mirror of
https://github.com/luxfi/mpc.git
synced 2026-09-24 00:26:24 +00:00
zeekay
3bb399cbdd
Adds the topology contract that lets a fund run mpcd as its own private
cluster — no Lux primary network registration, no shared M-Chain audit
ledger — using the same code path and the same operator surface.
Mode flag at cmd/mpcd/main.go:
--network=primary|private # registration target
--audit-store=mchain|local-worm|... # audit log destination
--registrar-url, --registrar-auth # primary-mode announcement
--audit-worm-path, --audit-mchain-url # backend selectors
pkg/audit:
- Append-only Merkle hash chain. Tampering with any historical event
invalidates every subsequent hash. Canonical bytes use fixed-order
concatenation (json.Marshal map ordering is non-deterministic).
- WORMDispatcher: NDJSON append, replay-on-start, fsync per Append.
- MChainDispatcher: batched POST of (batchHash, fromSeq, toSeq) to a
configurable anchor RPC.
- compositeDispatcher: fan-out to multiple legs with per-leg sealing.
- S3 Glacier Vault / Azure Immutable / GCS Object Lock dispatchers
fail closed — wired into the flag surface but gated behind the
cloud-audit build tag, no silent fallback.
pkg/identity/bootstrap.go: identity creation + (primary-mode only)
registrar announcement. Same on-disk format as the previous
loadOrGenerateIdentity (which is now removed); private mode is silent.
deployments/k8s-private: fund-only Kustomize overlay. Standalone
namespace, NetworkPolicy that blocks egress to anything outside the
fund's VPC, hardware-WORM PVC for the audit log, KMS-driven secret
template.
deployments/k8s-primary: env-var patch overlay on the existing lux-mpc
base. composite(local-worm,mchain) by default.
deployments/terraform/{aws,gcp,azure}: VPC + audit storage modules.
terraform validate passes; EKS/GKE/AKS + HSM modules are stubbed and
not yet plan-tested.
deployments/onprem/README.md: WORM storage + PKCS#11 HSM checklist.
Tests (14 total, all passing):
pkg/audit: 6/6 (chain, WORM replay, MChain batching, composite,
cloud stubs fail loud, double-seal rejected)
pkg/identity: 4/4 (private no-call, primary call, primary empty
URL no-op, primary registrar 503 surfaces)
internal/privatemode: 4/4 (no registrar traffic, restart, tamper-detect,
cloud stubs fail loud)
Companion runbook in lux/papers/lux-private-mpc-deployment/
(LaTeX, 5 pages, tectonic-clean).
100 lines
2.9 KiB
Go
100 lines
2.9 KiB
Go
package approval
|
|
|
|
import (
|
|
"encoding/binary"
|
|
"errors"
|
|
"os"
|
|
"strings"
|
|
)
|
|
|
|
// splitCommaTrim splits a comma-separated string and trims whitespace from
|
|
// each element. Empty fragments are dropped.
|
|
func splitCommaTrim(s string) []string {
|
|
parts := strings.Split(s, ",")
|
|
out := make([]string, 0, len(parts))
|
|
for _, p := range parts {
|
|
p = strings.TrimSpace(p)
|
|
if p != "" {
|
|
out = append(out, p)
|
|
}
|
|
}
|
|
return out
|
|
}
|
|
|
|
// isHTTPSOrDev returns true iff origin is acceptable for WebAuthn binding.
|
|
// Production requires https://; dev allows http://localhost only when
|
|
// MPC_ENV=dev.
|
|
func isHTTPSOrDev(origin string) bool {
|
|
if strings.HasPrefix(origin, "https://") {
|
|
return true
|
|
}
|
|
env := strings.ToLower(os.Getenv("MPC_ENV"))
|
|
if env != "dev" && env != "development" && env != "test" && env != "testing" {
|
|
return false
|
|
}
|
|
return strings.HasPrefix(origin, "http://localhost") || strings.HasPrefix(origin, "http://127.0.0.1")
|
|
}
|
|
|
|
// splitWebAuthnSession parses a session ID of the form "approverID/digestB64".
|
|
// Returns approver ID, digest base64, error.
|
|
func splitWebAuthnSession(sessionID string) (string, string, error) {
|
|
idx := strings.LastIndex(sessionID, "/")
|
|
if idx <= 0 || idx == len(sessionID)-1 {
|
|
return "", "", errors.New("approval/webauthn: malformed session id")
|
|
}
|
|
return sessionID[:idx], sessionID[idx+1:], nil
|
|
}
|
|
|
|
// encodeWebAuthnBundle serializes (authData || clientDataJSON || signature)
|
|
// with explicit length prefixes so a verifier can re-split exactly the
|
|
// same bytes the authenticator signed.
|
|
//
|
|
// Layout: [4-byte BE len(authData)] authData [4-byte BE len(clientData)] clientData [4-byte BE len(sig)] sig
|
|
func encodeWebAuthnBundle(authData, clientData, sig []byte) []byte {
|
|
out := make([]byte, 0, 12+len(authData)+len(clientData)+len(sig))
|
|
var buf4 [4]byte
|
|
binary.BigEndian.PutUint32(buf4[:], uint32(len(authData)))
|
|
out = append(out, buf4[:]...)
|
|
out = append(out, authData...)
|
|
binary.BigEndian.PutUint32(buf4[:], uint32(len(clientData)))
|
|
out = append(out, buf4[:]...)
|
|
out = append(out, clientData...)
|
|
binary.BigEndian.PutUint32(buf4[:], uint32(len(sig)))
|
|
out = append(out, buf4[:]...)
|
|
out = append(out, sig...)
|
|
return out
|
|
}
|
|
|
|
func decodeWebAuthnBundle(buf []byte) (authData, clientData, sig []byte, err error) {
|
|
read := func(p *[]byte) ([]byte, error) {
|
|
if len(*p) < 4 {
|
|
return nil, errors.New("approval/webauthn: truncated bundle (length)")
|
|
}
|
|
n := binary.BigEndian.Uint32((*p)[:4])
|
|
*p = (*p)[4:]
|
|
if uint32(len(*p)) < n {
|
|
return nil, errors.New("approval/webauthn: truncated bundle (payload)")
|
|
}
|
|
out := (*p)[:n]
|
|
*p = (*p)[n:]
|
|
return out, nil
|
|
}
|
|
cur := buf
|
|
authData, err = read(&cur)
|
|
if err != nil {
|
|
return nil, nil, nil, err
|
|
}
|
|
clientData, err = read(&cur)
|
|
if err != nil {
|
|
return nil, nil, nil, err
|
|
}
|
|
sig, err = read(&cur)
|
|
if err != nil {
|
|
return nil, nil, nil, err
|
|
}
|
|
if len(cur) != 0 {
|
|
return nil, nil, nil, errors.New("approval/webauthn: trailing bytes in bundle")
|
|
}
|
|
return authData, clientData, sig, nil
|
|
}
|