mirror of
https://github.com/neondatabase/neon.git
synced 2025-12-23 06:09:59 +00:00
d9ced89ec0
https://github.com/neondatabase/cloud/issues/23008 For TLS between proxy and compute, we are using an internally provisioned CA to sign the compute certificates. This change ensures that proxy will load them from a supplied env var pointing to the correct file - this file and env var will be configured later, using a kubernetes secret. Control plane responds with a `server_name` field if and only if the compute uses TLS. This server name is the name we use to validate the certificate. Control plane still sends us the IP to connect to as well (to support overlay IP). To support this change, I'd had to split `host` and `host_addr` into separate fields. Using `host_addr` and bypassing `lookup_addr` if possible (which is what happens in production). `host` then is only used for the TLS connection. There's no blocker to merging this. The code paths will not be triggered until the new control plane is deployed and the `enableTLS` compute flag is enabled on a project.
74 lines
2.1 KiB
Rust
74 lines
2.1 KiB
Rust
use std::future::Future;
|
|
use std::io;
|
|
use std::net::{IpAddr, SocketAddr};
|
|
use std::time::Duration;
|
|
|
|
use tokio::net::{self, TcpStream};
|
|
use tokio::time;
|
|
|
|
use crate::Error;
|
|
use crate::config::Host;
|
|
|
|
pub(crate) async fn connect_socket(
|
|
host_addr: Option<IpAddr>,
|
|
host: &Host,
|
|
port: u16,
|
|
connect_timeout: Option<Duration>,
|
|
) -> Result<TcpStream, Error> {
|
|
match host {
|
|
Host::Tcp(host) => {
|
|
let addrs = match host_addr {
|
|
Some(addr) => vec![SocketAddr::new(addr, port)],
|
|
None => net::lookup_host((&**host, port))
|
|
.await
|
|
.map_err(Error::connect)?
|
|
.collect(),
|
|
};
|
|
|
|
let mut last_err = None;
|
|
|
|
for addr in addrs {
|
|
let stream =
|
|
match connect_with_timeout(TcpStream::connect(addr), connect_timeout).await {
|
|
Ok(stream) => stream,
|
|
Err(e) => {
|
|
last_err = Some(e);
|
|
continue;
|
|
}
|
|
};
|
|
|
|
stream.set_nodelay(true).map_err(Error::connect)?;
|
|
|
|
return Ok(stream);
|
|
}
|
|
|
|
Err(last_err.unwrap_or_else(|| {
|
|
Error::connect(io::Error::new(
|
|
io::ErrorKind::InvalidInput,
|
|
"could not resolve any addresses",
|
|
))
|
|
}))
|
|
}
|
|
}
|
|
}
|
|
|
|
async fn connect_with_timeout<F, T>(connect: F, timeout: Option<Duration>) -> Result<T, Error>
|
|
where
|
|
F: Future<Output = io::Result<T>>,
|
|
{
|
|
match timeout {
|
|
Some(timeout) => match time::timeout(timeout, connect).await {
|
|
Ok(Ok(socket)) => Ok(socket),
|
|
Ok(Err(e)) => Err(Error::connect(e)),
|
|
Err(_) => Err(Error::connect(io::Error::new(
|
|
io::ErrorKind::TimedOut,
|
|
"connection timed out",
|
|
))),
|
|
},
|
|
None => match connect.await {
|
|
Ok(socket) => Ok(socket),
|
|
Err(e) => Err(Error::connect(e)),
|
|
},
|
|
}
|
|
}
|