gitee.com/zhaochuninhefei/fabric-ca-gm@v0.0.2/lib/server/operations/operations_suite_test.go

/*
Copyright IBM Corp. All Rights Reserved.

SPDX-License-Identifier: Apache-2.0
*/

package operations_test

import (
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509/pkix"
	"encoding/pem"
	"fmt"
	"io/ioutil"
	"math/big"
	"net"
	"os"
	"path/filepath"
	"testing"
	"time"

	http "gitee.com/zhaochuninhefei/gmgo/gmhttp"

	tls "gitee.com/zhaochuninhefei/gmgo/gmtls"

	"gitee.com/zhaochuninhefei/gmgo/x509"

	. "github.com/onsi/ginkgo"
	. "github.com/onsi/gomega"
)

func TestOperations(t *testing.T) {
	RegisterFailHandler(Fail)
	RunSpecs(t, "Operations Suite")
}

func generateCertificates(dir string) error {
	cert, privKey, err := genRoot("server-ca", dir)
	if err != nil {
		return err
	}
	err = genCert("server", dir, cert, privKey)
	if err != nil {
		return err
	}
	cert, privKey, err = genRoot("client-ca", dir)
	if err != nil {
		return err
	}
	err = genCert("client", dir, cert, privKey)
	if err != nil {
		return err
	}

	return nil
}

func genRoot(name, dir string) ([]byte, *rsa.PrivateKey, error) {
	template := &x509.Certificate{
		IsCA:                  true,
		BasicConstraintsValid: true,
		SubjectKeyId:          []byte{1, 2, 3},
		SerialNumber:          big.NewInt(1234),
		Subject: pkix.Name{
			Country:      []string{"CN"},
			Organization: []string{"gcsoft"},
			CommonName:   "localhost",
		},
		NotBefore:   time.Now(),
		NotAfter:    time.Now().AddDate(5, 5, 5),
		ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
		KeyUsage:    x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
		DNSNames:    []string{"127.0.0.1", "localhost"},
	}

	// generate private key
	privatekey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return nil, nil, err
	}

	publickey := &privatekey.PublicKey

	// create a self-signed certificate. template = parent
	var parent = template
	cert, err := x509.CreateCertificate(rand.Reader, template, parent, publickey, privatekey)
	if err != nil {
		return nil, nil, err
	}

	// save cert
	certOut, err := os.Create(filepath.Join(dir, fmt.Sprintf("%s.pem", name)))
	if err != nil {
		return nil, nil, err
	}
	if err := pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: cert}); err != nil {
		return nil, nil, err
	}
	if err := certOut.Close(); err != nil {
		return nil, nil, err
	}

	return cert, privatekey, nil
}

func genCert(name, dir string, cert []byte, privKey *rsa.PrivateKey) error {
	template := &x509.Certificate{
		BasicConstraintsValid: true,
		SubjectKeyId:          []byte{1, 2, 3},
		SerialNumber:          big.NewInt(1234),
		Subject: pkix.Name{
			Country:    []string{"CN"},
			CommonName: "localhost",
		},
		NotBefore:   time.Now(),
		NotAfter:    time.Now().AddDate(5, 5, 5),
		ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth, x509.ExtKeyUsageServerAuth},
		KeyUsage:    x509.KeyUsageDigitalSignature | x509.KeyUsageCertSign,
		DNSNames:    []string{"127.0.0.1", "localhost"},
		IPAddresses: []net.IP{net.ParseIP("127.0.0.1")},
	}

	// generate private key
	privatekey, err := rsa.GenerateKey(rand.Reader, 2048)
	if err != nil {
		return err
	}

	publickey := &privatekey.PublicKey
	if err != nil {
		return err
	}

	parentCert, err := x509.ParseCertificate(cert)
	if err != nil {
		return err
	}

	// create a self-signed certificate. template = parent
	cert, err = x509.CreateCertificate(rand.Reader, template, parentCert, publickey, privKey)
	if err != nil {
		return err
	}

	certOut, err := os.Create(filepath.Join(dir, fmt.Sprintf("%s-cert.pem", name)))
	if err != nil {
		return err
	}
	if err := pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: cert}); err != nil {
		return err
	}
	if err := certOut.Close(); err != nil {
		return err
	}

	pemfile, _ := os.Create(filepath.Join(dir, fmt.Sprintf("%s-key.pem", name)))
	var pemkey = &pem.Block{
		Type:  "RSA PRIVATE KEY",
		Bytes: x509.MarshalPKCS1PrivateKey(privatekey)}
	pem.Encode(pemfile, pemkey)
	pemfile.Close()

	return nil
}

func newHTTPClient(tlsDir string, withClientCert bool) *http.Client {
	clientCertPool := x509.NewCertPool()
	caCert, err := ioutil.ReadFile(filepath.Join(tlsDir, "server-ca.pem"))
	Expect(err).NotTo(HaveOccurred())
	clientCertPool.AppendCertsFromPEM(caCert)

	tlsClientConfig := &tls.Config{
		RootCAs: clientCertPool,
	}
	if withClientCert {
		clientCert, err := tls.LoadX509KeyPair(
			filepath.Join(tlsDir, "client-cert.pem"),
			filepath.Join(tlsDir, "client-key.pem"),
		)
		Expect(err).NotTo(HaveOccurred())
		tlsClientConfig.Certificates = []tls.Certificate{clientCert}
	}

	return &http.Client{
		Transport: &http.Transport{
			TLSClientConfig: tlsClientConfig,
		},
	}
}