block / mysql / 34064809572

85%

push

github

Enable TLS automatically for Amazon RDS endpoints (#4)

* Enable TLS automatically for Amazon RDS endpoints

A connection to an *.rds.amazonaws.com address now verifies against Amazon's
RDS root bundle, embedded here, unless the DSN asked for something else.

Three Block repositories had already written this: strata's pkg/mysqlrds,
vitess's go/vt/topo/mysqltopo, and spirit's pkg/dbconn each carry a copy of the
bundle, a hostname regexp, and a RegisterTLSConfig call. They agree on what
should happen and disagree on the details — two of the three regexps require
the leading dot in `.rds.amazonaws.com` and one does not, one pins a TLS
minimum version and two take the Go default, one checks the result of
AppendCertsFromPEM and two discard it, and strata's bundle is three
ca-west-1 roots newer than the other two. Every consumer of the driver has to
get all of that right independently, and getting it wrong by omission produces
an unencrypted connection rather than an error.

The driver is where this belongs: it is the only layer that sees every
connection, and the address is all the input it needs.

Design:

  - The hook is one line in Config.normalize, so it covers both entry points
    (ParseDSN and NewConnector) and everything downstream of them. All the
    logic is in rds.go, a file upstream does not have.

  - It fires only when neither cfg.TLS nor cfg.TLSConfig is set, so anything
    the DSN specifies wins — including tls=false, which is the documented
    opt-out. normalize then fills in ServerName as it does for any other
    config, making this identity verification and not just encryption.

  - The regexp requires the leading dot. Without it `notrds.amazonaws.com`
    matches; that fails safely (verification against RDS roots fails rather
    than trusting the wrong CA) but a confusing handshake error is still worse
    than not matching.

  - MinVersion is TLS 1.2 rather than the Go default, so a future change to
    that default cannot quietly... (continued)

37 of 37 new or added lines in 2 files covered. (100.0%)

3573 of 4227 relevant lines covered (84.53%)

331443.54 hits per line