swrup/mte
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

fix check for replay attack + revoke 1sec in the future

Browse source
This commit is contained in:
swrup 2026-02-26 17:52:30 +01:00
parent 30d500fe7d
commit 92fa4e12a4
4 changed files with 66 additions and 46 deletions
Download patch file Download diff file Expand all files Collapse all files

77
src/http_management.ml
View file

@ -165,8 +165,7 @@ module Auditors = struct
()
| Some auditor ->
if Timestamp.geq auditor.last_change validity_start then
Error
"database has more recent auditor data for this auditor public key"
Error "replay attack on enable-auditor"
else
let+ () = Pg.update_auditor db_conn auditor |> unwrap_err_caqti in
Logs.info (fun m -> m "updated auditor");
@ -200,27 +199,22 @@ module Auditors_disable = struct
match opt with
| None -> Error "auditor not found"
| Some auditor -> (
match Timestamp.geq auditor.last_change validity_end with
| true ->
Error
"database has more recent auditor data for this auditor public \
key"
| false -> (
match auditor.is_active with
| false ->
Logs.info (fun m -> m "auditor was already revoked");
Ok ()
| true ->
let auditor =
{ auditor with last_change= validity_end; is_active= false }
in
let+ () =
Pg.update_auditor db_conn auditor |> unwrap_err_caqti
in
Logs.info (fun m ->
m "revoked auditor `%s`"
(Crypto.EddsaPublicKey.to_b32 auditor_pub));
()))
if Timestamp.geq auditor.last_change validity_end then
Error "replay attack on disable-auditor"
else
match auditor.is_active with
| false ->
Logs.info (fun m -> m "auditor was already revoked");
Ok ()
| true ->
let auditor =
{ auditor with last_change= validity_end; is_active= false }
in
let+ () = Pg.update_auditor db_conn auditor |> unwrap_err_caqti in
Logs.info (fun m ->
m "revoked auditor `%s`"
(Crypto.EddsaPublicKey.to_b32 auditor_pub));
())
let jsont = AuditorTeardownMessage.jsont
@ -436,14 +430,6 @@ module Wire = struct
} =
let* opt = Pg.find_wire db_conn ~payto_uri |> unwrap_err_caqti in
match opt with
| Some wire ->
let+ () =
Pg.update_wire db_conn ~is_active:true ~last_change:validity_start
wire
|> unwrap_err_caqti
in
Logs.info (fun m -> m "updated wire method");
()
| None ->
let wire =
ExchangeWireAccount.
@ -464,6 +450,17 @@ module Wire = struct
in
Logs.info (fun m -> m "added wire method");
()
| Some (wire, _is_active, last_change) ->
if Timestamp.geq last_change validity_start then
Error "replay attack on enable-wire"
else
let+ () =
Pg.update_wire db_conn ~is_active:true ~last_change:validity_start
wire
|> unwrap_err_caqti
in
Logs.info (fun m -> m "updated wire method");
()
let jsont = WireSetupMessage.jsont
@ -492,13 +489,17 @@ module Wire_disable = struct
let* opt = Pg.find_wire db_conn ~payto_uri |> unwrap_err_caqti in
match opt with
| None -> Error "wire not found"
| Some wire ->
let+ () =
Pg.update_wire db_conn ~is_active:false ~last_change:validity_end wire
|> unwrap_err_caqti
in
Logs.info (fun m -> m "disabled wire method");
()
| Some (wire, _is_active, last_change) ->
if Timestamp.geq last_change validity_end then
Error "replay attack on disable-wire"
else
let+ () =
Pg.update_wire db_conn ~is_active:false ~last_change:validity_end
wire
|> unwrap_err_caqti
in
Logs.info (fun m -> m "disabled wire method");
()
let jsont = WireTeardownMessage.jsont