aboutsummaryrefslogtreecommitdiff
path: root/internal/requests
diff options
context:
space:
mode:
Diffstat (limited to 'internal/requests')
-rw-r--r--internal/requests/requests.go91
-rw-r--r--internal/requests/requests_test.go218
2 files changed, 309 insertions, 0 deletions
diff --git a/internal/requests/requests.go b/internal/requests/requests.go
new file mode 100644
index 0000000..cfd563f
--- /dev/null
+++ b/internal/requests/requests.go
@@ -0,0 +1,91 @@
+package requests
+
+import (
+ "context"
+ "fmt"
+ "net/http"
+ "time"
+
+ "git.sigsum.org/sigsum-go/pkg/dns"
+ "git.sigsum.org/sigsum-go/pkg/merkle"
+ sigsumreq "git.sigsum.org/sigsum-go/pkg/requests"
+ "git.sigsum.org/sigsum-go/pkg/types"
+)
+
+func LeafRequestFromHTTP(r *http.Request, shardStart uint64, ctx context.Context, vf dns.Verifier) (*sigsumreq.Leaf, error) {
+ var req sigsumreq.Leaf
+ if err := req.FromASCII(r.Body); err != nil {
+ return nil, fmt.Errorf("parse ascii: %w", err)
+ }
+ stmt := types.Statement{
+ ShardHint: req.ShardHint,
+ Checksum: *merkle.HashFn(req.Message[:]),
+ }
+ if !stmt.Verify(&req.PublicKey, &req.Signature) {
+ return nil, fmt.Errorf("invalid signature")
+ }
+ shardEnd := uint64(time.Now().Unix())
+ if req.ShardHint < shardStart {
+ return nil, fmt.Errorf("invalid shard hint: %d not in [%d, %d]", req.ShardHint, shardStart, shardEnd)
+ }
+ if req.ShardHint > shardEnd {
+ return nil, fmt.Errorf("invalid shard hint: %d not in [%d, %d]", req.ShardHint, shardStart, shardEnd)
+ }
+ if err := vf.Verify(ctx, req.DomainHint, &req.PublicKey); err != nil {
+ return nil, fmt.Errorf("invalid domain hint: %v", err)
+ }
+ return &req, nil
+}
+
+func CosignatureRequestFromHTTP(r *http.Request, w map[merkle.Hash]types.PublicKey) (*sigsumreq.Cosignature, error) {
+ var req sigsumreq.Cosignature
+ if err := req.FromASCII(r.Body); err != nil {
+ return nil, fmt.Errorf("parse ascii: %w", err)
+ }
+ if _, ok := w[req.KeyHash]; !ok {
+ return nil, fmt.Errorf("unknown witness: %x", req.KeyHash)
+ }
+ return &req, nil
+}
+
+func ConsistencyProofRequestFromHTTP(r *http.Request) (*sigsumreq.ConsistencyProof, error) {
+ var req sigsumreq.ConsistencyProof
+ if err := req.FromURL(r.URL.Path); err != nil {
+ return nil, fmt.Errorf("parse url: %w", err)
+ }
+ if req.OldSize < 1 {
+ return nil, fmt.Errorf("old_size(%d) must be larger than zero", req.OldSize)
+ }
+ if req.NewSize <= req.OldSize {
+ return nil, fmt.Errorf("new_size(%d) must be larger than old_size(%d)", req.NewSize, req.OldSize)
+ }
+ return &req, nil
+}
+
+func InclusionProofRequestFromHTTP(r *http.Request) (*sigsumreq.InclusionProof, error) {
+ var req sigsumreq.InclusionProof
+ if err := req.FromURL(r.URL.Path); err != nil {
+ return nil, fmt.Errorf("parse url: %w", err)
+ }
+ if req.TreeSize < 2 {
+ // TreeSize:0 => not possible to prove inclusion of anything
+ // TreeSize:1 => you don't need an inclusion proof (it is always empty)
+ return nil, fmt.Errorf("tree_size(%d) must be larger than one", req.TreeSize)
+ }
+ return &req, nil
+}
+
+func LeavesRequestFromHTTP(r *http.Request, maxRange uint64) (*sigsumreq.Leaves, error) {
+ var req sigsumreq.Leaves
+ if err := req.FromURL(r.URL.Path); err != nil {
+ return nil, fmt.Errorf("parse url: %w", err)
+ }
+
+ if req.StartSize > req.EndSize {
+ return nil, fmt.Errorf("start_size(%d) must be less than or equal to end_size(%d)", req.StartSize, req.EndSize)
+ }
+ if req.EndSize-req.StartSize+1 > maxRange {
+ req.EndSize = req.StartSize + maxRange - 1
+ }
+ return &req, nil
+}
diff --git a/internal/requests/requests_test.go b/internal/requests/requests_test.go
new file mode 100644
index 0000000..46d6e15
--- /dev/null
+++ b/internal/requests/requests_test.go
@@ -0,0 +1,218 @@
+package requests
+
+import (
+ "bytes"
+ "context"
+ "crypto/ed25519"
+ "crypto/rand"
+ "fmt"
+ "io"
+ "net/http"
+ "reflect"
+ "testing"
+ "time"
+
+ mocksDNS "git.sigsum.org/log-go/internal/mocks/dns"
+ "git.sigsum.org/sigsum-go/pkg/merkle"
+ sigsumreq "git.sigsum.org/sigsum-go/pkg/requests"
+ "git.sigsum.org/sigsum-go/pkg/types"
+ "github.com/golang/mock/gomock"
+)
+
+func TestLeafRequestFromHTTP(t *testing.T) {
+ st := uint64(10)
+ dh := "_sigsum_v0.example.org"
+ msg := merkle.Hash{}
+ var pub types.PublicKey
+ b, priv, err := ed25519.GenerateKey(rand.Reader)
+ if err != nil {
+ t.Fatalf("must generate key pair: %v", err)
+ }
+ copy(pub[:], b)
+
+ sign := func(sh uint64, msg merkle.Hash) *types.Signature {
+ stm := types.Statement{sh, *merkle.HashFn(msg[:])}
+ sig, err := stm.Sign(priv)
+ if err != nil {
+ t.Fatalf("must sign: %v", err)
+ }
+ return sig
+ }
+ input := func(sh uint64, msg merkle.Hash, badSig bool) io.Reader {
+ sig := sign(sh, msg)[:]
+ if badSig {
+ msg[0] += 1 // use a different message
+ }
+ str := fmt.Sprintf("shard_hint=%d\n", sh)
+ str += fmt.Sprintf("message=%x\n", msg[:])
+ str += fmt.Sprintf("signature=%x\n", sig[:])
+ str += fmt.Sprintf("public_key=%x\n", pub[:])
+ str += fmt.Sprintf("domain_hint=%s\n", dh)
+ return bytes.NewBufferString(str)
+ }
+
+ for _, table := range []struct {
+ desc string
+ params io.Reader
+ dnsExpect bool
+ dnsErr error
+ wantRsp *sigsumreq.Leaf
+ }{
+ {"invalid: parse ascii", bytes.NewBufferString("a=b"), false, nil, nil},
+ {"invalid: signature", input(st, msg, true), false, nil, nil},
+ {"invalid: shard start", input(st-1, msg, false), false, nil, nil},
+ {"invalid: shard end", input(uint64(time.Now().Unix())+1024, msg, false), false, nil, nil},
+ {"invalid: mocked dns error", input(st, msg, false), true, fmt.Errorf("mocked dns error"), nil},
+ {"valid", input(st, msg, false), true, nil, &sigsumreq.Leaf{st, msg, *sign(st, msg), pub, dh}},
+ } {
+ func() {
+ ctrl := gomock.NewController(t)
+ defer ctrl.Finish()
+ vf := mocksDNS.NewMockVerifier(ctrl)
+ if table.dnsExpect {
+ vf.EXPECT().Verify(gomock.Any(), gomock.Any(), gomock.Any()).Return(table.dnsErr)
+ }
+
+ url := types.EndpointAddLeaf.Path("http://example.org/sigsum/v0")
+ req, err := http.NewRequest(http.MethodPost, url, table.params)
+ if err != nil {
+ t.Fatalf("must create http request: %v", err)
+ }
+
+ parsedReq, err := LeafRequestFromHTTP(req, st, context.Background(), vf)
+ if got, want := err != nil, table.desc != "valid"; got != want {
+ t.Errorf("%s: got error %v but wanted %v: %v", table.desc, got, want, err)
+ }
+ if err != nil {
+ return
+ }
+ if got, want := parsedReq, table.wantRsp; !reflect.DeepEqual(got, want) {
+ t.Errorf("%s: got request %v but wanted %v", table.desc, got, want)
+ }
+ }()
+ }
+}
+
+func TestCosignatureRequestFromHTTP(t *testing.T) {
+ input := func(h merkle.Hash) io.Reader {
+ return bytes.NewBufferString(fmt.Sprintf("cosignature=%x\nkey_hash=%x\n", types.Signature{}, h))
+ }
+ w := map[merkle.Hash]types.PublicKey{
+ *merkle.HashFn([]byte("w1")): types.PublicKey{},
+ }
+ for _, table := range []struct {
+ desc string
+ params io.Reader
+ wantRsp *sigsumreq.Cosignature
+ }{
+ {"invalid: parser error", bytes.NewBufferString("abcd"), nil},
+ {"invalid: unknown witness", input(*merkle.HashFn([]byte("w2"))), nil},
+ {"valid", input(*merkle.HashFn([]byte("w1"))), &sigsumreq.Cosignature{types.Signature{}, *merkle.HashFn([]byte("w1"))}},
+ } {
+ url := types.EndpointAddCosignature.Path("http://example.org/sigsum/v0")
+ req, err := http.NewRequest(http.MethodPost, url, table.params)
+ if err != nil {
+ t.Fatalf("must create http request: %v", err)
+ }
+
+ parsedReq, err := CosignatureRequestFromHTTP(req, w)
+ if got, want := err != nil, table.desc != "valid"; got != want {
+ t.Errorf("%s: got error %v but wanted %v: %v", table.desc, got, want, err)
+ }
+ if err != nil {
+ continue
+ }
+ if got, want := parsedReq, table.wantRsp; !reflect.DeepEqual(got, want) {
+ t.Errorf("%s: got request %v but wanted %v", table.desc, got, want)
+ }
+ }
+}
+
+func TestConsistencyProofRequestFromHTTP(t *testing.T) {
+ for _, table := range []struct {
+ desc string
+ params string
+ wantRsp *sigsumreq.ConsistencyProof
+ }{
+ {"invalid: bad request (parser error)", "a/1", nil},
+ {"invalid: bad request (out of range 1/2)", "0/1", nil},
+ {"invalid: bad request (out of range 2/2)", "1/1", nil},
+ {"valid", "1/2", &sigsumreq.ConsistencyProof{1, 2}},
+ } {
+ url := types.EndpointGetConsistencyProof.Path("http://example.org/sigsum/v0/")
+ req, err := http.NewRequest(http.MethodGet, url+table.params, nil)
+ if err != nil {
+ t.Fatalf("must create http request: %v", err)
+ }
+
+ parsedReq, err := ConsistencyProofRequestFromHTTP(req)
+ if got, want := err != nil, table.desc != "valid"; got != want {
+ t.Errorf("%s: got error %v but wanted %v: %v", table.desc, got, want, err)
+ }
+ if err != nil {
+ continue
+ }
+ if got, want := parsedReq, table.wantRsp; !reflect.DeepEqual(got, want) {
+ t.Errorf("%s: got request %v but wanted %v", table.desc, got, want)
+ }
+ }
+}
+
+func TestInclusionProofRequestFromHTTP(t *testing.T) {
+ for _, table := range []struct {
+ desc string
+ params string
+ wantRsp *sigsumreq.InclusionProof
+ }{
+ {"invalid: bad request (parser error)", "a/0000000000000000000000000000000000000000000000000000000000000000", nil},
+ {"invalid: bad request (out of range)", "1/0000000000000000000000000000000000000000000000000000000000000000", nil},
+ {"valid", "2/0000000000000000000000000000000000000000000000000000000000000000", &sigsumreq.InclusionProof{2, merkle.Hash{}}},
+ } {
+ url := types.EndpointGetInclusionProof.Path("http://example.org/sigsum/v0/")
+ req, err := http.NewRequest(http.MethodGet, url+table.params, nil)
+ if err != nil {
+ t.Fatalf("must create http request: %v", err)
+ }
+
+ parsedReq, err := InclusionProofRequestFromHTTP(req)
+ if got, want := err != nil, table.desc != "valid"; got != want {
+ t.Errorf("%s: got error %v but wanted %v: %v", table.desc, got, want, err)
+ }
+ if err != nil {
+ continue
+ }
+ if got, want := parsedReq, table.wantRsp; !reflect.DeepEqual(got, want) {
+ t.Errorf("%s: got request %v but wanted %v", table.desc, got, want)
+ }
+ }
+}
+
+func TestGetLeaves(t *testing.T) {
+ maxRange := uint64(10)
+ for _, table := range []struct {
+ desc string
+ params string
+ wantRsp *sigsumreq.Leaves
+ }{
+ {"invalid: bad request (parser error)", "a/1", nil},
+ {"invalid: bad request (StartSize > EndSize)", "1/0", nil},
+ {"valid", "0/10", &sigsumreq.Leaves{0, maxRange - 1}},
+ } {
+ url := types.EndpointGetLeaves.Path("http://example.org/sigsum/v0/")
+ req, err := http.NewRequest(http.MethodGet, url+table.params, nil)
+ if err != nil {
+ t.Fatalf("must create http request: %v", err)
+ }
+
+ parsedReq, err := LeavesRequestFromHTTP(req, maxRange)
+ if got, want := err != nil, table.desc != "valid"; got != want {
+ t.Errorf("%s: got error %v but wanted %v: %v", table.desc, got, want, err)
+ }
+ if err != nil {
+ continue
+ }
+ if got, want := parsedReq, table.wantRsp; !reflect.DeepEqual(got, want) {
+ t.Errorf("%s: got request %v but wanted %v", table.desc, got, want)
+ }
+ }
+}