feat: upgrade rustls library family, opensrv-mysql and pgwire (#2927)

* feat: deps up

* fmt: toml format

src/servers/Cargo.toml

@@ -54,10 +54,10 @@ lazy_static.workspace = true
 mime_guess = "2.0"
 once_cell.workspace = true
 openmetrics-parser = "0.4"
-opensrv-mysql = "0.5"
+opensrv-mysql = "0.6"
 opentelemetry-proto.workspace = true
 parking_lot = "0.12"
-pgwire = "0.16"
+pgwire = "0.17"
 pin-project = "1.0"
 postgres-types = { version = "0.2", features = ["with-chrono-0_4"] }
 pprof = { version = "0.13", features = [
@@ -72,8 +72,9 @@ query.workspace = true
 rand.workspace = true
 regex.workspace = true
 rust-embed = { version = "6.6", features = ["debug-embed"] }
-rustls = "0.21"
-rustls-pemfile = "1.0"
+rustls = "0.22"
+rustls-pemfile = "2.0"
+rustls-pki-types = "1.0"
 schemars = "0.8"
 secrecy = { version = "0.8", features = ["serde", "alloc"] }
 serde.workspace = true
@@ -85,7 +86,7 @@ snap = "1"
 sql.workspace = true
 strum.workspace = true
 table.workspace = true
-tokio-rustls = "0.24"
+tokio-rustls = "0.25"
 tokio-stream = { workspace = true, features = ["net"] }
 tokio.workspace = true
 tonic-reflection = "0.10"
@@ -108,13 +109,12 @@ mysql_async = { version = "0.33", default-features = false, features = [
     "default-rustls",
 ] }
 rand.workspace = true
-rustls = { version = "0.21", features = ["dangerous_configuration"] }
 script = { workspace = true, features = ["python"] }
 serde_json = "1.0"
 session = { workspace = true, features = ["testing"] }
 table.workspace = true
 tokio-postgres = "0.7"
-tokio-postgres-rustls = "0.10"
+tokio-postgres-rustls = { git = "https://github.com/ol-teuto/tokio-postgres-rustls.git", branch = "rustls-update" }
 tokio-test = "0.4"
 
 [build-dependencies]

src/servers/src/postgres/handler.rs

@@ -41,7 +41,11 @@ use crate::SqlPlan;
 
 #[async_trait]
 impl SimpleQueryHandler for PostgresServerHandler {
-    async fn do_query<'a, C>(&self, _client: &C, query: &'a str) -> PgWireResult<Vec<Response<'a>>>
+    async fn do_query<'a, C>(
+        &self,
+        _client: &mut C,
+        query: &'a str,
+    ) -> PgWireResult<Vec<Response<'a>>>
     where
         C: ClientInfo + Unpin + Send + Sync,
     {

src/servers/src/tls.rs

@@ -15,8 +15,9 @@
 use std::fs::File;
 use std::io::{BufReader, Error, ErrorKind};
 
-use rustls::{Certificate, PrivateKey, ServerConfig};
+use rustls::ServerConfig;
 use rustls_pemfile::{certs, pkcs8_private_keys, rsa_private_keys};
+use rustls_pki_types::{CertificateDer, PrivateKeyDer};
 use serde::{Deserialize, Serialize};
 use strum::EnumString;
 
@@ -77,19 +78,20 @@ impl TlsOption {
             return Ok(None);
         }
         let cert = certs(&mut BufReader::new(File::open(&self.cert_path)?))
-            .map_err(|_| Error::new(ErrorKind::InvalidInput, "invalid cert"))
-            .map(|mut certs| certs.drain(..).map(Certificate).collect())?;
+            .collect::<Result<Vec<CertificateDer>, Error>>()?;
 
         let key = {
             let mut pkcs8 = pkcs8_private_keys(&mut BufReader::new(File::open(&self.key_path)?))
-                .map_err(|_| Error::new(ErrorKind::InvalidInput, "invalid key"))?;
+                .map(|key| key.map(PrivateKeyDer::from))
+                .collect::<Result<Vec<PrivateKeyDer>, Error>>()?;
             if !pkcs8.is_empty() {
-                PrivateKey(pkcs8.remove(0))
+                pkcs8.remove(0)
             } else {
                 let mut rsa = rsa_private_keys(&mut BufReader::new(File::open(&self.key_path)?))
-                    .map_err(|_| Error::new(ErrorKind::InvalidInput, "invalid key"))?;
+                    .map(|key| key.map(PrivateKeyDer::from))
+                    .collect::<Result<Vec<PrivateKeyDer>, Error>>()?;
                 if !rsa.is_empty() {
-                    PrivateKey(rsa.remove(0))
+                    rsa.remove(0)
                 } else {
                     return Err(Error::new(ErrorKind::InvalidInput, "invalid key"));
                 }
@@ -98,7 +100,6 @@ impl TlsOption {
 
         // TODO(SSebo): with_client_cert_verifier if TlsMode is Required.
         let config = ServerConfig::builder()
-            .with_safe_defaults()
             .with_no_client_auth()
             .with_single_cert(cert, key)
             .map_err(|err| std::io::Error::new(ErrorKind::InvalidInput, err))?;

src/servers/tests/postgres/mod.rs

@@ -14,7 +14,7 @@
 
 use std::net::SocketAddr;
 use std::sync::Arc;
-use std::time::{Duration, SystemTime};
+use std::time::Duration;
 
 use auth::tests::{DatabaseAuthInfo, MockUserProvider};
 use auth::UserProviderRef;
@@ -23,8 +23,9 @@ use common_runtime::Builder as RuntimeBuilder;
 use pgwire::api::Type;
 use rand::rngs::StdRng;
 use rand::Rng;
-use rustls::client::{ServerCertVerified, ServerCertVerifier};
-use rustls::{Certificate, Error, ServerName};
+use rustls::client::danger::{ServerCertVerified, ServerCertVerifier};
+use rustls::{Error, SignatureScheme};
+use rustls_pki_types::{CertificateDer, ServerName};
 use servers::error::Result;
 use servers::postgres::PostgresServer;
 use servers::server::Server;
@@ -386,7 +387,6 @@ async fn create_secure_connection(
     };
 
     let mut config = rustls::ClientConfig::builder()
-        .with_safe_defaults()
         .with_root_certificates(rustls::RootCertStore::empty())
         .with_no_client_auth();
     config
@@ -455,16 +455,45 @@ fn unwrap_results(resp: &[SimpleQueryMessage]) -> Vec<&str> {
     resp.iter().filter_map(|m| resolve_result(m, 0)).collect()
 }
 
+#[derive(Debug)]
 struct AcceptAllVerifier {}
 impl ServerCertVerifier for AcceptAllVerifier {
+    fn verify_tls12_signature(
+        &self,
+        _message: &[u8],
+        _cert: &CertificateDer<'_>,
+        _dss: &rustls::DigitallySignedStruct,
+    ) -> std::result::Result<rustls::client::danger::HandshakeSignatureValid, Error> {
+        Ok(rustls::client::danger::HandshakeSignatureValid::assertion())
+    }
+
+    fn verify_tls13_signature(
+        &self,
+        _message: &[u8],
+        _cert: &CertificateDer<'_>,
+        _dss: &rustls::DigitallySignedStruct,
+    ) -> std::result::Result<rustls::client::danger::HandshakeSignatureValid, Error> {
+        Ok(rustls::client::danger::HandshakeSignatureValid::assertion())
+    }
+
+    fn supported_verify_schemes(&self) -> Vec<rustls::SignatureScheme> {
+        vec![
+            SignatureScheme::ECDSA_NISTP384_SHA384,
+            SignatureScheme::ECDSA_NISTP256_SHA256,
+            SignatureScheme::RSA_PSS_SHA512,
+            SignatureScheme::RSA_PSS_SHA384,
+            SignatureScheme::RSA_PSS_SHA256,
+            SignatureScheme::ED25519,
+        ]
+    }
+
     fn verify_server_cert(
         &self,
-        _end_entity: &Certificate,
-        _intermediates: &[Certificate],
-        _server_name: &ServerName,
-        _scts: &mut dyn Iterator<Item = &[u8]>,
+        _end_entity: &CertificateDer<'_>,
+        _intermediates: &[CertificateDer<'_>],
+        _server_name: &ServerName<'_>,
         _ocsp_response: &[u8],
-        _now: SystemTime,
+        _now: rustls_pki_types::UnixTime,
     ) -> std::result::Result<ServerCertVerified, Error> {
         Ok(ServerCertVerified::assertion())
     }