Accept insecure certs when submitting protocol CMS (#628, #629)

Includes minor code cleanup:
 - remove unnecessary async
 - do not try to print protocol CMS (not accessible throug CLI and we have logging)

src/commons/util/httpclient.rs

@@ -24,24 +24,7 @@ fn report_get_and_exit(uri: &str, token: Option<&Token>) {
     std::process::exit(0);
 }
 
-enum PostBody<'a> {
-    String(&'a String),
-    Bytes(&'a Vec<u8>),
-}
-
-impl<'a> fmt::Display for PostBody<'a> {
-    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
-        match self {
-            PostBody::String(string) => write!(f, "{}", string),
-            PostBody::Bytes(bytes) => {
-                let base64 = base64::encode(bytes);
-                write!(f, "<binary content, base64 encoded for display here> {}", base64)
-            }
-        }
-    }
-}
-
-fn report_post_and_exit(uri: &str, content_type: Option<&str>, token: Option<&Token>, body: PostBody) {
+fn report_post_and_exit(uri: &str, content_type: Option<&str>, token: Option<&Token>, body: &str) {
     println!("POST:\n  {}", uri);
 
     if content_type.is_some() || token.is_some() {
@@ -85,7 +68,7 @@ pub async fn get_json<T: DeserializeOwned>(uri: &str, token: Option<&Token>) ->
 
     let headers = headers(Some(JSON_CONTENT), token)?;
 
-    let res = client(uri).await?.get(uri).headers(headers).send().await?;
+    let res = client(uri)?.get(uri).headers(headers).send().await?;
     process_json_response(res).await
 }
 
@@ -97,7 +80,7 @@ pub async fn get_text(uri: &str, token: Option<&Token>) -> Result<String, Error>
     }
 
     let headers = headers(None, token)?;
-    let res = client(uri).await?.get(uri).headers(headers).send().await?;
+    let res = client(uri)?.get(uri).headers(headers).send().await?;
     match opt_text_response(res).await? {
         Some(res) => Ok(res),
         None => Err(Error::EmptyResponse),
@@ -112,7 +95,7 @@ pub async fn get_ok(uri: &str, token: Option<&Token>) -> Result<(), Error> {
     }
 
     let headers = headers(None, token)?;
-    let res = client(uri).await?.get(uri).headers(headers).send().await?;
+    let res = client(uri)?.get(uri).headers(headers).send().await?;
     opt_text_response(res).await?; // Will return nice errors with possible body.
     Ok(())
 }
@@ -122,13 +105,13 @@ pub async fn get_ok(uri: &str, token: Option<&Token>) -> Result<(), Error> {
 pub async fn post_json(uri: &str, data: impl Serialize, token: Option<&Token>) -> Result<(), Error> {
     if env::var(KRILL_CLI_API_ENV).is_ok() {
         let body = serde_json::to_string_pretty(&data)?;
-        report_post_and_exit(uri, Some(JSON_CONTENT), token, PostBody::String(&body));
+        report_post_and_exit(uri, Some(JSON_CONTENT), token, &body);
     }
 
     let body = serde_json::to_string(&data)?;
     let headers = headers(Some(JSON_CONTENT), token)?;
 
-    let res = client(uri).await?.post(uri).headers(headers).body(body).send().await?;
+    let res = client(uri)?.post(uri).headers(headers).body(body).send().await?;
     if let Some(res) = opt_text_response(res).await? {
         Err(Error::UnexpectedResponse(res))
     } else {
@@ -160,23 +143,23 @@ pub async fn post_json_with_opt_response<T: DeserializeOwned>(
 ) -> Result<Option<T>, Error> {
     if env::var(KRILL_CLI_API_ENV).is_ok() {
         let body = serde_json::to_string_pretty(&data)?;
-        report_post_and_exit(uri, Some(JSON_CONTENT), token, PostBody::String(&body));
+        report_post_and_exit(uri, Some(JSON_CONTENT), token, &body);
     }
 
     let body = serde_json::to_string(&data)?;
     let headers = headers(Some(JSON_CONTENT), token)?;
-    let res = client(uri).await?.post(uri).headers(headers).body(body).send().await?;
+    let res = client(uri)?.post(uri).headers(headers).body(body).send().await?;
     process_opt_json_response(res).await
 }
 
 /// Performs a POST with no data to the given URI and expects and empty 200 OK response.
 pub async fn post_empty(uri: &str, token: Option<&Token>) -> Result<(), Error> {
     if env::var(KRILL_CLI_API_ENV).is_ok() {
-        report_post_and_exit(uri, None, token, PostBody::String(&"<empty>".to_string()));
+        report_post_and_exit(uri, None, token, "<empty>");
     }
 
     let headers = headers(Some(JSON_CONTENT), token)?;
-    let res = client(uri).await?.post(uri).headers(headers).send().await?;
+    let res = client(uri)?.post(uri).headers(headers).send().await?;
     if let Some(res) = opt_text_response(res).await? {
         Err(Error::UnexpectedResponse(res))
     } else {
@@ -192,15 +175,18 @@ pub async fn post_empty(uri: &str, token: Option<&Token>) -> Result<(), Error> {
 /// empty.
 pub async fn post_binary_with_full_ua(uri: &str, data: &Bytes, content_type: &str) -> Result<Bytes, Error> {
     let body = data.to_vec();
-    if env::var(KRILL_CLI_API_ENV).is_ok() {
-        report_post_and_exit(uri, None, None, PostBody::Bytes(&body));
-    }
 
     let mut headers = HeaderMap::new();
     headers.insert(USER_AGENT, HeaderValue::from_str(&format!("krill/{}", KRILL_VERSION))?);
     headers.insert(CONTENT_TYPE, HeaderValue::from_str(content_type)?);
 
-    let res = client(uri).await?.post(uri).headers(headers).body(body).send().await?;
+    let client = reqwest::ClientBuilder::new()
+        .timeout(Duration::from_secs(HTTP_CLIENT_TIMEOUT_SECS))
+        .danger_accept_invalid_certs(true)
+        .build()
+        .map_err(Error::RequestError)?;
+
+    let res = client.post(uri).headers(headers).body(body).send().await?;
 
     match res.status() {
         StatusCode::OK => {
@@ -216,7 +202,7 @@ pub async fn delete(uri: &str, token: Option<&Token>) -> Result<(), Error> {
     report_delete(uri, None, token);
 
     let headers = headers(None, token)?;
-    let res = client(uri).await?.delete(uri).headers(headers).send().await?;
+    let res = client(uri)?.delete(uri).headers(headers).send().await?;
 
     match res.status() {
         StatusCode::OK => Ok(()),
@@ -230,7 +216,7 @@ fn load_root_cert(path: &str) -> Result<reqwest::Certificate, Error> {
     reqwest::Certificate::from_pem(file.as_ref()).map_err(Error::https_root_cert_error)
 }
 
-pub async fn client(uri: &str) -> Result<reqwest::Client, Error> {
+pub fn client(uri: &str) -> Result<reqwest::Client, Error> {
     let mut builder = reqwest::ClientBuilder::new().timeout(Duration::from_secs(HTTP_CLIENT_TIMEOUT_SECS));
 
     if let Ok(cert_list) = env::var(KRILL_HTTPS_ROOT_CERTS_ENV) {

src/daemon/krillserver.rs

@@ -494,7 +494,9 @@ impl KrillServer {
                 let bgp_report = if ca.handle().as_str() == "ta" || ca.handle().as_str() == "testbed" {
                     BgpAnalysisReport::new(vec![])
                 } else {
-                    self.bgp_analyser.analyse(roas.as_slice(), &ca.all_resources(), None).await
+                    self.bgp_analyser
+                        .analyse(roas.as_slice(), &ca.all_resources(), None)
+                        .await
                 };
 
                 res.insert(
@@ -681,7 +683,10 @@ impl KrillServer {
         let ca = self.ca_manager.get_ca(handle).await?;
         let definitions = ca.roa_definitions();
         let resources_held = ca.all_resources();
-        Ok(self.bgp_analyser.analyse(definitions.as_slice(), &resources_held, None).await)
+        Ok(self
+            .bgp_analyser
+            .analyse(definitions.as_slice(), &resources_held, None)
+            .await)
     }
 
     pub async fn ca_routes_bgp_dry_run(
@@ -715,7 +720,10 @@ impl KrillServer {
         let definitions = ca.roa_definitions();
         let resources_held = ca.all_resources();
 
-        Ok(self.bgp_analyser.suggest(definitions.as_slice(), &resources_held, limit).await)
+        Ok(self
+            .bgp_analyser
+            .suggest(definitions.as_slice(), &resources_held, limit)
+            .await)
     }
 }
 

src/test.rs

@@ -13,18 +13,20 @@ use bytes::Bytes;
 use hyper::StatusCode;
 use tokio::time::{sleep, timeout};
 
-use rpki::{
-    repository::crypto::KeyIdentifier,
-    uri,
-};
+use rpki::{repository::crypto::KeyIdentifier, uri};
 
 use crate::{
+    cli::{
+        options::{BulkCaCommand, CaCommand, Command, Options, PubServerCommand},
+        report::{ApiResponse, ReportFormat},
+        {Error, KrillClient},
+    },
     commons::{
         api::{
-            AddChildRequest, CertAuthInfo, CertAuthInit, CertifiedKeyInfo, ChildHandle, Handle, ParentCaContact, ParentCaReq,
-            ParentHandle, ParentStatuses, PublicationServerUris, PublisherDetails, PublisherHandle, PublisherList,
-            ResourceClassName, ResourceSet, RoaDefinition, RoaDefinitionUpdates, RtaList, RtaName, RtaPrepResponse,
-            TypedPrefix, UpdateChildRequest, RepositoryContact,
+            AddChildRequest, CertAuthInfo, CertAuthInit, CertifiedKeyInfo, ChildHandle, Handle, ParentCaContact,
+            ParentCaReq, ParentHandle, ParentStatuses, PublicationServerUris, PublisherDetails, PublisherHandle,
+            PublisherList, RepositoryContact, ResourceClassName, ResourceSet, RoaDefinition, RoaDefinitionUpdates,
+            RtaList, RtaName, RtaPrepResponse, TypedPrefix, UpdateChildRequest,
         },
         bgp::{Announcement, BgpAnalysisReport, BgpAnalysisSuggestion},
         crypto::SignSupport,
@@ -32,11 +34,6 @@ use crate::{
         remote::rfc8183::{ChildRequest, RepositoryResponse},
         util::httpclient,
     },
-    cli::{
-        {Error, KrillClient},
-        options::{BulkCaCommand, CaCommand, Command, Options, PubServerCommand},
-        report::{ApiResponse, ReportFormat},
-    },
     daemon::{
         ca::{ta_handle, ResourceTaggedAttestation, RtaContentRequest, RtaPrepareRequest},
         http::server,
@@ -72,7 +69,7 @@ pub async fn server_ready(uri: &str) -> bool {
     let health = format!("{}health", uri);
 
     for _ in 0..300 {
-        match httpclient::client(&health).await {
+        match httpclient::client(&health) {
             Ok(client) => {
                 let res = timeout(Duration::from_millis(100), client.get(&health).send()).await;