@cryptotaxi247 / kubo / commits / 118ecb22c

remove new DHT record author check

We're going to just fix this a future commit. *This* change breaks publishing IPNS records using alternative IPNS keys (because the author signature (peer ID) differs from the record signature). We're going to fix it by validating the IPNS signature and ditching the author/signature fields. License: MIT Signed-off-by: Steven Allen <steven@stebalien.com>

Steven Allen committed Jan 26, 2018 at 00:33 UTC 118ecb22cda4b9957cec77ec9bf805fc56b45768
2 files changed +21 -16
namesys/ipns_validate_test.go
+3 -1
@@ -16,7 +16,7 @@ import (
16 func TestValidation(t *testing.T) {
17 // Create a record validator
18 validator := make(record.Validator)
19 - validator["ipns"] = &record.ValidChecker{ValidateIpnsRecord, true}
19 + validator["ipns"] = &record.ValidChecker{Func: ValidateIpnsRecord, Sign: true}
20
21 // Generate a key for signing the records
22 r := u.NewSeededRand(15) // generate deterministic keypair
@@ -46,6 +46,7 @@ func TestValidation(t *testing.T) {
46 t.Fatal(err)
47 }
48
49 + /* TODO(#4613)
50 // Create IPNS record path with a different private key
51 _, ipnsWrongAuthor := genKeys(t, r)
52 wrongAuthorRec, err := record.MakePutRecord(priv, ipnsWrongAuthor, val, true)
@@ -97,6 +98,7 @@ func TestValidation(t *testing.T) {
98 if err != ErrInvalidAuthor {
99 t.Fatal("ValidateIpnsRecord should have returned ErrInvalidAuthor")
100 }
101 + */
102
103 // Create expired entry
104 expiredEntry, err := CreateRoutingEntryData(priv, path.Path("foo"), 1, ts.Add(-1*time.Hour))
namesys/publisher.go
+18 -15
@@ -31,10 +31,6 @@ var ErrExpiredRecord = errors.New("expired record")
31 // unknown validity type.
32 var ErrUnrecognizedValidity = errors.New("unrecognized validity type")
33
34 -// ErrInvalidAuthor is returned when an IpnsRecord has an
35 -// author that does not match the IPNS path
36 -var ErrInvalidAuthor = errors.New("author does not match path")
37 -
34 // ErrInvalidPath should be returned when an ipns record path
35 // is not in a valid format
36 var ErrInvalidPath = errors.New("record path invalid")
@@ -314,17 +310,24 @@ func ValidateIpnsRecord(r *record.ValidationRecord) error {
310 return err
311 }
312
317 - // Note: The DHT will actually check the signature so we don't
318 - // need to do that here
319 -
320 - // Author in key must match author in record
321 - pid, err := peer.IDFromString(r.Key)
322 - if err != nil {
323 - return ErrInvalidAuthor
324 - }
325 - if pid != r.Author {
326 - return ErrInvalidAuthor
327 - }
313 + // NOTE/FIXME(#4613): We're not checking the DHT signature/author here.
314 + // We're going to remove them in a followup commit and then check the
315 + // *IPNS* signature. However, to do that, we need to ensure we *have*
316 + // the public key and:
317 + //
318 + // 1. Don't want to fetch it from the network when handling PUTs.
319 + // 2. Do want to fetch it from the network when handling GETs.
320 + //
321 + // Therefore, we'll need to either:
322 + //
323 + // 1. Pass some for of offline hint to the validator (e.g., using a context).
324 + // 2. Ensure we pre-fetch the key when performing gets.
325 + //
326 + // This PR is already *way* too large so we're punting that fix to a new
327 + // PR.
328 + //
329 + // This is not a regression, it just restores the current (bad)
330 + // behavior.
331
332 // Check that record has not expired
333 switch entry.GetValidityType() {