xiaoxue_admin
/
dbx
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(postgres): skip cert parsing for non-verifying TLS

This commit is contained in:
t8y2 2026-07-07 13:02:10 +08:00
parent 2cbce44628
commit 3161efe95f
1 changed files with 27 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
crates/dbx-core/src/db/postgres.rs
View File

@ -1289,20 +1289,20 @@ impl ServerCertVerifier for NoPostgresCertVerification {
fn verify_tls12_signature(
&self,
message: &[u8],
_message: &[u8],
cert: &CertificateDer<'_>,
dss: &rustls::DigitallySignedStruct,
_dss: &rustls::DigitallySignedStruct,
) -> Result<HandshakeSignatureValid, rustls::Error> {
verify_tls12_signature(message, cert, dss, &self.provider.signature_verification_algorithms)
self.accept_tls_signature_for_unverified_cert(cert)
}
fn verify_tls13_signature(
&self,
message: &[u8],
_message: &[u8],
cert: &CertificateDer<'_>,
dss: &rustls::DigitallySignedStruct,
_dss: &rustls::DigitallySignedStruct,
) -> Result<HandshakeSignatureValid, rustls::Error> {
verify_tls13_signature(message, cert, dss, &self.provider.signature_verification_algorithms)
self.accept_tls_signature_for_unverified_cert(cert)
}
fn supported_verify_schemes(&self) -> Vec<rustls::SignatureScheme> {
@ -1310,6 +1310,19 @@ impl ServerCertVerifier for NoPostgresCertVerification {
}
}
impl NoPostgresCertVerification {
fn accept_tls_signature_for_unverified_cert(
&self,
_cert: &CertificateDer<'_>,
) -> Result<HandshakeSignatureValid, rustls::Error> {
// PostgreSQL sslmode=prefer/require does not authenticate the server certificate.
// Avoid rustls' default signature helpers here because they parse the certificate
// before chain verification and reject legacy server certificates that libpq/JDBC
// still accept in these non-verifying modes.
Ok(HandshakeSignatureValid::assertion())
}
}
#[derive(Debug)]
struct PostgresCaOnlyCertVerification {
provider: Arc<CryptoProvider>,
@ -3389,6 +3402,14 @@ mod tests {
assert!(error.contains("sslkey"));
}
#[test]
fn postgres_accept_all_tls_signature_does_not_parse_unverified_cert() {
let verifier = NoPostgresCertVerification { provider: Arc::new(rustls::crypto::aws_lc_rs::default_provider()) };
let malformed_cert = CertificateDer::from(vec![0x30, 0x03, 0x02, 0x01, 0x00]);
assert!(verifier.accept_tls_signature_for_unverified_cert(&malformed_cert).is_ok());
}
#[test]
fn inject_postgres_keepalive_params_preserves_url_fragment() {
let url = "postgres://localhost/app?sslmode=require#read-only";