-
Notifications
You must be signed in to change notification settings - Fork 56
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update to hyper 1.0 #3371
Update to hyper 1.0 #3371
Conversation
@jarhodes314 FYI: I think we're going to have to stick to the ring crypto backend as aws-lc-rs does not support all of our targets. |
Annoyingly, part of the dependency on |
Now created bytebeamio/rumqtt#941, I'll update this PR with the forked dependency to unblock the build. |
Robot Results
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
So many breaking API changes here and there :-( Thank you for tackling this.
About upgrading rumqttc
, this PR is the way to go compared to #3359. Indeed, even if currently depending on fork of the main branch (bytebeamio/rumqtt#941), the changes are more future proof.
|
||
impl zeroize::Zeroize for PrivateKey { | ||
fn zeroize(&mut self) { | ||
self.0 .0.zeroize() | ||
// FIXME I can't be implemented with rustls 0.23 due to immutability |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
One can submit a PR on rustls_pki_types
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Since this is related to security and a removal of functionality, we should create a ticket to track it (e.g. and create a PR as @didier-wenzek suggested) before merging so we don't forget about this.
8e70689
to
6eacb6b
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The changes look good, but 3 things are left:
- hyper 1.5 -> 1.6
- can
CryptoProvider::install_default()
be removed? - most important: handling
Zeroize
, which we can no longer guarantee becauseCertificateDer
andPrivateKeyDer
are immutable. Making a PR to upstream is an option, but it could take some time. In the meantime, is zeroizing necessary so that we can't replace it with a noop? We're not really testing for it anywhere, so I'm not sure what exactly it provides us.
use rustls::crypto; | ||
let _ = crypto::CryptoProvider::install_default(crypto::ring::default_provider()); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
question: why do we need this snippet in the tests?
When I remove it, the tests still work. It's a bit of a pain to always have to call this in tests (also because cryptography should be somewhat abstracted and caller shouldn't have to care about it, so we don't always necessarily know when we'll have to call into rustls).
So because it still works without the snippet, I reckon it either doesn't call into ServerConfig/ClientConfig
builders or some other default is used?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Huh, having a closer look at this test, it seems like we're not using HTTPS at all (mockito doesn't support HTTPS as far as I can tell, and we certainly don't do anything to it that looks like it would enable HTTPS). @didier-wenzek can you elaborate on whether this lack of HTTPS in the test is an error or whether I'm just misunderstanding something?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I confirm that there is no more test over HTTPS, as you said because mockito doesn't support HTTPS. There was a test against https://httpbin.org, but this has been removed because subject to flackiness. See #1985
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I also don't get any test failures when commenting out crates/extensions/c8y_auth_proxy/src/server.rs:1250
, so I doubt it's because HTTPS isn't used.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I suspect because we now only have ring
enabled and not aws-lc-rs
, rustls
does this for us automatically, which would explain why I previously ran into errors and now don't.
hyper-rustls = { version = "0.24", default-features = false, features = [ | ||
"tokio-runtime", | ||
hyper = { version = "1.5", default-features = false } | ||
hyper-rustls = { version = "0.27.5", default-features = false, features = [ |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
question: why 1.5? cargo check
works for me with hyper 1.6
hyper-rustls = { version = "0.27.5", default-features = false, features = [ | |
hyper = { version = "1.6", default-features = false } |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't quite know, but we're already using 1.6 anyway according to the lockfile
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Ah, my bad, indeed there's 1.6
in the lockfile, just my Dependi extension took the older 0.14
version used for compat with rumqttd
and displayed me a "not up to date mark", so we're in the clear.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
suggestion: http-body
and hyper-util
can be upgraded to latest patch version using cargo upgrade
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Now done
source = "registry+https://github.com/rust-lang/crates.io-index" | ||
checksum = "c546c80d6be4bc6a00c0f01730c08df82eaa7a7a61f11d656526506112cc1709" | ||
dependencies = [ | ||
"thiserror-impl", | ||
"thiserror-impl 1.0.61", | ||
] | ||
|
||
[[package]] | ||
name = "thiserror" | ||
version = "2.0.11" | ||
source = "registry+https://github.com/rust-lang/crates.io-index" | ||
checksum = "d452f284b73e6d76dd36758a0c8684b1d5be31f92b89d07fd5822175732206fc" | ||
dependencies = [ | ||
"thiserror-impl 2.0.11", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
note: Seems that hyper & friends are using a new major release of thiserror
. Our crates and some other dependencies still use 1.0, so 2 versions are pulled, but because thiserror
basically does macros, it shouldn't have major codegen implications.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm okay to merge this PR despite there are still a failing tests (acceptor_rejects_untrusted_client_certificates
and bridge_disconnect_while_sending
), because:
- This PR is going in the correct direction, i.e. leveraging the HEAD of
rumqttc
to upgrade torustls 0.23
despite conflicting constraints. Reverting to the next released version ofrumqttc
will be feasible with no major difficulties. - This PR spreads a lot of small but non-trivial changes across all the creates depending on TLS. It would be good to avoid conflicts.
Follow-up tasks:
- Fix the two tests that have been ignored here.
- Create a PR on rumqttc for chore(rumqttc): disable default-features for tokio-rustls bytebeamio/rumqtt#941
- Consider to create a PR on rustls_pki_types to zeroize private keys.
@reubenmiller are you okay merging this PR soon?
match self { | ||
Self::Small(bytes) => (bytes.clone().into(), Some(bytes)), | ||
Self::Small(bytes) => ( | ||
SyncBody::new(Full::new(bytes.clone()).map_err(|i| match i {})), |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't get how matching the Infallible
error can help to make an impl http_body::Body()
from a Result
.
What am I missing?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Because Infallible
is an uninhabited type (i.e. the enum has no variants, so a value of the type can never exist), match i {}
is valid and evaluates to !
, so this can be cast to whatever implmentation is necessary (in this case axum::Error
).
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
match i {}
evaluates to!
This is what I was missing.
@@ -4,7 +4,7 @@ test-threads = "num-cpus" | |||
|
|||
[[profile.default.overrides]] | |||
# Remove once https://github.com/thin-edge/thin-edge.io/issues/3021 is resolved | |||
filter = 'test(bridge_reconnects_successfully_after_local_connection_interrupted) or test(bridge_reconnects_successfully_after_cloud_connection_interrupted)' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
When has been these two flaky tests resolved? If so it would be good to close #3021.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm not entirely sure, but I suspect it was with the reliability improvements you made in #3122. I've not seen the flakiness locally myself in cargo-nextest and I have seen quite a lot of flaky tests in recent weeks, I believe due to the strain it puts my work laptop under.
@didier-wenzek I don't quite understand this, you've linked to a PR against rumqttc but suggested this doesn't exist?
Yep, the bridge_disconnect one is the main new source of flakiness in the bridge tests. I will reduce the number of messages it sends because I think the issue is to do with rumqttd getting overloaded. I don't quite understand how (I presume a change in rumqttc may have changed how it sends messages: Here's a passing example:
And a failing example:
The thing that sticks out to me is This does lead to the question of why do we have a new issue with rumqttd, a dependency that hasn't updated. My suspicions are that the updated rumqttc has changed how it publishes the messages, and rumqttd isn't coping with this. It definitely seems to be related to the amount of load the system is under. If the test manages to publish the message and then the broker restarts/does something else that drops queued messages, this would explain the non-forwarding of messages. I'm trying to understand this further, but it's proving a bit difficult as enabling more logs changes the performance characteristics sufficiently to not cause the flakiness to appear. The fact that it's (mostly, but not entirely) that test may also prove useful in understanding what's going on here. I believe I've seen extremely occasional issues (1 in some thousands of runs) with |
Oops, I failed to noticed that is was not a link to your fork. |
crates/core/tedge/src/main.rs
Outdated
@@ -31,7 +31,6 @@ use tracing::log; | |||
static ALLOCATOR: Cap<alloc::System> = Cap::new(alloc::System, usize::MAX); | |||
|
|||
fn main() -> anyhow::Result<()> { | |||
clap_complete::CompleteEnv::with_factory(TEdgeCli::command).complete(); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Oops, must've accidentally deleted this when removing the CryptoProvider stuff.
I've created #3373 to address the fact this went undetected.
In principle, yes I'm ok with this PR merging soon), we just need to make sure we create all of the required follow up tickets prior to merging (so we don't forget about it). |
30d38b2
to
a2c8f02
Compare
Now created the follow up tickets and linked to the relevant one from the |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Approved. Thank you for tackling this.
Proposed changes
This updates nearly all our usage of hyper to 1.0, including through axum. It also updates rustls to 0.23.
I've not tested it properly, although I'm not expecting massive breaking changes. There is currently 1 failing unit test that I will look into further. I believe the functionality is working as intended, but the check the test performs to clarify the error is of the expected type isn't working. Additionally there is some new flakiness in the
tedge_mqtt_bridge
tests that I would like to understand better (but I think if the issue is a real bug rather than a test issue, it boils down to "when we put the bridge under a frankly ridiculous amount of load, things go a bit wonky").Currently we do still have a dependency on hyper 0.14 through
rumqttd
, although this only used for testing. I have updatedrumqttc
to the latest version using a git dependency (pinned to a commit hash to ensure we don't receive unexpected breaking changes).Types of changes
Paste Link to the issue
hyper
,hyper-rustls
to latest versions #3360Checklist
cargo fmt
as mentioned in CODING_GUIDELINEScargo clippy
as mentioned in CODING_GUIDELINESFurther comments