Skip to content
This repository was archived by the owner on Apr 25, 2025. It is now read-only.

Commit 9ef508f

Browse files
sudeshrshettysudeshrshetty
committed
[FAB-10417] endpointconfig TLS client certs preload
- preloading tls client certs in endpoint config - Fixed TLSConfig.TLSCert() not to throw status error for empty certs, instead of new bool argument will be returned Change-Id: I39a540aa2f09398eff06b80f704f5a19dd7a0168 Signed-off-by: Sudesh Shetty <sudesh.shetty@securekey.com>
1 parent df181da commit 9ef508f

File tree

20 files changed

+210
-253
lines changed

20 files changed

+210
-253
lines changed

‎pkg/common/providers/fab/provider.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ type EndpointConfig interface {
8181
ChannelOrderers(name string) ([]OrdererConfig, bool)
8282
TLSCACertPool(certConfig ...*x509.Certificate) (*x509.CertPool, error)
8383
EventServiceType() EventServiceType
84-
TLSClientCerts() ([]tls.Certificate, error)
84+
TLSClientCerts() []tls.Certificate
8585
CryptoConfigPath() string
8686
}
8787

‎pkg/common/providers/test/mockfab/mockconfig.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,7 @@ func DefaultMockConfig(mockCtrl *gomock.Controller) *MockEndpointConfig {
3939
config.EXPECT().TLSCACertPool(BadCert).Return(CertPool, errors.New(ErrorMessage)).AnyTimes()
4040
config.EXPECT().TLSCACertPool().Return(CertPool, nil).AnyTimes()
4141
config.EXPECT().Timeout(fab.EndorserConnection).Return(time.Second * 5).AnyTimes()
42-
config.EXPECT().TLSClientCerts().Return([]tls.Certificate{TLSCert}, nil).AnyTimes()
42+
config.EXPECT().TLSClientCerts().Return([]tls.Certificate{TLSCert}).AnyTimes()
4343

4444
return config
4545
}
@@ -52,7 +52,7 @@ func BadTLSClientMockConfig(mockCtrl *gomock.Controller) *MockEndpointConfig {
5252
config.EXPECT().TLSCACertPool(BadCert).Return(CertPool, errors.New(ErrorMessage)).AnyTimes()
5353
config.EXPECT().TLSCACertPool().Return(CertPool, nil).AnyTimes()
5454
config.EXPECT().Timeout(fab.EndorserConnection).Return(time.Second * 5).AnyTimes()
55-
config.EXPECT().TLSClientCerts().Return(nil, errors.Errorf(ErrorMessage)).AnyTimes()
55+
config.EXPECT().TLSClientCerts().Return(nil).AnyTimes()
5656

5757
return config
5858
}

‎pkg/common/providers/test/mockfab/mockfab.gen.go‎

Lines changed: 2 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/core/config/comm/comm.go‎

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ import (
1313

1414
cutil "github.com/hyperledger/fabric-sdk-go/internal/github.com/hyperledger/fabric/common/util"
1515
"github.com/hyperledger/fabric-sdk-go/pkg/common/providers/fab"
16-
"github.com/pkg/errors"
1716
)
1817

1918
// TLSConfig returns the appropriate config for TLS including the root CAs,
@@ -35,18 +34,13 @@ func TLSConfig(cert *x509.Certificate, serverName string, config fab.EndpointCon
3534
return nil, err
3635
}
3736

38-
clientCerts, err := config.TLSClientCerts()
39-
if err != nil {
40-
return nil, errors.Errorf("Error loading cert/key pair for TLS client credentials: %s", err)
41-
}
42-
43-
return &tls.Config{RootCAs: tlsCaCertPool, Certificates: clientCerts, ServerName: serverName}, nil
37+
return &tls.Config{RootCAs: tlsCaCertPool, Certificates: config.TLSClientCerts(), ServerName: serverName}, nil
4438
}
4539

4640
// TLSCertHash is a utility method to calculate the SHA256 hash of the configured certificate (for usage in channel headers)
4741
func TLSCertHash(config fab.EndpointConfig) []byte {
48-
certs, err := config.TLSClientCerts()
49-
if err != nil || len(certs) == 0 {
42+
certs := config.TLSClientCerts()
43+
if len(certs) == 0 {
5044
return nil
5145
}
5246

‎pkg/core/config/comm/comm_test.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ func TestTLSConfigErrorFromClientCerts(t *testing.T) {
4343

4444
config := mockfab.BadTLSClientMockConfig(mockCtrl)
4545

46-
_, err := TLSConfig(mockfab.GoodCert, "", config)
46+
_, err := TLSConfig(mockfab.BadCert, "", config)
4747

4848
if err == nil {
4949
t.Fatal("Expected failure from loading client certs")
@@ -89,7 +89,7 @@ func TestNoTlsCertHash(t *testing.T) {
8989
defer mockCtrl.Finish()
9090
config := mockfab.NewMockEndpointConfig(mockCtrl)
9191

92-
config.EXPECT().TLSClientCerts().Return([]tls.Certificate{}, nil)
92+
config.EXPECT().TLSClientCerts().Return([]tls.Certificate{})
9393

9494
tlsCertHash := TLSCertHash(config)
9595

@@ -104,7 +104,7 @@ func TestEmptyTlsCertHash(t *testing.T) {
104104
config := mockfab.NewMockEndpointConfig(mockCtrl)
105105

106106
emptyCert := tls.Certificate{}
107-
config.EXPECT().TLSClientCerts().Return([]tls.Certificate{emptyCert}, nil)
107+
config.EXPECT().TLSClientCerts().Return([]tls.Certificate{emptyCert})
108108

109109
tlsCertHash := TLSCertHash(config)
110110

@@ -123,7 +123,7 @@ func TestTlsCertHash(t *testing.T) {
123123
t.Fatalf("Unexpected error loading cert %s", err)
124124
}
125125

126-
config.EXPECT().TLSClientCerts().Return([]tls.Certificate{cert}, nil)
126+
config.EXPECT().TLSClientCerts().Return([]tls.Certificate{cert})
127127
tlsCertHash := TLSCertHash(config)
128128

129129
// openssl x509 -fingerprint -sha256 -in testdata/server.crt

‎pkg/core/config/endpoint/endpoint.go‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,6 @@ import (
1414

1515
"regexp"
1616

17-
"github.com/hyperledger/fabric-sdk-go/pkg/common/errors/status"
1817
"github.com/pkg/errors"
1918
)
2019

@@ -108,19 +107,19 @@ func (cfg *TLSConfig) LoadBytes() error {
108107

109108
// TLSCert returns the tls certificate as a *x509.Certificate by loading it either from the embedded Pem or Path
110109
//TODO to be removed since separate TLSConfig should only be used in parsing
111-
func (cfg *TLSConfig) TLSCert() (*x509.Certificate, error) {
110+
func (cfg *TLSConfig) TLSCert() (*x509.Certificate, bool, error) {
112111

113112
block, _ := pem.Decode(cfg.bytes)
114113

115114
if block != nil {
116115
pub, err := x509.ParseCertificate(block.Bytes)
117116
if err != nil {
118-
return nil, errors.Wrap(err, "certificate parsing failed")
117+
return nil, false, errors.Wrap(err, "certificate parsing failed")
119118
}
120119

121-
return pub, nil
120+
return pub, true, nil
122121
}
123122

124-
// return an error with an error code for clients to test against status.EmptyCert code
125-
return nil, status.New(status.ClientStatus, status.EmptyCert.ToInt32(), "pem data missing", nil)
123+
//no cert found and there is no error
124+
return nil, false, nil
126125
}

‎pkg/core/config/endpoint/endpoint_test.go‎

Lines changed: 24 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -154,8 +154,8 @@ func TestTLSConfig_TLSCertPostive(t *testing.T) {
154154
t.Fatalf("error loading certificate for sample cert path %s", e)
155155
}
156156

157-
c, e := tlsConfig.TLSCert()
158-
if e != nil {
157+
c, ok, e := tlsConfig.TLSCert()
158+
if e != nil || !ok {
159159
t.Fatalf("error loading certificate for sample cert path %s", e)
160160
}
161161
if c == nil {
@@ -179,8 +179,8 @@ V842OVjxCYYQwCjPIY+5e9ORR+8pxVzcMAoGCCqGSM49BAMCA0cAMEQCIGZ+KTfS
179179
eezqv0ml1VeQEmnAEt5sJ2RJA58+LegUYMd6AiAfEe6BKqdY03qFUgEYmtKG+3Dr
180180
O94CDp7l2k7hMQI0zQ==
181181
-----END CERTIFICATE-----`
182-
c, e = tlsConfig.TLSCert()
183-
if e != nil {
182+
c, ok, e = tlsConfig.TLSCert()
183+
if e != nil || !ok {
184184
t.Fatalf("error loading certificate for sample cert path and pem %s", e)
185185
}
186186
if c == nil {
@@ -196,34 +196,33 @@ func TestTLSConfig_TLSCertNegative(t *testing.T) {
196196
Path: "dummy/path",
197197
Pem: "",
198198
}
199-
c, e := tlsConfig.TLSCert()
200-
if e == nil {
201-
t.Fatal("expected error loading certificate for wrong cert path")
202-
}
203-
if c != nil {
204-
t.Fatal("cert's TLSCert() call returned non empty certificate for wrong cert path")
205-
}
199+
e := tlsConfig.LoadBytes()
200+
assert.NotNil(t, e, "expected error loading certificate for wrong cert path")
201+
202+
c, ok, e := tlsConfig.TLSCert()
203+
assert.Nil(t, e, "error supposed to be nil for empty bytes")
204+
assert.False(t, ok, "expected error loading certificate for wrong cert path")
205+
assert.Nil(t, c, "cert's TLSCert() call returned non empty certificate for wrong cert path")
206206

207207
// test with empty path and empty pem
208208
tlsConfig.Path = ""
209-
c, e = tlsConfig.TLSCert()
210-
if e == nil {
211-
t.Fatal("expected error loading certificate for empty cert path and empty pem")
212-
}
213-
if c != nil {
214-
t.Fatal("cert's TLSCert() call returned non empty certificate for wrong cert path and empty pem")
215-
}
209+
e = tlsConfig.LoadBytes()
210+
assert.Nil(t, e, "not supposed to get error for empty path/pem")
211+
c, ok, e = tlsConfig.TLSCert()
212+
assert.Nil(t, e, "error supposed to be nil for empty bytes")
213+
assert.False(t, ok, "expected error loading certificate for empty cert path and empty pem")
214+
assert.Nil(t, c, "cert's TLSCert() call returned non empty certificate for wrong cert path and empty pem")
216215

217216
// test with wrong pem and empty path
218217
tlsConfig.Path = ""
219218
tlsConfig.Pem = "wrongcertpem"
220-
c, e = tlsConfig.TLSCert()
221-
if e == nil {
222-
t.Fatalf("error loading certificate for empty cert path and and wrong pem %s", e)
223-
}
224-
if c != nil {
225-
t.Fatal("cert's TLSCert() call returned non empty certificate")
226-
}
219+
e = tlsConfig.LoadBytes()
220+
assert.Nil(t, e, "unexpected error loading certificate with wrong pem")
221+
222+
c, ok, e = tlsConfig.TLSCert()
223+
assert.Nil(t, c, "cert's TLSCert() call returned non empty certificate")
224+
assert.False(t, ok, "error loading certificate for empty cert path and and wrong pem ")
225+
assert.Nil(t, e, "cert's TLSCert() call returned unexpected error")
227226

228227
}
229228

‎pkg/fab/comm/connectionopts.go‎

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@ import (
1010
"crypto/x509"
1111
"time"
1212

13-
"github.com/hyperledger/fabric-sdk-go/pkg/common/errors/status"
1413
"github.com/hyperledger/fabric-sdk-go/pkg/common/options"
1514
"github.com/hyperledger/fabric-sdk-go/pkg/common/providers/fab"
1615
"github.com/spf13/cast"
@@ -148,13 +147,9 @@ type connectTimeoutSetter interface {
148147

149148
// OptsFromPeerConfig returns a set of connection options from the given peer config
150149
func OptsFromPeerConfig(peerCfg *fab.PeerConfig) ([]options.Opt, error) {
151-
certificate, err := peerCfg.TLSCACerts.TLSCert()
150+
certificate, _, err := peerCfg.TLSCACerts.TLSCert()
152151
if err != nil {
153-
//Ignore empty cert errors,
154-
errStatus, ok := err.(*status.Status)
155-
if !ok || errStatus.Code != status.EmptyCert.ToInt32() {
156-
return nil, err
157-
}
152+
return nil, err
158153
}
159154

160155
opts := []options.Opt{

0 commit comments

Comments
 (0)
⚡