github.com/extrame/fabric-ca@v2.0.0-alpha+incompatible/scripts/fvt/multica_test.sh (about)

     1  #!/bin/bash
     2  #
     3  # Copyright IBM Corp. All Rights Reserved.
     4  #
     5  # SPDX-License-Identifier: Apache-2.0
     6  #
     7  
     8  
     9  : ${TESTCASE:="multica-test"}
    10  TDIR=/tmp/$TESTCASE
    11  FABRIC_CA="$GOPATH/src/github.com/hyperledger/fabric-ca"
    12  SCRIPTDIR="$FABRIC_CA/scripts/fvt"
    13  TESTDATA="$FABRIC_CA/testdata"
    14  . $SCRIPTDIR/fabric-ca_utils
    15  PROTO="http://"
    16  TLSDIR="$TESTDATA"
    17  NUMINTCAS=4
    18  MAXENROLL=$((2*NUMINTCAS))
    19  NUMUSERS=2
    20  RC=0
    21  
    22  function createRootCA() {
    23     # Start RootCA
    24     mkdir -p "$TDIR/ca0"
    25     $SCRIPTDIR/fabric-ca_setup.sh -I -x "$TDIR/ca0" -d $driver -m $MAXENROLL
    26     sed -i "/^ca:/,/^[^\t ]/ s@\(\(cert\|key\)file:\).*@\1@" $TDIR/ca0/runFabricCaFvt.yaml
    27     FABRIC_CA_SERVER_HOME="$TDIR/ca0" fabric-ca-server start -d --cacount $NUMINTCAS \
    28                                        --csr.hosts $CA_HOST_ADDRESS --address $CA_HOST_ADDRESS \
    29                                        -c $TDIR/ca0/runFabricCaFvt.yaml 2>&1 |
    30                                        tee $TDIR/ca0/server.log &
    31     pollFabricCa "" "" $CA_DEFAULT_PORT
    32  }
    33  
    34  function enrollUser() {
    35     local user=$1
    36     local pswd=$2
    37     local caname=$3
    38     /usr/local/bin/fabric-ca-client enroll -d \
    39                     --caname $caname \
    40                     --mspdir $TDIR/$caname/$user/${user}msp \
    41                     --id.maxenrollments $MAXENROLL \
    42                     -u ${PROTO}$user:$pswd@$CA_HOST_ADDRESS:$CA_DEFAULT_PORT \
    43                     -c $TDIR/$caname/enroll.yaml \
    44                     $TLSOPT \
    45                     --csr.hosts $user@fab-client.raleigh.ibm.com,${user}.fabric.raleigh.ibm.com,127.42.42.$i
    46     return $?
    47  }
    48  
    49  function registerAndEnrollUser() {
    50     local user=$1
    51     local caname=$2
    52     local attrs='a=1,b=2,c=3,d=4,e=5,f=6,g=7,h=8,i=9,j=100000'
    53     local rc=0
    54     pswd=$(eval /usr/local/bin/fabric-ca-client register -u ${PROTO}admin:adminpw@$CA_HOST_ADDRESS:$CA_DEFAULT_PORT \
    55                          --id.attrs "$attrs" \
    56                          --caname $caname \
    57                          --mspdir $TDIR/$caname/admin/adminmsp \
    58                          --id.name $user \
    59                          --id.type user \
    60                          --id.maxenrollments $MAXENROLL \
    61                          --id.affiliation bank_a \
    62                          $TLSOPT \
    63                          -c $TDIR/$caname/register.yaml|tail -n1 | awk '{print $NF}')
    64     /usr/local/bin/fabric-ca-client enroll \
    65                     --caname $caname \
    66                     --mspdir $TDIR/$caname/$user/${user}msp \
    67                     --id.maxenrollments $MAXENROLL \
    68                     -u ${PROTO}$user:$pswd@$CA_HOST_ADDRESS:$CA_DEFAULT_PORT \
    69                     -c $TDIR/$caname/$user/enroll.yaml \
    70                     $TLSOPT \
    71                     --csr.hosts $user@fab-client.raleigh.ibm.com,$user.fabric.raleigh.ibm.com,127.37.37.$i
    72     return $?
    73  }
    74  
    75  function reenrollUser() {
    76     local user=$1
    77     local caname=$2
    78     local rc=0
    79     /usr/local/bin/fabric-ca-client reenroll \
    80                        --caname $caname \
    81                        --mspdir $TDIR/$caname/${user}/${user}msp \
    82                        --id.maxenrollments $MAXENROLL \
    83                        -u ${PROTO}@$CA_HOST_ADDRESS:$CA_DEFAULT_PORT \
    84                        -c $TDIR/$caname/$user/enroll.yaml \
    85                        $TLSOPT \
    86                        --csr.hosts ${user}@fab-client.raleigh.ibm.com,${user}.fabric.raleigh.ibm.com,127.42.42.$i
    87     return $?
    88  }
    89  
    90  function revokeUser() {
    91     local revoker=$1
    92     local user=$2
    93     local caname=$3
    94     local sn=$4
    95     local aki=$5
    96     local rc=0
    97     test -n "$sn" && local serial="--revoke.serial $sn"
    98     test -n "$aki" && local index="--revoke.aki $aki"
    99     export FABRIC_CA_CLIENT_HOME="$TDIR/$caname/$revoker"
   100     /usr/local/bin/fabric-ca-client revoke --caname $caname \
   101                 --mspdir $TDIR/$caname/$revoker/${revoker}msp \
   102                 -u ${PROTO}$CA_HOST_ADDRESS:$CA_DEFAULT_PORT \
   103                 --revoke.name $user $serial $index $TLSOPT
   104     return $?
   105  }
   106  
   107  function resetDB() {
   108    local driver=$1
   109    if [ $driver = "mysql" ]; then
   110      i=0;while test $((i++)) -lt $NUMINTCAS; do
   111        mysql --host=localhost --user=root --password=mysql -e "drop database fabric_ca_ca$i;"
   112      done
   113    fi
   114  
   115    if [ $driver = "postgres" ]; then
   116      i=0;while test $((i++)) -lt $NUMINTCAS; do
   117        psql -c "drop database fabric_ca_ca$i"
   118      done
   119    fi
   120  
   121    if [ $driver = "sqlite3" ]; then
   122      rm -rf $TDIR
   123    fi
   124  }
   125  
   126  #function setTLS() {
   127  #: ${FABRIC_TLS:="false"}
   128  #if $($FABRIC_TLS); then
   129  #   PROTO="https://"
   130  #fi
   131  #}
   132  
   133  ### Start Test ###
   134  for driver in postgres mysql; do
   135  
   136    # Expected codes
   137     # Result after enroll/reenroll -
   138     #    user status: 1, certs status: all 'good'
   139     enrolledGood=$(printf "1 %s\n%s\n%s" good good good)
   140     # Result after revoking the current enrollment cert -
   141     #    user status: 1, certs status: one revoked
   142     enrolledRevoked=$(printf "1 %s\n%s\n%s" good good revoked)
   143     # Result after revoking userid -
   144     #    user status: -1, certs status: all 'revoked'
   145     revokedRevoked=$(printf -- "-1 %s\n%s\n%s" revoked revoked revoked)
   146  
   147     $SCRIPTDIR/fabric-ca_setup.sh -R -x $TDIR/ca0 -D -d $driver
   148     rm -rf $TDIR
   149  
   150     # if ENV FABRIC_TLS=true, use TLS
   151     setTLS
   152     resetDB $driver
   153  
   154     createRootCA || ErrorExit "Failed to create root CA"
   155  
   156     USERS=("admin" "admin2" "notadmin" "testUser" "testUser2" "testUser3" )
   157     PSWDS=("adminpw" "adminpw2" "pass" "user1" "user2" "user3" )
   158     # roundrobin through all servers in pool and enroll users
   159     u=-1; while test $((u++)) -lt ${#USERS[u]}; do
   160        i=0;while test $((i++)) -lt $NUMINTCAS; do
   161           for iter in $(seq 1 $MAXENROLL); do
   162              # Issue duplicate enroll to ensure proper processing of multiple requests
   163              enrollUser ${USERS[u]} ${PSWDS[u]} ca$i || ErrorExit "Failed to enroll ${USERS[u]} to ca$i"
   164           done
   165        done
   166     done
   167  
   168     # enrolling beyond the configured MAXENROLL should fail
   169     u=-1; while test $((u++)) -lt ${#USERS[u]}; do
   170        i=0;while test $((i++)) -lt $NUMINTCAS; do
   171           enrollUser ${USERS[u]} ${PSWDS[u]} ca$i && ErrorExit "Should have failed to enroll ${USERS[u]} to ca$i"
   172        done
   173     done
   174  
   175     i=0;while test $((i++)) -lt $NUMINTCAS;  do
   176        j=0;while test $((j++)) -lt $NUMUSERS; do
   177           registerAndEnrollUser user$i$j ca$i || ErrorExit "Enroll user$i$j to CA ca$i failed"
   178        done
   179     done
   180  
   181     # roundrobin through all servers in pool and renroll users
   182     for iter in {0..1}; do
   183        # Issue duplicate reenroll to ensure proper processing of multiple requests
   184        i=0;while test $((i++)) -lt $NUMINTCAS;  do
   185           j=0;while test $((j++)) -lt $NUMUSERS; do
   186              reenrollUser user$i$j ca$i || ErrorExit "reenrollUser user$i$j ca$i failed"
   187           done
   188        done
   189     done
   190  
   191     # notadmin cannot revoke
   192     revokeUser notadmin user11 ca1 2>&1 | egrep "Authorization failure"
   193     test "$?" -ne 0 && ErrorMsg "Non-revoker successfully revoked cert or failed for incorrect reason"
   194  
   195     # Check the DB contents
   196     i=0;while test $((i++)) -lt $NUMINTCAS;  do
   197        j=0;while test $((j++)) -lt $NUMUSERS; do
   198           test "$(testStatus user$i$j $driver $TDIR/ca0/ca/ca$i fabric_ca_ca$i )" = "$enrolledGood" ||
   199              ErrorMsg "Incorrect user/certificate status for $user$i$j" RC
   200        done
   201     done
   202  
   203     i=0;while test $((i++)) -lt $NUMINTCAS;  do
   204        j=0;while test $((j++)) -lt $NUMUSERS; do
   205           c="$TDIR/ca$i/user$i$j/user$i${j}msp/signcerts/cert.pem"
   206           # Grab the serial number of user$i$j cert
   207           SN_UC="$(openssl x509 -noout -serial -in $c | awk -F'=' '{print toupper($2)}')"
   208           # and the auth keyid of notadmin cert - translate upper to lower case
   209           AKI_UC=$(openssl x509 -noout -text -in $c |awk '/keyid/ {gsub(/ *keyid:|:/,"",$1);print toupper($0)}')
   210           # Revoke the certs
   211           echo "SN  ---> $SN_UC"
   212           echo "AKI ---> $AKI_UC"
   213           revokeUser admin user$i$j ca$i "$SN_UC" "$AKI_UC"
   214           #### Ensure that revoking an already revoked cert doesn't blow up
   215           echo "=========================> Issuing duplicate revoke by -s -a"
   216           revokeUser admin user$i$j ca$i "$SN_UC" "$AKI_UC"
   217           test "$(testStatus user$i$j $driver $TDIR/ca0/ca/ca$i fabric_ca_ca$i )" = "$enrolledRevoked" ||
   218              ErrorMsg "Incorrect user/certificate status for user$i$j" RC
   219        done
   220     done
   221  
   222     i=0;while test $((i++)) -lt $NUMINTCAS;  do
   223        j=0;while test $((j++)) -lt $NUMUSERS; do
   224           echo "=========================> REVOKING by --eid"
   225           revokeUser admin user$i$j ca$i
   226           #### Ensure that revoking an already revoked cert doesn't blow up
   227           echo "=========================> Issuing duplicate revoke by -s -a"
   228           revokeUser admin user$i$j ca$i
   229           test "$(testStatus user$i$j $driver $TDIR/ca0/ca/ca$i fabric_ca_ca$i )" = "$revokedRevoked" ||
   230              ErrorMsg "Incorrect user/certificate status for user$i$j" RC
   231        done
   232     done
   233  
   234     #### Revoke admin cert
   235     i=0;while test $((i++)) -lt $NUMINTCAS;  do
   236        j=0;while test $((j++)) -lt $NUMUSERS; do
   237           echo "=========================> REVOKING self"
   238           revokeUser admin admin ca$i
   239           # Verify that the cert is no longer usable
   240           revokeUser admin user$i$j ca$i 2>&1 | egrep "Authentication failure"
   241           test $? -ne 0 && ErrorMsg "Improper revocation using revoked certificate" RC
   242        done
   243     done
   244  
   245     $SCRIPTDIR/fabric-ca_setup.sh -L -x $TDIR/ca0 -D -d $driver
   246     kill $(ps -x -o pid,comm | awk '$2~/fabric-ca-serve/ {print $1}')
   247  done
   248  
   249  # If the test failed, leave the results for debugging
   250  test "$RC" -eq 0 && $SCRIPTDIR/fabric-ca_setup.sh -R -x $CA_CFG_PATH -d $driver
   251  
   252  ### Clean up ###
   253  rm -f $TESTDATA/openssl.cnf.base.req
   254  CleanUp "$RC"
   255  exit $RC
   256