mirror of
https://github.com/neondatabase/neon.git
synced 2026-05-22 23:50:39 +00:00
1d642d6a57
Our rust-postgres fork is getting messy. Mostly because proxy wants more
control over the raw protocol than tokio-postgres provides. As such,
it's diverging more and more. Storage and compute also make use of
rust-postgres, but in more normal usage, thus they don't need our crazy
changes.
Idea:
* proxy maintains their subset
* other teams use a minimal patch set against upstream rust-postgres
Reviewing this code will be difficult. To implement it, I
1. Copied tokio-postgres, postgres-protocol and postgres-types from
00940fcdb5
2. Updated their package names with the `2` suffix to make them compile
in the workspace.
3. Updated proxy to use those packages
4. Copied in the code from tokio-postgres-rustls 0.13 (with some patches
applied https://github.com/jbg/tokio-postgres-rustls/pull/32
https://github.com/jbg/tokio-postgres-rustls/pull/33)
5. Removed as much dead code as I could find in the vendored libraries
6. Updated the tokio-postgres-rustls code to use our existing channel
binding implementation
49 lines
1.3 KiB
Rust
49 lines
1.3 KiB
Rust
use crate::config::SslMode;
|
|
use crate::maybe_tls_stream::MaybeTlsStream;
|
|
use crate::tls::private::ForcePrivateApi;
|
|
use crate::tls::TlsConnect;
|
|
use crate::Error;
|
|
use bytes::BytesMut;
|
|
use postgres_protocol2::message::frontend;
|
|
use tokio::io::{AsyncRead, AsyncReadExt, AsyncWrite, AsyncWriteExt};
|
|
|
|
pub async fn connect_tls<S, T>(
|
|
mut stream: S,
|
|
mode: SslMode,
|
|
tls: T,
|
|
) -> Result<MaybeTlsStream<S, T::Stream>, Error>
|
|
where
|
|
S: AsyncRead + AsyncWrite + Unpin,
|
|
T: TlsConnect<S>,
|
|
{
|
|
match mode {
|
|
SslMode::Disable => return Ok(MaybeTlsStream::Raw(stream)),
|
|
SslMode::Prefer if !tls.can_connect(ForcePrivateApi) => {
|
|
return Ok(MaybeTlsStream::Raw(stream))
|
|
}
|
|
SslMode::Prefer | SslMode::Require => {}
|
|
}
|
|
|
|
let mut buf = BytesMut::new();
|
|
frontend::ssl_request(&mut buf);
|
|
stream.write_all(&buf).await.map_err(Error::io)?;
|
|
|
|
let mut buf = [0];
|
|
stream.read_exact(&mut buf).await.map_err(Error::io)?;
|
|
|
|
if buf[0] != b'S' {
|
|
if SslMode::Require == mode {
|
|
return Err(Error::tls("server does not support TLS".into()));
|
|
} else {
|
|
return Ok(MaybeTlsStream::Raw(stream));
|
|
}
|
|
}
|
|
|
|
let stream = tls
|
|
.connect(stream)
|
|
.await
|
|
.map_err(|e| Error::tls(e.into()))?;
|
|
|
|
Ok(MaybeTlsStream::Tls(stream))
|
|
}
|