Skip to content

Commit

Permalink
[FAB-8762] Enable mutual tls for rc1 test
Browse files Browse the repository at this point in the history 
Change-Id: I366198747396a79a87a9e11463528ee46287e203
Signed-off-by: Firas Qutishat <firas.qutishat@securekey.com>
Signed-off-by: Troy Ronda <troy@troyronda.com>
  • Loading branch information
@fqutishat @troyronda
fqutishat authored and troyronda committed Mar 10, 2018
1 parent f4dd6f9 commit aec90b3
Show file tree
Hide file tree
Showing 7 changed files with 34 additions and 20 deletions.
6 changes: 2 additions & 4 deletions pkg/core/config/config.go
View file
Expand Up @@ -1268,12 +1268,10 @@ func (c *Config) CryptoConfigPath() string {
// TLSClientCerts loads the client's certs for mutual TLS
// It checks the config for embedded pem files before looking for cert files
func (c *Config) TLSClientCerts() ([]tls.Certificate, error) {
config, err := c.NetworkConfig()
clientConfig, err := c.Client()
if err != nil {
return nil, err
}

clientConfig := config.Client
var clientCerts tls.Certificate
var cb, kb []byte
cb, err = clientConfig.TLSCerts.Client.Cert.Bytes()
Expand All @@ -1296,7 +1294,7 @@ func (c *Config) TLSClientCerts() ([]tls.Certificate, error) {
if clientConfig.TLSCerts.Client.Key.Pem != "" {
kb = []byte(clientConfig.TLSCerts.Client.Key.Pem)
} else if clientConfig.TLSCerts.Client.Key.Path != "" {
kb, err = loadByteKeyOrCertFromFile(&clientConfig, true)
kb, err = loadByteKeyOrCertFromFile(clientConfig, true)
if err != nil {
return nil, errors.Wrapf(err, "Failed to load key from file path '%s'", clientConfig.TLSCerts.Client.Key.Path)
}
Expand Down
6 changes: 4 additions & 2 deletions test/fixtures/config/config_test.yaml
View file
Expand Up @@ -110,8 +110,10 @@ client:

# [Optional]. Client key and cert for TLS handshake with peers and orderers
client:
keyfile: ${GOPATH}/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/config/mutual_tls/client_sdk_go-key.pem
certfile: ${GOPATH}/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/config/mutual_tls/client_sdk_go.pem
key:
path: ${GOPATH}/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/config/mutual_tls/client_sdk_go-key.pem
cert:
path: ${GOPATH}/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/config/mutual_tls/client_sdk_go.pem

#
# [Optional]. But most apps would have this section so that channel objects can be constructed
Expand Down
6 changes: 4 additions & 2 deletions test/fixtures/config/config_test_local.yaml
View file
Expand Up @@ -111,8 +111,10 @@ client:

# [Optional]. Client key and cert for TLS handshake with peers and orderers
client:
keyfile: ${GOPATH}/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/config/mutual_tls/client_sdk_go-key.pem
certfile: ${GOPATH}/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/config/mutual_tls/client_sdk_go.pem
key:
path: ${GOPATH}/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/config/mutual_tls/client_sdk_go-key.pem
cert:
path: ${GOPATH}/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/config/mutual_tls/client_sdk_go.pem

#
# [Optional]. But most apps would have this section so that channel objects can be constructed
Expand Down
6 changes: 4 additions & 2 deletions test/fixtures/config/config_test_no_orderer.yaml
View file
Expand Up @@ -110,8 +110,10 @@ client:

# [Optional]. Client key and cert for TLS handshake with peers and orderers
client:
keyfile: ${GOPATH}/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/config/mutual_tls/client_sdk_go-key.pem
certfile: ${GOPATH}/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/config/mutual_tls/client_sdk_go.pem
key:
path: ${GOPATH}/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/config/mutual_tls/client_sdk_go-key.pem
cert:
path: ${GOPATH}/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/config/mutual_tls/client_sdk_go.pem

#
# [Optional]. But most apps would have this section so that channel objects can be constructed
Expand Down
6 changes: 4 additions & 2 deletions test/fixtures/config/config_test_no_orderer_local.yaml
View file
Expand Up @@ -112,8 +112,10 @@ client:

# [Optional]. Client key and cert for TLS handshake with peers and orderers
client:
keyfile: ${GOPATH}/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/config/mutual_tls/client_sdk_go-key.pem
certfile: ${GOPATH}/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/config/mutual_tls/client_sdk_go.pem
key:
path: ${GOPATH}/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/config/mutual_tls/client_sdk_go-key.pem
cert:
path: ${GOPATH}/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/config/mutual_tls/client_sdk_go.pem

#
# [Optional]. But most apps would have this section so that channel objects can be constructed
Expand Down
9 changes: 5 additions & 4 deletions test/fixtures/dockerenv/devstable-env.sh
View file
@@ -1,3 +1,4 @@
#!/usr/bin/bash
#
# Copyright SecureKey Technologies Inc. All Rights Reserved.
#
Expand All @@ -21,10 +22,10 @@ export FABRIC_COUCHDB_FIXTURE_TAG="DEV_STABLE"
export FABRIC_BUILDER_FIXTURE_TAG="DEV_STABLE"

# override SDK configuration that loads crypto-config
FABRIC_SDK_CLIENT_CRYPTOCONFIG_PATH='${GOPATH}'"/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/fabric/${FABRIC_CRYPTOCONFIG_VERSION}/crypto-config"
FABRIC_SDK_CLIENT_ORDERERS_TLSCACERTS_PATH='${GOPATH}'"/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/fabric/${FABRIC_CRYPTOCONFIG_VERSION}/crypto-config/ordererOrganizations/example.com/tlsca/tlsca.example.com-cert.pem"
FABRIC_SDK_CLIENT_PEERS_PEER0_ORG1_EXAMPLE_COM_TLSCACERTS_PATH='${GOPATH}'"/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/fabric/${FABRIC_CRYPTOCONFIG_VERSION}/crypto-config/peerOrganizations/org1.example.com/tlsca/tlsca.org1.example.com-cert.pem"
FABRIC_SDK_CLIENT_PEERS_PEER0_ORG2_EXAMPLE_COM_TLSCACERTS_PATH='${GOPATH}'"/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/fabric/${FABRIC_CRYPTOCONFIG_VERSION}/crypto-config/peerOrganizations/org2.example.com/tlsca/tlsca.org2.example.com-cert.pem"
export FABRIC_SDK_CLIENT_CRYPTOCONFIG_PATH='${GOPATH}'"/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/fabric/${FABRIC_CRYPTOCONFIG_VERSION}/crypto-config"
export FABRIC_SDK_CLIENT_ORDERERS_TLSCACERTS_PATH='${GOPATH}'"/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/fabric/${FABRIC_CRYPTOCONFIG_VERSION}/crypto-config/ordererOrganizations/example.com/tlsca/tlsca.example.com-cert.pem"
export FABRIC_SDK_CLIENT_PEERS_PEER0_ORG1_EXAMPLE_COM_TLSCACERTS_PATH='${GOPATH}'"/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/fabric/${FABRIC_CRYPTOCONFIG_VERSION}/crypto-config/peerOrganizations/org1.example.com/tlsca/tlsca.org1.example.com-cert.pem"
export FABRIC_SDK_CLIENT_PEERS_PEER0_ORG2_EXAMPLE_COM_TLSCACERTS_PATH='${GOPATH}'"/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/fabric/${FABRIC_CRYPTOCONFIG_VERSION}/crypto-config/peerOrganizations/org2.example.com/tlsca/tlsca.org2.example.com-cert.pem"

# override PEER and ORDERER configuration for mutual TLS
export CORE_PEER_TLS_CLIENTAUTHREQUIRED=true
Expand Down
15 changes: 11 additions & 4 deletions test/fixtures/dockerenv/prerelease-env.sh
View file
@@ -1,3 +1,4 @@
#!/usr/bin/bash
#
# Copyright SecureKey Technologies Inc. All Rights Reserved.
#
Expand All @@ -18,7 +19,13 @@ export FABRIC_BASEOS_FIXTURE_TAG="0.4.6"
export FABRIC_BASEIMAGE_FIXTURE_TAG="0.4.6"

# override configuration that loads crypto-config
FABRIC_SDK_CLIENT_CRYPTOCONFIG_PATH='${GOPATH}'"/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/fabric/${FABRIC_CRYPTOCONFIG_VERSION}/crypto-config"
FABRIC_SDK_CLIENT_ORDERERS_TLSCACERTS_PATH='${GOPATH}'"/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/fabric/${FABRIC_CRYPTOCONFIG_VERSION}/crypto-config/ordererOrganizations/example.com/tlsca/tlsca.example.com-cert.pem"
FABRIC_SDK_CLIENT_PEERS_PEER0_ORG1_EXAMPLE_COM_TLSCACERTS_PATH='${GOPATH}'"/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/fabric/${FABRIC_CRYPTOCONFIG_VERSION}/crypto-config/peerOrganizations/org1.example.com/tlsca/tlsca.org1.example.com-cert.pem"
FABRIC_SDK_CLIENT_PEERS_PEER0_ORG2_EXAMPLE_COM_TLSCACERTS_PATH='${GOPATH}'"/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/fabric/${FABRIC_CRYPTOCONFIG_VERSION}/crypto-config/peerOrganizations/org2.example.com/tlsca/tlsca.org2.example.com-cert.pem"
export FABRIC_SDK_CLIENT_CRYPTOCONFIG_PATH='${GOPATH}'"/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/fabric/${FABRIC_CRYPTOCONFIG_VERSION}/crypto-config"
export FABRIC_SDK_CLIENT_ORDERERS_TLSCACERTS_PATH='${GOPATH}'"/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/fabric/${FABRIC_CRYPTOCONFIG_VERSION}/crypto-config/ordererOrganizations/example.com/tlsca/tlsca.example.com-cert.pem"
export FABRIC_SDK_CLIENT_PEERS_PEER0_ORG1_EXAMPLE_COM_TLSCACERTS_PATH='${GOPATH}'"/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/fabric/${FABRIC_CRYPTOCONFIG_VERSION}/crypto-config/peerOrganizations/org1.example.com/tlsca/tlsca.org1.example.com-cert.pem"
export FABRIC_SDK_CLIENT_PEERS_PEER0_ORG2_EXAMPLE_COM_TLSCACERTS_PATH='${GOPATH}'"/src/github.com/hyperledger/fabric-sdk-go/test/fixtures/fabric/${FABRIC_CRYPTOCONFIG_VERSION}/crypto-config/peerOrganizations/org2.example.com/tlsca/tlsca.org2.example.com-cert.pem"

# override PEER and ORDERER configuration for mutual TLS
export CORE_PEER_TLS_CLIENTAUTHREQUIRED=true
export CORE_PEER_TLS_CLIENTROOTCAS_FILES="/etc/hyperledger/tls/peer/ca.crt /etc/hyperledger/mutual_tls/peer/client_sdk_go-ca_root.pem"
export ORDERER_GENERAL_TLS_CLIENTAUTHENABLED=true
export ORDERER_GENERAL_TLS_CLIENTROOTCAS="[/etc/hyperledger/tls/orderer/ca.crt,/etc/hyperledger/mutual_tls/orderer/client_sdk_go-ca_root.pem]"

0 comments on commit aec90b3

Please sign in to comment.