Skip to content
/ pgssl Public

SSL proxy for PostgreSQL that wraps plain connections into SSL

License

Notifications You must be signed in to change notification settings

glebarez/pgssl

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

16 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

pgSSL

pgSSL is a proxy for PostgreSQL that wraps plain TCP connections (sslmode=disable) into SSL and provides (optional) client certificate to the backend PostgreSQL server. This way it allows SSL encryption and certificate-based authentication for plain-text PostgreSQL clients.

Motivation

PostgreSQL listens to both plain and SSL connections on a single port, therefore it has its own handshake that precedes the usual SSL/TLS handshake. For this reason it's not possible to wrap plain connections into SSL with usual proxies like nginx, envoy, istio, HAproxy. Though pgbouncer can be used for such task, the purpose of pgbouncer is to load-balance and pool the connections, so for a simple SSL-wrap it seems to be overkill. pgSSL wraps connections with regard to PostgreSQL-specific SSL handshake.

How it works

sequenceDiagram
    client->>pgSSL: TCP connect (plain)
    pgSSL-->>PostgreSQL: SSLRequest
    PostgreSQL-->>pgSSL: S(OK)
    pgSSL-->>PostgreSQL: SSL Handshake
    PostgreSQL-->>pgSSL: SSL Handshake complete
    loop
    client->>pgSSL: plain query
    activate pgSSL
    pgSSL-->>PostgreSQL: encrypted query
    deactivate pgSSL
    PostgreSQL-->>pgSSL: encrypted result
    activate pgSSL
    pgSSL->>client: plain result
    deactivate pgSSL
    end
Loading

Installation

go install github.com/glebarez/pgssl

Usage examples

  • pgssl -p postgres-server:5432 -l :15432 -k client.key -c client.crt
  • pgssl -p postgres-server:5432 -l :15432
  • PGSSL_PASSWORD=changeme pgssl -p postgres-server:5432 -l :15432

About

SSL proxy for PostgreSQL that wraps plain connections into SSL

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages