lux/mpc
2
0
Fork 0
mirror of https://github.com/luxfi/mpc.git synced 2026-09-24 00:26:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

Secure file permission

Browse Source
This commit is contained in:
anhthii
2025-07-06 15:16:15 +07:00
parent d04b9cf396
commit fa8a42e010
7 changed files with 53 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/mpcium-cli/generate-identity.go
+13 -2
View File
@@ -13,6 +13,7 @@ import (
"time"
"filippo.io/age"
"github.com/fystack/mpcium/pkg/common/pathutil"
"github.com/urfave/cli/v3"
"golang.org/x/term"
)
@@ -92,6 +93,11 @@ func generateIdentity(ctx context.Context, c *cli.Command) error {
return fmt.Errorf("error checking peers file: %w", err)
}
// Validate the peers file path for security
if err := pathutil.ValidateFilePath(peersPath); err != nil {
return fmt.Errorf("invalid peers file path: %w", err)
}
// Read peers file
peersData, err := os.ReadFile(peersPath)
if err != nil {
@@ -111,7 +117,7 @@ func generateIdentity(ctx context.Context, c *cli.Command) error {
}
// Create identity directory
if err := os.MkdirAll(identityDir, 0755); err != nil {
if err := os.MkdirAll(identityDir, 0750); err != nil {
return fmt.Errorf("failed to create identity directory: %w", err)
}
@@ -152,7 +158,7 @@ func generateNodeIdentity(nodeName, nodeID, identityDir string, encrypt bool, pa
if err != nil {
return fmt.Errorf("failed to marshal identity: %w", err)
}
if err := os.WriteFile(identityPath, identityBytes, 0644); err != nil {
if err := os.WriteFile(identityPath, identityBytes, 0600); err != nil {
return fmt.Errorf("failed to write identity JSON: %w", err)
}
@@ -168,6 +174,11 @@ func generateNodeIdentity(nodeName, nodeID, identityDir string, encrypt bool, pa
return fmt.Errorf("encrypted key file %s already exists. Use --overwrite to force", encryptedKeyPath)
}
// Validate the encrypted key path for security
if err := pathutil.ValidateFilePath(encryptedKeyPath); err != nil {
return fmt.Errorf("invalid encrypted key file path: %w", err)
}
// Encrypt with age and passphrase
outFile, err := os.Create(encryptedKeyPath)
if err != nil {
cmd/mpcium-cli/generate-initiator.go
+9 -2
View File
@@ -14,6 +14,7 @@ import (
"time"
"filippo.io/age"
"github.com/fystack/mpcium/pkg/common/pathutil"
"github.com/urfave/cli/v3"
)
@@ -34,7 +35,7 @@ func generateInitiatorIdentity(ctx context.Context, c *cli.Command) error {
overwrite := c.Bool("overwrite")
// Create output directory if it doesn't exist
if err := os.MkdirAll(outputDir, 0755); err != nil {
if err := os.MkdirAll(outputDir, 0750); err != nil {
return fmt.Errorf("failed to create output directory: %w", err)
}
@@ -97,7 +98,7 @@ func generateInitiatorIdentity(ctx context.Context, c *cli.Command) error {
return fmt.Errorf("failed to marshal identity JSON: %w", err)
}
if err := os.WriteFile(identityPath, identityBytes, 0643); err != nil {
if err := os.WriteFile(identityPath, identityBytes, 0600); err != nil {
return fmt.Errorf("failed to save identity file: %w", err)
}
@@ -111,6 +112,12 @@ func generateInitiatorIdentity(ctx context.Context, c *cli.Command) error {
// Create encrypted key file
encKeyPath := keyPath + ".age"
// Validate the encrypted key path for security
if err := pathutil.ValidateFilePath(encKeyPath); err != nil {
return fmt.Errorf("invalid encrypted key file path: %w", err)
}
outFile, err := os.Create(encKeyPath)
if err != nil {
return fmt.Errorf("failed to create encrypted private key file: %w", err)
cmd/mpcium-cli/generate-peers.go
+2 -2
View File
@@ -33,7 +33,7 @@ func generatePeers(ctx context.Context, c *cli.Command) error {
// Create directory if it doesn't exist
dir := filepath.Dir(outputPath)
if dir != "." {
if err := os.MkdirAll(dir, 0755); err != nil {
if err := os.MkdirAll(dir, 0750); err != nil {
return fmt.Errorf("failed to create directory: %w", err)
}
}
@@ -56,7 +56,7 @@ func generatePeers(ctx context.Context, c *cli.Command) error {
}
// Write to file
if err := os.WriteFile(outputPath, peersJSON, 0644); err != nil {
if err := os.WriteFile(outputPath, peersJSON, 0600); err != nil {
return fmt.Errorf("failed to write file: %w", err)
}
cmd/mpcium-cli/register-peers.go
+6
View File
@@ -6,6 +6,7 @@ import (
"fmt"
"os"
"github.com/fystack/mpcium/pkg/common/pathutil"
"github.com/fystack/mpcium/pkg/config"
"github.com/fystack/mpcium/pkg/infra"
"github.com/fystack/mpcium/pkg/logger"
@@ -20,6 +21,11 @@ func registerPeers(ctx context.Context, c *cli.Command) error {
// Hardcoded prefix for MPC peers in Consul
prefix := "mpc_peers/"
// Validate the input file path for security
if err := pathutil.ValidateFilePath(inputPath); err != nil {
return fmt.Errorf("invalid input file path: %w", err)
}
// Check if input file exists
if _, err := os.Stat(inputPath); os.IsNotExist(err) {
return fmt.Errorf("input file %s does not exist", inputPath)
examples/generate/main.go
+1 -1
View File
@@ -111,7 +111,7 @@ func main() {
if err != nil {
logger.Error("Failed to marshal wallet IDs", err)
} else {
err = os.WriteFile("wallets.json", data, 0644)
err = os.WriteFile("wallets.json", data, 0600)
if err != nil {
logger.Error("Failed to write wallets.json", err)
} else {
pkg/identity/identity.go
+22 -6
View File
@@ -8,17 +8,18 @@ import (
"fmt"
"io"
"os"
"path/filepath"
"strings"
"sync"
"syscall"
"filippo.io/age"
"github.com/bnb-chain/tss-lib/v2/tss"
"golang.org/x/term"
"github.com/fystack/mpcium/pkg/common/pathutil"
"github.com/fystack/mpcium/pkg/logger"
"github.com/fystack/mpcium/pkg/types"
"github.com/spf13/viper"
"golang.org/x/term"
)
// NodeIdentity represents a node's identity information
@@ -54,7 +55,7 @@ type fileStore struct {
// NewFileStore creates a new identity store
func NewFileStore(identityDir, nodeName string, decrypt bool) (*fileStore, error) {
if err := os.MkdirAll(identityDir, 0755); err != nil {
if err := os.MkdirAll(identityDir, 0750); err != nil {
return nil, fmt.Errorf("failed to create identity directory: %w", err)
}
@@ -100,7 +101,12 @@ func NewFileStore(identityDir, nodeName string, decrypt bool) (*fileStore, error
// Check that each node in peers.json has an identity file
for nodeName, nodeID := range peers {
identityFilePath := filepath.Join(identityDir, fmt.Sprintf("%s_identity.json", nodeName))
identityFileName := fmt.Sprintf("%s_identity.json", nodeName)
identityFilePath, err := pathutil.SafePath(identityDir, identityFileName)
if err != nil {
return nil, fmt.Errorf("invalid identity file path for node %s: %w", nodeName, err)
}
data, err := os.ReadFile(identityFilePath)
if err != nil {
return nil, fmt.Errorf("missing identity file for node %s (%s): %w", nodeName, nodeID, err)
@@ -131,8 +137,18 @@ func NewFileStore(identityDir, nodeName string, decrypt bool) (*fileStore, error
// loadPrivateKey loads the private key from file, decrypting if necessary
func loadPrivateKey(identityDir, nodeName string, decrypt bool) (string, error) {
// Check for encrypted or unencrypted private key
encryptedKeyPath := filepath.Join(identityDir, fmt.Sprintf("%s_private.key.age", nodeName))
unencryptedKeyPath := filepath.Join(identityDir, fmt.Sprintf("%s_private.key", nodeName))
encryptedKeyFileName := fmt.Sprintf("%s_private.key.age", nodeName)
unencryptedKeyFileName := fmt.Sprintf("%s_private.key", nodeName)
encryptedKeyPath, err := pathutil.SafePath(identityDir, encryptedKeyFileName)
if err != nil {
return "", fmt.Errorf("invalid encrypted key path for node %s: %w", nodeName, err)
}
unencryptedKeyPath, err := pathutil.SafePath(identityDir, unencryptedKeyFileName)
if err != nil {
return "", fmt.Errorf("invalid unencrypted key path for node %s: %w", nodeName, err)
}
if decrypt {
// Use the encrypted age file
pkg/types/tss.go
-13
View File
@@ -4,7 +4,6 @@ package types
import (
"encoding/json"
"os"
"sort"
"github.com/bnb-chain/tss-lib/v2/tss"
@@ -111,18 +110,6 @@ func UnmarshalStartMessage(msgBytes []byte) (*StartMessage, error) {
return msg, nil
}
func SaveStructToJsonFile(s interface{}, filename string) error {
data, err := json.Marshal(s)
if err != nil {
return err
}
err = os.WriteFile(filename, data, 0644)
if err != nil {
return err
}
return nil
}
// MarshalForSigning returns the deterministic JSON bytes for signing
func (msg *TssMessage) MarshalForSigning() ([]byte, error) {
// Create a map with ordered keys