@@ -19,7 +19,9 @@ package comm_test
19
19
import (
20
20
"crypto/tls"
21
21
"crypto/x509"
22
+ "io/ioutil"
22
23
"net"
24
+ "path/filepath"
23
25
"testing"
24
26
"time"
25
27
@@ -61,7 +63,7 @@ zA85vv7JhfMkvZYGPELC7I2K8V7ZAiEA9KcthV3HtDXKNDsA6ULT+qUkyoHRzCzr
61
63
A4QaL2VU6i4=
62
64
-----END CERTIFICATE-----
63
65
`
64
- var timeout = time .Second * 10
66
+ var timeout = time .Second * 3
65
67
66
68
type testServiceServer struct {}
67
69
@@ -133,12 +135,8 @@ func TestNewGRPCServerInvalidParameters(t *testing.T) {
133
135
134
136
//bad hostname
135
137
_ , err = comm .NewGRPCServer ("hostdoesnotexist.localdomain:9050" , nil , nil , nil , nil )
136
- //check for error
137
- msg = "no such host"
138
- if assert .Error (t , err , "%s error expected" , msg ) {
139
- assert .Contains (t , err .Error (), msg ) //use contains here as error message inconsistent
140
- }
141
-
138
+ //check for error only - there are a few possibilities depending on DNS resolution but will get an error
139
+ assert .Error (t , err , "%s error expected" , msg )
142
140
if err != nil {
143
141
t .Log (err .Error ())
144
142
}
@@ -225,9 +223,8 @@ func TestNewGRPCServer(t *testing.T) {
225
223
_ , err = invokeEmptyCall (testAddress , dialOptions )
226
224
227
225
if err != nil {
228
- t .Logf ("GRPC client failed to invoke the EmptyCall service on %s: %v" ,
226
+ t .Fatalf ("GRPC client failed to invoke the EmptyCall service on %s: %v" ,
229
227
testAddress , err )
230
- t .Fatalf (err .Error ())
231
228
} else {
232
229
t .Log ("GRPC client successfully invoked the EmptyCall service: " + testAddress )
233
230
}
@@ -277,9 +274,8 @@ func TestNewGRPCServerFromListener(t *testing.T) {
277
274
_ , err = invokeEmptyCall (testAddress , dialOptions )
278
275
279
276
if err != nil {
280
- t .Logf ("GRPC client failed to invoke the EmptyCall service on %s: %v" ,
277
+ t .Fatalf ("GRPC client failed to invoke the EmptyCall service on %s: %v" ,
281
278
testAddress , err )
282
- t .Fatalf (err .Error ())
283
279
} else {
284
280
t .Log ("GRPC client successfully invoked the EmptyCall service: " + testAddress )
285
281
}
@@ -336,7 +332,7 @@ func TestNewSecureGRPCServer(t *testing.T) {
336
332
_ , err = invokeEmptyCall (testAddress , dialOptions )
337
333
338
334
if err != nil {
339
- t .Logf ("GRPC client failed to invoke the EmptyCall service on %s: %v" ,
335
+ t .Fatalf ("GRPC client failed to invoke the EmptyCall service on %s: %v" ,
340
336
testAddress , err )
341
337
} else {
342
338
t .Log ("GRPC client successfully invoked the EmptyCall service: " + testAddress )
@@ -401,9 +397,168 @@ func TestNewSecureGRPCServerFromListener(t *testing.T) {
401
397
_ , err = invokeEmptyCall (testAddress , dialOptions )
402
398
403
399
if err != nil {
404
- t .Logf ("GRPC client failed to invoke the EmptyCall service on %s: %v" ,
400
+ t .Fatalf ("GRPC client failed to invoke the EmptyCall service on %s: %v" ,
405
401
testAddress , err )
406
402
} else {
407
403
t .Log ("GRPC client successfully invoked the EmptyCall service: " + testAddress )
408
404
}
409
405
}
406
+
407
+ //prior tests used self-signed certficates loaded by the GRPCServer and the test client
408
+ //here we'll use certificates signed by certificate authorities
409
+ func TestWithSignedRootCertificates (t * testing.T ) {
410
+
411
+ //use Org1 testdata
412
+ fileBase := "Org1"
413
+ certPEMBlock , err := ioutil .ReadFile (filepath .Join ("testdata" , "certs" , fileBase + "-server1-cert.pem" ))
414
+ keyPEMBlock , err := ioutil .ReadFile (filepath .Join ("testdata" , "certs" , fileBase + "-server1-key.pem" ))
415
+ caPEMBlock , err := ioutil .ReadFile (filepath .Join ("testdata" , "certs" , fileBase + "-cert.pem" ))
416
+
417
+ if err != nil {
418
+ t .Fatalf ("Failed to load test certificates: %v" , err )
419
+ }
420
+ testAddress := "localhost:9057"
421
+ //create our listener
422
+ lis , err := net .Listen ("tcp" , testAddress )
423
+
424
+ if err != nil {
425
+ t .Fatalf ("Failed to create listener: %v" , err )
426
+ }
427
+
428
+ srv , err := comm .NewGRPCServerFromListener (lis , keyPEMBlock ,
429
+ certPEMBlock , nil , nil )
430
+ //check for error
431
+ if err != nil {
432
+ t .Fatalf ("Failed to return new GRPC server: %v" , err )
433
+ }
434
+
435
+ //register the GRPC test server
436
+ testpb .RegisterTestServiceServer (srv .Server (), & testServiceServer {})
437
+
438
+ //start the server
439
+ go srv .Start ()
440
+
441
+ defer srv .Stop ()
442
+ //should not be needed
443
+ time .Sleep (10 * time .Millisecond )
444
+
445
+ //create the client credentials
446
+ certPoolServer := x509 .NewCertPool ()
447
+
448
+ //use the server certificate only
449
+ if ! certPoolServer .AppendCertsFromPEM (certPEMBlock ) {
450
+ t .Fatal ("Failed to append certificate to client credentials" )
451
+ }
452
+
453
+ creds := credentials .NewClientTLSFromCert (certPoolServer , "" )
454
+
455
+ //GRPC client options
456
+ var dialOptions []grpc.DialOption
457
+ dialOptions = append (dialOptions , grpc .WithTransportCredentials (creds ))
458
+
459
+ //invoke the EmptyCall service
460
+ _ , err = invokeEmptyCall (testAddress , dialOptions )
461
+
462
+ //client should not be able to connect
463
+ //for now we can only test that we get a timeout error
464
+ assert .EqualError (t , err , grpc .ErrClientConnTimeout .Error ())
465
+ t .Logf ("assert.EqualError: %s" , err .Error ())
466
+
467
+ //now use the CA certificate
468
+ certPoolCA := x509 .NewCertPool ()
469
+ if ! certPoolCA .AppendCertsFromPEM (caPEMBlock ) {
470
+ t .Fatal ("Failed to append certificate to client credentials" )
471
+ }
472
+ creds = credentials .NewClientTLSFromCert (certPoolCA , "" )
473
+ var dialOptionsCA []grpc.DialOption
474
+ dialOptionsCA = append (dialOptionsCA , grpc .WithTransportCredentials (creds ))
475
+
476
+ //invoke the EmptyCall service
477
+ _ , err2 := invokeEmptyCall (testAddress , dialOptionsCA )
478
+
479
+ if err2 != nil {
480
+ t .Fatalf ("GRPC client failed to invoke the EmptyCall service on %s: %v" ,
481
+ testAddress , err2 )
482
+ } else {
483
+ t .Log ("GRPC client successfully invoked the EmptyCall service: " + testAddress )
484
+ }
485
+ }
486
+
487
+ //here we'll use certificates signed by intermediate certificate authorities
488
+ func TestWithSignedIntermediateCertificates (t * testing.T ) {
489
+
490
+ //use Org1 testdata
491
+ fileBase := "Org1"
492
+ certPEMBlock , err := ioutil .ReadFile (filepath .Join ("testdata" , "certs" , fileBase + "-child1-server1-cert.pem" ))
493
+ keyPEMBlock , err := ioutil .ReadFile (filepath .Join ("testdata" , "certs" , fileBase + "-child1-server1-key.pem" ))
494
+ intermediatePEMBlock , err := ioutil .ReadFile (filepath .Join ("testdata" , "certs" , fileBase + "-child1-cert.pem" ))
495
+
496
+ if err != nil {
497
+ t .Fatalf ("Failed to load test certificates: %v" , err )
498
+ }
499
+ testAddress := "localhost:9058"
500
+ //create our listener
501
+ lis , err := net .Listen ("tcp" , testAddress )
502
+
503
+ if err != nil {
504
+ t .Fatalf ("Failed to create listener: %v" , err )
505
+ }
506
+
507
+ srv , err := comm .NewGRPCServerFromListener (lis , keyPEMBlock ,
508
+ certPEMBlock , nil , nil )
509
+ //check for error
510
+ if err != nil {
511
+ t .Fatalf ("Failed to return new GRPC server: %v" , err )
512
+ }
513
+
514
+ //register the GRPC test server
515
+ testpb .RegisterTestServiceServer (srv .Server (), & testServiceServer {})
516
+
517
+ //start the server
518
+ go srv .Start ()
519
+
520
+ defer srv .Stop ()
521
+ //should not be needed
522
+ time .Sleep (10 * time .Millisecond )
523
+
524
+ //create the client credentials
525
+ certPoolServer := x509 .NewCertPool ()
526
+
527
+ //use the server certificate only
528
+ if ! certPoolServer .AppendCertsFromPEM (certPEMBlock ) {
529
+ t .Fatal ("Failed to append certificate to client credentials" )
530
+ }
531
+
532
+ creds := credentials .NewClientTLSFromCert (certPoolServer , "" )
533
+
534
+ //GRPC client options
535
+ var dialOptions []grpc.DialOption
536
+ dialOptions = append (dialOptions , grpc .WithTransportCredentials (creds ))
537
+
538
+ //invoke the EmptyCall service
539
+ _ , err = invokeEmptyCall (testAddress , dialOptions )
540
+
541
+ //client should not be able to connect
542
+ //for now we can only test that we get a timeout error
543
+ assert .EqualError (t , err , grpc .ErrClientConnTimeout .Error ())
544
+ t .Logf ("assert.EqualError: %s" , err .Error ())
545
+
546
+ //now use the CA certificate
547
+ certPoolCA := x509 .NewCertPool ()
548
+ if ! certPoolCA .AppendCertsFromPEM (intermediatePEMBlock ) {
549
+ t .Fatal ("Failed to append certificate to client credentials" )
550
+ }
551
+ creds = credentials .NewClientTLSFromCert (certPoolCA , "" )
552
+ var dialOptionsCA []grpc.DialOption
553
+ dialOptionsCA = append (dialOptionsCA , grpc .WithTransportCredentials (creds ))
554
+
555
+ //invoke the EmptyCall service
556
+ _ , err2 := invokeEmptyCall (testAddress , dialOptionsCA )
557
+
558
+ if err2 != nil {
559
+ t .Fatalf ("GRPC client failed to invoke the EmptyCall service on %s: %v" ,
560
+ testAddress , err2 )
561
+ } else {
562
+ t .Log ("GRPC client successfully invoked the EmptyCall service: " + testAddress )
563
+ }
564
+ }
0 commit comments