database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-10-24 01:29:19 +03:00
Code Activity

Support TLS handshake directly without SSLRequest negotiation

Browse Source 
By skipping SSLRequest, you can eliminate one round-trip when
establishing a TLS connection. It is also more friendly to generic TLS
proxies that don't understand the PostgreSQL protocol.

This is disabled by default in libpq, because the direct TLS handshake
will fail with old server versions. It can be enabled with the
sslnegotation=direct option. It will still fall back to the negotiated
TLS handshake if the server rejects the direct attempt, either because
it is an older version or the server doesn't support TLS at all, but
the fallback can be disabled with the sslnegotiation=requiredirect
option.

Author: Greg Stark, Heikki Linnakangas
Reviewed-by: Matthias van de Meent, Jacob Champion
This commit is contained in:
Heikki Linnakangas
2024-04-08 04:24:49 +03:00
parent 05fd30c0e7
commit d39a49c1e4
12 changed files with 604 additions and 162 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/interfaces/libpq/fe-secure-openssl.c
View File

@@ -1612,6 +1612,7 @@ pgtls_close(PGconn *conn)
SSL_free(conn->ssl);
conn->ssl = NULL;
conn->ssl_in_use = false;
conn->ssl_handshake_started = false;
destroy_needed = true;
}
@@ -1825,9 +1826,10 @@ static BIO_METHOD *my_bio_methods;
static int
my_sock_read(BIO *h, char *buf, int size)
{
PGconn *conn = (PGconn *) BIO_get_app_data(h);
int res;
res = pqsecure_raw_read((PGconn *) BIO_get_app_data(h), buf, size);
res = pqsecure_raw_read(conn, buf, size);
BIO_clear_retry_flags(h);
if (res < 0)
{
@@ -1849,6 +1851,9 @@ my_sock_read(BIO *h, char *buf, int size)
}
}
if (res > 0)
conn->ssl_handshake_started = true;
return res;
}