BLUE-276 Restrict first node selection based on the specified node ip and port

src/API.ts

@@ -82,6 +82,36 @@
 
     if (State.isFirst && NodeList.isEmpty() && !NodeList.foundFirstNode) {
       try {
+        let err = Utils.validateTypes(signedFirstNodeInfo, {
+          nodeInfo: 'o',
+          sign: 'o',
+        })
+        if (err) {
+          reply.send({ success: false, error: err })
+          return
+        }
+        err = Utils.validateTypes(signedFirstNodeInfo.nodeInfo, {
+          externalIp: 's',
+          externalPort: 'n',
+          publicKey: 's',
+        })
+        if (err) {
+          reply.send({ success: false, error: err })
+          return
+        }
+        err = Utils.validateTypes(signedFirstNodeInfo.sign, {
+          owner: 's',
+          sig: 's',
+        })
+        if (err) {
+          reply.send({ success: false, error: err })
+          return
+        }
+        if (signedFirstNodeInfo.nodeInfo.publicKey !== signedFirstNodeInfo.sign.owner) {
+          Logger.mainLogger.error('nodeInfo.publicKey does not match signature owner', signedFirstNodeInfo)
+          reply.send({ success: false, error: 'nodeInfo.publicKey does not match signature owner' })
+          return
+        }
         const isSignatureValid = Crypto.verify(signedFirstNodeInfo)
         if (!isSignatureValid) {
           Logger.mainLogger.error('Invalid signature', signedFirstNodeInfo)
@@ -93,16 +123,22 @@
         reply.send({ success: false, error: 'Signature verification failed' })
         return
       }
+      const ip = signedFirstNodeInfo.nodeInfo.externalIp
+      const port = signedFirstNodeInfo.nodeInfo.externalPort
+      const publicKey = signedFirstNodeInfo.nodeInfo.publicKey
+      if (config.restrictFirstNodeSelectionByPublicKey) {
+        if (config.firstNodePublicKey !== '' && publicKey !== config.firstNodePublicKey) {
+          Logger.mainLogger.error('Invalid publicKey of first node info', signedFirstNodeInfo)
+          reply.send({ success: false, error: 'Invalid publicKey of first node info' })
+          return
+        }
+      }
       if (NodeList.foundFirstNode) {
         const res = NodeList.getCachedNodeList()
         reply.send(res)
         return
       }
       NodeList.toggleFirstNode()
-      const ip = signedFirstNodeInfo.nodeInfo.externalIp
-      const port = signedFirstNodeInfo.nodeInfo.externalPort
-      const publicKey = signedFirstNodeInfo.nodeInfo.publicKey
-
       const firstNode: NodeList.ConsensusNodeInfo = {
         ip,
         port,
@@ -961,7 +997,7 @@
         'ARCHIVER_PUBLIC_KEY',
       ]
       try {
         const { sign, ...newConfig } = _request.body
         const validKeys = new Set(Object.keys(config))
         const payloadKeys = Object.keys(newConfig)
         const invalidKeys = payloadKeys.filter(

src/Config.ts

@@ -96,6 +96,8 @@ export interface Config {
     txCronSchedule: string
   }
   workerProcessesDebugLog: boolean // To enable debug logs for worker processes managed by the main process
+  restrictFirstNodeSelectionByPublicKey: boolean // The flag to pick the first node that matches the PUBLIC_KEY specified in the firstNodeInfo
+  firstNodePublicKey: string // The public key of the first node to be selected
 }
 
 let config: Config = {
@@ -184,6 +186,8 @@ let config: Config = {
     txCronSchedule: '*/5 * * * *',
   },
   workerProcessesDebugLog: false,
+  restrictFirstNodeSelectionByPublicKey: false,
+  firstNodePublicKey: '',
 }
 // Override default config params from config file, env vars, and cli args
 export async function overrideDefaultConfig(file: string): Promise<void> {