block / mysql / 34064570862

85%

master: 85%

Pull #4

github

rds: exclude GovCloud, clone the pool, match case-insensitively

Three fixes from review, each with a test that fails without it:

GovCloud RDS endpoints are ordinary <name>.<hash>.us-gov-<region>.rds.
amazonaws.com names, so the suffix check accepted them — but the embedded
bundle has 121 commercial roots and zero GovCloud ones. Auto-TLS would have
turned a GovCloud connection that works today in plaintext into a failing
handshake with an x509 error naming none of this: the same confusing failure
the leading dot in rdsAddr exists to avoid, reached from the other direction.
Excluded, with RDSTLSConfig as the documented path.

RDSTLSConfig's doc invites callers to modify the returned config, but every
call shared one *x509.CertPool, which has no copy-on-write. One caller
following that advice widened trust for every RDS connection in the process,
and raced with in-flight handshakes reading the pool. Clone it — a shallow
index copy, cheap next to a handshake.

DNS is case-insensitive and nothing normalizes cfg.Addr, so a hostname
uppercased by a config file or a console copy-paste got no auto-TLS at all:
the silent-plaintext omission this file exists to prevent.

Also document that auto-TLS is a property of the address, not the DSN string,
so FormatDSN output carries no tls= and only reproduces the behaviour when
reopened with block-mysql.

37 of 37 new or added lines in 2 files covered. (100.0%)

3575 of 4227 relevant lines covered (84.58%)

331445.44 hits per line