You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
As described in the official documentation (link) the configuration yaml contains information about the certificate structure that is being used to verify authentic agents.
I expect all parameters that are configurable to be used in determining if a signature is valid or not, i.e.:
certificates that adhere to the aforementioned structure are valid &
certificates that do not meet the criteria are rejected; specifically if a certificate is expired
Current Behavior
The code does not contain verification of the not_before and not_after parameters with regards to the current date.
There is some form of signature verification to be found in the nodes go code at packages/fetchai/connections/p2p_libp2p/libp2p_node/utils/utils.go:316 but no date related comparisons take place.
Validation boundaries are checked in aea/helpers/base.py:696 so before < after is guaranteed during the certification request in the AEA but no checks occur during the actual use in the libp2p code.
(This is especially important as the certificate handling does not rely on standardised structures like x.509 certificates.)
Another point to mention is the surprising use of self signed x.509 certificates for communication between peers due to an unsupported TLS implementation in golang. This should be investigated as well: packages/fetchai/connections/p2p_libp2p/libp2p_node/dht/dhtpeer/dhtpeer.go:673
To Reproduce
Choose an arbitrary date for not_before and not_after that excludes the current date.
Context
any
Failure Logs
No response
The text was updated successfully, but these errors were encountered:
Prerequisites
Expected Behavior
As described in the official documentation (link) the configuration yaml contains information about the certificate structure that is being used to verify authentic agents.
I expect all parameters that are configurable to be used in determining if a signature is valid or not, i.e.:
Current Behavior
The code does not contain verification of the
not_before
andnot_after
parameters with regards to the current date.There is some form of signature verification to be found in the nodes go code at
packages/fetchai/connections/p2p_libp2p/libp2p_node/utils/utils.go:316
but no date related comparisons take place.Validation boundaries are checked in
aea/helpers/base.py:696
sobefore < after
is guaranteed during the certification request in the AEA but no checks occur during the actual use in the libp2p code.(This is especially important as the certificate handling does not rely on standardised structures like x.509 certificates.)
Another point to mention is the surprising use of self signed x.509 certificates for communication between peers due to an unsupported TLS implementation in golang. This should be investigated as well:
packages/fetchai/connections/p2p_libp2p/libp2p_node/dht/dhtpeer/dhtpeer.go:673
To Reproduce
Choose an arbitrary date for
not_before
andnot_after
that excludes the current date.Context
any
Failure Logs
No response
The text was updated successfully, but these errors were encountered: