hyperledger-labs / fabric-smart-client / 40498207671

92%

Build Type

push

github

Committed by web-flow

Commit Message

fix(storage): keep every Postgres host when TLS is enabled (#2276)

With the Postgres tls block enabled, createTLSConnConfig reset the Fallbacks that pgx builds from the dataSource, so only the first host of a multi-host dataSource was ever tried. A node configured with postgres://u:p@pg-a:5432,pg-b:5432/db?target_session_attrs=read-write could not fail over to pg-b.

createTLSConnConfig now builds the connection attempts for every host, in order. Each host gets the attempts its ssl_mode requires: prefer tries TLS then plaintext, allow tries plaintext then TLS, as pgx does for a dataSource sslmode. Every TLS attempt has the verification settings and credentials of the mode, and verifies against its own host name unless server_name is set. A unix-socket host gets one plaintext attempt, as in pgx and libpq. target_session_attrs and per-host ports are kept. The tlsFallback and plaintextFallback helpers are removed.

TestCreateTLSConnConfigMultiHost checks the attempts for every ssl_mode, including each attempt's verification level and credentials. TestTLSConnConfigConnectsToSecondHost refuses connections on the first host and checks that the second host is dialed.

docs/configuration.md describes how the tls block handles a multi-host dataSource.

Fixes #2269

Signed-off-by: Marcus Brandenburger <bur@zurich.ibm.com>

Coverage Stats

33 of 33 new or added lines in 1 file covered. (100.0%)

6 existing lines in 3 files now uncovered.

30099 of 32927 relevant lines covered (91.41%)

1247.54 hits per line