dont set ssl negotiation packet

neondatabase · Jul 9, 2024 · fdceee4 · fdceee4
1 parent 2dd9d1a
commit fdceee4
Show file tree

Hide file tree

Showing 4 changed files with 26 additions and 10 deletions.
diff --git a/libs/postgres_backend/src/lib.rs b/libs/postgres_backend/src/lib.rs
@@ -672,11 +672,17 @@ impl<IO: AsyncRead + AsyncWrite + Unpin> PostgresBackend<IO> {
         assert!(self.state < ProtoState::Authentication);
         let have_tls = self.tls_config.is_some();
         match msg {
-            FeStartupPacket::SslRequest => {
+            FeStartupPacket::SslRequest { direct } => {
                 debug!("SSL requested");
 
-                self.write_message(&BeMessage::EncryptionResponse(have_tls))
-                    .await?;
+                if !direct {
+                    self.write_message(&BeMessage::EncryptionResponse(have_tls))
+                        .await?;
+                } else if !have_tls {
+                    return Err(QueryError::Other(anyhow::anyhow!(
+                        "direct SSL negotiation but no TLS support"
+                    )));
+                }
 
                 if have_tls {
                     self.start_tls().await?;

diff --git a/libs/pq_proto/src/lib.rs b/libs/pq_proto/src/lib.rs
@@ -66,7 +66,9 @@ impl fmt::Debug for ProtocolVersion {
 #[derive(Debug)]
 pub enum FeStartupPacket {
     CancelRequest(CancelKeyData),
-    SslRequest,
+    SslRequest {
+        direct: bool,
+    },
     GssEncRequest,
     StartupMessage {
         version: ProtocolVersion,
@@ -339,7 +341,7 @@ impl FeStartupPacket {
         // (It can't be a Postgres startup length because in network byte order
         // that would be a startup packet hundreds of megabytes long)
         if buf.first() == Some(&0x16) {
-            return Ok(Some(FeStartupPacket::SslRequest));
+            return Ok(Some(FeStartupPacket::SslRequest { direct: true }));
         }
 
         // need at least 4 bytes with packet len
@@ -390,7 +392,7 @@ impl FeStartupPacket {
             }
             NEGOTIATE_SSL_CODE => {
                 // Requested upgrade to SSL (aka TLS)
-                FeStartupPacket::SslRequest
+                FeStartupPacket::SslRequest { direct: false }
             }
             NEGOTIATE_GSS_CODE => {
                 // Requested upgrade to GSSAPI

diff --git a/proxy/src/bin/pg_sni_router.rs b/proxy/src/bin/pg_sni_router.rs
@@ -216,10 +216,11 @@ async fn ssl_handshake<S: AsyncRead + AsyncWrite + Unpin>(
     use pq_proto::FeStartupPacket::*;
 
     match msg {
-        SslRequest => {
+        SslRequest { direct: false } => {
             stream
                 .write_message(&pq_proto::BeMessage::EncryptionResponse(true))
                 .await?;
+
             // Upgrade raw stream into a secure TLS-backed stream.
             // NOTE: We've consumed `tls`; this fact will be used later.
 

diff --git a/proxy/src/proxy/handshake.rs b/proxy/src/proxy/handshake.rs
@@ -88,13 +88,20 @@ pub async fn handshake<S: AsyncRead + AsyncWrite + Unpin>(
 
         use FeStartupPacket::*;
         match msg {
-            SslRequest => match stream.get_ref() {
+            SslRequest { direct } => match stream.get_ref() {
                 Stream::Raw { .. } if !tried_ssl => {
                     tried_ssl = true;
 
                     // We can't perform TLS handshake without a config
-                    let enc = tls.is_some();
-                    stream.write_message(&Be::EncryptionResponse(enc)).await?;
+                    let have_tls = tls.is_some();
+                    if !direct {
+                        stream
+                            .write_message(&Be::EncryptionResponse(have_tls))
+                            .await?;
+                    } else if !have_tls {
+                        return Err(HandshakeError::ProtocolViolation);
+                    }
+
                     if let Some(tls) = tls.take() {
                         // Upgrade raw stream into a secure TLS-backed stream.
                         // NOTE: We've consumed `tls`; this fact will be used later.