Repository navigation
feat: route the driver through the host's SSH SOCKS5 proxy - #13
Open
vinimcorrea wants to merge 1 commit into
Open
vinimcorrea wants to merge 1 commit into
vinimcorrea wants to merge 1 commit into
Conversation
…DB#12) Declare the socks5_proxy capability. When SSH is enabled, Tabularis opens a SOCKS5 proxy over the SSH session and sends socks5_proxy_host, socks5_proxy_port and, when required, socks5_proxy_username and socks5_proxy_password. The plugin adds them to the URI as proxyHost, proxyPort, proxyUsername and proxyPassword, so every node the driver connects to, including nodes discovered through SRV, goes through the tunnel and the SSH server resolves their hostnames. - A URI that already sets a proxy option is rejected with a clear error instead of silently bypassing the SSH tunnel. - Proxy username and password must be provided together. - Enable the mongodb socks5-proxy feature. - Document SSH tunnels and the local SRV/TXT DNS limitation.
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Reviewed Files Reviewed (5 files)
Reviewed by claude-sonnet-5.5 · Input: 248 · Output: 1.5K · Cached: 167.5K |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #12
Host side: TabularisDB/tabularis#1467. It must merge first; without it, the host never sends the proxy fields and this plugin behaves as before.
Problem
With SSH enabled, the host forwards one local port to the connection's
host:portand gives the plugin127.0.0.1:<port>. Amongodb+srv://URI or a replica-set seedlist makes the driver discover the other members and connect to them by name, bypassing that forward. Only a single node works, and Atlas Private Link and replica sets behind a bastion can't be reached (#12).Changes
The host PR adds a
socks5_proxydriver capability. A driver that declares it gets a SOCKS5 proxy over the SSH session, and the host leaveshost,portandconnection_uriunchanged. Themongodbcrate supports a SOCKS5 proxy through itssocks5-proxyfeature and theproxy*URI options, so the plugin only needs to pass the proxy on..tabularium"socks5_proxy": trueCargo.tomlsocks5-proxyfeature ofmongodbsrc/main.rsapply_socks5_proxy()addsproxyHost,proxyPortand, when present,proxyUsername/proxyPasswordto the URI, for both aconnection_uriand one built from the legacy fieldsREADME.mdThe driver gives the proxy hostnames unresolved, so the bastion resolves node names such as
pl-0-...mongodb.netormongo-internal.Conflict with a proxy already in the URI. If SSH is enabled and the URI already sets
proxyHost,proxyPort,proxyUsernameorproxyPassword, the connection fails with an error. It doesn't pick one of the two proxies silently, so the SSH tab can't look active while the traffic takes another route:Without SSH, a URI proxy is used as before.
Other checks: the username and password must come together, the port must be valid, the credentials are percent-encoded, and the proxy password is masked in error messages.
Testing
cargo test: 43 passed. New tests cover appending the proxy to SRV and seedlist URIs (with and without a path or options), the URI conflict, URI proxies kept without SSH, credential encoding and pairing, masking, legacy fields, and port validation.mongo:7.0replica set whose only member ismongo-internal:27017, a name that resolves only on the bastion's network:shop.ordersthrough both host backends (russh with proxy credentials, and systemssh -D).proxyHostgave the error above.pl-0-...:1462,:1463and:1464, one per replica-set member.Limits
mongodb+srv://, the driver resolves the SRV and TXT records with the local resolver before connecting. If those records are published only in the private network's DNS, discovery fails, and amongodb://seedlist is needed. Atlas publishes them publicly, so Private Link works. I haven't been able to test a network where they are private-only.