diff options
| author | Heikki Linnakangas <heikki.linnakangas@iki.fi> | 2024-04-08 04:24:49 +0300 |
|---|---|---|
| committer | Heikki Linnakangas <heikki.linnakangas@iki.fi> | 2024-04-08 04:24:49 +0300 |
| commit | d39a49c1e459804831302807c724fa6512e90cf0 (patch) | |
| tree | 6c4c806f3e663ace026213bf719a89873fe7a7ab /src/interfaces/libpq/libpq-int.h | |
| parent | 05fd30c0e730bd5238f62d2fdfdcfaf28b16b225 (diff) | |
| download | postgresql-d39a49c1e459804831302807c724fa6512e90cf0.tar.gz postgresql-d39a49c1e459804831302807c724fa6512e90cf0.zip | |
Support TLS handshake directly without SSLRequest negotiation
By skipping SSLRequest, you can eliminate one round-trip when
establishing a TLS connection. It is also more friendly to generic TLS
proxies that don't understand the PostgreSQL protocol.
This is disabled by default in libpq, because the direct TLS handshake
will fail with old server versions. It can be enabled with the
sslnegotation=direct option. It will still fall back to the negotiated
TLS handshake if the server rejects the direct attempt, either because
it is an older version or the server doesn't support TLS at all, but
the fallback can be disabled with the sslnegotiation=requiredirect
option.
Author: Greg Stark, Heikki Linnakangas
Reviewed-by: Matthias van de Meent, Jacob Champion
Diffstat (limited to 'src/interfaces/libpq/libpq-int.h')
| -rw-r--r-- | src/interfaces/libpq/libpq-int.h | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/src/interfaces/libpq/libpq-int.h b/src/interfaces/libpq/libpq-int.h index 0119cb4cfae..3691e5ee969 100644 --- a/src/interfaces/libpq/libpq-int.h +++ b/src/interfaces/libpq/libpq-int.h @@ -235,7 +235,8 @@ typedef enum #define ENC_ERROR 0 #define ENC_PLAINTEXT 0x01 #define ENC_GSSAPI 0x02 -#define ENC_NEGOTIATED_SSL 0x04 +#define ENC_DIRECT_SSL 0x04 +#define ENC_NEGOTIATED_SSL 0x08 /* Target server type (decoded value of target_session_attrs) */ typedef enum @@ -394,6 +395,8 @@ struct pg_conn char *keepalives_count; /* maximum number of TCP keepalive * retransmits */ char *sslmode; /* SSL mode (require,prefer,allow,disable) */ + char *sslnegotiation; /* SSL initiation style + * (postgres,direct,requiredirect) */ char *sslcompression; /* SSL compression (0 or 1) */ char *sslkey; /* client key filename */ char *sslcert; /* client certificate filename */ @@ -563,6 +566,7 @@ struct pg_conn /* SSL structures */ bool ssl_in_use; + bool ssl_handshake_started; bool ssl_cert_requested; /* Did the server ask us for a cert? */ bool ssl_cert_sent; /* Did we send one in reply? */ |