fetchai / agents-aea

A framework for autonomous economic agent (AEA) development
https://docs.fetch.ai/aea/
Apache License 2.0
196 stars 61 forks source link

Certificate date parameter validation missing #2874

Open Archento opened 1 year ago

Archento commented 1 year ago

Prerequisites

Expected Behavior

As described in the official documentation (link) the configuration yaml contains information about the certificate structure that is being used to verify authentic agents.

cert_requests:
  identifier: acn
  ledger_id: fetchai
  not_after: '2023-01-01'
  not_before: '2022-01-01'
  public_key: fetchai
  message_format: '{public_key}'
  save_path: .certs/conn_cert.txt

I expect all parameters that are configurable to be used in determining if a signature is valid or not, i.e.:

Current Behavior

The code does not contain verification of the not_before and not_after parameters with regards to the current date.

There is some form of signature verification to be found in the nodes go code at packages/fetchai/connections/p2p_libp2p/libp2p_node/utils/utils.go:316 but no date related comparisons take place. Validation boundaries are checked in aea/helpers/base.py:696 so before < after is guaranteed during the certification request in the AEA but no checks occur during the actual use in the libp2p code. (This is especially important as the certificate handling does not rely on standardised structures like x.509 certificates.)

Another point to mention is the surprising use of self signed x.509 certificates for communication between peers due to an unsupported TLS implementation in golang. This should be investigated as well: packages/fetchai/connections/p2p_libp2p/libp2p_node/dht/dhtpeer/dhtpeer.go:673

To Reproduce

Choose an arbitrary date for not_before and not_after that excludes the current date.

Context

any

Failure Logs

No response