From 3de0e0af3521f826e60468b2d6d19717fa0a53d7 Mon Sep 17 00:00:00 2001
From: Magnus Ahltorp <map@kth.se>
Date: Wed, 10 Jun 2015 16:36:54 +0200
Subject: Don't answer public requests if STH is too old or nonexistent

---
 src/v1.erl | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

(limited to 'src/v1.erl')

diff --git a/src/v1.erl b/src/v1.erl
index ad312e7..e066cdd 100644
--- a/src/v1.erl
+++ b/src/v1.erl
@@ -7,14 +7,37 @@
 %% API (URL)
 -export([request/3]).
 
+check_valid_sth() ->
+    case plop:sth() of
+        noentry ->
+            lager:error("No valid STH found"),
+            exit({internalerror, "No valid STH found"});
+        {struct, PropList} ->
+            Now = plop:generate_timestamp(),
+            Timestamp = proplists:get_value(<<"timestamp">>, PropList),
+            MMD = application:get_env(catlfish, mmd, 86400) * 1000,
+            if
+                Now - Timestamp > MMD ->
+                    lager:error("Old STH found, " ++
+                                    "now: ~p, STH timestamp: ~p, diff: ~p",
+                                [Now, Timestamp, Now - Timestamp]),
+                    exit({internalerror, "No valid STH found"});
+                true ->
+                    ok
+            end
+    end.
+
 %% Public functions, i.e. part of URL.
 request(post, "ct/v1/add-chain", Input) ->
+    check_valid_sth(),
     add_chain(Input, normal);
 
 request(post, "ct/v1/add-pre-chain", Input) ->
+    check_valid_sth(),
     add_chain(Input, precert);
 
 request(get, "ct/v1/get-sth", _Query) ->
+    check_valid_sth(),
     case plop:sth() of
         noentry ->
             lager:error("No valid STH found"),
@@ -24,6 +47,7 @@ request(get, "ct/v1/get-sth", _Query) ->
     end;
 
 request(get, "ct/v1/get-sth-consistency", Query) ->
+    check_valid_sth(),
     case lists:sort(Query) of
         [{"first", FirstInput}, {"second", SecondInput}] ->
             {First, _} = string:to_integer(FirstInput),
@@ -42,6 +66,7 @@ request(get, "ct/v1/get-sth-consistency", Query) ->
     end;
 
 request(get, "ct/v1/get-proof-by-hash", Query) ->
+    check_valid_sth(),
     case lists:sort(Query) of
         [{"hash", HashInput}, {"tree_size", TreeSizeInput}] ->
             Hash = case (catch base64:decode(HashInput)) of
@@ -67,6 +92,7 @@ request(get, "ct/v1/get-proof-by-hash", Query) ->
     end;
 
 request(get, "ct/v1/get-entries", Query) ->
+    check_valid_sth(),
     case lists:sort(Query) of
         [{"end", EndInput}, {"start", StartInput}] ->
             {Start, _} = string:to_integer(StartInput),
@@ -80,6 +106,7 @@ request(get, "ct/v1/get-entries", Query) ->
     end;
 
 request(get, "ct/v1/get-entry-and-proof", Query) ->
+    check_valid_sth(),
     case lists:sort(Query) of
         [{"leaf_index", IndexInput}, {"tree_size", TreeSizeInput}] ->
             {Index, _} = string:to_integer(IndexInput),
@@ -94,6 +121,7 @@ request(get, "ct/v1/get-entry-and-proof", Query) ->
     end;
 
 request(get, "ct/v1/get-roots", _Query) ->
+    check_valid_sth(),
     R = [{certificates,
           [base64:encode(Der) ||
               Der <- catlfish:update_known_roots()]}],
-- 
cgit v1.1