Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cfsignal: add proxy support #234

Merged
merged 1 commit into from
Nov 4, 2024
Merged

cfsignal: add proxy support #234

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions packages/os/cfsignal.service
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ ConditionPathExists=!/var/lib/bottlerocket/cfsignal.ran

[Service]
Type=simple
EnvironmentFile=/etc/network/proxy.env
ExecStart=/usr/bin/cfsignal

[Install]
Expand Down
12 changes: 6 additions & 6 deletions sources/cfsignal/Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,19 +11,19 @@ exclude = ["README.md"]
fips = ["rustls/fips", "aws-lc-rs/fips", "aws-smithy-experimental/crypto-aws-lc-fips"]

[dependencies]
log.workspace = true
serde = { workspace = true, features = ["derive"] }
simplelog.workspace = true
snafu.workspace = true
toml.workspace = true
tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
aws-config.workspace = true
aws-lc-rs = { workspace = true, features = ["bindgen"] }
aws-sdk-cloudformation.workspace = true
aws-smithy-experimental = { workspace = true, features = ["crypto-aws-lc"] }
aws-types.workspace = true
imdsclient.workspace = true
log.workspace = true
rustls.workspace = true
serde = { workspace = true, features = ["derive"] }
simplelog.workspace = true
snafu.workspace = true
tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
toml.workspace = true

[build-dependencies]
generate-readme.workspace = true
33 changes: 26 additions & 7 deletions sources/cfsignal/src/cloudformation.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,13 @@
use aws_config::BehaviorVersion;
use std::str::FromStr;

use crate::error::{self, Result};

use aws_config::BehaviorVersion;
use aws_smithy_experimental::hyper_1_0::{CryptoMode, HyperClientBuilder};
use aws_types::region::Region;
use imdsclient::ImdsClient;
use log::info;
use snafu::{OptionExt, ResultExt};
use std::env;
use std::str::FromStr;

/// Signals Cloudformation stack resource
pub async fn signal_resource(
Expand All @@ -29,15 +30,33 @@ pub async fn signal_resource(
.load()
.await;

// TODO: add support for HTTP Proxy
#[cfg(feature = "fips")]
let crypto_mode = CryptoMode::AwsLcFips;
#[cfg(not(feature = "fips"))]
let crypto_mode = CryptoMode::AwsLc;

let http_client = HyperClientBuilder::new()
.crypto_mode(crypto_mode)
.build_https();
let https_proxy: Option<String> = match env::var_os("HTTPS_PROXY") {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

style nit: match statements like this are more idiomatically written using Option::map.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
let https_proxy: Option<String> = match env::var_os("HTTPS_PROXY") {
let https_proxy = env::var("HTTPS_PROXY").ok();
let no_proxy = env::var("NO_PROXY")
.ok()
.map(|n| n.split(',').map(|s| s.to_string()).collect::<Vec<_>>());

So in practice like this. It does look clean, but since we already have approvals I think we can save it for next time we're in the crate or if clippy flags it.

Some(https_proxy) => https_proxy.to_str().map(|h| h.to_string()),
_ => None,
};

let no_proxy: Option<Vec<String>> = match env::var_os("NO_PROXY") {
Some(no_proxy) => no_proxy
.to_str()
.map(|n| n.split(',').map(|s| s.to_string()).collect()),
_ => None,
};

let http_client = if let Some(https_proxy) = https_proxy {
let no_proxy = no_proxy.as_deref();
HyperClientBuilder::new()
.crypto_mode(crypto_mode)
.build_with_proxy(https_proxy, no_proxy)
} else {
HyperClientBuilder::new()
.crypto_mode(crypto_mode)
.build_https()
};

let cloudformation_config = aws_sdk_cloudformation::config::Builder::from(&config)
.http_client(http_client)
Expand Down