashtbl.of_seq (List.to_seq l) let list_to_ht l = Hashtbl.of_seq (List.to_seq l)
@ -282,25 +282,24 @@ module Make (Conn : Pg.CONN) = struct
let init () = let init () =
let dir = Config.secmod_dir in let dir = Config.secmod_dir in
let* b = Bos.OS.Dir.create ~mode:0o700 dir |> unwrap_err_msg in let* b = Bos.OS.Dir.create ~mode:0o700 dir |> unwrap_err_msg in
if b then if b then Logs.info (fun m -> m "Keys: created directory `%a`" Fpath.pp dir);
Logs.info (fun m -> m "secmod: created directory `%a`" Fpath.pp dir);
let* l = let* l =
Bos.OS.Dir.contents ~dotfiles:false ~rel:false dir |> unwrap_err_msg Bos.OS.Dir.contents ~dotfiles:false ~rel:false dir |> unwrap_err_msg
in in
match List.is_empty l with match List.is_empty l with
| true -> | true ->
Logs.info (fun m -> m "secmod: empty storage, generating fresh keys"); Logs.info (fun m -> m "Keys: empty storage, generating fresh keys");
let t = make_new () in let t = make_new () in
Ok t Ok t
| false -> | false ->
Logs.info (fun m -> m "secmod: loading keys from storage"); Logs.info (fun m -> m "Keys: loading keys from storage");
load () load ()
let t = let t =
match init () with match init () with
| Error e -> Fmt.failwith "secmod initialization failure: `%s`." e | Error e -> Fmt.failwith "Keys: initialization failure: `%s`." e
| Ok t -> | Ok t ->
Logs.info (fun m -> m "secmod initialized"); Logs.info (fun m -> m "Keys: initialized");
t t
let sm_pubkey = t.sm_pubkey let sm_pubkey = t.sm_pubkey
@ -308,7 +307,7 @@ module Make (Conn : Pg.CONN) = struct
let sign_with_signkey ~pub s = let sign_with_signkey ~pub s =
match Hashtbl.find_opt t.sk_key_ht pub with match Hashtbl.find_opt t.sk_key_ht pub with
| None -> Fmt.failwith "secmod sign_with_signkey failure: not found." | None -> Fmt.failwith "Keys sign_with_signkey failure: not found."
| Some priv -> EddsaSignature.sign ~key:priv s | Some priv -> EddsaSignature.sign ~key:priv s
let verify_with_sm_key s ~msg = EddsaSignature.verify ~key:t.sm_pubkey s ~msg let verify_with_sm_key s ~msg = EddsaSignature.verify ~key:t.sm_pubkey s ~msg
@ -318,7 +317,7 @@ module Make (Conn : Pg.CONN) = struct
let verify_with_signkey ~pub s ~msg = let verify_with_signkey ~pub s ~msg =
match Hashtbl.find_opt t.sk_ht pub with match Hashtbl.find_opt t.sk_ht pub with
| None -> Fmt.failwith "secmod verify_with_signkey failure: not found." | None -> Fmt.failwith "Keys verify_with_signkey failure: not found."
| Some _sk -> EddsaSignature.verify ~key:pub s ~msg | Some _sk -> EddsaSignature.verify ~key:pub s ~msg
let get_signkeys () = t.sk_ht |> Hashtbl.to_seq_values |> List.of_seq let get_signkeys () = t.sk_ht |> Hashtbl.to_seq_values |> List.of_seq
@ -341,10 +340,10 @@ module Make (Conn : Pg.CONN) = struct
Hashtbl.find_opt t.future_sk_key_ht pub ) Hashtbl.find_opt t.future_sk_key_ht pub )
with with
| None, _ | _, None -> | None, _ | _, None ->
Error "secmod certify_future_signkey: future signkey not found." Error "Keys certify_future_signkey: future signkey not found."
| Some future_sk, Some priv -> ( | Some future_sk, Some priv -> (
match Hashtbl.find_opt t.sk_ht pub with match Hashtbl.find_opt t.sk_ht pub with
| Some _sk -> Error "secmod certify_future_signkey: already certified" | Some _sk -> Error "Keys certify_future_signkey: already certified"
| None -> | None ->
let Api.FutureSignKey. let Api.FutureSignKey.
{ {
@ -381,12 +380,11 @@ module Make (Conn : Pg.CONN) = struct
Hashtbl.find_opt t.future_dn_key_ht h_pub ) Hashtbl.find_opt t.future_dn_key_ht h_pub )
with with
| None, _ | _, None -> | None, _ | _, None ->
Error Error "Keys certify_future_denomination: future denomination not found."
"secmod certify_future_denomination: future denomination not found."
| Some future_dn, Some priv -> ( | Some future_dn, Some priv -> (
match Hashtbl.find_opt t.dn_ht h_pub with match Hashtbl.find_opt t.dn_ht h_pub with
| Some _dn -> | Some _dn ->
Error "secmod certify_future_denomination: already certified" Error "Keys certify_future_denomination: already certified"
| None -> | None ->
let Api.FutureDenom. let Api.FutureDenom.
{ {
@ -439,7 +437,7 @@ module Make (Conn : Pg.CONN) = struct
let revoke_signkey pub revoked_sig = let revoke_signkey pub revoked_sig =
match Hashtbl.find_opt t.sk_ht pub with match Hashtbl.find_opt t.sk_ht pub with
| None -> Error "secmod revoke_signkey: signkey not found." | None -> Error "Keys revoke_signkey: signkey not found."
| Some sk -> | Some sk ->
let sk = { sk with revoked_sig= Some revoked_sig } in let sk = { sk with revoked_sig= Some revoked_sig } in
Hashtbl.replace t.sk_ht pub sk; Hashtbl.replace t.sk_ht pub sk;
@ -449,7 +447,7 @@ module Make (Conn : Pg.CONN) = struct
let revoke_denomination pub revoked_sig = let revoke_denomination pub revoked_sig =
match Hashtbl.find_opt t.dn_ht pub with match Hashtbl.find_opt t.dn_ht pub with
| None -> Error "secmod revoke_denomination: denomination not found." | None -> Error "Keys revoke_denomination: denomination not found."
| Some dn -> | Some dn ->
let dn = { dn with revoked_sig= Some revoked_sig } in let dn = { dn with revoked_sig= Some revoked_sig } in
Hashtbl.replace t.dn_ht pub dn; Hashtbl.replace t.dn_ht pub dn;
@ -470,9 +468,9 @@ module Make (Conn : Pg.CONN) = struct
|> List.of_seq |> List.of_seq
|> list_iter (fun (h_pub, priv) -> |> list_iter (fun (h_pub, priv) ->
match Hashtbl.find_opt t.dn_section_name_ht h_pub with match Hashtbl.find_opt t.dn_section_name_ht h_pub with
| None -> Error "secmod save: invalid state, section_name not found" | None -> Error "Keys save: invalid state, section_name not found"
| Some section_name -> write_rsa (dn_fname section_name) priv) | Some section_name -> write_rsa (dn_fname section_name) priv)
in in
Logs.info (fun m -> m "saved secmod private keys data"); Logs.info (fun m -> m "saved private keys data");
Ok () Ok ()
end end