Skip to content

Commit a10e852

Browse files
committed
feat: Automatically configure connections using DNS. Part of #2043.
1 parent c85d88c commit a10e852

File tree

9 files changed

+404
-53
lines changed

9 files changed

+404
-53
lines changed

.github/workflows/tests.yml

+8
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,8 @@ jobs:
142142
POSTGRES_CAS_PASS:${{ vars.GOOGLE_CLOUD_PROJECT }}/POSTGRES_CAS_PASS
143143
POSTGRES_CUSTOMER_CAS_CONNECTION_NAME:${{ vars.GOOGLE_CLOUD_PROJECT }}/POSTGRES_CUSTOMER_CAS_CONNECTION_NAME
144144
POSTGRES_CUSTOMER_CAS_PASS:${{ vars.GOOGLE_CLOUD_PROJECT }}/POSTGRES_CUSTOMER_CAS_PASS
145+
POSTGRES_CUSTOMER_CAS_PASS_VALID_DOMAIN_NAME:${{ vars.GOOGLE_CLOUD_PROJECT }}/POSTGRES_CUSTOMER_CAS_PASS_VALID_DOMAIN_NAME
146+
POSTGRES_CUSTOMER_CAS_PASS_INVALID_DOMAIN_NAME:${{ vars.GOOGLE_CLOUD_PROJECT }}/POSTGRES_CUSTOMER_CAS_PASS_INVALID_DOMAIN_NAME
145147
SQLSERVER_CONNECTION_NAME:${{ vars.GOOGLE_CLOUD_PROJECT }}/SQLSERVER_CONNECTION_NAME
146148
SQLSERVER_USER:${{ vars.GOOGLE_CLOUD_PROJECT }}/SQLSERVER_USER
147149
SQLSERVER_PASS:${{ vars.GOOGLE_CLOUD_PROJECT }}/SQLSERVER_PASS
@@ -166,6 +168,8 @@ jobs:
166168
POSTGRES_CAS_PASS: "${{ steps.secrets.outputs.POSTGRES_CAS_PASS }}"
167169
POSTGRES_CUSTOMER_CAS_CONNECTION_NAME: "${{ steps.secrets.outputs.POSTGRES_CUSTOMER_CAS_CONNECTION_NAME }}"
168170
POSTGRES_CUSTOMER_CAS_PASS: "${{ steps.secrets.outputs.POSTGRES_CUSTOMER_CAS_PASS }}"
171+
POSTGRES_CUSTOMER_CAS_PASS_VALID_DOMAIN_NAME: "${{ steps.secrets.outputs.POSTGRES_CUSTOMER_CAS_PASS_VALID_DOMAIN_NAME }}"
172+
POSTGRES_CUSTOMER_CAS_PASS_INVALID_DOMAIN_NAME: "${{ steps.secrets.outputs.POSTGRES_CUSTOMER_CAS_PASS_INVALID_DOMAIN_NAME }}"
169173
SQLSERVER_CONNECTION_NAME: "${{ steps.secrets.outputs.SQLSERVER_CONNECTION_NAME }}"
170174
SQLSERVER_USER: "${{ steps.secrets.outputs.SQLSERVER_USER }}"
171175
SQLSERVER_PASS: "${{ steps.secrets.outputs.SQLSERVER_PASS }}"
@@ -249,6 +253,8 @@ jobs:
249253
POSTGRES_CAS_PASS:${{ vars.GOOGLE_CLOUD_PROJECT }}/POSTGRES_CAS_PASS
250254
POSTGRES_CUSTOMER_CAS_CONNECTION_NAME:${{ vars.GOOGLE_CLOUD_PROJECT }}/POSTGRES_CUSTOMER_CAS_CONNECTION_NAME
251255
POSTGRES_CUSTOMER_CAS_PASS:${{ vars.GOOGLE_CLOUD_PROJECT }}/POSTGRES_CUSTOMER_CAS_PASS
256+
POSTGRES_CUSTOMER_CAS_PASS_VALID_DOMAIN_NAME:${{ vars.GOOGLE_CLOUD_PROJECT }}/POSTGRES_CUSTOMER_CAS_PASS_VALID_DOMAIN_NAME
257+
POSTGRES_CUSTOMER_CAS_PASS_INVALID_DOMAIN_NAME:${{ vars.GOOGLE_CLOUD_PROJECT }}/POSTGRES_CUSTOMER_CAS_PASS_INVALID_DOMAIN_NAME
252258
SQLSERVER_CONNECTION_NAME:${{ vars.GOOGLE_CLOUD_PROJECT }}/SQLSERVER_CONNECTION_NAME
253259
SQLSERVER_USER:${{ vars.GOOGLE_CLOUD_PROJECT }}/SQLSERVER_USER
254260
SQLSERVER_PASS:${{ vars.GOOGLE_CLOUD_PROJECT }}/SQLSERVER_PASS
@@ -274,6 +280,8 @@ jobs:
274280
POSTGRES_CAS_PASS: "${{ steps.secrets.outputs.POSTGRES_CAS_PASS }}"
275281
POSTGRES_CUSTOMER_CAS_CONNECTION_NAME: "${{ steps.secrets.outputs.POSTGRES_CUSTOMER_CAS_CONNECTION_NAME }}"
276282
POSTGRES_CUSTOMER_CAS_PASS: "${{ steps.secrets.outputs.POSTGRES_CUSTOMER_CAS_PASS }}"
283+
POSTGRES_CUSTOMER_CAS_PASS_VALID_DOMAIN_NAME: "${{ steps.secrets.outputs.POSTGRES_CUSTOMER_CAS_PASS_VALID_DOMAIN_NAME }}"
284+
POSTGRES_CUSTOMER_CAS_PASS_INVALID_DOMAIN_NAME: "${{ steps.secrets.outputs.POSTGRES_CUSTOMER_CAS_PASS_INVALID_DOMAIN_NAME }}"
277285
SQLSERVER_CONNECTION_NAME: "${{ steps.secrets.outputs.SQLSERVER_CONNECTION_NAME }}"
278286
SQLSERVER_USER: "${{ steps.secrets.outputs.SQLSERVER_USER }}"
279287
SQLSERVER_PASS: "${{ steps.secrets.outputs.SQLSERVER_PASS }}"

core/src/main/java/com/google/cloud/sql/core/Connector.java

+10-7
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,8 @@ class Connector {
4949
private final int serverProxyPort;
5050
private final ConnectorConfig config;
5151

52+
private final InstanceConnectionNameResolver instanceNameResolver;
53+
5254
Connector(
5355
ConnectorConfig config,
5456
ConnectionInfoRepositoryFactory connectionInfoRepositoryFactory,
@@ -57,7 +59,8 @@ class Connector {
5759
ListenableFuture<KeyPair> localKeyPair,
5860
long minRefreshDelayMs,
5961
long refreshTimeoutMs,
60-
int serverProxyPort) {
62+
int serverProxyPort,
63+
InstanceConnectionNameResolver instanceNameResolver) {
6164
this.config = config;
6265

6366
this.adminApi =
@@ -67,6 +70,7 @@ class Connector {
6770
this.localKeyPair = localKeyPair;
6871
this.minRefreshDelayMs = minRefreshDelayMs;
6972
this.serverProxyPort = serverProxyPort;
73+
this.instanceNameResolver = instanceNameResolver;
7074
}
7175

7276
public ConnectorConfig getConfig() {
@@ -174,17 +178,16 @@ private ConnectionConfig resolveConnectionName(ConnectionConfig config) {
174178
final String unresolvedName = config.getDomainName();
175179
final Function<String, String> resolver =
176180
config.getConnectorConfig().getInstanceNameResolver();
181+
CloudSqlInstanceName name;
177182
if (resolver != null) {
178-
return config.withCloudSqlInstance(resolver.apply(unresolvedName));
183+
name = instanceNameResolver.resolve(resolver.apply(unresolvedName));
179184
} else {
180-
throw new IllegalStateException(
181-
"Can't resolve domain " + unresolvedName + ". ConnectorConfig.resolver is not set.");
185+
name = instanceNameResolver.resolve(unresolvedName);
182186
}
187+
return config.withCloudSqlInstance(name.getConnectionName());
183188
} catch (IllegalArgumentException e) {
184189
throw new IllegalArgumentException(
185-
String.format(
186-
"Cloud SQL connection name is invalid: \"%s\"", config.getCloudSqlInstance()),
187-
e);
190+
String.format("Cloud SQL connection name is invalid: \"%s\"", config.getDomainName()), e);
188191
}
189192
}
190193

Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
/*
2+
* Copyright 2025 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package com.google.cloud.sql.core;
18+
19+
import java.util.Collection;
20+
import java.util.Objects;
21+
import javax.naming.NameNotFoundException;
22+
import org.slf4j.Logger;
23+
import org.slf4j.LoggerFactory;
24+
25+
/**
26+
* An implementation of InstanceConnectionNameResolver that uses DNS TXT records to resolve an
27+
* instance name from a domain name.
28+
*/
29+
class DnsInstanceConnectionNameResolver implements InstanceConnectionNameResolver {
30+
private static final Logger logger =
31+
LoggerFactory.getLogger(DnsInstanceConnectionNameResolver.class);
32+
33+
private final DnsResolver dnsResolver;
34+
35+
public DnsInstanceConnectionNameResolver(DnsResolver dnsResolver) {
36+
this.dnsResolver = dnsResolver;
37+
}
38+
39+
@Override
40+
public CloudSqlInstanceName resolve(final String name) {
41+
// Attempt to parse the instance name
42+
try {
43+
return new CloudSqlInstanceName(name);
44+
} catch (IllegalArgumentException e) {
45+
// Not a well-formed instance name.
46+
}
47+
48+
// Next, attempt to resolve DNS name.
49+
Collection<String> instanceNames;
50+
try {
51+
instanceNames = this.dnsResolver.resolveTxt(name);
52+
} catch (NameNotFoundException ne) {
53+
// No DNS record found. This is not a valid instance name.
54+
throw new IllegalArgumentException(
55+
String.format("Unable to resolve TXT record for \"%s\".", name));
56+
}
57+
58+
// Use the first valid instance name from the list
59+
// or throw an IllegalArgumentException if none of the values can be parsed.
60+
return instanceNames.stream()
61+
.map(
62+
target -> {
63+
try {
64+
return new CloudSqlInstanceName(target, name);
65+
} catch (IllegalArgumentException e) {
66+
logger.info(
67+
"Unable to parse instance name in TXT record for "
68+
+ "domain name \"{}\" with target \"{}\"",
69+
name,
70+
target,
71+
e);
72+
return null;
73+
}
74+
})
75+
.filter(Objects::nonNull)
76+
.findFirst()
77+
.orElseThrow(
78+
() ->
79+
new IllegalArgumentException(
80+
String.format("Unable to parse values of TXT record for \"%s\".", name)));
81+
}
82+
}

core/src/main/java/com/google/cloud/sql/core/DnsResolver.java

+1
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
import java.util.Collection;
2020
import javax.naming.NameNotFoundException;
2121

22+
/** Wraps the Java DNS API. */
2223
interface DnsResolver {
2324
Collection<String> resolveTxt(String domainName) throws NameNotFoundException;
2425
}

core/src/main/java/com/google/cloud/sql/core/InstanceCheckingTrustManger.java

+11-3
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616

1717
package com.google.cloud.sql.core;
1818

19+
import com.google.common.base.Strings;
1920
import java.net.Socket;
2021
import java.security.cert.CertificateException;
2122
import java.security.cert.X509Certificate;
@@ -103,20 +104,27 @@ private void checkCertificateChain(X509Certificate[] chain) throws CertificateEx
103104
}
104105

105106
private void checkSan(X509Certificate[] chain) throws CertificateException {
106-
List<String> sans = getSans(chain[0]);
107-
String dns = instanceMetadata.getDnsName();
107+
final String dns;
108+
if (!Strings.isNullOrEmpty(instanceMetadata.getInstanceName().getDomainName())) {
109+
dns = instanceMetadata.getInstanceName().getDomainName();
110+
} else {
111+
dns = instanceMetadata.getDnsName();
112+
}
113+
108114
if (dns == null || dns.isEmpty()) {
109115
throw new CertificateException(
110116
"Instance metadata for " + instanceMetadata.getInstanceName() + " has an empty dnsName");
111117
}
118+
119+
List<String> sans = getSans(chain[0]);
112120
for (String san : sans) {
113121
if (san.equalsIgnoreCase(dns)) {
114122
return;
115123
}
116124
}
117125
throw new CertificateException(
118126
"Server certificate does not contain expected name '"
119-
+ instanceMetadata.getDnsName()
127+
+ dns
120128
+ "' for Cloud SQL instance "
121129
+ instanceMetadata.getInstanceName());
122130
}
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
/*
2+
* Copyright 2025 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package com.google.cloud.sql.core;
18+
19+
/** Resolves the Cloud SQL Instance from the configuration name. */
20+
interface InstanceConnectionNameResolver {
21+
22+
/**
23+
* Resolves the CloudSqlInstanceName from a configuration string value.
24+
*
25+
* @param name the configuration string
26+
* @return the CloudSqlInstanceName
27+
* @throws IllegalArgumentException if the name cannot be resolved.
28+
*/
29+
CloudSqlInstanceName resolve(String name);
30+
}

core/src/main/java/com/google/cloud/sql/core/InternalConnectorRegistry.java

+5-4
Original file line numberDiff line numberDiff line change
@@ -172,9 +172,9 @@ public Socket connect(ConnectionConfig config) throws IOException, InterruptedEx
172172

173173
// Validate parameters
174174
Preconditions.checkArgument(
175-
config.getCloudSqlInstance() != null,
176-
"cloudSqlInstance property not set. Please specify this property in the JDBC URL or the "
177-
+ "connection Properties with value in form \"project:region:instance\"");
175+
config.getCloudSqlInstance() != null || config.getDomainName() != null,
176+
"cloudSqlInstance property and hostname not set. Please specify either cloudSqlInstance or the database hostname in the JDBC URL or the "
177+
+ "connection Properties. cloudSqlInstance should contain a value in form \"project:region:instance\"");
178178

179179
return getConnector(config).connect(config, connectTimeoutMs);
180180
}
@@ -332,7 +332,8 @@ private Connector createConnector(ConnectorConfig config) {
332332
localKeyPair,
333333
MIN_REFRESH_DELAY_MS,
334334
connectTimeoutMs,
335-
serverProxyPort);
335+
serverProxyPort,
336+
new DnsInstanceConnectionNameResolver(new JndiDnsResolver()));
336337
}
337338

338339
/** Register the configuration for a named connector. */

0 commit comments

Comments
 (0)