postgres: support for upstream SSL #23990
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Signed-off-by: Christoph Pakulski <[email protected]>
Signed-off-by: Christoph Pakulski <[email protected]>
Signed-off-by: Christoph Pakulski <[email protected]>
Signed-off-by: Christoph Pakulski <[email protected]>
Signed-off-by: Christoph Pakulski <[email protected]>
Signed-off-by: Christoph Pakulski <[email protected]>
Signed-off-by: Christoph Pakulski <[email protected]>
Signed-off-by: Christoph Pakulski <[email protected]>
Signed-off-by: Christoph Pakulski <[email protected]>
Signed-off-by: Christoph Pakulski <[email protected]>
Signed-off-by: Christoph Pakulski <[email protected]>
Signed-off-by: Christoph Pakulski <[email protected]>
Signed-off-by: Christoph Pakulski <[email protected]>
Signed-off-by: Christoph Pakulski <[email protected]>
Signed-off-by: Christoph Pakulski <[email protected]>
…sts. Signed-off-by: Christoph Pakulski <[email protected]>
|
@lizan. Friendly ping 😊. |
lizan
reviewed
Nov 30, 2022
api/contrib/envoy/extensions/filters/network/postgres_proxy/v3alpha/postgres_proxy.proto
Outdated
Show resolved
Hide resolved
api/contrib/envoy/extensions/filters/network/postgres_proxy/v3alpha/postgres_proxy.proto
Outdated
Show resolved
Hide resolved
Signed-off-by: Christoph Pakulski <[email protected]>
Signed-off-by: Christoph Pakulski <[email protected]>
Signed-off-by: Christoph Pakulski <[email protected]>
|
@lizan ping! |
lizan
approved these changes
Dec 7, 2022
|
Will run Postgres regression tests over this commit to make sure we didn't break anything. |
jpsim
added a commit
that referenced
this pull request
Dec 8, 2022
…-cpp-to-latest-version * origin/main: (23 commits) Reduce Route memory utilization by avoiding RuntimeData instances when not needed (#24327) build: fix compile error for mac (#24429) postgres: support for upstream SSL (#23990) iOS: split `EnvoyEngine.h` into multiple header files (#24397) mobile: check for pending exceptions after JNI call (#24361) Remove uneccessary `this->` from mobile engine builder (#24389) Add setRequestDecoder to ResponseEncoder interface (#24368) downstream: refactoring code to remove listener hard deps (#24394) lb api: moving load balancing policy specific configuration to extension configuration (#23967) ci: Skip docker/examples verification for docs or mobile only changes (#24417) ci: run mobile GitHub Actions on every PR (#24407) mobile: remove `bump_lyft_support_rotation.sh` script (#24404) Add file size to DirectoryEntry (#24176) bazel: update to 6.0.0rc4 (#24235) bazel: update rules_rust (#24409) Ecds config dump recommit (#24384) bazel: add another config_setting incompatible flag (#24270) listeners: moving listeners to extension directory (#24248) mobile: build Swift with whole module optimization (#24396) ci: update `actions/setup-java` from v1 to v3.8 (#24393) ... Signed-off-by: JP Simard <[email protected]>
|
Thanks @fabriziomello ! I hope it passed 😀. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Commit Message:
postgres: support for upstream SSL
Additional Description:
Postgres filter can negotiate upstream SSL connection with Postgres server and enable upstream encryption.
Upon receiving the initial postgres request, the filter buffers the received packet (without sending it) and sends to the upstream server a request to establish SSL connection. When the server agrees, the postgres filter enables upstream STARTTLS transport socket and sends the previously buffered initial packet. From now on, the connection to upstream is encrypted and the filter can read the postgres payloads in clear-text.
If the server does not agree for SSL or converting STARTTLS transport socket to secure mode fails, depending on the configuration, the filter may continue in clear-text or may tear down the connection.
Risk Level: Low
Testing: unit, integration and manual tests.
Docs Changes: yes.
Release Notes: yes
Platform Specific Features: No
Fixes #19527