Skip to content

Commit ee2ec59

Browse files
rennmanrennman
committed
[FAB-2668] Ensure revocation updates DB
Case1: Revoke all user certificates Case2: Revoke user certificate by SN and AKI Ensure case in-sensitivity w/r/t hexadeciaml digits Ensure cross-org revocation is dis-allowed Ensure revocation is dis-allowed for user w/o revoker attribute Ensure DB user table is updated properly Ensure DB certificate table is updated properly Ensure user can revoke own certificate Also update setup script to allow for longer timeouts; The sqlite3 DB is inordinately slow in initialiaing large numbers of affiliations. Change-Id: I0040df5548210c311d1e09862bf3e99eee61a213 Signed-off-by: rennman <eabailey@us.ibm.com>
1 parent 4456f65 commit ee2ec59

File tree

2 files changed

+184
-80
lines changed

2 files changed

+184
-80
lines changed

‎scripts/fvt/fabric-ca_setup.sh‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -190,7 +190,7 @@ backend fabric-cas
190190
function startFabricCa() {
191191
local inst=$1
192192
local start=$SECONDS
193-
local timeout=8
193+
local timeout="$((TIMEOUT*2))"
194194
local now=0
195195
local server_addr=127.0.0.$inst
196196
# if not explcitly set, use default
@@ -221,8 +221,9 @@ function killAllFabricCas() {
221221
test -n "$proxypids" && kill $proxypids
222222
}
223223
224-
while getopts "\?hRCISKXLDTAd:t:l:n:c:k:x:g:m:p:r:" option; do
224+
while getopts "\?hRCISKXLDTAd:t:l:n:c:k:x:g:m:p:r:o:" option; do
225225
case "$option" in
226+
o) TIMEOUT="$OPTARG" ;;
226227
d) DRIVER="$OPTARG" ;;
227228
r) USER_CA_PORT="$OPTARG" ;;
228229
p) HTTP_PORT="$OPTARG" ;;
@@ -249,6 +250,7 @@ while getopts "\?hRCISKXLDTAd:t:l:n:c:k:x:g:m:p:r:" option; do
249250
esac
250251
done
251252
253+
: ${TIMEOUT:="10"}
252254
: ${HTTP_PORT:="3755"}
253255
: ${DBNAME:="fabric_ca"}
254256
: ${MAXENROLL:="1"}

‎scripts/fvt/revoke_test.sh‎

Lines changed: 180 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -2,99 +2,201 @@
22
FABRIC_CA="$GOPATH/src/github.com/hyperledger/fabric-ca"
33
SCRIPTDIR="$FABRIC_CA/scripts/fvt"
44
TESTDATA="$FABRIC_CA/testdata"
5-
FABRIC_CA_EXEC="$FABRIC_CA/bin/fabric-ca"
6-
FABRIC_CA_HOME="$HOME/fabric-ca"
5+
export CA_CFG_PATH="/tmp/revoke_test"
76
RC=0
8-
URI="localhost:8888"
9-
DB="$TESTDATA/fabric_ca.db"
10-
USERS=("admin" "admin2" "notadmin")
11-
PSWDS=("adminpw" "adminpw2" "pass")
7+
# FIXME should not require user:pass
8+
URI="http://user:pass@localhost:8888"
9+
DB="fabric_ca"
10+
USERS=("admin" "admin2" "notadmin" "testUser" "testUser2" "testUser3" )
11+
PSWDS=("adminpw" "adminpw2" "pass" "user1" "user2" "user3" )
12+
#USERS=("admin" "admin2" "notadmin")
13+
#PSWDS=("adminpw" "adminpw2" "pass")
1214
HTTP_PORT="3755"
13-
export FABRIC_CA_HOME="/tmp/${USERS[1]}"
1415

1516
. $SCRIPTDIR/fabric-ca_utils
1617

17-
18-
# Expected codes
19-
# user cert
20-
test1Result="1 good"
21-
test2Result="1 revoked"
22-
test3Result="1 revoked"
18+
genAffYaml() {
19+
local Planet=(0 1)
20+
local Landmass=(0)
21+
local Country=(0 1)
22+
local Province=(0 1 2)
23+
local Locale=(0)
24+
local City=(0 1)
25+
local Hood=(0 1 2 3 4 5 6)
26+
echo "affiliations:"
27+
indent="${indent} "
28+
for P in ${Planet[@]}; do
29+
echo "${indent}Planet$P:"
30+
indent="${indent} "
31+
for L in ${Landmass[@]}; do
32+
echo "${indent}Landmass$L:"
33+
indent="${indent} "
34+
for C in ${Country[@]}; do
35+
echo "${indent}Country$C:"
36+
indent="${indent} "
37+
for R in ${Province[@]}; do
38+
echo "${indent}Province$R:"
39+
indent="${indent} "
40+
for O in ${Locale[@]}; do
41+
echo "${indent}Locale$O:"
42+
indent="${indent} "
43+
for I in ${City[@]}; do
44+
echo "${indent}City$I:"
45+
indent="${indent} "
46+
for H in ${Hood[@]}; do
47+
echo "${indent}- Hood$H"
48+
done
49+
indent="${indent# }"
50+
done
51+
indent="${indent# }"
52+
done
53+
indent="${indent# }"
54+
done
55+
indent="${indent# }"
56+
done
57+
indent="${indent# }"
58+
done
59+
indent="${indent# }"
60+
done
61+
indent="${indent} "
62+
}
2363

2464
function testStatus() {
25-
local user="$1"
26-
user_status=$(sqlite3 $DB "SELECT * FROM users WHERE (id=\"$user\");")
27-
cert_status=$(sqlite3 $DB "SELECT * FROM certificates WHERE (id=\"$user\");")
28-
user_status_code=$(echo $user_status | awk -F'|' '{print $6}')
29-
cert_status_code=$(echo $cert_status | awk -F'|' '{print $5}')
30-
echo "$user_status_code $cert_status_code"
65+
local user="$1"
66+
local driver="$2"
67+
: ${driver:="sqlite3"}
68+
case $driver in
69+
sqlite3)
70+
user_status=$(sqlite3 $CA_CFG_PATH/$DB "SELECT * FROM users WHERE (id=\"$user\");")
71+
cert_status=$(sqlite3 $CA_CFG_PATH/$DB "SELECT * FROM certificates WHERE (id=\"$user\");")
72+
user_status_code=$(echo $user_status | awk -F'|' '{print $6}')
73+
cert_status_code=$(echo $cert_status | awk -F'|' '{print $5}')
74+
;;
75+
mysql)
76+
user_status_code=$(mysql --host=localhost --user=root --password=mysql -e "SELECT * FROM users WHERE (id=\"$user\");" $DB| awk -F'\t' -v u=$user '$1~u {print $6}')
77+
cert_status_code=$(mysql --host=localhost --user=root --password=mysql -e "SELECT * FROM certificates WHERE (id=\"$user\");" $DB| awk -F'\t' -v u=$user '$1~u {print $5}')
78+
;;
79+
postgres)
80+
user_status_code=$(/usr/bin/psql -U postgres -h localhost -c "SELECT id,state FROM users WHERE id='$user';" --dbname=fabric_ca | awk -v u=$user -F'|' '$1~u {gsub(/ /,"");print $2}')
81+
cert_status_code=$(/usr/bin/psql -U postgres -h localhost -c "SELECT id,encode(status,'escape') FROM certificates WHERE id='$user';" --dbname=fabric_ca | awk -v u=$user -F'|' '$1~u {gsub(/ /,"");print $2}')
82+
;;
83+
esac
84+
echo "$user_status_code $cert_status_code"
3185
}
3286

87+
# Expected codes
88+
# user cert
89+
enrolledGood="1 good"
90+
enrolledRevoked="1 revoked"
91+
revokedRevoked="-1 revoked"
92+
TEST_RESULTS=("$revokedRevoked" "$revokedRevoked" "$enrolledRevoked" "$enrolledRevoked" "$enrolledGood" "$enrolledGood" )
93+
3394
cd $TESTDATA
3495
python -m SimpleHTTPServer $HTTP_PORT &
3596
HTTP_PID=$!
3697
pollServer python localhost "$HTTP_PORT" || ErrorExit "Failed to start HTTP server"
3798
echo $HTTP_PID
38-
trap "kill $HTTP_PID; CleanUp" INT
39-
40-
41-
# Kill any running servers
42-
$SCRIPTDIR/fabric-ca_setup.sh -R -x $FABRIC_CA_HOME
43-
44-
# Setup CA server
45-
$SCRIPTDIR/fabric-ca_setup.sh -I -S -X
46-
47-
# Enroll
48-
i=-1
49-
while test $((i++)) -lt 2; do
50-
FABRIC_CA_HOME="/tmp/${USERS[i]}"
51-
$SCRIPTDIR/enroll.sh -u "${USERS[i]}" -p "${PSWDS[i]}" -x "/tmp/${USERS[i]}"
99+
trap "kill $HTTP_PID; CleanUp; exit 1" INT
100+
101+
102+
for driver in mysql postgres sqlite3; do
103+
echo ""
104+
echo ""
105+
echo ""
106+
echo ""
107+
echo "=====================> TESTING $driver"
108+
# Kill any running servers
109+
$SCRIPTDIR/fabric-ca_setup.sh -R -d $driver
110+
111+
# Setup CA server
112+
$SCRIPTDIR/fabric-ca_setup.sh -D -I -d $driver
113+
genAffYaml >> $CA_CFG_PATH/runFabricCaFvt.yaml
114+
$SCRIPTDIR/fabric-ca_setup.sh -o 60 -D -S -X -d $driver -x $CA_CFG_PATH
115+
if test "$?" -ne 0; then
116+
kill $HTTP_PID
117+
wait $HTTP_PID
118+
ErrorExit "Failed to setup server" RC
119+
fi
120+
sleep 5
121+
# Enroll admin, admin2, notadmin, testUser
122+
i=-1
123+
while test $((i++)) -lt 5; do
124+
enroll "${USERS[i]}" "${PSWDS[i]}" "$CA_CFG_PATH/${USERS[i]}"
125+
done
126+
127+
# notadmin cannot revoke
128+
export FABRIC_CA_CLIENT_HOME="/tmp/revoke_test/${USERS[2]}"
129+
$FABRIC_CA_CLIENTEXEC revoke -u $URI --eid ${USERS[1]}
130+
test "$?" -eq 0 && ErrorMsg "Non-revoker successfully revoked cert"
131+
132+
# Check the DB contents
133+
while test $((i++)) -lt 3; do
134+
test "$(testStatus ${USERS[i]} $driver)" = "$enrolledGood" ||
135+
ErrorMsg "Incorrect user/certificate status for ${USERS[i]}" RC
136+
done
137+
138+
### Ensure case-insensitivity by using both upper/lower case
139+
### in two separate instances
140+
# Grab the serial number of notadmin cert
141+
SN_UC="$(openssl x509 -noout -serial -in $CA_CFG_PATH/${USERS[2]}/msp/signcerts/cert.pem | awk -F'=' '{print toupper($2)}')"
142+
# and the auth keyid of notadmin cert - translate upper to lower case
143+
AKI_UC=$(openssl x509 -noout -text -in $CA_CFG_PATH/${USERS[2]}/msp/signcerts/cert.pem |awk '/keyid/ {gsub(/ *keyid:|:/,"",$1);print toupper($0)}')
144+
145+
# Grab the serial number of testUser cert
146+
SN_LC="$(openssl x509 -noout -serial -in $CA_CFG_PATH/${USERS[3]}/msp/signcerts/cert.pem | awk -F'=' '{print tolower($2)}')"
147+
# and the auth keyid of testUser cert - translate upper to lower case
148+
AKI_LC=$(openssl x509 -noout -text -in $CA_CFG_PATH/${USERS[3]}/msp/signcerts/cert.pem |awk '/keyid/ {gsub(/ *keyid:|:/,"",$1);print tolower($0)}')
149+
150+
# Revoke the certs
151+
echo "=========================> REVOKING by --eid"
152+
export FABRIC_CA_CLIENT_HOME="/tmp/revoke_test/${USERS[0]}"
153+
#### Blanket revoke all of admin2 certs
154+
$FABRIC_CA_CLIENTEXEC revoke -u $URI --eid ${USERS[1]}
155+
156+
#### Revoke notadmin's cert by serial number and authority keyid
157+
#### using upper-case hexidecimal
158+
echo "=========================> REVOKING by -s -a (UPPERCASE)"
159+
$FABRIC_CA_CLIENTEXEC revoke -s $SN_UC -a $AKI_UC -u $URI
160+
161+
#### Ensure that revoking an already revoked cert doesn't blow up
162+
echo "=========================> Issuing duplicate revoke by -s -a"
163+
$FABRIC_CA_CLIENTEXEC revoke -s $SN_UC -a $AKI_UC -u $URI
164+
165+
#### Revoke using lower-case hexadeciaml
166+
# FIXME - should allow combination of SN + AKI + EID
167+
#$FABRIC_CA_CLIENTEXEC revoke -s $SN_LC -a $AKI_LC -u $URI --eid ${USERS[3]}
168+
echo "=========================> REVOKING by -s -a (LOWERCASE)"
169+
$FABRIC_CA_CLIENTEXEC revoke -s $SN_LC -a $AKI_LC -u $URI
170+
171+
echo "=========================> REVOKING by --eid"
172+
export FABRIC_CA_CLIENT_HOME="/tmp/revoke_test/${USERS[0]}"
173+
#### Revoke across affiliations not allowed
174+
$FABRIC_CA_CLIENTEXEC revoke -u $URI --eid ${USERS[5]}
175+
176+
#### Revoke my own cert
177+
echo "=========================> REVOKING self"
178+
$FABRIC_CA_CLIENTEXEC revoke --eid ${USERS[0]}
179+
180+
# Verify the DB update
181+
for ((i=${#USERS[@]}; i<=0; i--)); do
182+
test "$(testStatus ${USERS[i-1]} $driver)" = "${TEST_RESULTS[i-1]}" ||
183+
ErrorMsg "Incorrect user/certificate status for ${USERS[i-1]}" RC
184+
done
185+
186+
# Veriy that the cert is no longer usable
187+
export FABRIC_CA_CLIENT_HOME="/tmp/revoke_test/${USERS[0]}"
188+
register ${USERS[0]} 'user100'
189+
test "$?" -eq 0 && ErrorMsg "${USERS[0]} authenticated with revoked certificate" RC
190+
export FABRIC_CA_CLIENT_HOME="/tmp/revoke_test/${USERS[1]}"
191+
register ${USERS[1]} 'user101'
192+
test "$?" -eq 0 && ErrorMsg "${USERS[1]} authenticated with revoked certificate" RC
193+
194+
# Verify the DB update
195+
for ((i=${#USERS[@]}; i<=0; i--)); do
196+
test "$(testStatus ${USERS[i-1]} $driver)" = "${TEST_RESULTS[i-1]}" ||
197+
ErrorMsg "Incorrect user/certificate status for ${USERS[i-1]}" RC
198+
done
52199
done
53-
54-
# notadmin cannot revoke
55-
FABRIC_CA_HOME="/tmp/${USERS[2]}"
56-
$FABRIC_CA_EXEC client revoke $URI ${USERS[2]}
57-
test "$?" -eq 0 && ErrorMsg "Non-revoker successfully revoked cert"
58-
59-
# Check the DB contents
60-
test "$(testStatus ${USERS[0]})" = "$test1Result" ||
61-
ErrorMsg "Incorrect user/certificate status for ${USERS[0]}" RC
62-
test "$(testStatus ${USERS[1]})" = "$test1Result" ||
63-
ErrorMsg "Incorrect user/certificate status for ${USERS[1]}" RC
64-
65-
# Grab the serial number of admin cert (convert to decimal)
66-
SN=$(echo "ibase=16;$(openssl x509 -noout -serial -in /tmp/${USERS[0]}/cert.pem | awk -F'=' '{print $2}')" | bc)
67-
# and the auth keyid of admin cert - translate upper to lower case
68-
AKI=$(openssl x509 -noout -text -in /tmp/${USERS[0]}/cert.pem |awk '/keyid/ {gsub(/ *keyid:|:/,"",$1);print tolower($0)}')
69-
70-
# Revoke the certs
71-
FABRIC_CA_HOME="/tmp/${USERS[0]}"
72-
#### Blanket all of admin2 certs
73-
$FABRIC_CA_EXEC client revoke $URI ${USERS[1]}
74-
#### Revoke admin's cert by serial number and authority keyid
75-
$FABRIC_CA_EXEC client revoke -serial $SN -aki $AKI $URI ${USERS[0]}
76-
77-
# Verify the DB update
78-
test "$(testStatus ${USERS[0]})" = "$test2Result" ||
79-
ErrorMsg "Incorrect user/certificate status for ${USERS[0]}" RC
80-
test "$(testStatus ${USERS[1]})" = "$test2Result" ||
81-
ErrorMsg "Incorrect user/certificate status for ${USERS[1]}" RC
82-
83-
# Veriy that the cert is no longer usable
84-
FABRIC_CA_HOME="/tmp/${USERS[0]}"
85-
$SCRIPTDIR/register.sh -u 'user100'
86-
FABRIC_CA_HOME="/tmp/${USERS[0]}"
87-
test "$?" -eq 0 && ErrorMsg "${USERS[0]} authenticated with revoked certificate" RC
88-
FABRIC_CA_HOME="/tmp/${USERS[1]}"
89-
$SCRIPTDIR/register.sh -u 'user101'
90-
test "$?" -eq 0 && ErrorMsg "${USERS[1]} authenticated with revoked certificate" RC
91-
92-
# Verify the DB update
93-
test "$(testStatus ${USERS[0]})" = "$test3Result" ||
94-
ErrorMsg "Incorrect user/certificate status for ${USERS[0]}" RC
95-
test "$(testStatus ${USERS[1]})" = "$test3Result" ||
96-
ErrorMsg "Incorrect user/certificate status for ${USERS[1]}" RC
97-
98200
CleanUp $RC
99201
kill $HTTP_PID
100202
wait $HTTP_PID

0 commit comments

Comments
 (0)