BLUE-276 Restrict first node selection based on the specified node ip and port

debug_mode.patch

@@ -1,8 +1,8 @@
 diff --git a/archiver-config.json b/archiver-config.json
-index a892baf..ffac25a 100644
+index 7fafd0a..da32776 100644
 --- a/archiver-config.json
 +++ b/archiver-config.json
-@@ -56,7 +56,7 @@
+@@ -56,6 +56,6 @@
        "publicKey": "aec5d2b663869d9c22ba99d8de76f3bff0f54fa5e39d2899ec1f3f4543422ec7"
      }
    ],
@@ -12,10 +12,10 @@ index a892baf..ffac25a 100644
  }
 \ No newline at end of file
 diff --git a/src/Config.ts b/src/Config.ts
-index 6b41ee4..a812003 100644
+index 49bb21a..69cda2a 100644
 --- a/src/Config.ts
 +++ b/src/Config.ts
-@@ -86,7 +86,7 @@ let config: Config = {
+@@ -127,7 +127,7 @@ let config: Config = {
      save: true,
      interval: 1,
    },

src/API.ts

@@ -82,6 +82,36 @@
 
     if (State.isFirst && NodeList.isEmpty() && !NodeList.foundFirstNode) {
       try {
+        let err = Utils.validateTypes(signedFirstNodeInfo, {
+          nodeInfo: 'o',
+          sign: 'o',
+        })
+        if (err) {
+          reply.send({ success: false, error: err })
+          return
+        }
+        err = Utils.validateTypes(signedFirstNodeInfo.nodeInfo, {
+          externalIp: 's',
+          externalPort: 'n',
+          publicKey: 's',
+        })
+        if (err) {
+          reply.send({ success: false, error: err })
+          return
+        }
+        err = Utils.validateTypes(signedFirstNodeInfo.sign, {
+          owner: 's',
+          sig: 's',
+        })
+        if (err) {
+          reply.send({ success: false, error: err })
+          return
+        }
+        if (signedFirstNodeInfo.nodeInfo.publicKey !== signedFirstNodeInfo.sign.owner) {
+          Logger.mainLogger.error('nodeInfo.publicKey does not match signature owner', signedFirstNodeInfo)
+          reply.send({ success: false, error: 'nodeInfo.publicKey does not match signature owner' })
+          return
+        }
         const isSignatureValid = Crypto.verify(signedFirstNodeInfo)
         if (!isSignatureValid) {
           Logger.mainLogger.error('Invalid signature', signedFirstNodeInfo)
@@ -93,16 +123,22 @@
         reply.send({ success: false, error: 'Signature verification failed' })
         return
       }
+      const ip = signedFirstNodeInfo.nodeInfo.externalIp
+      const port = signedFirstNodeInfo.nodeInfo.externalPort
+      const publicKey = signedFirstNodeInfo.nodeInfo.publicKey
+      if (config.restrictFirstNodeSelectionByPublicKey) {
+        if (publicKey !== config.firstNodePublicKey) {
+          Logger.mainLogger.error('Invalid publicKey of first node info', signedFirstNodeInfo)
+          reply.send({ success: false, error: 'Invalid publicKey of first node info' })
+          return
+        }
+      }
       if (NodeList.foundFirstNode) {
         const res = NodeList.getCachedNodeList()
         reply.send(res)
         return
       }
       NodeList.toggleFirstNode()
-      const ip = signedFirstNodeInfo.nodeInfo.externalIp
-      const port = signedFirstNodeInfo.nodeInfo.externalPort
-      const publicKey = signedFirstNodeInfo.nodeInfo.publicKey
-
       const firstNode: NodeList.ConsensusNodeInfo = {
         ip,
         port,
@@ -961,7 +997,7 @@
         'ARCHIVER_PUBLIC_KEY',
       ]
       try {
         const { sign, ...newConfig } = _request.body
         const validKeys = new Set(Object.keys(config))
         const payloadKeys = Object.keys(newConfig)
         const invalidKeys = payloadKeys.filter(

src/Config.ts

@@ -96,6 +96,8 @@ export interface Config {
     txCronSchedule: string
   }
   workerProcessesDebugLog: boolean // To enable debug logs for worker processes managed by the main process
+  restrictFirstNodeSelectionByPublicKey: boolean // The flag to pick the first node that matches the PUBLIC_KEY specified in the firstNodeInfo
+  firstNodePublicKey: string // The public key of the first node to be selected
 }
 
 let config: Config = {
@@ -184,6 +186,8 @@ let config: Config = {
     txCronSchedule: '*/5 * * * *',
   },
   workerProcessesDebugLog: false,
+  restrictFirstNodeSelectionByPublicKey: false,
+  firstNodePublicKey: '',
 }
 // Override default config params from config file, env vars, and cli args
 export async function overrideDefaultConfig(file: string): Promise<void> {