Skip to content

Commit 21aed4b

Browse files
Zippo-WangZippo-Wang
committed
feat(gm): support GM
1 parent 92ae73a commit 21aed4b

File tree

164 files changed

+34782
-31
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

164 files changed

+34782
-31
lines changed

‎go.mod

+2
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ require (
1414
github.com/spf13/cobra v1.6.1
1515
github.com/spf13/pflag v1.0.5
1616
github.com/stretchr/testify v1.8.0
17+
github.com/tjfoc/gmsm v1.4.2-0.20220114090716-36b992c51540
1718
golang.org/x/net v0.17.0
1819
golang.org/x/sync v0.4.0
1920
golang.org/x/sys v0.14.0
@@ -54,6 +55,7 @@ require (
5455
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
5556
github.com/pmezard/go-difflib v1.0.0 // indirect
5657
github.com/spf13/afero v1.8.0 // indirect
58+
golang.org/x/crypto v0.14.0 // indirect
5759
golang.org/x/oauth2 v0.11.0 // indirect
5860
golang.org/x/term v0.14.0 // indirect
5961
golang.org/x/text v0.14.0 // indirect

‎go.sum

+6
Original file line numberDiff line numberDiff line change
@@ -319,6 +319,8 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
319319
github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
320320
github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
321321
github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
322+
github.com/tjfoc/gmsm v1.4.2-0.20220114090716-36b992c51540 h1:Q7nxhP4rDahaXbLofX2fRX1dcEoQRvlJA0Hd2hGgh9k=
323+
github.com/tjfoc/gmsm v1.4.2-0.20220114090716-36b992c51540/go.mod h1:j4INPkHWMrhJb38G+J6W4Tw0AbuN8Thu3PbdVYhVcTE=
322324
github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
323325
github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
324326
github.com/yuin/goldmark v1.1.32/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -340,8 +342,11 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
340342
golang.org/x/crypto v0.0.0-20191206172530-e9b2fee46413/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
341343
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
342344
golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
345+
golang.org/x/crypto v0.0.0-20201012173705-84dcc777aaee/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
343346
golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
344347
golang.org/x/crypto v0.0.0-20211108221036-ceb1ce70b4fa/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
348+
golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc=
349+
golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4=
345350
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
346351
golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
347352
golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -405,6 +410,7 @@ golang.org/x/net v0.0.0-20200520182314-0ba52f642ac2/go.mod h1:qpuaurCH72eLCgpAm/
405410
golang.org/x/net v0.0.0-20200625001655-4c5254603344/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
406411
golang.org/x/net v0.0.0-20200707034311-ab3426394381/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
407412
golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
413+
golang.org/x/net v0.0.0-20201010224723-4f7140c49acb/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
408414
golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
409415
golang.org/x/net v0.0.0-20201031054903-ff519b6c9102/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
410416
golang.org/x/net v0.0.0-20201209123823-ac852fbbde11/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=

‎pkg/config/cloud.go

+28-7
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ import (
77

88
"github.com/chnsz/golangsdk"
99
"github.com/chnsz/golangsdk/openstack"
10+
"github.com/tjfoc/gmsm/gmtls"
11+
"github.com/tjfoc/gmsm/x509"
1012

1113
"github.com/huaweicloud/huaweicloud-csi-driver/pkg/utils"
1214
)
@@ -26,6 +28,7 @@ type CloudCredentials struct {
2628
SecretKey string `gcfg:"secret-key"`
2729
ProjectID string `gcfg:"project-id"`
2830
Idc bool `gcfg:"idc"`
31+
GMSupport bool `gcfg:"gm-support"`
2932
}
3033

3134
Vpc struct {
@@ -82,8 +85,8 @@ func newServiceClient(cc *CloudCredentials, catalogName, region string) (*golang
8285
if !ok {
8386
return nil, fmt.Errorf("service type %s is invalid or not supportted", catalogName)
8487
}
85-
8688
client := cc.CloudClient
89+
8790
// update ProjectID and region in ProviderClient
8891
clone := new(golangsdk.ProviderClient)
8992
*clone = *client
@@ -137,27 +140,45 @@ func (c *CloudCredentials) newCloudClient() error {
137140
return err
138141
}
139142

140-
transport := &http.Transport{
143+
defaultTransport := &http.Transport{
141144
Proxy: http.ProxyFromEnvironment,
142145
TLSClientConfig: &tls.Config{
143146
MinVersion: tls.VersionTLS12,
144147
InsecureSkipVerify: c.Global.Insecure,
145148
},
146149
}
147150

151+
wrappers := []utils.WrapperFunc{
152+
utils.NewLogRoundTripper(),
153+
}
154+
if c.Global.GMSupport {
155+
gmCfg := &gmtls.Config{
156+
GMSupport: &gmtls.GMSupport{WorkMode: gmtls.ModeAutoSwitch},
157+
InsecureSkipVerify: true,
158+
VerifyPeerCertificate: func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
159+
for _, v := range rawCerts {
160+
_, err = x509.ParseCertificate(v)
161+
if err != nil {
162+
return err
163+
}
164+
}
165+
return nil
166+
},
167+
}
168+
wrappers = append(wrappers, utils.NewGMRoundTripper(gmCfg))
169+
}
170+
148171
client.HTTPClient = http.Client{
149-
Transport: &utils.LogRoundTripper{
150-
Rt: transport,
151-
},
172+
Transport: utils.Wrappers(wrappers...)(defaultTransport),
152173
}
153174

154-
err = openstack.Authenticate(client, ao)
155-
if err != nil {
175+
if err := openstack.Authenticate(client, ao); err != nil {
156176
return err
157177
}
158178

159179
c.CloudClient = client
160180
c.CloudClient.UserAgent.Prepend(UserAgent)
181+
161182
return nil
162183
}
163184

‎pkg/utils/gm_round_tripper.go

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
package utils
2+
3+
import (
4+
"context"
5+
"crypto/tls"
6+
"net"
7+
"net/http"
8+
"time"
9+
10+
"github.com/tjfoc/gmsm/gmtls"
11+
)
12+
13+
func NewGMRoundTripper(cfg *gmtls.Config) WrapperFunc {
14+
return func(inner http.RoundTripper) http.RoundTripper {
15+
return &http.Transport{
16+
Proxy: http.ProxyFromEnvironment,
17+
TLSClientConfig: &tls.Config{
18+
InsecureSkipVerify: cfg.InsecureSkipVerify,
19+
},
20+
DialTLSContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
21+
dialer := &net.Dialer{}
22+
conn, err := gmtls.DialWithDialer(dialer, network, addr, cfg)
23+
if err != nil {
24+
return nil, err
25+
}
26+
return conn, nil
27+
},
28+
DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
29+
dialer := &net.Dialer{
30+
Timeout: 10 * time.Second,
31+
KeepAlive: 60 * time.Second,
32+
}
33+
conn, err := gmtls.DialWithDialer(dialer, network, addr, cfg)
34+
if err != nil {
35+
return nil, err
36+
}
37+
return conn, nil
38+
},
39+
TLSHandshakeTimeout: 15 * time.Second,
40+
IdleConnTimeout: 30 * time.Second,
41+
}
42+
}
43+
}

‎pkg/utils/gm_round_tripper_test.go

+178
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,178 @@
1+
package utils
2+
3+
import (
4+
"net/http"
5+
"testing"
6+
7+
"github.com/tjfoc/gmsm/gmtls"
8+
"github.com/tjfoc/gmsm/x509"
9+
)
10+
11+
func TestNewGMRoundTripper(t *testing.T) {
12+
tests := []struct {
13+
name string
14+
description string
15+
cfg *gmtls.Config
16+
request *http.Request
17+
expected bool
18+
}{
19+
{
20+
name: "test1",
21+
description: "support both GM and no-GM encryption algorithm",
22+
cfg: &gmtls.Config{
23+
InsecureSkipVerify: true,
24+
},
25+
request: httpNewRequest("GET", "https://sm2test.ovssl.cn", nil, t),
26+
expected: false,
27+
},
28+
{
29+
name: "test2",
30+
description: "support both GM and no-GM encryption algorithm",
31+
cfg: &gmtls.Config{
32+
GMSupport: &gmtls.GMSupport{WorkMode: gmtls.ModeAutoSwitch},
33+
InsecureSkipVerify: true,
34+
},
35+
request: httpNewRequest("GET", "https://sm2test.ovssl.cn", nil, t),
36+
expected: false,
37+
},
38+
{
39+
name: "test3",
40+
description: "support both GM and no-GM encryption algorithm",
41+
cfg: &gmtls.Config{
42+
GMSupport: &gmtls.GMSupport{WorkMode: gmtls.ModeGMSSLOnly},
43+
InsecureSkipVerify: true,
44+
},
45+
request: httpNewRequest("GET", "https://sm2test.ovssl.cn", nil, t),
46+
expected: false,
47+
},
48+
{
49+
name: "test4",
50+
description: "support both GM and no-GM encryption algorithm",
51+
cfg: &gmtls.Config{
52+
GMSupport: &gmtls.GMSupport{WorkMode: gmtls.ModeAutoSwitch},
53+
InsecureSkipVerify: true,
54+
VerifyPeerCertificate: func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
55+
for _, v := range rawCerts {
56+
_, err := x509.ParseCertificate(v)
57+
if err != nil {
58+
return err
59+
}
60+
}
61+
return nil
62+
},
63+
},
64+
request: httpNewRequest("GET", "https://sm2test.ovssl.cn", nil, t),
65+
expected: false,
66+
},
67+
{
68+
name: "test5",
69+
description: "support both GM and no-GM encryption algorithm",
70+
cfg: &gmtls.Config{
71+
GMSupport: &gmtls.GMSupport{WorkMode: gmtls.ModeGMSSLOnly},
72+
InsecureSkipVerify: true,
73+
VerifyPeerCertificate: func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
74+
for _, v := range rawCerts {
75+
_, err := x509.ParseCertificate(v)
76+
if err != nil {
77+
return err
78+
}
79+
}
80+
return nil
81+
},
82+
},
83+
request: httpNewRequest("GET", "https://sm2test.ovssl.cn", nil, t),
84+
expected: false,
85+
},
86+
87+
{
88+
name: "test6",
89+
description: "don not support GM",
90+
cfg: &gmtls.Config{
91+
InsecureSkipVerify: true,
92+
},
93+
request: httpNewRequest("GET", "https://baidu.com", nil, t),
94+
expected: true,
95+
},
96+
//{
97+
// name: "test7",
98+
// description: "don not support GM",
99+
// cfg: &gmtls.Config{
100+
// GMSupport: &gmtls.GMSupport{WorkMode: gmtls.ModeAutoSwitch},
101+
// InsecureSkipVerify: true,
102+
// },
103+
// request: httpNewRequest("GET", "https://baidu.com", nil, t),
104+
// expected: true,
105+
//},
106+
//{
107+
// name: "test8",
108+
// description: "don not support GM",
109+
// cfg: &gmtls.Config{
110+
// GMSupport: &gmtls.GMSupport{WorkMode: gmtls.ModeGMSSLOnly},
111+
// InsecureSkipVerify: true,
112+
// },
113+
// request: httpNewRequest("GET", "https://baidu.com", nil, t),
114+
// expected: true,
115+
//},
116+
//{
117+
// name: "test9",
118+
// description: "don not support GM",
119+
// cfg: &gmtls.Config{
120+
// GMSupport: &gmtls.GMSupport{WorkMode: gmtls.ModeAutoSwitch},
121+
// InsecureSkipVerify: true,
122+
// VerifyPeerCertificate: func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
123+
// for _, v := range rawCerts {
124+
// _, err := x509.ParseCertificate(v)
125+
// if err != nil {
126+
// return err
127+
// }
128+
// }
129+
// return nil
130+
// },
131+
// },
132+
// request: httpNewRequest("GET", "https://baidu.com", nil, t),
133+
// expected: true,
134+
//},
135+
//{
136+
// name: "test10",
137+
// description: "don not support GM",
138+
// cfg: &gmtls.Config{
139+
// GMSupport: &gmtls.GMSupport{WorkMode: gmtls.ModeGMSSLOnly},
140+
// InsecureSkipVerify: true,
141+
// VerifyPeerCertificate: func(rawCerts [][]byte, verifiedChains [][]*x509.Certificate) error {
142+
// for _, v := range rawCerts {
143+
// _, err := x509.ParseCertificate(v)
144+
// if err != nil {
145+
// return err
146+
// }
147+
// }
148+
// return nil
149+
// },
150+
// },
151+
// request: httpNewRequest("GET", "https://baidu.com", nil, t),
152+
// expected: true,
153+
//},
154+
}
155+
156+
for _, testCase := range tests {
157+
t.Run(testCase.name, func(t *testing.T) {
158+
wrapper := NewGMRoundTripper(testCase.cfg)
159+
wrappedTransport := wrapper(http.DefaultTransport)
160+
client := &http.Client{
161+
Transport: wrappedTransport,
162+
}
163+
164+
resp, err := client.Do(testCase.request)
165+
166+
if testCase.expected && err == nil {
167+
t.Errorf("expected error but got none")
168+
}
169+
if !testCase.expected && err != nil {
170+
t.Errorf("expected: %v, but got err: %v", testCase.expected, err)
171+
}
172+
173+
if resp != nil && resp.Body != nil {
174+
resp.Body.Close()
175+
}
176+
})
177+
}
178+
}

‎pkg/utils/logroundtripper.go

+6
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,12 @@ var (
3737
serverGRPCEndpointCallCounter uint64
3838
)
3939

40+
func NewLogRoundTripper() WrapperFunc {
41+
return func(rt http.RoundTripper) http.RoundTripper {
42+
return &LogRoundTripper{Rt: rt}
43+
}
44+
}
45+
4046
// LogRoundTripper satisfies the http.RoundTripper interface and is used to
4147
// customize the default http client RoundTripper to allow for logging.
4248
type LogRoundTripper struct {

0 commit comments

Comments
 (0)