// CheckTransaction is used to verify that a transaction
// is well formed with the respect to the security layer
// prescriptions. To be used for internal verifications.
func (client *clientImpl) checkTransaction(tx *obc.Transaction) error {
if !client.isInitialized {
return utils.ErrNotInitialized
}
if tx.Cert == nil && tx.Signature == nil {
return utils.ErrTransactionMissingCert
}
if tx.Cert != nil && tx.Signature != nil {
// Verify the transaction
// 1. Unmarshal cert
cert, err := primitives.DERToX509Certificate(tx.Cert)
if err != nil {
client.Errorf("Failed unmarshalling cert [%s].", err.Error())
return err
}
// a. Get rid of the extensions that cannot be checked now
cert.UnhandledCriticalExtensions = nil
// b. Check against TCA certPool
if _, err = primitives.CheckCertAgainRoot(cert, client.tcaCertPool); err != nil {
client.Warningf("Failed verifing certificate against TCA cert pool [%s].", err.Error())
// c. Check against ECA certPool, if this check also fails then return an error
if _, err = primitives.CheckCertAgainRoot(cert, client.ecaCertPool); err != nil {
client.Warningf("Failed verifing certificate against ECA cert pool [%s].", err.Error())
return fmt.Errorf("Certificate has not been signed by a trusted authority. [%s]", err)
}
}
// 2. Marshall tx without signature
signature := tx.Signature
tx.Signature = nil
rawTx, err := proto.Marshal(tx)
if err != nil {
client.Errorf("Failed marshaling tx [%s].", err.Error())
return err
}
tx.Signature = signature
// 3. Verify signature
ver, err := client.verify(cert.PublicKey, rawTx, tx.Signature)
if err != nil {
client.Errorf("Failed marshaling tx [%s].", err.Error())
return err
}
if ver {
return nil
}
return utils.ErrInvalidTransactionSignature
}
return utils.ErrTransactionMissingCert
}
// TransactionPreValidation verifies that the transaction is
// well formed with the respect to the security layer
// prescriptions (i.e. signature verification).
func (peer *peerImpl) TransactionPreValidation(tx *obc.Transaction) (*obc.Transaction, error) {
if !peer.IsInitialized() {
return nil, utils.ErrNotInitialized
}
// peer.debug("Pre validating [%s].", tx.String())
peer.Debugf("Tx confdential level [%s].", tx.ConfidentialityLevel.String())
if tx.Cert != nil && tx.Signature != nil {
// Verify the transaction
// 1. Unmarshal cert
cert, err := primitives.DERToX509Certificate(tx.Cert)
if err != nil {
peer.Errorf("TransactionPreExecution: failed unmarshalling cert [%s].", err.Error())
return tx, err
}
// TODO: verify cert
// 3. Marshall tx without signature
signature := tx.Signature
tx.Signature = nil
rawTx, err := proto.Marshal(tx)
if err != nil {
peer.Errorf("TransactionPreExecution: failed marshaling tx [%s].", err.Error())
return tx, err
}
tx.Signature = signature
// 2. Verify signature
ok, err := peer.verify(cert.PublicKey, rawTx, tx.Signature)
if err != nil {
peer.Errorf("TransactionPreExecution: failed marshaling tx [%s].", err.Error())
return tx, err
}
if !ok {
return tx, utils.ErrInvalidTransactionSignature
}
} else {
if tx.Cert == nil {
return tx, utils.ErrTransactionCertificate
}
if tx.Signature == nil {
return tx, utils.ErrTransactionSignature
}
}
return tx, nil
}
// CheckTransaction is used to verify that a transaction
// is well formed with the respect to the security layer
// prescriptions. To be used for internal verifications.
func (client *clientImpl) checkTransaction(tx *obc.Transaction) error {
if !client.isInitialized {
return utils.ErrNotInitialized
}
if tx.Cert == nil && tx.Signature == nil {
return utils.ErrTransactionMissingCert
}
if tx.Cert != nil && tx.Signature != nil {
// Verify the transaction
// 1. Unmarshal cert
cert, err := utils.DERToX509Certificate(tx.Cert)
if err != nil {
client.error("Failed unmarshalling cert [%s].", err.Error())
return err
}
// TODO: verify cert
// 3. Marshall tx without signature
signature := tx.Signature
tx.Signature = nil
rawTx, err := proto.Marshal(tx)
if err != nil {
client.error("Failed marshaling tx [%s].", err.Error())
return err
}
tx.Signature = signature
// 2. Verify signature
ver, err := client.verify(cert.PublicKey, rawTx, tx.Signature)
if err != nil {
client.error("Failed marshaling tx [%s].", err.Error())
return err
}
if ver {
return nil
}
return utils.ErrInvalidTransactionSignature
}
return utils.ErrTransactionMissingCert
}
func (client *clientImpl) encryptTxVersion1_1(tx *obc.Transaction) error {
// client.enrollChainKey is an AES key represented as byte array
enrollChainKey := client.enrollChainKey.([]byte)
// Derive key
txKey := primitives.HMAC(enrollChainKey, tx.Nonce)
// client.log.Info("Deriving from :", utils.EncodeBase64(client.node.enrollChainKey))
// client.log.Info("Nonce ", utils.EncodeBase64(tx.Nonce))
// client.log.Info("Derived key ", utils.EncodeBase64(txKey))
// Encrypt Payload
payloadKey := primitives.HMACAESTruncated(txKey, []byte{1})
encryptedPayload, err := primitives.CBCPKCS7Encrypt(payloadKey, tx.Payload)
if err != nil {
return err
}
tx.Payload = encryptedPayload
// Encrypt ChaincodeID
chaincodeIDKey := primitives.HMACAESTruncated(txKey, []byte{2})
encryptedChaincodeID, err := primitives.CBCPKCS7Encrypt(chaincodeIDKey, tx.ChaincodeID)
if err != nil {
return err
}
tx.ChaincodeID = encryptedChaincodeID
// Encrypt Metadata
if len(tx.Metadata) != 0 {
metadataKey := primitives.HMACAESTruncated(txKey, []byte{3})
encryptedMetadata, err := primitives.CBCPKCS7Encrypt(metadataKey, tx.Metadata)
if err != nil {
return err
}
tx.Metadata = encryptedMetadata
}
return nil
}
func (client *clientImpl) encryptTxVersion1_2(tx *obc.Transaction) error {
// Create (PK_C,SK_C) pair
ccPrivateKey, err := client.eciesSPI.NewPrivateKey(rand.Reader, primitives.GetDefaultCurve())
if err != nil {
client.Errorf("Failed generate chaincode keypair: [%s]", err)
return err
}
// Prepare message to the validators
var (
stateKey []byte
privBytes []byte
)
switch tx.Type {
case obc.Transaction_CHAINCODE_DEPLOY:
// Prepare chaincode stateKey and privateKey
stateKey, err = primitives.GenAESKey()
if err != nil {
client.Errorf("Failed creating state key: [%s]", err)
return err
}
privBytes, err = client.eciesSPI.SerializePrivateKey(ccPrivateKey)
if err != nil {
client.Errorf("Failed serializing chaincode key: [%s]", err)
return err
}
break
case obc.Transaction_CHAINCODE_QUERY:
// Prepare chaincode stateKey and privateKey
stateKey = primitives.HMACAESTruncated(client.queryStateKey, append([]byte{6}, tx.Nonce...))
privBytes, err = client.eciesSPI.SerializePrivateKey(ccPrivateKey)
if err != nil {
client.Errorf("Failed serializing chaincode key: [%s]", err)
return err
}
break
case obc.Transaction_CHAINCODE_INVOKE:
// Prepare chaincode stateKey and privateKey
stateKey = make([]byte, 0)
privBytes, err = client.eciesSPI.SerializePrivateKey(ccPrivateKey)
if err != nil {
client.Errorf("Failed serializing chaincode key: [%s]", err)
return err
}
break
}
// Encrypt message to the validators
cipher, err := client.eciesSPI.NewAsymmetricCipherFromPublicKey(client.chainPublicKey)
if err != nil {
client.Errorf("Failed creating new encryption scheme: [%s]", err)
return err
}
msgToValidators, err := asn1.Marshal(chainCodeValidatorMessage1_2{privBytes, stateKey})
if err != nil {
client.Errorf("Failed preparing message to the validators: [%s]", err)
return err
}
encMsgToValidators, err := cipher.Process(msgToValidators)
if err != nil {
client.Errorf("Failed encrypting message to the validators: [%s]", err)
return err
}
tx.ToValidators = encMsgToValidators
// Encrypt the rest of the fields
// Init with chainccode pk
cipher, err = client.eciesSPI.NewAsymmetricCipherFromPublicKey(ccPrivateKey.GetPublicKey())
if err != nil {
client.Errorf("Failed initiliazing encryption scheme: [%s]", err)
return err
}
// Encrypt chaincodeID using pkC
encryptedChaincodeID, err := cipher.Process(tx.ChaincodeID)
if err != nil {
client.Errorf("Failed encrypting chaincodeID: [%s]", err)
return err
}
tx.ChaincodeID = encryptedChaincodeID
// Encrypt payload using pkC
encryptedPayload, err := cipher.Process(tx.Payload)
if err != nil {
client.Errorf("Failed encrypting payload: [%s]", err)
return err
}
tx.Payload = encryptedPayload
// Encrypt metadata using pkC
if len(tx.Metadata) != 0 {
encryptedMetadata, err := cipher.Process(tx.Metadata)
if err != nil {
client.Errorf("Failed encrypting metadata: [%s]", err)
return err
}
tx.Metadata = encryptedMetadata
}
return nil
}
// TransactionPreValidation verifies that the transaction is
// well formed with the respect to the security layer
// prescriptions (i.e. signature verification).
func (peer *peerImpl) TransactionPreValidation(tx *obc.Transaction) (*obc.Transaction, error) {
if !peer.IsInitialized() {
return nil, utils.ErrNotInitialized
}
// peer.debug("Pre validating [%s].", tx.String())
peer.Debugf("Tx confdential level [%s].", tx.ConfidentialityLevel.String())
if tx.Cert != nil && tx.Signature != nil {
// Verify the transaction
// 1. Unmarshal cert
cert, err := primitives.DERToX509Certificate(tx.Cert)
if err != nil {
peer.Errorf("TransactionPreExecution: failed unmarshalling cert [%s].", err.Error())
return tx, err
}
// Verify transaction certificate against root
// DER to x509
x509Cert, err := primitives.DERToX509Certificate(tx.Cert)
if err != nil {
peer.Debugf("Failed parsing certificate [% x]: [%s].", tx.Cert, err)
return tx, err
}
// 1. Get rid of the extensions that cannot be checked now
x509Cert.UnhandledCriticalExtensions = nil
// 2. Check against TCA certPool
if _, err = primitives.CheckCertAgainRoot(x509Cert, peer.tcaCertPool); err != nil {
peer.Warningf("Failed verifing certificate against TCA cert pool [%s].", err.Error())
// 3. Check against ECA certPool, if this check also fails then return an error
if _, err = primitives.CheckCertAgainRoot(x509Cert, peer.ecaCertPool); err != nil {
peer.Warningf("Failed verifing certificate against ECA cert pool [%s].", err.Error())
return tx, fmt.Errorf("Certificate has not been signed by a trusted authority. [%s]", err)
}
}
// 3. Marshall tx without signature
signature := tx.Signature
tx.Signature = nil
rawTx, err := proto.Marshal(tx)
if err != nil {
peer.Errorf("TransactionPreExecution: failed marshaling tx [%s].", err.Error())
return tx, err
}
tx.Signature = signature
// 2. Verify signature
ok, err := peer.verify(cert.PublicKey, rawTx, tx.Signature)
if err != nil {
peer.Errorf("TransactionPreExecution: failed marshaling tx [%s].", err.Error())
return tx, err
}
if !ok {
return tx, utils.ErrInvalidTransactionSignature
}
} else {
if tx.Cert == nil {
return tx, utils.ErrTransactionCertificate
}
if tx.Signature == nil {
return tx, utils.ErrTransactionSignature
}
}
return tx, nil
}