-
Notifications
You must be signed in to change notification settings - Fork 708
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update README.md #2
Conversation
Thank you for your contribution! This is a read only mirror, however. Please submit your change using gerrit. you would need to check out the repo here: https://gerrit.hyperledger.org/r/#/admin/projects/fabric-ca and make your edits, pushing them to gerrit here is a walkthrough for zephyrproject which is much the same WRT setting up an LFID, adding ssh keys, etc: feel free to ask on slack - https://slack.hyperledgerproject.org/ - I'm @ry there, feel free to ask me directly, or discuss in #fabric-ca one note: when you set up your LFID do not use social logins the first time, create the account and you can add social logins later |
When multiple CAs are configured and relative paths for fields such as the keystore were specified in the default CA config, the file paths were converted to absolute paths before being copied into the CA config. This is incorrect and caused all CAs to use the same file paths. The fix for this required breaking the initialization logic into the following pieces: 1) Initialize the config, setting default values, etc. This is done by the server.initConfig function. 2) At the end of this function, perform all initialization of the multiple CA configs, copying the relative paths, and converting the CA configs paths to absolute. 3) Complete initialization of the default CA config, including initially converting the default paths to absolute. Note: patch set #3 was inadvertent, so I'm repushing patch set #2. So #4 and #2 are the same. Change-Id: I2ada0c2b1bd31609799d09d422137808188a61d5 Signed-off-by: Keith Smith <[email protected]>
This is the 2nd phase of improving server error handling. I introduce two new objects: 1) serverEndpoint - this represents an endpoint. It performs server-side error handling, both for writing the response back to the client and for writing the access log entry. 2) serverRequestContext - this represents a single request being processed by the server. The serverEndpoint creates this object when it receives a request. It contains both the http request and response objects as well as any state that is associated with the request as it is being processed. For example, it contains the enrollment ID of the caller after authentication has been performed. Almost all of this code was copied from serverauth.go and so is not new code; see the BasicAuthentication and TokenAuthentication functions. NOTE: I am temporarily decreasing the minimum test coverage from 85% to 80%, but the next change set will change it back. The reason for this temporary lowering of the threshold is because I am introducing new code in this change set which is not yet called, but in the next change set, existing test cases will call it. Change-Id: I763d534083367e6adae642cb8757ef80aebc90ab Signed-off-by: Keith Smith <[email protected]>
This change copies the input file to a local volume before trying to change its access mode so that it can effectively be set to 000. With this change the test passes: $ go test -v -run TestNewUserRegistryMySQL === RUN TestNewUserRegistryMySQL 2017-07-21 22:22:29.463 UTC [bccsp] GetDefault -> WARN 001 Before using BCCSP, please call InitFactories(). Falling back to bootBCCSP. --- PASS: TestNewUserRegistryMySQL (0.00s) PASS ok github.com/hyperledger/fabric-ca/lib 0.012s Patch-set #2, 3, 4: rebase Patch-set #5: Addressed Keith's comments (better handling of error cases) Patch-set #6: added missing change Change-Id: I670ea08aaf2f9c0c4f9cf960ff23fd7326065dc3 Signed-off-by: Arnaud J Le Hors <[email protected]>
This change simply uses a temp dir on a local volume before trying to change its access mode so that it can effectively be set to 000. With this changes the test passes: $ go test -v -run TestSRVServerInit === RUN TestSRVServerInit 2017/08/28 13:14:50 [DEBUG] CA Home Directory: /opt/gopath/src/github.com/hyperledger/fabric-ca/lib/rootDir ... --- PASS: TestSRVServerInit (0.30s) server_test.go:111: Current dir: . server_test.go:112: Current curd: /tmp/ServerInitStat202077287 server_test.go:119: Server.Init error: Failed to get server's home directory: stat .: permission denied PASS Patch-set #2: fixes similar problem with TestCAInit, TestCLIClientConfigStat, and TestCWBCAConfigStat Patch-set #3: makes sure to delete all temp files that were created by tests Patch-set #4: fixes file format Patch-set #5: improves error handling Patch-set #6: fixes error message that referenced wrong dir Patch-set #7: fixes yet another error cleaning up tmp file Change-Id: If2aa88d683df7997159442f1d0d9d678f21496f3 Signed-off-by: Arnaud J Le Hors <[email protected]> Signed-off-by: Allen Bailey <[email protected]>
This change set allows a client to request which attributes should be added to its ECert when enrolling or reenrolling. The server processes these attribute requests using the attrmgr from change set #1. The test case sends requests, gets response from the server, and uses attrmgr to validate that the appropriate attributes are found and have the correct values. Change-Id: I0de57f968f05b29a05be01f0711626d622aed429 Signed-off-by: Keith Smith <[email protected]>
Patch-set #10+: implements approach #2 outlined in FAB-6085 for a complete overall of how the CA DBs are managed This also fixes among other things [FAB-5305]: Before this change "go test -v -run TestMaxEnrollment" fails with: === RUN TestMaxEnrollmentInfinite ... 2017/07/12 00:59:58 [DEBUG] Directing traffic to default CA 2017/07/12 00:59:58 [DEBUG] DB: Getting identity admin 2017/07/12 00:59:58 [DEBUG] DB: Login user admin with max enrollments of -1 and state of 8 2017/07/12 00:59:58 [DEBUG] Max enrollment value (-1) of identity is greater than allowed by CA, using CA max enrollment value of 1 2017/07/12 00:59:58 [DEBUG] Failed to login 'admin': The identity admin has already enrolled 1 times, it has reached its maximum enrollment allowance 2017/07/12 00:59:58 [DEBUG] Received response statusCode=400 (400 Bad Request) --- FAIL: TestMaxEnrollmentLimited (0.55s) server_test.go:986: Test max enrollment limited server_test.go:999: Enrollment failed, error: Error response from server was: Authorization failure panic: runtime error: invalid memory address or nil pointer dereference [recovered] panic: runtime error: invalid memory address or nil pointer dereference [signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x4cb657] goroutine 754 [running]: panic(0xaa1440, 0xc42000e0f0) /opt/go/src/runtime/panic.go:500 +0x1a1 testing.tRunner.func1(0xc42007a600) ... After the change it completes successfully: $ go test -v -run TestMaxEnrollment === RUN TestMaxEnrollmentInfinite 2017/07/14 00:10:43 [INFO] Starting server in home directory: rootDir 2017/07/14 00:10:43 [DEBUG] CA Home Directory: rootDir 2017/07/14 00:10:43 [DEBUG] Making server filenames absolute ... 2017/07/14 00:10:57 [DEBUG] Received response statusCode=500 (500 Internal Server Error) 2017/07/14 00:10:57 [DEBUG] Closing CA DBs 2017/07/14 00:10:57 [INFO] The server closed its listener endpoint 2017/07/14 00:10:57 [DEBUG] Waiting for server to stop 2017/07/14 00:10:57 [ERROR] Server has stopped serving: accept tcp [::]:7075: use of closed network connection 2017/07/14 00:10:58 [DEBUG] Received server stopped message --- PASS: TestMaxEnrollmentLimited (11.65s) server_test.go:1001: Test max enrollment limited PASS ok github.com/hyperledger/fabric-ca/lib 14.749s Patch-set #2+3: removed leftover line from investigation Patch-set #4: changed name to a more generic name server.Clean() Patch-set #6+7: rebase + check error returned by server.Clean() Patch-set #8: rebase + address Keith Smith's comments Patch-set #9: rebase + use new error package Patch-set #10: implement new approach Patch-set #11: debug CI run Patch-set #12: debug CI run Patch-set #13: ensure db is closed before Stop returns Change-Id: Iebce655378933e6cfaef5ae8c6b67d87c5f20f12 Signed-off-by: Arnaud J Le Hors <[email protected]>
This change adds several error checks on removal of temporary files it copies files instead of creating symlinks that don't work on Windows, it uses files in local volumes when chmod is involved and adds stopping of the server and/or closing of the DB to avoid leaving the database dangling in the ether. Patch-set #2: minor simplification Patch-set #3: limits changes to test files leaving to FAB-6085 the changes related to the lib code. Before the change: fabric-ca/lib $ go test --- FAIL: TestCAInit (0.09s) ca_test.go:200: ====== orgwd /opt/gopath/src/github.com/hyperl edger/fabric-ca/lib ca_test.go:211: confDir: TestCAInit514958420 ca_test.go:216: Working dir /opt/gopath/src/github.com/hyperle dger/fabric-ca/testdata/TestCAInit514958420 ca_test.go:236: ca.init error: Failed to get BCCSP with opts: Could not initialize BCCSP PKCS11 [Failed initializing configuration [ Hash Family not supported []]] ca_test.go:253: changed to /opt/gopath/src/github.com/hyperle dger/fabric-ca/testdata/TestCaInit209323427 ca_test.go:272: symlink error: link ../ec256-1-key.pem ca-key .pem: operation not permitted ca_test.go:259: Removed all: /opt/gopath/src/github.com/hyperl edger/fabric-ca/testdata/TestCaInit209323427 ca_test.go:222: Removed all: /opt/gopath/src/github.com/hyperl edger/fabric-ca/testdata/TestCAInit514958420 --- FAIL: TestSRVMultiCAConfigs (0.95s) server_test.go:785: TestMultiCA... server_test.go:791: Server configuration: &{Port:7075 Address: ... server_test.go:810: Starting 3 CAs with a duplicated CN name: Please modify CSR in /opt/gopath/src/github.com/hyperledger/fabric-ca/ testdata/ca/rootca/ca3/ca-cert.pem and try adding CA again: Both issue r and subject distinguished name are already in use server_test.go:817: Create err: <nil> server_test.go:822: Create err: <nil> server_test.go:828: srv.Start ERROR Validation of certificate and key failed: Invalid certificate in file '/opt/gopath/src/github.co m/hyperledger/fabric-ca/testdata/ca/rootca/ca1/ca-cert.pem': Failed to PEM decode certificate server_test.go:842: srv.Start ERROR Validation of certificate a nd key failed: Invalid certificate in file '/opt/gopath/src/github.com/ hyperledger/fabric-ca/testdata/ca/rootca/ca1/ca-cert.pem': Failed to PE M decode certificate server_test.go:2236: symlink expired cert to ../testdata/expire dcert.pem failed: link ../testdata/expiredcert.pem ../testdata/ca/root ca/ca1/ca-cert.pem: file exists server_test.go:2240: symlink key to ../testdata/tls_client-key. pem failed: link ../testdata/tls_client-key.pem ../testdata/ca/rootca/ ca1/ca-key.pem: file exists server_test.go:2244: srvStart ERROR Validation of certificate a nd key failed: Invalid certificate in file '/opt/gopath/src/github.com/ hyperledger/fabric-ca/testdata/ca/rootca/ca1/ca-cert.pem': Failed to PE M decode certificate server_test.go:2236: symlink expired cert to ../testdata/noKeyU sage.cert.pem failed: link ../testdata/noKeyUsage.cert.pem ../testdata /ca/rootca/ca1/ca-cert.pem: file exists server_test.go:2240: symlink key to ../testdata/noKeyUsage.key. pem failed: link ../testdata/noKeyUsage.key.pem ../testdata/ca/rootca/ ca1/ca-key.pem: file exists server_test.go:2244: srvStart ERROR Validation of certificate a nd key failed: Invalid certificate in file '/opt/gopath/src/github.com/ hyperledger/fabric-ca/testdata/ca/rootca/ca1/ca-cert.pem': Failed to PE M decode certificate server_test.go:2236: symlink expired cert to ../testdata/caFals e.cert.pem failed: link ../testdata/caFalse.cert.pem ../testdata/ca/ro otca/ca1/ca-cert.pem: file exists server_test.go:2240: symlink key to ../testdata/caFalse.key.pem failed: link ../testdata/caFalse.key.pem ../testdata/ca/rootca/ca1/ca -key.pem: file exists server_test.go:2244: srvStart ERROR Validation of certificate a nd key failed: Invalid certificate in file '/opt/gopath/src/github.com/ hyperledger/fabric-ca/testdata/ca/rootca/ca1/ca-cert.pem': Failed to PE M decode certificate server_test.go:2236: symlink expired cert to ../testdata/dsaCa- cert.pem failed: link ../testdata/dsaCa-cert.pem ../testdata/ca/rootca /ca1/ca-cert.pem: file exists server_test.go:2240: symlink key to ../testdata/dsaCa-key.pem f ailed: link ../testdata/dsaCa-key.pem ../testdata/ca/rootca/ca1/ca-key .pem: file exists server_test.go:2244: srvStart ERROR Validation of certificate a nd key failed: Invalid certificate in file '/opt/gopath/src/github.com/ hyperledger/fabric-ca/testdata/ca/rootca/ca1/ca-cert.pem': Failed to PE M decode certificate server_test.go:2236: symlink expired cert to ../testdata/dsaCa- cert.pem failed: link ../testdata/dsaCa-cert.pem ../testdata/ca/rootca /ca1/ca-cert.pem: file exists server_test.go:2240: symlink key to ../testdata/dsaCa-key.pem f ailed: link ../testdata/dsaCa-key.pem ../testdata/ca/rootca/ca1/ca-key .pem: file exists server_test.go:2244: srvStart ERROR Validation of certificate a nd key failed: Invalid certificate in file '/opt/gopath/src/github.com/ hyperledger/fabric-ca/testdata/ca/rootca/ca1/ca-cert.pem': Failed to PE M decode certificate server_test.go:2236: symlink expired cert to ../testdata/rsa512 -cert.pem failed: link ../testdata/rsa512-cert.pem ../testdata/ca/root ca/ca1/ca-cert.pem: file exists server_test.go:2240: symlink key to ../testdata/rsa512-key.pem failed: link ../testdata/rsa512-key.pem ../testdata/ca/rootca/ca1/ca-k ey.pem: file exists server_test.go:2244: srvStart ERROR Validation of certificate a nd key failed: Invalid certificate in file '/opt/gopath/src/github.com/ hyperledger/fabric-ca/testdata/ca/rootca/ca1/ca-cert.pem': Failed to PE M decode certificate server_test.go:2236: symlink expired cert to ../testdata/ec256- 1-cert.pem failed: link ../testdata/ec256-1-cert.pem ../testdata/ca/ro otca/ca1/ca-cert.pem: file exists server_test.go:2240: symlink key to ../testdata/ec256-2-key.pem failed: link ../testdata/ec256-2-key.pem ../testdata/ca/rootca/ca1/ca -key.pem: file exists server_test.go:2244: srvStart ERROR Validation of certificate a nd key failed: Invalid certificate in file '/opt/gopath/src/github.com/ hyperledger/fabric-ca/testdata/ca/rootca/ca1/ca-cert.pem': Failed to PE M decode certificate server_test.go:2236: symlink expired cert to ../testdata/rsa204 8-1-cert.pem failed: link ../testdata/rsa2048-1-cert.pem ../testdata/c a/rootca/ca1/ca-cert.pem: file exists server_test.go:2240: symlink key to ../testdata/rsa2048-2-key.p em failed: link ../testdata/rsa2048-2-key.pem ../testdata/ca/rootca/ca 1/ca-key.pem: file exists server_test.go:2244: srvStart ERROR Validation of certificate a nd key failed: Invalid certificate in file '/opt/gopath/src/github.com/ hyperledger/fabric-ca/testdata/ca/rootca/ca1/ca-cert.pem': Failed to PE M decode certificate server_test.go:2236: symlink expired cert to ../testdata/ec256- 1-cert.pem failed: link ../testdata/ec256-1-cert.pem ../testdata/ca/ro otca/ca1/ca-cert.pem: file exists server_test.go:2240: symlink key to ../testdata/rsa2048-1-cert. pem failed: link ../testdata/rsa2048-1-cert.pem ../testdata/ca/rootca/ ca1/ca-key.pem: file exists server_test.go:2244: srvStart ERROR Validation of certificate a ... --- FAIL: TestSRVMultiCAWithIntermediate (0.03s) server_test.go:997: Server configuration: &{Port:7075 Address: ... server_test.go:1002: Failed to start server: Validation of certi ficate and key failed: Invalid certificate in file '/opt/gopath/src/gith ub.com/hyperledger/fabric-ca/testdata/ca/rootca/ca1/ca-cert.pem': Failed to PEM decode certificate --- FAIL: TestSRVMaxEnrollmentInfinite (1.76s) server_test.go:1154: RemoveAll failed: remove rootDir/fabric_ca. db: text file busy server_test.go:1156: Test max enrollment infinite server_test.go:1224: RemoveAll failed: remove rootDir/fabric_ca. db: text file busy --- FAIL: TestSRVMaxEnrollmentDisabled (1.38s) server_test.go:1231: RemoveAll failed: remove rootDir/fabric_ca. db: text file busy server_test.go:1233: Test max enrollment disabled server_test.go:1272: RemoveAll failed: remove rootDir/fabric_ca. db: text file busy --- FAIL: TestSRVMaxEnrollmentLimited (1.65s) server_test.go:1279: RemoveAll failed: remove rootDir/fabric_ca. db: text file busy server_test.go:1281: Test max enrollment limited server_test.go:1358: RemoveAll failed: remove rootDir/fabric_ca. db: text file busy FAIL exit status 1 FAIL github.com/hyperledger/fabric-ca/lib 111.445s After the change: fabric-ca/lib$ go test PASS ok github.com/hyperledger/fabric-ca/lib 128.416s Change-Id: I6e037cf65df6b61ad556824d72c6e7c7ba64f815 Signed-off-by: Arnaud J Le Hors <[email protected]>
This CR simply changes NewCA to newCA. Patch-set #2: rebase Change-Id: I9762d5a6866b187578bf508237d6438edd2cf81f Signed-off-by: Arnaud J Le Hors <[email protected]>
This CR makes it so that in case initCA returns an error after opening the DB, newCA closes the DB before returning a nil and an error and losing the reference to the DB forever. Without the reference to the DB, it becomes impossible to close the DB anymore. Trying to delete the DB file leads to an error on vagrant/Windows: ca_test.go:722: Remove failed: remove ../testdata/fabric-ca-server. db: text file busy FAIL With this CR this error goes away. Patch-set #2: rebase Change-Id: Ic2cab315d0006a39e191358151d2ca44b6de5e83 Signed-off-by: Arnaud J Le Hors <[email protected]>
This CR adds to the unit-tests calls to ca.closeDB so that the DB file can effectively be removed, and error checking to catch any problems with the removal of test files. With these changes the unit-tests pass: $ go test -v === RUN TestCABadCACertificates 2017/10/10 14:00:54 [INFO] The CA key and certificate already exist 2017/10/10 14:00:54 [INFO] The key is stored by BCCSP provider 'SW' ... 2017/10/10 14:03:14 [DEBUG] Closing server DBs 2017/10/10 14:03:15 [DEBUG] Stop: successful stop on port 7075 --- PASS: TestRegisterationAffiliation (1.81s) === RUN TestEnd --- PASS: TestEnd (0.14s) === RUN TestSRVServerClean --- PASS: TestSRVServerClean (0.03s) PASS ok github.com/hyperledger/fabric-ca/lib 141.073s Patch-set #2: rebase Change-Id: Iea4b8afce63cc1bf7a8c100322d2736ffd056156 Signed-off-by: Arnaud J Le Hors <[email protected]>
This change introduces a more systematic policy of removing files generated by each test so that they do not pollute the environment they are run in and they are effectively independent from one another. This includes both files created locally and in os.TempDir. For instance, before this change one cannot run TestCLIClient twice: $ go test -v -run ^TestCLIClient\$ === RUN TestCLIClient --- PASS: TestCLIClient (8.56s) client_test.go:223: GetCAInfo error Failed to create keystore directory: mkdir /home/lehors/Projects/Go/src/github.com/hyperledger/ fabric-ca/lib/: invalid argument [...] client_test.go:436: Client Enroll error Failure generating CS R: Invalid algorithm: dsa PASS ok github.com/hyperledger/fabric-ca/lib 8.575s lehors:~/Projects/Go/src/github.com/hyperledger/fabric-ca/lib $ go test -v -run ^TestCLIClient\$ === RUN TestCLIClient --- FAIL: TestCLIClient (2.49s) client_test.go:223: GetCAInfo error Failed to create keystore directory: mkdir /home/lehors/Projects/Go/src/github.com/hyperledger /fabric-ca/lib/: invalid argument client_test.go:231: GetCAInfo error address localhost:[:7054: too many colons in address client_test.go:240: GetCAInfo error POST failure of request: POST http:///cainfo Authorization: {}: Post http:///cainfo: http: no Host in request URL client_test.go:255: CheckEnrollment error <nil> client_test.go:257: testRegister check enrollment should have failed - client not enrolled FAIL exit status 1 FAIL github.com/hyperledger/fabric-ca/lib 2.496s The reason for the failure on the second run is merely that the first run left some temporary directory behind that trips the second run. With this change, all files and directories created by each test are deleted at the end of each test, even when the test fails half way through. Patch-set #2: Fixed format errors. :-/ Patch-set #3: Rebased Change-Id: Icb7da9df150774387762cbc116a3445ffde02b7d Signed-off-by: Arnaud J Le Hors <[email protected]> Signed-off-by: Keith Smith <[email protected]>
This patch adds a couple of unit tests and change code on removal of an affiliation with sub-affiliations to check that this only happens when the force flag is specified. Before the bug fix the new tests fail: $ go test -v -run=TestAffiliationCmd github.com/hyperledger/fabric-ca/cmd/ fabric-ca-client ... Successfully added affiliation: org4.dept1.team Successfully removed affiliation: &{AffiliationInfo:{Name:org3 Affiliation s:[] Identities:[]} CAName:} Successfully modified affiliation: &{AffiliationInfo:{Name:org3 Affiliatio ns:[] Identities:[]} CAName:} Successfully removed affiliation: &{AffiliationInfo:{Name:org4 Affiliation s:[{Name:org4.dept1 Affiliations:[{Name:org4.dept1.team Affiliations:[] Id entities:[]}] Identities:[]}] Identities:[]} CAName:} 2018/01/30 11:31:21 [ERROR] Server has stopped serving: accept tcp [::]:70 90: use of closed network connection --- FAIL: TestAffiliationCmd (4.13s) Error Trace: main_test.go:858 Error: An error is expected but got nil. Messages: Should have failed, no force argument provided and affiliation being deleted had sub-affiliations FAIL exit status 1 FAIL github.com/hyperledger/fabric-ca/cmd/fabric-ca-client 4.147s After the bug fix the new tests pass: $ go test -v -run=TestAffiliationCmd github.com/hyperledger/fabric-ca/cmd/ fabric-ca-client ... Successfully added affiliation: org4.dept1.team Successfully removed affiliation: &{AffiliationInfo:{Name:org3 Affiliation s:[] Identities:[]} CAName:} Successfully modified affiliation: &{AffiliationInfo:{Name:org3 Affiliatio ns:[] Identities:[]} CAName:} Error: Response from server: Error Code: 20 - Authorization failure Successfully removed affiliation: &{AffiliationInfo:{Name:org4 Affiliation s:[{Name:org4.dept1 Affiliations:[{Name:org4.dept1.team Affiliations:[] Id entities:[]}] Identities:[]}] Identities:[]} CAName:} 2018/01/30 11:33:06 [ERROR] Server has stopped serving: accept tcp [::]:70 90: use of closed network connection --- PASS: TestAffiliationCmd (4.12s) PASS ok github.com/hyperledger/fabric-ca/cmd/fabric-ca-client 4.129s Patch-set #2: Improve error messages. Change-Id: Ib5a7acb68a42f251970cce6735173ea296ef5d54 Signed-off-by: Arnaud J Le Hors <[email protected]>
No description provided.