xiaoxue_admin
/
dbx
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix: normalize channel_binding=require to prefer for postgres

This commit is contained in:
t8y2 2026-06-15 17:44:00 +08:00
parent 3ee2514d07
commit 46ddcaba56
1 changed files with 27 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
crates/dbx-core/src/db/postgres.rs
View File

@ -920,6 +920,15 @@ fn postgres_connection_url(url: &str) -> Result<PostgresConnectionUrl, String> {
} else {
ssl_files.sslrootcert = Some(decoded);
}
} else if key.eq_ignore_ascii_case("channel_binding") {
// channel_binding=require fails when the server does not offer
// SCRAM-SHA-256-PLUS (e.g. Neon). Normalize require→prefer so
// channel binding is used when available but does not cause a
// hard failure when the server doesn't support it.
match value.to_ascii_lowercase().as_str() {
"require" => kept_params.push("channel_binding=prefer".to_string()),
_ => kept_params.push(param.to_string()),
}
} else if key.eq_ignore_ascii_case("sslmode") {
match value.to_ascii_lowercase().as_str() {
"verify-ca" => {
@ -2266,6 +2275,24 @@ mod tests {
assert!(!parsed.verifies_hostname);
}
#[test]
fn postgres_connection_url_normalizes_channel_binding_require_to_prefer() {
let parsed =
postgres_connection_url("postgres://localhost/db?sslmode=require&channel_binding=require").unwrap();
assert_eq!(parsed.url, "postgres://localhost/db?sslmode=require&channel_binding=prefer");
// The sanitized URL must be parseable by the driver
tokio_postgres::Config::from_str(&parsed.url).unwrap();
}
#[test]
fn postgres_connection_url_keeps_channel_binding_prefer() {
let parsed = postgres_connection_url("postgres://localhost/db?channel_binding=prefer").unwrap();
assert_eq!(parsed.url, "postgres://localhost/db?channel_binding=prefer");
tokio_postgres::Config::from_str(&parsed.url).unwrap();
}
#[test]
fn postgres_tls_rejects_unpaired_client_cert_and_key() {
let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();