Skip to content

Commit

Permalink
Tiny nits to help with rustls migration
Browse files Browse the repository at this point in the history
  • Loading branch information
nyurik committed Sep 30, 2023
1 parent 0f1bd9e commit d48ef47
Show file tree
Hide file tree
Showing 3 changed files with 17 additions and 16 deletions.
2 changes: 1 addition & 1 deletion martin/Cargo.toml
Original file line number Diff line number Diff line change
Expand Up @@ -65,10 +65,10 @@ brotli.workspace = true
clap.workspace = true
deadpool-postgres.workspace = true
env_logger.workspace = true
json-patch.workspace = true
flate2.workspace = true
futures.workspace = true
itertools.workspace = true
json-patch.workspace = true
log.workspace = true
martin-mbtiles.workspace = true
martin-tile-utils.workspace = true
Expand Down
12 changes: 6 additions & 6 deletions martin/src/pg/errors.rs
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
use deadpool_postgres::tokio_postgres::Error;
use deadpool_postgres::tokio_postgres::Error as TokioPgError;
use deadpool_postgres::{BuildError, PoolError};
use semver::Version;

Expand Down Expand Up @@ -31,7 +31,7 @@ pub enum PgError {
UnknownSslMode(deadpool_postgres::tokio_postgres::config::SslMode),

#[error("Postgres error while {1}: {0}")]
PostgresError(#[source] Error, &'static str),
PostgresError(#[source] TokioPgError, &'static str),

#[error("Unable to build a Postgres connection pool {1}: {0}")]
PostgresPoolBuildError(#[source] BuildError, String),
Expand All @@ -40,7 +40,7 @@ pub enum PgError {
PostgresPoolConnError(#[source] PoolError, String),

#[error("Unable to parse connection string {1}: {0}")]
BadConnectionString(#[source] Error, String),
BadConnectionString(#[source] TokioPgError, String),

#[error("Unable to parse PostGIS version {1}: {0}")]
BadPostgisVersion(#[source] semver::Error, String),
Expand All @@ -52,11 +52,11 @@ pub enum PgError {
InvalidTableExtent(String, String),

#[error("Error preparing a query for the tile '{1}' ({2}): {3} {0}")]
PrepareQueryError(#[source] Error, String, String, String),
PrepareQueryError(#[source] TokioPgError, String, String, String),

#[error(r#"Unable to get tile {2:#} from {1}: {0}"#)]
GetTileError(#[source] Error, String, Xyz),
GetTileError(#[source] TokioPgError, String, Xyz),

#[error(r#"Unable to get tile {2:#} with {:?} params from {1}: {0}"#, query_to_json(.3))]
GetTileWithQueryError(#[source] Error, String, Xyz, UrlQuery),
GetTileWithQueryError(#[source] TokioPgError, String, Xyz, UrlQuery),
}
19 changes: 10 additions & 9 deletions martin/src/pg/tls.rs
Original file line number Diff line number Diff line change
Expand Up @@ -12,9 +12,10 @@ use regex::Regex;

use crate::pg::PgError::BadConnectionString;
#[cfg(feature = "ssl")]
use crate::pg::PgError::{BadClientCertError, BadClientKeyError, UnknownSslMode};
#[cfg(feature = "ssl")]
use crate::pg::PgError::{BadTrustedRootCertError, BuildSslConnectorError};
use crate::pg::PgError::{
BadClientCertError, BadClientKeyError, BadTrustedRootCertError, BuildSslConnectorError,
UnknownSslMode,
};
use crate::pg::{PgSslCerts, Result};

/// A temporary workaround for <https://github.com/sfackler/rust-postgres/pull/988>
Expand Down Expand Up @@ -53,21 +54,21 @@ pub fn parse_conn_str(conn_str: &str) -> Result<(Config, SslModeOverride)> {
#[cfg(not(feature = "ssl"))]
#[allow(clippy::unnecessary_wraps)]
pub fn make_connector(
_certs: &PgSslCerts,
_pg_certs: &PgSslCerts,
_ssl_mode: SslModeOverride,
) -> Result<deadpool_postgres::tokio_postgres::NoTls> {
Ok(deadpool_postgres::tokio_postgres::NoTls)
}

#[cfg(feature = "ssl")]
pub fn make_connector(
certs: &PgSslCerts,
pg_certs: &PgSslCerts,
ssl_mode: SslModeOverride,
) -> Result<postgres_openssl::MakeTlsConnector> {
let (verify_ca, verify_hostname) = match ssl_mode {
SslModeOverride::Unmodified(mode) => match mode {
SslMode::Disable | SslMode::Prefer => (false, false),
SslMode::Require => match certs.ssl_root_cert {
SslMode::Require => match pg_certs.ssl_root_cert {
// If a root CA file exists, the behavior of sslmode=require will be the same as
// that of verify-ca, meaning the server certificate is validated against the CA.
// For more details, check out the note about backwards compatibility in
Expand All @@ -86,18 +87,18 @@ pub fn make_connector(
let tls = SslMethod::tls_client();
let mut builder = SslConnector::builder(tls).map_err(BuildSslConnectorError)?;

if let (Some(cert), Some(key)) = (&certs.ssl_cert, &certs.ssl_key) {
if let (Some(cert), Some(key)) = (&pg_certs.ssl_cert, &pg_certs.ssl_key) {
builder
.set_certificate_file(cert, SslFiletype::PEM)
.map_err(|e| BadClientCertError(e, cert.clone()))?;
builder
.set_private_key_file(key, SslFiletype::PEM)
.map_err(|e| BadClientKeyError(e, key.clone()))?;
} else if certs.ssl_key.is_some() || certs.ssl_key.is_some() {
} else if pg_certs.ssl_key.is_some() || pg_certs.ssl_key.is_some() {
warn!("SSL client certificate and key files must be set to use client certificate with Postgres. Only one of them was set.");
}

if let Some(file) = &certs.ssl_root_cert {
if let Some(file) = &pg_certs.ssl_root_cert {
builder
.set_ca_file(file)
.map_err(|e| BadTrustedRootCertError(e, file.clone()))?;
Expand Down

0 comments on commit d48ef47

Please sign in to comment.