2090580504

Build # 2090580504

Build Type

github

Committed by GitHub

Commit Message

<a href="https://github.com/tremor-rs/tremor-runtime/commit/<a class=hub.com/tremor-rs/tremor-runtime/commit/a57dc05dd51e4afad16132756238aadb0fe2b625">a57dc05dd<a href="https://github.com/tremor-rs/tremor-runtime/commit/a57dc05dd51e4afad16132756238aadb0fe2b625">">Merge </a><a class="double-link" href="https://github.com/tremor-rs/tremor-runtime/commit/<a class="double-link" href="https://github.com/tremor-rs/tremor-runtime/commit/7e64529d0b8ec89325996a5935069f72fcd135aa">7e64529d0</a>">7e64529d0</a><a href="https://github.com/tremor-rs/tremor-runtime/commit/a57dc05dd51e4afad16132756238aadb0fe2b625"> into ca5234b15">ca5234b15</a>

Pull Request Pull Request #1077: Connectors Implementation

Run Details

14221 of 14221 new or added lines in 164 files covered. (100.0%)

23737 of 27356 relevant lines covered (86.77%)

3.75 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

57.14

/src/connectors/utils/tls.rs

// Copyright 2021, The Tremor Team
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

//! TLS utilities

use std::path::{Path, PathBuf};
use std::sync::Arc;

use crate::errors::{Error, Kind as ErrorKind, Result};
use async_tls::TlsConnector;
use rustls::internal::pemfile::{certs, pkcs8_private_keys, rsa_private_keys};
use rustls::{Certificate, ClientConfig, NoClientAuth, PrivateKey, RootCertStore, ServerConfig};
use rustls_native_certs::load_native_certs;
use std::io::{BufReader, Cursor};

lazy_static! {
    static ref SYSTEM_ROOT_CERTS: RootCertStore = {
        let mut roots = RootCertStore::empty();
        // ALLOW: this is expected to panic if we cannot load system certificates
        for cert in load_native_certs().expect("Unable to load system TLS certificates.") {
            roots
                .add(&Certificate(cert.0))
                // ALLOW: this is expected to panic if we cannot load system certificates
                .expect("Unable to add root TLS certificate to RootCertStore");
        }
        roots
    };
}

#[derive(Debug, Clone, Deserialize)]
pub struct TLSServerConfig {
    pub(crate) cert: PathBuf,
    pub(crate) key: PathBuf,
}

#[derive(Deserialize, Debug, Default, Clone)]
#[serde(deny_unknown_fields)]
pub struct TLSClientConfig {
    pub(crate) cafile: Option<PathBuf>,
    pub(crate) domain: Option<String>,
}

/// Load the passed certificates file
pub(crate) fn load_certs(path: &Path) -> Result<Vec<Certificate>> {
    let certfile = tremor_common::file::open(path)?;
    let mut reader = BufReader::new(certfile);
    certs(&mut reader).map_err(|_| {
        Error::from(ErrorKind::TLSError(format!(
            "Invalid certificate in {}",
            path.display()
        )))
    })
}

/// Load the passed private key file
pub(crate) fn load_keys(path: &Path) -> Result<PrivateKey> {
    // prefer to load pkcs8 keys
    // this will only error if we have invalid pkcs8 key base64 or we couldnt read the file.
    let mut keys: Vec<PrivateKey> = {
        let keyfile = tremor_common::file::open(path)?;
        let mut reader = BufReader::new(keyfile);
        pkcs8_private_keys(&mut reader).map_err(|_e| {
            Error::from(ErrorKind::TLSError(format!(
                "Invalid PKCS8 Private key in {}",
                path.display()
            )))
        })
    }?;

    // only attempt to load as RSA keys if file has no pkcs8 keys
    if keys.is_empty() {
        let keyfile = tremor_common::file::open(path)?;
        let mut reader = BufReader::new(keyfile);
        keys = rsa_private_keys(&mut reader).map_err(|_e| {
            Error::from(ErrorKind::TLSError(format!(
                "Invalid RSA Private key in {}",
                path.display()
            )))
        })?;
    }

    if keys.is_empty() {
        Err(Error::from(ErrorKind::TLSError(format!(
            "No valid private keys (RSA or PKCS8) found in {}",
            path.display()
        ))))
    } else {
        // ALLOW: we know keys is not empty
        Ok(keys.remove(0))
    }
}

pub(crate) fn load_server_config(config: &TLSServerConfig) -> Result<ServerConfig> {
    let certs = load_certs(&config.cert)?;
    certs.len();
    let keys = load_keys(&config.key)?;
    keys.0.len();

    let mut server_config = ServerConfig::new(NoClientAuth::new());
    server_config
        // set this server to use one cert together with the loaded private key
        .set_single_cert(certs, keys)?;

    Ok(server_config)
}

/// if we have a cafile configured, we only load it, and no other ca certificates
/// if there is no cafile configured, we load the default webpki-roots from Mozilla
pub(crate) async fn tls_client_connector(config: &TLSClientConfig) -> Result<TlsConnector> {
    Ok(if let Some(cafile) = config.cafile.as_ref() {
        let mut config = ClientConfig::new();
        let file = async_std::fs::read(cafile).await?;
        let mut pem = Cursor::new(file);
        config.root_store.add_pem_file(&mut pem).map_err(|_e| {
            Error::from(ErrorKind::TLSError(format!(
                "Invalid certificate in {}",
                cafile.display()
            )))
        })?;
        TlsConnector::from(Arc::new(config))
    } else {
        let mut config = ClientConfig::new();
        config.root_store = SYSTEM_ROOT_CERTS.clone();
        TlsConnector::from(Arc::new(config))
    })
}

1	// Copyright 2021, The Tremor Team
2	//
3	// Licensed under the Apache License, Version 2.0 (the "License");
4	// you may not use this file except in compliance with the License.
5	// You may obtain a copy of the License at
6	//
7	// http://www.apache.org/licenses/LICENSE-2.0
8	//
9	// Unless required by applicable law or agreed to in writing, software
10	// distributed under the License is distributed on an "AS IS" BASIS,
11	// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	// See the License for the specific language governing permissions and
13	// limitations under the License.
14
15	//! TLS utilities
16
17	use std::path::{Path, PathBuf};
18	use std::sync::Arc;
19
20	use crate::errors::{Error, Kind as ErrorKind, Result};
21	use async_tls::TlsConnector;
22	use rustls::internal::pemfile::{certs, pkcs8_private_keys, rsa_private_keys};
23	use rustls::{Certificate, ClientConfig, NoClientAuth, PrivateKey, RootCertStore, ServerConfig};
24	use rustls_native_certs::load_native_certs;
25	use std::io::{BufReader, Cursor};
26
27	lazy_static! {
28	static ref SYSTEM_ROOT_CERTS: RootCertStore = {
29	let mut roots = RootCertStore::empty();	×
30	// ALLOW: this is expected to panic if we cannot load system certificates
31	for cert in load_native_certs().expect("Unable to load system TLS certificates.") {	×
32	roots	×
33	.add(&Certificate(cert.0))	×
34	// ALLOW: this is expected to panic if we cannot load system certificates
35	.expect("Unable to add root TLS certificate to RootCertStore");	×
36	}
37	roots
38	};
39	}
40
41	#[derive(Debug, Clone, Deserialize)]
42	pub struct TLSServerConfig {
43	pub(crate) cert: PathBuf,
44	pub(crate) key: PathBuf,
45	}
46
47	#[derive(Deserialize, Debug, Default, Clone)]
48	#[serde(deny_unknown_fields)]
49	pub struct TLSClientConfig {
50	pub(crate) cafile: Option<PathBuf>,
51	pub(crate) domain: Option<String>,
52	}
53
54	/// Load the passed certificates file
55	pub(crate) fn load_certs(path: &Path) -> Result<Vec<Certificate>> {	1✔
56	let certfile = tremor_common::file::open(path)?;	1✔
57	let mut reader = BufReader::new(certfile);	1✔
58	certs(&mut reader).map_err(\|_\| {	2✔
59	Error::from(ErrorKind::TLSError(format!(	×
60	"Invalid certificate in {}",
61	path.display()	×
62	)))
63	})
64	}
65
66	/// Load the passed private key file
67	pub(crate) fn load_keys(path: &Path) -> Result<PrivateKey> {	1✔
68	// prefer to load pkcs8 keys
69	// this will only error if we have invalid pkcs8 key base64 or we couldnt read the file.
70	let mut keys: Vec<PrivateKey> = {	3✔
71	let keyfile = tremor_common::file::open(path)?;	1✔
72	let mut reader = BufReader::new(keyfile);	1✔
73	pkcs8_private_keys(&mut reader).map_err(\|_e\| {	2✔
74	Error::from(ErrorKind::TLSError(format!(	×
75	"Invalid PKCS8 Private key in {}",
76	path.display()	×
77	)))
78	})
79	}?;
80
81	// only attempt to load as RSA keys if file has no pkcs8 keys
82	if keys.is_empty() {	2✔
83	let keyfile = tremor_common::file::open(path)?;	×
84	let mut reader = BufReader::new(keyfile);	×
85	keys = rsa_private_keys(&mut reader).map_err(\|_e\| {	×
86	Error::from(ErrorKind::TLSError(format!(	×
87	"Invalid RSA Private key in {}",
88	path.display()	×
89	)))
90	})?;
91	}
92
93	if keys.is_empty() {	3✔
94	Err(Error::from(ErrorKind::TLSError(format!(	×
95	"No valid private keys (RSA or PKCS8) found in {}",
96	path.display()	×
97	))))
98	} else {
99	// ALLOW: we know keys is not empty
100	Ok(keys.remove(0))	2✔
101	}
102	}
103
104	pub(crate) fn load_server_config(config: &TLSServerConfig) -> Result<ServerConfig> {	1✔
105	let certs = load_certs(&config.cert)?;	1✔
106	certs.len();	1✔
107	let keys = load_keys(&config.key)?;	2✔
108	keys.0.len();	1✔
109
110	let mut server_config = ServerConfig::new(NoClientAuth::new());	2✔
111	server_config	2✔
112	// set this server to use one cert together with the loaded private key
113	.set_single_cert(certs, keys)?;	1✔
114
115	Ok(server_config)	1✔
116	}
117
118	/// if we have a cafile configured, we only load it, and no other ca certificates
119	/// if there is no cafile configured, we load the default webpki-roots from Mozilla
120	pub(crate) async fn tls_client_connector(config: &TLSClientConfig) -> Result<TlsConnector> {	5✔
121	Ok(if let Some(cafile) = config.cafile.as_ref() {	5✔
122	let mut config = ClientConfig::new();	1✔
123	let file = async_std::fs::read(cafile).await?;	4✔
124	let mut pem = Cursor::new(file);	1✔
125	config.root_store.add_pem_file(&mut pem).map_err(\|_e\| {	3✔
126	Error::from(ErrorKind::TLSError(format!(	×
127	"Invalid certificate in {}",
128	cafile.display()	×
129	)))
130	})?;
131	TlsConnector::from(Arc::new(config))	2✔
132	} else {
133	let mut config = ClientConfig::new();	×
134	config.root_store = SYSTEM_ROOT_CERTS.clone();	×
135	TlsConnector::from(Arc::new(config))	×
136	})
137	}

tremor-rs / tremor-runtime / 2090580504

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous