Fixed TLS certs validation for consenters (release-2.2) #2005
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
wlahti
force-pushed
the
fab-18192-release-2.2
branch
from
ef5d318
to
f562ae9
Compare
* FAB-18192 Fixed TLS certs validation for consenters. Verification of TLS cert against simulated config, not the last one. To achieve that, metadata validator interface was changed, now it requires orderer config instead of just consensus metadata. Also, TLS verification was moved to VerifyMetadata function, it shouldn't have been part of ComputeMembershipChanges. Fixed tests. Signed-off-by: Vladyslav Kopaihorodskyi <vlad.kopaygorodsky@gmail.com>
FAB-18192 Signed-off-by: Will Lahti <wtlahti@us.ibm.com>
It was accidentally verifying only the clientCert and not the cert that was passed in. FAB-18269 Signed-off-by: Will Lahti <wtlahti@us.ibm.com>
wlahti
force-pushed
the
fab-18192-release-2.2
branch
from
f562ae9
to
05e1791
Compare
Signed-off-by: Will Lahti <wtlahti@us.ibm.com>
wlahti
force-pushed
the
fab-18192-release-2.2
branch
from
fda3d1a
to
c032d47
Compare
mastersingh24
approved these changes
Oct 14, 2020
There was a problem hiding this comment.
This looks ok to me, but maybe @jyellick can take a quick look as well.
jyellick
approved these changes
Oct 14, 2020
Yes, it was merged yesterday. Thanks, Gari and Jason! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Type of change
Description
First commit:
Verification of consenter's TLS certs against simulated config, not the last one. To achieve that, metadata validator interface was changed, now it requires orderer config instead of just consensus metadata. Also, TLS verification was moved to VerifyConfigMetadata function. Added ignoreCertExpiration option to ignore expiration errors when validating config metadata.
Second commit:
Third commit:
Related issues
FAB-18192
FAB-18269