[release/5.x] Cherry pick: Harden disaster recovery: Ignore duplicate sealed secrets (#6999) (#7001)

Author: eddyashton

CHANGELOG.md

@@ -123,6 +123,8 @@ namespace ccf::kv
       auto search = changes.find(ccf::Tables::SIGNATURES);
       if (search != changes.end())
       {
+        bool has_cose = false;
+
         switch (changes.size())
         {
           case 2:
@@ -138,6 +140,7 @@ namespace ccf::kv
                 changes.end() &&
               changes.find(ccf::Tables::COSE_SIGNATURES) != changes.end())
             {
+              has_cose = true;
               break;
             }
           default:
@@ -148,7 +151,7 @@ namespace ccf::kv
 
         if (history)
         {
-          if (!history->verify_root_signatures())
+          if (!history->verify_root_signatures(has_cose))
           {
             LOG_FAIL_FMT("Failed to deserialise");
             LOG_DEBUG_FMT(

src/kv/deserialise.h

@@ -399,11 +399,7 @@ namespace ccf::kv
     };
 
     virtual ~TxHistory() {}
-    virtual Result verify_and_sign(
-      ccf::PrimarySignature& signature,
-      Term* term,
-      ccf::kv::Configuration::Nodes& nodes) = 0;
-    virtual bool verify_root_signatures() = 0;
+    virtual bool verify_root_signatures(bool has_cose) = 0;
     virtual void try_emit_signature() = 0;
     virtual void emit_signature() = 0;
     virtual ccf::crypto::Sha256Hash get_replicated_state_root() = 0;

src/kv/kv_types.h

@@ -146,15 +146,7 @@ namespace ccf
       version++;
     }
 
-    ccf::kv::TxHistory::Result verify_and_sign(
-      PrimarySignature&,
-      ccf::kv::Term*,
-      ccf::kv::Configuration::Nodes&) override
-    {
-      return ccf::kv::TxHistory::Result::OK;
-    }
-
-    bool verify_root_signatures() override
+    bool verify_root_signatures(bool has_cose) override
     {
       return true;
     }
@@ -661,25 +653,7 @@ namespace ccf
         term_of_next_version};
     }
 
-    ccf::kv::TxHistory::Result verify_and_sign(
-      PrimarySignature& sig,
-      ccf::kv::Term* term,
-      ccf::kv::Configuration::Nodes& config) override
-    {
-      if (!verify_root_signatures())
-      {
-        return ccf::kv::TxHistory::Result::FAIL;
-      }
-
-      ccf::kv::TxHistory::Result result = ccf::kv::TxHistory::Result::OK;
-
-      sig.node = id;
-      sig.sig = kp.sign_hash(sig.root.h.data(), sig.root.h.size());
-
-      return result;
-    }
-
-    bool verify_root_signatures() override
+    bool verify_root_signatures(bool has_cose) override
     {
       auto tx = store.create_read_only_tx();
 
@@ -699,6 +673,11 @@ namespace ccf
         return false;
       }
 
+      if (!has_cose)
+      {
+        return true;
+      }
+
       auto cose_signatures =
         tx.template ro<ccf::CoseSignatures>(ccf::Tables::COSE_SIGNATURES);
       auto cose_sig = cose_signatures->get();

src/node/history.h

@@ -507,12 +507,27 @@ namespace ccf
            it != recovery_ledger_secrets.rend();
            it++)
       {
+        LOG_DEBUG_FMT(
+          "Recovering encrypted ledger secret valid at seqno {}",
+          it->previous_ledger_secret->version);
+
         if (!it->previous_ledger_secret.has_value())
         {
           // Very first entry does not encrypt any other ledger secret
           break;
         }
 
+        if (
+          restored_ledger_secrets.find(it->previous_ledger_secret->version) !=
+          restored_ledger_secrets.end())
+        {
+          // Already decrypted this ledger secret
+          LOG_INFO_FMT(
+            "Skipping, already decrypted ledger secret with version {}",
+            it->previous_ledger_secret->version);
+          continue;
+        }
+
         auto decrypted_ls_raw = decrypt_previous_ledger_secret_raw(
           latest_ls, it->previous_ledger_secret->encrypted_data);
 

src/node/share_manager.h

@@ -814,6 +814,10 @@ def run(args):
         args, "sgx_service", expected_recovery_count=3, test_receipt=False
     )
 
+    test_recover_service_from_files(
+        args, "double_sealed_service", expected_recovery_count=2, test_receipt=False
+    )
+
 
 def run_recover_snapshot_alone(args):
     """

tests/recovery.py

@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIBtjCCATygAwIBAgIUCp/pWk6MnuAKOk3hk+IHzRMNJnowCgYIKoZIzj0EAwMw
+EjEQMA4GA1UEAwwHbWVtYmVyMDAeFw0yNTA1MDgxMjMxNTNaFw0yNjA1MDgxMjMx
+NTNaMBIxEDAOBgNVBAMMB21lbWJlcjAwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAASN
+dA7cD9L+dx0fw8fJcuZzvhM3D2Nfla5/joZKleT4jwBo/YOKgOg8u5vcOccwxucO
+AiXXHNJ2dr+7FUPd+vg6N0AnIaOXDFHROXK2ylmT4l8oQMMw5kpXp6N2gS6AVBaj
+UzBRMB0GA1UdDgQWBBSV5wIP6S1xoYNM5aFl3BxL7LTSzzAfBgNVHSMEGDAWgBSV
+5wIP6S1xoYNM5aFl3BxL7LTSzzAPBgNVHRMBAf8EBTADAQH/MAoGCCqGSM49BAMD
+A2gAMGUCMGzigYRi6rNHp2XnHUJ4dz1ah/osEEnoDLOp1btD/UauD14XGugvD0vL
+vCE0myL25AIxAM5Qkii6F7SQ7J62Tg3/NYrcJ7L6XbkSUK3o1Whgv5POVQG/Eymw
++GgkVACatEnxsw==
+-----END CERTIFICATE-----

tests/testdata/double_sealed_service/common/member0_cert.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQD2qQjwy8D1vEgf
+5dAUJxleME52tzNp2IjuTi96APNMFPlOtBrT4x1MsOUeixDa0phHO+hOt/3kxVXm
+DInWWcbbewF9jlk8R4k3LXJPseDS9LBftaTC9G3JA8enzFjAbHOyVu76vA0BqiSH
+f+SgWd72eai+4mQf0gcMiPYkoDXoFWTst7l6IUc3i8iheaFRC2x/QGzNtI6PgPPQ
+bRMIQOD5wa1I6hw85VpclVylSlw1/Eq8y9DwMKzX5u+QxwWaSszgRLjPKSrSDyTu
+tMPHkCOiFTW9/s9hJ7Afqff0TPn2EdgFwdD5t3EmQxeG6Nu9y00RuLA64iyDxiYT
+hQntCJ7VAgMBAAECggEAeGw2TTlsz4xIuin82JnuLKnw5My0cSyiTZYmX64vGinz
+PZV4s5HiMBr9AVhrtimy5rQ8ypHRhutA8LuWX+wcxfLb22yv7FoQh7vMX1Q8q0GD
+CncoJXYoU0dhJm8BtZA9PAhtTESbJQDoLK8n85Fs5XCoDemBcHedsWT8pw0AxHkY
+GWqYA+RiilJp2pGxg50ce9362fSZ9TmuBZscNtS9FefHzkER/RTHttWpBR/aVyyC
+FnjyB9p4cELSwbZeFHRAX3v4Ba8KUeF8r3wh0qlBJRnM4fw/8kp1wW3dFA0L39zN
+jHuSYCPt7IQn1dR1rNuw34fHU2egRRPMrx7sVEqm0QKBgQD9Htw/gRjrQKKWmEIJ
+B8g/dYmvy4WBzEwqGWyyG7hGvnSxKQ5VaJna0lVDctaV27b5SLdNbyWNHlMrbPMF
+l51SA3HOLTjDzN4Fp2aotTKG558yZMaDe4nyX4B9REf9RmI8ld+/KVy05k0D36Xv
+TlUNPeP/7Y+2i+rUQ29PnllutwKBgQD5d1xovBgFkGT8Sx31gN1GP9AYgiwS/Rq1
+8Sz6RYdzdCIFlNN8VriX7h+2J4gqZ6hcR2kIQBJCK96RP9KX8WB4wKApgdi4LNB7
+SEI4x/a4jZFcUkQXKoBkpwKK1ZM+1M4gsQCUGr7Lm7M3tLuVJmLG7C4+ufO7SIGZ
+KIwNC0KS0wKBgHvW3Ws0fjybIvELDUPdyttBZlvb9zXJ/nmadtOtPDtgczc6Hwkq
+ZBvrTEvzo4kuNhdAvG3mMzkX3Rkh9MSHqTC2/rcg6OTjFr0tacyg2lemevzs0TMC
+/jrW/sZK4e3IwcdijFW6puDazFNY2JZ8fKA9548Pa4Ckc//l/k+16YuBAoGANzxt
+kqcrLng1VAOR450f4YEZo4OXHLE8K9L14YhpoG+zZMb6OMq+3q0UCnIgXTtMdPo+
+0FvXbx1lj4WxLIF+md4U2Hvur4EEvHdYalgkUeLOr8FrYDHB8gdksbbufngCGAz5
+EtIFMvILsabr7e9s6Zy79JmZ1PsN7wqiT/URTY8CgYAn603wR9ZZP5g4Zsauqh9Z
+skIRQZOQgvakpwl6IRDr9aLoekgl0gYy+uQKylDsy7h89dwqPK+Y8Ut/1y+OQl6S
+KD2Gc/8dHKuNSwrzcOI4dx/5RPUVddj8rNexBnafaitKB77nRbXSd8B7HNXYm3U6
+fqB1wFF2nyI3xWHMZMXagg==
+-----END PRIVATE KEY-----

tests/testdata/double_sealed_service/common/member0_enc_privk.pem

@@ -0,0 +1,9 @@
+-----BEGIN PUBLIC KEY-----
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA9qkI8MvA9bxIH+XQFCcZ
+XjBOdrczadiI7k4vegDzTBT5TrQa0+MdTLDlHosQ2tKYRzvoTrf95MVV5gyJ1lnG
+23sBfY5ZPEeJNy1yT7Hg0vSwX7WkwvRtyQPHp8xYwGxzslbu+rwNAaokh3/koFne
+9nmovuJkH9IHDIj2JKA16BVk7Le5eiFHN4vIoXmhUQtsf0BszbSOj4Dz0G0TCEDg
++cGtSOocPOVaXJVcpUpcNfxKvMvQ8DCs1+bvkMcFmkrM4ES4zykq0g8k7rTDx5Aj
+ohU1vf7PYSewH6n39Ez59hHYBcHQ+bdxJkMXhujbvctNEbiwOuIsg8YmE4UJ7Qie
+1QIDAQAB
+-----END PUBLIC KEY-----

tests/testdata/double_sealed_service/common/member0_enc_pubk.pem

@@ -0,0 +1,7 @@
+-----BEGIN EC PARAMETERS-----
+BgUrgQQAIg==
+-----END EC PARAMETERS-----
+-----BEGIN EC PRIVATE KEY-----
+MD4CAQEEMCNoAj3RDb9ksY2F0Z3rOstsugsQOmgkcrtDwI0Wv9GsgOiwD2xwLR1b
+RxQuM608naAHBgUrgQQAIg==
+-----END EC PRIVATE KEY-----