Merge pull request #100 from fastly/aturon/no-alpn

🎚 Use rustls for https directly, for more control

cli/Cargo.toml

@@ -19,7 +19,6 @@ tracing = "0.1.26"
 tracing-subscriber = "0.2.19"
 tracing-futures = "0.2.5"
 hyper = {version = "0.14.0", features = ["full"]}
-hyper-rustls = "0.22.1"
 wat = "1.0.38"
 serde_json = "1.0.66"
 

cli/src/main.rs

@@ -18,7 +18,6 @@ mod opts;
 use {
     crate::opts::Opts,
     hyper::{client::Client, Body, Request},
-    hyper_rustls::HttpsConnector,
     std::{
         env,
         io::{self, Stderr, Stdout},
@@ -28,7 +27,7 @@ use {
     tokio::time::timeout,
     tracing::{event, Level, Metadata},
     tracing_subscriber::{filter::EnvFilter, fmt::writer::MakeWriter, FmtSubscriber},
-    viceroy_lib::{config::FastlyConfig, Error, ExecuteCtx, ViceroyService},
+    viceroy_lib::{config::FastlyConfig, BackendConnector, Error, ExecuteCtx, ViceroyService},
 };
 
 /// Starts up a Viceroy server.
@@ -59,8 +58,9 @@ pub async fn serve(opts: Opts) -> Result<(), Error> {
             );
         }
 
-        let client = Client::builder().build(HttpsConnector::with_native_roots());
         for (name, backend) in backends.iter() {
+            let client =
+                Client::builder().build(BackendConnector::new(backend, ctx.tls_config().clone()));
             let req = Request::get(&backend.uri).body(Body::empty()).unwrap();
 
             event!(Level::INFO, "checking if backend '{}' is up", name);

lib/Cargo.toml

@@ -23,23 +23,26 @@ futures = "0.3.5"
 http = "0.2.1"
 http-body = "0.4.0"
 hyper = {version = "0.14.0", features = ["full"]}
-hyper-rustls = "0.22.1"
 itertools = "0.10.1"
 lazy_static = "1.4.0"
 regex = "1.3.9"
+rustls = "0.19"
+rustls-native-certs = "0.5.0"
 semver = "0.10.0"
 serde = "1.0.114"
 serde_derive = "1.0.114"
 serde_json = "1.0.59"
 thiserror = "1.0.20"
 tokio = {version = "1.2", features = ["full"]}
+tokio-rustls = "0.22"
 toml = "0.5.6"
 tracing = "0.1.26"
 tracing-futures = "0.2.5"
 url = "2.2.0"
 wasi-common = "0.29.0"
 wasmtime = "0.29.0"
 wasmtime-wasi = {version = "0.29.0", features = ["tokio"]}
+webpki = "0.21.0"
 wiggle = {version = "0.29.0", features = ["wasmtime_async"]}
 
 [dev-dependencies]

lib/src/error.rs

@@ -94,6 +94,9 @@ pub enum Error {
 
     #[error("{0} is not currently supported for local testing")]
     NotAvailable(&'static str),
+
+    #[error("Could not load native certificates: {0}")]
+    BadCerts(std::io::Error),
 }
 
 impl Error {
@@ -122,6 +125,7 @@ impl Error {
             // All other hostcall errors map to a generic `ERROR` value.
             Error::AbiVersionMismatch
             | Error::BackendUrl(_)
+            | Error::BadCerts(_)
             | Error::DownstreamRequestError(_)
             | Error::DownstreamRespSending
             | Error::FastlyConfig(_)

lib/src/execute.rs

@@ -36,6 +36,8 @@ pub struct ExecuteCtx {
     instance_pre: Arc<InstancePre<WasmCtx>>,
     /// The backends for this execution.
     backends: Arc<Backends>,
+    /// Preloaded TLS certificates and configuration
+    tls_config: Arc<rustls::ClientConfig>,
     /// The dictionaries for this execution.
     dictionaries: Arc<Dictionaries>,
     /// Path to the config, defaults to None
@@ -51,37 +53,7 @@ pub struct ExecuteCtx {
 impl ExecuteCtx {
     /// Create a new execution context, given the path to a module.
     pub fn new(module_path: impl AsRef<Path>) -> Result<Self, Error> {
-        use wasmtime::{
-            Config, InstanceAllocationStrategy, InstanceLimits, ModuleLimits,
-            PoolingAllocationStrategy, WasmBacktraceDetails,
-        };
-
-        let mut config = Config::new();
-        config.debug_info(false); // Keep this disabled - wasmtime will hang if enabled
-        config.wasm_backtrace_details(WasmBacktraceDetails::Enable);
-        config.async_support(true);
-        config.consume_fuel(true);
-
-        let module_limits = ModuleLimits {
-            // allow for up to 128MiB of linear memory
-            memory_pages: 2048,
-            // Default limit on types is 100, but some js programs have hit this.
-            // We may have to go higher at some point.
-            types: 200,
-            // AssemblyScript applications tend to create a fair number of globals
-            globals: 64,
-            // Some applications create a large number of functions, in particular in debug mode
-            functions: 20000,
-            ..ModuleLimits::default()
-        };
-
-        config.allocation_strategy(InstanceAllocationStrategy::Pooling {
-            strategy: PoolingAllocationStrategy::NextAvailable,
-            module_limits,
-            instance_limits: InstanceLimits::default(),
-        });
-        let engine = Engine::new(&config)?;
-
+        let engine = Engine::new(&configure_wasmtime())?;
         let mut linker = Linker::new(&engine);
         link_host_functions(&mut linker)?;
         let module = Module::from_file(&engine, module_path)?;
@@ -93,6 +65,7 @@ impl ExecuteCtx {
             engine,
             instance_pre: Arc::new(instance_pre),
             backends: Arc::new(Backends::default()),
+            tls_config: Arc::new(configure_tls()?),
             dictionaries: Arc::new(Dictionaries::default()),
             config_path: Arc::new(None),
             log_stdout: false,
@@ -160,6 +133,11 @@ impl ExecuteCtx {
         Self { log_stderr, ..self }
     }
 
+    /// Gets the TLS configuration
+    pub fn tls_config(&self) -> &Arc<rustls::ClientConfig> {
+        &self.tls_config
+    }
+
     /// Asynchronously handle a request.
     ///
     /// This method fully instantiates the wasm module housed within the `ExecuteCtx`,
@@ -257,6 +235,7 @@ impl ExecuteCtx {
             sender,
             remote,
             self.backends.clone(),
+            self.tls_config.clone(),
             self.dictionaries.clone(),
             self.config_path.clone(),
         );
@@ -305,3 +284,47 @@ impl ExecuteCtx {
         outcome
     }
 }
+
+fn configure_wasmtime() -> wasmtime::Config {
+    use wasmtime::{
+        Config, InstanceAllocationStrategy, InstanceLimits, ModuleLimits,
+        PoolingAllocationStrategy, WasmBacktraceDetails,
+    };
+
+    let mut config = Config::new();
+    config.debug_info(false); // Keep this disabled - wasmtime will hang if enabled
+    config.wasm_backtrace_details(WasmBacktraceDetails::Enable);
+    config.async_support(true);
+    config.consume_fuel(true);
+
+    let module_limits = ModuleLimits {
+        // allow for up to 128MiB of linear memory
+        memory_pages: 2048,
+        // Default limit on types is 100, but some js programs have hit this.
+        // We may have to go higher at some point.
+        types: 200,
+        // AssemblyScript applications tend to create a fair number of globals
+        globals: 64,
+        // Some applications create a large number of functions, in particular in debug mode
+        functions: 20000,
+        ..ModuleLimits::default()
+    };
+
+    config.allocation_strategy(InstanceAllocationStrategy::Pooling {
+        strategy: PoolingAllocationStrategy::NextAvailable,
+        module_limits,
+        instance_limits: InstanceLimits::default(),
+    });
+
+    config
+}
+
+fn configure_tls() -> Result<rustls::ClientConfig, Error> {
+    let mut config = rustls::ClientConfig::new();
+    config.root_store = match rustls_native_certs::load_native_certs() {
+        Ok(store) => store,
+        Err((_, err)) => return Err(Error::BadCerts(err)),
+    };
+    config.alpn_protocols.clear();
+    Ok(config)
+}

lib/src/lib.rs

@@ -28,4 +28,4 @@ mod streaming_body;
 mod upstream;
 mod wiggle_abi;
 
-pub use {error::Error, execute::ExecuteCtx, service::ViceroyService};
+pub use {error::Error, execute::ExecuteCtx, service::ViceroyService, upstream::BackendConnector};