rust/neon
1
0
Fork 0
mirror of https://github.com/neondatabase/neon.git synced 2026-05-30 11:30:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

IP allowlist on the proxy side (#5906)

Browse Source 
## Problem

Per-project IP allowlist:
https://github.com/neondatabase/cloud/issues/8116

## Summary of changes

Implemented IP filtering on the proxy side. 

To retrieve ip allowlist for all scenarios, added `get_auth_info` call
to the control plane for:
* sql-over-http
* password_hack
* cleartext_hack

Added cache with ttl for sql-over-http path

This might slow down a bit, consider using redis in the future.

---------

Co-authored-by: Conrad Ludgate <conrad@neon.tech>
This commit is contained in:
Anna Khanova
2023-11-30 14:14:33 +01:00
committed by GitHub
parent 1e57ddaabc
commit e12e2681e9
23 changed files with 601 additions and 115 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
proxy/src/serverless/sql_over_http.rs
View File

@@ -1,3 +1,4 @@
use std::net::SocketAddr;
use std::sync::Arc;
use anyhow::bail;
@@ -201,11 +202,19 @@ pub async fn handle(
sni_hostname: Option<String>,
conn_pool: Arc<GlobalConnPool>,
session_id: uuid::Uuid,
peer_addr: SocketAddr,
config: &'static HttpConfig,
) -> Result<Response<Body>, ApiError> {
let result = tokio::time::timeout(
config.timeout,
handle_inner(config, request, sni_hostname, conn_pool, session_id),
handle_inner(
config,
request,
sni_hostname,
conn_pool,
session_id,
peer_addr,
),
)
.await;
let mut response = match result {
@@ -292,6 +301,7 @@ async fn handle_inner(
sni_hostname: Option<String>,
conn_pool: Arc<GlobalConnPool>,
session_id: uuid::Uuid,
peer_addr: SocketAddr,
) -> anyhow::Result<Response<Body>> {
NUM_CONNECTIONS_ACCEPTED_COUNTER
.with_label_values(&["http"])
@@ -351,7 +361,9 @@ async fn handle_inner(
let body = hyper::body::to_bytes(request.into_body()).await?;
let payload: Payload = serde_json::from_slice(&body)?;
let mut client = conn_pool.get(&conn_info, !allow_pool, session_id).await?;
let mut client = conn_pool
.get(&conn_info, !allow_pool, session_id, peer_addr)
.await?;
let mut response = Response::builder()
.status(StatusCode::OK)