|
18 | 18 | package monitor |
19 | 19 |
|
20 | 20 | import ( |
| 21 | + "bytes" |
| 22 | + "encoding/json" |
| 23 | + "errors" |
| 24 | + "math/big" |
| 25 | + |
| 26 | + "github.com/google/keytransparency/core/mutator/entry" |
| 27 | + |
| 28 | + "github.com/golang/glog" |
| 29 | + tcrypto "github.com/google/trillian/crypto" |
| 30 | + "github.com/google/trillian/merkle" |
| 31 | + "github.com/google/trillian/storage" |
| 32 | + |
21 | 33 | ktpb "github.com/google/keytransparency/core/proto/keytransparency_v1_types" |
22 | 34 | ) |
23 | 35 |
|
24 | | -// verifyMutationsResponse verifies a response received by the GetMutations API. |
| 36 | +var ( |
| 37 | + // ErrInconsistentProofs occurs when the server returned different hashes |
| 38 | + // for the same inclusion proof node in the tree. |
| 39 | + ErrInconsistentProofs = errors.New("inconsistent inclusion proofs") |
| 40 | + // ErrInvalidLogConsistencyProof occurs when the log consistency proof does |
| 41 | + // not verify. |
| 42 | + ErrInvalidLogConsistencyProof = errors.New("invalid log consistency proof") |
| 43 | + // ErrInvalidLogInclusion occurs if the inclusion proof for the signed map |
| 44 | + // root into the log does not verify. |
| 45 | + ErrInvalidLogInclusion = errors.New("invalid log inclusion proof") |
| 46 | + // ErrInvalidLogSignature occurs if the log roots signature does not verify. |
| 47 | + ErrInvalidLogSignature = errors.New("invalid signature on log root") |
| 48 | + // ErrInvalidMapSignature occurs if the map roots signature does not verify. |
| 49 | + ErrInvalidMapSignature = errors.New("invalid signature on map root") |
| 50 | + // ErrInvalidMutation occurs when verification failed because of an invalid |
| 51 | + // mutation. |
| 52 | + ErrInvalidMutation = errors.New("invalid mutation") |
| 53 | + // ErrNotMatchingMapRoot occurs when the reconstructed root differs from the |
| 54 | + // one we received from the server. |
| 55 | + ErrNotMatchingMapRoot = errors.New("recreated root does not match") |
| 56 | +) |
| 57 | + |
| 58 | +// VerifyMutationsResponse verifies a response received by the GetMutations API. |
25 | 59 | // Additionally to the response it takes a complete list of mutations. The list |
26 | 60 | // of received mutations may differ from those included in the initial response |
27 | | -// because of the max. page size. If any verification check failed it returns |
28 | | -// an error. |
29 | | -func (m *Monitor) verifyMutationsResponse(in *ktpb.GetMutationsResponse) []error { |
| 61 | +// because of the max. page size. |
| 62 | +func (m *Monitor) VerifyMutationsResponse(in *ktpb.GetMutationsResponse) []error { |
| 63 | + errList := make([]error, 0) |
| 64 | + |
| 65 | + if m.trusted == nil { |
| 66 | + m.trusted = in.GetLogRoot() |
| 67 | + } |
| 68 | + |
| 69 | + if err := m.logVerifier.VerifyRoot(m.trusted, in.GetLogRoot(), in.GetLogConsistency()); err != nil { |
| 70 | + // this could be one of ErrInvalidLogSignature, ErrInvalidLogConsistencyProof |
| 71 | + errList = append(errList, err) |
| 72 | + } |
| 73 | + // updated trusted log root |
| 74 | + m.trusted = in.GetLogRoot() |
| 75 | + |
| 76 | + b, err := json.Marshal(in.GetSmr()) |
| 77 | + if err != nil { |
| 78 | + glog.Errorf("json.Marshal(): %v", err) |
| 79 | + errList = append(errList, ErrInvalidMapSignature) |
| 80 | + } |
| 81 | + leafIndex := in.GetSmr().GetMapRevision() |
| 82 | + treeSize := in.GetLogRoot().GetTreeSize() |
| 83 | + err = m.logVerifier.VerifyInclusionAtIndex(in.GetLogRoot(), b, leafIndex, in.GetLogInclusion()) |
| 84 | + if err != nil { |
| 85 | + glog.Errorf("m.logVerifier.VerifyInclusionAtIndex((%v, %v, _): %v", leafIndex, treeSize, err) |
| 86 | + errList = append(errList, ErrInvalidLogInclusion) |
| 87 | + } |
| 88 | + |
| 89 | + // copy of singed map root |
| 90 | + smr := *in.GetSmr() |
| 91 | + // reset to the state before it was signed: |
| 92 | + smr.Signature = nil |
| 93 | + // verify signature on map root: |
| 94 | + if err := tcrypto.VerifyObject(m.mapPubKey, smr, in.GetSmr().GetSignature()); err != nil { |
| 95 | + glog.Infof("couldn't verify signature on map root: %v", err) |
| 96 | + errList = append(errList, ErrInvalidMapSignature) |
| 97 | + } |
| 98 | + |
| 99 | + // we need the old root for verifying the inclusion of the old leafs in the |
| 100 | + // previous epoch. Storage always stores the mutations response independent |
| 101 | + // from if the checks succeeded or not. |
| 102 | + var oldRoot []byte |
| 103 | + // mutations happen after epoch 1 which is stored in storage: |
| 104 | + if m.store.LatestEpoch() > 0 { |
| 105 | + // retrieve the old root hash from storage |
| 106 | + monRes, err := m.store.Get(in.Epoch - 1) |
| 107 | + if err != nil { |
| 108 | + glog.Infof("Could not retrieve previous monitoring result: %v", err) |
| 109 | + } |
| 110 | + oldRoot = monRes.Response.GetSmr().GetRootHash() |
| 111 | + |
| 112 | + if err := m.verifyMutations(in.GetMutations(), oldRoot, |
| 113 | + in.GetSmr().GetRootHash(), in.GetSmr().GetMapId()); len(err) > 0 { |
| 114 | + errList = append(errList, err...) |
| 115 | + } |
| 116 | + } |
| 117 | + |
| 118 | + return errList |
| 119 | +} |
| 120 | + |
| 121 | +func (m *Monitor) verifyMutations(muts []*ktpb.Mutation, oldRoot, expectedNewRoot []byte, mapID int64) []error { |
| 122 | + errList := make([]error, 0) |
| 123 | + mutator := entry.New() |
| 124 | + oldProofNodes := make(map[string][]byte) |
| 125 | + newLeaves := make([]merkle.HStar2LeafHash, 0, len(muts)) |
| 126 | + glog.Infof("verifyMutations() called with %v mutations.", len(muts)) |
| 127 | + |
| 128 | + for _, mut := range muts { |
| 129 | + oldLeaf, err := entry.FromLeafValue(mut.GetProof().GetLeaf().GetLeafValue()) |
| 130 | + if err != nil { |
| 131 | + errList = append(errList, ErrInvalidMutation) |
| 132 | + } |
| 133 | + |
| 134 | + // verify that the provided leaf’s inclusion proof goes to epoch e-1: |
| 135 | + index := mut.GetProof().GetLeaf().GetIndex() |
| 136 | + leaf := mut.GetProof().GetLeaf().GetLeafValue() |
| 137 | + if err := merkle.VerifyMapInclusionProof(mapID, index, |
| 138 | + leaf, oldRoot, mut.GetProof().GetInclusion(), m.mapHasher); err != nil { |
| 139 | + glog.Infof("VerifyMapInclusionProof(%x): %v", index, err) |
| 140 | + errList = append(errList, ErrInvalidMutation) |
| 141 | + } |
| 142 | + |
| 143 | + // compute the new leaf |
| 144 | + newLeaf, err := mutator.Mutate(oldLeaf, mut.GetUpdate()) |
| 145 | + if err != nil { |
| 146 | + glog.Infof("Mutation did not verify: %v", err) |
| 147 | + errList = append(errList, ErrInvalidMutation) |
| 148 | + } |
| 149 | + newLeafnID := storage.NewNodeIDFromPrefixSuffix(index, storage.Suffix{}, m.mapHasher.BitLen()) |
| 150 | + newLeafHash := m.mapHasher.HashLeaf(mapID, index, newLeaf) |
| 151 | + newLeaves = append(newLeaves, merkle.HStar2LeafHash{ |
| 152 | + Index: newLeafnID.BigInt(), |
| 153 | + LeafHash: newLeafHash, |
| 154 | + }) |
| 155 | + |
| 156 | + // store the proof hashes locally to recompute the tree below: |
| 157 | + sibIDs := newLeafnID.Siblings() |
| 158 | + proofs := mut.GetProof().GetInclusion() |
| 159 | + for level, sibID := range sibIDs { |
| 160 | + proof := proofs[level] |
| 161 | + if p, ok := oldProofNodes[sibID.String()]; ok { |
| 162 | + // sanity check: for each mut overlapping proof nodes should be |
| 163 | + // equal: |
| 164 | + if !bytes.Equal(p, proof) { |
| 165 | + // this is really odd and should never happen |
| 166 | + errList = append(errList, ErrInconsistentProofs) |
| 167 | + } |
| 168 | + } else { |
| 169 | + if len(proof) > 0 { |
| 170 | + oldProofNodes[sibID.String()] = proof |
| 171 | + } |
| 172 | + } |
| 173 | + } |
| 174 | + } |
| 175 | + |
| 176 | + if err := m.validateMapRoot(expectedNewRoot, mapID, newLeaves, oldProofNodes); err != nil { |
| 177 | + errList = append(errList, err) |
| 178 | + } |
| 179 | + |
| 180 | + return errList |
| 181 | +} |
| 182 | + |
| 183 | +func (m *Monitor) validateMapRoot(expectedRoot []byte, mapID int64, mutatedLeaves []merkle.HStar2LeafHash, oldProofNodes map[string][]byte) error { |
| 184 | + // compute the new root using local intermediate hashes from epoch e |
| 185 | + // (above proof hashes): |
| 186 | + hs2 := merkle.NewHStar2(mapID, m.mapHasher) |
| 187 | + newRoot, err := hs2.HStar2Nodes([]byte{}, m.mapHasher.BitLen(), mutatedLeaves, |
| 188 | + func(depth int, index *big.Int) ([]byte, error) { |
| 189 | + nID := storage.NewNodeIDFromBigInt(depth, index, m.mapHasher.BitLen()) |
| 190 | + if p, ok := oldProofNodes[nID.String()]; ok { |
| 191 | + return p, nil |
| 192 | + } |
| 193 | + return nil, nil |
| 194 | + }, nil) |
| 195 | + |
| 196 | + if err != nil { |
| 197 | + glog.Errorf("hs2.HStar2Nodes(_): %v", err) |
| 198 | + return ErrNotMatchingMapRoot |
| 199 | + } |
| 200 | + |
| 201 | + // verify rootHash |
| 202 | + if !bytes.Equal(newRoot, expectedRoot) { |
| 203 | + return ErrNotMatchingMapRoot |
| 204 | + } |
| 205 | + |
30 | 206 | return nil |
31 | 207 | } |
0 commit comments