Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

FAB-18192 Fixed TLS certs validation for consenters. (bp #1888) #1971

Closed
wants to merge 1 commit into from
Closed

FAB-18192 Fixed TLS certs validation for consenters. (bp #1888) #1971

wants to merge 1 commit into from

Conversation

mergify[bot]
Copy link

@mergify mergify bot commented Oct 6, 2020

This is an automated backport of pull request #1888 done by Mergify

Cherry-pick of 886d3cc has failed:

On branch mergify/bp/release-2.2/pr-1888
Your branch is up to date with 'origin/release-2.2'.

You are currently cherry-picking commit 886d3cc55.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:

	modified:   integration/raft/config_test.go
	modified:   orderer/common/msgprocessor/mocks/metadata_validator.go
	modified:   orderer/common/msgprocessor/systemchannel.go
	modified:   orderer/common/msgprocessor/systemchannelfilter.go
	modified:   orderer/common/multichannel/chainsupport.go
	modified:   orderer/consensus/consensus.go
	modified:   orderer/consensus/etcdraft/chain.go
	modified:   orderer/consensus/etcdraft/chain_test.go
	modified:   orderer/consensus/etcdraft/membership.go
	modified:   orderer/consensus/etcdraft/membership_test.go
	new file:   orderer/consensus/etcdraft/testdata/consenters_certs/ca1/ca.pem
	new file:   orderer/consensus/etcdraft/testdata/consenters_certs/ca1/client1.pem
	new file:   orderer/consensus/etcdraft/testdata/consenters_certs/ca1/client1_pk.pem
	new file:   orderer/consensus/etcdraft/testdata/consenters_certs/ca1/client2.pem
	new file:   orderer/consensus/etcdraft/testdata/consenters_certs/ca1/client2_pk.pem
	new file:   orderer/consensus/etcdraft/testdata/consenters_certs/ca1/client3.pem
	new file:   orderer/consensus/etcdraft/testdata/consenters_certs/ca1/client3_pk.pem
	new file:   orderer/consensus/etcdraft/testdata/consenters_certs/ca2/ca.pem
	new file:   orderer/consensus/etcdraft/testdata/consenters_certs/ca2/client.pem
	new file:   orderer/consensus/etcdraft/testdata/consenters_certs/ca2/client_pk.pem
	modified:   orderer/consensus/etcdraft/util.go
	modified:   orderer/consensus/etcdraft/validator_test.go

Unmerged paths:
  (use "git add <file>..." to mark resolution)

	both modified:   orderer/common/msgprocessor/systemchannelfilter_test.go
	both modified:   orderer/common/multichannel/chainsupport_test.go
	both modified:   orderer/consensus/etcdraft/consenter.go
	both modified:   orderer/consensus/etcdraft/consenter_test.go
	both modified:   orderer/consensus/etcdraft/util_test.go

To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

Mergify commands and options

More conditions and actions can be found in the documentation.

You can also trigger Mergify actions by commenting on this pull request:

  • @Mergifyio refresh will re-evaluate the rules
  • @Mergifyio rebase will rebase this PR on its base branch
  • @Mergifyio update will merge the base branch into this PR
  • @Mergifyio backport <destination> will backport this PR on <destination> branch

Additionally, on Mergify dashboard you can:

  • look at your merge queues
  • generate the Mergify configuration with the config editor.

Finally, you can contact us on https://mergify.io/

@kopaygorodsky
FAB-18192 Fixed TLS certs validation for consenters. (#1888)
3b1a78d 
* FAB-18192 Fixed TLS certs validation for consenters.
Verification of TLS cert against simulated config, not the last one. To achieve that, metadata validator interface was changed, now it requires orderer config instead of just consensus metadata. Also, TLS verification was moved to VerifyMetadata function, it shouldn't have been part of ComputeMembershipChanges. Fixed tests.

Signed-off-by: kopaygorodsky <vlad.kopaygorodsky@gmail.com>

* fixed consenters tests

Signed-off-by: kopaygorodsky <vlad.kopaygorodsky@gmail.com>

* modified VerifyConfigMetadata with ignoreCertExpiration option

Signed-off-by: kopaygorodsky <vlad.kopaygorodsky@gmail.com>

* generation of verifying options based only on simulated config, fixes

Signed-off-by: kopaygorodsky <vlad.kopaygorodsky@gmail.com>

* fixed consenters map

Signed-off-by: kopaygorodsky <vlad.kopaygorodsky@gmail.com>

* Removed ignoreCertExpiration option from VerifyConfigMetadata, certs expiration is checked only on new consenters.
Improved tests.

Signed-off-by: kopaygorodsky <vlad.kopaygorodsky@gmail.com>
(cherry picked from commit 886d3cc)

# Conflicts:
#	orderer/common/msgprocessor/systemchannelfilter_test.go
#	orderer/common/multichannel/chainsupport_test.go
#	orderer/consensus/etcdraft/consenter.go
#	orderer/consensus/etcdraft/consenter_test.go
#	orderer/consensus/etcdraft/util_test.go
@mergify mergify bot requested a review from a team as a code owner October 6, 2020 17:24
@mergify mergify bot added the conflicts label Oct 6, 2020
@mergify mergify bot mentioned this pull request Oct 6, 2020
Merged
@wlahti
Copy link
Contributor

wlahti commented Oct 12, 2020

I'm working on a manual backport for this since the mergify backport won't work. We can abandon this PR.

@lindluni lindluni closed this Oct 13, 2020
@mergify mergify bot deleted the mergify/bp/release-2.2/pr-1888 branch October 13, 2020 15:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
conflicts
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@wlahti @lindluni @kopaygorodsky