Fixed TLS certs validation for consenters (release-2.2) - #2005
Merged
Conversation
wlahti
marked this pull request as draft
October 12, 2020 19:39
wlahti
force-pushed
the
fab-18192-release-2.2
branch
from
October 12, 2020 21:20
ef5d318 to
f562ae9
Compare
* FAB-18192 Fixed TLS certs validation for consenters. Verification of TLS cert against simulated config, not the last one. To achieve that, metadata validator interface was changed, now it requires orderer config instead of just consensus metadata. Also, TLS verification was moved to VerifyMetadata function, it shouldn't have been part of ComputeMembershipChanges. Fixed tests. Signed-off-by: Vladyslav Kopaihorodskyi <vlad.kopaygorodsky@gmail.com>
FAB-18192 Signed-off-by: Will Lahti <wtlahti@us.ibm.com>
It was accidentally verifying only the clientCert and not the cert that was passed in. FAB-18269 Signed-off-by: Will Lahti <wtlahti@us.ibm.com>
wlahti
force-pushed
the
fab-18192-release-2.2
branch
from
October 12, 2020 21:22
f562ae9 to
05e1791
Compare
wlahti
marked this pull request as ready for review
October 12, 2020 21:33
Signed-off-by: Will Lahti <wtlahti@us.ibm.com>
wlahti
force-pushed
the
fab-18192-release-2.2
branch
from
October 13, 2020 15:32
fda3d1a to
c032d47
Compare
mastersingh24
approved these changes
Oct 14, 2020
mastersingh24
left a comment
mastersingh24
left a comment
Contributor
There was a problem hiding this comment.
This looks ok to me, but maybe @jyellick can take a quick look as well.
jyellick
approved these changes
Oct 14, 2020
jyellick
left a comment
jyellick
left a comment
Contributor
There was a problem hiding this comment.
Looks good to me -- is this last commit already forward ported to master?
Contributor
Author
Yes, it was merged yesterday. Thanks, Gari and Jason! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Type of change
Description
First commit:
Verification of consenter's TLS certs against simulated config, not the last one. To achieve that, metadata validator interface was changed, now it requires orderer config instead of just consensus metadata. Also, TLS verification was moved to VerifyConfigMetadata function. Added ignoreCertExpiration option to ignore expiration errors when validating config metadata.
Second commit:
Third commit:
Related issues
FAB-18192
FAB-18269