Line data    Source code

       1              : //! Client authentication mechanisms.
       2              : 
       3              : pub mod backend;
       4              : pub use backend::BackendType;
       5              : 
       6              : mod credentials;
       7              : pub use credentials::{
       8              :     check_peer_addr_is_in_list, endpoint_sni, ComputeUserInfoMaybeEndpoint,
       9              :     ComputeUserInfoParseError, IpPattern,
      10              : };
      11              : 
      12              : mod password_hack;
      13              : pub use password_hack::parse_endpoint_param;
      14              : use password_hack::PasswordHackPayload;
      15              : 
      16              : mod flow;
      17              : pub use flow::*;
      18              : use tokio::time::error::Elapsed;
      19              : 
      20              : use crate::{
      21              :     console,
      22              :     error::{ReportableError, UserFacingError},
      23              : };
      24              : use std::io;
      25              : use thiserror::Error;
      26              : 
      27              : /// Convenience wrapper for the authentication error.
      28              : pub type Result<T> = std::result::Result<T, AuthError>;
      29              : 
      30              : /// Common authentication error.
      31          116 : #[derive(Debug, Error)]
      32              : pub enum AuthErrorImpl {
      33              :     #[error(transparent)]
      34              :     Link(#[from] backend::LinkAuthError),
      35              : 
      36              :     #[error(transparent)]
      37              :     GetAuthInfo(#[from] console::errors::GetAuthInfoError),
      38              : 
      39              :     /// SASL protocol errors (includes [SCRAM](crate::scram)).
      40              :     #[error(transparent)]
      41              :     Sasl(#[from] crate::sasl::Error),
      42              : 
      43              :     #[error("Unsupported authentication method: {0}")]
      44              :     BadAuthMethod(Box<str>),
      45              : 
      46              :     #[error("Malformed password message: {0}")]
      47              :     MalformedPassword(&'static str),
      48              : 
      49              :     #[error(
      50              :         "Endpoint ID is not specified. \
      51              :         Either please upgrade the postgres client library (libpq) for SNI support \
      52              :         or pass the endpoint ID (first part of the domain name) as a parameter: '?options=endpoint%3D<endpoint-id>'. \
      53              :         See more at https://neon.tech/sni"
      54              :     )]
      55              :     MissingEndpointName,
      56              : 
      57              :     #[error("password authentication failed for user '{0}'")]
      58              :     AuthFailed(Box<str>),
      59              : 
      60              :     /// Errors produced by e.g. [`crate::stream::PqStream`].
      61              :     #[error(transparent)]
      62              :     Io(#[from] io::Error),
      63              : 
      64              :     #[error(
      65              :         "This IP address is not allowed to connect to this endpoint. \
      66              :         Please add it to the allowed list in the Neon console."
      67              :     )]
      68              :     IpAddressNotAllowed,
      69              : 
      70              :     #[error("Too many connections to this endpoint. Please try again later.")]
      71              :     TooManyConnections,
      72              : 
      73              :     #[error("Authentication timed out")]
      74              :     UserTimeout(Elapsed),
      75              : }
      76              : 
      77          116 : #[derive(Debug, Error)]
      78              : #[error(transparent)]
      79              : pub struct AuthError(Box<AuthErrorImpl>);
      80              : 
      81              : impl AuthError {
      82            0 :     pub fn bad_auth_method(name: impl Into<Box<str>>) -> Self {
      83            0 :         AuthErrorImpl::BadAuthMethod(name.into()).into()
      84            0 :     }
      85              : 
      86            5 :     pub fn auth_failed(user: impl Into<Box<str>>) -> Self {
      87            5 :         AuthErrorImpl::AuthFailed(user.into()).into()
      88            5 :     }
      89              : 
      90            4 :     pub fn ip_address_not_allowed() -> Self {
      91            4 :         AuthErrorImpl::IpAddressNotAllowed.into()
      92            4 :     }
      93              : 
      94            0 :     pub fn too_many_connections() -> Self {
      95            0 :         AuthErrorImpl::TooManyConnections.into()
      96            0 :     }
      97              : 
      98            3 :     pub fn is_auth_failed(&self) -> bool {
      99            3 :         matches!(self.0.as_ref(), AuthErrorImpl::AuthFailed(_))
     100            3 :     }
     101              : 
     102            0 :     pub fn user_timeout(elapsed: Elapsed) -> Self {
     103            0 :         AuthErrorImpl::UserTimeout(elapsed).into()
     104            0 :     }
     105              : }
     106              : 
     107              : impl<E: Into<AuthErrorImpl>> From<E> for AuthError {
     108           26 :     fn from(e: E) -> Self {
     109           26 :         Self(Box::new(e.into()))
     110           26 :     }
     111              : }
     112              : 
     113              : impl UserFacingError for AuthError {
     114           11 :     fn to_string_client(&self) -> String {
     115           11 :         use AuthErrorImpl::*;
     116           11 :         match self.0.as_ref() {
     117            0 :             Link(e) => e.to_string_client(),
     118            4 :             GetAuthInfo(e) => e.to_string_client(),
     119            0 :             Sasl(e) => e.to_string_client(),
     120            3 :             AuthFailed(_) => self.to_string(),
     121            0 :             BadAuthMethod(_) => self.to_string(),
     122            0 :             MalformedPassword(_) => self.to_string(),
     123            1 :             MissingEndpointName => self.to_string(),
     124            0 :             Io(_) => "Internal error".to_string(),
     125            3 :             IpAddressNotAllowed => self.to_string(),
     126            0 :             TooManyConnections => self.to_string(),
     127            0 :             UserTimeout(_) => self.to_string(),
     128              :         }
     129           11 :     }
     130              : }
     131              : 
     132              : impl ReportableError for AuthError {
     133           11 :     fn get_error_kind(&self) -> crate::error::ErrorKind {
     134           11 :         use AuthErrorImpl::*;
     135           11 :         match self.0.as_ref() {
     136            0 :             Link(e) => e.get_error_kind(),
     137            4 :             GetAuthInfo(e) => e.get_error_kind(),
     138            0 :             Sasl(e) => e.get_error_kind(),
     139            3 :             AuthFailed(_) => crate::error::ErrorKind::User,
     140            0 :             BadAuthMethod(_) => crate::error::ErrorKind::User,
     141            0 :             MalformedPassword(_) => crate::error::ErrorKind::User,
     142            1 :             MissingEndpointName => crate::error::ErrorKind::User,
     143            0 :             Io(_) => crate::error::ErrorKind::ClientDisconnect,
     144            3 :             IpAddressNotAllowed => crate::error::ErrorKind::User,
     145            0 :             TooManyConnections => crate::error::ErrorKind::RateLimit,
     146            0 :             UserTimeout(_) => crate::error::ErrorKind::User,
     147              :         }
     148           11 :     }
     149              : }