4 |
4 | 
4 | 9 |
10 | 11 |12 |
13 | 14 |  15 |  16 | [](https://goreportcard.com/report/github.com/mothership/rds-auth-proxy) 17 | 18 | A two-layer proxy for connecting into RDS postgres databases 19 | based on IAM authentication. 20 | 21 | This tool allows you to keep your databases firewalled off, 22 | manage database access through IAM policies, and no developer 23 | will ever have to share or type a password. 24 | 25 |  26 | 27 |  28 | 29 | This pairs extremely well with a tool like [saml2aws](https://github.com/Versent/saml2aws) 30 | to ensure all AWS/database access uses temporary credentials. 31 | 32 | ## Documentation 33 | 34 | End user documentation is available on our [project site](https://mothership.github.io/rds-auth-proxy/). 35 | 36 | ## Design 37 | 38 | One proxy is run in your VPC subnet that can reach your RDS instances, 39 | the other on your client machine (dev laptop, etc.) with access to 40 | aws credentials. 41 | 42 | The client proxy is responsible for picking a host (RDS instance), and 43 | generating a temporary password based on the local IAM identity. The 44 | client proxy injects the host and password into the postgres startup 45 | message as additional parameters. 46 | 47 |  48 | 49 | The server proxy accepts a connection from the client proxy, and 50 | unpacks the host and password parameters. It then opens a connection 51 | to the RDS database and intercepts the authentication request. It then 52 | passes along the password it received from the client, and forwards the 53 | result to the client. 54 | 55 |  56 | 57 | 58 | ## Releasing 59 | 60 | CI handles building binaries and images on tag events. 61 | 62 | To create a release, start with a dry-run on the main branch: 63 | 64 | ```bash 65 | git checkout main 66 | ./build/release.sh --dry-run 67 | ``` 68 | 69 | Ensure that the changelog looks as expected, then run it for real: 70 | 71 | ```bash 72 | ./build/release.sh 73 | ``` 74 | 75 | -------------------------------------------------------------------------------- /pkg/config/config.go: -------------------------------------------------------------------------------- 1 | package config 2 | 3 | import ( 4 | "github.com/mothership/rds-auth-proxy/pkg/pg" 5 | "github.com/spf13/viper" 6 | ) 7 | 8 | const ( 9 | defaultKubeConfigPath = "$HOME/.kube/config" 10 | defaultListenAddr = "0.0.0.0:8000" 11 | ) 12 | 13 | type ConfigFile struct { 14 | Proxy Proxy `mapstructure:"proxy"` 15 | Targets map[string]*Target `mapstructure:"targets"` 16 | ProxyTargets map[string]*ProxyTarget `mapstructure:"upstream_proxies"` 17 | } 18 | 19 | type Proxy struct { 20 | ListenAddr string `mapstructure:"listen_addr"` 21 | SSL ServerSSL `mapstructure:"ssl"` 22 | ACL ACL `mapstructure:"target_acl"` 23 | } 24 | 25 | func LoadConfig(filepath string) (ConfigFile, error) { 26 | var config ConfigFile 27 | if filepath != "" { 28 | viper.SetConfigFile(filepath) 29 | } else { 30 | viper.SetConfigName("config") 31 | viper.AddConfigPath(".") 32 | viper.AddConfigPath("$XDG_CONFIG_HOME/rds-auth-proxy") 33 | viper.AddConfigPath("$HOME/.config/rds-auth-proxy") 34 | } 35 | if err := viper.ReadInConfig(); err != nil { 36 | return config, err 37 | } 38 | if err := viper.Unmarshal(&config); err != nil { 39 | return config, err 40 | } 41 | config.Init() 42 | return config, nil 43 | } 44 | 45 | // Init sets up defaults for the config file 46 | func (c *ConfigFile) Init() { 47 | if c.Targets == nil { 48 | c.Targets = map[string]*Target{} 49 | } 50 | 51 | if c.ProxyTargets == nil { 52 | c.ProxyTargets = map[string]*ProxyTarget{} 53 | } 54 | 55 | if c.Proxy.ListenAddr == "" { 56 | c.Proxy.ListenAddr = defaultListenAddr 57 | } 58 | 59 | c.Proxy.ACL.Init() 60 | // Set up SSL defaults for all targets if not set 61 | for key, target := range c.Targets { 62 | target.Name = key 63 | // if no SSL keys 64 | if target.SSL.Mode == "" { 65 | target.SSL.Mode = pg.SSLRequired 66 | } 67 | if target.SSL.Mode != pg.SSLDisabled && target.SSL.ClientCertificatePath == nil { 68 | target.SSL.ClientCertificatePath = c.Proxy.SSL.ClientCertificatePath 69 | target.SSL.ClientPrivateKeyPath = c.Proxy.SSL.ClientPrivateKeyPath 70 | } 71 | } 72 | 73 | // Set up SSL defaults for all proxies if not set 74 | for key, target := range c.ProxyTargets { 75 | target.Name = key 76 | if target.PortForward != nil && target.PortForward.KubeConfigFilePath == "" { 77 | target.PortForward.KubeConfigFilePath = defaultKubeConfigPath 78 | if target.SSL.Mode == "" { 79 | target.SSL.Mode = pg.SSLDisabled 80 | } 81 | } 82 | 83 | if target.SSL.Mode == "" { 84 | target.SSL.Mode = pg.SSLRequired 85 | } 86 | // if no SSL keys 87 | if target.SSL.Mode != pg.SSLDisabled && target.SSL.ClientCertificatePath == nil { 88 | target.SSL.ClientCertificatePath = c.Proxy.SSL.ClientCertificatePath 89 | target.SSL.ClientPrivateKeyPath = c.Proxy.SSL.ClientPrivateKeyPath 90 | } 91 | } 92 | } 93 | -------------------------------------------------------------------------------- /pkg/aws/rds.go: -------------------------------------------------------------------------------- 1 | package aws 2 | 3 | import ( 4 | "context" 5 | 6 | "github.com/aws/aws-sdk-go-v2/aws" 7 | "github.com/aws/aws-sdk-go-v2/aws/arn" 8 | "github.com/aws/aws-sdk-go-v2/config" 9 | "github.com/aws/aws-sdk-go-v2/feature/rds/auth" 10 | "github.com/aws/aws-sdk-go-v2/service/rds" 11 | "github.com/aws/aws-sdk-go-v2/service/rds/types" 12 | ) 13 | 14 | const ( 15 | filterEngine = "engine" 16 | enginePostgres = "postgres" 17 | engineAuroraPostgres = "aurora-postgresql" 18 | ) 19 | 20 | // DBInstanceResult is wrapper around a DBInstance or error 21 | // as a result of listing RDS Instances 22 | type DBInstanceResult struct { 23 | Instance types.DBInstance 24 | Error error 25 | } 26 | 27 | // RDSClient is our wrapper around the RDS library, allows us to 28 | // mock this for testing 29 | type RDSClient interface { 30 | GetPostgresInstances(ctx context.Context) <-chan DBInstanceResult 31 | NewAuthToken(ctx context.Context, host, region, user string) (string, error) 32 | RegionForInstance(inst types.DBInstance) (string, error) 33 | } 34 | 35 | type rdsClient struct { 36 | cfg aws.Config 37 | svc *rds.Client 38 | } 39 | 40 | // NewRDSClient loads AWS Config and creds, and returns an RDS client 41 | func NewRDSClient(ctx context.Context) (RDSClient, error) { 42 | cfg, err := config.LoadDefaultConfig(ctx) 43 | if err != nil { 44 | return nil, err 45 | } 46 | return &rdsClient{cfg: cfg, svc: rds.NewFromConfig(cfg)}, nil 47 | } 48 | 49 | // GetPostgresInstances grabs all db instances filtered by engine "postgres" and publishes 50 | // them to the result channel 51 | func (r *rdsClient) GetPostgresInstances(ctx context.Context) <-chan DBInstanceResult { 52 | resChan := make(chan DBInstanceResult, 1) 53 | go func() { 54 | defer close(resChan) 55 | paginator := r.rdsPaginator([]types.Filter{ 56 | { 57 | Name: strPtr(filterEngine), 58 | Values: []string{enginePostgres, engineAuroraPostgres}, 59 | }, 60 | }) 61 | for paginator.HasMorePages() { 62 | page, err := paginator.NextPage(ctx) 63 | if err != nil { 64 | resChan <- DBInstanceResult{Error: err} 65 | return 66 | } 67 | for _, d := range page.DBInstances { 68 | resChan <- DBInstanceResult{Instance: d} 69 | } 70 | } 71 | }() 72 | return resChan 73 | } 74 | 75 | func (r *rdsClient) rdsPaginator(filters []types.Filter) (paginator *rds.DescribeDBInstancesPaginator) { 76 | paginator = rds.NewDescribeDBInstancesPaginator(r.svc, &rds.DescribeDBInstancesInput{ 77 | Filters: filters, 78 | }, func(o *rds.DescribeDBInstancesPaginatorOptions) { 79 | o.Limit = 100 80 | }) 81 | return 82 | } 83 | 84 | func (r *rdsClient) NewAuthToken(ctx context.Context, host, region, user string) (string, error) { 85 | return auth.BuildAuthToken(ctx, host, region, user, r.cfg.Credentials) 86 | } 87 | 88 | func (r *rdsClient) RegionForInstance(inst types.DBInstance) (string, error) { 89 | arn, err := arn.Parse(*inst.DBInstanceArn) 90 | if err != nil { 91 | return "", err 92 | } 93 | return arn.Region, nil 94 | } 95 | 96 | func strPtr(val string) *string { 97 | return &val 98 | } 99 | -------------------------------------------------------------------------------- /cmd/proxy_server.go: -------------------------------------------------------------------------------- 1 | package cmd 2 | 3 | import ( 4 | "context" 5 | "fmt" 6 | "time" 7 | 8 | "github.com/mothership/rds-auth-proxy/pkg/aws" 9 | "github.com/mothership/rds-auth-proxy/pkg/config" 10 | "github.com/mothership/rds-auth-proxy/pkg/discovery" 11 | discoveryFactory "github.com/mothership/rds-auth-proxy/pkg/discovery/factory" 12 | "github.com/mothership/rds-auth-proxy/pkg/log" 13 | "github.com/mothership/rds-auth-proxy/pkg/proxy" 14 | "github.com/spf13/cobra" 15 | "go.uber.org/zap" 16 | ) 17 | 18 | var proxyServerCommand = &cobra.Command{ 19 | Use: "server", 20 | Short: "Launches the server proxy", 21 | Long: `Runs a proxy service in-cluster for connecting to RDS.`, 22 | RunE: func(cmd *cobra.Command, args []string) error { 23 | // TODO: make this gracefully shutdown on sigterm / sigint 24 | ctx, cancel := context.WithCancel(context.Background()) 25 | defer cancel() 26 | 27 | logger := log.NewLogger() 28 | filepath, err := cmd.Flags().GetString("configfile") 29 | if err != nil { 30 | return err 31 | } 32 | rdsClient, err := aws.NewRDSClient(ctx) 33 | if err != nil { 34 | return err 35 | } 36 | cfg, err := config.LoadConfig(filepath) 37 | if err != nil { 38 | return err 39 | } 40 | discoveryClient := discoveryFactory.FromConfig(rdsClient, &cfg) 41 | if err := discoveryClient.Refresh(ctx); err != nil { 42 | return err 43 | } 44 | 45 | opts, err := proxySSLOptions(cfg.Proxy.SSL) 46 | if err != nil { 47 | return err 48 | } 49 | logger.Info("starting server", zap.String("listen_addr", cfg.Proxy.ListenAddr)) 50 | manager, err := proxy.NewManager(proxy.MergeOptions(opts, []proxy.Option{ 51 | proxy.WithListenAddress(cfg.Proxy.ListenAddr), 52 | proxy.WithMode(proxy.ServerSide), 53 | proxy.WithCredentialInterceptor(func(creds *proxy.Credentials) error { 54 | hostConfig, err := discoveryClient.LookupTargetByHost(creds.Host) 55 | if err != nil { 56 | logger.Warn("client attempted to login to unknown host", zap.String("host", creds.Host)) 57 | return fmt.Errorf("host not allowed by ACL, or not configured for this proxy") 58 | } 59 | return overrideSSLConfig(creds, hostConfig.SSL) 60 | })})..., 61 | ) 62 | if err != nil { 63 | return err 64 | } 65 | // TODO: periodic refresh of discovery client 66 | RefreshTargets(ctx, discoveryClient, 1*time.Minute) 67 | err = manager.Start(ctx) 68 | return err 69 | }, 70 | } 71 | 72 | func RefreshTargets(ctx context.Context, client discovery.Client, period time.Duration) { 73 | go func() { 74 | t := time.NewTicker(period) 75 | for { 76 | select { 77 | case <-ctx.Done(): 78 | t.Stop() 79 | return 80 | case <-t.C: 81 | log.Info("starting target refresh", zap.Strings("targets", targetNames(client.GetTargets()))) 82 | if err := client.Refresh(ctx); err != nil { 83 | log.Warn("refresh failed", zap.Error(err), zap.Strings("targets", targetNames(client.GetTargets()))) 84 | } else { 85 | log.Info("refresh done", zap.Strings("targets", targetNames(client.GetTargets()))) 86 | } 87 | } 88 | } 89 | }() 90 | } 91 | 92 | func targetNames(targets []config.Target) []string { 93 | instances := make([]string, 0, len(targets)) 94 | for _, target := range targets { 95 | instances = append(instances, target.Name) 96 | } 97 | return instances 98 | } 99 | 100 | func init() { 101 | proxyServerCommand.PersistentFlags().String("configfile", "", "Filepath for proxy config file") 102 | rootCmd.AddCommand(proxyServerCommand) 103 | } 104 | -------------------------------------------------------------------------------- /pkg/kubernetes/port_forward.go: -------------------------------------------------------------------------------- 1 | package kubernetes 2 | 3 | import ( 4 | "bytes" 5 | "context" 6 | "fmt" 7 | "math/rand" 8 | "net/http" 9 | "time" 10 | 11 | "github.com/mothership/rds-auth-proxy/pkg/file" 12 | v1 "k8s.io/apimachinery/pkg/apis/meta/v1" 13 | "k8s.io/client-go/kubernetes" 14 | corev1client "k8s.io/client-go/kubernetes/typed/core/v1" 15 | restclient "k8s.io/client-go/rest" 16 | clientcmd "k8s.io/client-go/tools/clientcmd" 17 | "k8s.io/client-go/tools/portforward" 18 | "k8s.io/client-go/transport/spdy" 19 | ) 20 | 21 | type PortForwardCommand struct { 22 | Namespace string 23 | PodName string 24 | Config *restclient.Config 25 | Client restclient.Interface 26 | PodClient corev1client.PodsGetter 27 | Ports []string 28 | Address []string 29 | Out, ErrOut *bytes.Buffer 30 | PortForwarder *portforward.PortForwarder 31 | StopChannel chan struct{} 32 | ReadyChannel chan struct{} 33 | } 34 | 35 | type PortForwardOptions struct { 36 | Namespace string 37 | Deployment string 38 | Ports []string 39 | Context string 40 | } 41 | 42 | func loadConfig(path, context string) (*restclient.Config, error) { 43 | loadingRules := &clientcmd.ClientConfigLoadingRules{ExplicitPath: path} 44 | overrides := &clientcmd.ConfigOverrides{} 45 | if context != "" { 46 | overrides.CurrentContext = context 47 | } 48 | return clientcmd.NewNonInteractiveDeferredLoadingClientConfig(loadingRules, overrides).ClientConfig() 49 | } 50 | 51 | func BuildPortForwardCommand(ctx context.Context, kubeConfigPath string, opts PortForwardOptions) (*PortForwardCommand, error) { 52 | cmd := &PortForwardCommand{ 53 | Namespace: opts.Namespace, 54 | Ports: opts.Ports, 55 | Address: []string{"localhost"}, 56 | Out: new(bytes.Buffer), 57 | ErrOut: new(bytes.Buffer), 58 | StopChannel: make(chan struct{}, 1), 59 | ReadyChannel: make(chan struct{}), 60 | } 61 | path, err := file.ExpandPath(kubeConfigPath) 62 | if err != nil { 63 | return nil, err 64 | } 65 | config, err := loadConfig(path, opts.Context) 66 | if err != nil { 67 | return nil, err 68 | } 69 | cmd.Config = config 70 | // create the clientset 71 | clientset, err := kubernetes.NewForConfig(config) 72 | if err != nil { 73 | return nil, err 74 | } 75 | 76 | cmd.Client = clientset.CoreV1().RESTClient() 77 | cmd.PodClient = clientset.CoreV1() 78 | pods, err := cmd.PodClient.Pods(opts.Namespace).List(ctx, v1.ListOptions{ 79 | LabelSelector: fmt.Sprintf("app.kubernetes.io/name=%s", opts.Deployment), 80 | FieldSelector: "status.phase=Running", 81 | Limit: 3, 82 | }) 83 | if err != nil { 84 | return nil, err 85 | } 86 | 87 | rand.Seed(time.Now().Unix()) 88 | cmd.PodName = pods.Items[rand.Intn(len(pods.Items))].Name 89 | return cmd, nil 90 | } 91 | 92 | // ForwardPort forwards a port until context is canceled 93 | func ForwardPort(ctx context.Context, cmd *PortForwardCommand) error { 94 | go func() { 95 | <-ctx.Done() 96 | if cmd.StopChannel != nil { 97 | close(cmd.StopChannel) 98 | } 99 | }() 100 | 101 | req := cmd.Client.Post(). 102 | Resource("pods"). 103 | Namespace(cmd.Namespace). 104 | Name(cmd.PodName). 105 | SubResource("portforward") 106 | 107 | transport, upgrader, err := spdy.RoundTripperFor(cmd.Config) 108 | if err != nil { 109 | return err 110 | } 111 | dialer := spdy.NewDialer(upgrader, &http.Client{Transport: transport}, "POST", req.URL()) 112 | fw, err := portforward.NewOnAddresses(dialer, cmd.Address, cmd.Ports, cmd.StopChannel, cmd.ReadyChannel, cmd.Out, cmd.ErrOut) 113 | if err != nil { 114 | return err 115 | } 116 | cmd.PortForwarder = fw 117 | return fw.ForwardPorts() 118 | } 119 | -------------------------------------------------------------------------------- /docs/security.md: -------------------------------------------------------------------------------- 1 | # Security 2 | 3 | Found an issue? Send us an email at [security@mothership.com](mailto:security@mothership.com). 4 | 5 | As this software is in early development, there are no bounties, but you'll get credit and 6 | have our eternal gratitude! 7 | 8 | # Security Model 9 | 10 | The security of `rds-auth-proxy` depends on the following assumptions: 11 | 12 | * Users do not share laptops / leave them unlocked. 13 | * No untrusted process is running on the client machine. 14 | * No untrusted process can read the memory of the proxy process 15 | * You have a secure connection between the client and server proxies 16 | * You have IAM policies restricting which roles/databases a developer may use. 17 | 18 | ### Users do not share laptops / leave them unlocked 19 | 20 | `rds-auth-proxy` has no means of securing access to the proxy based on who is 21 | using the laptop. 22 | 23 | ### No untrusted process is running on the client machine 24 | 25 | Any process running locally, with network access, can connect to the proxy. 26 | 27 | ### No untrusted process can read the memory of the proxy process 28 | 29 | In client mode, `rds-auth-proxy` generates database passwords for the currently 30 | logged in AWS user. In server mode, `rds-auth-proxy` has to pass along the 31 | password to RDS. 32 | 33 | If an untrusted process can read memory of the proxy, it can read the generated 34 | password. Additionally, as Go is a garbage collected language, it is difficult 35 | to ensure all copies of the password is cleared from memory. 36 | 37 | ### You have a secure connection between the client and server proxies 38 | 39 | The postgres protocol transports passwords in plaintext and as an md5 hash. 40 | Neither format is suitable for transport over the public internet. We recommend 41 | tunneling the protocol over a kubernetes port-forward, or setting up SSL on the 42 | server-side proxy. 43 | 44 | ### You have IAM policies restricting which roles/databases a developer may use 45 | 46 | The server proxy, by default, will allow connections into any RDS postgres 47 | database with IAM authentication enabled. Developer access to the databases are 48 | controlled by their ability to generate temporary passwords on the client, which 49 | in turn is controlled by IAM policies and the AWS credentials they have access to. 50 | 51 | # Options for TLS 52 | 53 | ### Protecting the connection between the client and client proxy 54 | 55 | We support TLS between the client and client proxy, however, the client proxy is 56 | designed to be run on the same machine as the client and we don't recommend 57 | setting up TLS in that scenario for a few reasons: 58 | 59 | 1. If an attacker can already listen to local sockets, they can 60 | are already in a privileged position, TLS will not help. 61 | 2. Self-signed certificates are the only way to do this, but they are harder 62 | to manage and distribute securely. 63 | 64 | ### Protecting the connection between the client and server proxies 65 | 66 | The client proxy connection can be tunneled over a Kubernetes port-forward, and/or 67 | protected with TLS via the postgres protocol. 68 | 69 | While the server proxy supports the postgres over TLS, the postgres protocol has 70 | it's own handshake prior to upgrading to TLS, making it difficult to work with 71 | reverse proxies, or ingress resources. 72 | 73 | By using a port-forward, we can piggyback off of the encrypted tunnel Kubernetes 74 | provides. You can still enable TLS between the client and server over the 75 | port-forward if desired. 76 | 77 | ### Protecting the connection between the server and database 78 | 79 | For RDS instances, we require full verification of the RDS certificate. Our docker 80 | images are built with the RDS root CA certificates pre-installed. You may bring your 81 | own client certificate, but `rds-auth-proxy` will generate a self-signed client 82 | certificate if one isn't provided. 83 | -------------------------------------------------------------------------------- /pkg/discovery/rds/rds.go: -------------------------------------------------------------------------------- 1 | package rds 2 | 3 | import ( 4 | "context" 5 | "fmt" 6 | "strconv" 7 | "sync" 8 | 9 | "github.com/mothership/rds-auth-proxy/pkg/aws" 10 | "github.com/mothership/rds-auth-proxy/pkg/config" 11 | "github.com/mothership/rds-auth-proxy/pkg/discovery" 12 | "github.com/mothership/rds-auth-proxy/pkg/log" 13 | "github.com/mothership/rds-auth-proxy/pkg/pg" 14 | "go.uber.org/zap" 15 | ) 16 | 17 | const ( 18 | defaultDatabaseTag = "rds-auth-proxy:db-name" 19 | localPortTag = "rds-auth-proxy:local-port" 20 | ) 21 | 22 | type RdsDiscoveryClient struct { 23 | targetLock *sync.RWMutex 24 | config *config.ConfigFile 25 | client aws.RDSClient 26 | rdsTargets map[string]config.Target 27 | } 28 | 29 | var _ discovery.Client = (*RdsDiscoveryClient)(nil) 30 | 31 | func NewRdsDiscoveryClient(client aws.RDSClient, cfg *config.ConfigFile) *RdsDiscoveryClient { 32 | return &RdsDiscoveryClient{ 33 | targetLock: &sync.RWMutex{}, 34 | config: cfg, 35 | client: client, 36 | rdsTargets: map[string]config.Target{}, 37 | } 38 | } 39 | 40 | func (r *RdsDiscoveryClient) LookupTargetByHost(host string) (config.Target, error) { 41 | r.targetLock.RLock() 42 | defer r.targetLock.RUnlock() 43 | if target, ok := r.rdsTargets[host]; ok { 44 | return target, nil 45 | } 46 | return config.Target{}, discovery.ErrTargetNotFound 47 | 48 | } 49 | 50 | func (r *RdsDiscoveryClient) LookupTargetByName(name string) (config.Target, error) { 51 | r.targetLock.RLock() 52 | defer r.targetLock.RUnlock() 53 | for _, target := range r.rdsTargets { 54 | if target.Name == name { 55 | return target, nil 56 | } 57 | } 58 | return config.Target{}, discovery.ErrTargetNotFound 59 | } 60 | 61 | func (r *RdsDiscoveryClient) GetTargets() []config.Target { 62 | r.targetLock.RLock() 63 | defer r.targetLock.RUnlock() 64 | targetList := make([]config.Target, 0, len(r.rdsTargets)) 65 | for _, target := range r.rdsTargets { 66 | targetList = append(targetList, target) 67 | } 68 | return targetList 69 | } 70 | 71 | // RefreshRDSTargets searches AWS for allowed dbs updates the target list 72 | func (r *RdsDiscoveryClient) Refresh(ctx context.Context) (err error) { 73 | // XXX: Must consume ALL of these, else I think we leak the channel 74 | resChan := r.client.GetPostgresInstances(ctx) 75 | rdsTargets := map[string]config.Target{} 76 | for result := range resChan { 77 | if result.Error != nil { 78 | err = result.Error 79 | continue 80 | } 81 | d := result.Instance 82 | if d.Endpoint == nil { 83 | log.Warn("db instance missing endpoint, skipping", zap.String("name", *d.DBInstanceIdentifier)) 84 | continue 85 | } 86 | 87 | if tmpErr := r.config.Proxy.ACL.IsAllowed(d.TagList); tmpErr != nil { 88 | log.Debug("db instance not allowed by acl", zap.String("name", *d.DBInstanceIdentifier)) 89 | continue 90 | } 91 | 92 | region, regionErr := r.client.RegionForInstance(d) 93 | if regionErr != nil { 94 | log.Error("failed to detect db region, skipping", zap.Error(regionErr), zap.String("name", *d.DBInstanceIdentifier)) 95 | continue 96 | } 97 | 98 | if !d.IAMDatabaseAuthenticationEnabled { 99 | log.Warn("db instance does not have IAM auth enabled, skipping", zap.String("name", *d.DBInstanceIdentifier)) 100 | continue 101 | } 102 | 103 | target := config.Target{ 104 | Name: *d.DBInstanceIdentifier, 105 | Host: fmt.Sprintf("%+v:%+v", *d.Endpoint.Address, strconv.FormatInt(int64(d.Endpoint.Port), 10)), 106 | DefaultDatabase: d.DBName, 107 | SSL: config.SSL{ 108 | Mode: pg.SSLVerifyFull, 109 | ClientCertificatePath: r.config.Proxy.SSL.ClientCertificatePath, 110 | ClientPrivateKeyPath: r.config.Proxy.SSL.ClientPrivateKeyPath, 111 | }, 112 | Region: region, 113 | IsRDS: true, 114 | } 115 | for _, tag := range d.TagList { 116 | if *tag.Key == defaultDatabaseTag { 117 | target.DefaultDatabase = tag.Value 118 | } else if *tag.Key == localPortTag { 119 | target.LocalPort = tag.Value 120 | } 121 | } 122 | rdsTargets[target.Host] = target 123 | } 124 | 125 | if err == nil { 126 | r.targetLock.Lock() 127 | defer r.targetLock.Unlock() 128 | r.rdsTargets = rdsTargets 129 | } 130 | return err 131 | } 132 | -------------------------------------------------------------------------------- /pkg/pg/backend.go: -------------------------------------------------------------------------------- 1 | package pg 2 | 3 | import ( 4 | "crypto/tls" 5 | "io" 6 | "net" 7 | "sync" 8 | "time" 9 | 10 | pgproto3 "github.com/jackc/pgproto3/v2" 11 | ) 12 | 13 | const GSSENCecNotAllowed byte = 'N' 14 | const SSLNotAllowed byte = 'N' 15 | const SSLAllowed byte = 'S' 16 | 17 | // Backend acts as the postgres front-end client (ex: psql) 18 | type Backend interface { 19 | io.Closer 20 | Send(msg pgproto3.BackendMessage) error 21 | SendRaw([]byte) error 22 | Receive() (pgproto3.FrontendMessage, error) 23 | ReceiveRaw() ([]byte, error) 24 | } 25 | 26 | // SendOnlyBackend allows only the send operation to be accessed for network safety 27 | type SendOnlyBackend interface { 28 | Send(msg pgproto3.BackendMessage) error 29 | } 30 | 31 | // PostgresBackend implements a postgres backend client 32 | type PostgresBackend struct { 33 | backend *pgproto3.Backend 34 | connection net.Conn 35 | IdleTimeout time.Duration 36 | mutex sync.Mutex 37 | } 38 | 39 | // BackendOption allows us to specify options 40 | type BackendOption func(f *PostgresBackend) error 41 | 42 | // NewBackend returns a new postgres backend 43 | func NewBackend(conn net.Conn, opts ...BackendOption) (*PostgresBackend, error) { 44 | f := &PostgresBackend{ 45 | backend: pgproto3.NewBackend(pgproto3.NewChunkReader(conn), conn), 46 | connection: conn, 47 | IdleTimeout: readTimeout, 48 | mutex: sync.Mutex{}, 49 | } 50 | 51 | for _, opt := range opts { 52 | err := opt(f) 53 | if err != nil { 54 | return nil, err 55 | } 56 | } 57 | return f, nil 58 | } 59 | 60 | // Send sends a backend message to the backend 61 | func (b *PostgresBackend) Send(msg pgproto3.BackendMessage) error { 62 | b.mutex.Lock() 63 | defer b.mutex.Unlock() 64 | return b.backend.Send(msg) 65 | } 66 | 67 | // SendRaw sends arbitrary bytes to a backend 68 | func (b *PostgresBackend) SendRaw(msg []byte) error { 69 | _, err := b.connection.Write(msg) 70 | return err 71 | } 72 | 73 | // Receive accepts a message from the backend, or errors if nothing is read 74 | // within the idle timeout. Returns io.ErrUnexpectedEOF if the connection has 75 | // been closed. 76 | func (b *PostgresBackend) Receive() (pgproto3.FrontendMessage, error) { 77 | _ = b.connection.SetReadDeadline(time.Now().Add(b.IdleTimeout)) 78 | return b.backend.Receive() 79 | } 80 | 81 | // ReceiveRaw accepts a message from the backend, or errors if nothing 82 | // is read within the idle timeout. Returns io.ErrUnexpectedEOF if the 83 | // connection has been closed. 84 | func (b *PostgresBackend) ReceiveRaw() ([]byte, error) { 85 | // Postgres send buffers are at least this large 86 | response := make([]byte, 8192) 87 | _ = b.connection.SetReadDeadline(time.Now().Add(b.IdleTimeout)) 88 | readBytes, err := b.connection.Read(response) 89 | if err != nil && err == io.EOF { 90 | err = io.ErrUnexpectedEOF 91 | } 92 | return response[:readBytes], err 93 | } 94 | 95 | // Close closes the underlying connection 96 | func (b *PostgresBackend) Close() error { 97 | return b.connection.Close() 98 | } 99 | 100 | // SetupConnection sets up an inbound connection and extracts the login information 101 | // This will always return the existing connection, unless it had to upgrade to an SSL 102 | // connection. 103 | func (b *PostgresBackend) SetupConnection(cert *tls.Certificate) (map[string]string, error) { 104 | for { 105 | message, err := b.backend.ReceiveStartupMessage() 106 | if err != nil { 107 | return nil, err 108 | } 109 | switch msg := message.(type) { 110 | case *pgproto3.StartupMessage: 111 | return msg.Parameters, nil 112 | case *pgproto3.SSLRequest: 113 | if cert == nil { 114 | err = b.SendRaw([]byte{SSLNotAllowed}) 115 | if err != nil { 116 | return nil, err 117 | } 118 | continue 119 | } 120 | err = b.SendRaw([]byte{SSLAllowed}) 121 | if err != nil { 122 | return nil, err 123 | } 124 | b.connection = UpgradeServer(b.connection, cert) 125 | b.backend = pgproto3.NewBackend(pgproto3.NewChunkReader(b.connection), b.connection) 126 | continue 127 | case *pgproto3.GSSEncRequest: 128 | // Would need more research to offer GSS enc. 129 | err = b.SendRaw([]byte{GSSENCecNotAllowed}) 130 | if err != nil { 131 | return nil, err 132 | } 133 | continue 134 | } 135 | } 136 | } 137 | -------------------------------------------------------------------------------- /pkg/config/config_test.go: -------------------------------------------------------------------------------- 1 | package config_test 2 | 3 | import ( 4 | "fmt" 5 | "strings" 6 | "testing" 7 | 8 | . "github.com/mothership/rds-auth-proxy/pkg/config" 9 | "github.com/mothership/rds-auth-proxy/pkg/pg" 10 | ) 11 | 12 | func TestProxyConfigLoad(t *testing.T) { 13 | cases := []struct { 14 | FileName string 15 | Error error 16 | }{ 17 | { 18 | FileName: "foo", 19 | Error: fmt.Errorf("Unsupported Config Type"), 20 | }, 21 | { 22 | FileName: "foo.yaml", 23 | Error: fmt.Errorf("no such file or directory"), 24 | }, 25 | } 26 | for idx, test := range cases { 27 | _, err := LoadConfig(test.FileName) 28 | if !errorContains(err, test.Error) { 29 | t.Errorf("[Case %d] expected %+v, got %+v", idx, test.Error, err) 30 | } 31 | } 32 | } 33 | 34 | func TestConfigInit(t *testing.T) { 35 | var cfg ConfigFile 36 | cfg.Init() 37 | 38 | if cfg.Targets == nil { 39 | t.Errorf("expected targets to be initialized") 40 | } 41 | if cfg.ProxyTargets == nil { 42 | t.Errorf("expected proxy targets to be initialized") 43 | } 44 | } 45 | 46 | func TestTargetsGetDefaults(t *testing.T) { 47 | var cfg ConfigFile = ConfigFile{ 48 | Proxy: Proxy{ 49 | SSL: ServerSSL{ 50 | ClientCertificatePath: strPtr("/app/cert.pem"), 51 | ClientPrivateKeyPath: strPtr("/app/key.pem"), 52 | }, 53 | }, 54 | Targets: map[string]*Target{ 55 | "empty": {Host: "0"}, 56 | "override": { 57 | Host: "1", 58 | SSL: SSL{ 59 | ClientCertificatePath: strPtr("/tls/cert.pem"), 60 | ClientPrivateKeyPath: strPtr("/tls/key.pem"), 61 | }, 62 | }, 63 | }, 64 | } 65 | cfg.Init() 66 | if cfg.Targets["empty"].Name != "empty" { 67 | t.Errorf("Expected empty to have name populated") 68 | } 69 | 70 | if cfg.Targets["override"].Name != "override" { 71 | t.Errorf("Expected override to have name populated") 72 | } 73 | 74 | if cfg.Targets["empty"].SSL.Mode != pg.SSLRequired { 75 | t.Errorf("Expected empty to require SSL") 76 | } 77 | 78 | if cfg.Targets["empty"].SSL.ClientCertificatePath != cfg.Proxy.SSL.ClientCertificatePath { 79 | t.Errorf("Expected SSL cert to have taken value from parent") 80 | } 81 | 82 | if cfg.Targets["empty"].SSL.ClientPrivateKeyPath != cfg.Proxy.SSL.ClientPrivateKeyPath { 83 | t.Errorf("Expected SSL key to have taken value from parent") 84 | } 85 | } 86 | 87 | func TestProxyTargetsGetDefault(t *testing.T) { 88 | var cfg ConfigFile = ConfigFile{ 89 | Proxy: Proxy{ 90 | SSL: ServerSSL{ 91 | ClientCertificatePath: strPtr("/app/cert.pem"), 92 | ClientPrivateKeyPath: strPtr("/app/key.pem"), 93 | }, 94 | }, 95 | ProxyTargets: map[string]*ProxyTarget{ 96 | "empty": {Host: "0"}, 97 | "portforward": { 98 | PortForward: &PortForward{}, 99 | }, 100 | "override": { 101 | Host: "1", 102 | SSL: SSL{ 103 | ClientCertificatePath: strPtr("/tls/cert.pem"), 104 | ClientPrivateKeyPath: strPtr("/tls/key.pem"), 105 | }, 106 | }, 107 | }, 108 | } 109 | cfg.Init() 110 | 111 | if cfg.ProxyTargets["empty"].Name != "empty" { 112 | t.Errorf("Expected empty to have name populated") 113 | } 114 | 115 | if cfg.ProxyTargets["override"].Name != "override" { 116 | t.Errorf("Expected override to have name populated") 117 | } 118 | 119 | if cfg.ProxyTargets["empty"].SSL.Mode != pg.SSLRequired { 120 | t.Errorf("Expected empty to require SSL") 121 | } 122 | 123 | if cfg.ProxyTargets["empty"].SSL.ClientCertificatePath != cfg.Proxy.SSL.ClientCertificatePath { 124 | t.Errorf("Expected SSL cert to have taken value from parent") 125 | } 126 | 127 | if cfg.ProxyTargets["empty"].SSL.ClientPrivateKeyPath != cfg.Proxy.SSL.ClientPrivateKeyPath { 128 | t.Errorf("Expected SSL key to have taken value from parent") 129 | } 130 | 131 | if cfg.ProxyTargets["portforward"].SSL.Mode != pg.SSLDisabled { 132 | t.Errorf("Expected SSL to be disabled on portforward if not set") 133 | } 134 | } 135 | 136 | // errorContains checks if the error message in out contains the text in 137 | // want. 138 | // 139 | // This is safe when out is nil. Use an empty string for want if you want to 140 | // test that err is nil. 141 | func errorContains(out error, want error) bool { 142 | if want == nil && out == nil { 143 | return true 144 | } else if want == nil || out == nil { 145 | return false 146 | } 147 | return strings.Contains(out.Error(), want.Error()) 148 | } 149 | 150 | func strPtr(val string) *string { 151 | return &val 152 | } 153 | -------------------------------------------------------------------------------- /pkg/discovery/static/client_test.go: -------------------------------------------------------------------------------- 1 | package static_test 2 | 3 | import ( 4 | "testing" 5 | 6 | "github.com/mothership/rds-auth-proxy/pkg/config" 7 | "github.com/mothership/rds-auth-proxy/pkg/discovery" 8 | . "github.com/mothership/rds-auth-proxy/pkg/discovery/static" 9 | ) 10 | 11 | func TestStaticDiscoveryClientHostLookupFailures(t *testing.T) { 12 | staticTargets := map[string]config.Target{ 13 | "test.com:5432": makeTarget("test", "test.com:5432"), 14 | } 15 | cases := []struct { 16 | Targets map[string]config.Target 17 | Host string 18 | Expected error 19 | }{ 20 | { 21 | Targets: nil, 22 | Host: "test.com:5432", 23 | Expected: discovery.ErrTargetNotFound, 24 | }, 25 | { 26 | Targets: staticTargets, 27 | Host: "missing", 28 | Expected: discovery.ErrTargetNotFound, 29 | }, 30 | } 31 | for idx, test := range cases { 32 | client := NewStaticDiscoveryClient(test.Targets) 33 | _, err := client.LookupTargetByHost(test.Host) 34 | if test.Expected != err { 35 | t.Errorf("[Case %d] expected %+v. Got %+v.", idx, test.Expected, err) 36 | } 37 | } 38 | } 39 | 40 | func TestStaticDiscoveryClientHostLookupSuccess(t *testing.T) { 41 | staticTargets := map[string]config.Target{ 42 | "test.com:5432": makeTarget("test", "test.com:5432"), 43 | } 44 | cases := []struct { 45 | Targets map[string]config.Target 46 | Host string 47 | Expected config.Target 48 | }{ 49 | { 50 | Targets: staticTargets, 51 | Host: "test.com:5432", 52 | Expected: staticTargets["test.com:5432"], 53 | }, 54 | } 55 | for idx, test := range cases { 56 | client := NewStaticDiscoveryClient(test.Targets) 57 | target, err := client.LookupTargetByHost(test.Host) 58 | if err != nil { 59 | t.Fatalf("[Case %d] unexpected error: %s", idx, err) 60 | } 61 | if test.Expected != target { 62 | t.Errorf("[Case %d] expected %+v. Got %+v.", idx, test.Expected, target) 63 | } 64 | } 65 | } 66 | 67 | func TestStaticDiscoveryClientNameLookupSuccess(t *testing.T) { 68 | staticTargets := map[string]config.Target{ 69 | "test.com:5432": makeTarget("test", "test.com:5432"), 70 | } 71 | cases := []struct { 72 | Targets map[string]config.Target 73 | Name string 74 | Expected config.Target 75 | }{ 76 | { 77 | Targets: staticTargets, 78 | Name: "test", 79 | Expected: staticTargets["test.com:5432"], 80 | }, 81 | } 82 | for idx, test := range cases { 83 | client := NewStaticDiscoveryClient(test.Targets) 84 | target, err := client.LookupTargetByName(test.Name) 85 | if err != nil { 86 | t.Fatalf("[Case %d] unexpected error: %s", idx, err) 87 | } 88 | if test.Expected != target { 89 | t.Errorf("[Case %d] expected %+v. Got %+v.", idx, test.Expected, target) 90 | } 91 | } 92 | } 93 | 94 | func TestStaticDiscoveryClientNameLookupFailures(t *testing.T) { 95 | staticTargets := map[string]config.Target{ 96 | "test.com:5432": makeTarget("test", "test.com:5432"), 97 | } 98 | cases := []struct { 99 | Targets map[string]config.Target 100 | Name string 101 | Expected error 102 | }{ 103 | { 104 | Targets: nil, 105 | Name: "test", 106 | Expected: discovery.ErrTargetNotFound, 107 | }, 108 | { 109 | Targets: staticTargets, 110 | Name: "missing", 111 | Expected: discovery.ErrTargetNotFound, 112 | }, 113 | } 114 | for idx, test := range cases { 115 | client := NewStaticDiscoveryClient(test.Targets) 116 | _, err := client.LookupTargetByName(test.Name) 117 | if test.Expected != err { 118 | t.Errorf("[Case %d] expected %+v. Got %+v.", idx, test.Expected, err) 119 | } 120 | } 121 | } 122 | 123 | func TestStaticDiscoveryClientGetTargets(t *testing.T) { 124 | staticTargets := map[string]config.Target{ 125 | "test.com:5432": makeTarget("test", "test.com:5432"), 126 | } 127 | client := NewStaticDiscoveryClient(staticTargets) 128 | targets := client.GetTargets() 129 | if len(targets) != len(staticTargets) { 130 | t.Fatalf("missing targets") 131 | } 132 | 133 | for _, target := range targets { 134 | found, ok := staticTargets[target.Host] 135 | if !ok { 136 | t.Fatalf("failed to find target %q", target.Host) 137 | } 138 | if found.Host != target.Host || target.Name != found.Name { 139 | t.Fatalf("found wrong target %q, expected %q", found.Host, target.Host) 140 | } 141 | } 142 | 143 | } 144 | 145 | func makeTarget(name string, host string) config.Target { 146 | return config.Target{ 147 | Host: host, 148 | Name: name, 149 | } 150 | } 151 | -------------------------------------------------------------------------------- /pkg/pg/frontend.go: -------------------------------------------------------------------------------- 1 | package pg 2 | 3 | import ( 4 | "crypto/md5" 5 | "fmt" 6 | "io" 7 | "net" 8 | "sync" 9 | "time" 10 | 11 | pgproto3 "github.com/jackc/pgproto3/v2" 12 | ) 13 | 14 | const ( 15 | // TODO: should this be configurable? 16 | readTimeout = 3 * time.Second 17 | ) 18 | 19 | // Frontend acts as the postgres front-end client (ex: psql) 20 | type Frontend interface { 21 | io.Closer 22 | Send(msg pgproto3.FrontendMessage) error 23 | SendRaw([]byte) error 24 | Receive() (pgproto3.BackendMessage, error) 25 | ReceiveRaw() ([]byte, error) 26 | } 27 | 28 | // SendOnlyFrontend allows only the send operation to be accessed for network safety 29 | type SendOnlyFrontend interface { 30 | Send(msg pgproto3.FrontendMessage) error 31 | } 32 | 33 | type AuthFailedError struct { 34 | ErrMsg *pgproto3.ErrorResponse 35 | } 36 | 37 | func (a *AuthFailedError) Error() string { 38 | return "auth failed" 39 | } 40 | 41 | // PostgresFrontend implements a postgres frontend client 42 | type PostgresFrontend struct { 43 | frontend *pgproto3.Frontend 44 | connection net.Conn 45 | IdleTimeout time.Duration 46 | mutex sync.Mutex 47 | } 48 | 49 | // FrontendOption allows us to specify options 50 | type FrontendOption func(f *PostgresFrontend) error 51 | 52 | // NewFrontend returns a new postgres frontend 53 | func NewFrontend(conn net.Conn, opts ...FrontendOption) (*PostgresFrontend, error) { 54 | f := &PostgresFrontend{ 55 | frontend: pgproto3.NewFrontend(pgproto3.NewChunkReader(conn), conn), 56 | connection: conn, 57 | IdleTimeout: readTimeout, 58 | mutex: sync.Mutex{}, 59 | } 60 | 61 | for _, opt := range opts { 62 | err := opt(f) 63 | if err != nil { 64 | return nil, err 65 | } 66 | } 67 | return f, nil 68 | } 69 | 70 | // Send sends a frontend message to the backend 71 | func (f *PostgresFrontend) Send(msg pgproto3.FrontendMessage) error { 72 | f.mutex.Lock() 73 | defer f.mutex.Unlock() 74 | return f.frontend.Send(msg) 75 | } 76 | 77 | // SendRaw sends arbitrary bytes to a backend 78 | func (f *PostgresFrontend) SendRaw(b []byte) error { 79 | _, err := f.connection.Write(b) 80 | return err 81 | } 82 | 83 | // Receive accepts a message from the backend, or errors if nothing is read 84 | // within the idle timeout. Returns io.ErrUnexpectedEOF if the connection has 85 | // been closed. 86 | func (f *PostgresFrontend) Receive() (pgproto3.BackendMessage, error) { 87 | _ = f.connection.SetReadDeadline(time.Now().Add(f.IdleTimeout)) 88 | return f.frontend.Receive() 89 | } 90 | 91 | // ReceiveRaw accepts a message from the backend, or errors if nothing 92 | // is read within the idle timeout. Returns io.ErrUnexpectedEOF if the 93 | // connection has been closed. 94 | func (f *PostgresFrontend) ReceiveRaw() ([]byte, error) { 95 | // Postgres send buffers are at least this large 96 | response := make([]byte, 8192) 97 | _ = f.connection.SetReadDeadline(time.Now().Add(f.IdleTimeout)) 98 | readBytes, err := f.connection.Read(response) 99 | if err != nil && err == io.EOF { 100 | err = io.ErrUnexpectedEOF 101 | } 102 | return response[:readBytes], err 103 | } 104 | 105 | // Close closes the underlying connection 106 | func (b *PostgresFrontend) Close() error { 107 | return b.connection.Close() 108 | } 109 | 110 | func (f *PostgresFrontend) HandleAuthenticationRequest(username, password string) error { 111 | // TODO: max tries / exit condition? 112 | for { 113 | message, err := f.frontend.Receive() 114 | if err != nil { 115 | return err 116 | } 117 | 118 | switch msg := message.(type) { 119 | case *pgproto3.AuthenticationOk: 120 | return nil 121 | case *pgproto3.ReadyForQuery: 122 | return nil 123 | case *pgproto3.AuthenticationMD5Password: 124 | if err = f.Send(createMd5(msg, username, password)); err != nil { 125 | return err 126 | } 127 | continue 128 | case *pgproto3.AuthenticationCleartextPassword: 129 | if err := f.Send(createCleartext(msg, username, password)); err != nil { 130 | return err 131 | } 132 | continue 133 | case *pgproto3.ErrorResponse: 134 | return &AuthFailedError{ErrMsg: msg} 135 | case *pgproto3.AuthenticationSASL: 136 | return fmt.Errorf("SASL auth not supported") 137 | default: 138 | return fmt.Errorf("unsupported auth request, or unexpected message") 139 | } 140 | } 141 | } 142 | 143 | func createMD5Password(username string, password string, salt string) string { 144 | // Concatenate the password and the username together. 145 | passwordString := fmt.Sprintf("%s%s", password, username) 146 | 147 | // Compute the MD5 sum of the password+username string. 148 | passwordString = fmt.Sprintf("%x", md5.Sum([]byte(passwordString))) 149 | 150 | // Compute the MD5 sum of the password hash and the salt 151 | passwordString = fmt.Sprintf("%s%s", passwordString, salt) 152 | return fmt.Sprintf("md5%x", md5.Sum([]byte(passwordString))) 153 | } 154 | 155 | func createMd5(msg *pgproto3.AuthenticationMD5Password, username, password string) *pgproto3.PasswordMessage { 156 | return &pgproto3.PasswordMessage{ 157 | Password: createMD5Password(username, password, string(msg.Salt[:])), 158 | } 159 | } 160 | 161 | func createCleartext(msg *pgproto3.AuthenticationCleartextPassword, username, password string) *pgproto3.PasswordMessage { 162 | return &pgproto3.PasswordMessage{ 163 | Password: password, 164 | } 165 | } 166 | -------------------------------------------------------------------------------- /pkg/pg/ssl.go: -------------------------------------------------------------------------------- 1 | package pg 2 | 3 | import ( 4 | "crypto/tls" 5 | "crypto/x509" 6 | "net" 7 | 8 | "github.com/jackc/pgproto3/v2" 9 | ) 10 | 11 | // SSLMode is the type of SSL required 12 | // https://www.postgresql.org/docs/8.4/libpq-connect.html#LIBPQ-CONNECT-SSLMODE 13 | type SSLMode string 14 | 15 | const ( 16 | // SSLDisabled only tries a non-SSL connection 17 | SSLDisabled SSLMode = "disable" 18 | // SSLAllow first try a non-SSL connection, if that fails, tries an SSL connection 19 | // XXX: Not allowed at this time 20 | SSLAllow = "allow" 21 | // SSLPreferred is like allow, but tries an SSL connection first -- default behavior of psql 22 | SSLPreferred = "preferred" 23 | // SSLRequired only tries an SSL connection. If a root CA file is present, verify the certificate in the same way as if verify-ca was specified 24 | SSLRequired = "require" 25 | // SSLVerifyCA only tries an SSL connection, and verifies that the server certificate is issued by a trusted CA. 26 | SSLVerifyCA = "verify-ca" 27 | // SSLVerifyFull only tries an SSL connection, verifies that the server certificate is issued by a trusted CA and that 28 | // the server hostname matches that in the certificate. 29 | SSLVerifyFull = "verify-full" 30 | ) 31 | 32 | // Connect connects to an upstream database 33 | func Connect(host string, mode SSLMode, cert *tls.Certificate, rootCert *x509.Certificate) (net.Conn, error) { 34 | connection, err := net.Dial("tcp", host) 35 | if err != nil { 36 | return nil, err 37 | } 38 | 39 | backend := pgproto3.NewFrontend(pgproto3.NewChunkReader(connection), connection) 40 | if mode != SSLDisabled { 41 | // log.Info("SSL connections are enabled.") 42 | 43 | /* 44 | * First determine if SSL is allowed by the backend. To do this, send an 45 | * SSL request. The response from the backend will be a single byte 46 | * message. If the value is 'S', then SSL connections are allowed and an 47 | * upgrade to the connection should be attempted. If the value is 'N', 48 | * then the backend does not support SSL connections. 49 | */ 50 | sslRequest := &pgproto3.SSLRequest{} 51 | err = backend.Send(sslRequest) 52 | if err != nil { 53 | return nil, err 54 | } 55 | 56 | response := make([]byte, 4096) 57 | _, err = connection.Read(response) 58 | if err != nil { 59 | return nil, err 60 | } 61 | 62 | if len(response) > 0 && response[0] == SSLAllowed { 63 | // TODO: should probably decide whether or not to error based on SSL mode 64 | // but we'll pass the error back anyhow 65 | connection, err = UpgradeClient(host, connection, mode, cert, rootCert) 66 | } else if mode != SSLPreferred { 67 | // Close the connection only if we wanted required or higher 68 | connection.Close() 69 | } 70 | } 71 | 72 | return connection, err 73 | } 74 | 75 | // UpgradeServer upgrades a server connection with SSL 76 | func UpgradeServer(client net.Conn, cert *tls.Certificate) net.Conn { 77 | if cert == nil { 78 | return client 79 | } 80 | tlsConfig := tls.Config{} 81 | tlsConfig.Certificates = []tls.Certificate{*cert} 82 | return tls.Server(client, &tlsConfig) 83 | } 84 | 85 | // UpgradeClient upgrades a client connection with SSL 86 | func UpgradeClient(hostPort string, connection net.Conn, mode SSLMode, cert *tls.Certificate, rootCert *x509.Certificate) (net.Conn, error) { 87 | if mode == SSLDisabled { 88 | return connection, nil 89 | } 90 | 91 | tlsConfig := tls.Config{} 92 | if mode == SSLPreferred || mode == SSLRequired || mode == SSLVerifyCA { 93 | tlsConfig.InsecureSkipVerify = true 94 | } 95 | 96 | if mode == SSLVerifyFull { 97 | hostname, _, err := net.SplitHostPort(hostPort) 98 | if err != nil { 99 | return connection, err 100 | } 101 | tlsConfig.ServerName = hostname 102 | } 103 | 104 | var err error 105 | tlsConfig.Certificates = []tls.Certificate{*cert} 106 | tlsConfig.RootCAs, err = x509.SystemCertPool() 107 | if err != nil { 108 | return connection, err 109 | } 110 | 111 | if rootCert != nil { 112 | tlsConfig.RootCAs.AddCert(rootCert) 113 | } 114 | 115 | // do the upgrade 116 | client := tls.Client(connection, &tlsConfig) 117 | if mode == SSLVerifyCA || (mode == SSLRequired && rootCert != nil) { 118 | err := verifyCA(client, &tlsConfig) 119 | if err != nil { 120 | return connection, err 121 | } 122 | } 123 | 124 | return client, nil 125 | } 126 | 127 | // verifyCA explicitly does the handshake and certificate chain validation in the case that we need to validate 128 | // the CA, or we have a CA cert to validate against and the mode is require. 129 | func verifyCA(client *tls.Conn, tlsConf *tls.Config) error { 130 | err := client.Handshake() 131 | if err != nil { 132 | return err 133 | } 134 | 135 | // Get the peer/CA certificates from the connection state. 136 | peerCerts := client.ConnectionState().PeerCertificates 137 | caCert := peerCerts[0] 138 | peerCerts = peerCerts[1:] 139 | 140 | options := x509.VerifyOptions{ 141 | DNSName: client.ConnectionState().ServerName, 142 | Intermediates: x509.NewCertPool(), 143 | Roots: tlsConf.RootCAs, 144 | } 145 | // build the intermediate chain for verification 146 | for _, certificate := range peerCerts { 147 | options.Intermediates.AddCert(certificate) 148 | } 149 | 150 | // verify the CA cert is legitimate by building a path between it and the root 151 | // certificates we have, using the intermediates provided by the peer certificates. 152 | _, err = caCert.Verify(options) 153 | return err 154 | } 155 | -------------------------------------------------------------------------------- /pkg/proxy/config.go: -------------------------------------------------------------------------------- 1 | package proxy 2 | 3 | import ( 4 | "crypto/tls" 5 | "crypto/x509" 6 | "fmt" 7 | "net" 8 | 9 | pgproto3 "github.com/jackc/pgproto3/v2" 10 | "github.com/mothership/rds-auth-proxy/pkg/cert" 11 | "github.com/mothership/rds-auth-proxy/pkg/pg" 12 | ) 13 | 14 | // Credentials represents connection details to an upstream database or proxy 15 | type Credentials struct { 16 | Host string 17 | Database string 18 | Username string 19 | Password string 20 | // Misc connection parameters to be passed along 21 | Options map[string]string 22 | // SSL Settings for the outbound connection 23 | SSLMode pg.SSLMode 24 | ClientCertificate *tls.Certificate 25 | RootCertificate *x509.Certificate 26 | } 27 | 28 | // CredentialInterceptor provides a way to update credentials being forwarded 29 | // to the server proxy 30 | type CredentialInterceptor func(creds *Credentials) error 31 | 32 | // Mode indicates what kind of mode the proxy is in 33 | type Mode int 34 | 35 | const ( 36 | // ClientSide proxy mode is for running on the end-user laptop 37 | ClientSide Mode = iota 38 | // ServerSide proxy mode is for the in-cluster 39 | ServerSide 40 | ) 41 | 42 | // Config contains the various options for setting up the proxy 43 | type Config struct { 44 | ServerCertificate *tls.Certificate 45 | DefaultClientCertificate *tls.Certificate 46 | ListenAddress *net.TCPAddr 47 | CredentialInterceptor CredentialInterceptor 48 | QueryInterceptor QueryInterceptor 49 | Mode Mode 50 | } 51 | 52 | // QueryInterceptor provides a way to define custom behavior for handling messages 53 | type QueryInterceptor func(frontend pg.SendOnlyFrontend, backend pg.SendOnlyBackend, msg *pgproto3.Query) error 54 | 55 | // WillSendManually lets the proxy know that QueryInterceptor will handle sending the message 56 | var WillSendManually = fmt.Errorf("sending manually") 57 | 58 | // Option lets you set a config option 59 | type Option func(*Config) error 60 | 61 | // WithMode sets the mode of the proxy 62 | func WithMode(mode Mode) Option { 63 | return func(c *Config) error { 64 | if mode != ServerSide && mode != ClientSide { 65 | return fmt.Errorf("invalid mode: %d", mode) 66 | } 67 | c.Mode = mode 68 | return nil 69 | } 70 | } 71 | 72 | // WithListenAddress sets the IP/port that the proxy will accept connections on 73 | func WithListenAddress(addr string) Option { 74 | return func(c *Config) error { 75 | listenAddr, err := net.ResolveTCPAddr("tcp", addr) 76 | if err != nil { 77 | return err 78 | } 79 | 80 | c.ListenAddress = listenAddr 81 | return nil 82 | } 83 | } 84 | 85 | // WithCredentialInterceptor sets the credential retrieval strategy 86 | func WithCredentialInterceptor(credFactory CredentialInterceptor) Option { 87 | return func(c *Config) error { 88 | c.CredentialInterceptor = credFactory 89 | return nil 90 | } 91 | } 92 | 93 | // WithServerCertificate sets the SSL settings for the proxy 94 | func WithServerCertificate(certPath, keyPath string) Option { 95 | return func(c *Config) (err error) { 96 | if certPath == "" { 97 | return fmt.Errorf("certificate path not set") 98 | } 99 | if keyPath == "" { 100 | return fmt.Errorf("private key path not set") 101 | } 102 | cert, err := tls.LoadX509KeyPair(certPath, keyPath) 103 | if err != nil { 104 | return err 105 | } 106 | c.ServerCertificate = &cert 107 | return nil 108 | } 109 | } 110 | 111 | // WithGeneratedServerCertificate generates a self-signed server certificate for the proxy 112 | func WithGeneratedServerCertificate() Option { 113 | return func(c *Config) (err error) { 114 | certBytes, keyBytes, err := cert.GenerateSelfSignedCert("localhost,127.0.0.1", false) 115 | if err != nil { 116 | return err 117 | } 118 | cert, err := tls.X509KeyPair(certBytes, keyBytes) 119 | if err != nil { 120 | return err 121 | } 122 | c.ServerCertificate = &cert 123 | return nil 124 | } 125 | } 126 | 127 | // WithClientCertificate sets up the default client certificates 128 | func WithClientCertificate(certPath, keyPath string) Option { 129 | return func(c *Config) (err error) { 130 | if certPath == "" { 131 | return fmt.Errorf("client certificate path not set") 132 | } 133 | if keyPath == "" { 134 | return fmt.Errorf("client private key path not set") 135 | } 136 | cert, err := tls.LoadX509KeyPair(certPath, keyPath) 137 | if err != nil { 138 | return err 139 | } 140 | c.DefaultClientCertificate = &cert 141 | return nil 142 | } 143 | } 144 | 145 | // WithGeneratedClientCertificate generates the default client certificates 146 | func WithGeneratedClientCertificate() Option { 147 | return func(c *Config) (err error) { 148 | certBytes, keyBytes, err := cert.GenerateSelfSignedCert("localhost,127.0.0.1", false) 149 | if err != nil { 150 | return err 151 | } 152 | cert, err := tls.X509KeyPair(certBytes, keyBytes) 153 | if err != nil { 154 | return err 155 | } 156 | c.DefaultClientCertificate = &cert 157 | return nil 158 | } 159 | } 160 | 161 | // WithQueryInterceptor adds a function for custom message handling 162 | func WithQueryInterceptor(interceptor QueryInterceptor) Option { 163 | return func(c *Config) (err error) { 164 | c.QueryInterceptor = interceptor 165 | return nil 166 | } 167 | } 168 | 169 | // MergeOptions is a helper to merge an option list 170 | func MergeOptions(lists ...[]Option) []Option { 171 | opts := []Option{} 172 | for _, l := range lists { 173 | opts = append(opts, l...) 174 | } 175 | return opts 176 | } 177 | -------------------------------------------------------------------------------- /pkg/discovery/combined/client_test.go: -------------------------------------------------------------------------------- 1 | package combined_test 2 | 3 | import ( 4 | "testing" 5 | 6 | "github.com/mothership/rds-auth-proxy/pkg/config" 7 | "github.com/mothership/rds-auth-proxy/pkg/discovery" 8 | . "github.com/mothership/rds-auth-proxy/pkg/discovery/combined" 9 | "github.com/mothership/rds-auth-proxy/pkg/discovery/static" 10 | ) 11 | 12 | func TestCombinedDiscoveryClientHostLookupFailures(t *testing.T) { 13 | staticOne := makeStatic(makeTarget("db-1", "db-1:5432")) 14 | staticTwo := makeStatic(makeTarget("db-2", "db-2:5432"), makeTarget("db-3", "db-3:5432")) 15 | cases := []struct { 16 | Clients []discovery.Client 17 | Host string 18 | Expected error 19 | }{ 20 | { 21 | Clients: nil, 22 | Host: "db-1:5432", 23 | Expected: discovery.ErrTargetNotFound, 24 | }, 25 | { 26 | Clients: []discovery.Client{staticOne, staticTwo}, 27 | Host: "db-4:5432", 28 | Expected: discovery.ErrTargetNotFound, 29 | }, 30 | } 31 | for idx, test := range cases { 32 | client := NewCombinedDiscoveryClient(test.Clients) 33 | _, err := client.LookupTargetByHost(test.Host) 34 | if test.Expected != err { 35 | t.Errorf("[Case %d] expected %+v. Got %+v.", idx, test.Expected, err) 36 | } 37 | } 38 | } 39 | 40 | func TestCombinedDiscoveryClientHostLookupSuccess(t *testing.T) { 41 | staticOne := makeStatic(makeTarget("db-1", "db-1:5432")) 42 | staticTwo := makeStatic(makeTarget("db-2", "db-2:5432"), makeTarget("db-3", "db-3:5432")) 43 | cases := []struct { 44 | Clients []discovery.Client 45 | Host string 46 | Expected config.Target 47 | }{ 48 | { 49 | Clients: []discovery.Client{staticOne, staticTwo}, 50 | Host: "db-1:5432", 51 | Expected: ensureTarget(staticOne.LookupTargetByHost("db-1:5432")), 52 | }, 53 | { 54 | Clients: []discovery.Client{staticOne, staticTwo}, 55 | Host: "db-2:5432", 56 | Expected: ensureTarget(staticTwo.LookupTargetByHost("db-2:5432")), 57 | }, 58 | } 59 | for idx, test := range cases { 60 | client := NewCombinedDiscoveryClient(test.Clients) 61 | target, err := client.LookupTargetByHost(test.Host) 62 | if err != nil { 63 | t.Fatalf("[Case %d] unexpected error: %s", idx, err) 64 | } 65 | if test.Expected != target { 66 | t.Errorf("[Case %d] expected %+v. Got %+v.", idx, test.Expected, target) 67 | } 68 | } 69 | } 70 | 71 | func TestCombinedDiscoveryClientNameLookupSuccess(t *testing.T) { 72 | staticOne := makeStatic(makeTarget("db-1", "db-1:5432")) 73 | staticTwo := makeStatic(makeTarget("db-2", "db-2:5432"), makeTarget("db-3", "db-3:5432")) 74 | cases := []struct { 75 | Clients []discovery.Client 76 | Name string 77 | Expected config.Target 78 | }{ 79 | { 80 | Clients: []discovery.Client{staticOne, staticTwo}, 81 | Name: "db-1", 82 | Expected: ensureTarget(staticOne.LookupTargetByHost("db-1:5432")), 83 | }, 84 | { 85 | Clients: []discovery.Client{staticOne, staticTwo}, 86 | Name: "db-3", 87 | Expected: ensureTarget(staticTwo.LookupTargetByHost("db-3:5432")), 88 | }, 89 | } 90 | for idx, test := range cases { 91 | client := NewCombinedDiscoveryClient(test.Clients) 92 | target, err := client.LookupTargetByName(test.Name) 93 | if err != nil { 94 | t.Fatalf("[Case %d] unexpected error: %s", idx, err) 95 | } 96 | if test.Expected != target { 97 | t.Errorf("[Case %d] expected %+v. Got %+v.", idx, test.Expected, target) 98 | } 99 | } 100 | } 101 | 102 | func TestCombinedDiscoveryClientNameLookupFailures(t *testing.T) { 103 | staticOne := makeStatic(makeTarget("db-1", "db-1:5432")) 104 | staticTwo := makeStatic(makeTarget("db-2", "db-2:5432"), makeTarget("db-3", "db-3:5432")) 105 | cases := []struct { 106 | Clients []discovery.Client 107 | Name string 108 | Expected error 109 | }{ 110 | { 111 | Clients: nil, 112 | Name: "db-1", 113 | Expected: discovery.ErrTargetNotFound, 114 | }, 115 | { 116 | Clients: []discovery.Client{staticOne, staticTwo}, 117 | Name: "db-4", 118 | Expected: discovery.ErrTargetNotFound, 119 | }, 120 | } 121 | for idx, test := range cases { 122 | client := NewCombinedDiscoveryClient(test.Clients) 123 | _, err := client.LookupTargetByName(test.Name) 124 | if test.Expected != err { 125 | t.Errorf("[Case %d] expected %+v. Got %+v.", idx, test.Expected, err) 126 | } 127 | } 128 | } 129 | 130 | func TestCombinedDiscoveryClientGetTargets(t *testing.T) { 131 | staticOne := makeStatic(makeTarget("db-1", "db-1:5432")) 132 | staticTwo := makeStatic(makeTarget("db-2", "db-2:5432"), makeTarget("db-3", "db-3:5432")) 133 | client := NewCombinedDiscoveryClient([]discovery.Client{staticOne, staticTwo}) 134 | targets := client.GetTargets() 135 | if len(targets) != len(staticOne.GetTargets())+len(staticTwo.GetTargets()) { 136 | t.Fatalf("missing targets") 137 | } 138 | 139 | for _, target := range targets { 140 | found, err := client.LookupTargetByHost(target.Host) 141 | if err != nil { 142 | t.Fatalf("unexpected error %+v", err) 143 | } 144 | if found != target { 145 | t.Fatalf("found wrong target: %+v, expected %+v", found, target) 146 | } 147 | } 148 | } 149 | 150 | func makeStatic(targets ...config.Target) discovery.Client { 151 | hostMap := map[string]config.Target{} 152 | for _, target := range targets { 153 | hostMap[target.Host] = target 154 | } 155 | return static.NewStaticDiscoveryClient(hostMap) 156 | } 157 | 158 | func makeTarget(name string, host string) config.Target { 159 | return config.Target{ 160 | Host: host, 161 | Name: name, 162 | } 163 | } 164 | 165 | func ensureTarget(target config.Target, err error) config.Target { 166 | if err != nil { 167 | panic(err) 168 | } 169 | return target 170 | } 171 | -------------------------------------------------------------------------------- /docs/images/shield-icon-gradient.svg: -------------------------------------------------------------------------------- 1 | 10 | -------------------------------------------------------------------------------- /docs/quickstart.md: -------------------------------------------------------------------------------- 1 | # Getting Started 2 | 3 | !> At the moment, `rds-auth-proxy` only support PostgreSQL-flavored RDS instances. 4 | 5 | `rds-auth-proxy` is a binary that contains two major components, a server-side proxy, 6 | and a client-side proxy. This guide takes you through deploying the server-side proxy in 7 | your cluster, and connecting to it using the client-side proxy. 8 | 9 | For more information about the design, see the [architecture](./architecture.md) docs. 10 | 11 | ## Deploying the Server 12 | 13 | In order to deploy the server proxy successfully, you must ensure the following: 14 | 15 | 1. The proxy will be deployed into a subnet with security group rules that allow access to the RDS instances 16 | 2. The proxy has AWS credentials for database discovery 17 | 18 | The recommended way to install the proxy is to use our [helm chart](https://github.com/mothership/helm-charts/tree/master/charts/rds-auth-proxy). 19 | 20 | ### Setting up AWS Permissions 21 | 22 | The server-side proxy needs to be able to look up database instances to validate that it's allowed 23 | to complete the connection. 24 | 25 | In order to do this, it must be able to list RDS instances. An example IAM policy may look like this: 26 | 27 | ```json 28 | { 29 | "Version":"2012-10-17", 30 | "Statement":[ 31 | { 32 | "Sid":"AllowRDSDescribe", 33 | "Effect":"Allow", 34 | "Action": [ 35 | "rds:DescribeDBInstances", 36 | "rds:ListTagsForResource" 37 | ], 38 | "Resource": [ 39 | "arn:aws:rds:*:*:db:*" 40 | ] 41 | } 42 | ] 43 | } 44 | ``` 45 | 46 | You can get more granular with this policy by only allowing certain tags, AWS accounts, etc. Attach 47 | this policy to the user or role that will be used by the server-side proxy. 48 | 49 | ### Adding our chart repository 50 | 51 | Use Helm 3 to add the mothership repository: 52 | 53 | ```bash 54 | helm repo add mothership https://mothership.github.io/helm-charts/ 55 | helm repo update 56 | ``` 57 | 58 | ### Installing 59 | 60 | Start by creating a values file for the helm chart. An example file using [IRSA](https://aws.amazon.com/blogs/opensource/introducing-fine-grained-iam-roles-service-accounts/) 61 | is provided below. 62 | 63 | A similar approach should also work for [kube2iam](https://github.com/jtblin/kube2iam), or [kiam](https://github.com/uswitch/kiam) 64 | as well, but the annotations would need to be added to the deployment instead of the service account. 65 | 66 | ```yaml 67 | # values.yaml 68 | fullnameOverride: "rds-auth-proxy" 69 | deployment: 70 | # deploy at least two pods 71 | replicaCount: 2 72 | 73 | # create a service account, and pass AWS credentials using IRSA 74 | serviceAccount: 75 | create: true 76 | # IRSA controller will pick up this annotation and inject AWS credentials into the pod. 77 | annotations: 78 | eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/rds-auth-proxy 79 | 80 | rbac: 81 | # This creates a role with permissions to get/list pods + portforward to them in 82 | # the release namespace. 83 | create: true 84 | # Add your developer group, or list of users here to give them permissions 85 | # to port-forward to the server proxy 86 | portforwardSubjects: 87 | - name: my-developer-group 88 | kind: Group 89 | apiGroup: rbac.authorization.k8s.io 90 | 91 | 92 | proxy: 93 | # Disable SSL/TLS to the proxy itself, we'll tunnel the connection over a port-forward 94 | ssl: 95 | enabled: false 96 | # Disable cert manager integration, the proxy will generate a self-signed client 97 | # certificate and key 98 | certManager: 99 | enabled: false 100 | allowedRDSTags: 101 | - name: "rds_proxy_enabled" 102 | value: "true" 103 | ``` 104 | 105 | Apply the helm chart with this configuration to the cluster: 106 | 107 | ```bash 108 | kubectl create namespace rds-auth-proxy 109 | helm install rds-auth-proxy --namespace rds-auth-proxy mothership/rds-auth-proxy -f values.yaml 110 | ``` 111 | 112 | ## Preparing your database 113 | 114 | Enable RDS IAM authentication for one of your databases that the server proxy can reach. 115 | 116 | ```bash 117 | aws rds modify-db-instance \ 118 | --db-instance-identifier {my-db-instance} \ 119 | --apply-immediately \ 120 | --enable-iam-database-authentication 121 | ``` 122 | 123 | Add the tag `rds_proxy_enabled:true` to your database instance. 124 | 125 | ```bash 126 | aws rds add-tags-to-resource \ 127 | --resource-name {my-db-arn} \ 128 | --tags "[{\"Key\": \"rds_proxy_enabled\",\"Value\": \"true\"}]" 129 | ``` 130 | 131 | ### Granting the IAM Role 132 | 133 | Log in to your database and grant the `rds_iam` role to a user that you want to be accessible over 134 | the proxy. 135 | 136 | ```sql 137 | GRANT rds_iam TO postgres; 138 | ``` 139 | 140 | ### Granting IAM Permissions 141 | 142 | Ensure that you have access to AWS credentials with permissions to log in as that user. Your IAM 143 | policy would need to include a clause like this: 144 | 145 | ```json 146 | { 147 | "Version": "2012-10-17", 148 | "Statement": [ 149 | { 150 | "Effect": "Allow", 151 | "Action": [ 152 | "rds-db:connect" 153 | ], 154 | "Resource": [ 155 | "arn:aws:rds-db:{region}:{account}:dbuser:{db-resource-id}/{db-user}" 156 | ] 157 | } 158 | ] 159 | } 160 | ``` 161 | 162 | ## Setting up the client 163 | 164 | ### Download the client binary 165 | 166 | Check the [release page](https://github.com/mothership/rds-auth-proxy/releases) for the latest 167 | binaries. Download and install the one for your platform and architecture. 168 | 169 | ### Create your local config file 170 | 171 | Now we need to tell our client proxy about the server proxy. Drop this file at 172 | `~/.config/rds-auth-proxy/config.yaml`. 173 | 174 | ```yaml 175 | # ~/.config/rds-auth-proxy/config.yaml 176 | proxy: 177 | # this is the host/port that psql should connect with 178 | listen_addr: "0.0.0.0:8001" 179 | # don't use SSL between local proxy and psql 180 | ssl: 181 | enabled: false 182 | # only look at rds instances the server proxy can connect to 183 | target_acl: 184 | allowed_rds_tags: 185 | - name: rds_proxy_enabled 186 | value: "true" 187 | blocked_rds_tags: [] 188 | 189 | upstream_proxies: 190 | default: 191 | # configure a kubernetes port-forward tunnel to the in-cluster proxy 192 | port_forward: 193 | # context: some-other-kube-context 194 | # kube_config: /path/to/alternate_config_file 195 | deployment: rds-auth-proxy 196 | namespace: rds-auth-proxy 197 | local_port: "8000" 198 | remote_port: "8000" 199 | ssl: 200 | # since we disabled SSL on the in-cluster proxy, don't try SSL between 201 | # the client proxy and server proxy 202 | mode: "disable" 203 | ``` 204 | 205 | ## Testing your installation 206 | 207 | Run the following to start the client proxy: 208 | 209 | ```bash 210 | rds-auth-proxy client --target {dbinstanceidentifier} 211 | ``` 212 | 213 | In another shell, you should be able to connect: 214 | 215 | ``` 216 | psql -h localhost -p 8001 -U {db-user-with-iam-auth} 217 | ``` 218 | -------------------------------------------------------------------------------- /docs/reference.md: -------------------------------------------------------------------------------- 1 | # Config File Reference 2 | 3 | ## Terms 4 | 5 | **Targets** - Databases 6 | 7 | **Proxy** - The host launched by the rds-auth-proxy binary, can refer to either the client or server proxy. 8 | 9 | **Upstream Proxy** - The server proxy. 10 | 11 | ## Database Tags 12 | 13 | There are a few database tags that can change the behavior of 14 | `rds-auth-proxy` on the client proxy. 15 | 16 | | Tag | Behavior | 17 | | --- | -------- | 18 | | `rds-auth-proxy:db-name` | Provides the end user a hint about the default database name | 19 | | `rds-auth-proxy:local-port` | Sets the local port used by the client proxy for that database. Having a static local port per database allows developers to share connection configurations for various database tools | 20 | 21 | ## Client Config 22 | 23 | A full example of every option available: 24 | 25 | ```yaml 26 | # ~/.config/rds-auth-proxy/config.yaml 27 | 28 | # Options for the local proxy server 29 | proxy: 30 | # The listen address of this proxy 31 | listen_addr: 0.0.0.0:8001 32 | # SSL/TLS config for the proxy itself. 33 | ssl: 34 | # If set to true, without specifying a server 35 | # certificate/private key, will generate a self-signed 36 | # certificate for localhost 37 | enabled: false 38 | 39 | # Path to a pem-encoded certificate for the proxy 40 | certificate: ~/.config/rds-auth-proxy/server-cert.pem 41 | # Path to a pem-encoded private key for the certificate 42 | private_key: ~/.config/rds-auth-proxy/server-key.pem 43 | 44 | # Path to a pem-encoded certificate for upstream connections 45 | # 46 | # If not set, the proxy will generate a self-signed cert for 47 | # targets that require TLS/SSL. This cert can be overridden 48 | # on a per-host basis in the target config block below. 49 | # 50 | # This can be set regardless of whether or not you enable 51 | # TLS/SSL. 52 | client_certificate: ~/.config/rds-auth-proxy/client-cert.pem 53 | # Path to a pem-encoded key for the client certificate 54 | # 55 | # Leave unset, unless you're also providing the 56 | # client_certificate. 57 | client_private_key: ~/.config/rds-auth-proxy/client-key.pem 58 | 59 | # Effectively service-discovery for the proxy. These should 60 | # match the configuration for the upstream proxy. 61 | # 62 | # In the case that you have multiple upstream proxies, this can 63 | # be more permissive, but this has the current limitation that 64 | # your user must know which upstream handles which database 65 | # instances. 66 | target_acl: 67 | # RDS instances must have ALL of these tags to be connectable 68 | # An empty list means ALL instances that the proxy can see are 69 | # connectable 70 | allowed_rds_tags: 71 | - name: "rds_proxy_enabled" 72 | value: "true" # currently, must be an exact match 73 | # RDS instances must not have ANY of these tags to be connectable 74 | # An empty list means ALL instances that the proxy can see are 75 | # connectable 76 | blocked_rds_tags: 77 | - name: "rds_proxy_disabled" 78 | value: "true" # currently, must be an exact match 79 | 80 | # This is where you can specify upstream proxy settings 81 | upstream_proxies: 82 | # The 'default' proxy is used when no --proxy-target flag is 83 | # passed to the CLI 84 | default: 85 | # You can set up a kubernetes port-forward to the deployment 86 | # using a port-forward config block. 87 | # 88 | # In this case, the host will be set to 0.0.0.0 89 | port_forward: 90 | # The kubernetes config file to use when establishing the port-forward 91 | # If unset, uses ~/.kube/config 92 | kube_config: ~/.config/kube/kube_config 93 | # The context to use within the kube config file 94 | context: development 95 | # The name of your server proxy deployment 96 | deployment: rds-auth-proxy 97 | # The namespace of your server proxy 98 | namespace: rds-auth-proxy 99 | # Optional, the local port for the port-forward tunnel 100 | # if not specified, a random unused port will be used. If you have 101 | # multiple upstream proxies, leave this unset! 102 | local_port: 8000 103 | # The remote port of the proxy 104 | remote_port: 8000 105 | ssl: 106 | # You can enable SSL over a port-forward, but it's not required 107 | # as the port-forward is over a TLS connection. 108 | mode: "disable" # options are "disable", "verify-full", "verify-ca", or "require" 109 | # Additional upstream proxies can be specified as arbitrary keys in 110 | # the block 111 | with_ssl: 112 | host: example.com:8000 113 | ssl: 114 | # Expects the server certificate to be signed by a CA in the system trust store 115 | # and that the common name of the certificate matches the hostname 116 | mode: "verify-full" 117 | # Optionally provide a root CA that the certifiate chain must validate up to, 118 | # rather than the system trust store. 119 | root_certificate: ~/.config/rds-auth-proxy/root-ca.pem 120 | # Path to a pem encoded client certificate that should be used instead of the 121 | # proxies default client certificate for this host 122 | client_cert: ~/.config/rds-auth-proxy/my-client-cert.pem 123 | # Path to the pem encoded private key for the certificate 124 | client_private_key: ~/.config/rds-auth-proxy/my-client-key.pem 125 | 126 | # This is where you can specify SSL settings for the upstream 127 | # (non-RDS) databases 128 | # 129 | # RDS databases are discovered/added automatically at runtime. 130 | targets: 131 | in-cluster-postgres: 132 | # This should be the in-cluster hostname / port that the server-proxy 133 | # will use. 134 | host: postgres:5432 135 | ``` 136 | 137 | ## Server Config 138 | 139 | A full example of every option available: 140 | 141 | ```yaml 142 | # /etc/rds-auth-proxy/config.yaml 143 | 144 | # Options for the local proxy server 145 | proxy: 146 | # The listen address of this proxy 147 | listen_addr: 0.0.0.0:8000 148 | # SSL/TLS config for the proxy itself. 149 | ssl: 150 | # If set to true, without specifying a server 151 | # certificate/private key, will generate a self-signed 152 | # certificate for localhost 153 | enabled: false 154 | 155 | # Path to a pem-encoded certificate for the proxy 156 | certificate: /etc/rds-auth-proxy/server-cert.pem 157 | # Path to a pem-encoded private key for the certificate 158 | private_key: /etc/rds-auth-proxy/server-key.pem 159 | 160 | # Path to a pem-encoded certificate for upstream connections 161 | # 162 | # If not set, the proxy will generate a self-signed cert for 163 | # targets that require TLS/SSL. This cert can be overridden 164 | # on a per-host basis in the target config block below. 165 | # 166 | # This can be set regardless of whether or not you enable 167 | # TLS/SSL. 168 | client_certificate: /etc/rds-auth-proxy/client-cert.pem 169 | # Path to a pem-encoded key for the client certificate 170 | # 171 | # Leave unset, unless you're also providing the 172 | # client_certificate. 173 | client_private_key: /etc/rds-auth-proxy/client-key.pem 174 | 175 | # Effectively service-discovery for the proxy. Before making an 176 | # outbound connection, the proxy will check and verify that it 177 | # knows the host has one of these tags, or is specified in the 178 | # target list below. 179 | target_acl: 180 | # RDS instances must have ALL of these tags to be connectable 181 | # An empty list means ALL instances that the proxy can see are 182 | # connectable 183 | allowed_rds_tags: 184 | - name: "rds_proxy_enabled" 185 | value: "true" # currently, must be an exact match 186 | # RDS instances must not have ANY of these tags to be connectable 187 | # An empty list means ALL instances that the proxy can see are 188 | # connectable 189 | blocked_rds_tags: 190 | - name: "rds_proxy_disabled" 191 | value: "true" # currently, must be an exact match 192 | 193 | # This is where you can specify SSL settings for the upstream 194 | # databases 195 | # 196 | # RDS databases are discovered/added automatically at runtime, if you 197 | # add them yourself, you can override SSL settings. 198 | targets: 199 | in-cluster-postgres: 200 | # This should be the in-cluster hostname / port that the server-proxy 201 | # will use. 202 | host: postgres:5432 203 | overriden-rds-ssl: 204 | host: test-rds.aws.com:5432 205 | ssl: 206 | mode: "verify-full" 207 | # Path to a pem encoded client certificate that should be used instead of the 208 | # proxies default client certificate for this host 209 | client_cert: /etc/rds-auth-proxy/my-client-cert.pem 210 | # Path to the pem encoded private key for the certificate 211 | client_private_key: /etc/rds-auth-proxy/my-client-key.pem 212 | ``` 213 | -------------------------------------------------------------------------------- /pkg/proxy/proxy.go: -------------------------------------------------------------------------------- 1 | package proxy 2 | 3 | import ( 4 | "errors" 5 | "net" 6 | "os" 7 | "sync" 8 | "time" 9 | 10 | pgproto3 "github.com/jackc/pgproto3/v2" 11 | "github.com/mothership/rds-auth-proxy/pkg/log" 12 | "github.com/mothership/rds-auth-proxy/pkg/pg" 13 | "go.uber.org/zap" 14 | ) 15 | 16 | var connectionID = uint64(0) 17 | 18 | // Proxy - Manages a Proxy connection, piping data between proxy and remote. 19 | type Proxy struct { 20 | ID uint64 21 | logger *zap.Logger 22 | backend *pg.PostgresBackend 23 | frontend *pg.PostgresFrontend 24 | waiter sync.WaitGroup 25 | errChan chan errorWrapper 26 | shutdownChan chan bool 27 | config *Config 28 | } 29 | 30 | // newProxy returns a new Proxy that will handle a client connection and open 31 | // a downstream connection to the Postgres server 32 | func newProxy(clientConn net.Conn, errChan chan errorWrapper, config *Config) *Proxy { 33 | // XXX: can't error if no options are passed 34 | backend, _ := pg.NewBackend(clientConn) 35 | shutdownChan := make(chan bool, 1) 36 | connectionID++ 37 | return &Proxy{ 38 | ID: connectionID, 39 | shutdownChan: shutdownChan, 40 | backend: backend, 41 | logger: log.With(zap.Uint64("connectionID", connectionID)), 42 | errChan: errChan, 43 | waiter: sync.WaitGroup{}, 44 | config: config, 45 | } 46 | } 47 | 48 | func (p *Proxy) notifyError(err error) error { 49 | msg := &pgproto3.ErrorResponse{Severity: "FATAL", Message: err.Error()} 50 | if authErr, ok := err.(*pg.AuthFailedError); ok { 51 | msg = authErr.ErrMsg 52 | } 53 | _ = p.backend.Send(msg) 54 | p.errChan <- errorWrapper{ConnectionID: p.ID, Error: err} 55 | return err 56 | } 57 | 58 | func (p *Proxy) notifyStopped() { 59 | p.errChan <- errorWrapper{ConnectionID: p.ID, Error: nil} 60 | } 61 | 62 | // Stop shuts the proxy down and cleans up the connections 63 | func (p *Proxy) Stop() { 64 | close(p.shutdownChan) 65 | p.waiter.Wait() 66 | } 67 | 68 | // Start boots the proxy 69 | func (p *Proxy) Start() error { 70 | defer p.backend.Close() 71 | p.logger.Info("starting connection") 72 | // First, set up the connection with our client (ex: psql) 73 | // and extract the connection parameters from the startup message 74 | connectParams, err := p.backend.SetupConnection(p.config.ServerCertificate) 75 | if err != nil { 76 | return p.notifyError(err) 77 | } 78 | // Get credentials 79 | creds := p.ParseCredentials(connectParams) 80 | if err := p.config.CredentialInterceptor(&creds); err != nil { 81 | return p.notifyError(err) 82 | } 83 | // Next, establish a connection with the upstream database 84 | p.logger.Info("connecting to upstream postgres server", zap.String("postgres_server", creds.Host)) 85 | connection, err := pg.Connect(creds.Host, creds.SSLMode, creds.ClientCertificate, creds.RootCertificate) 86 | if err != nil { 87 | return p.notifyError(err) 88 | } 89 | 90 | // XXX: can't error without options 91 | frontend, _ := pg.NewFrontend(connection) 92 | p.frontend = frontend 93 | defer p.frontend.Close() 94 | 95 | p.logger.Info("connected to upstream postgres server", zap.String("postgres_server", creds.Host)) 96 | 97 | p.logger.Debug("sending startup message", 98 | zap.String("postgres_server", creds.Host), 99 | zap.String("user", creds.Username), 100 | zap.Any("options", creds.Options), 101 | ) 102 | 103 | // If we're in client proxy mode, forward the password in the StartupMessage 104 | if p.config.Mode == ClientSide && creds.Password != "" { 105 | creds.Options["password"] = creds.Password 106 | } 107 | // Now send our own StartupMessage, and pass thru any remaining connection parameters. 108 | startupMessage := createStartupMessage(creds.Username, creds.Database, creds.Options) 109 | if err = frontend.SendRaw(startupMessage.Encode(nil)); err != nil { 110 | return p.notifyError(err) 111 | } 112 | 113 | // Even if we're in server mode, don't bother intercepting the startup message response 114 | // UNLESS we have the password/auth credentials to handle it. This lets the user use 115 | // the proxy normally, for instance, if they are using it without IAM auth 116 | if p.config.Mode == ServerSide && creds.Password != "" { 117 | // Fetch the response to our startup message, most likely this is going to be a request 118 | // for us to authenticate. Assuming it is, forward the password we collected. 119 | p.logger.Debug("handling upstream authentication", zap.String("postgres_server", creds.Host)) 120 | err = p.frontend.HandleAuthenticationRequest(creds.Username, creds.Password) 121 | if err != nil { 122 | return p.notifyError(err) 123 | } 124 | p.logger.Debug("authed successfully with upstream", zap.String("postgres_server", creds.Host)) 125 | // Send the auth result down to the client (ex: psql) 126 | err = p.backend.Send(&pgproto3.AuthenticationOk{}) 127 | if err != nil { 128 | return p.notifyError(errors.New("failed to send auth")) 129 | } 130 | p.logger.Debug("notified client of auth result", zap.String("postgres_server", creds.Host)) 131 | } 132 | 133 | // Now move to generic TLS/TCP proxy 134 | p.logger.Info("startup success, starting full proxy", zap.String("postgres_server", creds.Host)) 135 | p.waiter.Add(2) 136 | go p.proxyToServer() 137 | go p.proxyToClient() 138 | // wait for close... 139 | p.waiter.Wait() 140 | return nil 141 | } 142 | 143 | func (p *Proxy) proxyToServer() { 144 | idleTimeout := 5 * time.Minute 145 | maxTimeouts := int64(int64(idleTimeout) / int64(p.backend.IdleTimeout)) 146 | timeouts := int64(0) 147 | defer p.waiter.Done() 148 | for { 149 | select { 150 | case <-p.shutdownChan: 151 | return 152 | default: 153 | msg, err := p.backend.Receive() 154 | if err != nil { 155 | if isRetryableError(err) { 156 | timeouts++ 157 | if timeouts < maxTimeouts { 158 | continue 159 | } 160 | } 161 | _ = p.notifyError(err) 162 | return 163 | } 164 | timeouts = 0 165 | 166 | switch castedMsg := msg.(type) { 167 | case *pgproto3.Terminate: 168 | err := p.frontend.Send(castedMsg) 169 | if err != nil { 170 | _ = p.notifyError(err) 171 | return 172 | } 173 | p.logger.Debug("got disconnected message") 174 | p.notifyStopped() 175 | return 176 | case *pgproto3.Query: 177 | p.logger.Debug("got query message from client") 178 | if p.config.QueryInterceptor != nil { 179 | if err := p.config.QueryInterceptor(p.frontend, p.backend, castedMsg); err != nil { 180 | if err != WillSendManually { 181 | _ = p.notifyError(err) 182 | return 183 | } 184 | continue 185 | } 186 | } 187 | err := p.frontend.Send(castedMsg) 188 | if err != nil { 189 | _ = p.notifyError(err) 190 | return 191 | } 192 | default: 193 | p.logger.Debug("got message from client") 194 | err := p.frontend.Send(castedMsg) 195 | if err != nil { 196 | _ = p.notifyError(err) 197 | return 198 | } 199 | } 200 | } 201 | } 202 | } 203 | 204 | func (p *Proxy) proxyToClient() { 205 | idleTimeout := 5 * time.Minute 206 | maxTimeouts := int64(int64(idleTimeout) / int64(p.frontend.IdleTimeout)) 207 | timeouts := int64(0) 208 | defer p.waiter.Done() 209 | for { 210 | select { 211 | case <-p.shutdownChan: 212 | return 213 | default: 214 | msg, err := p.frontend.Receive() 215 | if err != nil { 216 | if isRetryableError(err) { 217 | timeouts++ 218 | if timeouts < maxTimeouts { 219 | continue 220 | } 221 | } 222 | _ = p.notifyError(err) 223 | return 224 | } 225 | timeouts = 0 226 | p.logger.Debug("got message from server") 227 | err = p.backend.Send(msg) 228 | if err != nil { 229 | _ = p.notifyError(err) 230 | return 231 | } 232 | } 233 | } 234 | } 235 | 236 | func createStartupMessage(username string, database string, options map[string]string) pgproto3.StartupMessage { 237 | params := map[string]string{ 238 | "user": username, 239 | "database": database, 240 | } 241 | for key, value := range options { 242 | params[key] = value 243 | } 244 | 245 | return pgproto3.StartupMessage{ 246 | ProtocolVersion: pgproto3.ProtocolVersionNumber, 247 | Parameters: params, 248 | } 249 | } 250 | 251 | func isRetryableError(err error) bool { 252 | // These errors are expected in periods of no query activity. 253 | if errors.Is(err, os.ErrDeadlineExceeded) { 254 | return true 255 | } 256 | if netErr, ok := err.(net.Error); ok { 257 | return netErr.Timeout() || netErr.Temporary() //nolint 258 | } 259 | return false 260 | } 261 | 262 | // ParseCredentials takes connection parameters and turns them into Credentials 263 | func (p *Proxy) ParseCredentials(connectionParams map[string]string) Credentials { 264 | extracted := []string{"host", "password", "user", "database"} 265 | creds := Credentials{ 266 | Host: connectionParams["host"], 267 | Password: connectionParams["password"], 268 | Username: connectionParams["user"], 269 | Database: connectionParams["database"], 270 | SSLMode: pg.SSLRequired, 271 | ClientCertificate: p.config.DefaultClientCertificate, 272 | } 273 | for _, key := range extracted { 274 | delete(connectionParams, key) 275 | } 276 | creds.Options = connectionParams 277 | return creds 278 | } 279 | -------------------------------------------------------------------------------- /cmd/proxy_client.go: -------------------------------------------------------------------------------- 1 | package cmd 2 | 3 | import ( 4 | "context" 5 | "crypto/tls" 6 | "crypto/x509" 7 | "encoding/pem" 8 | "fmt" 9 | "io/ioutil" 10 | "net" 11 | "os" 12 | "os/signal" 13 | 14 | "github.com/AlecAivazis/survey/v2" 15 | "github.com/mothership/rds-auth-proxy/pkg/aws" 16 | "github.com/mothership/rds-auth-proxy/pkg/config" 17 | "github.com/mothership/rds-auth-proxy/pkg/discovery" 18 | discoveryFactory "github.com/mothership/rds-auth-proxy/pkg/discovery/factory" 19 | "github.com/mothership/rds-auth-proxy/pkg/kubernetes" 20 | "github.com/mothership/rds-auth-proxy/pkg/log" 21 | "github.com/mothership/rds-auth-proxy/pkg/proxy" 22 | "github.com/spf13/cobra" 23 | "go.uber.org/zap" 24 | "go.uber.org/zap/zapcore" 25 | ) 26 | 27 | var proxyClientCommand = &cobra.Command{ 28 | Use: "client", 29 | Short: "Launches the localhost proxy", 30 | Long: `Runs a localhost proxy service in-cluster for connecting to RDS.`, 31 | RunE: func(cmd *cobra.Command, args []string) error { 32 | logCfg := zap.NewDevelopmentConfig() 33 | logCfg.Level = zap.NewAtomicLevelAt(zapcore.InfoLevel) 34 | logCfg.Development = false 35 | logger, err := logCfg.Build(zap.WithCaller(false)) 36 | if err != nil { 37 | return err 38 | } 39 | log.SetLogger(logger) 40 | ctx, cancel := context.WithCancel(context.Background()) 41 | defer cancel() 42 | rdsClient, err := aws.NewRDSClient(ctx) 43 | if err != nil { 44 | return err 45 | } 46 | filepath, err := cmd.Flags().GetString("configfile") 47 | if err != nil { 48 | return err 49 | } 50 | cfg, err := config.LoadConfig(filepath) 51 | if err != nil { 52 | return err 53 | } 54 | discoveryClient := discoveryFactory.FromConfig(rdsClient, &cfg) 55 | if err := discoveryClient.Refresh(ctx); err != nil { 56 | return err 57 | } 58 | 59 | // Look up the proxy target 60 | proxyTarget, err := getProxyTarget(cmd, cfg.ProxyTargets) 61 | if err != nil { 62 | return err 63 | } 64 | 65 | // Look up the real target name in the target list 66 | target, err := getTarget(cmd, discoveryClient) 67 | if err != nil { 68 | return err 69 | } 70 | // Override local port if needed 71 | if target.LocalPort != nil { 72 | addr, err := net.ResolveTCPAddr("tcp", cfg.Proxy.ListenAddr) 73 | if err != nil { 74 | return err 75 | } 76 | cfg.Proxy.ListenAddr = fmt.Sprintf("%s:%s", addr.IP, *target.LocalPort) 77 | } 78 | 79 | // Optionally grab the password 80 | pass, err := cmd.Flags().GetString("password") 81 | if err != nil { 82 | return err 83 | } 84 | 85 | err = printConnectionString(cfg.Proxy.ListenAddr, target) 86 | if err != nil { 87 | return err 88 | } 89 | 90 | if proxyTarget.PortForward != nil { 91 | // setup port-forward 92 | prtCmd, err := kubernetes.BuildPortForwardCommand(ctx, proxyTarget.PortForward.KubeConfigFilePath, kubernetes.PortForwardOptions{ 93 | Namespace: proxyTarget.PortForward.Namespace, 94 | Deployment: proxyTarget.PortForward.DeploymentName, 95 | Ports: []string{fmt.Sprintf("%s:%s", proxyTarget.PortForward.GetLocalPort(), proxyTarget.PortForward.RemotePort)}, 96 | Context: proxyTarget.PortForward.Context, 97 | }) 98 | if err != nil { 99 | return err 100 | } 101 | 102 | go func() { 103 | if err := kubernetes.ForwardPort(ctx, prtCmd); err != nil { 104 | // TODO: blow this up gracefully 105 | log.Error("k8s port-forward caught error", zap.Error(err), zap.String("listen_addr", proxyTarget.GetHost())) 106 | panic(err) 107 | } 108 | log.Info("k8s port-forward exited", zap.String("listen_addr", proxyTarget.GetHost())) 109 | }() 110 | <-prtCmd.ReadyChannel 111 | ports, err := prtCmd.PortForwarder.GetPorts() 112 | if err != nil { 113 | return err 114 | } 115 | portUsed := fmt.Sprintf("%d", ports[0].Local) 116 | proxyTarget.PortForward.LocalPort = &portUsed 117 | log.Info("started k8s port-forward", zap.String("listen_addr", proxyTarget.GetHost())) 118 | } 119 | 120 | log.Info("starting client proxy", zap.String("listen_addr", cfg.Proxy.ListenAddr)) 121 | opts, err := proxySSLOptions(cfg.Proxy.SSL) 122 | if err != nil { 123 | return err 124 | } 125 | 126 | manager, err := proxy.NewManager(proxy.MergeOptions(opts, []proxy.Option{ 127 | proxy.WithListenAddress(cfg.Proxy.ListenAddr), 128 | proxy.WithMode(proxy.ClientSide), 129 | proxy.WithCredentialInterceptor(func(creds *proxy.Credentials) error { 130 | // Send this connection to the proxy host 131 | creds.Host = proxyTarget.GetHost() 132 | // But tell the server proxy to forward to the target host 133 | creds.Options["host"] = target.Host 134 | 135 | // Use provided password, or generate an RDS password to forward through 136 | if pass != "" { 137 | creds.Password = pass 138 | } else if target.IsRDS { 139 | authToken, err := rdsClient.NewAuthToken(ctx, target.Host, target.Region, creds.Username) 140 | if err != nil { 141 | return err 142 | } 143 | creds.Password = authToken 144 | } 145 | 146 | return overrideSSLConfig(creds, proxyTarget.SSL) 147 | })})..., 148 | ) 149 | if err != nil { 150 | return err 151 | } 152 | 153 | // Shutdown app on SIGINT/SIGTERM 154 | signals := make(chan os.Signal, 1) 155 | go func() { 156 | _ = manager.Start(ctx) 157 | close(signals) 158 | }() 159 | signal.Notify(signals, os.Interrupt) 160 | <-signals 161 | cancel() 162 | return nil 163 | }, 164 | } 165 | 166 | func printConnectionString(listenAddr string, target config.Target) error { 167 | addr, err := net.ResolveTCPAddr("tcp", listenAddr) 168 | if err != nil { 169 | return err 170 | } 171 | start := fmt.Sprintf("psql -h %s -p %d", addr.IP, addr.Port) 172 | if target.DefaultDatabase != nil && *target.DefaultDatabase != "" { 173 | start += fmt.Sprintf(" -d %s", *target.DefaultDatabase) 174 | } else { 175 | start += " -d {your_database}" 176 | } 177 | start += " -U {your user}" 178 | fmt.Printf("Setting up a tunnel to %s\n\nGive this a second, then in a new shell, connect with:\n\n\t%s\n\n", target.Name, start) 179 | return nil 180 | } 181 | 182 | func getProxyTarget(cmd *cobra.Command, targets map[string]*config.ProxyTarget) (*config.ProxyTarget, error) { 183 | // Look up the proxy target 184 | proxyName, err := cmd.Flags().GetString("proxy-target") 185 | if err != nil { 186 | return nil, err 187 | } 188 | proxyTarget, ok := targets[proxyName] 189 | if ok { 190 | return proxyTarget, nil 191 | } 192 | 193 | opts := make([]string, 0, len(targets)) 194 | for name := range targets { 195 | opts = append(opts, name) 196 | } 197 | 198 | prompt := &survey.Select{ 199 | Message: "Select an upstream proxy", 200 | Options: opts, 201 | } 202 | 203 | err = survey.AskOne(prompt, &proxyName) 204 | if err != nil { 205 | return nil, err 206 | } 207 | proxyTarget, ok = targets[proxyName] 208 | if ok { 209 | return proxyTarget, nil 210 | } 211 | return nil, fmt.Errorf("couldn't find a proxy target") 212 | } 213 | 214 | func getTarget(cmd *cobra.Command, discoveryClient discovery.Client) (config.Target, error) { 215 | targetName, err := cmd.Flags().GetString("target") 216 | if err != nil { 217 | return config.Target{}, err 218 | } 219 | 220 | if targetName == "" { 221 | targets := discoveryClient.GetTargets() 222 | opts := make([]string, 0, len(targets)) 223 | for _, target := range targets { 224 | opts = append(opts, target.Name) 225 | } 226 | prompt := &survey.Select{ 227 | Message: "Select a database", 228 | Options: opts, 229 | } 230 | 231 | if err := survey.AskOne(prompt, &targetName); err != nil { 232 | return config.Target{}, err 233 | } 234 | } 235 | return discoveryClient.LookupTargetByName(targetName) 236 | } 237 | 238 | func overrideSSLConfig(creds *proxy.Credentials, ssl config.SSL) error { 239 | creds.SSLMode = ssl.Mode 240 | // If the config wants us to use a specific SSL client cert, load it 241 | if ssl.ClientCertificatePath != nil { 242 | // TODO: load sooner / cache 243 | cert, err := tls.LoadX509KeyPair(*ssl.ClientCertificatePath, *ssl.ClientPrivateKeyPath) 244 | if err != nil { 245 | return err 246 | } 247 | creds.ClientCertificate = &cert 248 | } 249 | 250 | // If the config wants us to validate the cert chain goes to a specific root cert for the server proxy 251 | // load it, and set it 252 | if ssl.RootCertificatePath != nil { 253 | rootCABytes, err := ioutil.ReadFile(*ssl.RootCertificatePath) 254 | if err != nil { 255 | return err 256 | } 257 | decoded, _ := pem.Decode(rootCABytes) 258 | cert, err := x509.ParseCertificate(decoded.Bytes) 259 | if err != nil { 260 | return err 261 | } 262 | creds.RootCertificate = cert 263 | } 264 | return nil 265 | } 266 | 267 | func proxySSLOptions(ssl config.ServerSSL) ([]proxy.Option, error) { 268 | opts := make([]proxy.Option, 0, 2) 269 | if ssl.Enabled { 270 | if ssl.CertificatePath == nil && ssl.PrivateKeyPath == nil { 271 | opts = append(opts, proxy.WithGeneratedServerCertificate()) 272 | } else if ssl.CertificatePath != nil && ssl.PrivateKeyPath != nil { 273 | opts = append(opts, proxy.WithServerCertificate(*ssl.CertificatePath, *ssl.PrivateKeyPath)) 274 | } else { 275 | return opts, fmt.Errorf("bad options: when ssl is enabled, either both a certificate and key must be provided, or neither provided") 276 | } 277 | } 278 | 279 | if ssl.ClientCertificatePath == nil && ssl.ClientPrivateKeyPath == nil { 280 | opts = append(opts, proxy.WithGeneratedClientCertificate()) 281 | } else if ssl.ClientCertificatePath != nil && ssl.ClientPrivateKeyPath != nil { 282 | opts = append(opts, proxy.WithClientCertificate(*ssl.ClientCertificatePath, *ssl.ClientPrivateKeyPath)) 283 | } else { 284 | return opts, fmt.Errorf("bad options: either both a client certificate and key must be provided, or neither provided") 285 | } 286 | return opts, nil 287 | 288 | } 289 | 290 | func init() { 291 | proxyClientCommand.PersistentFlags().String("proxy-target", "default", "Name of the proxy target in the configfile") 292 | proxyClientCommand.PersistentFlags().String("target", "", "Name of the target, or db instance identifier that you wish to connect to") 293 | proxyClientCommand.PersistentFlags().String("configfile", "", "Path to the proxy config file") 294 | _ = proxyClientCommand.MarkPersistentFlagDirname("configfile") 295 | proxyClientCommand.PersistentFlags().String("password", "", "Password for the user if IAM auth is not set up") 296 | rootCmd.AddCommand(proxyClientCommand) 297 | } 298 | -------------------------------------------------------------------------------- /pkg/discovery/rds/rds_test.go: -------------------------------------------------------------------------------- 1 | package rds_test 2 | 3 | import ( 4 | "context" 5 | "fmt" 6 | "testing" 7 | 8 | "github.com/aws/aws-sdk-go-v2/service/rds/types" 9 | "github.com/mothership/rds-auth-proxy/pkg/aws" 10 | "github.com/mothership/rds-auth-proxy/pkg/config" 11 | "github.com/mothership/rds-auth-proxy/pkg/discovery" 12 | . "github.com/mothership/rds-auth-proxy/pkg/discovery/rds" 13 | ) 14 | 15 | func TestRefreshBehaviorWithACLFailures(t *testing.T) { 16 | instances := []aws.DBInstanceResult{ 17 | instance(types.DBInstance{ 18 | DBInstanceIdentifier: strPtr("db-1"), 19 | Endpoint: endpoint("db-1", 5000), 20 | TagList: rdsTags("enabled", "false"), 21 | }), 22 | instance(types.DBInstance{ 23 | DBInstanceIdentifier: strPtr("db-2"), 24 | Endpoint: endpoint("db-2", 5000), 25 | TagList: rdsTags("enabled", "true"), 26 | }), 27 | instance(types.DBInstance{ 28 | DBInstanceIdentifier: strPtr("db-3"), 29 | Endpoint: endpoint("db-3", 5000), 30 | TagList: rdsTags("region", "east", "enabled", "true"), 31 | }), 32 | instance(types.DBInstance{ 33 | DBInstanceIdentifier: strPtr("db-4"), 34 | Endpoint: endpoint("db-4", 5000), 35 | TagList: rdsTags("region", "west", "enabled", "true"), 36 | }), 37 | } 38 | 39 | cases := []struct { 40 | Config config.ConfigFile 41 | Host string 42 | Expected error 43 | }{ 44 | // Case 0: Test no allow/block list 45 | { 46 | Config: configFromACL(nil, nil), 47 | Host: "db-2:5000", 48 | Expected: nil, 49 | }, 50 | // Case 1: Test allow list, no block list 51 | { 52 | Config: configFromACL(tags("enabled", "true"), nil), 53 | Host: "db-1:5000", 54 | Expected: discovery.ErrTargetNotFound, 55 | }, 56 | // Case 2: Test no allow list, block list 57 | { 58 | Config: configFromACL(nil, tags("enabled", "true")), 59 | Host: "db-1:5000", 60 | Expected: nil, 61 | }, 62 | // Case 3: Test blocklist overrides allow list 63 | { 64 | Config: configFromACL(tags("enabled", "true"), tags("enabled", "true")), 65 | Host: "db-1:5000", 66 | Expected: discovery.ErrTargetNotFound, 67 | }, 68 | // Case 4: Test multi-tags in allow list require all to be met 69 | { 70 | Config: configFromACL(tags("enabled", "true", "region", "west"), nil), 71 | Host: "db-3:5000", 72 | Expected: discovery.ErrTargetNotFound, 73 | }, 74 | // Case 5: Test multi-tags in block list require any to be met 75 | { 76 | Config: configFromACL(nil, tags("enabled", "false", "region", "west")), 77 | Host: "db-4:5000", 78 | Expected: discovery.ErrTargetNotFound, 79 | }, 80 | } 81 | 82 | for idx, test := range cases { 83 | client := NewRdsDiscoveryClient(&mockRDSClient{Return: instances}, &test.Config) 84 | if err := client.Refresh(context.Background()); err != nil { 85 | t.Fatalf("[Case %d] expected no error, got: %+v", idx, err) 86 | } 87 | _, err := client.LookupTargetByHost(test.Host) 88 | if err != test.Expected { 89 | t.Errorf("[Case %d] expected %+v. Got %+v.", idx, test.Expected, err) 90 | } 91 | } 92 | } 93 | 94 | func TestRefreshBehaviorWithACLSuccesses(t *testing.T) { 95 | instances := []aws.DBInstanceResult{ 96 | instance(types.DBInstance{ 97 | DBInstanceIdentifier: strPtr("db-1"), 98 | Endpoint: endpoint("db-1", 5000), 99 | TagList: rdsTags("enabled", "false"), 100 | }), 101 | instance(types.DBInstance{ 102 | DBInstanceIdentifier: strPtr("db-2"), 103 | Endpoint: endpoint("db-2", 5000), 104 | TagList: rdsTags("enabled", "true"), 105 | }), 106 | instance(types.DBInstance{ 107 | DBInstanceIdentifier: strPtr("db-3"), 108 | Endpoint: endpoint("db-3", 5000), 109 | TagList: rdsTags("region", "east", "enabled", "true"), 110 | }), 111 | instance(types.DBInstance{ 112 | DBInstanceIdentifier: strPtr("db-4"), 113 | Endpoint: endpoint("db-4", 5000), 114 | TagList: rdsTags("region", "west", "enabled", "true"), 115 | }), 116 | } 117 | cases := []struct { 118 | Config config.ConfigFile 119 | Host string 120 | Expected config.Target 121 | }{ 122 | // Case 0: Test no allow/block list 123 | { 124 | Config: configFromACL(nil, nil), 125 | Host: "db-2:5000", 126 | Expected: config.Target{Name: "db-2"}, 127 | }, 128 | // Case 1: Test block list still allows non-blocked dbs 129 | { 130 | Config: configFromACL(nil, tags("enabled", "true")), 131 | Host: "db-1:5000", 132 | Expected: config.Target{Name: "db-1"}, 133 | }, 134 | // Case 2: Test multi-tags in block list doesn't affect other dbs 135 | { 136 | Config: configFromACL(nil, tags("enabled", "false", "region", "west")), 137 | Host: "db-3:5000", 138 | Expected: config.Target{Name: "db-3"}, 139 | }, 140 | } 141 | for idx, test := range cases { 142 | client := NewRdsDiscoveryClient(&mockRDSClient{Return: instances}, &test.Config) 143 | if err := client.Refresh(context.Background()); err != nil { 144 | t.Fatalf("[Case %d] expected no error, got: %+v", idx, err) 145 | } 146 | target, err := client.LookupTargetByHost(test.Host) 147 | if err != nil { 148 | t.Fatalf("[Case %d] got unexpected error: %s", idx, err) 149 | } 150 | if target.Name != test.Expected.Name { 151 | t.Errorf("[Case %d] expected %+v. Got %+v.", idx, test.Expected, target) 152 | } 153 | } 154 | } 155 | 156 | func TestGetTargetByNameSuccesses(t *testing.T) { 157 | instances := []aws.DBInstanceResult{ 158 | instance(types.DBInstance{ 159 | DBInstanceIdentifier: strPtr("db-1"), 160 | Endpoint: endpoint("db-1", 5000), 161 | TagList: rdsTags("enabled", "false"), 162 | }), 163 | instance(types.DBInstance{ 164 | DBInstanceIdentifier: strPtr("db-2"), 165 | Endpoint: endpoint("db-2", 5000), 166 | TagList: rdsTags("enabled", "true"), 167 | }), 168 | } 169 | cases := []struct { 170 | Name string 171 | Expected config.Target 172 | }{ 173 | { 174 | Name: "db-2", 175 | Expected: config.Target{Name: "db-2"}, 176 | }, 177 | { 178 | Name: "db-1", 179 | Expected: config.Target{Name: "db-1"}, 180 | }, 181 | } 182 | for idx, test := range cases { 183 | config := configFromACL(nil, nil) 184 | client := NewRdsDiscoveryClient(&mockRDSClient{Return: instances}, &config) 185 | if err := client.Refresh(context.Background()); err != nil { 186 | t.Fatalf("[Case %d] expected no error, got: %+v", idx, err) 187 | } 188 | target, err := client.LookupTargetByName(test.Name) 189 | if err != nil { 190 | t.Fatalf("[Case %d] got unexpected error: %s", idx, err) 191 | } 192 | if target.Name != test.Expected.Name { 193 | t.Errorf("[Case %d] expected %+v. Got %+v.", idx, test.Expected, target) 194 | } 195 | } 196 | } 197 | 198 | func TestGetTargetByNameFailures(t *testing.T) { 199 | instances := []aws.DBInstanceResult{ 200 | instance(types.DBInstance{ 201 | DBInstanceIdentifier: strPtr("db-1"), 202 | Endpoint: endpoint("db-1", 5000), 203 | TagList: rdsTags("enabled", "false"), 204 | }), 205 | instance(types.DBInstance{ 206 | DBInstanceIdentifier: strPtr("db-2"), 207 | Endpoint: endpoint("db-2", 5000), 208 | TagList: rdsTags("enabled", "true"), 209 | }), 210 | } 211 | cases := []struct { 212 | Name string 213 | Expected error 214 | }{ 215 | { 216 | Name: "db-3", 217 | Expected: discovery.ErrTargetNotFound, 218 | }, 219 | } 220 | for idx, test := range cases { 221 | config := configFromACL(nil, nil) 222 | client := NewRdsDiscoveryClient(&mockRDSClient{Return: instances}, &config) 223 | if err := client.Refresh(context.Background()); err != nil { 224 | t.Fatalf("[Case %d] expected no error, got: %+v", idx, err) 225 | } 226 | _, err := client.LookupTargetByName(test.Name) 227 | if err != test.Expected { 228 | t.Fatalf("[Case %d] got %+v, expected error: %s", idx, err, test.Expected) 229 | } 230 | } 231 | } 232 | 233 | func TestRdsDiscoveryClientGetTargets(t *testing.T) { 234 | instances := []aws.DBInstanceResult{ 235 | instance(types.DBInstance{ 236 | DBInstanceIdentifier: strPtr("db-1"), 237 | Endpoint: endpoint("db-1", 5000), 238 | TagList: rdsTags("enabled", "false"), 239 | }), 240 | instance(types.DBInstance{ 241 | DBInstanceIdentifier: strPtr("db-2"), 242 | Endpoint: endpoint("db-2", 5000), 243 | TagList: rdsTags("enabled", "true"), 244 | }), 245 | } 246 | config := configFromACL(nil, nil) 247 | client := NewRdsDiscoveryClient(&mockRDSClient{Return: instances}, &config) 248 | if err := client.Refresh(context.Background()); err != nil { 249 | t.Fatalf("expected no error, got: %+v", err) 250 | } 251 | targets := client.GetTargets() 252 | if len(targets) != len(instances) { 253 | t.Fatalf("missing targets") 254 | } 255 | 256 | // TODO: sort and test that each instance was present, currently a low quality test 257 | } 258 | 259 | type mockRDSClient struct { 260 | Return []aws.DBInstanceResult 261 | } 262 | 263 | var _ aws.RDSClient = (*mockRDSClient)(nil) 264 | 265 | func (m *mockRDSClient) GetPostgresInstances(ctx context.Context) <-chan aws.DBInstanceResult { 266 | retChan := make(chan aws.DBInstanceResult, 1) 267 | go func() { 268 | defer close(retChan) 269 | for _, r := range m.Return { 270 | retChan <- r 271 | if r.Error != nil { 272 | return 273 | } 274 | } 275 | }() 276 | return retChan 277 | } 278 | 279 | func (m *mockRDSClient) NewAuthToken(ctx context.Context, host, region, user string) (string, error) { 280 | return "", nil 281 | } 282 | 283 | func (m *mockRDSClient) RegionForInstance(d types.DBInstance) (string, error) { 284 | return "us-west-2", nil 285 | } 286 | 287 | func instance(inst types.DBInstance) aws.DBInstanceResult { 288 | inst.IAMDatabaseAuthenticationEnabled = true 289 | return aws.DBInstanceResult{Instance: inst} 290 | } 291 | 292 | func rdsTags(pairs ...string) []types.Tag { 293 | if len(pairs)%2 != 0 { 294 | panic(fmt.Errorf("must pass key value pairs to rdsTags")) 295 | } 296 | tags := make([]types.Tag, 0, len(pairs)/2) 297 | for i := 0; i < len(pairs)/2+1; i += 2 { 298 | tags = append(tags, types.Tag{Key: &pairs[i], Value: &pairs[i+1]}) 299 | } 300 | return tags 301 | } 302 | 303 | func tags(pairs ...string) []*config.Tag { 304 | if len(pairs)%2 != 0 { 305 | panic(fmt.Errorf("must pass key value pairs to tags")) 306 | } 307 | tags := make([]*config.Tag, 0, len(pairs)/2) 308 | for i := 0; i < len(pairs)/2+1; i += 2 { 309 | tags = append(tags, &config.Tag{Name: pairs[i], Value: pairs[i+1]}) 310 | } 311 | return tags 312 | } 313 | 314 | func endpoint(host string, port int32) *types.Endpoint { 315 | return &types.Endpoint{Address: &host, Port: port} 316 | } 317 | 318 | func configFromACL(allowed []*config.Tag, blocked []*config.Tag) config.ConfigFile { 319 | return config.ConfigFile{ 320 | Targets: map[string]*config.Target{}, 321 | Proxy: config.Proxy{ 322 | SSL: config.ServerSSL{}, 323 | ACL: config.ACL{ 324 | AllowedRDSTags: config.TagList(allowed), 325 | BlockedRDSTags: config.TagList(blocked), 326 | }, 327 | }, 328 | } 329 | } 330 | 331 | func strPtr(val string) *string { 332 | return &val 333 | } 334 | --------------------------------------------------------------------------------