Chaincode as external service with TLS: installed but query doesn't find it?

user_1295856 0
Viewed 262

In the Fabric docs example for a bin/release script, there's the comment

if tls_required is true, copy TLS files (using above example, the fully qualified path for these fils would be "$RELEASE"/chaincode/server/tls)

But which files should be put there? How do they have to be named? Are they referenced somewhere? Altogether I even don't understand why they're needed anyway. We already have all certficates in the connection.json on the peer side and also TLS certficates referenced by the ChaincodeServer on the chaincode side.

I'm asking because I can't invoke my chaincode and since I don't have additional certificates within the $RELEASE folder, that might cause the problem.

This is happening on chaincode query at the CLI:

$ export CORE_PEER_MSPCONFIGPATH=/config/admin/msp
$ peer chaincode query -C channel1 -n cc-abac -c '{"Args":["query","a"]}' --clientauth --tls --cafile /config/peer/tls-msp/tlscacerts/ca-cert.pem --keyfile /config/peer/tls-msp/keystore/key.pem --certfile /config/peer/tls-msp/signcerts/cert.pem
2020-07-06 07:20:55.290 UTC [msp] loadCertificateAt -> WARN 001 Failed loading ClientOU certificate at [/config/admin/msp]: [could not read file /config/admin/msp: read /config/admin/msp: is a directory]
2020-07-06 07:20:55.290 UTC [msp] loadCertificateAt -> WARN 002 Failed loading PeerOU certificate at [/config/admin/msp]: [could not read file /config/admin/msp: read /config/admin/msp: is a directory]
2020-07-06 07:20:55.290 UTC [msp] loadCertificateAt -> WARN 003 Failed loading AdminOU certificate at [/config/admin/msp]: [could not read file /config/admin/msp: read /config/admin/msp: is a directory]
2020-07-06 07:20:55.291 UTC [msp] loadCertificateAt -> WARN 004 Failed loading OrdererOU certificate at [/config/admin/msp]: [could not read file /config/admin/msp: read /config/admin/msp: is a directory]
2020-07-06 07:20:55.302 UTC [grpc] Infof -> DEBU 005 parsed scheme: ""
2020-07-06 07:20:55.302 UTC [grpc] Infof -> DEBU 006 scheme "" not registered, fallback to default scheme
2020-07-06 07:20:55.302 UTC [grpc] Infof -> DEBU 007 ccResolverWrapper: sending update to cc: {[{org1-peer1:30151  <nil> 0 <nil>}] <nil> <nil>}
2020-07-06 07:20:55.302 UTC [grpc] Infof -> DEBU 008 ClientConn switching balancer to "pick_first"
2020-07-06 07:20:55.302 UTC [grpc] Infof -> DEBU 009 Channel switches to new LB policy "pick_first"
2020-07-06 07:20:55.302 UTC [grpc] Infof -> DEBU 00a Subchannel Connectivity change to CONNECTING
2020-07-06 07:20:55.302 UTC [grpc] Infof -> DEBU 00b Subchannel picks a new address "org1-peer1:30151" to connect
2020-07-06 07:20:55.302 UTC [grpc] UpdateSubConnState -> DEBU 00c pickfirstBalancer: HandleSubConnStateChange: 0xc0001aff40, {CONNECTING <nil>}
2020-07-06 07:20:55.302 UTC [grpc] Infof -> DEBU 00d Channel Connectivity change to CONNECTING
2020-07-06 07:20:55.310 UTC [grpc] Infof -> DEBU 00e Subchannel Connectivity change to READY
2020-07-06 07:20:55.310 UTC [grpc] UpdateSubConnState -> DEBU 00f pickfirstBalancer: HandleSubConnStateChange: 0xc0001aff40, {READY <nil>}
2020-07-06 07:20:55.310 UTC [grpc] Infof -> DEBU 010 Channel Connectivity change to READY
2020-07-06 07:20:55.315 UTC [grpc] Infof -> DEBU 011 parsed scheme: ""
2020-07-06 07:20:55.315 UTC [grpc] Infof -> DEBU 012 scheme "" not registered, fallback to default scheme
2020-07-06 07:20:55.315 UTC [grpc] Infof -> DEBU 013 ccResolverWrapper: sending update to cc: {[{org1-peer1:30151  <nil> 0 <nil>}] <nil> <nil>}
2020-07-06 07:20:55.315 UTC [grpc] Infof -> DEBU 014 ClientConn switching balancer to "pick_first"
2020-07-06 07:20:55.315 UTC [grpc] Infof -> DEBU 015 Channel switches to new LB policy "pick_first"
2020-07-06 07:20:55.315 UTC [grpc] Infof -> DEBU 016 Subchannel Connectivity change to CONNECTING
2020-07-06 07:20:55.315 UTC [grpc] Infof -> DEBU 017 Subchannel picks a new address "org1-peer1:30151" to connect
2020-07-06 07:20:55.315 UTC [grpc] UpdateSubConnState -> DEBU 018 pickfirstBalancer: HandleSubConnStateChange: 0xc0003447f0, {CONNECTING <nil>}
2020-07-06 07:20:55.315 UTC [grpc] Infof -> DEBU 019 Channel Connectivity change to CONNECTING
2020-07-06 07:20:55.320 UTC [grpc] Infof -> DEBU 01a Subchannel Connectivity change to READY
2020-07-06 07:20:55.320 UTC [grpc] UpdateSubConnState -> DEBU 01b pickfirstBalancer: HandleSubConnStateChange: 0xc0003447f0, {READY <nil>}
2020-07-06 07:20:55.320 UTC [grpc] Infof -> DEBU 01c Channel Connectivity change to READY
Error: endorsement failure during query. response: status:500 message:"make sure the chaincode cc-abac has been successfully defined on channel channel1 and try again: chaincode definition for 'cc-abac' exists, but chaincode is not installed"

Ok, let's check if it's installed:

$ peer lifecycle chaincode queryinstalled
2020-07-06 07:27:54.192 UTC [msp] loadCertificateAt -> WARN 001 Failed loading ClientOU certificate at [/config/admin/msp]: [could not read file /config/admin/msp: read /config/admin/msp: is a directory]
2020-07-06 07:27:54.192 UTC [msp] loadCertificateAt -> WARN 002 Failed loading PeerOU certificate at [/config/admin/msp]: [could not read file /config/admin/msp: read /config/admin/msp: is a directory]
2020-07-06 07:27:54.192 UTC [msp] loadCertificateAt -> WARN 003 Failed loading AdminOU certificate at [/config/admin/msp]: [could not read file /config/admin/msp: read /config/admin/msp: is a directory]
2020-07-06 07:27:54.193 UTC [msp] loadCertificateAt -> WARN 004 Failed loading OrdererOU certificate at [/config/admin/msp]: [could not read file /config/admin/msp: read /config/admin/msp: is a directory]
2020-07-06 07:27:54.201 UTC [grpc] Infof -> DEBU 005 parsed scheme: ""
2020-07-06 07:27:54.201 UTC [grpc] Infof -> DEBU 006 scheme "" not registered, fallback to default scheme
2020-07-06 07:27:54.201 UTC [grpc] Infof -> DEBU 007 ccResolverWrapper: sending update to cc: {[{org1-peer1:30151  <nil> 0 <nil>}] <nil> <nil>}
2020-07-06 07:27:54.201 UTC [grpc] Infof -> DEBU 008 ClientConn switching balancer to "pick_first"
2020-07-06 07:27:54.201 UTC [grpc] Infof -> DEBU 009 Channel switches to new LB policy "pick_first"
2020-07-06 07:27:54.201 UTC [grpc] Infof -> DEBU 00a Subchannel Connectivity change to CONNECTING
2020-07-06 07:27:54.202 UTC [grpc] Infof -> DEBU 00b Subchannel picks a new address "org1-peer1:30151" to connect
2020-07-06 07:27:54.202 UTC [grpc] UpdateSubConnState -> DEBU 00c pickfirstBalancer: HandleSubConnStateChange: 0xc000447800, {CONNECTING <nil>}
2020-07-06 07:27:54.202 UTC [grpc] Infof -> DEBU 00d Channel Connectivity change to CONNECTING
2020-07-06 07:27:54.209 UTC [grpc] Infof -> DEBU 00e Subchannel Connectivity change to READY
2020-07-06 07:27:54.209 UTC [grpc] UpdateSubConnState -> DEBU 00f pickfirstBalancer: HandleSubConnStateChange: 0xc000447800, {READY <nil>}
2020-07-06 07:27:54.209 UTC [grpc] Infof -> DEBU 010 Channel Connectivity change to READY
2020-07-06 07:27:54.213 UTC [grpc] Infof -> DEBU 011 parsed scheme: ""
2020-07-06 07:27:54.213 UTC [grpc] Infof -> DEBU 012 scheme "" not registered, fallback to default scheme
2020-07-06 07:27:54.213 UTC [grpc] Infof -> DEBU 013 ccResolverWrapper: sending update to cc: {[{org1-peer1:30151  <nil> 0 <nil>}] <nil> <nil>}
2020-07-06 07:27:54.213 UTC [grpc] Infof -> DEBU 014 ClientConn switching balancer to "pick_first"
2020-07-06 07:27:54.213 UTC [grpc] Infof -> DEBU 015 Channel switches to new LB policy "pick_first"
2020-07-06 07:27:54.213 UTC [grpc] Infof -> DEBU 016 Subchannel Connectivity change to CONNECTING
2020-07-06 07:27:54.213 UTC [grpc] Infof -> DEBU 017 Subchannel picks a new address "org1-peer1:30151" to connect
2020-07-06 07:27:54.213 UTC [grpc] UpdateSubConnState -> DEBU 018 pickfirstBalancer: HandleSubConnStateChange: 0xc0000da8f0, {CONNECTING <nil>}
2020-07-06 07:27:54.213 UTC [grpc] Infof -> DEBU 019 Channel Connectivity change to CONNECTING
2020-07-06 07:27:54.219 UTC [grpc] Infof -> DEBU 01a Subchannel Connectivity change to READY
2020-07-06 07:27:54.219 UTC [grpc] UpdateSubConnState -> DEBU 01b pickfirstBalancer: HandleSubConnStateChange: 0xc0000da8f0, {READY <nil>}
2020-07-06 07:27:54.219 UTC [grpc] Infof -> DEBU 01c Channel Connectivity change to READY
Installed chaincodes on peer:
Package ID: cc-abac:7f7a2b755874ef0c72e6d1eb467f6e65afb488994c80a75f3c5712fcdc9ee095, Label: cc-abac

So it's installed but the query command doesn't find it?
And yes - it's installed on the correct channel:

$ peer lifecycle chaincode querycommitted --channelID channel1 --name cc-abac --cafile /config/peer/tls-msp/tlscacerts/ca-cert.pem
Committed chaincode definition for chaincode 'cc-abac' on channel 'channel1':
Version: 1.0, Sequence: 1, Endorsement Plugin: escc, Validation Plugin: vscc, Approvals: [Org1MSP: true, Org2MSP: true, Org3MSP: true]

This is the peer log at the time of the query:

[36m2020-07-06 07:31:23.605 UTC [lockbasedtxmgr] NewTxSimulator -> DEBU 12a6[0m constructing new tx simulator
[36m2020-07-06 07:31:23.605 UTC [lockbasedtxmgr] newLockBasedTxSimulator -> DEBU 12a7[0m constructing new tx simulator txid = [ed5b5de845b99b8b126e1b10d05df3849b9b108c83435f4225fc47c9a3b841c7]
[36m2020-07-06 07:31:23.605 UTC [stateleveldb] GetState -> DEBU 12a8[0m GetState(). ns=_lifecycle, key=namespaces/fields/cc-abac/Sequence
[36m2020-07-06 07:31:23.605 UTC [lockbasedtxmgr] Done -> DEBU 12a9[0m Done with transaction simulation / query execution [ed5b5de845b99b8b126e1b10d05df3849b9b108c83435f4225fc47c9a3b841c7]
[34m2020-07-06 07:31:23.605 UTC [comm.grpc.server] 1 -> INFO 12aa[0m unary call completed grpc.service=protos.Endorser grpc.method=ProcessProposal grpc.peer_address=10.131.0.100:51580 grpc.peer_subject="CN=org1-peer1,OU=peer,O=Hyperledger,ST=North Carolina,C=US" grpc.code=OK grpc.call_duration=2.128156ms
[36m2020-07-06 07:31:23.608 UTC [grpc] infof -> DEBU 12ab[0m transport: loopyWriter.run returning. connection error: desc = "transport is closing"
[36m2020-07-06 07:31:23.608 UTC [grpc] warningf -> DEBU 12ac[0m transport: http2Server.HandleStreams failed to read frame: read tcp 10.130.1.219:7051->10.131.0.100:51580: read: connection reset by peer
[36m2020-07-06 07:31:23.608 UTC [grpc] infof -> DEBU 12ad[0m transport: loopyWriter.run returning. connection error: desc = "transport is closing"

10.131.0.100 is the calling CLI and 10.130.1.219 is the peer. So is there a connection problem between CLI and Peer?

Coming back to the first paragraph of this question - this is the connection.json available to the peer:

{
  "address": "org1-cc1:31101",
  "dial_timeout": "10s",
  "tls_required": "true",
  "client_auth_required": "true",
  "client_key": "-----BEGIN PRIVATE KEY-----\nxxx\nxxx\nxxx\n-----END PRIVATE KEY-----",
  "client_cert": "-----BEGIN CERTIFICATE-----\nxxx/xxx\nxxx\nxxx\nxxx\nxxx\nxxx\nxxx/xxxn\nxxx\nxxx\nxxx\nxxx\nxxx\nxxx\nxxx=\n-----END CERTIFICATE-----",
  "root_cert": "-----BEGIN CERTIFICATE-----\nxxx\nxxx\nxxx\nxxx\nxxx\nxxx\nxxx\nxxx\nxxx\nxxx\nxxx\nxxx\n-----END CERTIFICATE-----"
}

Of course, xxx are just placeholders ;)

The Chaincode main() looks as follows:

func main() {
    keyFile := os.Getenv("CHAINCODE_TLS_KEY_FILE")
    key, err := ioutil.ReadFile(keyFile)
    check(err)

    certFile := os.Getenv("CHAINCODE_TLS_CERT_FILE")
    cert, err := ioutil.ReadFile(certFile)
    check(err)

    caFile := os.Getenv("CHAINCODE_TLS_CACERT_FILE")
    ca, err := ioutil.ReadFile(caFile)
    check(err)

    server := &shim.ChaincodeServer{
        CCID:    os.Getenv("CHAINCODE_CCID"),
        Address: "0.0.0.0:9999",
        CC:      new(SimpleChaincode),
        TLSProps: shim.TLSProperties{
            Disabled:      false,
            Key:           key,
            Cert:          cert,
            ClientCACerts: ca,
        },
    }
    err = server.Start()
    if err != nil {
        fmt.Printf("Error starting Simple chaincode: %s", err)
    }
}
hyperledger-fabric
0 Answers
Related