Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

BLUE-276 Restrict first node selection based on the specified node ip and port #85

Merged
merged 8 commits into from
Sep 19, 2024
Merged

BLUE-276 Restrict first node selection based on the specified node ip and port #85

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
6d51e9a
Restrict first node selection based on the specified node ip and port
jairajdev Sep 19, 2024
9b3252f
Change the first node port to 9001
jairajdev Sep 19, 2024
22c7919
Added restrictFirstNodeSelectionByPublicKey to use in selecting first…
jairajdev Sep 19, 2024
12b6770
Set restrictFirstNodeSelection to false as default
jairajdev Sep 19, 2024
8ae1434
fix validateTypes
urnotsam Sep 19, 2024
156c2a4
Remove first node IP and PORT check code
jairajdev Sep 19, 2024
15026bc
refactor restrictFirstNodeSelectionByPublicKey check
jairajdev Sep 19, 2024
84deacd
Fix debug_mode.patch so it applies again.
mhanson-github Sep 19, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 11 additions & 4 deletions src/API.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,7 @@
const signedFirstNodeInfo = request.body

if (State.isFirst && NodeList.isEmpty() && !NodeList.foundFirstNode) {
// TODO - validate signedFirstNodeInfo payload before signature verification
try {
const isSignatureValid = Crypto.verify(signedFirstNodeInfo)
if (!isSignatureValid) {
Expand All @@ -93,16 +94,22 @@
reply.send({ success: false, error: 'Signature verification failed' })
return
}
const ip = signedFirstNodeInfo.nodeInfo.externalIp
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what if ip in payload will be different from actual ip of the sender ?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The IP and Port are not even being checked in here are they? The title of this PR says restricted based off IP and Port, but I only see the public key being checked.
@mhanson-github @jairajdev

const port = signedFirstNodeInfo.nodeInfo.externalPort
const publicKey = signedFirstNodeInfo.nodeInfo.publicKey
if (config.restrictFirstNodeSelection) {
if (ip !== config.firstNodeInfo.IP || port !== config.firstNodeInfo.PORT) {
Logger.mainLogger.error('Invalid first node info', signedFirstNodeInfo)
Fixed Show fixed Hide fixed
reply.send({ success: false, error: 'Invalid first node info' })
return
}
}
if (NodeList.foundFirstNode) {
const res = NodeList.getCachedNodeList()
reply.send(res)
return
}
NodeList.toggleFirstNode()
const ip = signedFirstNodeInfo.nodeInfo.externalIp
const port = signedFirstNodeInfo.nodeInfo.externalPort
const publicKey = signedFirstNodeInfo.nodeInfo.publicKey

const firstNode: NodeList.ConsensusNodeInfo = {
ip,
port,
Expand Down Expand Up @@ -961,7 +968,7 @@
'ARCHIVER_PUBLIC_KEY',
]
try {
const { sign, ...newConfig } = _request.body

Check warning on line 971 in src/API.ts

View workflow job for this annotation

GitHub Actions / ci / QA merge checks 

'sign' is assigned a value but never used
const validKeys = new Set(Object.keys(config))
const payloadKeys = Object.keys(newConfig)
const invalidKeys = payloadKeys.filter(
Expand Down
10 changes: 10 additions & 0 deletions src/Config.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,6 +96,11 @@ export interface Config {
txCronSchedule: string
}
workerProcessesDebugLog: boolean // To enable debug logs for worker processes managed by the main process
restrictFirstNodeSelection: boolean // The flag to pick the first node that matches the IP and PORT specified in the firstNodeInfo
firstNodeInfo: {
IP: string
PORT: number
}
}

let config: Config = {
Expand Down Expand Up @@ -184,6 +189,11 @@ let config: Config = {
txCronSchedule: '*/5 * * * *',
},
workerProcessesDebugLog: false,
restrictFirstNodeSelection: true,
firstNodeInfo: {
IP: '127.0.0.1',
PORT: 9001,
},
}
// Override default config params from config file, env vars, and cli args
export async function overrideDefaultConfig(file: string): Promise<void> {
Expand Down
Loading