From a21a9cfa36a68d9dfaee070fa2e9f034a8d42d90 Mon Sep 17 00:00:00 2001 From: Gavin Frazar Date: Tue, 21 Mar 2023 11:53:30 -0700 Subject: [PATCH] Fix flaky postgres local proxy tests (#23355) * Configure non-tunnel local proxy to check certs, which tests the local proxy as it would actually be configured and eliminates a connection close race caused by the local proxy *not* inspecting connections. --- integration/proxy/proxy_test.go | 20 ++++++++++++++++++-- lib/srv/alpnproxy/proxy_test.go | 15 +++++++++++++-- 2 files changed, 31 insertions(+), 4 deletions(-) diff --git a/integration/proxy/proxy_test.go b/integration/proxy/proxy_test.go index 2e378088d48..926d6d4f3fb 100644 --- a/integration/proxy/proxy_test.go +++ b/integration/proxy/proxy_test.go @@ -642,7 +642,15 @@ func TestALPNSNIProxyDatabaseAccess(t *testing.T) { }) t.Run("postgres", func(t *testing.T) { - lp := mustStartALPNLocalProxy(t, pack.Root.Cluster.SSHProxy, alpncommon.ProtocolPostgres) + lp := mustStartALPNLocalProxyWithConfig(t, alpnproxy.LocalProxyConfig{ + RemoteProxyAddr: pack.Root.Cluster.SSHProxy, + Protocols: []alpncommon.Protocol{alpncommon.ProtocolPostgres}, + InsecureSkipVerify: true, + // Since this a non-tunnel local proxy, we should check certs are needed + // for postgres. + // (this is how a local proxy would actually be configured for postgres). + CheckCertsNeeded: true, + }) t.Run("connect to main cluster via proxy", func(t *testing.T) { client, err := postgres.MakeTestClient(context.Background(), common.TestClientConfig{ AuthClient: pack.Root.Cluster.GetSiteAPI(pack.Root.Cluster.Secrets.SiteName), @@ -680,7 +688,15 @@ func TestALPNSNIProxyDatabaseAccess(t *testing.T) { mustClosePostgresClient(t, client) }) t.Run("connect to main cluster via proxy with ping protocol", func(t *testing.T) { - pingProxy := mustStartALPNLocalProxy(t, pack.Root.Cluster.SSHProxy, alpncommon.ProtocolWithPing(alpncommon.ProtocolPostgres)) + pingProxy := mustStartALPNLocalProxyWithConfig(t, alpnproxy.LocalProxyConfig{ + RemoteProxyAddr: pack.Root.Cluster.SSHProxy, + Protocols: []alpncommon.Protocol{alpncommon.ProtocolWithPing(alpncommon.ProtocolPostgres)}, + InsecureSkipVerify: true, + // Since this a non-tunnel local proxy, we should check certs are needed + // for postgres. + // (this is how a local proxy would actually be configured for postgres). + CheckCertsNeeded: true, + }) client, err := postgres.MakeTestClient(context.Background(), common.TestClientConfig{ AuthClient: pack.Root.Cluster.GetSiteAPI(pack.Root.Cluster.Secrets.SiteName), AuthServer: pack.Root.Cluster.Process.GetAuthServer(), diff --git a/lib/srv/alpnproxy/proxy_test.go b/lib/srv/alpnproxy/proxy_test.go index eb182fe1cd4..d0d6765258c 100644 --- a/lib/srv/alpnproxy/proxy_test.go +++ b/lib/srv/alpnproxy/proxy_test.go @@ -295,6 +295,10 @@ func TestLocalProxyPostgresProtocol(t *testing.T) { SNI: "localhost", ParentContext: context.Background(), InsecureSkipVerify: true, + // Since this a non-tunnel local proxy, we should check certs are needed + // for postgres. + // (this is how a local proxy would actually be configured for postgres). + CheckCertsNeeded: true, } mustStartLocalProxy(t, localProxyConfig) @@ -302,8 +306,8 @@ func TestLocalProxyPostgresProtocol(t *testing.T) { conn, err := net.Dial("tcp", localProxyListener.Addr().String()) require.NoError(t, err) - // we have to send a request so that the local proxy will inspect - // the client conn, see it's not a CancelRequest, and determine + // we have to send a request because the local proxy will inspect + // the client conn. It should see it's not a CancelRequest, and determine // that certs are not needed. mustSendPostgresMsg(t, conn, &pgproto3.SSLRequest{}) @@ -678,6 +682,10 @@ func TestProxyPingConnections(t *testing.T) { } return nil }, + // Since this a non-tunnel local proxy, we should check certs are needed + // for postgres. + // (this is how a local proxy would actually be configured for postgres). + CheckCertsNeeded: protocol == common.ProtocolPostgres, } mustStartLocalProxy(t, localProxyConfig) @@ -695,6 +703,9 @@ func TestProxyPingConnections(t *testing.T) { } if protocol == common.ProtocolPostgres { + // we have to send a request because the local proxy will inspect + // the client conn. It should see it's not a CancelRequest, and determine + // that certs are not needed. mustSendPostgresMsg(t, conn, &pgproto3.SSLRequest{}) }