Repository navigation
fix(linux): TLS file checks, connect errors and keyring wording - #3467
Merged
Merged
Conversation
Require checked no certificate and dropped the file, where libpq and the mysql client verify against it. A saved Require with a CA file now loads as Verify full, so it fails closed instead of connecting unchecked.
A CA or key path of /dev/zero filled memory and a FIFO held a runtime worker forever. PostgreSQL, MySQL and SQL Server now build their TLS setup on the blocking pool.
Only a client certificate rustls refused is ClientIdentityInvalid now; tablepro-net reports it as TlsSetupError::ClientIdentity.
SQLSTATE 28000 is now DriverError::LoginRefused: it still parks the session, but the app words it as a refused login and offers no Enter Password.
Every imported entry now gets a suffix when another entry holds its name, and an added one drops the file's last-opened time.
MySQL over a direct route hides the server name row, so a name mismatch there offered a button that opened a row nobody could see.
A new entry that reached the same host, user and database replaced the saved one, its name and its read-only switch included. Only the entry the dialog was reopened on is written over now. The test that pinned the old match is replaced.
With TLS off an active attacker can ask sqlx-mysql 0.9 for mysql_clear_password on the first handshake, and the in-band RSA key is unauthenticated. sqlx has no option to refuse either, so the docs and the mode's subtitle now say so.
The window test that matched the old toast text now matches the new one.
…curity # Conflicts: # linux/crates/app/src/ui/session_window/connect_failed_page.rs
Signed-off-by: Dat Ngo Quoc <datlechin@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
require_with_ca_file_is_refusedon all four engines.tablepro_net::tls::set_up_off_runtime).FileCreateFlags::PRIVATE).last_opened_at.TlsSetupError::ClientIdentity, other trust store failures areOther. SQLSTATE 28000 (pg_hba) isDriverError::LoginRefused, not a wrong password, with no Enter Password.a_connect_from_new_connection_never_writes_over_a_saved_entry.docs/drivers/mysql.mdand ADR 0009 say the password can travel in clear text. sqlx-mysql 0.9 has no switch to refuse it.deny.toml: drop thezip@8.6.0yanked entry, since crates.io no longer lists 8.6.0 as yanked; the three RUSTSEC ignores stay.secret_retrywindow test updated for the new keyring toast text.