fix: decline SSL negotiation in plaintext mode

internal/server/server.go

@@ -145,6 +145,14 @@ func (s *Server) handle(connection net.Conn) {
 	resolveContext, cancelResolve := context.WithTimeout(context.Background(), resolveTimeout)
 	defer cancelResolve()
 
+	if s.TLSConfig == nil {
+		negotiated, negotiateErr := pgwire.NegotiatePlainPostgreSQL(connection)
+		if negotiateErr != nil {
+			s.Logger.Warn("connection rejected", "remote_address", remote, "result", "invalid_negotiation", "error", negotiateErr)
+			return
+		}
+		proxyClient = negotiated
+	}
 	if sni != "" {
 		backend, err = s.Resolver.Resolve(resolveContext, sni)
 		if err != nil {