update readme

This is to avoid the paywall on GNU Taler repository

.gitignore

@@ -1,5 +1,4 @@
 _build
-_dbinit_sql
 vendors
 assets
 keys

GNUmakefile

@@ -1,8 +1,9 @@
 storage=./keys/secmod.fat
 service=tap0
 
-setup-switch:
+switch:
 	opam switch create mte ocaml.5.4.1
+	eval $$(opam env)
 	opam update
 	opam install --yes . --deps-only
 
@@ -10,14 +11,21 @@ vendors: source.sh
 	@mkdir -p vendors
 	@./source.sh
 
-.PHONY: clean
-clean:
-	rm -rf _build/
-	rm -rf vendors/
+assets:
+	@cp -r default/assets ./
+
+build: vendors
+	@dune build @all
+	@dune build --workspace dune-workspace.solo5 src/mte.exe
+
+manifest.json:
+	@dune exec src/mte.exe > src/manifest.json
 
 keys:
 	@mkdir -p keys
 	@dune exec tools/offline.exe -- generate-eddsa-key --output ./keys/master
+
+postgres_password:
 	@read -sp "Enter postgres password: " POSTGRES_PASSWORD; \
 	  echo; \
 	  printf $${POSTGRES_PASSWORD} > ./keys/postgres_password
@@ -25,19 +33,26 @@ keys:
 secmod.fat:
 	mfat make --sectors=2048 $(storage)
 
-assets:
-	@cp -r default/assets ./
-
 config:
 	@sed "s/%%MASTER_PUBLIC_KEY%%/$$(cat ./keys/master.pub)/" -i assets/mte.conf
 
-src/manifest.json:
-	@dune exec src/mte.exe > src/manifest.json
-
-build: vendors
-	@dune build @all
-	@dune build --workspace dune-workspace.solo5 src/mte.exe
-
 run: build
 	@solo5-hvt --block:storage=$(storage) --net:service=$(service) -- ./_build/solo5/src/mte.exe \
 		--postgres-password=$$(cat ./keys/postgres_password)
+
+clean-switch:
+	opam switch remove mte
+
+clean-vendors:
+	rm -rf vendors/
+
+clean-build:
+	rm -rf _build/
+
+clean-assets:
+	rm -rf assets/
+
+clean-keys:
+	rm -rf keys/
+
+clean-all: clean-switch clean-vendors clean-build clean-assets clean-keys

README.md

@@ -60,9 +60,7 @@ To initialize the database use the `tools/dbinit.sh` script, it aggregates toget
 Prepare SQL queries and create the various elements (e.g. sql tables) required to be in the database.
 
 ```
-./tools/dbinit fetch
-./tools/dbinit build
-./tools/dbinit init
+./tools/dbinit.sh init
 ```
 
 ## Dependencies
@@ -72,7 +70,7 @@ MTE use the opam package manager and the dune build system.
 Create a dedicated opam switch, pin libraries to the required version and install them.
 
 ```
-make setup-switch
+make switch
 ```
 
 For compilation to a solo5 unikernel, we also need to "vendor" some libraries.
@@ -83,12 +81,24 @@ make vendors
 
 ## Assets, configuration file and keys
 
-Create a `keys/` folder, generate a fresh master key for the server (and also a file with the required postgres_password to connect to the database).
+Create a `assets/` folder containing default terms of use files and a default configuration file (incomplete).
+
+```
+make assets
+```
+
+Create a `keys/` folder and generate a fresh master key for the server.
 
 ```
 make keys
 ```
 
+Write a `keys/postgres_password` file with the required database password.
+
+```
+make postgres_password
+```
+
 Create `keys/secmod.fat` file that will be the FAT block storage given to MTE.
 MTE will use it to store it's signatures and denominations keys.
 
@@ -96,12 +106,6 @@ MTE will use it to store it's signatures and denominations keys.
 make secmod.fat
 ```
 
-Create a `assets/` folder containing default terms of use files and a default configuration file.
-
-```
-make assets
-```
-
 Complete the configuration file by writing master public key of the server we previously generated into it.
 
 ```
@@ -130,7 +134,7 @@ dune runtest
 This will run tests for various utility functions, binary formats and cryptographic functions.
 It also test that MTE's binary formats and cryptographic signature on the various fields of `/keys` API are consistent with the reference implementation.
 
-It is also possible to run a test scenario of the `/management` API with the `/test/management.sh` script.
+It is also possible to run a test scenario of the `/management` API with the `./test/management.sh` script.
 It uses `mte-offline-tool` executable to produce various keys, signatures and JSON objects used in the `/management` API.
-Note that this script assumes a server is already running at `http://10.0.0.2:3434`, and that it will write changes to the database.
+Note that this script assumes a server is already running on `http://10.0.0.2:3434`, and that it will write changes to the database.
 

_dbinit_sql/drop.sql

@@ -0,0 +1,38 @@
+--
+-- This file is part of TALER
+-- Copyright (C) 2014--2022 Taler Systems SA
+--
+-- TALER is free software; you can redistribute it and/or modify it under the
+-- terms of the GNU General Public License as published by the Free Software
+-- Foundation; either version 3, or (at your option) any later version.
+--
+-- TALER is distributed in the hope that it will be useful, but WITHOUT ANY
+-- WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
+-- A PARTICULAR PURPOSE.  See the GNU General Public License for more details.
+--
+-- You should have received a copy of the GNU General Public License along with
+-- TALER; see the file COPYING.  If not, see <http://www.gnu.org/licenses/>
+--
+
+-- Everything in one big transaction
+BEGIN;
+
+WITH xpatches AS (
+  SELECT patch_name
+  FROM _v.patches
+  WHERE starts_with(patch_name,'exchange-')
+)
+  SELECT _v.unregister_patch(xpatches.patch_name)
+    FROM xpatches;
+
+WITH xpatches AS (
+  SELECT patch_name
+    FROM _v.patches
+   WHERE starts_with(patch_name,'auditor-triggers-')
+)
+  SELECT _v.unregister_patch(xpatches.patch_name)
+    FROM xpatches;
+
+DROP SCHEMA exchange CASCADE;
+
+COMMIT;

ip6tables.rules.example

@@ -0,0 +1,26 @@
+*filter
+:INPUT DROP [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT ACCEPT [0:0]
+:TCP - [0:0]
+:UDP - [0:0]
+-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+-A INPUT -i lo -j ACCEPT
+-A INPUT -m conntrack --ctstate INVALID -j DROP
+
+# for ICMPv6 Neighbor Discovery Protocol
+# (note: need a corresponding line for each directly attached subnet)
+-A INPUT -p ipv6-icmp --icmpv6-type 128 -m conntrack --ctstate NEW -j ACCEPT
+-A INPUT -s fe80::/10 -p ipv6-icmp -j ACCEPT
+
+-A INPUT -p udp -m conntrack --ctstate NEW -j UDP
+-A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j TCP
+-A INPUT -p udp -j REJECT --reject-with icmp6-port-unreachable
+-A INPUT -p tcp -j REJECT --reject-with tcp-reset
+-A INPUT -j REJECT
+
+#  accept incoming connections on UDP port 546, to enable DHCPv6
+-A UDP -p udp --sport 547 --dport 546 -j ACCEPT
+
+
+COMMIT

iptables.rules.example

@@ -0,0 +1,23 @@
+*filter
+:INPUT DROP [0:0]
+:FORWARD DROP [0:0]
+:OUTPUT ACCEPT [0:0]
+:TCP - [0:0]
+:UDP - [0:0]
+-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
+-A INPUT -i lo -j ACCEPT
+-A INPUT -m conntrack --ctstate INVALID -j DROP
+-A INPUT -p icmp -m icmp --icmp-type 8 -m conntrack --ctstate NEW -j ACCEPT
+-A INPUT -p udp -m conntrack --ctstate NEW -j UDP
+-A INPUT -p tcp --tcp-flags FIN,SYN,RST,ACK SYN -m conntrack --ctstate NEW -j TCP
+-A INPUT -p udp -j REJECT --reject-with icmp-port-unreachable
+-A INPUT -p tcp -j REJECT --reject-with tcp-reset
+-A INPUT -j REJECT --reject-with icmp-proto-unreachable
+
+-A UDP -p udp --dport 53 -j ACCEPT
+-A TCP -p tcp --dport 53 -j ACCEPT
+-A TCP -p tcp --dport 3434 -j ACCEPT
+-A TCP -p tcp --dport 5432 -j ACCEPT
+
+
+COMMIT

mte.opam

@@ -48,12 +48,16 @@ depends: [
   "caqti-mnet"
   "caqti-driver-pgx"
   "pgx"
+  "mkernel"
+  "utcp"
 ]
 build: [
   [make "build"]
 ]
 pin-depends: [
   [ "zarith.dev" "git+https://github.com/mirage/Zarith.git#df8969d9bb95cffca13e31a615189ab27ada0684" ]
+  [ "mkernel.dev" "git+https://github.com/robur-coop/mkernel.git#v0.0.2" ]
+  [ "utcp.dev" "git+https://github.com/robur-coop/utcp.git#0.0.2" ]
   [ "mnet.dev" "git+https://github.com/robur-coop/mnet.git#v0.0.2" ]
   [ "mnet-tls.dev" "git+https://github.com/robur-coop/mnet.git#v0.0.2" ]
   [ "mnet-happy-eyeballs.dev" "git+https://github.com/robur-coop/mnet.git#v0.0.2" ]

src/dune

@@ -34,7 +34,7 @@
   mirage-ptime.solo5
   mfat
   ;
-  caqti
+  caqti.classic
   caqti-miou
   caqti-mnet
   caqti-driver-pgx
@@ -75,7 +75,7 @@
   fpath
   cohttp
   bin
-  caqti
+  caqti.classic
   jsont
   jsont.bytesrw
   digestif