Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Skip tls verification when making requests to secure signer from Dataposter [NIT-2521] #2307

Merged
merged 4 commits into from
May 16, 2024
Merged

Skip tls verification when making requests to secure signer from Dataposter [NIT-2521] #2307

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
bf8f40a
Skip tls verification when making requests to secure signer from Data…
anodar May 16, 2024
761e98d
Expose InsecureSkipVerify as a flag in external signer config
anodar May 16, 2024
b8503d8
Fix flag initialization
anodar May 16, 2024
7b7159c
Keep insecureSkipVerify false by default in prod config
anodar May 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 9 additions & 2 deletions arbnode/dataposter/data_poster.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -217,6 +217,10 @@ func NewDataPoster(ctx context.Context, opts *DataPosterOpts) (*DataPoster, erro
func rpcClient(ctx context.Context, opts *ExternalSignerCfg) (*rpc.Client, error) {
tlsCfg := &tls.Config{
MinVersion: tls.VersionTLS12,
// Dataposter verifies that signed transaction was signed by the account
// that it expects to be signed with. So signer is already authenticated
// on application level and does not need to rely on TLS for authentication.
InsecureSkipVerify: opts.InsecureSkipVerify, // #nosec G402
}

if opts.ClientCert != "" && opts.ClientPrivateKey != "" {
Expand Down Expand Up @@ -1223,6 +1227,8 @@ type ExternalSignerCfg struct {
// (Optional) Client certificate key for mtls.
// This is required when client-cert is set.
ClientPrivateKey string `koanf:"client-private-key"`
// TLS config option, when enabled skips certificate verification of external signer.
InsecureSkipVerify bool `koanf:"insecure-skip-verify"`
}

type DangerousConfig struct {
Expand Down Expand Up @@ -1276,6 +1282,7 @@ func addExternalSignerOptions(prefix string, f *pflag.FlagSet) {
f.String(prefix+".root-ca", DefaultDataPosterConfig.ExternalSigner.RootCA, "external signer root CA")
f.String(prefix+".client-cert", DefaultDataPosterConfig.ExternalSigner.ClientCert, "rpc client cert")
f.String(prefix+".client-private-key", DefaultDataPosterConfig.ExternalSigner.ClientPrivateKey, "rpc client private key")
f.Bool(prefix+".insecure-skip-verify", DefaultDataPosterConfig.ExternalSigner.InsecureSkipVerify, "skip TLS certificate verification")
}

var DefaultDataPosterConfig = DataPosterConfig{
Expand All @@ -1297,7 +1304,7 @@ var DefaultDataPosterConfig = DataPosterConfig{
UseNoOpStorage: false,
LegacyStorageEncoding: false,
Dangerous: DangerousConfig{ClearDBStorage: false},
ExternalSigner: ExternalSignerCfg{Method: "eth_signTransaction"},
ExternalSigner: ExternalSignerCfg{Method: "eth_signTransaction", InsecureSkipVerify: false},
MaxFeeCapFormula: "((BacklogOfBatches * UrgencyGWei) ** 2) + ((ElapsedTime/ElapsedTimeBase) ** 2) * ElapsedTimeImportance + TargetPriceGWei",
ElapsedTimeBase: 10 * time.Minute,
ElapsedTimeImportance: 10,
Expand Down Expand Up @@ -1330,7 +1337,7 @@ var TestDataPosterConfig = DataPosterConfig{
UseDBStorage: false,
UseNoOpStorage: false,
LegacyStorageEncoding: false,
ExternalSigner: ExternalSignerCfg{Method: "eth_signTransaction"},
ExternalSigner: ExternalSignerCfg{Method: "eth_signTransaction", InsecureSkipVerify: true},
MaxFeeCapFormula: "((BacklogOfBatches * UrgencyGWei) ** 2) + ((ElapsedTime/ElapsedTimeBase) ** 2) * ElapsedTimeImportance + TargetPriceGWei",
ElapsedTimeBase: 10 * time.Minute,
ElapsedTimeImportance: 10,
Expand Down
Loading