fix: decline SSL negotiation in plaintext mode

internal/server/server.go

@@ -145,6 +145,14 @@ func (s *Server) handle(connection net.Conn) {
 	resolveContext, cancelResolve := context.WithTimeout(context.Background(), resolveTimeout)
 	defer cancelResolve()
 
+	if s.TLSConfig == nil {
+		negotiated, negotiateErr := pgwire.NegotiatePlainPostgreSQL(connection)
+		if negotiateErr != nil {
+			s.Logger.Warn("connection rejected", "remote_address", remote, "result", "invalid_negotiation", "error", negotiateErr)
+			return
+		}
+		proxyClient = negotiated
+	}
 	if sni != "" {
 		backend, err = s.Resolver.Resolve(resolveContext, sni)
 		if err != nil {

internal/server/server_test.go

@@ -257,6 +257,79 @@ func TestServerRoutesPlaintextConnectionsByDatabase(t *testing.T) {
 	}
 }
 
+func TestServerDeclinesSSLNegotiationInPlaintextMode(t *testing.T) {
+	backendListener := listen(t)
+	defer backendListener.Close()
+	backendDatabase := make(chan string, 1)
+	go func() {
+		connection, err := backendListener.Accept()
+		if err != nil {
+			return
+		}
+		defer connection.Close()
+		startup, err := pgwire.ReadStartupMessage(connection)
+		if err != nil {
+			return
+		}
+		backendDatabase <- startup.Database
+		_, _ = connection.Write([]byte("backend"))
+	}()
+
+	staticResolver, err := router.NewStaticResolver([]config.DatabaseConfig{{
+		Name:     "analytics",
+		Upstream: backendListener.Addr().String(),
+	}})
+	if err != nil {
+		t.Fatal(err)
+	}
+	routingServer, err := New(nil, staticResolver, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	listener := listen(t)
+	defer func() {
+		_ = routingServer.Shutdown()
+		routingServer.Wait()
+		_ = listener.Close()
+	}()
+	go func() { _ = routingServer.Serve(listener) }()
+
+	connection, err := net.Dial("tcp", listener.Addr().String())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer connection.Close()
+	request := pgwire.SSLRequest()
+	if _, err := connection.Write(request[:]); err != nil {
+		t.Fatal(err)
+	}
+	response := make([]byte, 1)
+	if _, err := io.ReadFull(connection, response); err != nil {
+		t.Fatal(err)
+	}
+	if response[0] != 'N' {
+		t.Fatalf("SSL response = %q, want N", response)
+	}
+	if _, err := connection.Write(startupMessage("analytics")); err != nil {
+		t.Fatal(err)
+	}
+	response = make([]byte, len("backend"))
+	if _, err := io.ReadFull(connection, response); err != nil {
+		t.Fatal(err)
+	}
+	if string(response) != "backend" {
+		t.Fatalf("proxied response = %q", response)
+	}
+	select {
+	case database := <-backendDatabase:
+		if database != "analytics" {
+			t.Errorf("backend database = %q, want analytics", database)
+		}
+	case <-time.After(time.Second):
+		t.Fatal("backend did not receive the StartupMessage after SSL decline")
+	}
+}
+
 func startupMessage(database string) []byte {
 	body := make([]byte, 4)
 	binary.BigEndian.PutUint32(body, 196608)