Replace bash script with go script for server

DataDog · Jan 29, 2025 · 186a675 · 186a675
1 parent 463d2c8
commit 186a675
Show file tree

Hide file tree

Showing 4 changed files with 60 additions and 25 deletions.
diff --git a/.github/workflows/fips/compose/compose-linux.yml b/.github/workflows/fips/compose/compose-linux.yml
@@ -20,7 +20,7 @@ services:
     build:
       context: linux
       dockerfile: Dockerfile
-    command: ["./start-server.sh", "ECDHE-RSA-AES128-SHA256"]
+    command: ["./server", "ECDHE-RSA-AES128-SHA256"]
     healthcheck:
       test: "curl -f localhost:443"
       start_period: 5s
@@ -31,7 +31,7 @@ services:
     build:
       context: linux
       dockerfile: Dockerfile
-    command: ["./start-server.sh", "ECDHE-RSA-CHACHA20-POLY1305"]
+    command: ["./server", "ECDHE-RSA-CHACHA20-POLY1305"]
     healthcheck:
       test: "curl -f localhost:443"
       start_period: 5s

diff --git a/.github/workflows/fips/compose/linux/Dockerfile b/.github/workflows/fips/compose/linux/Dockerfile
@@ -1,11 +1,9 @@
-FROM alpine:3.14
+FROM golang:1.23
 
-COPY start-server.sh .
-COPY ca.* ./
-RUN chmod +x start-server.sh
+# Copy all files
+COPY . ./
 
-# Install OpenSSL and necessary tools
-RUN apk add --no-cache openssl bash curl
+RUN go build -o server http-server.go
 
 # Expose port 443
 EXPOSE 443
diff --git a/.github/workflows/fips/compose/linux/http-server.go b/.github/workflows/fips/compose/linux/http-server.go
@@ -0,0 +1,54 @@
+package main
+
+import (
+	"crypto/tls"
+	"fmt"
+	"log"
+	"net/http"
+	"os"
+)
+
+func main() {
+	// Get the allowed cipher from command-line argument
+	if len(os.Args) < 2 {
+		log.Fatal("Usage: server <TLS_CIPHER>")
+	}
+	tlsCipher := os.Args[1]
+
+	// Define allowed ciphers for TLS 1.2
+	cipherMap := map[string]uint16{
+		"ECDHE-RSA-CHACHA20-POLY1305": tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,
+		"ECDHE-RSA-AES128-SHA256": tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+	}
+
+	cipher, exists := cipherMap[tlsCipher]
+	if !exists {
+		log.Fatalf("Unsupported cipher: %s", tlsCipher)
+	}
+
+	// TLS Configuration
+	tlsConfig := &tls.Config{
+		MinVersion:               tls.VersionTLS12,
+		MaxVersion:               tls.VersionTLS12, // Force TLS 1.2 only
+		CipherSuites:             []uint16{cipher}, // Restrict to a single cipher
+		PreferServerCipherSuites: true,
+
+	}
+
+	// Define a simple HTTP handler
+	handler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte("<html><body><h1>Secure Server</h1></body></html>"))
+	})
+
+	// Create HTTPS server
+	server := &http.Server{
+		Addr:      ":443",
+		Handler:   handler,
+		TLSConfig: tlsConfig,
+		TLSNextProto: make(map[string]func(*http.Server, *tls.Conn, http.Handler)),
+	}
+
+	fmt.Printf("Serving on https://localhost:8443 using cipher %s with TLSv1.2 enforced\n", tlsCipher)
+	log.Fatal(server.ListenAndServeTLS("ca.crt", "ca.key"))
+}
diff --git a/.github/workflows/fips/compose/linux/start-server.sh b/.github/workflows/fips/compose/linux/start-server.sh