mirror of
https://github.com/XRPLF/rippled.git
synced 2025-12-06 17:27:55 +00:00
Dynamize trusted validator list and quorum (RIPD-1220):
Instead of specifying a static list of trusted validators in the config or validators file, the configuration can now include trusted validator list publisher keys. The trusted validator list and quorum are now reset each consensus round using the latest validator lists and the list of recent validations seen. The minimum validation quorum is now only configurable via the command line.
This commit is contained in:
wilsonianb
@@ -1,477 +0,0 @@
|
||||
//------------------------------------------------------------------------------
|
||||
/*
|
||||
This file is part of rippled: https://github.com/ripple/rippled
|
||||
Copyright (c) 2012, 2013 Ripple Labs Inc.
|
||||
|
||||
Permission to use, copy, modify, and/or distribute this software for any
|
||||
purpose with or without fee is hereby granted, provided that the above
|
||||
copyright notice and this permission notice appear in all copies.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
||||
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
||||
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
||||
ANY SPECIAL , DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
||||
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
||||
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
||||
OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
//==============================================================================
|
||||
|
||||
#include <ripple/app/main/Application.h>
|
||||
#include <ripple/basics/contract.h>
|
||||
#include <ripple/basics/Log.h>
|
||||
#include <ripple/app/misc/ValidatorList.h>
|
||||
#include <ripple/core/DatabaseCon.h>
|
||||
#include <ripple/overlay/impl/Manifest.h>
|
||||
#include <ripple/protocol/PublicKey.h>
|
||||
#include <ripple/protocol/Sign.h>
|
||||
#include <boost/regex.hpp>
|
||||
#include <stdexcept>
|
||||
|
||||
namespace ripple {
|
||||
|
||||
boost::optional<Manifest>
|
||||
make_Manifest (std::string s)
|
||||
{
|
||||
try
|
||||
{
|
||||
STObject st (sfGeneric);
|
||||
SerialIter sit (s.data (), s.size ());
|
||||
st.set (sit);
|
||||
auto const opt_pk = get<PublicKey>(st, sfPublicKey);
|
||||
auto const opt_spk = get<PublicKey>(st, sfSigningPubKey);
|
||||
auto const opt_seq = get (st, sfSequence);
|
||||
auto const opt_sig = get (st, sfSignature);
|
||||
auto const opt_msig = get (st, sfMasterSignature);
|
||||
if (!opt_pk || !opt_spk || !opt_seq || !opt_sig || !opt_msig)
|
||||
{
|
||||
return boost::none;
|
||||
}
|
||||
return Manifest (std::move (s), *opt_pk, *opt_spk, *opt_seq);
|
||||
}
|
||||
catch (std::exception const&)
|
||||
{
|
||||
return boost::none;
|
||||
}
|
||||
}
|
||||
|
||||
template<class Stream>
|
||||
Stream&
|
||||
logMftAct (
|
||||
Stream& s,
|
||||
std::string const& action,
|
||||
PublicKey const& pk,
|
||||
std::uint32_t seq)
|
||||
{
|
||||
s << "Manifest: " << action <<
|
||||
";Pk: " << toBase58 (TokenType::TOKEN_NODE_PUBLIC, pk) <<
|
||||
";Seq: " << seq << ";";
|
||||
return s;
|
||||
}
|
||||
|
||||
template<class Stream>
|
||||
Stream& logMftAct (
|
||||
Stream& s,
|
||||
std::string const& action,
|
||||
PublicKey const& pk,
|
||||
std::uint32_t seq,
|
||||
std::uint32_t oldSeq)
|
||||
{
|
||||
s << "Manifest: " << action <<
|
||||
";Pk: " << toBase58 (TokenType::TOKEN_NODE_PUBLIC, pk) <<
|
||||
";Seq: " << seq <<
|
||||
";OldSeq: " << oldSeq << ";";
|
||||
return s;
|
||||
}
|
||||
|
||||
Manifest::Manifest (std::string s,
|
||||
PublicKey pk,
|
||||
PublicKey spk,
|
||||
std::uint32_t seq)
|
||||
: serialized (std::move (s))
|
||||
, masterKey (std::move (pk))
|
||||
, signingKey (std::move (spk))
|
||||
, sequence (seq)
|
||||
{
|
||||
}
|
||||
|
||||
bool Manifest::verify () const
|
||||
{
|
||||
STObject st (sfGeneric);
|
||||
SerialIter sit (serialized.data (), serialized.size ());
|
||||
st.set (sit);
|
||||
if (! ripple::verify (st, HashPrefix::manifest, signingKey))
|
||||
return false;
|
||||
|
||||
return ripple::verify (
|
||||
st, HashPrefix::manifest, masterKey, sfMasterSignature);
|
||||
}
|
||||
|
||||
uint256 Manifest::hash () const
|
||||
{
|
||||
STObject st (sfGeneric);
|
||||
SerialIter sit (serialized.data (), serialized.size ());
|
||||
st.set (sit);
|
||||
return st.getHash (HashPrefix::manifest);
|
||||
}
|
||||
|
||||
bool Manifest::revoked () const
|
||||
{
|
||||
/*
|
||||
The maximum possible sequence number means that the master key
|
||||
has been revoked.
|
||||
*/
|
||||
return sequence == std::numeric_limits<std::uint32_t>::max ();
|
||||
}
|
||||
|
||||
Blob Manifest::getSignature () const
|
||||
{
|
||||
STObject st (sfGeneric);
|
||||
SerialIter sit (serialized.data (), serialized.size ());
|
||||
st.set (sit);
|
||||
return st.getFieldVL (sfSignature);
|
||||
}
|
||||
|
||||
Blob Manifest::getMasterSignature () const
|
||||
{
|
||||
STObject st (sfGeneric);
|
||||
SerialIter sit (serialized.data (), serialized.size ());
|
||||
st.set (sit);
|
||||
return st.getFieldVL (sfMasterSignature);
|
||||
}
|
||||
|
||||
bool
|
||||
ManifestCache::loadValidatorKeys(
|
||||
Section const& keys,
|
||||
beast::Journal journal)
|
||||
{
|
||||
static boost::regex const re (
|
||||
"[[:space:]]*" // skip leading whitespace
|
||||
"([[:alnum:]]+)" // node identity
|
||||
"(?:" // begin optional comment block
|
||||
"[[:space:]]+" // (skip all leading whitespace)
|
||||
"(?:" // begin optional comment
|
||||
"(.*[^[:space:]]+)" // the comment
|
||||
"[[:space:]]*" // (skip all trailing whitespace)
|
||||
")?" // end optional comment
|
||||
")?" // end optional comment block
|
||||
);
|
||||
|
||||
JLOG (journal.debug()) <<
|
||||
"Loading configured validator keys";
|
||||
|
||||
std::size_t count = 0;
|
||||
|
||||
for (auto const& line : keys.lines())
|
||||
{
|
||||
boost::smatch match;
|
||||
|
||||
if (!boost::regex_match (line, match, re))
|
||||
{
|
||||
JLOG (journal.error()) <<
|
||||
"Malformed entry: '" << line << "'";
|
||||
return false;
|
||||
}
|
||||
|
||||
auto const key = parseBase58<PublicKey>(
|
||||
TokenType::TOKEN_NODE_PUBLIC, match[1]);
|
||||
|
||||
if (!key)
|
||||
{
|
||||
JLOG (journal.error()) <<
|
||||
"Error decoding validator key: " << match[1];
|
||||
return false;
|
||||
}
|
||||
|
||||
if (publicKeyType(*key) != KeyType::ed25519)
|
||||
{
|
||||
JLOG (journal.error()) <<
|
||||
"Validator key not using Ed25519: " << match[1];
|
||||
return false;
|
||||
}
|
||||
|
||||
JLOG (journal.debug()) << "Loaded key: " << match[1];
|
||||
|
||||
addTrustedKey (*key, match[2]);
|
||||
++count;
|
||||
}
|
||||
|
||||
JLOG (journal.debug()) <<
|
||||
"Loaded " << count << " entries";
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
void
|
||||
ManifestCache::configManifest (
|
||||
Manifest m, ValidatorList& unl, beast::Journal journal)
|
||||
{
|
||||
if (! m.verify())
|
||||
{
|
||||
Throw<std::runtime_error> ("Unverifiable manifest in config");
|
||||
}
|
||||
|
||||
// Trust our own master public key
|
||||
if (!trusted(m.masterKey) && !unl.trusted (m.masterKey))
|
||||
{
|
||||
addTrustedKey (m.masterKey, "");
|
||||
}
|
||||
|
||||
auto const result = applyManifest (std::move(m), unl, journal);
|
||||
|
||||
if (result != ManifestDisposition::accepted)
|
||||
{
|
||||
Throw<std::runtime_error> ("Our own validation manifest was not accepted");
|
||||
}
|
||||
}
|
||||
|
||||
bool
|
||||
ManifestCache::trusted (PublicKey const& identity) const
|
||||
{
|
||||
return map_.count(identity);
|
||||
}
|
||||
|
||||
void
|
||||
ManifestCache::addTrustedKey (PublicKey const& pk, std::string comment)
|
||||
{
|
||||
std::lock_guard<std::mutex> lock (mutex_);
|
||||
|
||||
auto& value = map_[pk];
|
||||
|
||||
if (value.m)
|
||||
{
|
||||
Throw<std::runtime_error> (
|
||||
"New trusted validator key already has a manifest");
|
||||
}
|
||||
|
||||
value.comment = std::move(comment);
|
||||
}
|
||||
|
||||
std::size_t
|
||||
ManifestCache::size () const
|
||||
{
|
||||
std::lock_guard <std::mutex> lock (mutex_);
|
||||
return map_.size ();
|
||||
}
|
||||
|
||||
ManifestDisposition
|
||||
ManifestCache::canApply (PublicKey const& pk, std::uint32_t seq,
|
||||
beast::Journal journal) const
|
||||
{
|
||||
auto const iter = map_.find(pk);
|
||||
|
||||
if (iter == map_.end())
|
||||
{
|
||||
/*
|
||||
A manifest was received whose master key we don't trust.
|
||||
Since rippled always sends all of its current manifests,
|
||||
this will happen normally any time a peer connects.
|
||||
*/
|
||||
if (auto stream = journal.debug())
|
||||
logMftAct(stream, "Untrusted", pk, seq);
|
||||
return ManifestDisposition::untrusted;
|
||||
}
|
||||
|
||||
auto& old = iter->second.m;
|
||||
|
||||
if (old && seq <= old->sequence)
|
||||
{
|
||||
/*
|
||||
A manifest was received for a validator we're tracking, but
|
||||
its sequence number is no higher than the one already stored.
|
||||
This will happen normally when a peer without the latest gossip
|
||||
connects.
|
||||
*/
|
||||
if (auto stream = journal.debug())
|
||||
logMftAct(stream, "Stale", pk, seq, old->sequence);
|
||||
return ManifestDisposition::stale; // not a newer manifest, ignore
|
||||
}
|
||||
|
||||
return ManifestDisposition::accepted;
|
||||
}
|
||||
|
||||
|
||||
ManifestDisposition
|
||||
ManifestCache::applyManifest (
|
||||
Manifest m, ValidatorList& unl, beast::Journal journal)
|
||||
{
|
||||
/*
|
||||
Move master public key from permanent trusted key list
|
||||
to manifest cache.
|
||||
*/
|
||||
if (auto unlComment = unl.member (m.masterKey))
|
||||
{
|
||||
addTrustedKey (m.masterKey, *unlComment);
|
||||
unl.removePermanentKey (m.masterKey);
|
||||
}
|
||||
|
||||
{
|
||||
std::lock_guard<std::mutex> lock (mutex_);
|
||||
|
||||
/*
|
||||
before we spend time checking the signature, make sure we trust the
|
||||
master key and the sequence number is newer than any we have.
|
||||
*/
|
||||
auto const chk = canApply(m.masterKey, m.sequence, journal);
|
||||
|
||||
if (chk != ManifestDisposition::accepted)
|
||||
{
|
||||
return chk;
|
||||
}
|
||||
}
|
||||
|
||||
if (! m.verify())
|
||||
{
|
||||
/*
|
||||
A manifest's signature is invalid.
|
||||
This shouldn't happen normally.
|
||||
*/
|
||||
if (auto stream = journal.warn())
|
||||
logMftAct(stream, "Invalid", m.masterKey, m.sequence);
|
||||
return ManifestDisposition::invalid;
|
||||
}
|
||||
|
||||
std::lock_guard<std::mutex> lock (mutex_);
|
||||
|
||||
/*
|
||||
We released the lock above, so we have to check again, in case
|
||||
another thread accepted a newer manifest.
|
||||
*/
|
||||
auto const chk = canApply(m.masterKey, m.sequence, journal);
|
||||
|
||||
if (chk != ManifestDisposition::accepted)
|
||||
{
|
||||
return chk;
|
||||
}
|
||||
|
||||
auto const iter = map_.find(m.masterKey);
|
||||
|
||||
auto& old = iter->second.m;
|
||||
|
||||
if (! old)
|
||||
{
|
||||
/*
|
||||
This is the first received manifest for a trusted master key
|
||||
(possibly our own). This only happens once per validator per
|
||||
run (and possibly not at all, if there's an obsolete entry in
|
||||
[validator_keys] for a validator that no longer exists).
|
||||
*/
|
||||
if (auto stream = journal.info())
|
||||
logMftAct(stream, "AcceptedNew", m.masterKey, m.sequence);
|
||||
}
|
||||
else
|
||||
{
|
||||
if (m.revoked ())
|
||||
{
|
||||
/*
|
||||
The MASTER key for this validator was revoked. This is
|
||||
expected, but should happen at most *very* rarely.
|
||||
*/
|
||||
if (auto stream = journal.info())
|
||||
logMftAct(stream, "Revoked",
|
||||
m.masterKey, m.sequence, old->sequence);
|
||||
}
|
||||
else
|
||||
{
|
||||
/*
|
||||
An ephemeral key was revoked and superseded by a new key.
|
||||
This is expected, but should happen infrequently.
|
||||
*/
|
||||
if (auto stream = journal.info())
|
||||
logMftAct(stream, "AcceptedUpdate",
|
||||
m.masterKey, m.sequence, old->sequence);
|
||||
}
|
||||
|
||||
unl.removeEphemeralKey (old->signingKey);
|
||||
}
|
||||
|
||||
if (m.revoked ())
|
||||
{
|
||||
// The master key is revoked -- don't insert the signing key
|
||||
if (auto stream = journal.warn())
|
||||
logMftAct(stream, "Revoked", m.masterKey, m.sequence);
|
||||
|
||||
/*
|
||||
A validator master key has been compromised, so its manifests
|
||||
are now untrustworthy. In order to prevent us from accepting
|
||||
a forged manifest signed by the compromised master key, store
|
||||
this manifest, which has the highest possible sequence number
|
||||
and therefore can't be superseded by a forged one.
|
||||
*/
|
||||
}
|
||||
else
|
||||
{
|
||||
unl.insertEphemeralKey (m.signingKey, iter->second.comment);
|
||||
}
|
||||
|
||||
old = std::move(m);
|
||||
|
||||
return ManifestDisposition::accepted;
|
||||
}
|
||||
|
||||
void ManifestCache::load (
|
||||
DatabaseCon& dbCon, ValidatorList& unl, beast::Journal journal)
|
||||
{
|
||||
static const char* const sql =
|
||||
"SELECT RawData FROM ValidatorManifests;";
|
||||
auto db = dbCon.checkoutDb ();
|
||||
soci::blob sociRawData (*db);
|
||||
soci::statement st =
|
||||
(db->prepare << sql,
|
||||
soci::into (sociRawData));
|
||||
st.execute ();
|
||||
while (st.fetch ())
|
||||
{
|
||||
std::string serialized;
|
||||
convert (sociRawData, serialized);
|
||||
if (auto mo = make_Manifest (std::move (serialized)))
|
||||
{
|
||||
if (!mo->verify())
|
||||
{
|
||||
JLOG(journal.warn())
|
||||
<< "Unverifiable manifest in db";
|
||||
continue;
|
||||
}
|
||||
|
||||
if (trusted(mo->masterKey) || unl.trusted(mo->masterKey))
|
||||
{
|
||||
applyManifest (std::move(*mo), unl, journal);
|
||||
}
|
||||
else
|
||||
{
|
||||
JLOG(journal.info())
|
||||
<< "Manifest in db is no longer trusted";
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
JLOG(journal.warn())
|
||||
<< "Malformed manifest in database";
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
void ManifestCache::save (DatabaseCon& dbCon) const
|
||||
{
|
||||
auto db = dbCon.checkoutDb ();
|
||||
|
||||
soci::transaction tr(*db);
|
||||
*db << "DELETE FROM ValidatorManifests";
|
||||
static const char* const sql =
|
||||
"INSERT INTO ValidatorManifests (RawData) VALUES (:rawData);";
|
||||
for (auto const& v : map_)
|
||||
{
|
||||
if (!v.second.m)
|
||||
continue;
|
||||
|
||||
// soci does not support bulk insertion of blob data
|
||||
// Do not reuse blob because manifest ecdsa signatures vary in length
|
||||
// but blob write length is expected to be >= the last write
|
||||
soci::blob rawData(*db);
|
||||
convert (v.second.m->serialized, rawData);
|
||||
*db << sql,
|
||||
soci::use (rawData);
|
||||
}
|
||||
tr.commit ();
|
||||
}
|
||||
}
|
||||
@@ -1,227 +0,0 @@
|
||||
//------------------------------------------------------------------------------
|
||||
/*
|
||||
This file is part of rippled: https://github.com/ripple/rippled
|
||||
Copyright (c) 2012, 2013 Ripple Labs Inc.
|
||||
|
||||
Permission to use, copy, modify, and/or distribute this software for any
|
||||
purpose with or without fee is hereby granted, provided that the above
|
||||
copyright notice and this permission notice appear in all copies.
|
||||
|
||||
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
||||
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
||||
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
||||
ANY SPECIAL , DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
||||
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
||||
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
||||
OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
||||
*/
|
||||
//==============================================================================
|
||||
|
||||
#ifndef RIPPLE_OVERLAY_MANIFEST_H_INCLUDED
|
||||
#define RIPPLE_OVERLAY_MANIFEST_H_INCLUDED
|
||||
|
||||
#include <ripple/app/misc/ValidatorList.h>
|
||||
#include <ripple/basics/BasicConfig.h>
|
||||
#include <ripple/basics/UnorderedContainers.h>
|
||||
#include <ripple/protocol/PublicKey.h>
|
||||
#include <ripple/protocol/STExchange.h>
|
||||
#include <ripple/beast/utility/Journal.h>
|
||||
#include <boost/optional.hpp>
|
||||
#include <string>
|
||||
|
||||
namespace ripple {
|
||||
|
||||
/*
|
||||
Validator key manifests
|
||||
-----------------------
|
||||
|
||||
Suppose the secret keys installed on a Ripple validator are compromised. Not
|
||||
only do you have to generate and install new key pairs on each validator,
|
||||
EVERY rippled needs to have its config updated with the new public keys, and
|
||||
is vulnerable to forged validation signatures until this is done. The
|
||||
solution is a new layer of indirection: A master secret key under
|
||||
restrictive access control is used to sign a "manifest": essentially, a
|
||||
certificate including the master public key, an ephemeral public key for
|
||||
verifying validations (which will be signed by its secret counterpart), a
|
||||
sequence number, and a digital signature.
|
||||
|
||||
The manifest has two serialized forms: one which includes the digital
|
||||
signature and one which doesn't. There is an obvious causal dependency
|
||||
relationship between the (latter) form with no signature, the signature
|
||||
of that form, and the (former) form which includes that signature. In
|
||||
other words, a message can't contain a signature of itself. The code
|
||||
below stores a serialized manifest which includes the signature, and
|
||||
dynamically generates the signatureless form when it needs to verify
|
||||
the signature.
|
||||
|
||||
There are two stores of information within rippled related to manifests.
|
||||
An instance of ManifestCache stores, for each trusted validator, (a) its
|
||||
master public key, and (b) the most senior of all valid manifests it has
|
||||
seen for that validator, if any. On startup, the [validator_keys] config
|
||||
entries are used to prime the manifest cache with the trusted master keys.
|
||||
At this point, the manifest cache has all the entries it will ever have,
|
||||
but none of them have manifests. The [validation_manifest] config entry
|
||||
(which is the manifest for this validator) is then decoded and added to
|
||||
the manifest cache. Other manifests are added as "gossip" is received
|
||||
from rippled peers.
|
||||
|
||||
The other data store (which does not involve manifests per se) contains
|
||||
the set of active ephemeral validator keys. Keys are added to the set
|
||||
when a manifest is accepted, and removed when that manifest is obsoleted.
|
||||
|
||||
When an ephemeral key is compromised, a new signing key pair is created,
|
||||
along with a new manifest vouching for it (with a higher sequence number),
|
||||
signed by the master key. When a rippled peer receives the new manifest,
|
||||
it verifies it with the master key and (assuming it's valid) discards the
|
||||
old ephemeral key and stores the new one. If the master key itself gets
|
||||
compromised, a manifest with sequence number 0xFFFFFFFF will supersede a
|
||||
prior manifest and discard any existing ephemeral key without storing a
|
||||
new one. Since no further manifests for this master key will be accepted
|
||||
(since no higher sequence number is possible), and no signing key is on
|
||||
record, no validations will be accepted from the compromised validator.
|
||||
*/
|
||||
|
||||
//------------------------------------------------------------------------------
|
||||
|
||||
struct Manifest
|
||||
{
|
||||
static std::size_t constexpr textLength = 288;
|
||||
|
||||
std::string serialized;
|
||||
PublicKey masterKey;
|
||||
PublicKey signingKey;
|
||||
std::uint32_t sequence;
|
||||
|
||||
Manifest(std::string s, PublicKey pk, PublicKey spk, std::uint32_t seq);
|
||||
|
||||
Manifest(Manifest&& other) = default;
|
||||
Manifest& operator=(Manifest&& other) = default;
|
||||
|
||||
bool verify () const;
|
||||
uint256 hash () const;
|
||||
bool revoked () const;
|
||||
Blob getSignature () const;
|
||||
|
||||
/// Returns manifest master key signature
|
||||
Blob getMasterSignature () const;
|
||||
};
|
||||
|
||||
boost::optional<Manifest> make_Manifest(std::string s);
|
||||
|
||||
inline bool operator==(Manifest const& lhs, Manifest const& rhs)
|
||||
{
|
||||
return lhs.serialized == rhs.serialized && lhs.masterKey == rhs.masterKey &&
|
||||
lhs.signingKey == rhs.signingKey && lhs.sequence == rhs.sequence;
|
||||
}
|
||||
|
||||
inline bool operator!=(Manifest const& lhs, Manifest const& rhs)
|
||||
{
|
||||
return !(lhs == rhs);
|
||||
}
|
||||
|
||||
enum class ManifestDisposition
|
||||
{
|
||||
accepted = 0, // everything checked out
|
||||
|
||||
untrusted, // manifest declares a master key we don't trust
|
||||
stale, // trusted master key, but seq is too old
|
||||
invalid, // trusted and timely, but invalid signature
|
||||
};
|
||||
|
||||
class DatabaseCon;
|
||||
/** Remembers manifests with the highest sequence number. */
|
||||
class ManifestCache
|
||||
{
|
||||
private:
|
||||
struct MappedType
|
||||
{
|
||||
MappedType() = default;
|
||||
MappedType(MappedType&&) = default;
|
||||
MappedType& operator=(MappedType&&) = default;
|
||||
|
||||
MappedType(std::string comment,
|
||||
std::string serialized,
|
||||
PublicKey pk, PublicKey spk, std::uint32_t seq)
|
||||
:comment (std::move(comment))
|
||||
{
|
||||
m.emplace (std::move(serialized), std::move(pk), std::move(spk),
|
||||
seq);
|
||||
}
|
||||
|
||||
std::string comment;
|
||||
boost::optional<Manifest> m;
|
||||
};
|
||||
|
||||
using MapType = hash_map<PublicKey, MappedType>;
|
||||
|
||||
mutable std::mutex mutex_;
|
||||
MapType map_;
|
||||
|
||||
ManifestDisposition
|
||||
canApply (PublicKey const& pk, std::uint32_t seq,
|
||||
beast::Journal journal) const;
|
||||
|
||||
public:
|
||||
ManifestCache() = default;
|
||||
ManifestCache (ManifestCache const&) = delete;
|
||||
ManifestCache& operator= (ManifestCache const&) = delete;
|
||||
~ManifestCache() = default;
|
||||
|
||||
bool loadValidatorKeys(
|
||||
Section const& keys,
|
||||
beast::Journal journal);
|
||||
|
||||
void configManifest (Manifest m, ValidatorList& unl, beast::Journal journal);
|
||||
|
||||
/** Determines whether a node is in the trusted master key list */
|
||||
bool
|
||||
trusted (
|
||||
PublicKey const& identity) const;
|
||||
|
||||
void addTrustedKey (PublicKey const& pk, std::string comment);
|
||||
|
||||
/** The number of installed trusted master keys */
|
||||
std::size_t
|
||||
size () const;
|
||||
|
||||
ManifestDisposition
|
||||
applyManifest (
|
||||
Manifest m, ValidatorList& unl, beast::Journal journal);
|
||||
|
||||
void load (
|
||||
DatabaseCon& dbCon, ValidatorList& unl, beast::Journal journal);
|
||||
void save (DatabaseCon& dbCon) const;
|
||||
|
||||
// A "for_each" for populated manifests only
|
||||
template <class Function>
|
||||
void
|
||||
for_each_manifest(Function&& f) const
|
||||
{
|
||||
std::lock_guard<std::mutex> lock (mutex_);
|
||||
for (auto const& e : map_)
|
||||
{
|
||||
if (auto const& m = e.second.m)
|
||||
f(*m);
|
||||
}
|
||||
}
|
||||
|
||||
// A "for_each" for populated manifests only
|
||||
// The PreFun is called with the maximum number of
|
||||
// times EachFun will be called (useful for memory allocations)
|
||||
template <class PreFun, class EachFun>
|
||||
void
|
||||
for_each_manifest(PreFun&& pf, EachFun&& f) const
|
||||
{
|
||||
std::lock_guard<std::mutex> lock (mutex_);
|
||||
pf(map_.size ());
|
||||
for (auto const& e : map_)
|
||||
{
|
||||
if (auto const& m = e.second.m)
|
||||
f(*m);
|
||||
}
|
||||
}
|
||||
};
|
||||
|
||||
} // ripple
|
||||
|
||||
#endif
|
||||
@@ -20,7 +20,7 @@
|
||||
#include <BeastConfig.h>
|
||||
#include <ripple/app/misc/HashRouter.h>
|
||||
#include <ripple/app/misc/NetworkOPs.h>
|
||||
#include <ripple/core/ConfigSections.h>
|
||||
#include <ripple/app/misc/ValidatorList.h>
|
||||
#include <ripple/core/DatabaseCon.h>
|
||||
#include <ripple/basics/contract.h>
|
||||
#include <ripple/basics/Log.h>
|
||||
@@ -479,57 +479,6 @@ OverlayImpl::checkStopped ()
|
||||
stopped();
|
||||
}
|
||||
|
||||
void
|
||||
OverlayImpl::setupValidatorKeyManifests (BasicConfig const& config,
|
||||
DatabaseCon& db)
|
||||
{
|
||||
auto const loaded = manifestCache_.loadValidatorKeys (
|
||||
config.section (SECTION_VALIDATOR_KEYS),
|
||||
journal_);
|
||||
|
||||
if (!loaded)
|
||||
Throw<std::runtime_error> (
|
||||
"Unable to load keys from [" SECTION_VALIDATOR_KEYS "]");
|
||||
|
||||
auto const& validation_manifest =
|
||||
config.section (SECTION_VALIDATION_MANIFEST);
|
||||
|
||||
if (! validation_manifest.lines().empty())
|
||||
{
|
||||
std::string s;
|
||||
s.reserve (Manifest::textLength);
|
||||
for (auto const& line : validation_manifest.lines())
|
||||
s += beast::rfc2616::trim(line);
|
||||
if (auto mo = make_Manifest (beast::detail::base64_decode(s)))
|
||||
{
|
||||
manifestCache_.configManifest (
|
||||
std::move (*mo),
|
||||
app_.validators(),
|
||||
journal_);
|
||||
}
|
||||
else
|
||||
{
|
||||
Throw<std::runtime_error> ("Malformed manifest in config");
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
JLOG(journal_.debug()) << "No [" SECTION_VALIDATION_MANIFEST <<
|
||||
"] section in config";
|
||||
}
|
||||
|
||||
manifestCache_.load (
|
||||
db,
|
||||
app_.validators(),
|
||||
journal_);
|
||||
}
|
||||
|
||||
void
|
||||
OverlayImpl::saveValidatorKeyManifests (DatabaseCon& db) const
|
||||
{
|
||||
manifestCache_.save (db);
|
||||
}
|
||||
|
||||
void
|
||||
OverlayImpl::onPrepare()
|
||||
{
|
||||
@@ -713,21 +662,29 @@ OverlayImpl::onManifests (
|
||||
{
|
||||
auto& s = m->list ().Get (i).stobject ();
|
||||
|
||||
if (auto mo = make_Manifest (s))
|
||||
if (auto mo = Manifest::make_Manifest (s))
|
||||
{
|
||||
uint256 const hash = mo->hash ();
|
||||
if (!hashRouter.addSuppressionPeer (hash, from->id ()))
|
||||
continue;
|
||||
|
||||
auto const serialized = mo->serialized;
|
||||
auto const result = manifestCache_.applyManifest (
|
||||
std::move(*mo),
|
||||
app_.validators(),
|
||||
journal);
|
||||
if (! app_.validators().listed (mo->masterKey))
|
||||
{
|
||||
JLOG(journal.info()) << "Untrusted manifest #" << i + 1;
|
||||
app_.getOPs().pubManifest (*mo);
|
||||
continue;
|
||||
}
|
||||
|
||||
if (result == ManifestDisposition::accepted ||
|
||||
result == ManifestDisposition::untrusted)
|
||||
app_.getOPs().pubManifest (*make_Manifest(serialized));
|
||||
auto const serialized = mo->serialized;
|
||||
|
||||
auto const result = app_.validatorManifests ().applyManifest (
|
||||
std::move(*mo));
|
||||
|
||||
if (result == ManifestDisposition::accepted)
|
||||
{
|
||||
app_.getOPs().pubManifest (
|
||||
*Manifest::make_Manifest(serialized));
|
||||
}
|
||||
|
||||
if (result == ManifestDisposition::accepted)
|
||||
{
|
||||
|
||||
@@ -23,7 +23,6 @@
|
||||
#include <ripple/app/main/Application.h>
|
||||
#include <ripple/core/Job.h>
|
||||
#include <ripple/overlay/Overlay.h>
|
||||
#include <ripple/overlay/impl/Manifest.h>
|
||||
#include <ripple/overlay/impl/TrafficCount.h>
|
||||
#include <ripple/server/Handoff.h>
|
||||
#include <ripple/rpc/ServerHandler.h>
|
||||
@@ -118,7 +117,6 @@ private:
|
||||
hash_map<Peer::id_t, std::weak_ptr<PeerImp>> ids_;
|
||||
Resolver& m_resolver;
|
||||
std::atomic <Peer::id_t> next_id_;
|
||||
ManifestCache manifestCache_;
|
||||
int timer_count_;
|
||||
|
||||
//--------------------------------------------------------------------------
|
||||
@@ -152,12 +150,6 @@ public:
|
||||
return serverHandler_;
|
||||
}
|
||||
|
||||
ManifestCache const&
|
||||
manifestCache() const
|
||||
{
|
||||
return manifestCache_;
|
||||
}
|
||||
|
||||
Setup const&
|
||||
setup() const
|
||||
{
|
||||
@@ -195,15 +187,6 @@ public:
|
||||
relay (protocol::TMValidation& m,
|
||||
uint256 const& uid) override;
|
||||
|
||||
virtual
|
||||
void
|
||||
setupValidatorKeyManifests (BasicConfig const& config,
|
||||
DatabaseCon& db) override;
|
||||
|
||||
virtual
|
||||
void
|
||||
saveValidatorKeyManifests (DatabaseCon& db) const override;
|
||||
|
||||
//--------------------------------------------------------------------------
|
||||
//
|
||||
// OverlayImpl
|
||||
|
||||
@@ -703,8 +703,8 @@ PeerImp::doProtocolStart()
|
||||
|
||||
protocol::TMManifests tm;
|
||||
|
||||
overlay_.manifestCache ().for_each_manifest (
|
||||
[&tm](size_t s){tm.mutable_list()->Reserve(s);},
|
||||
app_.validatorManifests ().for_each_manifest (
|
||||
[&tm](std::size_t s){tm.mutable_list()->Reserve(s);},
|
||||
[&tm](Manifest const& manifest)
|
||||
{
|
||||
auto const& s = manifest.serialized;
|
||||
|
||||
Reference in New Issue
Block a user