mirror of
https://github.com/element-hq/synapse.git
synced 2026-08-15 20:00:23 +00:00
Erik JohnstonandClaude Opus 4.8
9717da8ba5
The Rust backend connected with `NoTls`, so it couldn't talk to a Postgres that requires (or, as libpq defaults, prefers) TLS — a blocker for most managed / networked databases. Honour the same libpq keys psycopg2 already forwards, so an existing `database.args` keeps working: `sslmode`, `sslrootcert`, `sslcert`, `sslkey`, `sslpassword`. Implemented on rustls (already in the tree via reqwest; pinned to the `ring` provider since `aws-lc-rs` needs a C toolchain we don't have). `tokio-postgres` only knows `sslmode` disable/prefer/require and does no verification itself, so a new `postgres/tls.rs` drives both the handshake mode and the verifier: disable -> no TLS allow/prefer -> encrypt opportunistically, no verification (accept-any) require -> encrypt, no verification (libpq's `require` does NOT verify) verify-ca -> verify the chain, not the hostname (WebPKI, name bypassed) verify-full -> verify chain + hostname (WebPKI) `sslrootcert` (or the system trust store) supplies the roots; `sslcert`/`sslkey` add a client certificate for mutual TLS. The cert-path keys and the `verify-*` modes are stripped from the DSN and passed to the pool as explicit params (`rust_dbapi.split_ssl_params`), since `tokio-postgres` can't parse them. Behaviour change: the default (no `sslmode`) is now libpq's `prefer` — attempt TLS, fall back to plaintext — where it was previously no TLS. This matches psycopg2; plaintext servers still connect via the fallback. Caveats vs libpq/openssl: rustls is stricter (requires SANs, rejects a non-CA self-signed root), and an encrypted client key (`sslpassword`) isn't supported and is rejected with a clear error. Validated end-to-end against an SSL Postgres: require / verify-ca / verify-full connect and use TLS, verify-full with only the system roots correctly rejects an unknown CA, and hostname is checked (verify-full) / ignored (verify-ca). Unit tests cover the sslmode->verifier mapping; the Rust-backend storage suites still pass with the new default (prefer falls back against the plaintext test server). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01W3G4M92AmwSSZCbmtMJU3d