hyperledger / fabric-x-orderer / 40630736208

85%

Build Type

push

github

Committed by web-flow

Commit Message

requestfilter: verify the TxID of every request (#1330)

* requestfilter: verify the TxID of every request (#1151)

Nothing checked the TxID of a client request, so a client could submit
a TX with an empty or arbitrary TxID. That lets junk reach the
committer, and, since consensus deduplicates config requests by the
TxID of their CONFIG_UPDATE, lets a client reuse another client's TxID
to get its config update dropped as a duplicate.

The sig filter now requires a non-empty nonce and a channel header TxID
equal to protoutil.ComputeTxID(nonce, creator). The check runs before,
and regardless of, client signature verification, for data and config
requests alike, on the router, the batcher and the consenter. Follower
consenters also check the TxID of a leader-proposed config request and
of its CONFIG_UPDATE.

The test envelope helpers now set a valid TxID, and
PrepareUnsignedEnvelope computes the data size from the marshaled
header sizes instead of a hard-coded threshold, which was already off
by one.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Yoav Tock <TOCK@il.ibm.com>

* requestfilter: address review of the TxID check

Follower consenters now verify a leader-proposed config envelope and its
LastUpdate with the consenter's sig filter, instead of only checking
their TxIDs. The LastUpdate's signature was never checked on that path,
since ProposeConfigUpdate only evaluates the admins' ConfigSignatures, so
a Byzantine leader could put another client's creator, nonce and TxID on
a config update and have that client's update dropped as a duplicate.

The TxID check returns constant errors, and rejects a TxID of the wrong
length before calling protoutil.CheckTxID, so a rejected request does
not echo its unbounded TxID into errors and logs. A SigFilter benchmark
measures the check with client signature verification off.

The perf, signed and config update test helpers use a random nonce, so
each envelope gets a unique TxID, as a comm... (continued)

Coverage Stats

75 of 79 new or added lines in 4 files covered. (94.94%)

100 existing lines in 11 files now uncovered.

18526 of 21855 relevant lines covered (84.77%)

49122.08 hits per line