Skip to content

Commit 8b55c80

Browse files
mbwhitembwhite
authored
Merge pull request #175 from ftokarev/netty-grpc-server-tls-fix
NettyGrpcServer -- configure ALPN to enable TLS
2 parents 4f44791 + 1128e7b commit 8b55c80

File tree

3 files changed

+49
-22
lines changed

3 files changed

+49
-22
lines changed

‎fabric-chaincode-shim/src/main/java/org/hyperledger/fabric/shim/NettyGrpcServer.java‎

Lines changed: 34 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@
99

1010
import io.grpc.Server;
1111
import io.grpc.netty.shaded.io.grpc.netty.NettyServerBuilder;
12+
import io.grpc.netty.shaded.io.netty.handler.ssl.ApplicationProtocolConfig;
13+
import io.grpc.netty.shaded.io.netty.handler.ssl.ApplicationProtocolNames;
1214
import io.grpc.netty.shaded.io.netty.handler.ssl.SslContextBuilder;
1315
import org.apache.commons.logging.Log;
1416
import org.apache.commons.logging.LogFactory;
@@ -23,13 +25,14 @@
2325
*/
2426
public final class NettyGrpcServer implements GrpcServer {
2527

26-
private static Log logger = LogFactory.getLog(NettyGrpcServer.class);
28+
private static final Log LOGGER = LogFactory.getLog(NettyGrpcServer.class);
2729

2830
private final Server server;
31+
2932
/**
3033
* init netty grpc server.
3134
*
32-
* @param chaincodeBase - chaincode implementation (invoke, init)
35+
* @param chaincodeBase - chaincode implementation (invoke, init)
3336
* @param chaincodeServerProperties - setting for grpc server
3437
* @throws IOException
3538
*/
@@ -56,27 +59,37 @@ public NettyGrpcServer(final ChaincodeBase chaincodeBase, final ChaincodeServerP
5659
final File keyCertChainFile = Paths.get(chaincodeServerProperties.getKeyCertChainFile()).toFile();
5760
final File keyFile = Paths.get(chaincodeServerProperties.getKeyFile()).toFile();
5861

62+
SslContextBuilder sslContextBuilder;
5963
if (chaincodeServerProperties.getKeyPassword() == null || chaincodeServerProperties.getKeyPassword().isEmpty()) {
60-
serverBuilder.sslContext(SslContextBuilder.forServer(keyCertChainFile, keyFile).build());
64+
sslContextBuilder = SslContextBuilder.forServer(keyCertChainFile, keyFile);
6165
} else {
62-
serverBuilder.sslContext(SslContextBuilder.forServer(keyCertChainFile, keyFile, chaincodeServerProperties.getKeyPassword()).build());
66+
sslContextBuilder = SslContextBuilder.forServer(keyCertChainFile, keyFile, chaincodeServerProperties.getKeyPassword());
6367
}
68+
69+
ApplicationProtocolConfig apn = new ApplicationProtocolConfig(
70+
ApplicationProtocolConfig.Protocol.ALPN,
71+
ApplicationProtocolConfig.SelectorFailureBehavior.NO_ADVERTISE,
72+
ApplicationProtocolConfig.SelectedListenerFailureBehavior.ACCEPT,
73+
ApplicationProtocolNames.HTTP_2);
74+
sslContextBuilder.applicationProtocolConfig(apn);
75+
76+
serverBuilder.sslContext(sslContextBuilder.build());
6477
}
6578

66-
logger.info("<<<<<<<<<<<<<chaincodeServerProperties>>>>>>>>>>>>:\n");
67-
logger.info("PortChaincodeServer:" + chaincodeServerProperties.getPortChaincodeServer());
68-
logger.info("MaxInboundMetadataSize:" + chaincodeServerProperties.getMaxInboundMetadataSize());
69-
logger.info("MaxInboundMessageSize:" + chaincodeServerProperties.getMaxInboundMessageSize());
70-
logger.info("MaxConnectionAgeSeconds:" + chaincodeServerProperties.getMaxConnectionAgeSeconds());
71-
logger.info("KeepAliveTimeoutSeconds:" + chaincodeServerProperties.getKeepAliveTimeoutSeconds());
72-
logger.info("PermitKeepAliveTimeMinutes:" + chaincodeServerProperties.getPermitKeepAliveTimeMinutes());
73-
logger.info("KeepAliveTimeMinutes:" + chaincodeServerProperties.getKeepAliveTimeMinutes());
74-
logger.info("PermitKeepAliveWithoutCalls:" + chaincodeServerProperties.getPermitKeepAliveWithoutCalls());
75-
logger.info("KeyPassword:" + chaincodeServerProperties.getKeyPassword());
76-
logger.info("KeyCertChainFile:" + chaincodeServerProperties.getKeyCertChainFile());
77-
logger.info("KeyFile:" + chaincodeServerProperties.getKeyFile());
78-
logger.info("isTlsEnabled:" + chaincodeServerProperties.isTlsEnabled());
79-
logger.info("\n");
79+
LOGGER.info("<<<<<<<<<<<<<chaincodeServerProperties>>>>>>>>>>>>:\n");
80+
LOGGER.info("PortChaincodeServer:" + chaincodeServerProperties.getPortChaincodeServer());
81+
LOGGER.info("MaxInboundMetadataSize:" + chaincodeServerProperties.getMaxInboundMetadataSize());
82+
LOGGER.info("MaxInboundMessageSize:" + chaincodeServerProperties.getMaxInboundMessageSize());
83+
LOGGER.info("MaxConnectionAgeSeconds:" + chaincodeServerProperties.getMaxConnectionAgeSeconds());
84+
LOGGER.info("KeepAliveTimeoutSeconds:" + chaincodeServerProperties.getKeepAliveTimeoutSeconds());
85+
LOGGER.info("PermitKeepAliveTimeMinutes:" + chaincodeServerProperties.getPermitKeepAliveTimeMinutes());
86+
LOGGER.info("KeepAliveTimeMinutes:" + chaincodeServerProperties.getKeepAliveTimeMinutes());
87+
LOGGER.info("PermitKeepAliveWithoutCalls:" + chaincodeServerProperties.getPermitKeepAliveWithoutCalls());
88+
LOGGER.info("KeyPassword:" + chaincodeServerProperties.getKeyPassword());
89+
LOGGER.info("KeyCertChainFile:" + chaincodeServerProperties.getKeyCertChainFile());
90+
LOGGER.info("KeyFile:" + chaincodeServerProperties.getKeyFile());
91+
LOGGER.info("isTlsEnabled:" + chaincodeServerProperties.isTlsEnabled());
92+
LOGGER.info("\n");
8093

8194
this.server = serverBuilder.build();
8295
}
@@ -87,7 +100,7 @@ public NettyGrpcServer(final ChaincodeBase chaincodeBase, final ChaincodeServerP
87100
* @throws IOException
88101
*/
89102
public void start() throws IOException {
90-
logger.info("start grpc server");
103+
LOGGER.info("start grpc server");
91104
Runtime.getRuntime()
92105
.addShutdownHook(
93106
new Thread(() -> {
@@ -105,15 +118,15 @@ public void start() throws IOException {
105118
* @throws InterruptedException
106119
*/
107120
public void blockUntilShutdown() throws InterruptedException {
108-
logger.info("Waits for the server to become terminated.");
121+
LOGGER.info("Waits for the server to become terminated.");
109122
server.awaitTermination();
110123
}
111124

112125
/**
113126
* shutdown now grpc server.
114127
*/
115128
public void stop() {
116-
logger.info("shutdown now grpc server.");
129+
LOGGER.info("shutdown now grpc server.");
117130
server.shutdownNow();
118131
}
119132
}

‎fabric-chaincode-shim/src/test/java/org/hyperledger/fabric/shim/NettyGrpcServerTest.java‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -288,7 +288,12 @@ void startAndStopTlsPassword() {
288288
try {
289289
final ChaincodeBase chaincodeBase = new EmptyChaincode();
290290
chaincodeBase.processEnvironmentOptions();
291-
ChaincodeServer chaincodeServer = new NettyChaincodeServer(chaincodeBase, new ChaincodeServerProperties());
291+
final ChaincodeServerProperties chaincodeServerProperties = new ChaincodeServerProperties();
292+
chaincodeServerProperties.setTlsEnabled(true);
293+
chaincodeServerProperties.setKeyFile("src/test/resources/client.key.password-protected");
294+
chaincodeServerProperties.setKeyCertChainFile("src/test/resources/client.crt");
295+
chaincodeServerProperties.setKeyPassword("test");
296+
ChaincodeServer chaincodeServer = new NettyChaincodeServer(chaincodeBase, chaincodeServerProperties);
292297
new Thread(() -> {
293298
try {
294299
chaincodeServer.start();
@@ -315,6 +320,9 @@ void startAndStopTlsWithoutPassword() {
315320
final ChaincodeBase chaincodeBase = new EmptyChaincode();
316321
chaincodeBase.processEnvironmentOptions();
317322
final ChaincodeServerProperties chaincodeServerProperties = new ChaincodeServerProperties();
323+
chaincodeServerProperties.setTlsEnabled(true);
324+
chaincodeServerProperties.setKeyFile("src/test/resources/client.key");
325+
chaincodeServerProperties.setKeyCertChainFile("src/test/resources/client.crt");
318326
ChaincodeServer chaincodeServer = new NettyChaincodeServer(chaincodeBase, chaincodeServerProperties);
319327
new Thread(() -> {
320328
try {

‎fabric-chaincode-shim/src/test/resources/client.key.password-protected‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
-----BEGIN ENCRYPTED PRIVATE KEY-----
2+
MIGxMBwGCiqGSIb3DQEMAQMwDgQIfzm0IqTm+rACAggABIGQDY1vpaSD+KDuVRyT
3+
Gi35536iOYUuVoz01ktV3YCDv03Pm5+8xZ1JXXW8lDM3JP/TcKbocRRk63y/R7O2
4+
dB9kcyV7/gYtYH0B3TMk1/x1WtfHL8JnYRFHQ/OuhYjJ6O04B4aY2waeYByzsIsI
5+
YhNVZq5fZ7/bjsy8b54o57WD4DDHH3uRysbv8I5TaDVyJMJq
6+
-----END ENCRYPTED PRIVATE KEY-----

0 commit comments

Comments
 (0)