postgres: Use 'postgresql' ALPN for SSL connections

Author: Daniel Frankcom

sqlx-core/Cargo.toml

@@ -37,7 +37,7 @@ async-std = { workspace = true, optional = true }
 tokio = { workspace = true, optional = true }
 
 # TLS
-native-tls = { version = "0.2.10", optional = true }
+native-tls = { version = "0.2.10", features = ["alpn"], optional = true }
 
 rustls = { version = "0.23.15", default-features = false, features = ["std", "tls12"], optional = true }
 webpki-roots = { version = "0.26", optional = true }

sqlx-core/src/net/tls/mod.rs

@@ -64,6 +64,7 @@ pub struct TlsConfig<'a> {
     pub root_cert_path: Option<&'a CertificateInput>,
     pub client_cert_path: Option<&'a CertificateInput>,
     pub client_key_path: Option<&'a CertificateInput>,
+    pub alpn_protocols: Option<Vec<&'a str>>,
 }
 
 pub async fn handshake<S, Ws>(

sqlx-core/src/net/tls/tls_native_tls.rs

@@ -53,6 +53,10 @@ pub async fn handshake<S: Socket>(
         builder.add_root_certificate(native_tls::Certificate::from_pem(&data).map_err(Error::tls)?);
     }
 
+    if let Some(protocols) = config.alpn_protocols {
+        builder.request_alpns(&protocols);
+    }
+
     // authentication using user's key-file and its associated certificate
     if let (Some(cert_path), Some(key_path)) = (config.client_cert_path, config.client_key_path) {
         let cert_path = cert_path.data().await?;

sqlx-core/src/net/tls/tls_rustls.rs

@@ -123,7 +123,7 @@ where
         }
     };
 
-    let config = if tls_config.accept_invalid_certs {
+    let mut config = if tls_config.accept_invalid_certs {
         if let Some(user_auth) = user_auth {
             config
                 .dangerous()
@@ -183,6 +183,15 @@ where
         }
     };
 
+    if let Some(alpn_protocols) = tls_config.alpn_protocols {
+        let alpn_protocols: Vec<Vec<u8>> = alpn_protocols
+            .into_iter()
+            .map(|s| s.as_bytes().to_vec())
+            .collect();
+
+        config.alpn_protocols = alpn_protocols;
+    }
+
     let host = ServerName::try_from(tls_config.hostname.to_owned()).map_err(Error::tls)?;
 
     let mut socket = RustlsSocket {

sqlx-mysql/src/connection/tls.rs

@@ -66,6 +66,7 @@ pub(super) async fn maybe_upgrade<S: Socket>(
         root_cert_path: options.ssl_ca.as_ref(),
         client_cert_path: options.ssl_client_cert.as_ref(),
         client_key_path: options.ssl_client_key.as_ref(),
+        alpn_protocols: None,
     };
 
     // Request TLS upgrade

sqlx-postgres/src/connection/tls.rs

@@ -82,6 +82,7 @@ async fn maybe_upgrade<S: Socket>(
         root_cert_path: options.ssl_root_cert.as_ref(),
         client_cert_path: options.ssl_client_cert.as_ref(),
         client_key_path: options.ssl_client_key.as_ref(),
+        alpn_protocols: Some(vec!["postgresql"]),
     };
 
     tls::handshake(socket, config, SocketIntoBox).await