forked from hyperledger/fabric-sdk-go
-
Notifications
You must be signed in to change notification settings - Fork 0
/
endpoint.go
116 lines (95 loc) · 3.11 KB
/
endpoint.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
/*
Copyright SecureKey Technologies Inc. All Rights Reserved.
SPDX-License-Identifier: Apache-2.0
*/
package endpoint
import (
"crypto/x509"
"encoding/pem"
"io/ioutil"
"strings"
"regexp"
"github.com/hyperledger/fabric-sdk-go/pkg/common/errors/status"
"github.com/hyperledger/fabric-sdk-go/pkg/common/logging"
"github.com/pkg/errors"
)
var logger = logging.NewLogger("fabsdk/core")
// IsTLSEnabled is a generic function that expects a URL and verifies if it has
// a prefix HTTPS or GRPCS to return true for TLS Enabled URLs or false otherwise
func IsTLSEnabled(url string) bool {
tlsURL := strings.ToLower(url)
if strings.HasPrefix(tlsURL, "https://") || strings.HasPrefix(tlsURL, "grpcs://") {
return true
}
return false
}
// ToAddress is a utility function to trim the GRPC protocol prefix as it is not needed by GO
// if the GRPC protocol is not found, the url is returned unchanged
func ToAddress(url string) string {
if strings.HasPrefix(url, "grpc://") {
return strings.TrimPrefix(url, "grpc://")
}
if strings.HasPrefix(url, "grpcs://") {
return strings.TrimPrefix(url, "grpcs://")
}
return url
}
//AttemptSecured is a utility function which verifies URL and returns if secured connections needs to established
// for protocol 'grpcs' in URL returns true
// for protocol 'grpc' in URL returns false
// for no protocol mentioned, returns !allowInSecure
func AttemptSecured(url string, allowInSecure bool) bool {
ok, err := regexp.MatchString(".*(?i)s://", url)
if ok && err == nil {
return true
} else if strings.Contains(url, "://") {
return false
} else {
return !allowInSecure
}
}
// TLSConfig TLS configuration used in the sdk's configs.
type TLSConfig struct {
// the following two fields are interchangeable.
// If Path is available, then it will be used to load the cert
// if Pem is available, then it has the raw data of the cert it will be used as-is
// Certificate root certificate path
Path string
// Certificate actual content
Pem string
}
// Bytes returns the tls certificate as a byte array by loading it either from the embedded Pem or Path
func (cfg TLSConfig) Bytes() ([]byte, error) {
var bytes []byte
var err error
if cfg.Pem != "" {
bytes = []byte(cfg.Pem)
} else if cfg.Path != "" {
bytes, err = ioutil.ReadFile(cfg.Path)
if err != nil {
return nil, errors.Wrapf(err, "failed to load pem bytes from path %s", cfg.Path)
}
}
return bytes, nil
}
// TLSCert returns the tls certificate as a *x509.Certificate by loading it either from the embedded Pem or Path
func (cfg TLSConfig) TLSCert() (*x509.Certificate, error) {
bytes, err := cfg.Bytes()
if err != nil {
return nil, err
}
return loadCert(bytes)
}
// loadCAKey
func loadCert(rawData []byte) (*x509.Certificate, error) {
block, _ := pem.Decode(rawData)
if block != nil {
pub, err := x509.ParseCertificate(block.Bytes)
if err != nil {
return nil, errors.Wrap(err, "certificate parsing failed")
}
return pub, nil
}
// return an error with an error code for clients to test against status.EmptyCert code
return nil, status.New(status.ClientStatus, status.EmptyCert.ToInt32(), "pem data missing", nil)
}