Repository navigation
h5i-app-pg: verified TLS to PostgreSQL (feature tls) - #770
Merged
Merged
Conversation
added 3 commits
October 31, 2026 20:11
`pool` and `lockdown` connect with NoTls, so a deployment could not require encrypted database connections (e.g. RDS `rds.force_ssl = 1`). With the new `tls` feature (also `h5i-app/tls`): - `pool_tls(url, max_size, &Roots)` and `lockdown_tls` connect with rustls (ring provider), verifying the certificate chain against `Roots::WebPki` or a PEM CA file (`Roots::PemFile`, e.g. the RDS bundle) and the host name (libpq's verify-full). There is no unverified mode. - sslmode is raised to `require`, so a server without TLS is refused rather than used in the clear; `sslmode=disable` in the URL is an error. - The connector is implemented in the crate on tokio-rustls, so tokio-postgres is still wrapped only by h5i-app-pg and deadpool-postgres (deny.toml A8). `pool` and `lockdown` are unchanged. Tests (`src/tls_test.rs`) against a TLS-only server (`scripts/app/pg-tls.sh`: throwaway CA, certificate for `localhost`, `hostnossl ... reject`): connections are TLSv1.3, `sslmode=prefer` is raised, an untrusted CA (UnknownIssuer) and a host not in the certificate are refused, a plain pool is refused by the server, `lockdown_tls`'s connection is verified, bad CA files and `sslmode=disable` are errors. CI starts that server before scripts/app/ci-rust-tests.sh.
From the review of #770: - SCRAM channel binding: the connector now offers `tls-server-end-point` (RFC 5929 §4.1), the certificate hashed with its signature's hash (SHA-256 for MD5/SHA-1), for RSA PKCS#1 v1.5 and ECDSA signatures. For RSA-PSS, Ed25519 and anything else it offers none: plain SCRAM-SHA-256, and `channel_binding=require` fails. Documented in the module and README. - CA files: certificates webpki cannot use as trust anchors are logged with a warning (count and file); a file with none usable is still an error. A provider's bundle with one odd entry keeps working. - Tests: - `channel_binding=require` against the server (which checks the hash itself); without the binding data, or with the wrong hash, it fails. - A server limited to TLS 1.2 (`scripts/app/pg-tls.sh` now starts it as well), with channel binding. - `pool_tls` against a server without TLS: "server does not support TLS". - A bundle with one unusable certificate still verifies; a bundle of only unusable certificates is refused. - `server_end_point` on RSA/ECDSA × SHA-1/256/384/512, Ed25519 and RSA-PSS certificates (fixtures, expected hashes from openssl).
They are test data for tls_test.rs, not source.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
poolandlockdownconnect with NoTls, so a deployment could not require encrypted database connections (e.g. RDSrds.force_ssl = 1).With the new
tlsfeature (alsoh5i-app/tls):pool_tls(url, max_size, &Roots)andlockdown_tlsconnect with rustls (ring provider), verifying the certificate chain againstRoots::WebPkior a PEM CA file (Roots::PemFile, e.g. the RDS bundle) and the host name (libpq's verify-full). There is no unverified mode.require, so a server without TLS is refused rather than used in the clear;sslmode=disablein the URL is an error.poolandlockdownare unchanged.Tests (
src/tls_test.rs) against a TLS-only server (scripts/app/pg-tls.sh: throwaway CA, certificate forlocalhost,hostnossl ... reject): connections are TLSv1.3,sslmode=preferis raised, an untrusted CA (UnknownIssuer) and a host not in the certificate are refused, a plain pool is refused by the server,lockdown_tls's connection is verified, bad CA files andsslmode=disableare errors. CI starts that server before scripts/app/ci-rust-tests.sh.