aws-crt 0.1.9 → 0.2.0

data/aws-crt-ffi/crt/aws-c-auth/source/signing_config.c

@@ -36,6 +36,9 @@ const char *aws_signing_algorithm_to_string(enum aws_signing_algorithm algorithm
         case AWS_SIGNING_ALGORITHM_V4:
             return "SigV4";
 
+        case AWS_SIGNING_ALGORITHM_V4_S3EXPRESS:
+            return "SigV4S3Express";
+
         case AWS_SIGNING_ALGORITHM_V4_ASYMMETRIC:
             return "SigV4Asymmetric";
 
@@ -114,6 +117,28 @@ int aws_validate_aws_signing_config_aws(const struct aws_signing_config_aws *con
                 }
             }
             break;
+        case AWS_SIGNING_ALGORITHM_V4_S3EXPRESS:
+            if (config->credentials == NULL && config->credentials_provider == NULL) {
+                AWS_LOGF_ERROR(
+                    AWS_LS_AUTH_SIGNING,
+                    "(id=%p) Sigv4 S3 Express signing config is missing a credentials provider or credentials",
+                    (void *)config);
+                return aws_raise_error(AWS_AUTH_SIGNING_INVALID_CONFIGURATION);
+            }
+
+            if (config->credentials != NULL) {
+                if (aws_credentials_is_anonymous(config->credentials) ||
+                    aws_credentials_get_access_key_id(config->credentials).len == 0 ||
+                    aws_credentials_get_secret_access_key(config->credentials).len == 0 ||
+                    aws_credentials_get_session_token(config->credentials).len == 0) {
+                    AWS_LOGF_ERROR(
+                        AWS_LS_AUTH_SIGNING,
+                        "(id=%p) Sigv4 S3 Express signing configured with invalid credentials",
+                        (void *)config);
+                    return aws_raise_error(AWS_AUTH_SIGNING_INVALID_CREDENTIALS);
+                }
+            }
+            break;
 
         case AWS_SIGNING_ALGORITHM_V4_ASYMMETRIC:
             if (config->credentials == NULL && config->credentials_provider == NULL) {

data/aws-crt-ffi/crt/aws-c-auth/tests/CMakeLists.txt

@@ -146,6 +146,8 @@ add_net_test_case(credentials_provider_sso_basic_success_after_failure)
 add_test_case(imds_client_new_release)
 add_test_case(imds_client_connect_failure)
 add_test_case(imds_client_token_request_failure)
+add_test_case(imds_client_insecure_fallback_request_failure)
+add_test_case(imds_client_v1_fallback_disabled_failure)
 add_test_case(imds_client_resource_request_failure)
 add_test_case(imds_client_resource_request_success)
 add_test_case(imds_client_insecure_resource_request_success)
@@ -156,6 +158,7 @@ add_test_case(imds_client_get_ancestor_ami_ids_success)
 add_test_case(imds_client_get_iam_profile_success)
 add_test_case(imds_client_get_instance_info_success)
 add_test_case(imds_client_get_credentials_success)
+add_test_case(imds_client_cache_token_refresh)
 
 if(AWS_BUILDING_ON_EC2)
     add_test_case(imds_client_real_success)

data/aws-crt-ffi/crt/aws-c-auth/tests/aws_imds_client_test.c

@@ -24,15 +24,16 @@
 #    pragma warning(disable : 4244)
 #endif /* _MSC_VER */
 
-#define IMDS_CLIENT_MAX_REQUESTS 3
+#define IMDS_CLIENT_MAX_REQUESTS 15
 struct aws_mock_imds_client_tester {
     struct aws_byte_buf request_uris[IMDS_CLIENT_MAX_REQUESTS];
     struct aws_array_list response_data_callbacks[IMDS_CLIENT_MAX_REQUESTS];
     struct aws_allocator *allocator;
     int current_request;
-    int token_response_code;
+    int response_code[IMDS_CLIENT_MAX_REQUESTS];
     int token_request_idx;
-    bool insecure_then_secure_attempt;
+    int error_code;
+    uint64_t timestamp;
     bool is_connection_acquire_successful;
 
     struct aws_mutex lock;
@@ -199,11 +200,8 @@ static int s_aws_http_stream_get_incoming_response_status_mock(
     const struct aws_http_stream *stream,
     int *out_status_code) {
     (void)stream;
-    if (s_tester.token_request_idx == s_tester.current_request - 1 && s_tester.token_response_code != 0) {
-        *out_status_code = s_tester.token_response_code;
-    } else if (s_tester.current_request == 1 && s_tester.insecure_then_secure_attempt) {
-        /* for testing insecure then switch to secure way */
-        *out_status_code = AWS_HTTP_STATUS_CODE_401_UNAUTHORIZED;
+    if (s_tester.response_code[s_tester.current_request - 1] != 0) {
+        *out_status_code = s_tester.response_code[s_tester.current_request - 1];
     } else {
         *out_status_code = AWS_HTTP_STATUS_CODE_200_OK;
     }
@@ -219,6 +217,11 @@ static void s_aws_http_connection_close_mock(struct aws_http_connection *connect
     (void)connection;
 }
 
+static int s_aws_high_res_clock_get_ticks_mock(uint64_t *timestamp) {
+    *timestamp = s_tester.timestamp;
+    return AWS_OP_SUCCESS;
+}
+
 static struct aws_auth_http_system_vtable s_mock_function_table = {
     .aws_http_connection_manager_new = s_aws_http_connection_manager_new_mock,
     .aws_http_connection_manager_release = s_aws_http_connection_manager_release_mock,
@@ -229,12 +232,16 @@ static struct aws_auth_http_system_vtable s_mock_function_table = {
     .aws_http_stream_get_connection = s_aws_http_stream_get_connection_mock,
     .aws_http_stream_get_incoming_response_status = s_aws_http_stream_get_incoming_response_status_mock,
     .aws_http_stream_release = s_aws_http_stream_release_mock,
-    .aws_http_connection_close = s_aws_http_connection_close_mock};
+    .aws_http_connection_close = s_aws_http_connection_close_mock,
+    .aws_high_res_clock_get_ticks = s_aws_high_res_clock_get_ticks_mock,
+};
 
 static int s_aws_imds_tester_init(struct aws_allocator *allocator) {
 
     aws_auth_library_init(allocator);
 
+    AWS_ZERO_STRUCT(s_tester);
+
     s_tester.allocator = allocator;
     for (size_t i = 0; i < IMDS_CLIENT_MAX_REQUESTS; i++) {
         if (aws_array_list_init_dynamic(
@@ -246,9 +253,6 @@ static int s_aws_imds_tester_init(struct aws_allocator *allocator) {
         }
     }
 
-    s_tester.token_response_code = 0;
-    s_tester.token_request_idx = 0;
-    s_tester.insecure_then_secure_attempt = false;
     if (aws_mutex_init(&s_tester.lock)) {
         return AWS_OP_ERR;
     }
@@ -257,8 +261,6 @@ static int s_aws_imds_tester_init(struct aws_allocator *allocator) {
         return AWS_OP_ERR;
     }
 
-    s_tester.current_request = 0;
-
     /* default to everything successful */
     s_tester.is_connection_acquire_successful = true;
 
@@ -312,9 +314,9 @@ static void s_aws_wait_for_resource_result(void) {
 
 static void s_get_resource_callback(const struct aws_byte_buf *resource, int error_code, void *user_data) {
     (void)user_data;
-    (void)error_code;
     aws_mutex_lock(&s_tester.lock);
     s_tester.has_received_resource_callback = true;
+    s_tester.error_code = error_code;
     if (resource && resource->len) {
         struct aws_byte_cursor cursor = aws_byte_cursor_from_buf(resource);
         aws_byte_buf_append_dynamic(&s_tester.resource, &cursor);
@@ -518,7 +520,7 @@ static int s_imds_client_token_request_failure(struct aws_allocator *allocator,
     (void)ctx;
 
     s_aws_imds_tester_init(allocator);
-    s_tester.token_response_code = AWS_HTTP_STATUS_CODE_400_BAD_REQUEST;
+    s_tester.response_code[0] = AWS_HTTP_STATUS_CODE_400_BAD_REQUEST;
     struct aws_imds_client_options options = {
         .bootstrap = s_tester.bootstrap,
         .function_table = &s_mock_function_table,
@@ -558,14 +560,14 @@ static int s_imds_client_token_request_failure(struct aws_allocator *allocator,
 
 AWS_TEST_CASE(imds_client_token_request_failure, s_imds_client_token_request_failure);
 
-static int s_imds_client_resource_request_failure(struct aws_allocator *allocator, void *ctx) {
+static int s_imds_client_insecure_fallback_request_failure(struct aws_allocator *allocator, void *ctx) {
     (void)ctx;
 
     s_aws_imds_tester_init(allocator);
-
-    struct aws_byte_cursor test_token_cursor = aws_byte_cursor_from_string(s_test_imds_token);
-    aws_array_list_push_back(&s_tester.response_data_callbacks[0], &test_token_cursor);
-
+    /* secure data flow is not supported, fallback to insecurity */
+    s_tester.response_code[0] = AWS_HTTP_STATUS_CODE_403_FORBIDDEN;
+    /* Insecurity fails as well */
+    s_tester.response_code[1] = AWS_HTTP_STATUS_CODE_401_UNAUTHORIZED;
     struct aws_imds_client_options options = {
         .bootstrap = s_tester.bootstrap,
         .function_table = &s_mock_function_table,
@@ -577,19 +579,21 @@ static int s_imds_client_resource_request_failure(struct aws_allocator *allocato
     };
 
     struct aws_imds_client *client = aws_imds_client_new(allocator, &options);
+
     aws_imds_client_get_resource_async(
         client, aws_byte_cursor_from_string(s_expected_imds_resource_uri), s_get_resource_callback, NULL);
 
     s_aws_wait_for_resource_result();
 
+    ASSERT_TRUE(s_tester.has_received_resource_callback == true);
+    ASSERT_TRUE(s_tester.resource.len == 0);
+
     ASSERT_TRUE(s_validate_uri_path_and_resource(2, false /*no resource*/) == 0);
     ASSERT_TRUE(s_tester.token_ttl_header_exist[0]);
     ASSERT_TRUE(s_tester.token_ttl_header_expected[0]);
     ASSERT_FALSE(s_tester.token_header_exist[0]);
 
-    ASSERT_FALSE(s_tester.token_ttl_header_exist[1]);
-    ASSERT_TRUE(s_tester.token_header_exist[1]);
-    ASSERT_TRUE(s_tester.token_header_expected[1]);
+    ASSERT_UINT_EQUALS(s_tester.error_code, AWS_AUTH_IMDS_CLIENT_SOURCE_FAILURE);
 
     aws_imds_client_release(client);
 
@@ -599,10 +603,11 @@ static int s_imds_client_resource_request_failure(struct aws_allocator *allocato
     aws_mem_release(allocator, client);
 
     ASSERT_SUCCESS(s_aws_imds_tester_cleanup());
+
     return 0;
 }
 
-AWS_TEST_CASE(imds_client_resource_request_failure, s_imds_client_resource_request_failure);
+AWS_TEST_CASE(imds_client_insecure_fallback_request_failure, s_imds_client_insecure_fallback_request_failure);
 
 AWS_STATIC_STRING_FROM_LITERAL(
     s_good_response,
@@ -613,6 +618,104 @@ AWS_STATIC_STRING_FROM_LITERAL(s_secret_key, "SuccessfulSecret");
 AWS_STATIC_STRING_FROM_LITERAL(s_token, "TokenSuccess");
 AWS_STATIC_STRING_FROM_LITERAL(s_expiration, "2020-02-25T06:03:31Z");
 
+static int s_imds_client_v1_fallback_disabled_failure(struct aws_allocator *allocator, void *ctx) {
+    (void)ctx;
+
+    s_aws_imds_tester_init(allocator);
+    /* secure data flow is not supported */
+    s_tester.response_code[0] = AWS_HTTP_STATUS_CODE_403_FORBIDDEN;
+    /* v1 would have worked if fallback was not disabled */
+    struct aws_byte_cursor good_response_cursor = aws_byte_cursor_from_string(s_good_response);
+    aws_array_list_push_back(&s_tester.response_data_callbacks[1], &good_response_cursor);
+
+    struct aws_imds_client_options options = {
+        .bootstrap = s_tester.bootstrap,
+        .function_table = &s_mock_function_table,
+        .ec2_metadata_v1_disabled = true,
+        .shutdown_options =
+            {
+                .shutdown_callback = s_on_shutdown_complete,
+                .shutdown_user_data = NULL,
+            },
+    };
+
+    struct aws_imds_client *client = aws_imds_client_new(allocator, &options);
+
+    aws_imds_client_get_resource_async(
+        client, aws_byte_cursor_from_string(s_expected_imds_resource_uri), s_get_resource_callback, NULL);
+
+    s_aws_wait_for_resource_result();
+
+    ASSERT_TRUE(s_tester.has_received_resource_callback == true);
+    ASSERT_TRUE(s_tester.resource.len == 0);
+    /* There was no fallback so we didn't get any resource */
+    ASSERT_TRUE(s_validate_uri_path_and_resource(1, false /*no resource*/) == 0);
+    ASSERT_TRUE(s_tester.token_ttl_header_exist[0]);
+    ASSERT_TRUE(s_tester.token_ttl_header_expected[0]);
+    ASSERT_FALSE(s_tester.token_header_exist[0]);
+
+    ASSERT_UINT_EQUALS(s_tester.error_code, AWS_AUTH_IMDS_CLIENT_SOURCE_FAILURE);
+
+    aws_imds_client_release(client);
+
+    s_aws_wait_for_imds_client_shutdown_callback();
+
+    /* Because we mock the http connection manager, we never get a callback back from it */
+    aws_mem_release(allocator, client);
+
+    ASSERT_SUCCESS(s_aws_imds_tester_cleanup());
+
+    return 0;
+}
+
+AWS_TEST_CASE(imds_client_v1_fallback_disabled_failure, s_imds_client_v1_fallback_disabled_failure);
+
+static int s_imds_client_resource_request_failure(struct aws_allocator *allocator, void *ctx) {
+    (void)ctx;
+
+    s_aws_imds_tester_init(allocator);
+
+    struct aws_byte_cursor test_token_cursor = aws_byte_cursor_from_string(s_test_imds_token);
+    aws_array_list_push_back(&s_tester.response_data_callbacks[0], &test_token_cursor);
+
+    struct aws_imds_client_options options = {
+        .bootstrap = s_tester.bootstrap,
+        .function_table = &s_mock_function_table,
+        .shutdown_options =
+            {
+                .shutdown_callback = s_on_shutdown_complete,
+                .shutdown_user_data = NULL,
+            },
+    };
+
+    struct aws_imds_client *client = aws_imds_client_new(allocator, &options);
+    aws_imds_client_get_resource_async(
+        client, aws_byte_cursor_from_string(s_expected_imds_resource_uri), s_get_resource_callback, NULL);
+
+    s_aws_wait_for_resource_result();
+
+    ASSERT_TRUE(s_validate_uri_path_and_resource(2, false /*no resource*/) == 0);
+    ASSERT_TRUE(s_tester.token_ttl_header_exist[0]);
+    ASSERT_TRUE(s_tester.token_ttl_header_expected[0]);
+    ASSERT_FALSE(s_tester.token_header_exist[0]);
+
+    ASSERT_FALSE(s_tester.token_ttl_header_exist[1]);
+    ASSERT_TRUE(s_tester.token_header_exist[1]);
+    ASSERT_TRUE(s_tester.token_header_expected[1]);
+
+    aws_imds_client_release(client);
+
+    s_aws_wait_for_imds_client_shutdown_callback();
+
+    /* Because we mock the http connection manager, we never get a callback back from it */
+    aws_mem_release(allocator, client);
+
+    ASSERT_SUCCESS(s_aws_imds_tester_cleanup());
+    return 0;
+}
+
+AWS_TEST_CASE(imds_client_resource_request_failure, s_imds_client_resource_request_failure);
+
 static int s_imds_client_resource_request_success(struct aws_allocator *allocator, void *ctx) {
     (void)ctx;
 
@@ -670,7 +773,7 @@ static int s_imds_client_insecure_resource_request_success(struct aws_allocator
     (void)ctx;
 
     s_aws_imds_tester_init(allocator);
-    s_tester.token_response_code = AWS_HTTP_STATUS_CODE_403_FORBIDDEN;
+    s_tester.response_code[0] = AWS_HTTP_STATUS_CODE_403_FORBIDDEN;
 
     struct aws_byte_cursor good_response_cursor = aws_byte_cursor_from_string(s_good_response);
     aws_array_list_push_back(&s_tester.response_data_callbacks[1], &good_response_cursor);
@@ -716,10 +819,8 @@ static int s_imds_client_insecure_then_secure_resource_request_success(struct aw
     (void)ctx;
 
     s_aws_imds_tester_init(allocator);
-    s_tester.insecure_then_secure_attempt = true;
     s_tester.token_request_idx = 1;
-    s_tester.token_response_code = AWS_HTTP_STATUS_CODE_200_OK;
-
+    s_tester.response_code[0] = AWS_HTTP_STATUS_CODE_401_UNAUTHORIZED;
     struct aws_byte_cursor test_token_cursor = aws_byte_cursor_from_string(s_test_imds_token);
     aws_array_list_push_back(&s_tester.response_data_callbacks[1], &test_token_cursor);
 
@@ -742,6 +843,7 @@ static int s_imds_client_insecure_then_secure_resource_request_success(struct aw
         client, aws_byte_cursor_from_string(s_expected_imds_resource_uri), s_get_resource_callback, NULL);
     s_aws_wait_for_resource_result();
 
+    ASSERT_TRUE(s_tester.has_received_resource_callback == true);
     ASSERT_TRUE(s_validate_uri_path_and_resource(3, true /*no creds*/) == 0);
 
     ASSERT_FALSE(s_tester.token_ttl_header_exist[0]);
@@ -777,9 +879,9 @@ static int s_aws_http_stream_get_multiple_incoming_response_status_mock(
     int *out_status_code) {
 
     (void)stream;
-    /* randomly return 400/401/200 */
+    /* randomly return 403/200 */
     uint32_t rand_output;
-    int ret[2] = {AWS_HTTP_STATUS_CODE_200_OK, AWS_HTTP_STATUS_CODE_401_UNAUTHORIZED};
+    int ret[2] = {AWS_HTTP_STATUS_CODE_200_OK, AWS_HTTP_STATUS_CODE_403_FORBIDDEN};
     aws_device_random_u32(&rand_output);
     *out_status_code = ret[rand_output % 2];
     return AWS_OP_SUCCESS;
@@ -1385,3 +1487,67 @@ static int s_imds_client_get_credentials_success(struct aws_allocator *allocator
     return 0;
 }
 AWS_TEST_CASE(imds_client_get_credentials_success, s_imds_client_get_credentials_success);
+
+static int s_imds_client_cache_token_refresh(struct aws_allocator *allocator, void *ctx) {
+    (void)ctx;
+
+    s_aws_imds_tester_init(allocator);
+
+    s_tester.timestamp = 0;
+
+    struct aws_byte_cursor test_token_cursor = aws_byte_cursor_from_string(s_test_imds_token);
+    struct aws_byte_cursor good_response_cursor = aws_byte_cursor_from_string(s_good_response);
+
+    aws_array_list_push_back(&s_tester.response_data_callbacks[0], &test_token_cursor);
+    aws_array_list_push_back(&s_tester.response_data_callbacks[1], &good_response_cursor);
+    aws_array_list_push_back(&s_tester.response_data_callbacks[2], &good_response_cursor);
+    aws_array_list_push_back(&s_tester.response_data_callbacks[3], &test_token_cursor);
+    aws_array_list_push_back(&s_tester.response_data_callbacks[4], &good_response_cursor);
+
+    struct aws_imds_client_options options = {
+        .bootstrap = s_tester.bootstrap,
+        .function_table = &s_mock_function_table,
+        .shutdown_options =
+            {
+                .shutdown_callback = s_on_shutdown_complete,
+                .shutdown_user_data = NULL,
+            },
+    };
+
+    struct aws_imds_client *client = aws_imds_client_new(allocator, &options);
+    /* 1. request a resource */
+    aws_imds_client_get_credentials(client, aws_byte_cursor_from_c_str("test_role"), s_get_credentails_callback, NULL);
+    s_aws_wait_for_resource_result();
+    /* Currently have 2 requests, one to get the token, the other to fetch resource */
+    ASSERT_UINT_EQUALS(2, s_tester.current_request);
+    ASSERT_UINT_EQUALS(AWS_ERROR_SUCCESS, s_tester.error_code);
+
+    /* 2. Request another resource without change the timestamp. So that the cached token should be used */
+    s_tester.has_received_resource_callback = false;
+    aws_imds_client_get_credentials(client, aws_byte_cursor_from_c_str("test_role"), s_get_credentails_callback, NULL);
+    s_aws_wait_for_resource_result();
+    /* Currently have 3 requests, only one more to fetch the resource as the cached token being used. */
+    ASSERT_UINT_EQUALS(3, s_tester.current_request);
+    ASSERT_UINT_EQUALS(AWS_ERROR_SUCCESS, s_tester.error_code);
+
+    /* 3. Update the time to expired time. Request another resource without change the timestamp. So that the cached
+     * token should be expired, and will fetch another token. */
+    s_tester.has_received_resource_callback = false;
+    s_tester.timestamp = aws_timestamp_convert(21600, AWS_TIMESTAMP_SECS, AWS_TIMESTAMP_NANOS, NULL);
+    aws_imds_client_get_credentials(client, aws_byte_cursor_from_c_str("test_role"), s_get_credentails_callback, NULL);
+    s_aws_wait_for_resource_result();
+    /* Currently have 3 requests, only one more to fetch the resource as the cached token being used. */
+    ASSERT_UINT_EQUALS(5, s_tester.current_request);
+    ASSERT_UINT_EQUALS(AWS_ERROR_SUCCESS, s_tester.error_code);
+    aws_imds_client_release(client);
+
+    s_aws_wait_for_imds_client_shutdown_callback();
+
+    /* Because we mock the http connection manager, we never get a callback back from it */
+    aws_mem_release(allocator, client);
+
+    ASSERT_SUCCESS(s_aws_imds_tester_cleanup());
+
+    return 0;
+}
+AWS_TEST_CASE(imds_client_cache_token_refresh, s_imds_client_cache_token_refresh);

data/aws-crt-ffi/crt/aws-c-auth/tests/credentials_provider_imds_tests.c

@@ -40,9 +40,9 @@ struct aws_mock_imds_tester {
     struct aws_array_list response_data_callbacks[IMDS_MAX_REQUESTS];
 
     int current_request;
-    int token_response_code;
+    int response_code[IMDS_MAX_REQUESTS];
     int token_request_idx;
-    bool insecure_then_secure_attempt;
+
     bool is_connection_acquire_successful;
 
     struct aws_mutex lock;
@@ -213,11 +213,8 @@ static int s_aws_http_stream_get_incoming_response_status_mock(
     const struct aws_http_stream *stream,
     int *out_status_code) {
     (void)stream;
-    if (s_tester.token_request_idx == s_tester.current_request - 1 && s_tester.token_response_code != 0) {
-        *out_status_code = s_tester.token_response_code;
-    } else if (s_tester.current_request == 1 && s_tester.insecure_then_secure_attempt) {
-        /* for testing insecure then switch to secure way */
-        *out_status_code = AWS_HTTP_STATUS_CODE_401_UNAUTHORIZED;
+    if (s_tester.response_code[s_tester.current_request - 1] != 0) {
+        *out_status_code = s_tester.response_code[s_tester.current_request - 1];
     } else {
         *out_status_code = AWS_HTTP_STATUS_CODE_200_OK;
     }
@@ -233,6 +230,10 @@ static void s_aws_http_connection_close_mock(struct aws_http_connection *connect
     (void)connection;
 }
 
+static int s_aws_high_res_clock_get_ticks_mock(uint64_t *timestamp) {
+    return aws_high_res_clock_get_ticks(timestamp);
+}
+
 static struct aws_auth_http_system_vtable s_mock_function_table = {
     .aws_http_connection_manager_new = s_aws_http_connection_manager_new_mock,
     .aws_http_connection_manager_release = s_aws_http_connection_manager_release_mock,
@@ -243,11 +244,14 @@ static struct aws_auth_http_system_vtable s_mock_function_table = {
     .aws_http_stream_get_connection = s_aws_http_stream_get_connection_mock,
     .aws_http_stream_get_incoming_response_status = s_aws_http_stream_get_incoming_response_status_mock,
     .aws_http_stream_release = s_aws_http_stream_release_mock,
-    .aws_http_connection_close = s_aws_http_connection_close_mock};
+    .aws_http_connection_close = s_aws_http_connection_close_mock,
+    .aws_high_res_clock_get_ticks = s_aws_high_res_clock_get_ticks_mock,
+};
 
 static int s_aws_imds_tester_init(struct aws_allocator *allocator) {
 
     aws_auth_library_init(allocator);
+    AWS_ZERO_STRUCT(s_tester);
 
     for (size_t i = 0; i < IMDS_MAX_REQUESTS; i++) {
         if (aws_array_list_init_dynamic(
@@ -258,10 +262,8 @@ static int s_aws_imds_tester_init(struct aws_allocator *allocator) {
             return AWS_OP_ERR;
         }
     }
+
     s_tester.allocator = allocator;
-    s_tester.token_response_code = 0;
-    s_tester.token_request_idx = 0;
-    s_tester.insecure_then_secure_attempt = false;
     if (aws_mutex_init(&s_tester.lock)) {
         return AWS_OP_ERR;
     }
@@ -270,11 +272,8 @@ static int s_aws_imds_tester_init(struct aws_allocator *allocator) {
         return AWS_OP_ERR;
     }
 
-    s_tester.current_request = 0;
-
     /* default to everything successful */
     s_tester.is_connection_acquire_successful = true;
-    s_tester.error_code = AWS_ERROR_SUCCESS;
 
     s_tester.el_group = aws_event_loop_group_new_default(allocator, 1, NULL);
     struct aws_client_bootstrap_options bootstrap_options = {
@@ -491,7 +490,7 @@ static int s_credentials_provider_imds_token_request_failure(struct aws_allocato
     (void)ctx;
 
     s_aws_imds_tester_init(allocator);
-    s_tester.token_response_code = AWS_HTTP_STATUS_CODE_400_BAD_REQUEST;
+    s_tester.response_code[0] = AWS_HTTP_STATUS_CODE_400_BAD_REQUEST;
     struct aws_credentials_provider_imds_options options = {
         .bootstrap = s_tester.bootstrap,
         .function_table = &s_mock_function_table,
@@ -824,7 +823,7 @@ static int s_credentials_provider_imds_insecure_success(struct aws_allocator *al
     (void)ctx;
 
     s_aws_imds_tester_init(allocator);
-    s_tester.token_response_code = AWS_HTTP_STATUS_CODE_403_FORBIDDEN;
+    s_tester.response_code[0] = AWS_HTTP_STATUS_CODE_403_FORBIDDEN;
 
     struct aws_byte_cursor test_role_cursor = aws_byte_cursor_from_string(s_test_role_response);
     aws_array_list_push_back(&s_tester.response_data_callbacks[1], &test_role_cursor);
@@ -882,9 +881,8 @@ static int s_credentials_provider_imds_insecure_then_secure_success(struct aws_a
     (void)ctx;
 
     s_aws_imds_tester_init(allocator);
-    s_tester.insecure_then_secure_attempt = true;
     s_tester.token_request_idx = 1;
-    s_tester.token_response_code = AWS_HTTP_STATUS_CODE_200_OK;
+    s_tester.response_code[0] = AWS_HTTP_STATUS_CODE_401_UNAUTHORIZED;
 
     struct aws_byte_cursor test_token_cursor = aws_byte_cursor_from_string(s_test_imds_token);
     aws_array_list_push_back(&s_tester.response_data_callbacks[1], &test_token_cursor);

data/aws-crt-ffi/crt/aws-c-auth/tests/sigv4_signing_tests.c

@@ -1527,6 +1527,9 @@ static int s_do_header_skip_test(
     ASSERT_SUCCESS(s_parse_request(allocator, aws_byte_cursor_from_string(request_contents), &message, &body_stream));
     struct aws_signable *signable = aws_signable_new_http_request(allocator, message);
 
+    /* release reference to message early, to ensure signable keeps it alive */
+    aws_http_message_release(message);
+
     struct aws_signing_state_aws *signing_state = aws_signing_state_new(allocator, &config, signable, NULL, NULL);
     ASSERT_NOT_NULL(signing_state);
 
@@ -1539,7 +1542,6 @@ static int s_do_header_skip_test(
         signing_state->canonical_request.len);
 
     aws_input_stream_destroy(body_stream);
-    aws_http_message_release(message);
     aws_signing_state_destroy(signing_state);
     aws_credentials_release(credentials);
     aws_signable_destroy(signable);

data/aws-crt-ffi/crt/aws-c-cal/include/aws/cal/private/opensslcrypto_common.h

@@ -1,10 +1,32 @@
 #ifndef AWS_C_CAL_OPENSSLCRYPTO_COMMON_H
 #define AWS_C_CAL_OPENSSLCRYPTO_COMMON_H
 
+/**
+ * Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ * SPDX-License-Identifier: Apache-2.0.
+ */
+
+#define OPENSSL_SUPPRESS_DEPRECATED
 #include <openssl/crypto.h>
 #include <openssl/evp.h>
 #include <openssl/hmac.h>
 
+#if !defined(OPENSSL_IS_AWSLC) && !defined(OPENSSL_IS_BORINGSSL)
+#    define OPENSSL_IS_OPENSSL
+#endif
+
+/*
+ * There are some differences in function definitions between OpenSSL 1.0.2 and
+ * 1.1.1, aws-lc and boringssl.
+ * This file defines some common wrappers that abstract away those differences.
+ * For OpenSSL we currently support building against 1.0.2 or 1.1.1, and can
+ * detect version used at runtime and dyn load those symbols correctly.
+ * For OpenSSL 3.0 the code will compile and run, but largely because we disable
+ * deprecation warnings.
+ * For aws-lc and boringssl code must be compiled against the same version as
+ * the runtime lib.
+ */
+
 typedef HMAC_CTX *(*hmac_ctx_new)(void);
 typedef void (*hmac_ctx_free)(HMAC_CTX *);
 typedef void (*hmac_ctx_init)(HMAC_CTX *);