upstream

type Attempt ¶

type Attempt struct {
	// TLS is the configuration for an encrypted attempt, or nil for plaintext.
	TLS *tls.Config
}

Attempt is one way of reaching the target. A nil TLS config means "connect in plaintext"; a non-nil one means "encrypt with exactly this config".

func (a Attempt) Encrypted() bool

type DialFunc ¶

type DialFunc func(ctx context.Context) (net.Conn, error)

DialFunc opens the raw transport to the target — directly, or through the SSH bastion chain. Connectors never dial themselves: the caller injects this so the proxy and the probe provably traverse the same tunnel.

type MySQLConfig ¶

type MySQLConfig struct {
	// Host and Port name the target. They build the address go-mysql reports
	// in its errors and the TLS server name; the transport itself comes from
	// the injected DialFunc.
	Host string
	Port int
	// Username, Password and Database are the stored upstream credentials.
	Username string
	Password string
	Database string
	// ProgramName is the "program_name" connection attribute, so a DBA reading
	// performance_schema.session_connect_attrs can tell who is connected.
	ProgramName string
	// SSLMode is the row's ssl_mode; interpreted by PlanFor.
	SSLMode string
}

MySQLConfig is everything a MySQL/MariaDB login needs from a server row.

type MySQLUpstream ¶

type MySQLUpstream struct {
	// Conn is the live go-mysql client connection.
	Conn *gomysqlclient.Conn
	// TLS reports whether the connection is encrypted.
	TLS bool
}

MySQLUpstream is an authenticated MySQL/MariaDB connection plus the one fact the row could not state: whether it ended up encrypted.

func ConnectMySQL(ctx context.Context, dial DialFunc, cfg MySQLConfig) (*MySQLUpstream, error)

func (u *MySQLUpstream) Close() error

type OracleConfig ¶

type OracleConfig struct {
	// Host and Port build the DSN go-ora reports in its errors; the transport
	// comes from the injected DialFunc.
	Host string
	Port int
	// ServiceName is the SERVICE_NAME to present, already resolved by the
	// caller (the dedicated column, or the database name as a fallback).
	ServiceName string
	// Username and Password are the stored upstream credentials.
	Username string
	Password string
	// ProgramName is the PROGRAM option, so a DBA reading v$session can tell
	// who is connected.
	ProgramName string
	// SSLMode is the row's ssl_mode; interpreted by PlanFor.
	SSLMode string
}

OracleConfig is everything an Oracle login needs from a server row.

type Plan ¶

type Plan struct {
	// Mode is the ssl_mode this plan was built from, kept for error messages.
	Mode string
	// Attempts are the permitted ways to connect, in preference order. Never
	// empty.
	Attempts []Attempt
}

Plan is the ordered list of attempts an ssl_mode authorizes, best first. It is the *only* place dbbat decides what an ssl_mode means — every protocol, on both the proxy side and the probe side, reads its policy from here.

Not every protocol can honor the *order*, and that is the one place where the single policy still produces more than one behavior. Read the list as the SET of attempts a mode permits; the order is advisory and only binding for protocols that can act on it:

• PostgreSQL negotiates in band (SSLRequest / 'S' / 'N') and so never walks the list: it reads OffersTLS and AllowsPlaintext and nothing else. Under `allow` it therefore behaves exactly like `prefer` — it offers TLS and upgrades if the server says yes. That is the pre-existing behavior of both the proxy and libpq-with-one-round-trip, it errs toward encryption, and re-ordering it would cost a second dial for no confidentiality gain.
• MySQL (CLIENT_SSL capability) and MongoDB (TLS from the first byte) cannot negotiate in band, so they redial between attempts and DO honor the order: `allow` really is plaintext-first for them.
• Oracle only reads RequiresTLS: the opportunistic modes never encrypt. See the note on ConnectOracle.

So `allow` is the only mode whose meaning still varies by protocol, and it varies within what the mode permits — never outside it. `disable`, `require` and the verify-* modes have a single attempt each, so order cannot apply and every protocol agrees exactly.

func PlanFor(mode, host string) Plan

func (p Plan) AllowsPlaintext() bool

func (p Plan) OffersTLS() bool

func (p Plan) PrefersTLS() bool

func (p Plan) RequiresTLS() bool

func (p Plan) TLSConfig() *tls.Config

type PostgresAuthError ¶

type PostgresAuthError struct {
	// Response is the upstream's ErrorResponse, copied out of pgproto3's
	// reusable buffer.
	Response *pgproto3.ErrorResponse
}

PostgresAuthError is an ErrorResponse the upstream sent during login. It keeps the raw message so the proxy can hand its own client the server's verbatim error instead of a paraphrase, and unwraps to ErrPostgresAuthFailed so callers that only classify can use errors.Is.

func (e *PostgresAuthError) Error() string

func (e *PostgresAuthError) Unwrap() error

type PostgresConfig ¶

type PostgresConfig struct {
	// Host is the target hostname. Used only for TLS server-name
	// verification — the transport comes from the injected DialFunc.
	Host string
	// Username, Password and Database are the stored upstream credentials.
	Username string
	Password string
	Database string
	// ApplicationName is advertised in the StartupMessage, so a DBA reading
	// pg_stat_activity can tell who is connected and why.
	ApplicationName string
	// SSLMode is the row's ssl_mode; interpreted by PlanFor.
	SSLMode string
}

PostgresConfig is everything the login needs from a server row. The caller resolves it (decrypting the password, building the application name) so this package stays free of store and crypto concerns.

type PostgresUpstream ¶

type PostgresUpstream struct {
	// Conn is the live connection — TLS-wrapped when the negotiation upgraded.
	Conn net.Conn
	// Frontend speaks pgproto3 over Conn with dbbat in the client role.
	Frontend *pgproto3.Frontend
	// ParameterStatuses are the server's startup parameters, in arrival order.
	// Copies: pgproto3 reuses its message structs.
	ParameterStatuses []*pgproto3.ParameterStatus
	// BackendKeyData is the cancellation key the server issued, or nil when it
	// issued none.
	BackendKeyData *pgproto3.BackendKeyData
	// ReadyForQuery is the message that ended the login.
	ReadyForQuery *pgproto3.ReadyForQuery
	// TLS reports whether the connection is encrypted. It answers "are we
	// actually encrypted?" for a row whose ssl_mode only expressed a
	// preference.
	TLS bool
}

PostgresUpstream is an authenticated upstream connection, plus everything the login produced that a proxy has to replay to its own client.

The connector stops the instant the upstream is authenticated and ready: it does not forward anything, set session state, or register cancel keys. The proxy does that from these fields; the connectivity check ignores them and closes Conn.

func ConnectPostgres(ctx context.Context, dial DialFunc, cfg PostgresConfig, logger *slog.Logger) (*PostgresUpstream, error)

func (u *PostgresUpstream) Close() error