Skip to content

Commit e930cdc

Browse files
chore: move all the fips-ish things to their own mini-package
1 parent 323f346 commit e930cdc

File tree

4 files changed

+60
-47
lines changed

4 files changed

+60
-47
lines changed

bottlecap/src/bin/bottlecap/main.rs

Lines changed: 1 addition & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ use bottlecap::{
1818
},
1919
event_bus::bus::EventBus,
2020
events::Event,
21+
fips::{log_fips_status, prepare_client_provider},
2122
lifecycle::{
2223
flush_control::FlushControl, invocation::processor::Processor as InvocationProcessor,
2324
listener::Listener as LifecycleListener,
@@ -79,42 +80,6 @@ use tokio_util::sync::CancellationToken;
7980
use tracing::{debug, error};
8081
use tracing_subscriber::EnvFilter;
8182

82-
#[cfg(all(feature = "default", feature = "fips"))]
83-
compile_error!("When building in fips mode, the default feature must be disabled");
84-
85-
#[cfg(feature = "fips")]
86-
fn log_fips_status() {
87-
debug!("FIPS mode is enabled");
88-
}
89-
90-
#[cfg(not(feature = "fips"))]
91-
fn log_fips_status() {
92-
debug!("FIPS mode is disabled");
93-
}
94-
95-
/// Sets up the client provider for TLS operations.
96-
/// In FIPS mode, this installs the AWS-LC crypto provider.
97-
/// In non-FIPS mode, this is a no-op.
98-
#[cfg(feature = "fips")]
99-
fn prepare_client_provider() -> Result<()> {
100-
rustls::crypto::default_fips_provider()
101-
.install_default()
102-
.map_err(|e| {
103-
Error::new(
104-
std::io::ErrorKind::InvalidData,
105-
format!("Failed to set up fips provider: {e:?}"),
106-
)
107-
})
108-
}
109-
110-
#[cfg(not(feature = "fips"))]
111-
// this is not unnecessary since the fips version can return an error
112-
#[allow(clippy::unnecessary_wraps)]
113-
fn prepare_client_provider() -> Result<()> {
114-
// No-op in non-FIPS mode
115-
Ok(())
116-
}
117-
11883
#[derive(Clone, Deserialize)]
11984
#[serde(rename_all = "camelCase")]
12085
struct RegisterResponse {

bottlecap/src/fips/mod.rs

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
// This module contains all of the things we do a little bit differently when we compile for FIPS
2+
// mode. This is used in conjunction with the datadog-serverless-fips crate to ensure that when we
3+
// compile the extension in FIPS mode, everything is built and configured correctly.
4+
5+
#[cfg(feature = "fips")]
6+
use std::io::Error;
7+
use std::io::Result;
8+
use tracing::debug;
9+
10+
#[cfg(all(feature = "default", feature = "fips"))]
11+
compile_error!("When building in fips mode, the default feature must be disabled");
12+
13+
#[cfg(feature = "fips")]
14+
pub fn log_fips_status() {
15+
debug!("FIPS mode is enabled");
16+
}
17+
18+
#[cfg(not(feature = "fips"))]
19+
pub fn log_fips_status() {
20+
debug!("FIPS mode is disabled");
21+
}
22+
23+
/// Sets up the client provider for TLS operations.
24+
/// In FIPS mode, this installs the AWS-LC crypto provider.
25+
/// In non-FIPS mode, this is a no-op.
26+
#[cfg(feature = "fips")]
27+
pub fn prepare_client_provider() -> Result<()> {
28+
rustls::crypto::default_fips_provider()
29+
.install_default()
30+
.map_err(|e| {
31+
Error::new(
32+
std::io::ErrorKind::InvalidData,
33+
format!("Failed to set up fips provider: {e:?}"),
34+
)
35+
})
36+
}
37+
38+
#[cfg(not(feature = "fips"))]
39+
// this is not unnecessary since the fips version can return an error
40+
#[allow(clippy::unnecessary_wraps)]
41+
pub fn prepare_client_provider() -> Result<()> {
42+
// No-op in non-FIPS mode
43+
Ok(())
44+
}
45+
46+
#[cfg(not(feature = "fips"))]
47+
#[must_use]
48+
pub fn compute_aws_api_host(service: &String, region: &String, domain: &str) -> String {
49+
format!("{service}.{region}.{domain}")
50+
}
51+
52+
#[cfg(feature = "fips")]
53+
#[must_use]
54+
pub fn compute_aws_api_host(service: &String, region: &String, domain: &str) -> String {
55+
format!("{service}-fips.{region}.{domain}")
56+
}

bottlecap/src/lib.rs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
pub mod config;
2121
pub mod event_bus;
2222
pub mod events;
23+
pub mod fips;
2324
pub mod http_client;
2425
pub mod lifecycle;
2526
pub mod logger;

bottlecap/src/secrets/decrypt.rs

Lines changed: 2 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
use crate::config::{aws::AwsConfig, Config};
2+
use crate::fips::compute_aws_api_host;
23
use base64::prelude::*;
34
use chrono::{DateTime, Utc};
45
use datadog_serverless_fips::reqwest_adapter::create_reqwest_client_builder;
@@ -226,16 +227,6 @@ async fn request(
226227
Ok(v)
227228
}
228229

229-
#[cfg(not(feature = "fips"))]
230-
fn compute_host(service: &String, region: &String, domain: &str) -> String {
231-
format!("{service}.{region}.{domain}")
232-
}
233-
234-
#[cfg(feature = "fips")]
235-
fn compute_host(service: &String, region: &String, domain: &str) -> String {
236-
format!("{service}-fips.{region}.{domain}")
237-
}
238-
239230
fn build_get_secret_signed_headers(
240231
aws_config: &AwsConfig,
241232
region: String,
@@ -250,7 +241,7 @@ fn build_get_secret_signed_headers(
250241
"amazonaws.com"
251242
};
252243

253-
let host = compute_host(&header_values.service, &region, domain);
244+
let host = compute_aws_api_host(&header_values.service, &region, domain);
254245

255246
let canonical_uri = "/";
256247
let canonical_querystring = "";

0 commit comments

Comments
 (0)