Documentation
¶
Index ¶
- Constants
- Variables
- func ConvertYesNo(s string) (bool, error)
- func CreateCertificateVerifier(rootCertPool *x509.CertPool, hostname string) func([][]byte, [][]*x509.Certificate) error
- func DialThroughTunnel(ctx context.Context, client *ssh.Client, network, addr string) (net.Conn, error)
- func FormatErrorWithQuery(err error, query string) error
- func GetSSHClient(ctx context.Context, ds *storepb.DataSource) (*ssh.Client, error)
- func GetTLSConfig(ds *storepb.DataSource) (*tls.Config, error)
- type DeadlineConn
- type SSLMode
Constants ¶
const SSHTimeout = 30 * time.Second
SSHTimeout bounds both the SSH transport handshake (TCP connect, version exchange and key agreement) and opening a TCP channel through an established tunnel. A bastion that accepts the TCP connection but never completes the handshake, or never answers a channel request, must not be able to hold a caller — and one of the instance's connection slots — forever.
Variables ¶
var PortFIFO = make(chan int, sshPortSize)
PortFIFO is the fifo for SSH client port queue.
Functions ¶
func CreateCertificateVerifier ¶
func CreateCertificateVerifier(rootCertPool *x509.CertPool, hostname string) func([][]byte, [][]*x509.Certificate) error
CreateCertificateVerifier returns a verification function that properly handles intermediate certificates and validates the hostname matches the certificate. This is exported for use by database drivers that need custom certificate verification.
func DialThroughTunnel ¶
func DialThroughTunnel(ctx context.Context, client *ssh.Client, network, addr string) (net.Conn, error)
DialThroughTunnel opens a connection to addr from the SSH server. The channel open is bounded by the shorter of the caller's deadline and SSHTimeout, so a host that keeps the SSH session but never answers a channel request cannot hold a caller — for instance for the whole 15 minutes of a sync — forever. The returned connection is not tied to the context.
func FormatErrorWithQuery ¶
FormatErrorWithQuery will format the error with failed query.
func GetSSHClient ¶
GetSSHClient returns an SSH client for ds.
The server's host key is checked against the data source's ssh_host_key; a data source that lists no key is refused, because the tunnel carries the database credentials in clear text and any host that answers on ssh_host could otherwise collect them.
func GetTLSConfig ¶
func GetTLSConfig(ds *storepb.DataSource) (*tls.Config, error)
GetTLSConfig gets the TLS config for connection.
Types ¶
type DeadlineConn ¶
DeadlineConn adapts a tunnel connection, which rejects net.Conn deadlines ("ssh: tcpChan: deadline not supported"), to drivers that interrupt a blocked query by setting one. pgx watches the statement context and sets the connection deadline when it is cancelled or times out; this connection closes the tunnel at that moment, which unblocks the pending read or write, where a no-op implementation let the stalled query run on.
func (*DeadlineConn) Close ¶
func (c *DeadlineConn) Close() error
Close stops the deadline timer before closing the tunnel.
func (*DeadlineConn) SetDeadline ¶
func (c *DeadlineConn) SetDeadline(deadline time.Time) error
func (*DeadlineConn) SetReadDeadline ¶
func (c *DeadlineConn) SetReadDeadline(deadline time.Time) error
func (*DeadlineConn) SetWriteDeadline ¶
func (c *DeadlineConn) SetWriteDeadline(deadline time.Time) error
type SSLMode ¶
type SSLMode string
SSLMode is the PGSSLMode type. https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNECT-SSLMODE
func GetPGSSLMode ¶
func GetPGSSLMode(ds *storepb.DataSource) SSLMode
GetPGSSLMode is used only when SSL is enabled. We should consider allowing user to override this default in the future even if SSL is enabled.
Source Files