Skip to content

Rustls vulnerability fix #419

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jakewimmer wants to merge 4 commits into
base: main
Choose a base branch
from
Open

Rustls vulnerability fix #419

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d46e4c0
chore(deps): upgrade rustls stack to 0.23 and resolve CVEs
jakewimmer May 11, 2026
0e90db7
chore(deps): bump azure_identity 0.5.0 -> 0.20.0
jakewimmer May 12, 2026
66030d2
ci: modernize GitHub Actions workflow
jakewimmer May 11, 2026
6247684
test: port stranded async-std tests to #[test_on_runtimes]
jakewimmer May 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
123 changes: 74 additions & 49 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,30 +8,32 @@ jobs:
clippy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v1
- uses: actions-rs/toolchain@v1
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
components: clippy
override: true
persist-credentials: false
- uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
with:
toolchain: stable
components: clippy
- uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
- name: Install dependencies
run: sudo apt install -y openssl libkrb5-dev
- uses: actions-rs/clippy-check@v1
with:
token: ${{ secrets.GITHUB_TOKEN }}
args: --features=all
- name: Clippy
run: cargo clippy --features=all -- -D warnings

format:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v2
- uses: actions-rs/toolchain@v1
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
components: rustfmt
override: true
- uses: mbrobbel/rustfmt-check@master
persist-credentials: false
- uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
with:
token: ${{ secrets.GITHUB_TOKEN }}
toolchain: stable
components: rustfmt
- name: Rustfmt
run: cargo fmt --check

cargo-test-linux:
runs-on: ubuntu-latest
Expand All @@ -57,20 +59,27 @@ jobs:
RUSTFLAGS: "-Dwarnings"

steps:
- uses: actions/checkout@v2
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false

- uses: actions-rs/toolchain@v1
- uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
with:
toolchain: stable

- uses: actions/cache@v2
- name: Compute cache key
shell: bash
run: |
key="${{ matrix.features }}"
key="${key//,/+}"
echo "RUST_CACHE_KEY=$key" >> "$GITHUB_ENV"

- uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
with:
path: |
~/.cargo/registry
~/.cargo/git
target
key: ${{ runner.os }}-cargo-${{ matrix.features }}
shared-key: ${{ env.RUST_CACHE_KEY }}

- name: Start SQL Server ${{matrix.database}}
run: DOCKER_BUILDKIT=1 docker-compose -f docker-compose.yml up -d mssql-${{matrix.database}}
run: DOCKER_BUILDKIT=1 docker compose -f docker-compose.yml up -d mssql-${{matrix.database}}

- name: Install dependencies
run: sudo apt install -y openssl libkrb5-dev
Expand All @@ -96,41 +105,39 @@ jobs:
TIBERIUS_TEST_CONNECTION_STRING: "server=tcp:127.0.0.1,1433;IntegratedSecurity=true;TrustServerCertificate=true"

steps:
- uses: actions/checkout@v2
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false

- uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
with:
toolchain: stable

- uses: actions-rs/toolchain@v1
- name: Compute cache key
shell: bash
run: |
key="${{ matrix.features }}"
key="${key//,/+}"
echo "RUST_CACHE_KEY=$key" >> "$GITHUB_ENV"

- uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
with:
shared-key: ${{ env.RUST_CACHE_KEY }}

- name: Set required PowerShell modules
id: psmodulecache
uses: potatoqualitee/psmodulecache@v1
uses: potatoqualitee/psmodulecache@ee5e9494714abf56f6efbfa51527b2aec5c761b8 # v6.2.1
with:
modules-to-cache: SqlServer

- name: Setup PowerShell module cache
id: cacher
uses: actions/cache@v2
with:
path: ${{ steps.psmodulecache.outputs.modulepath }}
key: ${{ steps.psmodulecache.outputs.keygen }}

- name: Setup Chocolatey download cache
id: chococache
uses: actions/cache@v2
uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
with:
path: C:\Users\runneradmin\AppData\Local\Temp\chocolatey\
key: chocolatey-install

- name: Setup Cargo build cache
uses: actions/cache@v2
with:
path: |
C:\Users\runneradmin\.cargo\registry
C:\Users\runneradmin\.cargo\git
target
key: ${{ runner.os }}-cargo

- name: Install required PowerShell modules
if: steps.cacher.outputs.cache-hit != 'true'
shell: powershell
run: |
Set-PSRepository PSGallery -InstallationPolicy Trusted
Expand Down Expand Up @@ -189,7 +196,7 @@ jobs:
run: cargo test ${{matrix.features}}

cargo-test-macos:
runs-on: macos-12
runs-on: macos-26-intel

strategy:
fail-fast: false
Expand All @@ -204,14 +211,32 @@ jobs:
TIBERIUS_TEST_CONNECTION_STRING: "server=tcp:localhost,1433;user=SA;password=<YourStrong@Passw0rd>;TrustServerCertificate=true"

steps:
- uses: actions/checkout@v2
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
with:
persist-credentials: false

- uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
with:
toolchain: stable

- name: Compute cache key
shell: bash
run: |
key="${{ matrix.features }}"
key="${key//,/+}"
echo "RUST_CACHE_KEY=$key" >> "$GITHUB_ENV"

- uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
with:
shared-key: ${{ env.RUST_CACHE_KEY }}

- uses: actions-rs/toolchain@v1
- uses: docker/setup-docker-action@b2189fbf2a6592b51fee7cdd93ee2bfaeba733db # v5.1.0

- uses: docker-practice/actions-setup-docker@master
- name: Install docker compose plugin
run: brew install docker-compose

- name: Start SQL Server ${{matrix.database}}
run: DOCKER_BUILDKIT=1 docker-compose -f docker-compose.yml up -d mssql-${{matrix.database}}
run: DOCKER_BUILDKIT=1 docker compose -f docker-compose.yml up -d mssql-${{matrix.database}}

- name: Run tests
run: cargo test ${{matrix.features}}
17 changes: 6 additions & 11 deletions Cargo.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,16 +118,11 @@ version = "1.12.0"
optional = true

[dependencies.tokio-rustls]
version = "0.24.0"
optional = true
features = ["dangerous_configuration"]

[dependencies.rustls-pemfile]
version = "1"
version = "0.26"
optional = true

[dependencies.rustls-native-certs]
version = "0.6"
version = "0.8"
optional = true

[dependencies.opentls]
Expand Down Expand Up @@ -166,10 +161,10 @@ path = "./runtimes-macro"
names = "0.14"
anyhow = "1"
env_logger = "0.9"
azure_identity = "0.5.0"
oauth2 = "4.2.3"
azure_identity = "0.20.0"
oauth2 = "5.0"
url = "2.2.2"
reqwest = "0.11.10"
reqwest = "0.12"
paste = "1.0"
indicatif = "0.17"
chrono = "0.4.38"
Expand Down Expand Up @@ -199,6 +194,6 @@ sql-browser-tokio = ["tokio", "tokio-util"]
sql-browser-smol = ["async-io", "async-net", "futures-lite"]
integrated-auth-gssapi = ["libgssapi"]
bigdecimal = ["bigdecimal_"]
rustls = ["tokio-rustls", "tokio-util", "rustls-pemfile", "rustls-native-certs"]
rustls = ["tokio-rustls", "tokio-util", "rustls-native-certs"]
native-tls = ["async-native-tls"]
vendored-openssl = ["opentls"]
4 changes: 4 additions & 0 deletions docker-compose.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
version: "3"
services:
mssql-2022:
platform: linux/amd64
build:
context: docker/
dockerfile: docker-mssql-2022.dockerfile
Expand All @@ -12,6 +13,7 @@ services:
- "1433:1433"

mssql-2019:
platform: linux/amd64
build:
context: docker/
dockerfile: docker-mssql-2019.dockerfile
Expand All @@ -23,6 +25,7 @@ services:
- "1433:1433"

mssql-2017:
platform: linux/amd64
build:
context: docker/
dockerfile: docker-mssql-2017.dockerfile
Expand All @@ -34,6 +37,7 @@ services:
- "1433:1433"

mssql-azure-sql-edge:
platform: linux/amd64
build:
context: docker/
dockerfile: docker-azure-sql-edge.dockerfile
Expand Down
2 changes: 1 addition & 1 deletion docker/certs/customCA.srl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
0DAEECC45C07F5E06E0DD1B05115C3CFD1A46D9C
0DAEECC45C07F5E06E0DD1B05115C3CFD1A46D9D
4 changes: 3 additions & 1 deletion docker/certs/generate-signed-cert.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,10 @@ set -o pipefail

# Skript creates a custom-signed certificate
# Parameter1 = name of the cert
# Parameter2 = validity in days (default 1825)

CERT_KEY_NAME=$1
CERT_DAYS=${2:-1825}
CERT_FILE=$CERT_KEY_NAME.crt
Comment on lines 10 to 12
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 12, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Validate CERT_DAYS before generating artifacts.

Now that the validity period is caller-controlled, values like 0 or 30d will fail only at the signing step after the key and CSR have already been created. Reject invalid input up front and quote the expansion when invoking OpenSSL.

Suggested fix 
 CERT_KEY_NAME=$1
 CERT_DAYS=${2:-1825}
+if ! [[ "$CERT_DAYS" =~ ^[1-9][0-9]*$ ]]; then
+  echo "CERT_DAYS must be a positive integer" >&2
+  exit 1
+fi
 CERT_FILE=$CERT_KEY_NAME.crt
@@
-  -days $CERT_DAYS
+  -days "$CERT_DAYS"

Also applies to: 37-37

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docker/certs/generate-signed-cert.sh` around lines 10 - 12, Validate the
CERT_DAYS variable before creating keys/CSRs: ensure CERT_DAYS is a positive
integer (e.g., >0) and exit with a clear error if it is not; reference the
variables CERT_DAYS, CERT_KEY_NAME and CERT_FILE to locate the relevant logic
that creates the key/CSR and performs signing. After validation, when invoking
openssl use a quoted expansion of the days parameter (e.g., "$CERT_DAYS") so
non-numeric or spaced values do not get split by the shell; apply the same
validation/quoting wherever CERT_DAYS is used (including the later signing
step).

Copy link
Copy Markdown
Author

@jakewimmer jakewimmer May 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Depending on the CI, it might not be a bad idea to forego bundling pregenerated key material and simply generate a temporary CA and certificate during the test process.

Copy link
Copy Markdown

@coderabbitai coderabbitai Bot May 12, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CodeRabbit chat interactions are restricted to organization members for this repository. Ask an organization member to interact with CodeRabbit, or set chat.allow_non_org_members: true in your configuration.


export CERT_CN=$CERT_KEY_NAME
Expand All @@ -32,7 +34,7 @@ openssl x509 -req \
-CAserial customCA.srl \
-out $CERT_FILE \
-passin file:passphrase.txt \
-days 200
-days $CERT_DAYS

echo Generating PEM format
openssl rsa -in ${CERT_KEY_NAME}.key -out ${CERT_KEY_NAME}-nopassword.key
Expand Down
54 changes: 27 additions & 27 deletions docker/certs/server-full.crt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,33 +1,33 @@
-----BEGIN CERTIFICATE-----
MIIFVDCCAzygAwIBAgIUDa7sxFwH9eBuDdGwURXDz9GkbZwwDQYJKoZIhvcNAQEL
BQAwDzENMAsGA1UEAwwEQWNtZTAeFw0yNDA2MDMxMTQwMzNaFw0yNDEyMjAxMTQw
MzNaMEAxCzAJBgNVBAYTAkRFMQ0wCwYDVQQKDARBY21lMREwDwYDVQQLDAhUaWJl
MIIFVDCCAzygAwIBAgIUDa7sxFwH9eBuDdGwURXDz9GkbZ0wDQYJKoZIhvcNAQEL
BQAwDzENMAsGA1UEAwwEQWNtZTAeFw0yNjA1MTExOTA2MzlaFw0yNzExMDIxOTA2
MzlaMEAxCzAJBgNVBAYTAkRFMQ0wCwYDVQQKDARBY21lMREwDwYDVQQLDAhUaWJl
cml1czEPMA0GA1UEAwwGc2VydmVyMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC
CgKCAgEAztKC7UloJuxGMaOslWm7vEDcd8YkcC9P4PMqDTS0qgr/IXeK1LB1Pt2w
iEY4Bz/Bd3boj2IMgRzT9gjtJoD6Y3Aa32UWp1TgrDtLQ6Bns30d6sNdk7xJ5m9v
qM3ZpJSdLNKolvldcdbUWQkthKUCArNQzHUoHI70PNZGKE6iikWoqvOv4xUq3L8J
e5Ows8fw8NY8TyaJAiHE8zOH0kUyRGaVp2+ku6qNHLFPaLk/iJjlMs1CfsdUNjNN
/N5YhwYxF7ikIhsnNXV7/AHKQeM0z5jlD74VwnquuyXc0Mgq4I99xg7nJXQNLKdU
X7thDJ8BJdKM7i8KKn/UgDoU2USIiF1x8GsqZzFR//LS9lt+n/utduEdBX7Ut0rr
nv2lQZhL4313hyzdv0f5gaEjCAndQXu/oq9SutJDAa3uszHejiyBEWgpfY7xiaTT
xf5XMTue+hbwruXLlX+H0tdH9W/BWuT7+RR3H35nKZ4FLyNG0g3joL5la3WIhRHb
9PP5hZSB6Mf1mnWuBWiJ63MJzAVsfuwyBMir8feRbj+YvI6azPXfkz874OdWnN9F
Zi6GUWy3z4UAwnC0OXO5WwH56gHfZi9u2S70Zho4jPPnF3OP2KrVJSQNrc9qwC1M
0HJNcYw9O4ERnI5OYkclEafrK98VVRPhnuKLDak31jenUh4nwNECAwEAAaN3MHUw
CgKCAgEAqnTgLxZ/eCpB46PPJqOE2IJnopLlpkK2wfp/3b7Wqskiitnr3Llw6iuk
Z0UJQJ38kIkW/UqPiyIsjEfSsRFoGhb3KofTIRd+U7Xug3wLNU1HoxUJUvXKndPk
TOaTkxaHm7wBj4oHIrGuEZGoeOpzI1BeKhhxT3xoqnuA3DjR0umMcPLwsrN1Q4O8
+RD0xZm1sKO/nSx2rN1UfD62MFf+YW2mkjBj7UQnsgANcm5aHHj9l9osPBtOTQ+I
da1ycsJIbOJ7LhfSCTzXN6a/cLuBtAWOdgmARQf1n/TX75AcPOVJCg3fyPVTYvq2
eSfWrYbK6cnRCzI0Sdi2oP0gPHKU3pgGKPSg6sg/WFHvGQRkj+H5AhgkGSfAlghY
sECsduqLJaDZJ+2qxC6c4fGyCYRc29BzdrE51x6VzVL7nwMTVVUeSfRzE5QyrgNX
0TXJUv1qyjo4MG3cqLNRYo73Am8+jFaxCn+a5MKavKOAW+958bdS1NmfeZFXeydG
MCjufiRlF0GBESFnv7JIE+kgn1PYPIrcBbOp7UKAl8VS1bth97eeRIeR/tCyD50r
05b4xj98+KXGLWncPoQ8ojL+9wjagPlVodRJrR+E5HVvG6kN470jLbPaClerEjx8
SqN8VWRb+J84TjL++DaL0kf7Mjyq5cMwhacYPQtPHULLqzoGL+0CAwEAAaN3MHUw
FAYDVR0RBA0wC4IJbG9jYWxob3N0MB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEF
BQcDAjAdBgNVHQ4EFgQUn6la/z79UFTu+LlDc6aDXG+6Tv0wHwYDVR0jBBgwFoAU
RHcTzm1u6x8WiXeAWDblHzwBt9kwDQYJKoZIhvcNAQELBQADggIBAA6sCw60Cr1V
aeFXxpzYKc3dtfKjuD6d5K6kwRkrt2AlsSfEk9fVu4SXbYeISXkL42g9nI02ce4j
o2iCeabgBT7HQVMsSx3KzlCXzXW2ACtma1D87RRQjBJinbCLSHaksZxSsMK6J+3u
MxLIgYIbxP9xGt8PLURkJq5tvJua8WZhdvaUXD1YdLANIzenCL6gHuW6WkzmHJ7E
c5rX/p8njJe7hse0ng04B9eQpuTPGUXYxOs7yMvSb5fNqZZr1EAVhBphDVjR6TuD
KTrh8vCDqHDj1xm00sbnYjzah/znmq+8XAvYGlf7DpuT68ipR914UDGvG4vKcdLz
x+3mcT3tOLfCT0VqlieWiJEdotk6EvFyubP034VxIqwr53ew2+e4m3dw39/HZ+Y1
tggXWwlFpkZS/knLje9kz7F/EOReA4WknFSfm07B0Yv7qZNgTc/Kptw7FgPFTDLL
Cah96vwSny66C1iaRV4ALdAa1/ZNSkD/D6y1oTFGQVgy4KezjwlTA0EvmIS+wves
7jXoTSqO1iBRRl2DfHnzBtWHP1XtSTo7rqDHj6WOb/rEkTsgXqdnA5RQokj8zjLq
zaNaREfrAw55tuOASw0TbWLlv3qDofUlZyqOE6oCgCCjN/0KyqWm5m8lTUJKo6qg
HTMZ5IJXU9f1XKtMHLdGRpx0YiEGTw0e
BQcDAjAdBgNVHQ4EFgQUKTH2Ri4hNDGnL4ifUg7HEbEwhbQwHwYDVR0jBBgwFoAU
RHcTzm1u6x8WiXeAWDblHzwBt9kwDQYJKoZIhvcNAQELBQADggIBAByBbh6Mj+jp
z0Rb2vdiEV4sK0o+ad96p74ZJdiyeTLki8fLSxtKlnlrlhAzY/YFr49KQJKOzbHM
X1aoieL4Si72eprWREyNcXuD2N7tuVnw8/p3WpqW7IKBXSDDdqkdppc1B+LvTBwI
+FXSdou7dPuHgim8fHmoz/ogj+Zf1gvog3ohcnAtj9kN0zfQoBjeyjQ7v81uQ0sx
K8AO+yg/P/IWSNfzEMEGRxT91as9IrV+nmvIfe7k14ljDdJDsf+FRkea9UBOhtJW
G7cqFeWTCBV7W8bjFB0kBF9HE09E2B7hUtYZwOpVruhxXdy7WdzQzx8RWXG/bJnS
qML1bw+sdY+RtfbOr1jy8ctcAg+OmBbR0qLDQeuWlXqjTtxoHViMZpa6lNtIuD8+
1e3+iFJ53djOSgSZ6XW163HI9353nrr1dXtlx7kdPZsb5Z3FXvL940rLiIx69ftR
dP4hP7iWstrUsrwnk6E3OmVwzc+pD8f72ztFhcqI81rmvgJ/MufGvaKoB254OibT
ng4pgs4NF2kKSFmqhXG1dTen2XRlg4ZecLrcCcotdcFX4qPEGcPjjQ4UEEaYhgFW
yWmTUWJEMO9BtqSxUFTZiQ8Ul0cJs16CyAC+oxGhaM92r7w/2xZ7fH4MHGyzJcm6
WY7hfVHCK4+xjXMLn+k5qZYVEPUPe+0s
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
MIIE/zCCAuegAwIBAgIUATFLyERaRfsQiPasMC5l0vrBMUMwDQYJKoZIhvcNAQEL
Expand Down
Loading