environmentd: migrate test TLS infrastructure to rcgen+rustls#35835
Draft
jasonhernandez wants to merge 3 commits intoMaterializeInc:jason/sec-220-tier3-4-leaf-crate-migrationsfrom
Draft
Conversation
Contributor
|
Thanks for opening this PR! Here are a few tips to help make the review process smooth for everyone. PR title guidelines
Pre-merge checklist
|
jasonhernandez
force-pushed
the
jason/sec-219-tls-test-infra
branch
2 times, most recently
from
38d722a to
dfaf0ef
Compare
jasonhernandez
changed the title
jasonhernandez
force-pushed
the
jason/sec-219-tls-test-infra
branch
6 times, most recently
from
0eb770f to
89701f2
Compare
…ustls Replace openssl-based test certificate generation and TLS connector construction with rcgen (cert generation) and tokio-postgres-rustls. - Ca struct now uses rcgen::CertificateParams + KeyPair instead of openssl X509/PKey. Certificate and key are stored as PEM bytes. - New TestTlsConfig builder replaces the closure-based SslConnectorBuilder pattern with a declarative config struct. - make_pg_tls now takes TestTlsConfig and returns MakeRustlsConnect. Test files (auth.rs, server.rs, balancerd/tests) still need call-site migration to the new API — tracked as remaining work for SEC-219. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Update all test files to use the new TestTlsConfig-based API: - auth.rs: Migrate ~50 make_pg_tls call sites, replace SslConnectorBuilder closures with TestTlsConfig builder. Switch JWT from RS256 to ES256 (matching rcgen's ECDSA key generation). Stub make_http_tls/make_ws_tls with TODO comments for full rustls migration. - environmentd/tests/server.rs: Migrate make_pg_tls calls, JWT keys, reqwest cert access, and X509 comparisons (with TODO stubs). - balancerd/tests/server.rs: Migrate make_pg_tls calls, JWT keys, reqwest cert access, and X509 comparisons (with TODO stubs). Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
Replace TODO stubs with working implementations: - peer_certificate_der(): raw tokio-rustls handshake to inspect peer certificates. reqwest's TlsInfo::peer_certificate() only works with the native-tls backend, returning None with rustls — so we drop down to tokio_rustls::TlsConnector directly where ServerConnection::peer_certificates() always works. - cert_file_to_der(): parse PEM cert files to DER for comparison. - make_http_tls(): now honors TestTlsConfig (builds hyper-rustls connector from the client config that trusts the test CA). - make_ws_tls(): uses rustls::StreamOwned for synchronous TLS WebSocket connections. Cert reloading test assertions in both environmentd and balancerd are now fully restored — no remaining TODO stubs. Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
jasonhernandez
force-pushed
the
jason/sec-219-tls-test-infra
branch
from
89701f2 to
4eec3e8
Compare
jasonhernandez
changed the base branch from
main
to
jason/sec-220-tier3-4-leaf-crate-migrations
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
postgres-openssltotokio-postgres-rustlstokio-postgres-rustlsas ring wrapper in deny.tomlDepends on #35847.
Part 7/7 of the FIPS 140-3 compliance mode migration.
Works toward SEC-219.
Test plan
cargo deny check licenses bans sourcespasses🤖 Generated with Claude Code