|
| 1 | +/* |
| 2 | + * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved. |
| 3 | + * SPDX-License-Identifier: Apache-2.0 |
| 4 | + */ |
| 5 | + |
| 6 | +use std::env; |
| 7 | +use std::fs::File; |
| 8 | +use std::io::BufReader; |
| 9 | +use std::time::Duration; |
| 10 | + |
| 11 | +use aws_config::timeout::TimeoutConfig; |
| 12 | +use aws_credential_types::Credentials; |
| 13 | +use aws_sdk_sts::error::SdkError; |
| 14 | + |
| 15 | +#[cfg(debug_assertions)] |
| 16 | +use x509_parser::prelude::*; |
| 17 | + |
| 18 | +const OPERATION_TIMEOUT: u64 = 5; |
| 19 | + |
| 20 | +fn unsupported() { |
| 21 | + println!("UNSUPPORTED"); |
| 22 | + std::process::exit(exitcode::OK); |
| 23 | +} |
| 24 | + |
| 25 | +fn get_credentials() -> Credentials { |
| 26 | + Credentials::from_keys( |
| 27 | + "AKIAIOSFODNN7EXAMPLE", |
| 28 | + "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY", |
| 29 | + None, |
| 30 | + ) |
| 31 | +} |
| 32 | + |
| 33 | +#[cfg(debug_assertions)] |
| 34 | +fn debug_cert(cert: &[u8]) { |
| 35 | + let x509 = X509Certificate::from_der(cert).unwrap(); |
| 36 | + let subject = x509.1.subject(); |
| 37 | + let serial = x509.1.raw_serial_as_string(); |
| 38 | + println!("Adding root CA: {subject} ({serial})"); |
| 39 | +} |
| 40 | + |
| 41 | +fn add_cert_to_store(cert: &[u8], store: &mut rustls::RootCertStore) { |
| 42 | + let cert = rustls::Certificate(cert.to_vec()); |
| 43 | + #[cfg(debug_assertions)] |
| 44 | + debug_cert(&cert.0); |
| 45 | + if let Err(e) = store.add(&cert) { |
| 46 | + println!("Error adding root certificate: {e}"); |
| 47 | + unsupported(); |
| 48 | + } |
| 49 | +} |
| 50 | + |
| 51 | +fn load_ca_bundle(filename: &String, roots: &mut rustls::RootCertStore) { |
| 52 | + match File::open(filename) { |
| 53 | + Ok(f) => { |
| 54 | + let mut f = BufReader::new(f); |
| 55 | + match rustls_pemfile::certs(&mut f) { |
| 56 | + Ok(certs) => { |
| 57 | + for cert in certs { |
| 58 | + add_cert_to_store(&cert, roots); |
| 59 | + } |
| 60 | + } |
| 61 | + Err(e) => { |
| 62 | + println!("Error reading PEM file: {e}"); |
| 63 | + unsupported(); |
| 64 | + } |
| 65 | + } |
| 66 | + } |
| 67 | + Err(e) => { |
| 68 | + println!("Error opening file '{filename}': {e}"); |
| 69 | + unsupported(); |
| 70 | + } |
| 71 | + } |
| 72 | +} |
| 73 | + |
| 74 | +fn load_native_certs(roots: &mut rustls::RootCertStore) { |
| 75 | + let certs = rustls_native_certs::load_native_certs(); |
| 76 | + if let Err(ref e) = certs { |
| 77 | + println!("Error reading native certificates: {e}"); |
| 78 | + unsupported(); |
| 79 | + } |
| 80 | + for cert in certs.unwrap() { |
| 81 | + add_cert_to_store(&cert.0, roots); |
| 82 | + } |
| 83 | + let mut pem_ca_cert = b"\ |
| 84 | +-----BEGIN CERTIFICATE----- |
| 85 | +-----END CERTIFICATE-----\ |
| 86 | +" as &[u8]; |
| 87 | + let certs = rustls_pemfile::certs(&mut pem_ca_cert).unwrap(); |
| 88 | + for cert in certs { |
| 89 | + add_cert_to_store(&cert, roots); |
| 90 | + } |
| 91 | +} |
| 92 | + |
| 93 | +async fn create_client( |
| 94 | + roots: rustls::RootCertStore, |
| 95 | + host: &String, |
| 96 | + port: &String, |
| 97 | +) -> aws_sdk_sts::Client { |
| 98 | + let credentials = get_credentials(); |
| 99 | + let tls_config = rustls::client::ClientConfig::builder() |
| 100 | + .with_safe_default_cipher_suites() |
| 101 | + .with_safe_default_kx_groups() |
| 102 | + .with_safe_default_protocol_versions() |
| 103 | + .unwrap() |
| 104 | + .with_root_certificates(roots) |
| 105 | + .with_no_client_auth(); |
| 106 | + let https_connector = hyper_rustls::HttpsConnectorBuilder::new() |
| 107 | + .with_tls_config(tls_config) |
| 108 | + .https_only() |
| 109 | + .enable_http1() |
| 110 | + .enable_http2() |
| 111 | + .build(); |
| 112 | + let smithy_connector = aws_smithy_client::hyper_ext::Adapter::builder().build(https_connector); |
| 113 | + let sdk_config = aws_config::from_env() |
| 114 | + .http_connector(smithy_connector) |
| 115 | + .credentials_provider(credentials) |
| 116 | + .region("us-nether-1") |
| 117 | + .endpoint_url(format!("https://{host}:{port}")) |
| 118 | + .timeout_config( |
| 119 | + TimeoutConfig::builder() |
| 120 | + .operation_timeout(Duration::from_secs(OPERATION_TIMEOUT)) |
| 121 | + .build(), |
| 122 | + ) |
| 123 | + .load() |
| 124 | + .await; |
| 125 | + aws_sdk_sts::Client::new(&sdk_config) |
| 126 | +} |
| 127 | + |
| 128 | +#[tokio::main] |
| 129 | +async fn main() -> Result<(), aws_sdk_sts::Error> { |
| 130 | + let argv: Vec<String> = env::args().collect(); |
| 131 | + if argv.len() < 3 || argv.len() > 4 { |
| 132 | + eprintln!("Syntax: {} <hostname> <port> [ca-file]", argv[0]); |
| 133 | + std::process::exit(exitcode::USAGE); |
| 134 | + } |
| 135 | + let mut roots = rustls::RootCertStore::empty(); |
| 136 | + if argv.len() == 4 { |
| 137 | + print!( |
| 138 | + "Connecting to https://{}:{} with root CA bundle from {}: ", |
| 139 | + &argv[1], &argv[2], &argv[3] |
| 140 | + ); |
| 141 | + load_ca_bundle(&argv[3], &mut roots); |
| 142 | + } else { |
| 143 | + print!( |
| 144 | + "Connecting to https://{}:{} with native roots: ", |
| 145 | + &argv[1], &argv[2] |
| 146 | + ); |
| 147 | + load_native_certs(&mut roots); |
| 148 | + } |
| 149 | + let sts_client = create_client(roots, &argv[1], &argv[2]).await; |
| 150 | + match sts_client.get_caller_identity().send().await { |
| 151 | + Ok(_) => println!("\nACCEPT"), |
| 152 | + Err(SdkError::DispatchFailure(e)) => println!("{e:?}\nREJECT"), |
| 153 | + Err(SdkError::ServiceError(e)) => println!("{e:?}\nACCEPT"), |
| 154 | + Err(e) => { |
| 155 | + println!("Unexpected error: {e:#?}"); |
| 156 | + std::process::exit(exitcode::SOFTWARE); |
| 157 | + } |
| 158 | + } |
| 159 | + Ok(()) |
| 160 | +} |
0 commit comments