Skip to content

Certificate date parameter validation missing #2874

Description

@Archento

Prerequisites

Expected Behavior

As described in the official documentation (link) the configuration yaml contains information about the certificate structure that is being used to verify authentic agents.

cert_requests:
  identifier: acn
  ledger_id: fetchai
  not_after: '2023-01-01'
  not_before: '2022-01-01'
  public_key: fetchai
  message_format: '{public_key}'
  save_path: .certs/conn_cert.txt

I expect all parameters that are configurable to be used in determining if a signature is valid or not, i.e.:

  • certificates that adhere to the aforementioned structure are valid &
  • certificates that do not meet the criteria are rejected; specifically if a certificate is expired

Current Behavior

The code does not contain verification of the not_before and not_after parameters with regards to the current date.

There is some form of signature verification to be found in the nodes go code at packages/fetchai/connections/p2p_libp2p/libp2p_node/utils/utils.go:316 but no date related comparisons take place.
Validation boundaries are checked in aea/helpers/base.py:696 so before < after is guaranteed during the certification request in the AEA but no checks occur during the actual use in the libp2p code.
(This is especially important as the certificate handling does not rely on standardised structures like x.509 certificates.)

Another point to mention is the surprising use of self signed x.509 certificates for communication between peers due to an unsupported TLS implementation in golang. This should be investigated as well: packages/fetchai/connections/p2p_libp2p/libp2p_node/dht/dhtpeer/dhtpeer.go:673

To Reproduce

Choose an arbitrary date for not_before and not_after that excludes the current date.

Context

any

Failure Logs

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions