mirror of
https://github.com/neondatabase/neon.git
synced 2026-01-09 06:22:57 +00:00
8f651f9582
## Problem Ref: https://github.com/neondatabase/neon/issues/10632 We use dns named `*.localtest.me` in our test, and that domain is well-known and widely used for that, with all the records there resolve to the localhost, both IPv4 and IPv6: `127.0.0.1` and `::1` In some cases on our runners these addresses resolves only to `IPv6`, and so components fail to connect when runner doesn't have `IPv6` address. We suspect issue in systemd-resolved here (https://github.com/systemd/systemd/issues/17745) To workaround that and improve test stability, we introduced our own domain `*.local.neon.build` with IPv4 address `127.0.0.1` only See full details and troubleshoot log in referred issue. p.s. If you're FritzBox user, don't forget to add that domain `local.neon.build` to the `DNS Rebind Protection` section under `Home Network -> Network -> Network Settings`, otherwise FritzBox will block addresses, resolving to the local addresses. For other devices/vendors, please check corresponding documentation, if resolving `local.neon.build` will produce empty answer for you. ## Summary of changes Replace all the occurrences of `localtest.me` with `local.neon.build`
77 lines
2.7 KiB
Python
77 lines
2.7 KiB
Python
from __future__ import annotations
|
|
|
|
import psycopg2
|
|
import pytest
|
|
from fixtures.neon_fixtures import (
|
|
NeonProxy,
|
|
VanillaPostgres,
|
|
)
|
|
|
|
TABLE_NAME = "neon_control_plane.endpoints"
|
|
|
|
|
|
# Proxy uses the same logic for psql and websockets.
|
|
@pytest.mark.asyncio
|
|
async def test_proxy_psql_allowed_ips(static_proxy: NeonProxy, vanilla_pg: VanillaPostgres):
|
|
# Shouldn't be able to connect to this project
|
|
vanilla_pg.safe_psql(
|
|
f"INSERT INTO {TABLE_NAME} (endpoint_id, allowed_ips) VALUES ('private-project', '8.8.8.8')"
|
|
)
|
|
# Should be able to connect to this project
|
|
vanilla_pg.safe_psql(
|
|
f"INSERT INTO {TABLE_NAME} (endpoint_id, allowed_ips) VALUES ('generic-project', '::1,127.0.0.1')"
|
|
)
|
|
|
|
def check_cannot_connect(**kwargs):
|
|
with pytest.raises(psycopg2.Error) as exprinfo:
|
|
static_proxy.safe_psql(**kwargs)
|
|
text = str(exprinfo.value).strip()
|
|
assert "not allowed to connect" in text
|
|
|
|
# no SNI, deprecated `options=project` syntax (before we had several endpoint in project)
|
|
check_cannot_connect(query="select 1", sslsni=0, options="project=private-project")
|
|
|
|
# no SNI, new `options=endpoint` syntax
|
|
check_cannot_connect(query="select 1", sslsni=0, options="endpoint=private-project")
|
|
|
|
# with SNI
|
|
check_cannot_connect(query="select 1", host="private-project.local.neon.build")
|
|
|
|
# no SNI, deprecated `options=project` syntax (before we had several endpoint in project)
|
|
out = static_proxy.safe_psql(query="select 1", sslsni=0, options="project=generic-project")
|
|
assert out[0][0] == 1
|
|
|
|
# no SNI, new `options=endpoint` syntax
|
|
out = static_proxy.safe_psql(query="select 1", sslsni=0, options="endpoint=generic-project")
|
|
assert out[0][0] == 1
|
|
|
|
# with SNI
|
|
out = static_proxy.safe_psql(query="select 1", host="generic-project.local.neon.build")
|
|
assert out[0][0] == 1
|
|
|
|
|
|
@pytest.mark.asyncio
|
|
async def test_proxy_http_allowed_ips(static_proxy: NeonProxy, vanilla_pg: VanillaPostgres):
|
|
static_proxy.safe_psql("create user http_auth with password 'http' superuser")
|
|
|
|
# Shouldn't be able to connect to this project
|
|
vanilla_pg.safe_psql(
|
|
f"INSERT INTO {TABLE_NAME} (endpoint_id, allowed_ips) VALUES ('proxy', '8.8.8.8')"
|
|
)
|
|
|
|
def query(status: int, query: str, *args):
|
|
static_proxy.http_query(
|
|
query,
|
|
args,
|
|
user="http_auth",
|
|
password="http",
|
|
expected_code=status,
|
|
)
|
|
|
|
query(400, "select 1;") # ip address is not allowed
|
|
# Should be able to connect to this project
|
|
vanilla_pg.safe_psql(
|
|
f"UPDATE {TABLE_NAME} SET allowed_ips = '8.8.8.8,127.0.0.1' WHERE endpoint_id = 'proxy'"
|
|
)
|
|
query(200, "select 1;") # should work now
|