google.golang.org/grpc@v1.62.1/internal/testutils/xds/e2e/setup_certs.go (about)

     1  /*
     2   *
     3   * Copyright 2022 gRPC authors.
     4   *
     5   * Licensed under the Apache License, Version 2.0 (the "License");
     6   * you may not use this file except in compliance with the License.
     7   * You may obtain a copy of the License at
     8   *
     9   *     http://www.apache.org/licenses/LICENSE-2.0
    10   *
    11   * Unless required by applicable law or agreed to in writing, software
    12   * distributed under the License is distributed on an "AS IS" BASIS,
    13   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    14   * See the License for the specific language governing permissions and
    15   * limitations under the License.
    16   *
    17   */
    18  
    19  package e2e
    20  
    21  import (
    22  	"crypto/tls"
    23  	"crypto/x509"
    24  	"fmt"
    25  	"os"
    26  	"path"
    27  	"testing"
    28  
    29  	"google.golang.org/grpc/credentials"
    30  	"google.golang.org/grpc/testdata"
    31  )
    32  
    33  const (
    34  	// Names of files inside tempdir, for certprovider plugin to watch.
    35  	certFile = "cert.pem"
    36  	keyFile  = "key.pem"
    37  	rootFile = "ca.pem"
    38  )
    39  
    40  func createTmpFile(src, dst string) error {
    41  	data, err := os.ReadFile(src)
    42  	if err != nil {
    43  		return fmt.Errorf("os.ReadFile(%q) failed: %v", src, err)
    44  	}
    45  	if err := os.WriteFile(dst, data, os.ModePerm); err != nil {
    46  		return fmt.Errorf("os.WriteFile(%q) failed: %v", dst, err)
    47  	}
    48  	return nil
    49  }
    50  
    51  // createTempDirWithFiles creates a temporary directory under the system default
    52  // tempDir with the given dirSuffix. It also reads from certSrc, keySrc and
    53  // rootSrc files are creates appropriate files under the newly create tempDir.
    54  // Returns the name of the created tempDir.
    55  func createTmpDirWithFiles(dirSuffix, certSrc, keySrc, rootSrc string) (string, error) {
    56  	// Create a temp directory. Passing an empty string for the first argument
    57  	// uses the system temp directory.
    58  	dir, err := os.MkdirTemp("", dirSuffix)
    59  	if err != nil {
    60  		return "", fmt.Errorf("os.MkdirTemp() failed: %v", err)
    61  	}
    62  
    63  	if err := createTmpFile(testdata.Path(certSrc), path.Join(dir, certFile)); err != nil {
    64  		return "", err
    65  	}
    66  	if err := createTmpFile(testdata.Path(keySrc), path.Join(dir, keyFile)); err != nil {
    67  		return "", err
    68  	}
    69  	if err := createTmpFile(testdata.Path(rootSrc), path.Join(dir, rootFile)); err != nil {
    70  		return "", err
    71  	}
    72  	return dir, nil
    73  }
    74  
    75  // CreateClientTLSCredentials creates client-side TLS transport credentials
    76  // using certificate and key files from testdata/x509 directory.
    77  func CreateClientTLSCredentials(t *testing.T) credentials.TransportCredentials {
    78  	t.Helper()
    79  
    80  	cert, err := tls.LoadX509KeyPair(testdata.Path("x509/client1_cert.pem"), testdata.Path("x509/client1_key.pem"))
    81  	if err != nil {
    82  		t.Fatalf("tls.LoadX509KeyPair(x509/client1_cert.pem, x509/client1_key.pem) failed: %v", err)
    83  	}
    84  	b, err := os.ReadFile(testdata.Path("x509/server_ca_cert.pem"))
    85  	if err != nil {
    86  		t.Fatalf("os.ReadFile(x509/server_ca_cert.pem) failed: %v", err)
    87  	}
    88  	roots := x509.NewCertPool()
    89  	if !roots.AppendCertsFromPEM(b) {
    90  		t.Fatal("Failed to append certificates")
    91  	}
    92  	return credentials.NewTLS(&tls.Config{
    93  		Certificates: []tls.Certificate{cert},
    94  		RootCAs:      roots,
    95  		ServerName:   "x.test.example.com",
    96  	})
    97  }
    98  
    99  // CreateServerTLSCredentials creates server-side TLS transport credentials
   100  // using certificate and key files from testdata/x509 directory.
   101  func CreateServerTLSCredentials(t *testing.T, clientAuth tls.ClientAuthType) credentials.TransportCredentials {
   102  	t.Helper()
   103  
   104  	cert, err := tls.LoadX509KeyPair(testdata.Path("x509/server1_cert.pem"), testdata.Path("x509/server1_key.pem"))
   105  	if err != nil {
   106  		t.Fatalf("tls.LoadX509KeyPair(x509/server1_cert.pem, x509/server1_key.pem) failed: %v", err)
   107  	}
   108  	b, err := os.ReadFile(testdata.Path("x509/client_ca_cert.pem"))
   109  	if err != nil {
   110  		t.Fatalf("os.ReadFile(x509/client_ca_cert.pem) failed: %v", err)
   111  	}
   112  	ca := x509.NewCertPool()
   113  	if !ca.AppendCertsFromPEM(b) {
   114  		t.Fatal("Failed to append certificates")
   115  	}
   116  	return credentials.NewTLS(&tls.Config{
   117  		ClientAuth:   clientAuth,
   118  		Certificates: []tls.Certificate{cert},
   119  		ClientCAs:    ca,
   120  	})
   121  }