Skip to content

Commit 512d818

Browse files
mastersingh24mastersingh24
committedDec 24, 2017
[FAB-7553] Refactor comm.SecureConfig
A simple change which renames a few fields so that SecureConfig can be used by clients as well as servers. Change-Id: I2f8a7a947eb3b568e45efa6c0ad34beec85c7853 Signed-off-by: Gari Singh <gari.r.singh@gmail.com>
·
v3.1.0v1.1.0-alpha
1 parent 7ba2c97 commit 512d818

File tree

10 files changed

+77
-77
lines changed

10 files changed

+77
-77
lines changed
 

‎core/comm/config.go

+8-8
Original file line numberDiff line numberDiff line change
@@ -53,15 +53,15 @@ type ServerConfig struct {
5353
// SecureOptions defines the security parameters (e.g. TLS) for a
5454
// GRPCServer instance
5555
type SecureOptions struct {
56-
// PEM-encoded X509 public key to be used by the server for TLS communication
57-
ServerCertificate []byte
58-
// PEM-encoded private key to be used by the server for TLS communication
59-
ServerKey []byte
60-
// Set of PEM-encoded X509 certificate authorities to optionally send
61-
// as part of the server handshake
56+
// PEM-encoded X509 public key to be used for TLS communication
57+
Certificate []byte
58+
// PEM-encoded private key to be used for TLS communication
59+
Key []byte
60+
// Set of PEM-encoded X509 certificate authorities used by clients to
61+
// verify server certificates
6262
ServerRootCAs [][]byte
63-
// Set of PEM-encoded X509 certificate authorities to use when verifying
64-
// client certificates
63+
// Set of PEM-encoded X509 certificate authorities used by servers to
64+
// verify client certificates
6565
ClientRootCAs [][]byte
6666
// Whether or not to use TLS for communication
6767
UseTLS bool

‎core/comm/connection_test.go

+9-9
Original file line numberDiff line numberDiff line change
@@ -86,19 +86,19 @@ func TestClientConnections(t *testing.T) {
8686
name: "ValidConnectionTLS",
8787
sc: ServerConfig{
8888
SecOpts: &SecureOptions{
89-
UseTLS: true,
90-
ServerCertificate: certPEMBlock,
91-
ServerKey: keyPEMBlock}},
89+
UseTLS: true,
90+
Certificate: certPEMBlock,
91+
Key: keyPEMBlock}},
9292
creds: credentials.NewClientTLSFromCert(certPool, ""),
9393
serverPort: 8052,
9494
},
9595
{
9696
name: "InvalidConnectionTLS",
9797
sc: ServerConfig{
9898
SecOpts: &SecureOptions{
99-
UseTLS: true,
100-
ServerCertificate: certPEMBlock,
101-
ServerKey: keyPEMBlock}},
99+
UseTLS: true,
100+
Certificate: certPEMBlock,
101+
Key: keyPEMBlock}},
102102
creds: credentials.NewClientTLSFromCert(nil, ""),
103103
fail: true,
104104
serverPort: 8053,
@@ -284,9 +284,9 @@ func newServer(org string, port int) *srv {
284284
}
285285
gSrv, err := NewGRPCServerFromListener(l, ServerConfig{
286286
SecOpts: &SecureOptions{
287-
ServerCertificate: certs["server.crt"],
288-
ServerKey: certs["server.key"],
289-
UseTLS: true,
287+
Certificate: certs["server.crt"],
288+
Key: certs["server.key"],
289+
UseTLS: true,
290290
},
291291
})
292292
if err != nil {

‎core/comm/server.go

+4-4
Original file line numberDiff line numberDiff line change
@@ -109,10 +109,10 @@ func NewGRPCServerFromListener(listener net.Listener, serverConfig ServerConfig)
109109
secureConfig := serverConfig.SecOpts
110110
if secureConfig != nil && secureConfig.UseTLS {
111111
//both key and cert are required
112-
if secureConfig.ServerKey != nil && secureConfig.ServerCertificate != nil {
112+
if secureConfig.Key != nil && secureConfig.Certificate != nil {
113113
grpcServer.tlsEnabled = true
114114
//load server public and private keys
115-
cert, err := tls.X509KeyPair(secureConfig.ServerCertificate, secureConfig.ServerKey)
115+
cert, err := tls.X509KeyPair(secureConfig.Certificate, secureConfig.Key)
116116
if err != nil {
117117
return nil, err
118118
}
@@ -155,8 +155,8 @@ func NewGRPCServerFromListener(listener net.Listener, serverConfig ServerConfig)
155155
creds := NewServerTransportCredentials(grpcServer.tlsConfig)
156156
serverOpts = append(serverOpts, grpc.Creds(creds))
157157
} else {
158-
return nil, errors.New("serverConfig.SecOpts must contain both ServerKey and " +
159-
"ServerCertificate when UseTLS is true")
158+
return nil, errors.New("serverConfig.SecOpts must contain both Key and " +
159+
"Certificate when UseTLS is true")
160160
}
161161
}
162162
// set max send and recv msg sizes

‎core/comm/server_test.go

+38-38
Original file line numberDiff line numberDiff line change
@@ -196,8 +196,8 @@ func (org *testOrg) testServers(port int, clientRootCAs [][]byte) []testServer {
196196
comm.ServerConfig{
197197
SecOpts: &comm.SecureOptions{
198198
UseTLS: true,
199-
ServerCertificate: serverCert.certPEM,
200-
ServerKey: serverCert.keyPEM,
199+
Certificate: serverCert.certPEM,
200+
Key: serverCert.keyPEM,
201201
RequireClientCert: true,
202202
ClientRootCAs: clientRootCAs,
203203
},
@@ -395,39 +395,39 @@ func TestNewGRPCServerInvalidParameters(t *testing.T) {
395395
t.Log(err.Error())
396396
}
397397

398-
//missing serverCertificate
398+
//missing server Certificate
399399
_, err = comm.NewGRPCServer(":9041",
400400
comm.ServerConfig{
401401
SecOpts: &comm.SecureOptions{
402-
UseTLS: true,
403-
ServerCertificate: []byte{}}})
402+
UseTLS: true,
403+
Certificate: []byte{}}})
404404
//check for error
405-
msg = "serverConfig.SecOpts must contain both ServerKey and " +
406-
"ServerCertificate when UseTLS is true"
405+
msg = "serverConfig.SecOpts must contain both Key and " +
406+
"Certificate when UseTLS is true"
407407
assert.EqualError(t, err, msg)
408408
if err != nil {
409409
t.Log(err.Error())
410410
}
411411

412-
//missing serverKey
412+
//missing server Key
413413
_, err = comm.NewGRPCServer(":9042",
414414
comm.ServerConfig{
415415
SecOpts: &comm.SecureOptions{
416-
UseTLS: true,
417-
ServerCertificate: []byte{}}})
416+
UseTLS: true,
417+
Certificate: []byte{}}})
418418
//check for error
419419
assert.EqualError(t, err, msg)
420420
if err != nil {
421421
t.Log(err.Error())
422422
}
423423

424-
//bad serverKey
424+
//bad server Key
425425
_, err = comm.NewGRPCServer(":9043",
426426
comm.ServerConfig{
427427
SecOpts: &comm.SecureOptions{
428-
UseTLS: true,
429-
ServerCertificate: []byte(selfSignedCertPEM),
430-
ServerKey: []byte{}}})
428+
UseTLS: true,
429+
Certificate: []byte(selfSignedCertPEM),
430+
Key: []byte{}}})
431431

432432
//check for error
433433
msg = "tls: failed to find any PEM data in key input"
@@ -436,13 +436,13 @@ func TestNewGRPCServerInvalidParameters(t *testing.T) {
436436
t.Log(err.Error())
437437
}
438438

439-
//bad serverCertificate
439+
//bad server Certificate
440440
_, err = comm.NewGRPCServer(":9044",
441441
comm.ServerConfig{
442442
SecOpts: &comm.SecureOptions{
443-
UseTLS: true,
444-
ServerCertificate: []byte{},
445-
ServerKey: []byte(selfSignedKeyPEM)}})
443+
UseTLS: true,
444+
Certificate: []byte{},
445+
Key: []byte(selfSignedKeyPEM)}})
446446
//check for error
447447
msg = "tls: failed to find any PEM data in certificate input"
448448
assert.EqualError(t, err, msg)
@@ -454,8 +454,8 @@ func TestNewGRPCServerInvalidParameters(t *testing.T) {
454454
comm.ServerConfig{
455455
SecOpts: &comm.SecureOptions{
456456
UseTLS: true,
457-
ServerCertificate: []byte(selfSignedCertPEM),
458-
ServerKey: []byte(selfSignedKeyPEM),
457+
Certificate: []byte(selfSignedCertPEM),
458+
Key: []byte(selfSignedKeyPEM),
459459
RequireClientCert: true}})
460460
badRootCAs := [][]byte{[]byte(badPEM)}
461461
err = srv.SetClientRootCAs(badRootCAs)
@@ -576,9 +576,9 @@ func TestNewSecureGRPCServer(t *testing.T) {
576576
testAddress := "localhost:9055"
577577
srv, err := comm.NewGRPCServer(testAddress, comm.ServerConfig{
578578
SecOpts: &comm.SecureOptions{
579-
UseTLS: true,
580-
ServerCertificate: []byte(selfSignedCertPEM),
581-
ServerKey: []byte(selfSignedKeyPEM)}})
579+
UseTLS: true,
580+
Certificate: []byte(selfSignedCertPEM),
581+
Key: []byte(selfSignedKeyPEM)}})
582582
//check for error
583583
if err != nil {
584584
t.Fatalf("Failed to return new GRPC server: %v", err)
@@ -661,9 +661,9 @@ func TestNewSecureGRPCServerFromListener(t *testing.T) {
661661

662662
srv, err := comm.NewGRPCServerFromListener(lis, comm.ServerConfig{
663663
SecOpts: &comm.SecureOptions{
664-
UseTLS: true,
665-
ServerCertificate: []byte(selfSignedCertPEM),
666-
ServerKey: []byte(selfSignedKeyPEM)}})
664+
UseTLS: true,
665+
Certificate: []byte(selfSignedCertPEM),
666+
Key: []byte(selfSignedKeyPEM)}})
667667
//check for error
668668
if err != nil {
669669
t.Fatalf("Failed to return new GRPC server: %v", err)
@@ -743,9 +743,9 @@ func TestWithSignedRootCertificates(t *testing.T) {
743743

744744
srv, err := comm.NewGRPCServerFromListener(lis, comm.ServerConfig{
745745
SecOpts: &comm.SecureOptions{
746-
UseTLS: true,
747-
ServerCertificate: certPEMBlock,
748-
ServerKey: keyPEMBlock}})
746+
UseTLS: true,
747+
Certificate: certPEMBlock,
748+
Key: keyPEMBlock}})
749749
//check for error
750750
if err != nil {
751751
t.Fatalf("Failed to return new GRPC server: %v", err)
@@ -822,9 +822,9 @@ func TestWithSignedIntermediateCertificates(t *testing.T) {
822822

823823
srv, err := comm.NewGRPCServerFromListener(lis, comm.ServerConfig{
824824
SecOpts: &comm.SecureOptions{
825-
UseTLS: true,
826-
ServerCertificate: certPEMBlock,
827-
ServerKey: keyPEMBlock}})
825+
UseTLS: true,
826+
Certificate: certPEMBlock,
827+
Key: keyPEMBlock}})
828828
//check for error
829829
if err != nil {
830830
t.Fatalf("Failed to return new GRPC server: %v", err)
@@ -1444,9 +1444,9 @@ func TestUpdateTLSCert(t *testing.T) {
14441444

14451445
cfg := comm.ServerConfig{
14461446
SecOpts: &comm.SecureOptions{
1447-
UseTLS: true,
1448-
ServerKey: key,
1449-
ServerCertificate: cert,
1447+
UseTLS: true,
1448+
Key: key,
1449+
Certificate: cert,
14501450
},
14511451
}
14521452
srv, err := comm.NewGRPCServer("localhost:8333", cfg)
@@ -1536,9 +1536,9 @@ func TestCipherSuites(t *testing.T) {
15361536

15371537
serverConfig := comm.ServerConfig{
15381538
SecOpts: &comm.SecureOptions{
1539-
ServerCertificate: certPEM,
1540-
ServerKey: keyPEM,
1541-
UseTLS: true,
1539+
Certificate: certPEM,
1540+
Key: keyPEM,
1541+
UseTLS: true,
15421542
}}
15431543

15441544
var tests = []struct {

‎core/comm/util_test.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -153,9 +153,9 @@ func (is *inspectingServer) inspect(envelope *common.Envelope) error {
153153
func newInspectingServer(addr string, inspector comm.BindingInspector) *inspectingServer {
154154
srv, err := comm.NewGRPCServer(addr, comm.ServerConfig{
155155
SecOpts: &comm.SecureOptions{
156-
UseTLS: true,
157-
ServerCertificate: []byte(selfSignedCertPEM),
158-
ServerKey: []byte(selfSignedKeyPEM),
156+
UseTLS: true,
157+
Certificate: []byte(selfSignedCertPEM),
158+
Key: []byte(selfSignedKeyPEM),
159159
}})
160160
if err != nil {
161161
panic(err)

‎core/deliverservice/requester_test.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -42,8 +42,8 @@ func TestTLSBinding(t *testing.T) {
4242
s, err := comm.NewGRPCServer("localhost:9435", comm.ServerConfig{
4343
SecOpts: &comm.SecureOptions{
4444
RequireClientCert: true,
45-
ServerKey: serverKey,
46-
ServerCertificate: serverCert,
45+
Key: serverKey,
46+
Certificate: serverCert,
4747
ClientRootCAs: [][]byte{caCert},
4848
UseTLS: true,
4949
},

‎core/peer/config.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -140,8 +140,8 @@ func GetServerConfig() (comm.ServerConfig, error) {
140140
if err != nil {
141141
return serverConfig, fmt.Errorf("error loading TLS certificate (%s)", err)
142142
}
143-
secureOptions.ServerCertificate = serverCert
144-
secureOptions.ServerKey = serverKey
143+
secureOptions.Certificate = serverCert
144+
secureOptions.Key = serverKey
145145
secureOptions.RequireClientCert = viper.GetBool("peer.tls.clientAuthRequired")
146146
if secureOptions.RequireClientCert {
147147
var clientRoots [][]byte

‎core/peer/pkg_test.go

+6-6
Original file line numberDiff line numberDiff line change
@@ -236,8 +236,8 @@ func TestUpdateRootsFromConfigBlock(t *testing.T) {
236236
serverConfig: comm.ServerConfig{
237237
SecOpts: &comm.SecureOptions{
238238
UseTLS: true,
239-
ServerCertificate: org1Server1Cert,
240-
ServerKey: org1Server1Key,
239+
Certificate: org1Server1Cert,
240+
Key: org1Server1Key,
241241
ServerRootCAs: [][]byte{org1CA},
242242
RequireClientCert: true,
243243
},
@@ -254,8 +254,8 @@ func TestUpdateRootsFromConfigBlock(t *testing.T) {
254254
serverConfig: comm.ServerConfig{
255255
SecOpts: &comm.SecureOptions{
256256
UseTLS: true,
257-
ServerCertificate: org1Server1Cert,
258-
ServerKey: org1Server1Key,
257+
Certificate: org1Server1Cert,
258+
Key: org1Server1Key,
259259
ServerRootCAs: [][]byte{org1CA},
260260
RequireClientCert: true,
261261
},
@@ -274,8 +274,8 @@ func TestUpdateRootsFromConfigBlock(t *testing.T) {
274274
serverConfig: comm.ServerConfig{
275275
SecOpts: &comm.SecureOptions{
276276
UseTLS: true,
277-
ServerCertificate: org1Server1Cert,
278-
ServerKey: org1Server1Key,
277+
Certificate: org1Server1Cert,
278+
Key: org1Server1Key,
279279
ServerRootCAs: [][]byte{org1CA},
280280
RequireClientCert: true,
281281
},

‎orderer/common/server/main.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -141,7 +141,7 @@ func initializeServerConfig(conf *config.TopLevel) comm.ServerConfig {
141141
// load crypto material from files
142142
serverCertificate, err := ioutil.ReadFile(conf.General.TLS.Certificate)
143143
if err != nil {
144-
logger.Fatalf("Failed to load ServerCertificate file '%s' (%s)",
144+
logger.Fatalf("Failed to load server Certificate file '%s' (%s)",
145145
conf.General.TLS.Certificate, err)
146146
}
147147
serverKey, err := ioutil.ReadFile(conf.General.TLS.PrivateKey)
@@ -169,8 +169,8 @@ func initializeServerConfig(conf *config.TopLevel) comm.ServerConfig {
169169
}
170170
msg = "mutual TLS"
171171
}
172-
secureOpts.ServerKey = serverKey
173-
secureOpts.ServerCertificate = serverCertificate
172+
secureOpts.Key = serverKey
173+
secureOpts.Certificate = serverCertificate
174174
secureOpts.ServerRootCAs = serverRootCAs
175175
secureOpts.ClientRootCAs = clientRootCAs
176176
logger.Infof("Starting orderer with %s enabled", msg)

‎peer/node/start.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -389,8 +389,8 @@ func createChaincodeServer(ca accesscontrol.CA, peerHostname string) (srv comm.G
389389
// Trust only client certificates signed by ourselves
390390
ClientRootCAs: [][]byte{ca.CertBytes()},
391391
// Use our own self-signed TLS certificate and key
392-
ServerCertificate: certKeyPair.Cert,
393-
ServerKey: certKeyPair.Key,
392+
Certificate: certKeyPair.Cert,
393+
Key: certKeyPair.Key,
394394
// No point in specifying server root CAs since this TLS config is only used for
395395
// a gRPC server and not a client
396396
ServerRootCAs: nil,

0 commit comments

Comments
 (0)
Please sign in to comment.