opensource/teleport
3
0
Fork 0
mirror of https://github.com/gravitational/teleport.git synced 2026-09-21 14:12:20 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix flaky postgres local proxy tests (#23355)

Browse Source 
* Configure non-tunnel local proxy to check certs,
  which tests the local proxy as it would actually be
  configured and eliminates a connection close race
  caused by the local proxy *not* inspecting connections.
This commit is contained in:
Gavin Frazar
2023-03-21 18:53:30 +00:00
committed by GitHub
parent de71133238
commit a21a9cfa36
2 changed files with 31 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integration/proxy/proxy_test.go
+18 -2
View File
@@ -642,7 +642,15 @@ func TestALPNSNIProxyDatabaseAccess(t *testing.T) {
})
t.Run("postgres", func(t *testing.T) {
lp := mustStartALPNLocalProxy(t, pack.Root.Cluster.SSHProxy, alpncommon.ProtocolPostgres)
lp := mustStartALPNLocalProxyWithConfig(t, alpnproxy.LocalProxyConfig{
RemoteProxyAddr: pack.Root.Cluster.SSHProxy,
Protocols: []alpncommon.Protocol{alpncommon.ProtocolPostgres},
InsecureSkipVerify: true,
// Since this a non-tunnel local proxy, we should check certs are needed
// for postgres.
// (this is how a local proxy would actually be configured for postgres).
CheckCertsNeeded: true,
})
t.Run("connect to main cluster via proxy", func(t *testing.T) {
client, err := postgres.MakeTestClient(context.Background(), common.TestClientConfig{
AuthClient: pack.Root.Cluster.GetSiteAPI(pack.Root.Cluster.Secrets.SiteName),
@@ -680,7 +688,15 @@ func TestALPNSNIProxyDatabaseAccess(t *testing.T) {
mustClosePostgresClient(t, client)
})
t.Run("connect to main cluster via proxy with ping protocol", func(t *testing.T) {
pingProxy := mustStartALPNLocalProxy(t, pack.Root.Cluster.SSHProxy, alpncommon.ProtocolWithPing(alpncommon.ProtocolPostgres))
pingProxy := mustStartALPNLocalProxyWithConfig(t, alpnproxy.LocalProxyConfig{
RemoteProxyAddr: pack.Root.Cluster.SSHProxy,
Protocols: []alpncommon.Protocol{alpncommon.ProtocolWithPing(alpncommon.ProtocolPostgres)},
InsecureSkipVerify: true,
// Since this a non-tunnel local proxy, we should check certs are needed
// for postgres.
// (this is how a local proxy would actually be configured for postgres).
CheckCertsNeeded: true,
})
client, err := postgres.MakeTestClient(context.Background(), common.TestClientConfig{
AuthClient: pack.Root.Cluster.GetSiteAPI(pack.Root.Cluster.Secrets.SiteName),
AuthServer: pack.Root.Cluster.Process.GetAuthServer(),
lib/srv/alpnproxy/proxy_test.go
+13 -2
View File
@@ -295,6 +295,10 @@ func TestLocalProxyPostgresProtocol(t *testing.T) {
SNI: "localhost",
ParentContext: context.Background(),
InsecureSkipVerify: true,
// Since this a non-tunnel local proxy, we should check certs are needed
// for postgres.
// (this is how a local proxy would actually be configured for postgres).
CheckCertsNeeded: true,
}
mustStartLocalProxy(t, localProxyConfig)
@@ -302,8 +306,8 @@ func TestLocalProxyPostgresProtocol(t *testing.T) {
conn, err := net.Dial("tcp", localProxyListener.Addr().String())
require.NoError(t, err)
// we have to send a request so that the local proxy will inspect
// the client conn, see it's not a CancelRequest, and determine
// we have to send a request because the local proxy will inspect
// the client conn. It should see it's not a CancelRequest, and determine
// that certs are not needed.
mustSendPostgresMsg(t, conn, &pgproto3.SSLRequest{})
@@ -678,6 +682,10 @@ func TestProxyPingConnections(t *testing.T) {
}
return nil
},
// Since this a non-tunnel local proxy, we should check certs are needed
// for postgres.
// (this is how a local proxy would actually be configured for postgres).
CheckCertsNeeded: protocol == common.ProtocolPostgres,
}
mustStartLocalProxy(t, localProxyConfig)
@@ -695,6 +703,9 @@ func TestProxyPingConnections(t *testing.T) {
}
if protocol == common.ProtocolPostgres {
// we have to send a request because the local proxy will inspect
// the client conn. It should see it's not a CancelRequest, and determine
// that certs are not needed.
mustSendPostgresMsg(t, conn, &pgproto3.SSLRequest{})
}