Repository navigation
feat(pgsql): verify TLS certificate identity - #59
Merged
Merged
Conversation
Add strict DNS and IP matching, SAN precedence, safe CN fallback, and DeviceCertificateKit verifier wiring for VERIFY_FULL. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
🟡 Changes recommended
Terminal-dot numeric hosts can bypass IP identity checks and pass DNS/CN matching without an IP SAN, creating a critical certificate-verification vulnerability.
2 open issues
What changed in this PR
This PR enables PostgreSQL VERIFY_FULL certificate identity checks through DeviceCertificateKit, replacing the unsupported-verifier placeholder.
Changes:
- Adds a production certificate adapter behind the existing verification interface.
- Implements strict DNS and wildcard matching, IPv4/IPv6 matching, and SAN precedence with restricted CN fallback.
- Adds tests for identity matching, malformed certificates, error handling, and defensive copies.
| File | Description |
|---|---|
| pgsql/src/test/pgsql/transport/PostgresTls.test.ets | Adds identity-matching and mocked verifier coverage. |
| pgsql/src/main/ets/pgsql/transport/PostgresTcpTransport.ets | Adds platform certificate decoding and host identity verification. |
Review effort: Balanced
Keep canonical and legacy numeric host spellings from falling through to DNS SAN or CN matching when they include a terminal root dot. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
🔵 Needs a closer look
The security-sensitive VERIFY_FULL path now depends on DeviceCertificateKit decoding and SAN/CN extraction, but tests cover only injected seams while real-device certificate and TLS-handshake validation remains deferred to G01.
No open issues 🎉
2 resolved since last review
Review effort: Balanced
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validation
npm run test:arkts -- pgsql— 111 native cases passednode --test --test-concurrency=1 tools\architecture-graph.test.mjs tools\run-ohos-tests.test.mjs tools\driver-contracts.test.mjs— 151 tests passed