Skip to content
This repository was archived by the owner on Aug 2, 2022. It is now read-only.

Consolidated Security Fixes for 2.0.3. #8643

Merged
jeffreyssmith2nd merged 1 commit into from
Feb 13, 2020
Merged

Consolidated Security Fixes for 2.0.3. #8643

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
49 changes: 38 additions & 11 deletions libraries/chain/abi_serializer.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,24 +25,51 @@ namespace eosio { namespace chain {
return fc::variant(temp);
}

template <typename T>
inline fc::variant variant_from_stream(fc::datastream<const char*>& stream, const fc::time_point& deadline) {
T temp;
fc::raw::unpack( stream, temp );
FC_CHECK_DEADLINE(deadline);
return fc::variant( temp, deadline );
}

template <typename T>
auto pack_function() {
return []( const fc::variant& var, fc::datastream<char*>& ds, bool is_array, bool is_optional, const fc::time_point& deadline ){
if( is_array )
fc::raw::pack( ds, var.as<vector<T>>() );
else if ( is_optional )
fc::raw::pack( ds, var.as<optional<T>>() );
else
fc::raw::pack( ds, var.as<T>());
};
}

template <typename T>
auto pack_unpack() {
return std::make_pair<abi_serializer::unpack_function, abi_serializer::pack_function>(
[]( fc::datastream<const char*>& stream, bool is_array, bool is_optional) -> fc::variant {
[]( fc::datastream<const char*>& stream, bool is_array, bool is_optional, const fc::time_point& deadline) -> fc::variant {
if( is_array )
return variant_from_stream<vector<T>>(stream);
else if ( is_optional )
return variant_from_stream<optional<T>>(stream);
return variant_from_stream<T>(stream);
},
[]( const fc::variant& var, fc::datastream<char*>& ds, bool is_array, bool is_optional ){
pack_function<T>()
);
}

template <typename T>
auto pack_unpack_deadline() {
return std::make_pair<abi_serializer::unpack_function, abi_serializer::pack_function>(
[]( fc::datastream<const char*>& stream, bool is_array, bool is_optional, const fc::time_point& deadline) -> fc::variant {
if( is_array )
fc::raw::pack( ds, var.as<vector<T>>() );
return variant_from_stream<vector<T>>(stream);
else if ( is_optional )
fc::raw::pack( ds, var.as<optional<T>>() );
else
fc::raw::pack( ds, var.as<T>());
}
return variant_from_stream<optional<T>>(stream);
return variant_from_stream<T>(stream, deadline);
},
pack_function<T>()
);
}

Expand Down Expand Up @@ -90,8 +117,8 @@ namespace eosio { namespace chain {
built_in_types.emplace("checksum256", pack_unpack<checksum256_type>());
built_in_types.emplace("checksum512", pack_unpack<checksum512_type>());

built_in_types.emplace("public_key", pack_unpack<public_key_type>());
built_in_types.emplace("signature", pack_unpack<signature_type>());
built_in_types.emplace("public_key", pack_unpack_deadline<public_key_type>());
built_in_types.emplace("signature", pack_unpack_deadline<signature_type>());

built_in_types.emplace("symbol", pack_unpack<symbol>());
built_in_types.emplace("symbol_code", pack_unpack<symbol_code>());
Expand Down Expand Up @@ -318,7 +345,7 @@ namespace eosio { namespace chain {
auto btype = built_in_types.find(ftype );
if( btype != built_in_types.end() ) {
try {
return btype->second.first(stream, is_array(rtype), is_optional(rtype));
return btype->second.first(stream, is_array(rtype), is_optional(rtype), ctx.get_deadline());
} EOS_RETHROW_EXCEPTIONS( unpack_exception, "Unable to unpack ${class} type '${type}' while processing '${p}'",
("class", is_array(rtype) ? "array of built-in" : is_optional(rtype) ? "optional of built-in" : "built-in")
("type", impl::limit_size(ftype))("p", ctx.get_path_string()) )
Expand Down Expand Up @@ -403,7 +430,7 @@ namespace eosio { namespace chain {

auto btype = built_in_types.find(fundamental_type(rtype));
if( btype != built_in_types.end() ) {
btype->second.second(var, ds, is_array(rtype), is_optional(rtype));
btype->second.second(var, ds, is_array(rtype), is_optional(rtype), ctx.get_deadline());
} else if ( is_array(rtype) ) {
ctx.hint_array_type_if_in_array();
vector<fc::variant> vars = var.get_array();
Expand Down
5 changes: 3 additions & 2 deletions libraries/chain/include/eosio/chain/abi_serializer.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,8 +81,8 @@ struct abi_serializer {
return false;
}

typedef std::function<fc::variant(fc::datastream<const char*>&, bool, bool)> unpack_function;
typedef std::function<void(const fc::variant&, fc::datastream<char*>&, bool, bool)> pack_function;
typedef std::function<fc::variant(fc::datastream<const char*>&, bool, bool, const fc::time_point&)> unpack_function;
typedef std::function<void(const fc::variant&, fc::datastream<char*>&, bool, bool, const fc::time_point&)> pack_function;

void add_specialized_unpack_pack( const string& name, std::pair<abi_serializer::unpack_function, abi_serializer::pack_function> unpack_pack );

Expand Down Expand Up @@ -139,6 +139,7 @@ namespace impl {
{}

void check_deadline()const;
const fc::time_point& get_deadline()const { return deadline; }

fc::scoped_exit<std::function<void()>> enter_scope();

Expand Down
4 changes: 2 additions & 2 deletions libraries/chain/include/eosio/chain/authority.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,8 +29,8 @@ struct shared_public_key {
return std::move(public_key_storage);
}

operator string() const {
return (string)this->operator public_key_type();
std::string to_string() const {
return this->operator public_key_type().to_string();
}

shared_public_key_data pubkey;
Expand Down
2 changes: 1 addition & 1 deletion libraries/chain/include/eosio/chain/config.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,7 +97,7 @@ const static uint32_t setcode_ram_bytes_multiplier = 10; ///< multip
const static uint32_t hashing_checktime_block_size = 10*1024; /// call checktime from hashing intrinsic once per this number of bytes

const static eosio::chain::wasm_interface::vm_type default_wasm_runtime = eosio::chain::wasm_interface::vm_type::wabt;
const static uint32_t default_abi_serializer_max_time_ms = 15*1000; ///< default deadline for abi serialization methods
const static uint32_t default_abi_serializer_max_time_us = 15*1000; ///< default deadline for abi serialization methods

/**
* The number of sequential blocks produced by a single producer
Expand Down
2 changes: 1 addition & 1 deletion libraries/fc
Open in desktop
Submodule fc updated 15 files
+3 −2 include/fc/crypto/base58.hpp
+9 −1 include/fc/crypto/common.hpp
+2 −2 include/fc/crypto/private_key.hpp
+2 −2 include/fc/crypto/public_key.hpp
+2 −2 include/fc/crypto/signature.hpp
+10 −0 include/fc/exception/exception.hpp
+0 −10 include/fc/time.hpp
+11 −0 include/fc/variant.hpp
+14 −8 src/crypto/base58.cpp
+1 −1 src/crypto/elliptic_common.cpp
+1 −1 src/crypto/elliptic_r1.cpp
+8 −8 src/crypto/private_key.cpp
+5 −5 src/crypto/public_key.cpp
+6 −5 src/crypto/signature.cpp
+10 −10 test/crypto/test_cypher_suites.cpp
12 changes: 6 additions & 6 deletions plugins/chain_plugin/chain_plugin.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,7 +148,7 @@ class chain_plugin_impl {
fc::optional<genesis_state> genesis;
//txn_msg_rate_limits rate_limits;
fc::optional<vm_type> wasm_runtime;
fc::microseconds abi_serializer_max_time_ms;
fc::microseconds abi_serializer_max_time_us;
fc::optional<bfs::path> snapshot_path;


Expand Down Expand Up @@ -207,7 +207,7 @@ void chain_plugin::set_program_options(options_description& cli, options_descrip
}
#endif
}), "Override default WASM runtime")
("abi-serializer-max-time-ms", bpo::value<uint32_t>()->default_value(config::default_abi_serializer_max_time_ms),
("abi-serializer-max-time-ms", bpo::value<uint32_t>()->default_value(config::default_abi_serializer_max_time_us / 1000),
"Override default maximum ABI serialization time allowed in ms")
("chain-state-db-size-mb", bpo::value<uint64_t>()->default_value(config::default_state_size / (1024 * 1024)), "Maximum size (in MiB) of the chain state database")
("chain-state-db-guard-size-mb", bpo::value<uint64_t>()->default_value(config::default_state_guard_size / (1024 * 1024)), "Safely shut down node when free space remaining in the chain state database drops below this size (in MiB).")
Expand Down Expand Up @@ -692,7 +692,7 @@ void chain_plugin::plugin_initialize(const variables_map& options) {
my->wasm_runtime = options.at( "wasm-runtime" ).as<vm_type>();

if(options.count("abi-serializer-max-time-ms"))
my->abi_serializer_max_time_ms = fc::microseconds(options.at("abi-serializer-max-time-ms").as<uint32_t>() * 1000);
my->abi_serializer_max_time_us = fc::microseconds(options.at("abi-serializer-max-time-ms").as<uint32_t>() * 1000);

my->chain_config->blocks_dir = my->blocks_dir;
my->chain_config->state_dir = app().data_dir() / config::default_state_dir_name;
Expand Down Expand Up @@ -1363,7 +1363,7 @@ chain::chain_id_type chain_plugin::get_chain_id()const {
}

fc::microseconds chain_plugin::get_abi_serializer_max_time() const {
return my->abi_serializer_max_time_ms;
return my->abi_serializer_max_time_us;
}

void chain_plugin::log_guard_exception(const chain::guard_exception&e ) {
Expand Down Expand Up @@ -1811,7 +1811,7 @@ fc::variant read_only::get_currency_stats( const read_only::get_currency_stats_p
return results;
}

fc::variant get_global_row( const database& db, const abi_def& abi, const abi_serializer& abis, const fc::microseconds& abi_serializer_max_time_ms, bool shorten_abi_errors ) {
fc::variant get_global_row( const database& db, const abi_def& abi, const abi_serializer& abis, const fc::microseconds& abi_serializer_max_time_us, bool shorten_abi_errors ) {
const auto table_type = get_table_type(abi, N(global));
EOS_ASSERT(table_type == read_only::KEYi64, chain::contract_table_query_exception, "Invalid table type ${type} for table global", ("type",table_type));

Expand All @@ -1824,7 +1824,7 @@ fc::variant get_global_row( const database& db, const abi_def& abi, const abi_se

vector<char> data;
read_only::copy_inline_row(*it, data);
return abis.binary_to_variant(abis.get_table_type(N(global)), data, abi_serializer_max_time_ms, shorten_abi_errors );
return abis.binary_to_variant(abis.get_table_type(N(global)), data, abi_serializer_max_time_us, shorten_abi_errors );
}

read_only::get_producers_result read_only::get_producers( const read_only::get_producers_params& p ) const try {
Expand Down
6 changes: 3 additions & 3 deletions plugins/mongo_db_plugin/mongo_db_plugin.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -634,13 +634,13 @@ optional<abi_serializer> mongo_db_plugin_impl::get_abi_serializer( account_name
// unpack setabi.abi as abi_def instead of as bytes
abis.add_specialized_unpack_pack( "abi_def",
std::make_pair<abi_serializer::unpack_function, abi_serializer::pack_function>(
[]( fc::datastream<const char*>& stream, bool is_array, bool is_optional ) -> fc::variant {
[]( fc::datastream<const char*>& stream, bool is_array, bool is_optional, const fc::time_point& deadline ) -> fc::variant {
EOS_ASSERT( !is_array && !is_optional, chain::mongo_db_exception, "unexpected abi_def");
chain::bytes temp;
fc::raw::unpack( stream, temp );
return fc::variant( fc::raw::unpack<abi_def>( temp ) );
},
[]( const fc::variant& var, fc::datastream<char*>& ds, bool is_array, bool is_optional ) {
[]( const fc::variant& var, fc::datastream<char*>& ds, bool is_array, bool is_optional, const fc::time_point& deadline ) {
EOS_ASSERT( false, chain::mongo_db_exception, "never called" );
}
) );
Expand Down Expand Up @@ -1110,7 +1110,7 @@ void mongo_db_plugin_impl::add_pub_keys( const vector<chain::key_weight>& keys,
auto find_doc = bsoncxx::builder::basic::document();

find_doc.append( kvp( "account", name.to_string()),
kvp( "public_key", pub_key_weight.key.operator string()),
kvp( "public_key", pub_key_weight.key.to_string()),
kvp( "permission", permission.to_string()) );

auto update_doc = make_document( kvp( "$set", make_document( bsoncxx::builder::concatenate_doc{find_doc.view()},
Expand Down
6 changes: 4 additions & 2 deletions plugins/producer_plugin/producer_plugin.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -648,7 +648,9 @@ void producer_plugin::set_program_options(
"ID of producer controlled by this node (e.g. inita; may specify multiple times)")
("private-key", boost::program_options::value<vector<string>>()->composing()->multitoken(),
"(DEPRECATED - Use signature-provider instead) Tuple of [public key, WIF private key] (may specify multiple times)")
("signature-provider", boost::program_options::value<vector<string>>()->composing()->multitoken()->default_value({std::string(default_priv_key.get_public_key()) + "=KEY:" + std::string(default_priv_key)}, std::string(default_priv_key.get_public_key()) + "=KEY:" + std::string(default_priv_key)),
("signature-provider", boost::program_options::value<vector<string>>()->composing()->multitoken()->default_value(
{default_priv_key.get_public_key().to_string() + "=KEY:" + default_priv_key.to_string()},
default_priv_key.get_public_key().to_string() + "=KEY:" + default_priv_key.to_string()),
"Key=Value pairs in the form <public-key>=<provider-spec>\n"
"Where:\n"
" <public-key> \tis a string form of a vaild EOSIO public key\n\n"
Expand Down Expand Up @@ -773,7 +775,7 @@ void producer_plugin::plugin_initialize(const boost::program_options::variables_
try {
auto key_id_to_wif_pair = dejsonify<std::pair<public_key_type, private_key_type>>(key_id_to_wif_pair_string);
my->_signature_providers[key_id_to_wif_pair.first] = make_key_signature_provider(key_id_to_wif_pair.second);
auto blanked_privkey = std::string(std::string(key_id_to_wif_pair.second).size(), '*' );
auto blanked_privkey = std::string(key_id_to_wif_pair.second.to_string().size(), '*' );
wlog("\"private-key\" is DEPRECATED, use \"signature-provider=${pub}=KEY:${priv}\"", ("pub",key_id_to_wif_pair.first)("priv", blanked_privkey));
} catch ( fc::exception& e ) {
elog("Malformed private key pair");
Expand Down
2 changes: 1 addition & 1 deletion plugins/wallet_plugin/se_wallet.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -359,7 +359,7 @@ bool se_wallet::import_key(string wif_key) {

string se_wallet::create_key(string key_type) {
EOS_ASSERT(key_type.empty() || key_type == "R1", chain::unsupported_key_type_exception, "Secure Enclave wallet only supports R1 keys");
return (string)my->create();
return my->create().to_string();
}

bool se_wallet::remove_key(string key) {
Expand Down
4 changes: 2 additions & 2 deletions plugins/wallet_plugin/wallet.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -183,8 +183,8 @@ class soft_wallet_impl
else
EOS_THROW(chain::unsupported_key_type_exception, "Key type \"${kt}\" not supported by software wallet", ("kt", key_type));

import_key((string)priv_key);
return (string)priv_key.get_public_key();
import_key(priv_key.to_string());
return priv_key.get_public_key().to_string();
}

bool load_wallet_file(string wallet_filename = "")
Expand Down
2 changes: 1 addition & 1 deletion plugins/wallet_plugin/wallet_manager.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,7 @@ constexpr auto password_prefix = "PW";

std::string gen_password() {
auto key = private_key_type::generate();
return password_prefix + string(key);
return password_prefix + key.to_string();

}

Expand Down
2 changes: 1 addition & 1 deletion plugins/wallet_plugin/yubihsm_wallet.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -252,7 +252,7 @@ bool yubihsm_wallet::import_key(string wif_key) {

string yubihsm_wallet::create_key(string key_type) {
EOS_ASSERT(key_type.empty() || key_type == "R1", chain::unsupported_key_type_exception, "YubiHSM wallet only supports R1 keys");
return (string)my->create();
return my->create().to_string();
}

bool yubihsm_wallet::remove_key(string key) {
Expand Down
8 changes: 4 additions & 4 deletions programs/cleos/main.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2149,7 +2149,7 @@ void get_account( const string& accountName, const string& coresym, bool json_fo
std::cout << indent << std::string(depth*3, ' ') << name << ' ' << std::setw(5) << p.required_auth.threshold << ": ";
const char *sep = "";
for ( auto it = p.required_auth.keys.begin(); it != p.required_auth.keys.end(); ++it ) {
std::cout << sep << it->weight << ' ' << string(it->key);
std::cout << sep << it->weight << ' ' << it->key.to_string();
sep = ", ";
}
for ( auto& acc : p.required_auth.accounts ) {
Expand Down Expand Up @@ -2444,8 +2444,8 @@ int main( int argc, char** argv ) {
}

auto pk = r1 ? private_key_type::generate_r1() : private_key_type::generate();
auto privs = string(pk);
auto pubs = string(pk.get_public_key());
auto privs = pk.to_string();
auto pubs = pk.get_public_key().to_string();
if (print_console) {
std::cout << localized("Private key: ${key}", ("key", privs) ) << std::endl;
std::cout << localized("Public key: ${key}", ("key", pubs ) ) << std::endl;
Expand Down Expand Up @@ -3290,7 +3290,7 @@ int main( int argc, char** argv ) {

fc::variants vs = {fc::variant(wallet_name), fc::variant(wallet_key)};
call(wallet_url, wallet_import_key, vs);
std::cout << localized("imported private key for: ${pubkey}", ("pubkey", std::string(pubkey))) << std::endl;
std::cout << localized("imported private key for: ${pubkey}", ("pubkey", pubkey.to_string())) << std::endl;
});

// remove keys from wallet
Expand Down
16 changes: 8 additions & 8 deletions programs/eosio-launcher/main.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1115,9 +1115,9 @@ launcher_def::write_config_file (tn_node_def &node) {
}
if (allowed_connections & PC_SPECIFIED) {
cfg << "allowed-connection = specified\n";
cfg << "peer-key = \"" << string(node.keys.begin()->get_public_key()) << "\"\n";
cfg << "peer-private-key = [\"" << string(node.keys.begin()->get_public_key())
<< "\",\"" << string(*node.keys.begin()) << "\"]\n";
cfg << "peer-key = \"" << node.keys.begin()->get_public_key().to_string() << "\"\n";
cfg << "peer-private-key = [\"" << node.keys.begin()->get_public_key().to_string()
<< "\",\"" << node.keys.begin()->to_string() << "\"]\n";
}
}

Expand All @@ -1130,8 +1130,8 @@ launcher_def::write_config_file (tn_node_def &node) {
}
if (instance.has_db || node.producers.size()) {
for (const auto &kp : node.keys ) {
cfg << "private-key = [\"" << string(kp.get_public_key())
<< "\",\"" << string(kp) << "\"]\n";
cfg << "private-key = [\"" << kp.get_public_key().to_string()
<< "\",\"" << kp.to_string() << "\"]\n";
}
for (auto &p : node.producers) {
cfg << "producer-name = " << p << "\n";
Expand Down Expand Up @@ -1207,7 +1207,7 @@ launcher_def::init_genesis () {
eosio::chain::genesis_state default_genesis;
fc::json::save_to_file( default_genesis, genesis_path, true );
}
string bioskey = string(network.nodes["bios"].keys[0].get_public_key());
string bioskey = network.nodes["bios"].keys[0].get_public_key().to_string();

fc::json::from_file(genesis_path).as<eosio::chain::genesis_state>(genesis_from_file);
genesis_from_file.initial_key = public_key_type(bioskey);
Expand Down Expand Up @@ -1277,7 +1277,7 @@ launcher_def::write_bios_boot () {
}
else if (key == "prodkeys" ) {
for (auto &node : network.nodes) {
brb << "wcmd import -n ignition --private-key " << string(node.second.keys[0]) << "\n";
brb << "wcmd import -n ignition --private-key " << node.second.keys[0].to_string() << "\n";
}
}
else if (key == "cacmd") {
Expand All @@ -1286,7 +1286,7 @@ launcher_def::write_bios_boot () {
continue;
}
brb << "cacmd " << p.producer_name
<< " " << string(p.block_signing_key) << " " << string(p.block_signing_key) << "\n";
<< " " << p.block_signing_key.to_string() << " " << p.block_signing_key.to_string() << "\n";
}
}
}
Expand Down
Loading