From 47dd6b5b8fa7bcb51b6171e94506647d95b2ea4b Mon Sep 17 00:00:00 2001 From: Nia Weiss Date: Thu, 27 Aug 2020 10:49:01 -0400 Subject: [PATCH] fix postgres endpoint config --- cmd/export.go | 2 +- cmd/import.go | 2 +- ctl/common.go | 12 ++++++------ ctl/server.go | 11 +++++++++-- pg/protocol.go | 10 ++++++++-- server/server.go | 2 +- 6 files changed, 26 insertions(+), 13 deletions(-) diff --git a/cmd/export.go b/cmd/export.go index 25ca5f5a0..bceedb98a 100644 --- a/cmd/export.go +++ b/cmd/export.go @@ -50,7 +50,7 @@ The file does not contain any headers. flags.StringVarP(&Exporter.Index, "index", "i", "", "Pilosa index to export") flags.StringVarP(&Exporter.Field, "field", "f", "", "Field to export") flags.StringVarP(&Exporter.Path, "output-file", "o", "", "File to write export to - default stdout") - ctl.SetTLSConfig(flags, &Exporter.TLS.CertificatePath, &Exporter.TLS.CertificateKeyPath, &Exporter.TLS.CACertPath, &Exporter.TLS.SkipVerify, &Exporter.TLS.EnableClientVerification) + ctl.SetTLSConfig(flags, "", &Exporter.TLS.CertificatePath, &Exporter.TLS.CertificateKeyPath, &Exporter.TLS.CACertPath, &Exporter.TLS.SkipVerify, &Exporter.TLS.EnableClientVerification) return exportCmd } diff --git a/cmd/import.go b/cmd/import.go index c18db2b0d..cd091dc9a 100644 --- a/cmd/import.go +++ b/cmd/import.go @@ -63,7 +63,7 @@ omitted. If it is present then its format should be YYYY-MM-DDTHH:MM. flags.BoolVarP(&Importer.Sort, "sort", "", false, "Enables sorting before import.") flags.BoolVarP(&Importer.CreateSchema, "create", "e", false, "Create the schema if it does not exist before import.") flags.BoolVarP(&Importer.Clear, "clear", "", false, "Clear the data provided in the import.") - ctl.SetTLSConfig(flags, &Importer.TLS.CertificatePath, &Importer.TLS.CertificateKeyPath, &Importer.TLS.CACertPath, &Importer.TLS.SkipVerify, &Importer.TLS.EnableClientVerification) + ctl.SetTLSConfig(flags, "", &Importer.TLS.CertificatePath, &Importer.TLS.CertificateKeyPath, &Importer.TLS.CACertPath, &Importer.TLS.SkipVerify, &Importer.TLS.EnableClientVerification) return importCmd } diff --git a/ctl/common.go b/ctl/common.go index db788246e..8cd22451c 100644 --- a/ctl/common.go +++ b/ctl/common.go @@ -31,12 +31,12 @@ type CommandWithTLSSupport interface { } // SetTLSConfig creates common TLS flags -func SetTLSConfig(flags *pflag.FlagSet, certificatePath *string, certificateKeyPath *string, caCertPath *string, skipVerify *bool, enableClientVerification *bool) { - flags.StringVarP(certificatePath, "tls.certificate", "", "", "TLS certificate path (usually has the .crt or .pem extension)") - flags.StringVarP(certificateKeyPath, "tls.key", "", "", "TLS certificate key path (usually has the .key extension)") - flags.StringVarP(caCertPath, "tls.ca-certificate", "", "", "TLS CA certificate path (usually has the .pem extension)") - flags.BoolVarP(skipVerify, "tls.skip-verify", "", false, "Skip TLS certificate server verification (not secure)") - flags.BoolVarP(enableClientVerification, "tls.enable-client-verification", "", false, "Enable TLS certificate client verification for incoming connections") +func SetTLSConfig(flags *pflag.FlagSet, prefix string, certificatePath *string, certificateKeyPath *string, caCertPath *string, skipVerify *bool, enableClientVerification *bool) { + flags.StringVarP(certificatePath, prefix+"tls.certificate", "", "", "TLS certificate path (usually has the .crt or .pem extension)") + flags.StringVarP(certificateKeyPath, prefix+"tls.key", "", "", "TLS certificate key path (usually has the .key extension)") + flags.StringVarP(caCertPath, prefix+"tls.ca-certificate", "", "", "TLS CA certificate path (usually has the .pem extension)") + flags.BoolVarP(skipVerify, prefix+"tls.skip-verify", "", false, "Skip TLS certificate server verification (not secure)") + flags.BoolVarP(enableClientVerification, prefix+"tls.enable-client-verification", "", false, "Enable TLS certificate client verification for incoming connections") } // commandClient returns a pilosa.InternalHTTPClient for the command diff --git a/ctl/server.go b/ctl/server.go index 378f951a3..859266038 100644 --- a/ctl/server.go +++ b/ctl/server.go @@ -36,7 +36,7 @@ func BuildServerFlags(cmd *cobra.Command, srv *server.Command) { flags.Uint64Var(&srv.Config.MaxFileCount, "max-file-count", srv.Config.MaxFileCount, "Soft limit on the maximum number of fragment files Pilosa keeps open simultaneously.") // TLS - SetTLSConfig(flags, &srv.Config.TLS.CertificatePath, &srv.Config.TLS.CertificateKeyPath, &srv.Config.TLS.CACertPath, &srv.Config.TLS.SkipVerify, &srv.Config.TLS.EnableClientVerification) + SetTLSConfig(flags, "", &srv.Config.TLS.CertificatePath, &srv.Config.TLS.CertificateKeyPath, &srv.Config.TLS.CACertPath, &srv.Config.TLS.SkipVerify, &srv.Config.TLS.EnableClientVerification) // Handler flags.StringSliceVarP(&srv.Config.Handler.AllowedOrigins, "handler.allowed-origins", "", []string{}, "Comma separated list of allowed origin URIs (for CORS/WebUI).") @@ -90,5 +90,12 @@ func BuildServerFlags(cmd *cobra.Command, srv *server.Command) { flags.StringVarP(&srv.Config.Txsrc, "tx", "", "", "transaction/storage to use: one of roaring, rbf, badger, rbf_roaring, roaring_rbf, badger_roaring, roaring_badger, badger_rbf, or rbf_badger (default roaring)") // Postgres endpoint - flags.StringVar(&srv.Config.Postgres.Addr, "postgres.addr", "", "address to which to bind a postgres endpoint") + flags.StringVar(&srv.Config.Postgres.Addr, "postgres.addr", srv.Config.Postgres.Addr, "address to which to bind a postgres endpoint (leave blank to disable)") + SetTLSConfig(flags, "postgres.", &srv.Config.Postgres.TLS.CertificatePath, &srv.Config.Postgres.TLS.CertificateKeyPath, &srv.Config.Postgres.TLS.CACertPath, &srv.Config.Postgres.TLS.SkipVerify, &srv.Config.Postgres.TLS.EnableClientVerification) + flags.BoolVar(&srv.Config.Postgres.RequireTLS, "postgres.tls.require", srv.Config.Postgres.RequireTLS, "Require TLS on all incoming postgres connections.") + flags.DurationVar((*time.Duration)(&srv.Config.Postgres.StartupTimeout), "postgres.startup-timeout", time.Duration(srv.Config.Postgres.StartupTimeout), "Timeout for postgres connection startup. (set 0 to disable)") + flags.DurationVar((*time.Duration)(&srv.Config.Postgres.ReadTimeout), "postgres.read-timeout", time.Duration(srv.Config.Postgres.ReadTimeout), "Timeout for reads on a postgres connection. (set 0 to disable; does not include connection idling)") + flags.DurationVar((*time.Duration)(&srv.Config.Postgres.WriteTimeout), "postgres.write-timeout", time.Duration(srv.Config.Postgres.WriteTimeout), "Timeout for writes on a postgres connection. (set 0 to disable)") + flags.Uint32Var(&srv.Config.Postgres.MaxStartupSize, "postgres.max-startup-size", srv.Config.Postgres.MaxStartupSize, "Maximum acceptable size of a postgres startup packet, in bytes. (set 0 to disable)") + flags.Uint16Var(&srv.Config.Postgres.ConnectionLimit, "postgres.connection-limit", srv.Config.Postgres.ConnectionLimit, "Maximum number of simultaneous postgres connections to allow. (set 0 to disable)") } diff --git a/pg/protocol.go b/pg/protocol.go index 2267b1ca7..60c9af541 100644 --- a/pg/protocol.go +++ b/pg/protocol.go @@ -73,9 +73,17 @@ func (p Protocol) String() string { // handle reads the startup packet and dispatches an appropriate protocol handler for the connection. func (s *Server) handle(ctx context.Context, conn net.Conn) (err error) { + var hasTLS bool + defer func() { cerr := conn.Close() if cerr != nil && err == nil { + if hasTLS { + if nerr, ok := cerr.(net.Error); ok && nerr.Timeout() { + // TLS does this sometimes. + return + } + } err = errors.Wrap(cerr, "closing connection") } }() @@ -100,8 +108,6 @@ func (s *Server) handle(ctx context.Context, conn net.Conn) (err error) { } } - var hasTLS bool - startup: // Read startup packet. var buf [4]byte diff --git a/server/server.go b/server/server.go index aa9919c2b..df15981c8 100644 --- a/server/server.go +++ b/server/server.go @@ -181,7 +181,7 @@ func (m *Command) Start() (err error) { if m.Config.Postgres.TLS.CertificatePath != "" { conf, err := GetTLSConfig(&m.Config.Postgres.TLS, m.logger.Logger()) if err != nil { - return errors.Wrap(err, "settuing up postgres TLS") + return errors.Wrap(err, "setting up postgres TLS") } tlsConf = conf }