TLS Connection Support

Author: WyriHaximus

.github/workflows/ci.yml

@@ -12,36 +12,46 @@ jobs:
     outputs:
       version: ${{ steps.supported-versions-matrix.outputs.version }}
     steps:
-      - uses: actions/checkout@v1
+      - uses: actions/checkout@v4
       - id: supported-versions-matrix
         uses: WyriHaximus/github-action-composer-php-versions-in-range@v1
   tests:
-    services:
-      postgres:
-        image: postgres:${{ matrix.postgres }}
-        env:
-          POSTGRES_PASSWORD: postgres
-          POSTGRES_INITDB_ARGS: --auth-host=md5
-        # Set health checks to wait until postgres has started
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-        ports:
-          - 5432:5432
+#    services:
+#      postgres:
+#        image: postgres:${{ matrix.postgres }}
+#        env:
+#          POSTGRES_PASSWORD: postgres
+#          POSTGRES_INITDB_ARGS: --auth-host=md5
+#        # Set health checks to wait until postgres has started
+#        options: >-
+#          --health-cmd pg_isready
+#          --health-interval 10s
+#          --health-timeout 5s
+#          --health-retries 5
+#        ports:
+#          - 5432:5432
     name: Testing on PHP ${{ matrix.php }} with ${{ matrix.composer }} dependency preference against Postgres ${{ matrix.postgres }}
     strategy:
       fail-fast: false
       matrix:
         php: ${{ fromJson(needs.supported-versions-matrix.outputs.version) }}
-        postgres: [12, 13, 14, 15]
+#        postgres: [12, 13, 14, 15, 16, 17]
+        postgres: [17]
         composer: [lowest, locked, highest]
+#        php: ["8.4", "7.0"]
+#        postgres: [15]
+#        composer: [locked]
+        tls: [false,true]
     needs:
       - supported-versions-matrix
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
+      - uses: ikalnytskyi/action-setup-postgres@v7
+        with:
+          postgres-version: ${{ matrix.postgres }}
+          ssl: ${{ matrix.tls }}
+        id: postgres
       - run: |
           PGPASSWORD=postgres psql -h localhost -U postgres -c "CREATE USER pgasync"
           PGPASSWORD=postgres psql -h localhost -U postgres -c "ALTER ROLE pgasync PASSWORD 'pgasync'"

README.md

@@ -79,6 +79,35 @@ $client->listen('some_channel')
 $client->query("NOTIFY some_channel, 'Hello World'")->subscribe();
 ```
 
+## Example - Connecting over TLS with CA certificate file
+```php
+
+$client = new PgAsync\Client([
+    "host"                => "127.0.0.1",
+    "port"                => "5432",
+    "user"                => "matt",
+    "database"            => "matt",
+    "tls"                 => "verify-full",
+    "tls_connector_flags" => [
+        "cafile" => "/path/to/ca.crt",
+    ],
+]);
+
+$client->query('SELECT * FROM channel')->subscribe(
+    function ($row) {
+        var_dump($row);
+    },
+    function ($e) {
+        echo "Failed.\n";
+    },
+    function () {
+        echo "Complete.\n";
+    }
+);
+
+
+```
+
 ## Install
 With [composer](https://getcomposer.org/) install into you project with:
 

composer.json

@@ -36,8 +36,9 @@
     "php": ">=7.0.0",
     "voryx/event-loop": "^3.0 || ^2.0.2",
     "reactivex/rxphp": "^2.0",
-    "react/socket": "^1.0 || ^0.8 || ^0.7",
-    "evenement/evenement": "^2.0 | ^3.0"
+    "react/promise-stream": "^1.5",
+    "evenement/evenement": "^2.0 | ^3.0",
+    "wyrihaximus/react-opportunistic-tls": "^1"
   },
   "require-dev": {
     "phpunit/phpunit": ">=8.5.23 || ^6.5.5",

src/PgAsync/Connection.php

@@ -12,6 +12,7 @@
 use PgAsync\Command\PasswordMessage;
 use PgAsync\Command\SaslInitialResponse;
 use PgAsync\Command\SaslResponse;
+use PgAsync\Command\SSLRequest;
 use PgAsync\Command\Sync;
 use PgAsync\Command\Terminate;
 use PgAsync\Message\Authentication;
@@ -32,9 +33,13 @@
 use PgAsync\Message\ReadyForQuery;
 use PgAsync\Message\RowDescription;
 use PgAsync\Command\StartupMessage;
+use React\EventLoop\Loop;
 use React\EventLoop\LoopInterface;
-use React\Socket\Connector;
+use React\Promise\Promise;
+use React\Socket\ConnectionInterface;
+use WyriHaximus\React\Socket\Connector;
 use React\Socket\ConnectorInterface;
+use WyriHaximus\React\Socket\OpportunisticTlsConnectionInterface;
 use React\Stream\DuplexStreamInterface;
 use Rx\Disposable\CallbackDisposable;
 use Rx\Disposable\EmptyDisposable;
@@ -43,6 +48,8 @@
 use Rx\ObserverInterface;
 use Rx\SchedulerInterface;
 use Rx\Subject\Subject;
+use function React\Promise\resolve;
+use function React\Promise\Stream\first;
 
 class Connection extends EventEmitter
 {
@@ -73,6 +80,16 @@ class Connection extends EventEmitter
     const CONNECTION_NEEDED = 8;            /* Internal state: connect() needed */
     const CONNECTION_CLOSED = 9;
 
+    // Reference table: https://www.postgresql.org/docs/current/libpq-ssl.html#LIBPQ-SSL-PROTECTION
+    const TLS_MODE_DISABLE = 'disable';
+    const TLS_MODE_ALLOW = 'allow';
+    const TLS_MODE_PREFER = 'prefer';
+    const TLS_MODE_REQUIRE = 'require';
+    const TLS_MODE_VERIFY_CA = 'verify-ca';
+    const TLS_MODE_VERIFY_FULL = 'verify-full';
+    const TLS_MODE_LIST_FULL = [self::TLS_MODE_DISABLE, self::TLS_MODE_ALLOW, self::TLS_MODE_PREFER, self::TLS_MODE_REQUIRE, self::TLS_MODE_VERIFY_CA, self::TLS_MODE_VERIFY_FULL];
+    const TLS_MODE_LIST_REQUIRED = [self::TLS_MODE_REQUIRE, self::TLS_MODE_VERIFY_CA, self::TLS_MODE_VERIFY_FULL];
+
     private $queryState;
     private $queryType;
     private $connStatus;
@@ -134,6 +151,8 @@ class Connection extends EventEmitter
 
     /** @var  bool */
     private $auto_disconnect = false;
+    private $tls = self::TLS_MODE_PREFER;
+    private $tlsConnectorFlags = [];
     private $password;
 
     public function __construct(array $parameters, LoopInterface $loop, ConnectorInterface $connector = null)
@@ -158,6 +177,19 @@ public function __construct(array $parameters, LoopInterface $loop, ConnectorInt
             unset($parameters['password']);
         }
 
+        if (array_key_exists('tls', $parameters)) {
+            if (!in_array($this->tls, self::TLS_MODE_LIST_FULL)) {
+                throw new \InvalidArgumentException('TLS mode must be one off "' . implode(', ', self::TLS_MODE_LIST_FULL) . ' but got "' . $parameters['tls'] . '" instead');
+            }
+            $this->tls = $parameters['tls'];
+            unset($parameters['tls']);
+        }
+
+        if (array_key_exists('tls_connector_flags', $parameters)) {
+            $this->tlsConnectorFlags = $parameters['tls_connector_flags'];
+            unset($parameters['tls_connector_flags']);
+        }
+
         if (isset($parameters['auto_disconnect'])) {
             $this->auto_disconnect = $parameters['auto_disconnect'];
             unset($parameters['auto_disconnect']);
@@ -172,8 +204,17 @@ public function __construct(array $parameters, LoopInterface $loop, ConnectorInt
         $this->queryState          = static::STATE_BUSY;
         $this->queryType           = static::QUERY_SIMPLE;
         $this->connStatus          = static::CONNECTION_NEEDED;
-        $this->socket              = $connector ?: new Connector($loop);
-        $this->uri                 = 'tcp://' . $parameters['host'] . ':' . $parameters['port'];
+        $this->socket              = $connector ?: new Connector($loop, [
+            'tls' => [
+                'verify_peer'       => $this->tls === self::TLS_MODE_VERIFY_FULL,
+                'verify_peer_name'  => $this->tls === self::TLS_MODE_VERIFY_FULL,
+                'allow_self_signed' => $this->tls !== self::TLS_MODE_VERIFY_FULL,
+            ] + $this->tlsConnectorFlags,
+        ]);
+        // We always url `opportunistic+tls` as scheme because the logic required for using `tcp` on TLS `disable`
+        // mode is more complex than worth it when connecting to the server. And the `SecureConnector` gives us a
+        // plaint text connection with all TLS flags already set and ready to use for all the other modes.
+        $this->uri                 = 'opportunistic+tls://' . $parameters['host'] . ':' . $parameters['port'];
         $this->notificationSubject = new Subject();
         $this->cancelPending       = false;
         $this->cancelRequested     = false;
@@ -191,23 +232,43 @@ private function start()
         $this->connStatus = static::CONNECTION_STARTED;
 
         $this->socket->connect($this->uri)->then(
-            function (DuplexStreamInterface $stream) {
-                $this->stream     = $stream;
-                $this->connStatus = static::CONNECTION_MADE;
-
-                $stream->on('close', [$this, 'onClose']);
+            function (OpportunisticTlsConnectionInterface $stream) {
+                (new Promise(function (callable $resolve, callable $reject) use ($stream) {
+                    if ($this->tls !== self::TLS_MODE_DISABLE) {
+                        first($stream)->then(function ($data) use ($resolve, $reject, $stream) {
+                            if (trim($data) === 'S') {
+                                $stream->enableEncryption()->then($resolve, $reject);
+                                return;
+                            }
+
+                            if (in_array($this->tls, self::TLS_MODE_LIST_REQUIRED)) {
+                                $reject(new \RuntimeException('Failed to encrypt connection while required'));
+                                return;
+                            }
+
+                            $resolve($stream);
+                        }, $reject);
+
+                        $ssl = new SSLRequest();
+                        $stream->write($ssl->encodedMessage());
+                        return;
+                    }
 
-                $stream->on('data', [$this, 'onData']);
+                    $resolve($stream);
+                }))->then(function (DuplexStreamInterface $stream) {
+                    $this->stream     = $stream;
+                    $this->connStatus = static::CONNECTION_MADE;
 
-                //  $ssl = new SSLRequest();
-                //  $stream->write($ssl->encodedMessage());
+                    $stream->on('close', [$this, 'onClose']);
+                    $stream->on('data', [$this, 'onData']);
 
-                $startupParameters = $this->parameters;
-                unset($startupParameters['host'], $startupParameters['port']);
+                    $startupParameters = $this->parameters;
+                    unset($startupParameters['host'], $startupParameters['port']);
 
-                $startup = new StartupMessage();
-                $startup->setParameters($startupParameters);
-                $stream->write($startup->encodedMessage());
+                    $startup = new StartupMessage();
+                    $startup->setParameters($startupParameters);
+                    $stream->write($startup->encodedMessage());
+                });
             },
             function ($e) {
                 // connection error
@@ -596,11 +657,11 @@ function (ObserverInterface $observer, SchedulerInterface $scheduler = null) use
                 $this->processQueue();
 
                 return new CallbackDisposable(function () use ($q) {
-                        if ($this->currentCommand === $q && $q->isActive()) {
-                            $this->cancelRequested = true;
-                        }
-                        $q->cancel();
-                    });
+                    if ($this->currentCommand === $q && $q->isActive()) {
+                        $this->cancelRequested = true;
+                    }
+                    $q->cancel();
+                });
             }
         );
 

tests/tls/postgres.tls.conf

@@ -0,0 +1,7 @@
+# Refs: https://github.com/postgres/postgres/blob/REL_14_18/src/backend/utils/misc/postgresql.conf.sample
+
+listen_addresses = '*'
+port = 5432
+ssl = on
+ssl_cert_file = '/etc/postgresql/server.crt'
+ssl_key_file = '/etc/postgresql/server.key'

tests/tls/server.crt

@@ -0,0 +1,32 @@
+-----BEGIN CERTIFICATE-----
+MIIFlzCCA3+gAwIBAgIUcOAckRnMviMxTXzc6QLLjeXHXXgwDQYJKoZIhvcNAQEL
+BQAwWjELMAkGA1UEBhMCTkwxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
+GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDETMBEGA1UEAwwKcG9zdGdyZXNxbDAg
+Fw0yNTA3MjEwOTU2MDRaGA8yMTI1MDYyNzA5NTYwNFowWjELMAkGA1UEBhMCTkwx
+EzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMg
+UHR5IEx0ZDETMBEGA1UEAwwKcG9zdGdyZXNxbDCCAiIwDQYJKoZIhvcNAQEBBQAD
+ggIPADCCAgoCggIBAM3BOrC5r6/b9JJK5QxLoiJReXQEPSVKIRtAxLwi+c07dG9P
+Zc8fezoODfxuuYz8/OYpNHtoy1i+8Epbcz8EVUK0JDKwMoD5bTQqBmSDXA62eb/C
+9htcMPEvM+gheKr/Jj+0/FRD3U8RSJiAu/lo1XPwtOJJ6BNlG3IzpJ7Ekp4g1Dug
+fC8TFPQ69KaI9iV7xe+SmWLlpgr0k9lxGYKtHm5ttXFCXkHb0aZUC2N8LR5U/UR4
+k84rNHprbzPIc4m98zJELaOw6lCLXZ+AoBZZIsRd4zlVQ0vBbidkqiixrOsw0+RL
+mk2fUHNfm8qO0BpoPxNfoBfjIpYu2Qipd3wwHRR3nO32E07I+0aMdcdnmgvSmf7M
+18UabQHY+DWSAtNlH9SuQKEVnDxhWIMBDyl/Qi4IPKfnhmNrRwpwPhoPBgkdfeoQ
+vdmhsixFZhi3xRv7RqKMhJ6tJFqRPfMHW8z65ppx1qgOA5Ff+yPQqWjhjcJwwoqx
+IIG9SMmiMUvcsuoFPbSC5w4MOdZvgdJ7tJJbOtveHIbj1vHuwRD754MG4iV8Y7FL
+V444SXdqVwT4v+cruKRIFIMVZrrSWUgCQCoNeCMoiPdAUv8O1oEqvL+hC4y4FDCb
+TA2TUiCkr1b44VAcWrtdf1Cd6zGOB0r6uZPHYDfL4YvCkpYVp/LzRm3ariIHAgMB
+AAGjUzBRMB0GA1UdDgQWBBRCYwZgmacp1uvjATwdv1HLcXd+tTAfBgNVHSMEGDAW
+gBRCYwZgmacp1uvjATwdv1HLcXd+tTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3
+DQEBCwUAA4ICAQC/LqVdml76YeXacUyFdVb03L5RQY72z9YULUAshRQVpE9c+H3i
+zO4HEaxIgicTp7EYsd3yewyuxfO7x/KpuRo71HlugpjbrumEky2xSkL/VyzftgQG
+7NXketOOdQbMACsGl1xevZKhVDLhc2UZDlEeF0OVK4tRx0kWAKxIfU3QIP4gmmMK
+scuLlQjInOCaKA0hjkPG67xnCJB1QSCfTHBhgt2cQLpWRSX6YLU10zHhmFsJDzM0
+JK8ijI+saf5OJrrjvFDOpuU7Q6GqdDbrCyujj0SNhhAU3x+K1t+JtNQhVH4MqcUC
+a6J4xQbatMwaZEIpEb+9dN0L7i4HubFDO3tsoHzBqpRPekFhBu/3QpvubKOa3oo4
+bnjaoDLWShekHoxE1IEHajxE9OyJLP/5JUAzf1641WJQQNEV+FFH09+k+RuV5Y4K
+vtdYXhHs5yc0qS8s/e60GfrR4nPEK+husMV2NW33cvQlNLxw/KaXOiQ1t73yE5/S
+jS/a16HRWm+4WCQz6ZH6uOxfqqTiX7yAElvOtrPnq7ISbvYY95Au9Sm9oCSSz4O1
+rl5xHVaX13EqqpMd+mMNOhih8gs8eKjMBLZkjSOfM/j95LSJzmyd3xV+ZNjIeUzz
+cQnh4iaPn/x7/LQhG9Qqp0TPl/7UDQM2PCxMj1QNTONqSrCi94ikaTMPew==
+-----END CERTIFICATE-----

tests/tls/server.key

@@ -0,0 +1,52 @@
+-----BEGIN PRIVATE KEY-----
+MIIJQwIBADANBgkqhkiG9w0BAQEFAASCCS0wggkpAgEAAoICAQDNwTqwua+v2/SS
+SuUMS6IiUXl0BD0lSiEbQMS8IvnNO3RvT2XPH3s6Dg38brmM/PzmKTR7aMtYvvBK
+W3M/BFVCtCQysDKA+W00KgZkg1wOtnm/wvYbXDDxLzPoIXiq/yY/tPxUQ91PEUiY
+gLv5aNVz8LTiSegTZRtyM6SexJKeINQ7oHwvExT0OvSmiPYle8Xvkpli5aYK9JPZ
+cRmCrR5ubbVxQl5B29GmVAtjfC0eVP1EeJPOKzR6a28zyHOJvfMyRC2jsOpQi12f
+gKAWWSLEXeM5VUNLwW4nZKoosazrMNPkS5pNn1BzX5vKjtAaaD8TX6AX4yKWLtkI
+qXd8MB0Ud5zt9hNOyPtGjHXHZ5oL0pn+zNfFGm0B2Pg1kgLTZR/UrkChFZw8YViD
+AQ8pf0IuCDyn54Zja0cKcD4aDwYJHX3qEL3ZobIsRWYYt8Ub+0aijISerSRakT3z
+B1vM+uaacdaoDgORX/sj0Klo4Y3CcMKKsSCBvUjJojFL3LLqBT20gucODDnWb4HS
+e7SSWzrb3hyG49bx7sEQ++eDBuIlfGOxS1eOOEl3alcE+L/nK7ikSBSDFWa60llI
+AkAqDXgjKIj3QFL/DtaBKry/oQuMuBQwm0wNk1IgpK9W+OFQHFq7XX9QnesxjgdK
++rmTx2A3y+GLwpKWFafy80Zt2q4iBwIDAQABAoICAC8xFByHol+kA+7v5aQRzuCv
+LjupYzrjyz8cdmMuZHwpmFWVcOT2NAXHRnbxEHbhacICjmqFySoUNTngysiX3lRb
+y/eiSRsi2mS+BNRV+q3XNYqBlYAF/6W57V5fGvWhauzuvnc3T5G8hZmQ4UxduqOK
+gHpseCHGrWpepPHTZUuGfRcmAoWri0FPKmDuBgLn5ijCR5MS2CgoG6ciVTcPLO0o
+FZciIUtatzW+jhQl3ZVY6fQj8ca2SyWO8aT/Y1yi6B5N2+fxAnUx2enlDxLBJAPF
+AwJZ54L/HRxE7vBBfEc/XkI9Aumt0j58HdfyNJHx+hGf+7Cu5HZszVO6xtCBmpF3
+TVgI65Q5OStuBdPMTLd5qqRB8+740TsM8MegULgYthPexdi8mmB7FzxhTVCZSKNh
+NaVgEUowJ0xgMD+UDhskP4vMN+aL04Oo2ubHa6f1o1GQTpIccdovuipntQ6ZkYOE
+v7bLsQmoFL89DJ4v9EVkPe6zF8Q9SAT3IkM90Q3pMzs4EQ80YVQXPw5dxCmprilh
+PhlSDiigaOkGqB8lZ7rmPhkFyntTX15FCVO9ZKAzeUAQ5gDu7a9ugb9v2m962VDP
+yxFtFlG3Nypa2hNRONufUfmvS6wAAeR4ohav8hnvjsjPHbHve6sKKd+MbRqjYwCl
+4go/JQTZU/A7EPL4DxC5AoIBAQDazwQ+Bmv3DKDj/KSr8ZhH7VfyBUmbreOh81Y+
+k5ebtLQerF66FMF+vaqwD2kxbNXSxv/UhjPxvA3QeHVMTRB87Ib8vzZXyK2rqYfk
+ArX/600RAth3ATQf37aNoondc4d2fc2+Hb08Q6gnnz6ttmnNVufjpoVZ8D64BhaY
+0mo08cuGIntWs+Oc9BFzdJuHJXo3B+44duHfCfUukMtgv4Y40EXUSYUYZwDSq656
+iiTNhonhcWdI61O71wdyhRosEDkxZW0FPUuIX1A2udFsvzP4RmD4e6xXN1m5tFMu
+4B83bpxHLLQ0G4YSs2Lk6ylExmu4kEpRES9PM63J4mXN/Lw/AoIBAQDwujPVOxjP
+tiT8gf6q/jbapBqCkJdT7Ws1bfXdXKVUFvEqmWcCRt8ynvEAhlKSf3jTWkcl0SrT
+iNCbo9L+jrbUsBNv5gg+eYz35BEOTd/+p/GpharO+SZUrpx/dImJIkuLpV0EcfhU
+Am48I1dMkh5F8whZVbiwfc+BCqoE5nBuMAX8ZZ8GAJAgi1NBCfXcQLldCfn9adgJ
+fWaGJ9N+eO3219qcUYBnJ9g/0FDVwneKfnGHSu8YAxcbh6S37QIL6ySO7/MavSk1
+TF/UlzLZzTJVP5pb1OWAkhZd2lpDTWXVAwE1SxdJypXy9EzNA33kODFGaCsjZbE6
+eOj7WmiL6cg5AoIBAF1jC5l5Xi0T27tSgenM9ESGnQlzjkX+gnAFjmKo1YUkK9gH
+k2pyH197jdUUzr3EiMIsItZO7O6YZ4D5WH7XSVk4DijjZ0syIEVq1s/PBGSUxdCj
+2UV5YwjTj3OF0reMbl15Ng2VXcXRznwSsEqt1xxHojL8SF/pdKtQFeblr2Snakj2
+gJOxtUywsp4HP7X/ndjM7rR0sNRjyJw2OkcxlxS6d4MyWbbfh29izNYKDckWSdTJ
+dN6faZ57GPecrV3vEqntcwlQbuNmYrLoveRe+sxVJWAIULbsrcPfnb0c9NXQxKxv
+/P1cXe2vWF8BqxxqX2FnXACbiAiSsvK+SNsQqjsCggEBANjN2oDgiKgJ06XXLhWy
+fpTL11RgBOqBmVy1fAmxtvTU9L75CdzzF3Hv0/40+4kVZSx00j8s8vUw8zA5i33X
+6rIDIn5VHnel4WAg93t6h5JCj1OuHvfpTKxX1nqz6mqniIJsnCm0u4Jt7fobmjRM
+JRe6mnpaycuqg4gkoptnLzsN5VY778zoFOY6lPCul8+WO1uf8JZbDUb+uad5lvEA
+2NDH9wtyG8LMD+bpJuReEGubFYRT6KInplgVAjTkMEOrs3FIiho64zItZuGAizu9
+oudEMTEjvM7ew2YjkcernVsLKbtltcOvwPzfKYw66NbyBO70QmXO4J9Y5fv6oM3h
+74ECggEBAIsxv9vVNCPac8TC9WBfnb0ze5nLjm1Mpm805mEBM33P3X0lLqt4b+u3
+a9wse7wYaJn25AW2TIJBEH0oUNFf+bt0qRHJ3hyf5Y980PhpDI+PTMRgRhkhrr8o
+ASYxgJCfXAqsMxJfu/msFecn2RCZYLgP7pyXszMLAXRkA1N54FrD/T0+wBKXtzSn
+09g76tX97yvHpAGE85ENEgm4pWz7jb7aWYg5wh+uC9VjeBMH/Xqiz+AUIiDfV4Nc
+VkathORqy5W4n2UTJEIQuHhl+y0nCNzeu/q4INkwql3qIbkkQHpJc/CZP5EbgsdQ
+wRJVjpt6cqfFR5QdYVRLIYN0vKGvSsU=
+-----END PRIVATE KEY-----