-
-
Notifications
You must be signed in to change notification settings - Fork 941
Open
Description
I have a Ruby script that proxies Postgres connections.
When a connection is received, I first check if it's TLS-encrypted or not. An unencrypted Postgres connection cannot have 0x16 as the first byte, so this check works:
client_direct_ssl = nil
first_byte = client_sock.recv(1, Socket::MSG_PEEK)
early_exit.("with no data received") if first_byte.nil?
if first_byte == bin_str("\x16") # start of a TLS handshake record
client_direct_ssl = true
client_sock = OpenSSL::SSL::SSLSocket.new(client_sock, client_ctx).accept # begin handshake
cnputs.("direct #{tls_summary(client_sock)} connection established with client", " server name via SNI: #{target_via_sni}")
first_eight = client_sock.read(8)
else
# not direct SSL, so we may or may not begin with an 8-byte SSLRequest
first_eight = client_sock.read(8)
# ...This fails in JRuby. I think that's because the MSG_PEEK flag is not supported (and the second argument to recv is interpreted differently). But the documentation I can find doesn't help much.
Am I right that JRuby doesn't support MSG_PEEK? Can it be added? Is there a sensible alternative I can use?
Thanks.
Metadata
Metadata
Assignees
Labels
No labels