proxy: Relax endpoint check (#6503)

## Problem

http-over-sql allowes host to be in format api.aws.... however it's not
the case for the websocket flow.

## Summary of changes

Relax endpoint check for the ws serverless connections.
This commit is contained in:
Anna Khanova
2024-01-28 22:27:14 +01:00
committed by GitHub
parent 3a82430432
commit 8253cf1931
3 changed files with 18 additions and 15 deletions
+12 -8
View File
@@ -2,7 +2,8 @@
use crate::{
auth::password_hack::parse_endpoint_param, context::RequestMonitoring, error::UserFacingError,
metrics::NUM_CONNECTION_ACCEPTED_BY_SNI, proxy::NeonOptions, EndpointId, RoleName,
metrics::NUM_CONNECTION_ACCEPTED_BY_SNI, proxy::NeonOptions, serverless::SERVERLESS_DRIVER_SNI,
EndpointId, RoleName,
};
use itertools::Itertools;
use pq_proto::StartupMessageParams;
@@ -54,10 +55,10 @@ impl ComputeUserInfoMaybeEndpoint {
}
}
pub fn endpoint_sni<'a>(
sni: &'a str,
pub fn endpoint_sni(
sni: &str,
common_names: &HashSet<String>,
) -> Result<&'a str, ComputeUserInfoParseError> {
) -> Result<Option<EndpointId>, ComputeUserInfoParseError> {
let Some((subdomain, common_name)) = sni.split_once('.') else {
return Err(ComputeUserInfoParseError::UnknownCommonName { cn: sni.into() });
};
@@ -66,7 +67,10 @@ pub fn endpoint_sni<'a>(
cn: common_name.into(),
});
}
Ok(subdomain)
if subdomain == SERVERLESS_DRIVER_SNI {
return Ok(None);
}
Ok(Some(EndpointId::from(subdomain)))
}
impl ComputeUserInfoMaybeEndpoint {
@@ -85,7 +89,6 @@ impl ComputeUserInfoMaybeEndpoint {
// record the values if we have them
ctx.set_application(params.get("application_name").map(SmolStr::from));
ctx.set_user(user.clone());
ctx.set_endpoint_id(sni.map(EndpointId::from));
// Project name might be passed via PG's command-line options.
let endpoint_option = params
@@ -103,7 +106,7 @@ impl ComputeUserInfoMaybeEndpoint {
let endpoint_from_domain = if let Some(sni_str) = sni {
if let Some(cn) = common_names {
Some(EndpointId::from(endpoint_sni(sni_str, cn)?))
endpoint_sni(sni_str, cn)?
} else {
None
}
@@ -117,12 +120,13 @@ impl ComputeUserInfoMaybeEndpoint {
Some(Err(InconsistentProjectNames { domain, option }))
}
// Invariant: project name may not contain certain characters.
(a, b) => a.or(b).map(|name| match project_name_valid(&name) {
(a, b) => a.or(b).map(|name| match project_name_valid(name.as_ref()) {
false => Err(MalformedProjectName(name)),
true => Ok(name),
}),
}
.transpose()?;
ctx.set_endpoint_id(endpoint.clone());
info!(%user, project = endpoint.as_deref(), "credentials");
if sni.is_some() {