[X] I checked the documentation and found no answer to my problem.
[X] I checked the existing issues to make sure my problem has not already been reported.
[X] I have read the code of conduct before creating this issue.
Expected Behavior
As described in the official documentation (link) the configuration yaml contains information about the certificate structure that is being used to verify authentic agents.
I expect all parameters that are configurable to be used in determining if a signature is valid or not, i.e.:
certificates that adhere to the aforementioned structure are valid &
certificates that do not meet the criteria are rejected; specifically if a certificate is expired
Current Behavior
The code does not contain verification of the not_before and not_after parameters with regards to the current date.
There is some form of signature verification to be found in the nodes go code at packages/fetchai/connections/p2p_libp2p/libp2p_node/utils/utils.go:316 but no date related comparisons take place.
Validation boundaries are checked in aea/helpers/base.py:696 so before < after is guaranteed during the certification request in the AEA but no checks occur during the actual use in the libp2p code.
(This is especially important as the certificate handling does not rely on standardised structures like x.509 certificates.)
Another point to mention is the surprising use of self signed x.509 certificates for communication between peers due to an unsupported TLS implementation in golang. This should be investigated as well: packages/fetchai/connections/p2p_libp2p/libp2p_node/dht/dhtpeer/dhtpeer.go:673
To Reproduce
Choose an arbitrary date for not_before and not_after that excludes the current date.
Prerequisites
Expected Behavior
As described in the official documentation (link) the configuration yaml contains information about the certificate structure that is being used to verify authentic agents.
I expect all parameters that are configurable to be used in determining if a signature is valid or not, i.e.:
Current Behavior
The code does not contain verification of the
not_before
andnot_after
parameters with regards to the current date.There is some form of signature verification to be found in the nodes go code at
packages/fetchai/connections/p2p_libp2p/libp2p_node/utils/utils.go:316
but no date related comparisons take place. Validation boundaries are checked inaea/helpers/base.py:696
sobefore < after
is guaranteed during the certification request in the AEA but no checks occur during the actual use in the libp2p code. (This is especially important as the certificate handling does not rely on standardised structures like x.509 certificates.)Another point to mention is the surprising use of self signed x.509 certificates for communication between peers due to an unsupported TLS implementation in golang. This should be investigated as well:
packages/fetchai/connections/p2p_libp2p/libp2p_node/dht/dhtpeer/dhtpeer.go:673
To Reproduce
Choose an arbitrary date for
not_before
andnot_after
that excludes the current date.Context
any
Failure Logs
No response