Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Certificate date parameter validation missing #2874

Open
4 tasks done
Archento opened this issue Feb 16, 2023 · 0 comments
Open
4 tasks done

Certificate date parameter validation missing #2874

Archento opened this issue Feb 16, 2023 · 0 comments
Labels
bug Something isn't working

Comments

@Archento
Copy link
Member

Prerequisites

Expected Behavior

As described in the official documentation (link) the configuration yaml contains information about the certificate structure that is being used to verify authentic agents.

cert_requests:
  identifier: acn
  ledger_id: fetchai
  not_after: '2023-01-01'
  not_before: '2022-01-01'
  public_key: fetchai
  message_format: '{public_key}'
  save_path: .certs/conn_cert.txt

I expect all parameters that are configurable to be used in determining if a signature is valid or not, i.e.:

  • certificates that adhere to the aforementioned structure are valid &
  • certificates that do not meet the criteria are rejected; specifically if a certificate is expired

Current Behavior

The code does not contain verification of the not_before and not_after parameters with regards to the current date.

There is some form of signature verification to be found in the nodes go code at packages/fetchai/connections/p2p_libp2p/libp2p_node/utils/utils.go:316 but no date related comparisons take place.
Validation boundaries are checked in aea/helpers/base.py:696 so before < after is guaranteed during the certification request in the AEA but no checks occur during the actual use in the libp2p code.
(This is especially important as the certificate handling does not rely on standardised structures like x.509 certificates.)

Another point to mention is the surprising use of self signed x.509 certificates for communication between peers due to an unsupported TLS implementation in golang. This should be investigated as well: packages/fetchai/connections/p2p_libp2p/libp2p_node/dht/dhtpeer/dhtpeer.go:673

To Reproduce

Choose an arbitrary date for not_before and not_after that excludes the current date.

Context

any

Failure Logs

No response

@Archento Archento added the bug Something isn't working label Feb 16, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant