From b643458f2d8fd6fdd5f5356512f1ad3866e8e5e0 Mon Sep 17 00:00:00 2001 From: Greg Stark Date: Thu, 16 Mar 2023 11:55:16 -0400 Subject: [PATCH v7 05/12] Direct SSL connections client support --- src/interfaces/libpq/fe-connect.c | 92 +++++++++++++++++++++++++++++-- src/interfaces/libpq/libpq-fe.h | 3 +- src/interfaces/libpq/libpq-int.h | 3 + 3 files changed, 92 insertions(+), 6 deletions(-) diff --git a/src/interfaces/libpq/fe-connect.c b/src/interfaces/libpq/fe-connect.c index 79e0b73d618..2c446c15343 100644 --- a/src/interfaces/libpq/fe-connect.c +++ b/src/interfaces/libpq/fe-connect.c @@ -129,6 +129,7 @@ static int ldapServiceLookup(const char *purl, PQconninfoOption *options, #define DefaultSSLMode "disable" #define DefaultSSLCertMode "disable" #endif +#define DefaultSSLNegotiation "postgres" #ifdef ENABLE_GSS #include "fe-gssapi-common.h" #define DefaultGSSMode "prefer" @@ -272,6 +273,10 @@ static const internalPQconninfoOption PQconninfoOptions[] = { "SSL-Mode", "", 12, /* sizeof("verify-full") == 12 */ offsetof(struct pg_conn, sslmode)}, + {"sslnegotiation", "PGSSLNEGOTIATION", DefaultSSLNegotiation, NULL, + "SSL-Negotiation", "", 14, /* strlen("requiredirect") == 14 */ + offsetof(struct pg_conn, sslnegotiation)}, + {"sslcompression", "PGSSLCOMPRESSION", "0", NULL, "SSL-Compression", "", 1, offsetof(struct pg_conn, sslcompression)}, @@ -1524,10 +1529,36 @@ connectOptions2(PGconn *conn) } #endif } + + /* + * validate sslnegotiation option, default is "postgres" for the postgres + * style negotiated connection with an extra round trip but more options. + */ + if (conn->sslnegotiation) + { + if (strcmp(conn->sslnegotiation, "postgres") != 0 + && strcmp(conn->sslnegotiation, "direct") != 0 + && strcmp(conn->sslnegotiation, "requiredirect") != 0) + { + conn->status = CONNECTION_BAD; + libpq_append_conn_error(conn, "invalid %s value: \"%s\"", + "sslnegotiation", conn->sslnegotiation); + return false; + } + +#ifndef USE_SSL + if (conn->sslnegotiation[0] != 'p') { + conn->status = CONNECTION_BAD; + libpq_append_conn_error(conn, "sslnegotiation value \"%s\" invalid when SSL support is not compiled in", + conn->sslnegotiation); + return false; + } +#endif + } else { - conn->sslmode = strdup(DefaultSSLMode); - if (!conn->sslmode) + conn->sslnegotiation = strdup(DefaultSSLNegotiation); + if (!conn->sslnegotiation) goto oom_error; } @@ -1650,6 +1681,18 @@ connectOptions2(PGconn *conn) conn->gssencmode); return false; } +#endif +#ifdef USE_SSL + /* GSS is incompatible with direct SSL connections so it requires the + * default postgres style connection ssl negotiation */ + if (strcmp(conn->gssencmode, "require") == 0 && + strcmp(conn->sslnegotiation, "postgres") != 0) + { + conn->status = CONNECTION_BAD; + libpq_append_conn_error(conn, "gssencmode value \"%s\" invalid when Direct SSL negotiation is enabled", + conn->gssencmode); + return false; + } #endif } else @@ -2783,11 +2826,12 @@ keep_going: /* We will come back to here until there is /* initialize these values based on SSL mode */ conn->allow_ssl_try = (conn->sslmode[0] != 'd'); /* "disable" */ conn->wait_ssl_try = (conn->sslmode[0] == 'a'); /* "allow" */ + /* direct ssl is incompatible with "allow" or "disabled" ssl */ + conn->allow_direct_ssl_try = conn->allow_ssl_try && !conn->wait_ssl_try && (conn->sslnegotiation[0] != 'p'); #endif #ifdef ENABLE_GSS conn->try_gss = (conn->gssencmode[0] != 'd'); /* "disable" */ #endif - reset_connection_state_machine = false; need_new_connection = true; } @@ -3245,6 +3289,29 @@ keep_going: /* We will come back to here until there is if (pqsecure_initialize(conn, false, true) < 0) goto error_return; + /* + * If SSL is enabled and direct SSL connections are enabled + * and we haven't already established an SSL connection (or + * already tried a direct connection and failed or succeeded) + * then try just enabling SSL directly. + * + * If we fail then we'll either fail the connection (if + * sslnegotiation is set to requiredirect or turn + * allow_direct_ssl_try to false + */ + if (conn->allow_ssl_try + && !conn->wait_ssl_try + && conn->allow_direct_ssl_try + && !conn->ssl_in_use +#ifdef ENABLE_GSS + && !conn->gssenc +#endif + ) + { + conn->status = CONNECTION_SSL_STARTUP; + return PGRES_POLLING_WRITING; + } + /* * If SSL is enabled and we haven't already got encryption of * some sort running, request SSL instead of sending the @@ -3321,9 +3388,11 @@ keep_going: /* We will come back to here until there is /* * On first time through, get the postmaster's response to our - * SSL negotiation packet. + * SSL negotiation packet. If we are trying a direct ssl + * connection skip reading the negotiation packet and go + * straight to initiating an ssl connection. */ - if (!conn->ssl_in_use) + if (!conn->ssl_in_use && !conn->allow_direct_ssl_try) { /* * We use pqReadData here since it has the logic to @@ -3429,6 +3498,18 @@ keep_going: /* We will come back to here until there is } if (pollres == PGRES_POLLING_FAILED) { + /* Failed direct ssl connection, possibly try a new connection with postgres negotiation */ + if (conn->allow_direct_ssl_try) + { + /* if it's requiredirect then it's a hard failure */ + if (conn->sslnegotiation[0] == 'r') + goto error_return; + /* otherwise only retry using postgres connection */ + conn->allow_direct_ssl_try = false; + need_new_connection = true; + goto keep_going; + } + /* * Failed ... if sslmode is "prefer" then do a non-SSL * retry @@ -4436,6 +4517,7 @@ freePGconn(PGconn *conn) free(conn->keepalives_interval); free(conn->keepalives_count); free(conn->sslmode); + free(conn->sslnegotiation); free(conn->sslcert); free(conn->sslkey); if (conn->sslpassword) diff --git a/src/interfaces/libpq/libpq-fe.h b/src/interfaces/libpq/libpq-fe.h index f0ec660cb69..3a4e8ae4080 100644 --- a/src/interfaces/libpq/libpq-fe.h +++ b/src/interfaces/libpq/libpq-fe.h @@ -78,7 +78,8 @@ typedef enum CONNECTION_CONSUME, /* Consuming any extra messages. */ CONNECTION_GSS_STARTUP, /* Negotiating GSSAPI. */ CONNECTION_CHECK_TARGET, /* Checking target server properties. */ - CONNECTION_CHECK_STANDBY /* Checking if server is in standby mode. */ + CONNECTION_CHECK_STANDBY, /* Checking if server is in standby mode. */ + CONNECTION_DIRECT_SSL_STARTUP /* Starting SSL without PG Negotiation. */ } ConnStatusType; typedef enum diff --git a/src/interfaces/libpq/libpq-int.h b/src/interfaces/libpq/libpq-int.h index f0143726bbc..c5391bd926c 100644 --- a/src/interfaces/libpq/libpq-int.h +++ b/src/interfaces/libpq/libpq-int.h @@ -388,6 +388,7 @@ struct pg_conn char *keepalives_count; /* maximum number of TCP keepalive * retransmits */ char *sslmode; /* SSL mode (require,prefer,allow,disable) */ + char *sslnegotiation; /* SSL initiation style (postgres,direct,requiredirect) */ char *sslcompression; /* SSL compression (0 or 1) */ char *sslkey; /* client key filename */ char *sslcert; /* client certificate filename */ @@ -549,6 +550,8 @@ struct pg_conn bool ssl_cert_sent; /* Did we send one in reply? */ #ifdef USE_SSL + bool allow_direct_ssl_try; /* Try to make a direct SSL connection + * without an "SSL negotiation packet" */ bool allow_ssl_try; /* Allowed to try SSL negotiation */ bool wait_ssl_try; /* Delay SSL negotiation until after * attempting normal connection */ -- 2.39.2