Skip to content

Conversation

@DorKatzelnick
Copy link
Contributor

  • add consnter info to router config
  • add router info to consenter config
  • router's certificate pinning in SubmitConfig
  • add configSubmitter to router, without forwarding config requests

issue: #192

config/config.go Outdated
panic(fmt.Sprintf("Failed marshaling consenter public key: %v", err))
routerInfo := nodeconfig.RouterInfo{
PartyID: partyID,
Endpoint: routerConfig.Host + ":" + strconv.Itoa(int(routerConfig.Port)),
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This trick will not work well with IPv6.

To construct a string from an IP address and port in Go, the net.JoinHostPort function is the recommended approach. This function correctly handles various IP address formats, including IPv6, and ensures the proper formatting of the "host:port" string.


// compare the two certificates
if !bytes.Equal(pemBlock.Bytes, cert.Raw) {
return fmt.Errorf("error: access denied. The client certificate does not match the router's certificate")
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here, because it is a config or security problem, log the details of the offending incoming cert, in human readable format as well as raw. This may help correct the issue.

// send error to the client
s.responseToClientWithError(tr, fmt.Errorf("request verification error: %s", err))
} else {
// TODO - if request is config, forward it to the consenter using configSubmitter
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is unrelated to the current PR, but an early return approach in the if is more readable and preferrable in Go. That is,

if err := s.verifier.Verify(tr.request); err != nil {
				s.logger.Debugf("request is invalid: %s", err)
				// send error to the client
				s.responseToClientWithError(tr, fmt.Errorf("request verification error: %s", err))
                continue
}

... code for no err==nil

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

next PR will address this code

@DorKatzelnick DorKatzelnick force-pushed the configSubmitter2 branch 2 times, most recently from f202ac5 to 1b1ec73 Compare October 29, 2025 14:15
add router info to consenter config
router's certificate pinning in SubmitConfig
add configSubmitter to router, without forwarding config requests

Signed-off-by: Dor.Katzelnick <Dor.Katzelnick@ibm.com>
@tock-ibm tock-ibm merged commit 351f01a into hyperledger:main Oct 30, 2025
7 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants