You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@iggy.apache.org by "hubcio (via GitHub)" <gi...@apache.org> on 2026/06/12 11:12:32 UTC
[PR] feat(cluster): add TLS 1.3 to replica plane with PSK channel binding [iggy]
hubcio opened a new pull request, #3461:
URL: https://github.com/apache/iggy/pull/3461
The replica port carried plaintext: the PSK handshake authenticates
cluster membership but gives no confidentiality, and encryption was
delegated to out-of-band tunnels (WireGuard/VPC). Replica traffic
now supports in-process TLS behind an opt-in [cluster.tls] table.
TLS session state cannot cross shard boundaries, so shard 0 no
longer runs the PSK handshake before delegating: it blindly ships
the raw fd right after accept or dial, and the owning shard wraps
it and runs the handshake inside the TLS stream, both under one
handshake_grace budget. With handshakes no longer serialized on
shard 0, unauthenticated inflight connections get a global cap: a
shard-0 slot table, an outcome ack from the owning shard, and a
deadline that reclaims slots when an ack is lost. The same ack
clears a pending-dial set that stops the periodic reconnect sweep
from double-dialing a peer whose handshake is still in flight.
When the owning shard is shard 0 itself the ack releases inline
on the local bus instead of self-sending a frame.
TLS 1.3 only, ALPN "iggy-replica". Two cert modes mirror the
legacy TcpTlsConfig shape: CA files (default; the new ca_file
anchors the dialer, a TLS-client role the server plane never has)
and self_signed (auto-generated cert, accept-any verifier). Both
modes require cluster.auth: neither carries client certificates,
so TLS authenticates the acceptor only and the PSK handshake stays
the sole peer authenticator. The PSK MAC absorbs the TLS exporter
value plus a mode byte: a relay MITM terminating both legs
produces two different exporters and the handshake fails. The
exporter is only reachable by handshaking with futures-rustls
directly and converting into the compio-tls stream via its public
From impls; a tripwire test pins that route. The transcript change
is wire-incompatible with the previous MAC, acceptable while
server-ng is unreleased.
Also fixes framing::write_message never flushing: rustls holds
ciphertext in its internal buffer until flushed, so handshake
frames written over TLS never reached the wire (no-op on plain
TCP).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@iggy.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(cluster): add TLS 1.3 to replica plane with PSK channel binding [iggy]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #3461:
URL: https://github.com/apache/iggy/pull/3461#issuecomment-4690672211
## [Codecov](https://app.codecov.io/gh/apache/iggy/pull/3461?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 72.72%. Comparing base ([`843457d`](https://app.codecov.io/gh/apache/iggy/commit/843457d1f72d9ddd4df7398258a96ee146572508?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`52e0463`](https://app.codecov.io/gh/apache/iggy/commit/52e0463dace241eeafd191d7e08a33063d93523c?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
:warning: Report is 1 commits behind head on master.
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## master #3461 +/- ##
============================================
- Coverage 74.56% 72.72% -1.84%
Complexity 937 937
============================================
Files 1249 1186 -63
Lines 123564 118410 -5154
Branches 99839 99284 -555
============================================
- Hits 92133 86112 -6021
- Misses 28448 29408 +960
+ Partials 2983 2890 -93
```
| [Components](https://app.codecov.io/gh/apache/iggy/pull/3461/components?src=pr&el=components&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [Rust Core](https://app.codecov.io/gh/apache/iggy/pull/3461/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `75.69% <ø> (-0.01%)` | :arrow_down: |
| [Java SDK](https://app.codecov.io/gh/apache/iggy/pull/3461/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `58.57% <ø> (ø)` | |
| [C# SDK](https://app.codecov.io/gh/apache/iggy/pull/3461/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `69.92% <ø> (ø)` | |
| [Python SDK](https://app.codecov.io/gh/apache/iggy/pull/3461/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `81.06% <ø> (ø)` | |
| [PHP SDK](https://app.codecov.io/gh/apache/iggy/pull/3461/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `83.57% <ø> (ø)` | |
| [Node SDK](https://app.codecov.io/gh/apache/iggy/pull/3461/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `87.27% <ø> (-4.08%)` | :arrow_down: |
| [Go SDK](https://app.codecov.io/gh/apache/iggy/pull/3461/components?src=pr&el=component&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `15.35% <ø> (-24.90%)` | :arrow_down: |
| [Files with missing lines](https://app.codecov.io/gh/apache/iggy/pull/3461?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [core/configs/src/server\_config/cluster.rs](https://app.codecov.io/gh/apache/iggy/pull/3461?src=pr&el=tree&filepath=core%2Fconfigs%2Fsrc%2Fserver_config%2Fcluster.rs&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-Y29yZS9jb25maWdzL3NyYy9zZXJ2ZXJfY29uZmlnL2NsdXN0ZXIucnM=) | `100.00% <ø> (ø)` | |
| [core/configs/src/server\_config/defaults.rs](https://app.codecov.io/gh/apache/iggy/pull/3461?src=pr&el=tree&filepath=core%2Fconfigs%2Fsrc%2Fserver_config%2Fdefaults.rs&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-Y29yZS9jb25maWdzL3NyYy9zZXJ2ZXJfY29uZmlnL2RlZmF1bHRzLnJz) | `77.65% <ø> (ø)` | |
| [core/configs/src/server\_config/validators.rs](https://app.codecov.io/gh/apache/iggy/pull/3461?src=pr&el=tree&filepath=core%2Fconfigs%2Fsrc%2Fserver_config%2Fvalidators.rs&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-Y29yZS9jb25maWdzL3NyYy9zZXJ2ZXJfY29uZmlnL3ZhbGlkYXRvcnMucnM=) | `75.55% <ø> (ø)` | |
| [core/message\_bus/src/connector.rs](https://app.codecov.io/gh/apache/iggy/pull/3461?src=pr&el=tree&filepath=core%2Fmessage_bus%2Fsrc%2Fconnector.rs&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-Y29yZS9tZXNzYWdlX2J1cy9zcmMvY29ubmVjdG9yLnJz) | `96.49% <ø> (+7.15%)` | :arrow_up: |
| [core/message\_bus/src/framing.rs](https://app.codecov.io/gh/apache/iggy/pull/3461?src=pr&el=tree&filepath=core%2Fmessage_bus%2Fsrc%2Fframing.rs&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-Y29yZS9tZXNzYWdlX2J1cy9zcmMvZnJhbWluZy5ycw==) | `79.01% <ø> (-0.26%)` | :arrow_down: |
| [core/message\_bus/src/installer/mod.rs](https://app.codecov.io/gh/apache/iggy/pull/3461?src=pr&el=tree&filepath=core%2Fmessage_bus%2Fsrc%2Finstaller%2Fmod.rs&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-Y29yZS9tZXNzYWdlX2J1cy9zcmMvaW5zdGFsbGVyL21vZC5ycw==) | `66.66% <ø> (+4.16%)` | :arrow_up: |
| [core/message\_bus/src/installer/replica.rs](https://app.codecov.io/gh/apache/iggy/pull/3461?src=pr&el=tree&filepath=core%2Fmessage_bus%2Fsrc%2Finstaller%2Freplica.rs&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-Y29yZS9tZXNzYWdlX2J1cy9zcmMvaW5zdGFsbGVyL3JlcGxpY2EucnM=) | `84.24% <ø> (+0.81%)` | :arrow_up: |
| [core/message\_bus/src/installer/tcp.rs](https://app.codecov.io/gh/apache/iggy/pull/3461?src=pr&el=tree&filepath=core%2Fmessage_bus%2Fsrc%2Finstaller%2Ftcp.rs&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-Y29yZS9tZXNzYWdlX2J1cy9zcmMvaW5zdGFsbGVyL3RjcC5ycw==) | `93.95% <ø> (ø)` | |
| [core/message\_bus/src/lib.rs](https://app.codecov.io/gh/apache/iggy/pull/3461?src=pr&el=tree&filepath=core%2Fmessage_bus%2Fsrc%2Flib.rs&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-Y29yZS9tZXNzYWdlX2J1cy9zcmMvbGliLnJz) | `89.19% <ø> (ø)` | |
| [core/message\_bus/src/replica/auth.rs](https://app.codecov.io/gh/apache/iggy/pull/3461?src=pr&el=tree&filepath=core%2Fmessage_bus%2Fsrc%2Freplica%2Fauth.rs&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-Y29yZS9tZXNzYWdlX2J1cy9zcmMvcmVwbGljYS9hdXRoLnJz) | `93.19% <ø> (ø)` | |
| ... and [9 more](https://app.codecov.io/gh/apache/iggy/pull/3461?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | |
... and [123 files with indirect coverage changes](https://app.codecov.io/gh/apache/iggy/pull/3461/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
</details>
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@iggy.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(cluster): add TLS 1.3 to replica plane with PSK channel binding [iggy]
Posted by "krishvishal (via GitHub)" <gi...@apache.org>.
krishvishal merged PR #3461:
URL: https://github.com/apache/iggy/pull/3461
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@iggy.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org