Skip to content

Commit d4fda55

Browse files
risssonrissson
committed
packages/ak-common/tls: init (#21262)
Squashed commit of the following: commit e1e6316 Merge: dec4bcd 095d38c Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Wed Apr 1 17:13:10 2026 +0200 Merge branch 'rust-config' into rust-lib-tls Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> commit 095d38c Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Wed Apr 1 17:11:52 2026 +0200 fixup Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> commit 7eb07d5 Merge: cb1f86b 507eb2f Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Wed Apr 1 17:11:08 2026 +0200 Merge branch 'rust-arbiter' into rust-config commit 507eb2f Merge: 6968d59 0079984 Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Wed Apr 1 17:10:37 2026 +0200 Merge branch 'rust-lib-rename' into rust-arbiter Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> commit 0079984 Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Wed Apr 1 17:08:07 2026 +0200 packages/ak-common: rename from ak-lib Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> commit dec4bcd Merge: b84b263 a3fea5d Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Wed Apr 1 16:54:07 2026 +0200 Merge branch 'fix-rustfmt-config' into rust-lib-tls commit cb1f86b Merge: c8fa1b8 a3fea5d Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Wed Apr 1 16:53:19 2026 +0200 Merge branch 'fix-rustfmt-config' into rust-config commit 6968d59 Merge: 341c9cc a3fea5d Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Wed Apr 1 16:52:55 2026 +0200 Merge branch 'fix-rustfmt-config' into rust-arbiter commit a3fea5d Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Wed Apr 1 16:32:16 2026 +0200 root: fix rustfmt config Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> commit b84b263 Merge: 09d3b7d c8fa1b8 Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Tue Mar 31 13:56:53 2026 +0200 Merge branch 'rust-config' into rust-lib-tls commit c8fa1b8 Merge: 48c833c 341c9cc Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Tue Mar 31 13:56:39 2026 +0200 Merge branch 'rust-arbiter' into rust-config commit 341c9cc Merge: a1cf0a7 55e555c Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Tue Mar 31 13:55:28 2026 +0200 Merge branch 'main' into rust-arbiter Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> commit 09d3b7d Merge: 73c449c 48c833c Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Mon Mar 30 20:31:11 2026 +0200 Merge branch 'rust-config' into rust-lib-tls commit 48c833c Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Mon Mar 30 20:31:04 2026 +0200 lint Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> commit 73c449c Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Mon Mar 30 20:28:30 2026 +0200 packages/ak-lib/tls: init Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> commit 681117d Merge: 4c54511 a1cf0a7 Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Mon Mar 30 20:03:49 2026 +0200 Merge branch 'rust-arbiter' into rust-config Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> commit a1cf0a7 Merge: 1ee6f11 524b788 Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Mon Mar 30 20:03:01 2026 +0200 Merge branch 'rust-lib' into rust-arbiter Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> commit 524b788 Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Mon Mar 30 19:57:51 2026 +0200 fixup Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> commit dc65ab1 Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Mon Mar 30 16:33:49 2026 +0200 packages/ak-lib: init Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> commit 4c54511 Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Mon Mar 30 19:52:55 2026 +0200 move into lib crate Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> commit d7141df Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Mon Mar 30 19:48:34 2026 +0200 fixup Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> commit 2bab7ed Merge: 2bc79f1 1ee6f11 Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Mon Mar 30 19:43:24 2026 +0200 Merge branch 'rust-arbiter' into rust-config commit 1ee6f11 Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Mon Mar 30 19:43:21 2026 +0200 fixup Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> commit 2bc79f1 Merge: e7d3704 27ff039 Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Mon Mar 30 19:42:58 2026 +0200 Merge branch 'rust-arbiter' into rust-config Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> commit 27ff039 Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Mon Mar 30 19:40:37 2026 +0200 rename to ak-lib Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> commit e7d3704 Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Mon Mar 30 19:32:59 2026 +0200 packages/ak-config: init Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> commit 1e5cb4b Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Mon Mar 30 19:32:18 2026 +0200 sort out package versions Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> commit 64b9391 Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Mon Mar 30 17:49:16 2026 +0200 lint Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> commit 57edeec Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Mon Mar 30 17:48:51 2026 +0200 add tests Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> commit 5294f8a Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Mon Mar 30 16:38:11 2026 +0200 fixup Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> commit f1257d2 Author: Marc 'risson' Schmitt <marc.schmitt@risson.space> Date: Mon Mar 30 16:33:49 2026 +0200 packages/ak-arbiter: init Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space> Signed-off-by: Marc 'risson' Schmitt <marc.schmitt@risson.space>
1 parent b16bb99 commit d4fda55

4 files changed

Lines changed: 72 additions & 0 deletions

File tree

‎Cargo.lock‎

Lines changed: 2 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎packages/ak-common/Cargo.toml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,14 @@ proxy = []
1616

1717
[dependencies]
1818
arc-swap.workspace = true
19+
aws-lc-rs.workspace = true
1920
axum-server.workspace = true
2021
config-rs.workspace = true
2122
eyre.workspace = true
2223
glob.workspace = true
2324
notify.workspace = true
2425
pin-project-lite.workspace = true
26+
rustls.workspace = true
2527
serde.workspace = true
2628
serde_json.workspace = true
2729
thiserror.workspace = true
@@ -36,3 +38,6 @@ tempfile.workspace = true
3638

3739
[lints]
3840
workspace = true
41+
42+
[package.metadata.cargo-machete]
43+
ignored = ["aws-lc-rs"]

‎packages/ak-common/src/lib.rs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ pub use arbiter::{Arbiter, Event, Tasks};
55
pub mod config;
66
pub mod mode;
77
pub use mode::Mode;
8+
pub mod tls;
89
pub mod tokio;
910

1011
pub const VERSION: &str = env!("CARGO_PKG_VERSION");

‎packages/ak-common/src/tls.rs‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
//! TLS utilities
2+
use std::sync::Arc;
3+
4+
use eyre::{Result, eyre};
5+
use rustls::server::ResolvesServerCert;
6+
7+
use crate::config;
8+
9+
/// Dummy resolver for FIPS compliance check.
10+
#[derive(Debug)]
11+
struct EmptyCertResolver;
12+
13+
#[expect(
14+
clippy::missing_trait_methods,
15+
reason = "this is just a dummy implementation to check FIPS compliance"
16+
)]
17+
impl ResolvesServerCert for EmptyCertResolver {
18+
fn resolve(
19+
&self,
20+
_client_hello: rustls::server::ClientHello<'_>,
21+
) -> Option<Arc<rustls::sign::CertifiedKey>> {
22+
None
23+
}
24+
}
25+
26+
/// Check if fips is enabled.
27+
fn is_fips_enabled() -> bool {
28+
rustls::client::ClientConfig::builder()
29+
.with_root_certificates(rustls::RootCertStore::empty())
30+
.with_no_client_auth()
31+
.fips()
32+
&& rustls::server::ServerConfig::builder()
33+
.with_no_client_auth()
34+
.with_cert_resolver(Arc::new(EmptyCertResolver {}))
35+
.fips()
36+
}
37+
38+
/// Initialize default [`rustls`] crypto provider, and check that FIPS is working correctly.
39+
pub fn init() -> Result<()> {
40+
#[expect(
41+
clippy::unwrap_in_result,
42+
reason = "result type does not implement Error"
43+
)]
44+
rustls::crypto::aws_lc_rs::default_provider()
45+
.install_default()
46+
.expect("Failed to install rustls provider");
47+
48+
if config::get().compliance.fips.enabled && !is_fips_enabled() {
49+
return Err(eyre!("A non fips crypto provider was installed"));
50+
}
51+
52+
Ok(())
53+
}
54+
55+
#[cfg(test)]
56+
mod tests {
57+
#[test]
58+
fn init() {
59+
crate::config::init().expect("failed to initialize config");
60+
61+
super::init().expect("failed to initialized rustls");
62+
assert!(super::is_fips_enabled());
63+
}
64+
}

0 commit comments

Comments
 (0)