From: Heikki Linnakangas <heikki.linnakangas@iki.fi>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Support TLS handshake directly without SSLRequest negotiation
Date: Mon, 08 Apr 2024 01:25:40 +0000
Message-ID: <E1rtdlT-001384-IY@gemulon.postgresql.org> (raw)
Support TLS handshake directly without SSLRequest negotiation
By skipping SSLRequest, you can eliminate one round-trip when
establishing a TLS connection. It is also more friendly to generic TLS
proxies that don't understand the PostgreSQL protocol.
This is disabled by default in libpq, because the direct TLS handshake
will fail with old server versions. It can be enabled with the
sslnegotation=direct option. It will still fall back to the negotiated
TLS handshake if the server rejects the direct attempt, either because
it is an older version or the server doesn't support TLS at all, but
the fallback can be disabled with the sslnegotiation=requiredirect
option.
Author: Greg Stark, Heikki Linnakangas
Reviewed-by: Matthias van de Meent, Jacob Champion
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/d39a49c1e459804831302807c724fa6512e90cf0
Modified Files
--------------
doc/src/sgml/libpq.sgml | 87 ++++-
doc/src/sgml/protocol.sgml | 36 +++
src/backend/libpq/be-secure.c | 52 ++-
src/backend/libpq/pqcomm.c | 12 +-
src/backend/tcop/backend_startup.c | 98 +++++-
src/include/libpq/libpq-be.h | 13 +
src/include/libpq/libpq.h | 2 +-
src/interfaces/libpq/fe-connect.c | 102 +++++-
src/interfaces/libpq/fe-secure-openssl.c | 7 +-
src/interfaces/libpq/libpq-fe.h | 4 +-
src/interfaces/libpq/libpq-int.h | 6 +-
.../libpq_encryption/t/001_negotiate_encryption.pl | 357 +++++++++++++--------
12 files changed, 609 insertions(+), 167 deletions(-)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: heikki.linnakangas@iki.fi, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Support TLS handshake directly without SSLRequest negotiation
In-Reply-To: <E1rtdlT-001384-IY@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox