From 4daf0daea3173f0ab2ef8231b00f6ec7cd570ea9 Mon Sep 17 00:00:00 2001 From: Tim Bruijnzeels Date: Tue, 10 Aug 2021 16:00:52 +0200 Subject: [PATCH] Accept insecure certs when submitting protocol CMS (#628, #629) Includes minor code cleanup: - remove unnecessary async - do not try to print protocol CMS (not accessible throug CLI and we have logging) --- src/commons/util/httpclient.rs | 52 +++++++++++++--------------------- src/daemon/krillserver.rs | 14 +++++++-- src/test.rs | 25 +++++++--------- 3 files changed, 41 insertions(+), 50 deletions(-) diff --git a/src/commons/util/httpclient.rs b/src/commons/util/httpclient.rs index 74e292a7..e6049960 100644 --- a/src/commons/util/httpclient.rs +++ b/src/commons/util/httpclient.rs @@ -24,24 +24,7 @@ fn report_get_and_exit(uri: &str, token: Option<&Token>) { std::process::exit(0); } -enum PostBody<'a> { - String(&'a String), - Bytes(&'a Vec), -} - -impl<'a> fmt::Display for PostBody<'a> { - fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result { - match self { - PostBody::String(string) => write!(f, "{}", string), - PostBody::Bytes(bytes) => { - let base64 = base64::encode(bytes); - write!(f, " {}", base64) - } - } - } -} - -fn report_post_and_exit(uri: &str, content_type: Option<&str>, token: Option<&Token>, body: PostBody) { +fn report_post_and_exit(uri: &str, content_type: Option<&str>, token: Option<&Token>, body: &str) { println!("POST:\n {}", uri); if content_type.is_some() || token.is_some() { @@ -85,7 +68,7 @@ pub async fn get_json(uri: &str, token: Option<&Token>) -> let headers = headers(Some(JSON_CONTENT), token)?; - let res = client(uri).await?.get(uri).headers(headers).send().await?; + let res = client(uri)?.get(uri).headers(headers).send().await?; process_json_response(res).await } @@ -97,7 +80,7 @@ pub async fn get_text(uri: &str, token: Option<&Token>) -> Result } let headers = headers(None, token)?; - let res = client(uri).await?.get(uri).headers(headers).send().await?; + let res = client(uri)?.get(uri).headers(headers).send().await?; match opt_text_response(res).await? { Some(res) => Ok(res), None => Err(Error::EmptyResponse), @@ -112,7 +95,7 @@ pub async fn get_ok(uri: &str, token: Option<&Token>) -> Result<(), Error> { } let headers = headers(None, token)?; - let res = client(uri).await?.get(uri).headers(headers).send().await?; + let res = client(uri)?.get(uri).headers(headers).send().await?; opt_text_response(res).await?; // Will return nice errors with possible body. Ok(()) } @@ -122,13 +105,13 @@ pub async fn get_ok(uri: &str, token: Option<&Token>) -> Result<(), Error> { pub async fn post_json(uri: &str, data: impl Serialize, token: Option<&Token>) -> Result<(), Error> { if env::var(KRILL_CLI_API_ENV).is_ok() { let body = serde_json::to_string_pretty(&data)?; - report_post_and_exit(uri, Some(JSON_CONTENT), token, PostBody::String(&body)); + report_post_and_exit(uri, Some(JSON_CONTENT), token, &body); } let body = serde_json::to_string(&data)?; let headers = headers(Some(JSON_CONTENT), token)?; - let res = client(uri).await?.post(uri).headers(headers).body(body).send().await?; + let res = client(uri)?.post(uri).headers(headers).body(body).send().await?; if let Some(res) = opt_text_response(res).await? { Err(Error::UnexpectedResponse(res)) } else { @@ -160,23 +143,23 @@ pub async fn post_json_with_opt_response( ) -> Result, Error> { if env::var(KRILL_CLI_API_ENV).is_ok() { let body = serde_json::to_string_pretty(&data)?; - report_post_and_exit(uri, Some(JSON_CONTENT), token, PostBody::String(&body)); + report_post_and_exit(uri, Some(JSON_CONTENT), token, &body); } let body = serde_json::to_string(&data)?; let headers = headers(Some(JSON_CONTENT), token)?; - let res = client(uri).await?.post(uri).headers(headers).body(body).send().await?; + let res = client(uri)?.post(uri).headers(headers).body(body).send().await?; process_opt_json_response(res).await } /// Performs a POST with no data to the given URI and expects and empty 200 OK response. pub async fn post_empty(uri: &str, token: Option<&Token>) -> Result<(), Error> { if env::var(KRILL_CLI_API_ENV).is_ok() { - report_post_and_exit(uri, None, token, PostBody::String(&"".to_string())); + report_post_and_exit(uri, None, token, ""); } let headers = headers(Some(JSON_CONTENT), token)?; - let res = client(uri).await?.post(uri).headers(headers).send().await?; + let res = client(uri)?.post(uri).headers(headers).send().await?; if let Some(res) = opt_text_response(res).await? { Err(Error::UnexpectedResponse(res)) } else { @@ -192,15 +175,18 @@ pub async fn post_empty(uri: &str, token: Option<&Token>) -> Result<(), Error> { /// empty. pub async fn post_binary_with_full_ua(uri: &str, data: &Bytes, content_type: &str) -> Result { let body = data.to_vec(); - if env::var(KRILL_CLI_API_ENV).is_ok() { - report_post_and_exit(uri, None, None, PostBody::Bytes(&body)); - } let mut headers = HeaderMap::new(); headers.insert(USER_AGENT, HeaderValue::from_str(&format!("krill/{}", KRILL_VERSION))?); headers.insert(CONTENT_TYPE, HeaderValue::from_str(content_type)?); - let res = client(uri).await?.post(uri).headers(headers).body(body).send().await?; + let client = reqwest::ClientBuilder::new() + .timeout(Duration::from_secs(HTTP_CLIENT_TIMEOUT_SECS)) + .danger_accept_invalid_certs(true) + .build() + .map_err(Error::RequestError)?; + + let res = client.post(uri).headers(headers).body(body).send().await?; match res.status() { StatusCode::OK => { @@ -216,7 +202,7 @@ pub async fn delete(uri: &str, token: Option<&Token>) -> Result<(), Error> { report_delete(uri, None, token); let headers = headers(None, token)?; - let res = client(uri).await?.delete(uri).headers(headers).send().await?; + let res = client(uri)?.delete(uri).headers(headers).send().await?; match res.status() { StatusCode::OK => Ok(()), @@ -230,7 +216,7 @@ fn load_root_cert(path: &str) -> Result { reqwest::Certificate::from_pem(file.as_ref()).map_err(Error::https_root_cert_error) } -pub async fn client(uri: &str) -> Result { +pub fn client(uri: &str) -> Result { let mut builder = reqwest::ClientBuilder::new().timeout(Duration::from_secs(HTTP_CLIENT_TIMEOUT_SECS)); if let Ok(cert_list) = env::var(KRILL_HTTPS_ROOT_CERTS_ENV) { diff --git a/src/daemon/krillserver.rs b/src/daemon/krillserver.rs index 92db5c44..70c35e02 100644 --- a/src/daemon/krillserver.rs +++ b/src/daemon/krillserver.rs @@ -494,7 +494,9 @@ impl KrillServer { let bgp_report = if ca.handle().as_str() == "ta" || ca.handle().as_str() == "testbed" { BgpAnalysisReport::new(vec![]) } else { - self.bgp_analyser.analyse(roas.as_slice(), &ca.all_resources(), None).await + self.bgp_analyser + .analyse(roas.as_slice(), &ca.all_resources(), None) + .await }; res.insert( @@ -681,7 +683,10 @@ impl KrillServer { let ca = self.ca_manager.get_ca(handle).await?; let definitions = ca.roa_definitions(); let resources_held = ca.all_resources(); - Ok(self.bgp_analyser.analyse(definitions.as_slice(), &resources_held, None).await) + Ok(self + .bgp_analyser + .analyse(definitions.as_slice(), &resources_held, None) + .await) } pub async fn ca_routes_bgp_dry_run( @@ -715,7 +720,10 @@ impl KrillServer { let definitions = ca.roa_definitions(); let resources_held = ca.all_resources(); - Ok(self.bgp_analyser.suggest(definitions.as_slice(), &resources_held, limit).await) + Ok(self + .bgp_analyser + .suggest(definitions.as_slice(), &resources_held, limit) + .await) } } diff --git a/src/test.rs b/src/test.rs index b192967c..b1e3d57c 100644 --- a/src/test.rs +++ b/src/test.rs @@ -13,18 +13,20 @@ use bytes::Bytes; use hyper::StatusCode; use tokio::time::{sleep, timeout}; -use rpki::{ - repository::crypto::KeyIdentifier, - uri, -}; +use rpki::{repository::crypto::KeyIdentifier, uri}; use crate::{ + cli::{ + options::{BulkCaCommand, CaCommand, Command, Options, PubServerCommand}, + report::{ApiResponse, ReportFormat}, + {Error, KrillClient}, + }, commons::{ api::{ - AddChildRequest, CertAuthInfo, CertAuthInit, CertifiedKeyInfo, ChildHandle, Handle, ParentCaContact, ParentCaReq, - ParentHandle, ParentStatuses, PublicationServerUris, PublisherDetails, PublisherHandle, PublisherList, - ResourceClassName, ResourceSet, RoaDefinition, RoaDefinitionUpdates, RtaList, RtaName, RtaPrepResponse, - TypedPrefix, UpdateChildRequest, RepositoryContact, + AddChildRequest, CertAuthInfo, CertAuthInit, CertifiedKeyInfo, ChildHandle, Handle, ParentCaContact, + ParentCaReq, ParentHandle, ParentStatuses, PublicationServerUris, PublisherDetails, PublisherHandle, + PublisherList, RepositoryContact, ResourceClassName, ResourceSet, RoaDefinition, RoaDefinitionUpdates, + RtaList, RtaName, RtaPrepResponse, TypedPrefix, UpdateChildRequest, }, bgp::{Announcement, BgpAnalysisReport, BgpAnalysisSuggestion}, crypto::SignSupport, @@ -32,11 +34,6 @@ use crate::{ remote::rfc8183::{ChildRequest, RepositoryResponse}, util::httpclient, }, - cli::{ - {Error, KrillClient}, - options::{BulkCaCommand, CaCommand, Command, Options, PubServerCommand}, - report::{ApiResponse, ReportFormat}, - }, daemon::{ ca::{ta_handle, ResourceTaggedAttestation, RtaContentRequest, RtaPrepareRequest}, http::server, @@ -72,7 +69,7 @@ pub async fn server_ready(uri: &str) -> bool { let health = format!("{}health", uri); for _ in 0..300 { - match httpclient::client(&health).await { + match httpclient::client(&health) { Ok(client) => { let res = timeout(Duration::from_millis(100), client.get(&health).send()).await;