Skip to content

Commit 61b675c

Browse files
82marbagDaniele Ahmed
andauthored
TLS tests in CI (#2886)
## Motivation and Context This PR adds a CI workflow to verify the TLS configuration of the smithy-rs client. ## Checklist <!--- If a checkbox below is not applicable, then please DELETE it rather than leaving it unchecked --> - [ ] I have updated `CHANGELOG.next.toml` if I made changes to the smithy-rs codegen or runtime crates - [ ] I have updated `CHANGELOG.next.toml` if I made changes to the AWS SDK, generated SDK code, or SDK runtime crates ---- _By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice._ --------- Signed-off-by: Daniele Ahmed <ahmeddan@amazon.de> Co-authored-by: Daniele Ahmed <ahmeddan@amazon.de>
1 parent 5675a69 commit 61b675c

File tree

9 files changed

+342
-0
lines changed

9 files changed

+342
-0
lines changed

.github/workflows/ci-tls.yml

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
2+
# SPDX-License-Identifier: Apache-2.0
3+
4+
# This workflow tests the TLS configuration of the smithy-rs client
5+
# To run on an Ubuntu machine, run each step in this order.
6+
# Each script can be run on your Ubuntu host.
7+
# You will have to install Docker and rustc/cargo manually.
8+
9+
env:
10+
rust_version: 1.68.2
11+
12+
name: Verify client TLS configuration
13+
on:
14+
pull_request:
15+
push:
16+
branches: [main]
17+
18+
jobs:
19+
verify-tls-config:
20+
name: Verify TLS configuration
21+
runs-on: ubuntu-latest
22+
steps:
23+
- name: Install packages
24+
shell: bash
25+
run: |
26+
sudo apt-get update
27+
sudo apt-get -y install gcc make python3-pip nginx git ruby openjdk-17-jre pkg-config libssl-dev faketime
28+
pip3 install certbuilder crlbuilder
29+
- name: Stop nginx
30+
run: sudo systemctl stop nginx
31+
- name: Checkout smithy-rs
32+
uses: actions/checkout@v3
33+
with:
34+
path: ./smithy-rs
35+
- name: Checkout trytls
36+
uses: actions/checkout@v3
37+
with:
38+
repository: ouspg/trytls
39+
path: ./trytls
40+
- name: Checkout badtls
41+
uses: actions/checkout@v3
42+
with:
43+
repository: wbond/badtls.io
44+
path: ./badtls.io
45+
- name: Checkout badssl
46+
uses: actions/checkout@v3
47+
with:
48+
repository: chromium/badssl.com
49+
path: ./badssl.com
50+
- name: Install Rust
51+
uses: dtolnay/rust-toolchain@master
52+
with:
53+
toolchain: ${{ env.rust_version }}
54+
- name: Build badssl.com
55+
shell: bash
56+
working-directory: badssl.com
57+
env:
58+
DOCKER_BUILDKIT: 1
59+
run: ../smithy-rs/tools/ci-scripts/configure-tls/configure-badssl
60+
- name: Build SDK
61+
working-directory: smithy-rs
62+
run: ./gradlew :aws:sdk:assemble -Paws.services=+sts,+sso
63+
- name: Build trytls
64+
shell: bash
65+
working-directory: trytls
66+
run: ../smithy-rs/tools/ci-scripts/configure-tls/configure-trytls
67+
- name: Build badtls.io
68+
working-directory: badtls.io
69+
shell: bash
70+
run: ../smithy-rs/tools/ci-scripts/configure-tls/configure-badtls
71+
- name: Update TLS configuration
72+
shell: bash
73+
run: smithy-rs/tools/ci-scripts/configure-tls/update-certs
74+
- name: Build TLS stub
75+
working-directory: smithy-rs/tools/ci-resources/tls-stub
76+
shell: bash
77+
run: cargo build
78+
- name: Test TLS configuration
79+
working-directory: smithy-rs/tools
80+
shell: bash
81+
run: trytls https target/debug/stub

ci.mk

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,3 +131,7 @@ check-semver:
131131
.PHONY: generate-smithy-rs-release
132132
generate-smithy-rs-release:
133133
$(CI_ACTION) $@ $(ARGS)
134+
135+
.PHONY: verify-tls-config
136+
verify-tls-config:
137+
$(CI_ACTION) $@ $(ARGS)
Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
#
2+
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
3+
# SPDX-License-Identifier: Apache-2.0
4+
#
5+
6+
[package]
7+
name = "stub"
8+
version = "0.1.0"
9+
edition = "2021"
10+
publish = false
11+
12+
[dependencies]
13+
aws-config = {path = "../../../aws/sdk/build/aws-sdk/sdk/aws-config", features = ["client-hyper"] }
14+
aws-credential-types = { path = "../../../aws/sdk/build/aws-sdk/sdk/aws-credential-types", features = ["hardcoded-credentials"] }
15+
aws-sdk-sts = { path = "../../../aws/sdk/build/aws-sdk/sdk/sts" }
16+
aws-smithy-client = { path = "../../../aws/sdk/build/aws-sdk/sdk/aws-smithy-client", features = ["client-hyper", "rustls"] }
17+
exitcode = "1"
18+
hyper-rustls = { version = "0.24", features = ["rustls-native-certs", "http2"] }
19+
rustls = "0.21"
20+
rustls-native-certs = "0.6"
21+
rustls-pemfile = "1"
22+
tokio = { version = "1", features = ["full"] }
23+
x509-parser = "0.15"
Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
# TLS Stub
2+
3+
This package is used to verify the client's TLS configuration.
4+
5+
It is used in a CI test. See `ci-tls.yml`, "Verify client TLS configuration".
6+
7+
The stub loads a root certificate authority and uses it to connect to a supplied port on localhost.
8+
`trytls` reads the output on the console and uses the exit code of the stub to pass or fail a test case.
Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
/*
2+
* Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
3+
* SPDX-License-Identifier: Apache-2.0
4+
*/
5+
6+
use std::env;
7+
use std::fs::File;
8+
use std::io::BufReader;
9+
use std::time::Duration;
10+
11+
use aws_config::timeout::TimeoutConfig;
12+
use aws_credential_types::Credentials;
13+
use aws_sdk_sts::error::SdkError;
14+
15+
#[cfg(debug_assertions)]
16+
use x509_parser::prelude::*;
17+
18+
const OPERATION_TIMEOUT: u64 = 5;
19+
20+
fn unsupported() {
21+
println!("UNSUPPORTED");
22+
std::process::exit(exitcode::OK);
23+
}
24+
25+
fn get_credentials() -> Credentials {
26+
Credentials::from_keys(
27+
"AKIAIOSFODNN7EXAMPLE",
28+
"wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
29+
None,
30+
)
31+
}
32+
33+
#[cfg(debug_assertions)]
34+
fn debug_cert(cert: &[u8]) {
35+
let x509 = X509Certificate::from_der(cert).unwrap();
36+
let subject = x509.1.subject();
37+
let serial = x509.1.raw_serial_as_string();
38+
println!("Adding root CA: {subject} ({serial})");
39+
}
40+
41+
fn add_cert_to_store(cert: &[u8], store: &mut rustls::RootCertStore) {
42+
let cert = rustls::Certificate(cert.to_vec());
43+
#[cfg(debug_assertions)]
44+
debug_cert(&cert.0);
45+
if let Err(e) = store.add(&cert) {
46+
println!("Error adding root certificate: {e}");
47+
unsupported();
48+
}
49+
}
50+
51+
fn load_ca_bundle(filename: &String, roots: &mut rustls::RootCertStore) {
52+
match File::open(filename) {
53+
Ok(f) => {
54+
let mut f = BufReader::new(f);
55+
match rustls_pemfile::certs(&mut f) {
56+
Ok(certs) => {
57+
for cert in certs {
58+
add_cert_to_store(&cert, roots);
59+
}
60+
}
61+
Err(e) => {
62+
println!("Error reading PEM file: {e}");
63+
unsupported();
64+
}
65+
}
66+
}
67+
Err(e) => {
68+
println!("Error opening file '{filename}': {e}");
69+
unsupported();
70+
}
71+
}
72+
}
73+
74+
fn load_native_certs(roots: &mut rustls::RootCertStore) {
75+
let certs = rustls_native_certs::load_native_certs();
76+
if let Err(ref e) = certs {
77+
println!("Error reading native certificates: {e}");
78+
unsupported();
79+
}
80+
for cert in certs.unwrap() {
81+
add_cert_to_store(&cert.0, roots);
82+
}
83+
let mut pem_ca_cert = b"\
84+
-----BEGIN CERTIFICATE-----
85+
-----END CERTIFICATE-----\
86+
" as &[u8];
87+
let certs = rustls_pemfile::certs(&mut pem_ca_cert).unwrap();
88+
for cert in certs {
89+
add_cert_to_store(&cert, roots);
90+
}
91+
}
92+
93+
async fn create_client(
94+
roots: rustls::RootCertStore,
95+
host: &String,
96+
port: &String,
97+
) -> aws_sdk_sts::Client {
98+
let credentials = get_credentials();
99+
let tls_config = rustls::client::ClientConfig::builder()
100+
.with_safe_default_cipher_suites()
101+
.with_safe_default_kx_groups()
102+
.with_safe_default_protocol_versions()
103+
.unwrap()
104+
.with_root_certificates(roots)
105+
.with_no_client_auth();
106+
let https_connector = hyper_rustls::HttpsConnectorBuilder::new()
107+
.with_tls_config(tls_config)
108+
.https_only()
109+
.enable_http1()
110+
.enable_http2()
111+
.build();
112+
let smithy_connector = aws_smithy_client::hyper_ext::Adapter::builder().build(https_connector);
113+
let sdk_config = aws_config::from_env()
114+
.http_connector(smithy_connector)
115+
.credentials_provider(credentials)
116+
.region("us-nether-1")
117+
.endpoint_url(format!("https://{host}:{port}"))
118+
.timeout_config(
119+
TimeoutConfig::builder()
120+
.operation_timeout(Duration::from_secs(OPERATION_TIMEOUT))
121+
.build(),
122+
)
123+
.load()
124+
.await;
125+
aws_sdk_sts::Client::new(&sdk_config)
126+
}
127+
128+
#[tokio::main]
129+
async fn main() -> Result<(), aws_sdk_sts::Error> {
130+
let argv: Vec<String> = env::args().collect();
131+
if argv.len() < 3 || argv.len() > 4 {
132+
eprintln!("Syntax: {} <hostname> <port> [ca-file]", argv[0]);
133+
std::process::exit(exitcode::USAGE);
134+
}
135+
let mut roots = rustls::RootCertStore::empty();
136+
if argv.len() == 4 {
137+
print!(
138+
"Connecting to https://{}:{} with root CA bundle from {}: ",
139+
&argv[1], &argv[2], &argv[3]
140+
);
141+
load_ca_bundle(&argv[3], &mut roots);
142+
} else {
143+
print!(
144+
"Connecting to https://{}:{} with native roots: ",
145+
&argv[1], &argv[2]
146+
);
147+
load_native_certs(&mut roots);
148+
}
149+
let sts_client = create_client(roots, &argv[1], &argv[2]).await;
150+
match sts_client.get_caller_identity().send().await {
151+
Ok(_) => println!("\nACCEPT"),
152+
Err(SdkError::DispatchFailure(e)) => println!("{e:?}\nREJECT"),
153+
Err(SdkError::ServiceError(e)) => println!("{e:?}\nACCEPT"),
154+
Err(e) => {
155+
println!("Unexpected error: {e:#?}");
156+
std::process::exit(exitcode::SOFTWARE);
157+
}
158+
}
159+
Ok(())
160+
}
Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
#!/bin/bash
2+
#
3+
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
4+
# SPDX-License-Identifier: Apache-2.0
5+
#
6+
7+
set -euxo pipefail
8+
9+
perl -p -i -e 's/ruby2\.4/ruby2.6/' Dockerfile
10+
grep -q 'start of badssl\.test hosts' /etc/hosts || make list-hosts | sudo tee -a /etc/hosts
11+
# badssl fails to create dh480.pem on our Ubuntu host.
12+
# Create it manually inside the docker container.
13+
sed -i '/CMD /i \
14+
RUN echo "-----BEGIN DH PARAMETERS-----" >/var/www/badssl/_site/certs/sets/current/gen/dhparam/dh480.pem \
15+
RUN echo "MEICPQDZ/YFp3iEs3/k9iRGoC/5/To2+5pUF/C6GkO6VjXHHyRVy68I0rI0q7IAq" >>/var/www/badssl/_site/certs/sets/current/gen/dhparam/dh480.pem \
16+
RUN echo "VyyGQ7/5Q/Iu0QQnHT4X9uMCAQI=" >>/var/www/badssl/_site/certs/sets/current/gen/dhparam/dh480.pem \
17+
RUN echo "-----END DH PARAMETERS-----" >>/var/www/badssl/_site/certs/sets/current/gen/dhparam/dh480.pem \
18+
' Dockerfile
19+
sed -i '/ 480/c \\ttrue' certs/Makefile
20+
# badssl does not create an expired certificate;
21+
# it creates a certificate that expires after 1 day and waits for 1 day to run the "expired certificate" test.
22+
# This command patches this behavior to run the test immediately.
23+
# See: https://github.com/chromium/badssl.com/blob/df8d5a9d062f4b99fc19d8aacdea5333b399d624/certs/Makefile#L177
24+
sed -i 's%./tool sign $@ $(D) 1 sha256 req_v3_usr $^%faketime -f "-2d" ./tool sign $@ $(D) 1 sha256 req_v3_usr $^%' certs/Makefile
25+
screen -dmS badssl sudo make serve
Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#!/bin/bash
2+
#
3+
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
4+
# SPDX-License-Identifier: Apache-2.0
5+
#
6+
7+
set -euxo pipefail
8+
9+
python3 scripts/generate.py badtls.test
10+
sudo mkdir /etc/nginx/tls || true
11+
sudo mkdir /var/www || true
12+
sudo python3 scripts/install.py /etc/nginx/conf.d /etc/nginx/tls /var/www
13+
sudo rm /etc/nginx/sites-enabled/default
14+
echo '#### start of badtls.test hosts ####' | sudo tee -a /etc/hosts
15+
echo '127.0.0.1 domain-match.badtls.test wildcard-match.badtls.test san-match.badtls.test dh1024.badtls.test expired-1963.badtls.test future.badtls.test domain-mismatch.badtls.test san-mismatch.badtls.test bad-key-usage.badtls.test expired.badtls.test wildcard.mismatch.badtls.test rc4.badtls.test weak-sig.badtls.test rc4-md5.badtls.test' | sudo tee -a /etc/hosts
16+
echo '#### end of badtls.test hosts ####' | sudo tee -a /etc/hosts
17+
screen -dmS badtls sudo bash ./scripts/local.sh
Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
#!/bin/bash
2+
#
3+
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
4+
# SPDX-License-Identifier: Apache-2.0
5+
#
6+
7+
set -euxo pipefail
8+
9+
perl -p -i -e 's!\./runners!runners!' setup.py
10+
sed -i '/import platform/a import distro' runners/trytls/utils.py
11+
sed -i 's/platform.linux_distribution()/distro.name(), distro.version(), distro.id()/' runners/trytls/utils.py
12+
sed -i 's/break//' runners/trytls/bundles/https.py
13+
perl -p -i -e 's/badssl\.com/badssl.test/g; s/badtls\.io/badtls.test/g;' runners/trytls/bundles/https.py
14+
pip3 install -e .
Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#!/bin/bash
2+
#
3+
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
4+
# SPDX-License-Identifier: Apache-2.0
5+
#
6+
7+
set -euxo pipefail
8+
9+
sed -i -e '/BEGIN CERTIFICATE/,/CERTIFICATE/!b' -e '/END CERTIFICATE/!d;r badtls.io/certs/ca.crt' -e 'd' trytls/runners/trytls/bundles/https.py
10+
sed -i -e '/BEGIN CERTIFICATE/,/CERTIFICATE/!b' -e '/END CERTIFICATE/!d;r badssl.com/certs/sets/test/gen/crt/ca-root.crt' -e 'd' smithy-rs/tools/ci-resources/tls-stub/src/main.rs

0 commit comments

Comments
 (0)