fixed ssl configuration bug when connecting to neo4j aura pro instances and up

fixes #62

Author: transistive

src/Bolt/BoltConnectionPool.php

@@ -16,8 +16,7 @@
 use Bolt\connection\StreamSocket;
 use Exception;
 use function explode;
-use const FILTER_VALIDATE_IP;
-use function filter_var;
+use Laudis\Neo4j\Common\TransactionHelper;
 use Laudis\Neo4j\Contracts\AuthenticateInterface;
 use Laudis\Neo4j\Contracts\ConnectionPoolInterface;
 use Laudis\Neo4j\Enum\AccessMode;
@@ -42,25 +41,9 @@ public function acquire(UriInterface $uri, AccessMode $mode, AuthenticateInterfa
         $sslConfig = $explosion[1] ?? '';
 
         if (str_starts_with('s', $sslConfig)) {
-            $this->enableSsl($host, $sslConfig, $socket);
+            TransactionHelper::enableSsl($host, $sslConfig, $socket);
         }
 
         return $socket;
     }
-
-    private function enableSsl(string $host, string $sslConfig, StreamSocket $sock): void
-    {
-        // Pass a standard option to enable ssl as there is no direct flag
-        // and \Bolt\Bolt only turns on ssl if an option is passed.
-        $options = ['verify_peer' => true];
-        if (!filter_var($host, FILTER_VALIDATE_IP)) {
-            $options['SNI_enabled'] = true;
-        }
-        if ($sslConfig === 's') {
-            $sock->setSslContextOptions($options);
-        } elseif ($sslConfig === 'ssc') {
-            $options['allow_self_signed'] = true;
-            $sock->setSslContextOptions($options);
-        }
-    }
 }

src/Common/TransactionHelper.php

@@ -13,6 +13,9 @@
 
 namespace Laudis\Neo4j\Common;
 
+use Bolt\connection\StreamSocket;
+use const FILTER_VALIDATE_IP;
+use function filter_var;
 use Laudis\Neo4j\Contracts\TransactionInterface;
 use Laudis\Neo4j\Contracts\UnmanagedTransactionInterface;
 use Laudis\Neo4j\Databags\TransactionConfiguration;
@@ -52,4 +55,22 @@ public static function retry(callable $tsxFactory, callable $tsxHandler, Transac
             }
         }
     }
+
+    public static function enableSsl(string $host, string $sslConfig, StreamSocket $sock): void
+    {
+        $options = [
+            'verify_peer' => true,
+//            'verify_peer_name' => false,
+            'peer_name' => $host,
+        ];
+        if (!filter_var($host, FILTER_VALIDATE_IP)) {
+            $options['SNI_enabled'] = true;
+        }
+        if ($sslConfig === 's') {
+            $sock->setSslContextOptions($options);
+        } elseif ($sslConfig === 'ssc') {
+            $options['allow_self_signed'] = true;
+            $sock->setSslContextOptions($options);
+        }
+    }
 }

src/Neo4j/Neo4jConnectionPool.php

@@ -16,9 +16,8 @@
 use Bolt\connection\StreamSocket;
 use Exception;
 use function explode;
-use const FILTER_VALIDATE_IP;
-use function filter_var;
 use Laudis\Neo4j\Bolt\BoltDriver;
+use Laudis\Neo4j\Common\TransactionHelper;
 use Laudis\Neo4j\Common\Uri;
 use Laudis\Neo4j\Contracts\AuthenticateInterface;
 use Laudis\Neo4j\Contracts\ConnectionPoolInterface;
@@ -57,50 +56,39 @@ public function acquire(UriInterface $uri, AccessMode $mode, AuthenticateInterfa
         $table = $this->routingTable($uri, $authenticate);
         $server = $this->getNextServer($table, $mode);
 
-        $socket = $this->pool->acquire(Uri::create($server), $mode, $authenticate);
+        $socket = $this->pool->acquire($server, $mode, $authenticate);
 
         $scheme = $uri->getScheme();
         $explosion = explode('+', $scheme, 2);
         $sslConfig = $explosion[1] ?? '';
 
         if (str_starts_with('s', $sslConfig)) {
-            $this->enableSsl($server, $sslConfig, $socket, $uri);
+            // We have to pass a different host when working with ssl on aura.
+            // There is a strange behaviour where if we pass the uri host on a single
+            // instance aura deployment, we need to pass the original uri for the
+            // ssl configuration to be valid.
+            if ($table->getWithRole()->count() > 1) {
+                TransactionHelper::enableSsl($server->getHost(), $sslConfig, $socket);
+            } else {
+                TransactionHelper::enableSsl($uri->getHost(), $sslConfig, $socket);
+            }
         }
 
         return $socket;
     }
 
-    private function enableSsl(string $host, string $sslConfig, StreamSocket $sock, UriInterface $uri): void
-    {
-        // Pass a standard option to enable ssl as there is no direct flag
-        // and \Bolt\Bolt only turns on ssl if an option is passed.
-        $options = [
-            'verify_peer' => true,
-            'peer_name' => $uri->getHost(),
-        ];
-        if (!filter_var($host, FILTER_VALIDATE_IP)) {
-            $options['SNI_enabled'] = true;
-        }
-        if ($sslConfig === 's') {
-            $sock->setSslContextOptions($options);
-        } elseif ($sslConfig === 'ssc') {
-            $options['allow_self_signed'] = true;
-            $sock->setSslContextOptions($options);
-        }
-    }
-
     /**
      * @throws Exception
      */
-    private function getNextServer(RoutingTable $table, AccessMode $mode): string
+    private function getNextServer(RoutingTable $table, AccessMode $mode): Uri
     {
         if (AccessMode::WRITE() === $mode) {
             $servers = $table->getWithRole(RoutingRoles::LEADER());
         } else {
             $servers = $table->getWithRole(RoutingRoles::FOLLOWER());
         }
 
-        return $servers->get(random_int(0, $servers->count() - 1));
+        return Uri::create($servers->get(random_int(0, $servers->count() - 1)));
     }
 
     /**

src/Neo4j/RoutingTable.php

@@ -40,12 +40,12 @@ public function getTtl(): int
     /**
      * @return Set<string>
      */
-    public function getWithRole(RoutingRoles $role): Set
+    public function getWithRole(RoutingRoles $role = null): Set
     {
         /** @psalm-var Set<string> $tbr */
         $tbr = new Set();
         foreach ($this->servers as $server) {
-            if (in_array($server['role'], $role->getValue(), true)) {
+            if ($role === null || in_array($server['role'], $role->getValue(), true)) {
                 foreach ($server['addresses'] as $address) {
                     $tbr->add($address);
                 }