Skip to content

Commit b9bc349

Browse files
mastersingh24mastersingh24
committed
[FAB-6927] Generate TLS client certs for users
Now tha that both the peer and the orderer support mutual TLS, cryptogen needs to generate TLS client certificates for the users it generates. All of the material was already being generated, but all TLS certs were name server.* and it is more appropriate / more clear to name TLS certs intended for client usage client.*. So internally a new parameter is added which specifies the type of node and maps node type to client or server as appropriate. Change-Id: I510a07335f4c685367ff941ab6c63a0203a04bd1 Signed-off-by: Gari Singh <gari.r.singh@gmail.com>
1 parent 6778439 commit b9bc349

File tree

3 files changed

+51
-16
lines changed

3 files changed

+51
-16
lines changed

‎common/tools/cryptogen/main.go

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -423,7 +423,7 @@ func generatePeerOrg(baseDir string, orgSpec OrgSpec) {
423423
os.Exit(1)
424424
}
425425

426-
generateNodes(peersDir, orgSpec.Specs, signCA, tlsCA)
426+
generateNodes(peersDir, orgSpec.Specs, signCA, tlsCA, msp.PEER)
427427

428428
// TODO: add ability to specify usernames
429429
users := []NodeSpec{}
@@ -440,7 +440,7 @@ func generatePeerOrg(baseDir string, orgSpec OrgSpec) {
440440
}
441441

442442
users = append(users, adminUser)
443-
generateNodes(usersDir, users, signCA, tlsCA)
443+
generateNodes(usersDir, users, signCA, tlsCA, msp.CLIENT)
444444

445445
// copy the admin cert to the org's MSP admincerts
446446
err = copyAdminCert(usersDir, adminCertsDir, adminUser.CommonName)
@@ -483,11 +483,11 @@ func copyAdminCert(usersDir, adminCertsDir, adminUserName string) error {
483483

484484
}
485485

486-
func generateNodes(baseDir string, nodes []NodeSpec, signCA *ca.CA, tlsCA *ca.CA) {
486+
func generateNodes(baseDir string, nodes []NodeSpec, signCA *ca.CA, tlsCA *ca.CA, nodeType int) {
487487

488488
for _, node := range nodes {
489489
nodeDir := filepath.Join(baseDir, node.CommonName)
490-
err := msp.GenerateLocalMSP(nodeDir, node.CommonName, node.SANS, signCA, tlsCA)
490+
err := msp.GenerateLocalMSP(nodeDir, node.CommonName, node.SANS, signCA, tlsCA, nodeType)
491491
if err != nil {
492492
fmt.Printf("Error generating local MSP for %s:\n%v\n", node, err)
493493
os.Exit(1)
@@ -526,7 +526,7 @@ func generateOrdererOrg(baseDir string, orgSpec OrgSpec) {
526526
os.Exit(1)
527527
}
528528

529-
generateNodes(orderersDir, orgSpec.Specs, signCA, tlsCA)
529+
generateNodes(orderersDir, orgSpec.Specs, signCA, tlsCA, msp.ORDERER)
530530

531531
adminUser := NodeSpec{
532532
CommonName: fmt.Sprintf("%s@%s", adminBaseName, orgName),
@@ -536,7 +536,7 @@ func generateOrdererOrg(baseDir string, orgSpec OrgSpec) {
536536
users := []NodeSpec{}
537537
// add an admin user
538538
users = append(users, adminUser)
539-
generateNodes(usersDir, users, signCA, tlsCA)
539+
generateNodes(usersDir, users, signCA, tlsCA, msp.CLIENT)
540540

541541
// copy the admin cert to the org's MSP admincerts
542542
err = copyAdminCert(usersDir, adminCertsDir, adminUser.CommonName)

‎common/tools/cryptogen/msp/generator.go

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,14 @@ import (
2929
"github.com/hyperledger/fabric/common/tools/cryptogen/csp"
3030
)
3131

32+
const (
33+
CLIENT = iota
34+
ORDERER
35+
PEER
36+
)
37+
3238
func GenerateLocalMSP(baseDir, name string, sans []string, signCA *ca.CA,
33-
tlsCA *ca.CA) error {
39+
tlsCA *ca.CA, nodeType int) error {
3440

3541
// create folder structure
3642
mspDir := filepath.Join(baseDir, "msp")
@@ -122,13 +128,17 @@ func GenerateLocalMSP(baseDir, name string, sans []string, signCA *ca.CA,
122128
}
123129

124130
// rename the generated TLS X509 cert
131+
tlsFilePrefix := "server"
132+
if nodeType == CLIENT {
133+
tlsFilePrefix = "client"
134+
}
125135
err = os.Rename(filepath.Join(tlsDir, x509Filename(name)),
126-
filepath.Join(tlsDir, "server.crt"))
136+
filepath.Join(tlsDir, tlsFilePrefix+".crt"))
127137
if err != nil {
128138
return err
129139
}
130140

131-
err = keyExport(tlsDir, filepath.Join(tlsDir, "server.key"), tlsPrivKey)
141+
err = keyExport(tlsDir, filepath.Join(tlsDir, tlsFilePrefix+".key"), tlsPrivKey)
132142
if err != nil {
133143
return err
134144
}

‎common/tools/cryptogen/msp/msp_test.go

Lines changed: 32 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -44,12 +44,13 @@ func TestGenerateLocalMSP(t *testing.T) {
4444

4545
cleanup(testDir)
4646

47-
err := msp.GenerateLocalMSP(testDir, testName, nil, &ca.CA{}, &ca.CA{})
47+
err := msp.GenerateLocalMSP(testDir, testName, nil, &ca.CA{}, &ca.CA{}, msp.PEER)
4848
assert.Error(t, err, "Empty CA should have failed")
4949

5050
caDir := filepath.Join(testDir, "ca")
5151
tlsCADir := filepath.Join(testDir, "tlsca")
5252
mspDir := filepath.Join(testDir, "msp")
53+
tlsDir := filepath.Join(testDir, "tls")
5354

5455
// generate signing CA
5556
signCA, err := ca.NewCA(caDir, testCAOrg, testCAName, testCountry, testProvince, testLocality, testOrganizationalUnit, testStreetAddress, testPostalCode)
@@ -71,20 +72,44 @@ func TestGenerateLocalMSP(t *testing.T) {
7172
assert.NotEmpty(t, signCA.SignCert.Subject.PostalCode, "postalCode cannot be empty.")
7273
assert.Equal(t, testPostalCode, signCA.SignCert.Subject.PostalCode[0], "Failed to match postalCode")
7374

74-
// generate local MSP
75-
err = msp.GenerateLocalMSP(testDir, testName, nil, signCA, tlsCA)
75+
// generate local MSP for nodeType=PEER
76+
err = msp.GenerateLocalMSP(testDir, testName, nil, signCA, tlsCA, msp.PEER)
7677
assert.NoError(t, err, "Failed to generate local MSP")
7778

7879
// check to see that the right files were generated/saved
79-
files := []string{
80+
mspFiles := []string{
8081
filepath.Join(mspDir, "admincerts", testName+"-cert.pem"),
8182
filepath.Join(mspDir, "cacerts", testCAName+"-cert.pem"),
8283
filepath.Join(mspDir, "tlscacerts", testCAName+"-cert.pem"),
8384
filepath.Join(mspDir, "keystore"),
8485
filepath.Join(mspDir, "signcerts", testName+"-cert.pem"),
8586
}
87+
tlsFiles := []string{
88+
filepath.Join(tlsDir, "ca.crt"),
89+
filepath.Join(tlsDir, "server.key"),
90+
filepath.Join(tlsDir, "server.crt"),
91+
}
8692

87-
for _, file := range files {
93+
for _, file := range mspFiles {
94+
assert.Equal(t, true, checkForFile(file),
95+
"Expected to find file "+file)
96+
}
97+
for _, file := range tlsFiles {
98+
assert.Equal(t, true, checkForFile(file),
99+
"Expected to find file "+file)
100+
}
101+
102+
// generate local MSP for nodeType=CLIENT
103+
err = msp.GenerateLocalMSP(testDir, testName, nil, signCA, tlsCA, msp.CLIENT)
104+
assert.NoError(t, err, "Failed to generate local MSP")
105+
//only need to check for the TLS certs
106+
tlsFiles = []string{
107+
filepath.Join(tlsDir, "ca.crt"),
108+
filepath.Join(tlsDir, "client.key"),
109+
filepath.Join(tlsDir, "client.crt"),
110+
}
111+
112+
for _, file := range tlsFiles {
88113
assert.Equal(t, true, checkForFile(file),
89114
"Expected to find file "+file)
90115
}
@@ -98,10 +123,10 @@ func TestGenerateLocalMSP(t *testing.T) {
98123
assert.NoError(t, err, "Error setting up local MSP")
99124

100125
tlsCA.Name = "test/fail"
101-
err = msp.GenerateLocalMSP(testDir, testName, nil, signCA, tlsCA)
126+
err = msp.GenerateLocalMSP(testDir, testName, nil, signCA, tlsCA, msp.CLIENT)
102127
assert.Error(t, err, "Should have failed with CA name 'test/fail'")
103128
signCA.Name = "test/fail"
104-
err = msp.GenerateLocalMSP(testDir, testName, nil, signCA, tlsCA)
129+
err = msp.GenerateLocalMSP(testDir, testName, nil, signCA, tlsCA, msp.ORDERER)
105130
assert.Error(t, err, "Should have failed with CA name 'test/fail'")
106131
t.Log(err)
107132
cleanup(testDir)

0 commit comments

Comments
 (0)