Add generic TCP connection handler hook

src/Server/TCP/Swoole.php

@@ -319,10 +319,10 @@ public function onReceive(Server $server, int $fd, string $data, int $port): voi
             $this->connections[$fd] = $connection;
         }
 
-        // Handle PostgreSQL STARTTLS: SSLRequest comes before the real startup message.
-        if ($this->tlsContext !== null && $port === 5432 && TLS::isPostgreSQLSSLRequest($data)) {
-            $server->send($fd, TLS::PG_SSL_RESPONSE_OK);
-            $connection->pendingTls = true;
+        $sslResponse = $this->postgreSQLSSLResponse($data, $port);
+        if ($sslResponse !== null) {
+            $server->send($fd, $sslResponse);
+            $connection->pendingTls = $sslResponse === TLS::PG_SSL_RESPONSE_OK;
 
             return;
         }
@@ -393,6 +393,19 @@ protected function forward(Server $server, int $clientFd, Client $backend): void
         });
     }
 
+    private function postgreSQLSSLResponse(string $data, int $port): ?string
+    {
+        if (!\in_array($port, [5432, 6432], true) || !TLS::isPostgreSQLSSLRequest($data)) {
+            return null;
+        }
+
+        if ($this->tlsContext !== null) {
+            return TLS::PG_SSL_RESPONSE_OK;
+        }
+
+        return TLS::PG_SSL_RESPONSE_REJECT;
+    }
+
     public function onClose(Server $server, int $fd, int $reactorId): void
     {
         if ($this->config->logConnections) {

tests/TLSTest.php

@@ -3,6 +3,8 @@
 namespace Utopia\Tests;
 
 use PHPUnit\Framework\TestCase;
+use ReflectionClass;
+use Utopia\Proxy\Server\TCP\Swoole as TCPServer;
 use Utopia\Proxy\Server\TCP\TLS;
 
 class TLSTest extends TestCase
@@ -270,6 +272,24 @@ public function testIsPostgreSQLSSLRequestWithRegularStartupMessage(): void
         $this->assertFalse(TLS::isPostgreSQLSSLRequest($startup));
     }
 
+    public function testPostgreSQLSSLRequestIsRejectedWhenTlsIsDisabled(): void
+    {
+        $server = $this->tcpServerWithoutConstructor();
+
+        $this->assertSame(TLS::PG_SSL_RESPONSE_REJECT, $this->postgreSQLSSLResponse($server, TLS::PG_SSL_REQUEST, 5432));
+        $this->assertSame(TLS::PG_SSL_RESPONSE_REJECT, $this->postgreSQLSSLResponse($server, TLS::PG_SSL_REQUEST, 6432));
+    }
+
+    public function testPostgreSQLSSLResponseIgnoresNonSslPackets(): void
+    {
+        $server = $this->tcpServerWithoutConstructor();
+
+        $startup = "\x00\x00\x00\x08\x00\x03\x00\x00";
+
+        $this->assertNull($this->postgreSQLSSLResponse($server, $startup, 5432));
+        $this->assertNull($this->postgreSQLSSLResponse($server, TLS::PG_SSL_REQUEST, 3306));
+    }
+
     public function testIsMySQLSSLRequestWithValidData(): void
     {
         // Build a valid MySQL SSL request: 36+ bytes, sequence ID 1, SSL flag set
@@ -346,4 +366,25 @@ public function testIsMySQLSSLRequestWithLargerPacket(): void
         $data[5] = "\x08";
         $this->assertTrue(TLS::isMySQLSSLRequest($data));
     }
+
+    private function tcpServerWithoutConstructor(): TCPServer
+    {
+        $reflection = new ReflectionClass(TCPServer::class);
+        $server = $reflection->newInstanceWithoutConstructor();
+        $property = $reflection->getProperty('tlsContext');
+        $property->setValue($server, null);
+
+        return $server;
+    }
+
+    private function postgreSQLSSLResponse(TCPServer $server, string $data, int $port): ?string
+    {
+        $reflection = new ReflectionClass(TCPServer::class);
+        $method = $reflection->getMethod('postgreSQLSSLResponse');
+        $response = $method->invoke($server, $data, $port);
+
+        $this->assertTrue(\is_string($response) || $response === null);
+
+        return $response;
+    }
 }