Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update the RDS root CA list #1772

Merged
merged 1 commit into from
Feb 14, 2024
Merged

Update the RDS root CA list #1772

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
117 changes: 113 additions & 4 deletions Cargo.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,7 @@ chrono = { version = "0.4", features = ["serde"] }
tokio-postgres = { version = "0.7.2", features = ["with-chrono-0_4", "with-serde_json-1", "with-uuid-0_8"] }
postgres-native-tls = "0.5.0"
native-tls = "0.2"
x509-cert = { version = "0.2.5", features = ["pem"] }
serde_path_to_error = "0.1.2"
octocrab = "0.30.1"
comrak = { version = "0.8.2", default-features = false }
Expand Down
33 changes: 25 additions & 8 deletions src/db.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,10 +12,10 @@ pub mod jobs;
pub mod notifications;
pub mod rustc_commits;

const CERT_URL: &str = "https://s3.amazonaws.com/rds-downloads/rds-ca-2019-root.pem";
const CERT_URL: &str = "https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem";

lazy_static::lazy_static! {
static ref CERTIFICATE_PEM: Vec<u8> = {
static ref CERTIFICATE_PEMS: Vec<u8> = {
let client = reqwest::blocking::Client::new();
let resp = client
.get(CERT_URL)
Expand Down Expand Up @@ -94,12 +94,11 @@ impl ClientPool {
async fn make_client() -> anyhow::Result<tokio_postgres::Client> {
let db_url = std::env::var("DATABASE_URL").expect("needs DATABASE_URL");
if db_url.contains("rds.amazonaws.com") {
let cert = &CERTIFICATE_PEM[..];
let cert = Certificate::from_pem(&cert).context("made certificate")?;
let connector = TlsConnector::builder()
.add_root_certificate(cert)
.build()
.context("built TlsConnector")?;
let mut builder = TlsConnector::builder();
for cert in make_certificates() {
builder.add_root_certificate(cert);
}
let connector = builder.build().context("built TlsConnector")?;
let connector = MakeTlsConnector::new(connector);

let (db_client, connection) = match tokio_postgres::connect(&db_url, connector).await {
Expand Down Expand Up @@ -134,6 +133,24 @@ async fn make_client() -> anyhow::Result<tokio_postgres::Client> {
}
}

fn make_certificates() -> Vec<Certificate> {
use x509_cert::der::pem::LineEnding;
use x509_cert::der::EncodePem;

let certs = x509_cert::Certificate::load_pem_chain(&CERTIFICATE_PEMS[..]).unwrap();
certs
.into_iter()
.map(|cert| Certificate::from_pem(cert.to_pem(LineEnding::LF).unwrap().as_bytes()).unwrap())
.collect()
}

// Makes sure we successfully parse the RDS certificates and load them into native-tls compatible
// format.
#[test]
fn cert() {
make_certificates();
}

pub async fn run_migrations(client: &DbClient) -> anyhow::Result<()> {
client
.execute(
Expand Down
Loading