fix bug for set empty certs

6 files changed, 52 insertions, 33 deletions

diff --git a/edge/pkg/edgehub/clients/wsclient/websocket.go b/edge/pkg/edgehub/clients/wsclient/websocket.go
index 800c0bba1..c6f4ac8f8 100644
--- a/edge/pkg/edgehub/clients/wsclient/websocket.go
+++ b/edge/pkg/edgehub/clients/wsclient/websocket.go
@@ -2,14 +2,17 @@ package wsclient
 
 import (
 	"crypto/tls"
+	"crypto/x509"
 	"errors"
 	"fmt"
+	"io/ioutil"
 	"net/http"
 	"time"
 
 	"k8s.io/klog"
 
 	"github.com/kubeedge/beehive/pkg/core/model"
+	"github.com/kubeedge/kubeedge/edge/pkg/edgehub/config"
 	"github.com/kubeedge/viaduct/pkg/api"
 	wsclient "github.com/kubeedge/viaduct/pkg/client"
 	"github.com/kubeedge/viaduct/pkg/conn"
@@ -52,9 +55,20 @@ func (wsc *WebSocketClient) Init() error {
 		return fmt.Errorf("failed to load x509 key pair, error: %v", err)
 	}
 
+	caCert, err := ioutil.ReadFile(config.Config.TLSCAFile)
+	if err != nil {
+		return err
+	}
+
+	pool := x509.NewCertPool()
+	if ok := pool.AppendCertsFromPEM(caCert); !ok {
+		return fmt.Errorf("cannot parse the certificates")
+	}
+
 	tlsConfig := &tls.Config{
+		RootCAs:            pool,
 		Certificates:       []tls.Certificate{cert},
-		InsecureSkipVerify: true,
+		InsecureSkipVerify: false,
 	}
 
 	option := wsclient.Options{
diff --git a/edge/pkg/edgehub/common/certutil/certfile.go b/edge/pkg/edgehub/common/certutil/certfile.go
index 2cccc3b75..621861eb0 100644
--- a/edge/pkg/edgehub/common/certutil/certfile.go
+++ b/edge/pkg/edgehub/common/certutil/certfile.go
@@ -25,32 +25,30 @@ const (
 )
 
 // WriteKey stores the given key at the given location
-func WriteKey(pkiPath, name string, key crypto.Signer) error {
+func WriteKey(pkiPath string, key crypto.Signer) error {
 	if key == nil {
 		return errors.New("private key cannot be nil when writing to file")
 	}
 
-	privateKeyPath := pathForKey(pkiPath, name)
 	encoded, err := keyutil.MarshalPrivateKeyToPEM(key)
 	if err != nil {
 		return errors.Wrapf(err, "unable to marshal private key to PEM")
 	}
-	if err := keyutil.WriteKey(privateKeyPath, encoded); err != nil {
-		return errors.Wrapf(err, "unable to write private key to file %s", privateKeyPath)
+	if err := keyutil.WriteKey(pkiPath, encoded); err != nil {
+		return errors.Wrapf(err, "unable to write private key to file %s", pkiPath)
 	}
 
 	return nil
 }
 
 // WriteCert stores the given certificate at the given location
-func WriteCert(pkiPath, name string, cert *x509.Certificate) error {
+func WriteCert(certPath string, cert *x509.Certificate) error {
 	if cert == nil {
 		return errors.New("certificate cannot be nil when writing to file")
 	}
 
-	certificatePath := pathForCert(pkiPath, name)
-	if err := certutil.WriteCert(certificatePath, EncodeCertPEM(cert)); err != nil {
-		return errors.Wrapf(err, "unable to write certificate to file %s", certificatePath)
+	if err := certutil.WriteCert(certPath, EncodeCertPEM(cert)); err != nil {
+		return errors.Wrapf(err, "unable to write certificate to file %s", certPath)
 	}
 
 	return nil
diff --git a/edge/pkg/edgehub/common/certutil/certutil.go b/edge/pkg/edgehub/common/certutil/certutil.go
index 2434f357c..82695a8fb 100644
--- a/edge/pkg/edgehub/common/certutil/certutil.go
+++ b/edge/pkg/edgehub/common/certutil/certutil.go
@@ -2,16 +2,17 @@ package certutil
 
 import (
 	"bytes"
+	"crypto/ecdsa"
+	"crypto/elliptic"
 	"crypto/rand"
-	"crypto/rsa"
 	"crypto/sha256"
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/hex"
 	"encoding/pem"
 	"fmt"
-	"github.com/kubeedge/kubeedge/common/constants"
 	"github.com/kubeedge/kubeedge/edge/pkg/edgehub/common/http"
+	"github.com/kubeedge/kubeedge/edge/pkg/edgehub/config"
 	"io/ioutil"
 	"os"
 )
@@ -21,7 +22,7 @@ const privateKeyBits = 2048
 // GetCACert gets the cloudcore CA certificate
 func GetCACert(url string) ([]byte, error) {
 	client := http.NewHTTPClient()
-	req, _ := http.BuildRequest("get", url, nil, "")
+	req, _ := http.BuildRequest("GET", url, nil, "")
 	res, err := http.SendRequest(req, client)
 	if err != nil {
 		return nil, err
@@ -36,9 +37,9 @@ func GetCACert(url string) ([]byte, error) {
 }
 
 func getCSR() ([]byte, error) {
-	pk, _ := rsa.GenerateKey(rand.Reader, privateKeyBits)
+	pk, _ := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
 	// save the private key
-	if err := WriteKey(constants.DefaultCertDir, "edge", pk); err != nil {
+	if err := WriteKey(config.Config.TLSPrivateKeyFile, pk); err != nil {
 		return nil, err
 	}
 
@@ -62,7 +63,7 @@ func GetEdgeCert(url string, cacert []byte, token string) ([]byte, error) {
 		return nil, fmt.Errorf("failed to create CSR: %v", err)
 	}
 	client, err := http.NewHTTPclientWithCA(cacert)
-	req, _ := http.BuildRequest("get", url, bytes.NewReader(csr), token)
+	req, _ := http.BuildRequest("GET", url, bytes.NewReader(csr), token)
 	res, err := http.SendRequest(req, client)
 	if err != nil {
 		return nil, err
diff --git a/edge/pkg/edgehub/common/http/http.go b/edge/pkg/edgehub/common/http/http.go
index ee7088f93..8a7f3a002 100644
--- a/edge/pkg/edgehub/common/http/http.go
+++ b/edge/pkg/edgehub/common/http/http.go
@@ -3,6 +3,7 @@ package http
 import (
 	"crypto/tls"
 	"crypto/x509"
+	"encoding/pem"
 	"fmt"
 	"io"
 	"net"
@@ -64,14 +65,14 @@ func NewHTTPSclient(certFile, keyFile string) (*http.Client, error) {
 }
 
 // NewHTTPclientWithCA create client without certificate
-func NewHTTPclientWithCA(ca []byte)(*http.Client, error){
+func NewHTTPclientWithCA(ca []byte) (*http.Client, error) {
 	pool := x509.NewCertPool()
-	if ok := pool.AppendCertsFromPEM(ca); !ok {
+	if ok := pool.AppendCertsFromPEM(pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: ca})); !ok {
 		return nil, fmt.Errorf("cannot parse the certificates")
 	}
 	tr := &http.Transport{
 		TLSClientConfig: &tls.Config{
-			RootCAs:      pool,
+			RootCAs:            pool,
 			InsecureSkipVerify: false,
 		},
 	}
@@ -95,8 +96,8 @@ func BuildRequest(method string, urlStr string, body io.Reader, token string) (*
 		return nil, err
 	}
 	if token != "" {
-		req.Header.Add("authorization", token)
+		bearerToken := "Bearer " + token
+		req.Header.Add("Authorization", bearerToken)
 	}
 	return req, nil
 }
-
diff --git a/edge/pkg/edgehub/edgehub.go b/edge/pkg/edgehub/edgehub.go
index d881ada7c..c2ef17b4c 100644
--- a/edge/pkg/edgehub/edgehub.go
+++ b/edge/pkg/edgehub/edgehub.go
@@ -67,13 +67,13 @@ func (eh *EdgeHub) Start() {
 		_, err := tls.LoadX509KeyPair(config.Config.TLSCertFile, config.Config.TLSPrivateKeyFile)
 		if err != nil {
 			if err := eh.applyCerts(); err != nil {
-				klog.Errorf("failed to apply for edge certificate, error: %v", err)
+				klog.Fatal("failed to apply for edge certificate, error: %v", err)
 				return
 			}
 		}
 	} else {
 		if err := eh.applyCerts(); err != nil {
-			klog.Errorf("failed to apply for edge certificate, error: %v", err)
+			klog.Fatal("failed to apply for edge certificate, error: %v", err)
 			return
 		}
 	}
diff --git a/edge/pkg/edgehub/process.go b/edge/pkg/edgehub/process.go
index 996f71b84..84efb35ec 100644
--- a/edge/pkg/edgehub/process.go
+++ b/edge/pkg/edgehub/process.go
@@ -10,7 +10,6 @@ import (
 
 	beehiveContext "github.com/kubeedge/beehive/pkg/core/context"
 	"github.com/kubeedge/beehive/pkg/core/model"
-	"github.com/kubeedge/kubeedge/common/constants"
 	connect "github.com/kubeedge/kubeedge/edge/pkg/common/cloudconnection"
 	"github.com/kubeedge/kubeedge/edge/pkg/common/message"
 	"github.com/kubeedge/kubeedge/edge/pkg/common/modules"
@@ -39,8 +38,8 @@ func (eh *EdgeHub) applyCerts() error {
 	url := config.Config.HttpServer + caURL
 	cacert, err := certutil.GetCACert(url)
 	if err != nil {
-		klog.Errorf("failed to get CA certificate")
-		return fmt.Errorf("failed to get CA certificate")
+		klog.Errorf("failed to get CA certificate, err: %v", err)
+		return fmt.Errorf("failed to get CA certificate, err: %v", err)
 	}
 
 	// validate the CA certificate by hashcode
@@ -54,27 +53,33 @@ func (eh *EdgeHub) applyCerts() error {
 		return fmt.Errorf("failed to validate CA certificate. tokenCAhash: %s, CAhash: %s", hash, newHash)
 	}
 	// save the ca.crt to file
-	ca, _ := x509.ParseCertificate(cacert)
-	if err = certutil.WriteCert(constants.DefaultCADir, "ca", ca); err != nil {
-		klog.Errorf("failed to save the CA certificate to file: %s, error: %v", constants.DefaultCADir+"ca.crt", err)
-		return fmt.Errorf("failed to save the CA certificate to file: %s, error: %v", constants.DefaultCADir+"ca.crt", err)
+	ca, err := x509.ParseCertificate(cacert)
+	if err != nil {
+		klog.Errorf("failed to parse the CA certificate, error: %v", err)
+		return fmt.Errorf("failed to parse the CA certificate, error: %v", err)
+	}
+
+	if err = certutil.WriteCert(config.Config.TLSCAFile, ca); err != nil {
+		klog.Errorf("failed to save the CA certificate to file: %s, error: %v", config.Config.TLSCAFile, err)
+		return fmt.Errorf("failed to save the CA certificate to file: %s, error: %v", config.Config.TLSCAFile, err)
 	}
 
 	// get the edge.crt
 	url = config.Config.HttpServer + certURL
-	edgecert, err := certutil.GetEdgeCert(url, cacert, config.Config.Token)
+	edgecert, err := certutil.GetEdgeCert(url, cacert, tokenParts[1])
 	if err != nil {
 		klog.Errorf("failed to get edge certificate from the cloudcore, error: %v", err)
 		return fmt.Errorf("failed to get edge certificate from the cloudcore, error: %v", err)
 	}
 	// save the edge.crt to the file
 	cert, _ := x509.ParseCertificate(edgecert)
-	if err = certutil.WriteCert(constants.DefaultCertDir, "edge", cert); err != nil {
-		klog.Errorf("failed to save the edge certificate to file: %s, error: %v", constants.DefaultCertDir+"edge.crt", err)
-		return fmt.Errorf("failed to save the edge certificate to file: %s, error: %v", constants.DefaultCertDir+"edge.crt", err)
+	if err = certutil.WriteCert(config.Config.TLSCertFile, cert); err != nil {
+		klog.Errorf("failed to save the edge certificate to file: %s, error: %v", config.Config.TLSCertFile, err)
+		return fmt.Errorf("failed to save the edge certificate to file: %s, error: %v", config.Config.TLSCertFile, err)
 	}
 	return nil
 }
+
 func (eh *EdgeHub) initial() (err error) {
 
 	cloudHubClient, err := clients.GetClient()