fix: OpenSSL and prepare for more SSL libs (#47)

Signed-off-by: Jeremy HERGAULT <jeremy@hergault.fr>

Author: reneca

.github/workflows/ci.yml

@@ -87,6 +87,6 @@ jobs:
         with:
           components: llvm-tools, rustc-dev
       - run: >
-          cargo test --all-features --release
-          --tests --verbose --color always
+          cargo test --release --tests
+          --verbose --color always
           --workspace --no-fail-fast

Cargo.toml

@@ -22,7 +22,7 @@ include = [
 ]
 
 [workspace.dependencies]
-prosa-utils = { version = "0.3.0", path = "prosa_utils" }
+prosa-utils = { version = "0.3.0", path = "prosa_utils", default-features = false }
 prosa-macros = { version = "0.3.0", path = "prosa_macros" }
 thiserror = "2"
 aquamarine = "0.6"
@@ -46,6 +46,9 @@ prometheus = { version = "0.14" }
 opentelemetry-prometheus = { version = "0.29" }
 opentelemetry-appender-log = "0.29"
 
+# Config SSL
+openssl = { version = "0.10" }
+
 # Web
 hyper = { version = "1", features = ["server", "http1", "http2"] }
 http-body-util = "0.1"

cargo-prosa/Cargo.toml

@@ -15,7 +15,6 @@ path = "src/main.rs"
 
 [dependencies]
 thiserror.workspace = true
-prosa-utils = { workspace = true, features = ["msg", "config", "config-observability"] }
 aquamarine.workspace = true
 clap = "4"
 clap_complete = "4"

prosa/Cargo.toml

@@ -10,8 +10,10 @@ license.workspace = true
 include.workspace = true
 
 [features]
-default = ["http-proxy"]
+default = ["http-proxy", "openssl"]
 http-proxy = ["dep:async-http-proxy"]
+openssl = ["dep:openssl", "dep:tokio-openssl", "prosa-utils/config-openssl"]
+openssl-vendored = ["openssl", "openssl/vendored", "prosa-utils/config-openssl-vendored"]
 
 [[example]]
 name = "proc"
@@ -35,7 +37,7 @@ settings = "stub::proc::StubSettings"
 adaptor = ["stub::adaptor::StubParotAdaptor"]
 
 [dependencies]
-prosa-utils = { workspace = true, features = ["msg", "config", "config-observability"] }
+prosa-utils = { workspace = true, features = ["msg", "config", "config-observability", "config-observability-prometheus"] }
 prosa-macros.workspace = true
 bytes.workspace = true
 tracing = "0.1"
@@ -46,9 +48,9 @@ rlimit = "0.10"
 
 aquamarine.workspace = true
 
-openssl = { version = "0.10" }
+openssl = { workspace = true, optional = true }
 tokio.workspace = true
-tokio-openssl = "0.6"
+tokio-openssl = { version = "0.6", optional = true }
 async-http-proxy = { version = "1", optional = true, features = ["runtime-tokio","basic-auth"] }
 
 serde = { version = "1", features = ["derive"] }

prosa/src/core/error.rs

@@ -54,6 +54,7 @@ impl ProcError for std::io::Error {
     }
 }
 
+#[cfg(feature = "openssl")]
 impl ProcError for openssl::error::Error {
     fn recoverable(&self) -> bool {
         if let Some(reason) = self.reason() {
@@ -65,6 +66,7 @@ impl ProcError for openssl::error::Error {
     }
 }
 
+#[cfg(feature = "openssl")]
 impl ProcError for openssl::error::ErrorStack {
     fn recoverable(&self) -> bool {
         for error in self.errors() {

prosa/src/io.rs

@@ -143,14 +143,13 @@ impl From<tokio::net::unix::SocketAddr> for SocketAddr {
 mod tests {
     use futures_util::future;
     use listener::{ListenerSetting, StreamListener};
-    use openssl::ssl::SslVerifyMode;
-    use prosa_utils::config::ssl::{SslConfig, Store};
+
+    #[cfg(feature = "openssl")]
+    use prosa_utils::config::ssl::{SslConfig, SslConfigContext as _, Store};
+
     use std::{env, os::fd::AsRawFd as _};
     use stream::{Stream, TargetSetting};
-    use tokio::{
-        fs::File,
-        io::{AsyncReadExt as _, AsyncWriteExt},
-    };
+    use tokio::io::{AsyncReadExt as _, AsyncWriteExt};
 
     use super::*;
 
@@ -198,7 +197,7 @@ mod tests {
 
             stream.write_all(b"ProSA").await.unwrap();
 
-            let mut buf = vec![];
+            let mut buf = Vec::new();
             stream.read_to_end(&mut buf).await.unwrap();
             assert_eq!(buf, b"Worldline");
 
@@ -253,7 +252,7 @@ mod tests {
 
             stream.write_all(b"ProSA").await.unwrap();
 
-            let mut buf = vec![];
+            let mut buf = Vec::new();
             stream.read_to_end(&mut buf).await.unwrap();
             assert_eq!(buf, b"Worldline");
 
@@ -263,20 +262,29 @@ mod tests {
         future::join(server, client).await;
     }
 
+    #[cfg(feature = "openssl")]
     #[tokio::test]
-    async fn ssl_client_server() {
+    async fn openssl_client_server() {
         let addr = "localhost:41443";
         let addr_url = Url::parse(format!("tls://{addr}").as_str()).unwrap();
-
-        let ssl_config = SslConfig::default();
-        let ssl_acceptor = ssl_config
-            .init_tls_server_context(addr_url.host_str())
+        let cert_path = env::temp_dir()
+            .join("test_openssl_client_server.pem")
+            .to_str()
             .unwrap()
-            .build();
-        let listener = StreamListener::bind(addr)
-            .await
-            .unwrap()
-            .ssl_acceptor(ssl_acceptor, Some(ssl_config.get_ssl_timeout()));
+            .to_string();
+
+        let mut ssl_config = SslConfig::new_self_cert(cert_path.clone());
+        let listener = {
+            let ssl_acceptor_builder: ::openssl::ssl::SslAcceptorBuilder = ssl_config
+                .init_tls_server_context(addr_url.host_str())
+                .unwrap();
+            let ssl_acceptor = ssl_acceptor_builder.build();
+            StreamListener::bind(addr)
+                .await
+                .unwrap()
+                .ssl_acceptor(ssl_acceptor, Some(ssl_config.get_ssl_timeout()))
+        };
+
         assert!(listener.as_raw_fd() > 0);
         assert!(
             format!("{listener:?}").contains("Ssl"),
@@ -297,15 +305,21 @@ mod tests {
             assert_eq!(&buf, b"ProSA");
 
             client_stream.write_all(b"Worldline").await.unwrap();
+
+            let _ = client_stream.shutdown().await;
         };
 
+        ssl_config.set_store(Store::File { path: cert_path });
         let client = async {
-            let mut ssl_client_context = ssl_config.init_tls_client_context().unwrap();
-            ssl_client_context.set_verify(SslVerifyMode::NONE);
+            let mut stream = {
+                let ssl_client_context: ::openssl::ssl::SslConnectorBuilder =
+                    ssl_config.init_tls_client_context().unwrap();
+
+                Stream::connect_openssl(&addr_url, &ssl_client_context.build())
+                    .await
+                    .unwrap()
+            };
 
-            let mut stream = Stream::connect_ssl(&addr_url, &ssl_client_context.build())
-                .await
-                .unwrap();
             assert!(stream.as_raw_fd() > 0);
             assert!(
                 format!("{stream:?}").contains("Ssl"),
@@ -315,7 +329,7 @@ mod tests {
 
             stream.write_all(b"ProSA").await.unwrap();
 
-            let mut buf = vec![];
+            let mut buf = Vec::new();
             stream.read_to_end(&mut buf).await.unwrap();
             assert_eq!(buf, b"Worldline");
 
@@ -325,20 +339,29 @@ mod tests {
         future::join(server, client).await;
     }
 
+    #[cfg(feature = "openssl")]
     #[tokio::test]
-    async fn ssl_client_server_raw() {
+    async fn openssl_client_server_raw() {
         let addr = "localhost:41453";
         let addr_url = Url::parse(format!("tls://{addr}").as_str()).unwrap();
-
-        let ssl_config = SslConfig::default();
-        let ssl_acceptor = ssl_config
-            .init_tls_server_context(addr_url.host_str())
+        let cert_path = env::temp_dir()
+            .join("test_openssl_client_server_raw.pem")
+            .to_str()
             .unwrap()
-            .build();
-        let listener = StreamListener::bind(addr)
-            .await
-            .unwrap()
-            .ssl_acceptor(ssl_acceptor, Some(ssl_config.get_ssl_timeout()));
+            .to_string();
+
+        let mut ssl_config = SslConfig::new_self_cert(cert_path.clone());
+        let listener = {
+            let ssl_acceptor_builder: ::openssl::ssl::SslAcceptorBuilder = ssl_config
+                .init_tls_server_context(addr_url.host_str())
+                .unwrap();
+            let ssl_acceptor = ssl_acceptor_builder.build();
+            StreamListener::bind(addr)
+                .await
+                .unwrap()
+                .ssl_acceptor(ssl_acceptor, Some(ssl_config.get_ssl_timeout()))
+        };
+
         assert!(listener.as_raw_fd() > 0);
         assert!(
             format!("{listener:?}").contains("Ssl"),
@@ -360,15 +383,21 @@ mod tests {
             assert_eq!(&buf, b"ProSA");
 
             client_stream.write_all(b"Worldline").await.unwrap();
+
+            let _ = client_stream.shutdown().await;
         };
 
+        ssl_config.set_store(Store::File { path: cert_path });
         let client = async {
-            let mut ssl_client_context = ssl_config.init_tls_client_context().unwrap();
-            ssl_client_context.set_verify(SslVerifyMode::NONE);
+            let mut stream = {
+                let ssl_client_context: ::openssl::ssl::SslConnectorBuilder =
+                    ssl_config.init_tls_client_context().unwrap();
+
+                Stream::connect_openssl(&addr_url, &ssl_client_context.build())
+                    .await
+                    .unwrap()
+            };
 
-            let mut stream = Stream::connect_ssl(&addr_url, &ssl_client_context.build())
-                .await
-                .unwrap();
             assert!(stream.as_raw_fd() > 0);
             assert!(
                 format!("{stream:?}").contains("Ssl"),
@@ -378,7 +407,7 @@ mod tests {
 
             stream.write_all(b"ProSA").await.unwrap();
 
-            let mut buf = vec![];
+            let mut buf = Vec::new();
             stream.read_to_end(&mut buf).await.unwrap();
             assert_eq!(buf, b"Worldline");
 
@@ -388,13 +417,18 @@ mod tests {
         future::join(server, client).await;
     }
 
+    #[cfg(feature = "openssl")]
     #[tokio::test]
     async fn ssl_client_server_with_config() {
-        let temp_cert_dir = env::temp_dir();
         let addr_str = "tls://localhost:41463";
         let addr = Url::parse(addr_str).unwrap();
+        let cert_path = env::temp_dir()
+            .join("test_ssl_client_server_with_config.pem")
+            .to_str()
+            .unwrap()
+            .to_string();
 
-        let mut server_ssl_config = SslConfig::default();
+        let mut server_ssl_config = SslConfig::new_self_cert(cert_path.clone());
         server_ssl_config.set_alpn(vec!["prosa/1".into(), "h2".into()]);
 
         let listener_settings = ListenerSetting::new(addr.clone(), Some(server_ssl_config));
@@ -411,16 +445,6 @@ mod tests {
         assert!(listener_settings.to_string().starts_with(addr_str));
 
         let listener = listener_settings.bind().await.unwrap();
-        if let StreamListener::Ssl(_, acceptor, _) = &listener {
-            let server_cert = acceptor.context().certificate().unwrap();
-            let mut server_cert_file = File::create(temp_cert_dir.join("prosa_test_server.pem"))
-                .await
-                .unwrap();
-            server_cert_file
-                .write_all(&server_cert.to_pem().unwrap())
-                .await
-                .unwrap();
-        }
         assert!(listener.as_raw_fd() > 0);
         assert!(
             format!("{listener:?}").contains("Ssl"),
@@ -443,36 +467,32 @@ mod tests {
             client_stream = listener.handshake(client_stream).await.unwrap();
 
             client_stream.write_all(b"Worldline").await.unwrap();
+
+            let _ = client_stream.shutdown().await;
         };
 
         let mut client_ssl_config = SslConfig::default();
         client_ssl_config.set_alpn(vec!["http/1.1".into(), "prosa/1".into()]);
-        let ssl_store = Store::File {
-            path: temp_cert_dir.to_str().unwrap().to_string(),
-        };
-        client_ssl_config.set_store(ssl_store);
+        client_ssl_config.set_store(Store::File { path: cert_path });
         let target_settings = TargetSetting::new(addr, Some(client_ssl_config), None);
         assert_eq!(addr_str, target_settings.to_string());
 
         let client = async {
             let mut stream = target_settings.connect().await.unwrap();
             assert!(stream.as_raw_fd() > 0);
             assert!(
-                format!("{stream:?}").contains("Ssl"),
-                "stream `{stream:?}` don't contain Ssl"
+                format!("{stream:?}").contains("Ssl") || format!("{stream:?}").contains("Tls"),
+                "stream `{stream:?}` don't contain Ssl or Tls"
             );
-            if let Stream::Ssl(s) = &stream {
-                assert_eq!(
-                    Some(b"prosa/1".as_slice()),
-                    s.ssl().selected_alpn_protocol()
-                );
+            if stream.is_ssl() {
+                assert!(stream.selected_alpn_check(|alpn| { alpn == b"prosa/1".as_slice() }));
             } else {
                 panic!("Should be an SSL stream for client");
             }
 
             stream.write_all(b"ProSA").await.unwrap();
 
-            let mut buf = vec![];
+            let mut buf = Vec::new();
             stream.read_to_end(&mut buf).await.unwrap();
             assert_eq!(buf, b"Worldline");
 
@@ -481,4 +501,23 @@ mod tests {
 
         future::join(server, client).await;
     }
+
+    #[cfg(all(feature = "openssl", not(feature = "openssl-vendored")))]
+    #[tokio::test]
+    async fn ssl_client_public_with_config() {
+        let addr_str = "https://worldline.com/";
+        let addr = Url::parse(addr_str).unwrap();
+
+        let target_settings = TargetSetting::new(addr, Some(SslConfig::default()), None);
+        assert_eq!(addr_str, target_settings.to_string());
+
+        let mut stream = target_settings.connect().await.unwrap();
+        assert!(stream.as_raw_fd() > 0);
+        assert!(
+            format!("{stream:?}").contains("Ssl") || format!("{stream:?}").contains("Tls"),
+            "stream `{stream:?}` don't contain Ssl or Tls"
+        );
+
+        let _ = stream.shutdown().await;
+    }
 }