Skip to content

Commit 9abe0ab

Browse files
ellemoutonellemouton
authored
Merge pull request #1043 from ellemouton/sql31
[sql-31] firewalldb: Privacy Mapper schemas, queries and CRUD
2 parents b0230d4 + b9ad664 commit 9abe0ab

19 files changed

+381
-47
lines changed

‎db/migrations.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ const (
2222
// daemon.
2323
//
2424
// NOTE: This MUST be updated when a new migration is added.
25-
LatestMigrationVersion = 3
25+
LatestMigrationVersion = 4
2626
)
2727

2828
// MigrationTarget is a functional option that can be passed to applyMigrations

‎db/sqlc/migrations/000004_privacy_pairs.down.sql

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
DROP INDEX IF EXISTS privacy_pairs_group_id_idx;
2+
DROP INDEX IF EXISTS privacy_pairs_unique_real;
3+
DROP INDEX IF EXISTS privacy_pairs_unique_pseudo;
4+
DROP TABLE IF EXISTS privacy_pairs;

‎db/sqlc/migrations/000004_privacy_pairs.up.sql

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
-- privacy_pairs stores the privacy map pairs for a given session group.
2+
CREATE TABLE IF NOT EXISTS privacy_pairs (
3+
-- The group ID of the session that this privacy pair is associated
4+
-- with.
5+
group_id BIGINT NOT NULL REFERENCES sessions(id) ON DELETE CASCADE,
6+
7+
-- The real value of the privacy pair.
8+
real_val TEXT NOT NULL,
9+
10+
-- The pseudo value of the privacy pair.
11+
pseudo_val TEXT NOT NULL
12+
);
13+
14+
-- There should be no duplicate real values for a given group ID.
15+
CREATE UNIQUE INDEX privacy_pairs_unique_real ON privacy_pairs (
16+
group_id, real_val
17+
);
18+
19+
-- There should be no duplicate pseudo values for a given group ID.
20+
CREATE UNIQUE INDEX privacy_pairs_unique_pseudo ON privacy_pairs (
21+
group_id, pseudo_val
22+
);
23+

‎db/sqlc/models.go

+6
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎db/sqlc/privacy_paris.sql.go

+96
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎db/sqlc/querier.go

+4
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎db/sqlc/queries/privacy_paris.sql

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
-- name: InsertPrivacyPair :exec
2+
INSERT INTO privacy_pairs (group_id, real_val, pseudo_val)
3+
VALUES ($1, $2, $3);
4+
5+
-- name: GetRealForPseudo :one
6+
SELECT real_val
7+
FROM privacy_pairs
8+
WHERE group_id = $1 AND pseudo_val = $2;
9+
10+
-- name: GetPseudoForReal :one
11+
SELECT pseudo_val
12+
FROM privacy_pairs
13+
WHERE group_id = $1 AND real_val = $2;
14+
15+
-- name: GetAllPrivacyPairs :many
16+
SELECT real_val, pseudo_val
17+
FROM privacy_pairs
18+
WHERE group_id = $1;

‎firewall/privacy_mapper.go

+5-5
Original file line numberDiff line numberDiff line change
@@ -60,19 +60,19 @@ var _ mid.RequestInterceptor = (*PrivacyMapper)(nil)
6060
// PrivacyMapper is a RequestInterceptor that maps any pseudo names in certain
6161
// requests to their real values and vice versa for responses.
6262
type PrivacyMapper struct {
63-
newDB firewalldb.NewPrivacyMapDB
63+
db firewalldb.PrivacyMapper
6464
randIntn func(int) (int, error)
6565
sessionDB firewalldb.SessionDB
6666
}
6767

6868
// NewPrivacyMapper returns a new instance of PrivacyMapper. The randIntn
6969
// function is used to draw randomness for request field obfuscation.
70-
func NewPrivacyMapper(newDB firewalldb.NewPrivacyMapDB,
70+
func NewPrivacyMapper(newDB firewalldb.PrivacyMapper,
7171
randIntn func(int) (int, error),
7272
sessionDB firewalldb.SessionDB) *PrivacyMapper {
7373

7474
return &PrivacyMapper{
75-
newDB: newDB,
75+
db: newDB,
7676
randIntn: randIntn,
7777
sessionDB: sessionDB,
7878
}
@@ -195,7 +195,7 @@ func (p *PrivacyMapper) checkAndReplaceIncomingRequest(ctx context.Context,
195195
return nil, err
196196
}
197197

198-
db := p.newDB(session.GroupID)
198+
db := p.db.PrivacyDB(session.GroupID)
199199

200200
// If we don't have a handler for the URI, we don't allow the request
201201
// to go through.
@@ -225,7 +225,7 @@ func (p *PrivacyMapper) replaceOutgoingResponse(ctx context.Context, uri string,
225225
return nil, err
226226
}
227227

228-
db := p.newDB(session.GroupID)
228+
db := p.db.PrivacyDB(session.GroupID)
229229

230230
// If we don't have a handler for the URI, we don't allow the response
231231
// to go to avoid accidental leaks.

‎firewall/privacy_mapper_test.go

+6-6
Original file line numberDiff line numberDiff line change
@@ -902,7 +902,7 @@ func TestPrivacyMapper(t *testing.T) {
902902

903903
// randIntn is used for deterministic testing.
904904
randIntn := func(n int) (int, error) { return 100, nil }
905-
p := NewPrivacyMapper(db.NewSessionDB, randIntn, pd)
905+
p := NewPrivacyMapper(db, randIntn, pd)
906906

907907
rawMsg, err := proto.Marshal(test.msg)
908908
require.NoError(t, err)
@@ -978,7 +978,7 @@ func TestPrivacyMapper(t *testing.T) {
978978
rawMsg, err := proto.Marshal(msg)
979979
require.NoError(t, err)
980980

981-
p := NewPrivacyMapper(db.NewSessionDB, CryptoRandIntn, pd)
981+
p := NewPrivacyMapper(db, CryptoRandIntn, pd)
982982
require.NoError(t, err)
983983

984984
// We test the independent outgoing amount (incoming amount
@@ -1071,7 +1071,7 @@ func newMockDB(t *testing.T, preloadRealToPseudo map[string]string,
10711071
sessID session.ID) mockDB {
10721072

10731073
db := mockDB{privDB: make(map[string]*mockPrivacyMapDB)}
1074-
sessDB := db.NewSessionDB(sessID)
1074+
sessDB := db.PrivacyDB(sessID)
10751075

10761076
_ = sessDB.Update(context.Background(), func(ctx context.Context,
10771077
tx firewalldb.PrivacyMapTx) error {
@@ -1085,14 +1085,14 @@ func newMockDB(t *testing.T, preloadRealToPseudo map[string]string,
10851085
return db
10861086
}
10871087

1088-
func (m mockDB) NewSessionDB(sessionID session.ID) firewalldb.PrivacyMapDB {
1089-
db, ok := m.privDB[string(sessionID[:])]
1088+
func (m mockDB) PrivacyDB(groupID session.ID) firewalldb.PrivacyMapDB {
1089+
db, ok := m.privDB[string(groupID[:])]
10901090
if ok {
10911091
return db
10921092
}
10931093

10941094
newDB := newMockPrivacyMapDB()
1095-
m.privDB[string(sessionID[:])] = newDB
1095+
m.privDB[string(groupID[:])] = newDB
10961096

10971097
return newDB
10981098
}

‎firewall/rule_enforcer.go

+4-4
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ type RuleEnforcer struct {
3333
actionsDB firewalldb.ActionReadDBGetter
3434
sessionDB firewalldb.SessionDB
3535
markActionErrored func(reqID uint64, reason string) error
36-
newPrivMap firewalldb.NewPrivacyMapDB
36+
privMapDB firewalldb.PrivacyMapper
3737

3838
permsMgr *perms.Manager
3939
getFeaturePerms featurePerms
@@ -64,7 +64,7 @@ func NewRuleEnforcer(ruleDB firewalldb.RulesDB,
6464
lndClient lndclient.LightningClient, lndConnID string,
6565
ruleMgrs rules.ManagerSet,
6666
markActionErrored func(reqID uint64, reason string) error,
67-
privMap firewalldb.NewPrivacyMapDB) *RuleEnforcer {
67+
privMap firewalldb.PrivacyMapper) *RuleEnforcer {
6868

6969
return &RuleEnforcer{
7070
ruleDB: ruleDB,
@@ -76,7 +76,7 @@ func NewRuleEnforcer(ruleDB firewalldb.RulesDB,
7676
lndClient: lndClient,
7777
ruleMgrs: ruleMgrs,
7878
markActionErrored: markActionErrored,
79-
newPrivMap: privMap,
79+
privMapDB: privMap,
8080
sessionDB: sessionIDIndex,
8181
lndConnID: lndConnID,
8282
}
@@ -392,7 +392,7 @@ func (r *RuleEnforcer) initRule(ctx context.Context, reqID uint64, name string,
392392
}
393393

394394
if privacy {
395-
privMap := r.newPrivMap(session.GroupID)
395+
privMap := r.privMapDB.PrivacyDB(session.GroupID)
396396

397397
ruleValues, err = ruleValues.PseudoToReal(
398398
ctx, privMap, session.PrivacyFlags,

‎firewalldb/db.go

+11-4
Original file line numberDiff line numberDiff line change
@@ -14,21 +14,28 @@ var (
1414
ErrNoSuchKeyFound = fmt.Errorf("no such key found")
1515
)
1616

17+
// firewallDBs is an interface that groups the RulesDB and PrivacyMapper
18+
// interfaces.
19+
type firewallDBs interface {
20+
RulesDB
21+
PrivacyMapper
22+
}
23+
1724
// DB manages the firewall rules database.
1825
type DB struct {
1926
started sync.Once
2027
stopped sync.Once
2128

22-
RulesDB
29+
firewallDBs
2330

2431
cancel fn.Option[context.CancelFunc]
2532
}
2633

2734
// NewDB creates a new firewall database. For now, it only contains the
28-
// underlying rules' database.
29-
func NewDB(kvdb RulesDB) *DB {
35+
// underlying rules' and privacy mapper databases.
36+
func NewDB(dbs firewallDBs) *DB {
3037
return &DB{
31-
RulesDB: kvdb,
38+
firewallDBs: dbs,
3239
}
3340
}
3441

‎firewalldb/interface.go

+8
Original file line numberDiff line numberDiff line change
@@ -92,3 +92,11 @@ type RulesDB interface {
9292
// DeleteTempKVStores deletes all temporary kv stores.
9393
DeleteTempKVStores(ctx context.Context) error
9494
}
95+
96+
// PrivacyMapper is an interface that abstracts access to the privacy mapper
97+
// database.
98+
type PrivacyMapper interface {
99+
// PrivacyDB constructs a PrivacyMapDB that will be indexed under the
100+
// given group ID key.
101+
PrivacyDB(groupID session.ID) PrivacyMapDB
102+
}

‎firewalldb/privacy_mapper.go

-6
Original file line numberDiff line numberDiff line change
@@ -11,8 +11,6 @@ import (
1111
"strconv"
1212
"strings"
1313
"sync"
14-
15-
"github.com/lightninglabs/lightning-terminal/session"
1614
)
1715

1816
var (
@@ -29,10 +27,6 @@ var (
2927
"value already exists")
3028
)
3129

32-
// NewPrivacyMapDB is a function type that takes a group ID and uses it to
33-
// construct a new PrivacyMapDB.
34-
type NewPrivacyMapDB func(groupID session.ID) PrivacyMapDB
35-
3630
// PrivacyMapDB provides an Update and View method that will allow the caller
3731
// to perform atomic read and write transactions defined by PrivacyMapTx on the
3832
// underlying DB.

‎firewalldb/privacy_mapper_kvdb.go

+2
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,8 @@ var (
3030

3131
// PrivacyDB constructs a PrivacyMapDB that will be indexed under the given
3232
// group ID key.
33+
//
34+
// NOTE: this is part of the PrivacyMapper interface.
3335
func (db *BoltDB) PrivacyDB(groupID session.ID) PrivacyMapDB {
3436
return &kvdbExecutor[PrivacyMapTx]{
3537
db: db.DB,

0 commit comments

Comments
 (0)