mirrors/core-lightning
1
0
Fork 0
mirror of https://github.com/ElementsProject/lightning.git synced 2025-01-18 05:12:45 +01:00
Code Issues Projects Releases Wiki Activity

hsmd: Ensure the hsmd is initialized before anything else is called

Browse Source 
Just a security measure to avoid alternative use-cases of the hsmd
running into the issue that they need to send a `WIRE_HSMD_INIT`
message as first message. If that is not done, the `secretstuff` won't
get initialized and we'd be producing signatures from uninitialized
memory, which are completely useless.

Changelog-None: Internal change only
This commit is contained in:
Christian Decker 2021-03-05 12:40:32 +01:00 committed by Rusty Russell
parent 21355edc43
commit 65bf347ad3
1 changed files with 16 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
hsmd/hsmd.c
View File

@ -69,6 +69,9 @@ static struct {
secp256k1_keypair bolt12; secp256k1_keypair bolt12;
} secretstuff; } secretstuff;
/* Have we initialized the secretstuff? */
static bool initialized = false;
/* Version codes for BIP32 extended keys in libwally-core. /* Version codes for BIP32 extended keys in libwally-core.
* It's not suitable to add this struct into client struct, * It's not suitable to add this struct into client struct,
* so set it static.*/ * so set it static.*/
@ -772,6 +775,10 @@ static struct io_plan *init_hsm(struct io_conn *conn,
status_failed(STATUS_FAIL_INTERNAL_ERROR, status_failed(STATUS_FAIL_INTERNAL_ERROR,
"Could derive bolt12 public key."); "Could derive bolt12 public key.");
/* Now we can consider ourselves initialized, and we won't get
* upset if we get a non-init message. */
initialized = true;
/*~ Note: marshalling a bip32 tree only marshals the public side, /*~ Note: marshalling a bip32 tree only marshals the public side,
* not the secrets! So we're not actually handing them out here! * not the secrets! So we're not actually handing them out here!
*/ */
@ -2015,6 +2022,15 @@ static struct io_plan *handle_client(struct io_conn *conn, struct client *c)
return bad_req_fmt(conn, c, c->msg_in, return bad_req_fmt(conn, c, c->msg_in,
"does not have capability to run %d", t); "does not have capability to run %d", t);
/* If we aren't initialized yet we better get an init message
* first. Otherwise we don't load the secret and every
* signature we produce is just going to be junk. */
if (!initialized && t != WIRE_HSMD_INIT)
status_failed(STATUS_FAIL_MASTER_IO,
"hsmd was not initialized correctly, expected "
"message type %d, got %d",
WIRE_HSMD_INIT, t);
/* Now actually go and do what the client asked for */ /* Now actually go and do what the client asked for */
switch (t) { switch (t) {
case WIRE_HSMD_INIT: case WIRE_HSMD_INIT: