Repository navigation
pgwire-common: wrap TLS connections in a backend-neutral TlsStream - #39433
Open
jasonhernandez wants to merge 1 commit into
Open
jasonhernandez wants to merge 1 commit into
jasonhernandez wants to merge 1 commit into
Conversation
This was referenced Sep 30, 2026
`Conn::Ssl` now holds a `TlsStream` enum with an `Openssl` variant and rustls `Server` and `Client` variants. SNI lookup moves behind `TlsStream::server_name`, so balancerd's resolver no longer reaches into the OpenSSL session directly. pgwire and balancerd wrap their existing OpenSSL streams in `TlsStream::Openssl`. Nothing constructs the rustls variants yet, so TLS behavior is unchanged. Co-Authored-By: Claude Opus 5.5 <[email protected]>
jasonhernandez
force-pushed
the
jason/tls-stack-5-tlsstream-bridge
branch
from
October 27, 2026 07:09
f6e14c9 to
926248f
Compare
jasonhernandez
added a commit
that referenced
this pull request
Oct 27, 2026
### Motivation First PR in the TLS migration stack replacing #36085: #39428 (this, OpenSSL handshake tests) → #39430 (rustls Postgres connector) → #39431 (channel binding) and #39432 (nightly public-CA check). #39433 (pgwire-common `TlsStream` bridge) is independent, based on main. These tests pin down today's OpenSSL TLS client behavior in `mz-tls-util` ahead of the rustls migration, which will extend each test with a rustls leg. Split out of #36085. ### Description - `verify_full_trusts_default_store`: with `sslmode=verify-full` and no `sslrootcert`, `make_tls` trusts a CA from the default store (`SSL_CERT_FILE`). - `client_certs_accepted`: `make_tls` presents the configured client certificate to a server that requires one. - Harness: a throwaway `TestCa`, a blocking OpenSSL `SslAcceptor` server on a background thread, and connect/assert helpers. - `tempfile` and `tokio` added as dev-dependencies (both existing workspace deps). No production code changes. ### Verification Ran the tests repeatedly under nextest. Confirmed each fails when its property is broken (no `SSL_CERT_FILE`, no client cert). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Jason Hernandez <[email protected]> Co-authored-by: Claude Opus 5.5 <[email protected]>
jasonhernandez
marked this pull request as ready for review
October 28, 2026 06:22
antiguru
approved these changes
Oct 28, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
pgwire and balancerd now pass TLS connections around as
Conn::Ssl(TlsStream), a backend-neutral stream, instead of an OpenSSLSslStream. This lets each accept and dial path move to rustls independently. Part of the TLS stack moving off OpenSSL.Description
mz_pgwire_common::TlsStreamwithOpenssl, rustlsServerand rustlsClientvariants, implementingget_ref,get_mut,AsyncRead,AsyncWriteandAsyncReady.TlsStream::server_name, which balancerd's pgwire resolver uses instead of querying the OpenSSL session directly.TlsStream::Openssl.tokio-rustlsto the workspace. The lockfile gains only dependency edges.Risks
No behavior change: nothing constructs the rustls variants yet, and the OpenSSL variant makes the same calls as before, including for SNI.
Tests
No new tests. The existing balancerd
serverintegration tests cover the SNI and TLS accept paths.🤖 Generated with Claude Code