using System;

using System.Buffers;

using System.Collections.Generic;

using System.Data;

using System.Diagnostics;

using System.Diagnostics.CodeAnalysis;

using System.IO;

using System.Net;

using System.Net.Security;

using System.Net.Sockets;

using System.Runtime.CompilerServices;

using System.Runtime.InteropServices;

using System.Runtime.ExceptionServices;

using System.Security.Authentication;

using System.Security.Cryptography.X509Certificates;

using System.Text;

using System.Threading;

using System.Threading.Channels;

using System.Threading.Tasks;

using Npgsql.BackendMessages;

using Npgsql.Util;

using static Npgsql.Util.Statics;

using System.Transactions;

using Microsoft.Extensions.Logging;

using Npgsql.Properties;

namespace Npgsql.Internal;

public sealed partial class NpgsqlConnector

#region Fields and Properties

/// <summary>

/// The physical connection socket to the backend.

/// </summary>

Socket _socket = default!;

/// <summary>

/// The physical connection stream to the backend, without anything on top.

/// </summary>

NetworkStream _baseStream = default!;

/// <summary>

/// The physical connection stream to the backend, layered with an SSL/TLS stream if in secure mode.

/// </summary>

Stream _stream = default!;

/// <summary>

/// The parsed connection string.

/// </summary>

public NpgsqlConnectionStringBuilder Settings { get; }

Action<X509CertificateCollection>? ClientCertificatesCallback { get; }

RemoteCertificateValidationCallback? UserCertificateValidationCallback { get; }

#pragma warning disable CS0618 // ProvidePasswordCallback is obsolete

ProvidePasswordCallback? ProvidePasswordCallback { get; }

#pragma warning restore CS0618

public Encoding TextEncoding { get; private set; } = default!;

/// <summary>

/// Same as <see cref="TextEncoding"/>, except that it does not throw an exception if an invalid char is

/// encountered (exception fallback), but rather replaces it with a question mark character (replacement

/// fallback).

/// </summary>

internal Encoding RelaxedTextEncoding { get; private set; } = default!;

/// <summary>

/// Buffer used for reading data.

/// </summary>

internal NpgsqlReadBuffer ReadBuffer { get; private set; } = default!;

/// <summary>

/// If we read a data row that's bigger than <see cref="ReadBuffer"/>, we allocate an oversize buffer.

/// The original (smaller) buffer is stored here, and restored when the connection is reset.

/// </summary>

NpgsqlReadBuffer? _origReadBuffer;

/// <summary>

/// Buffer used for writing data.

/// </summary>

internal NpgsqlWriteBuffer WriteBuffer { get; private set; } = default!;

/// <summary>

/// The secret key of the backend for this connector, used for query cancellation.

/// </summary>

int _backendSecretKey;

/// <summary>

/// The process ID of the backend for this connector.

/// </summary>

internal int BackendProcessId { get; private set; }

string? _inferredUserName;

/// <summary>

/// The user name that has been inferred when the connector was opened

/// </summary>

internal string InferredUserName

}

bool SupportsPostgresCancellation => BackendProcessId != 0;

/// <summary>

/// A unique ID identifying this connector, used for logging. Currently mapped to BackendProcessId

/// </summary>

internal int Id => BackendProcessId;

internal PgSerializerOptions SerializerOptions { get; set; } = default!;

/// <summary>

/// Information about PostgreSQL and PostgreSQL-like databases (e.g. type definitions, capabilities...).

/// </summary>

public NpgsqlDatabaseInfo DatabaseInfo { get; internal set; } = default!;

/// <summary>

/// The current transaction status for this connector.

/// </summary>

internal TransactionStatus TransactionStatus { get; set; }

/// <summary>

/// A transaction object for this connector. Since only one transaction can be in progress at any given time,

/// this instance is recycled. To check whether a transaction is currently in progress on this connector,

/// see <see cref="TransactionStatus"/>.

/// </summary>

internal NpgsqlTransaction? Transaction { get; set; }

internal NpgsqlTransaction? UnboundTransaction { get; set; }

/// <summary>

/// The NpgsqlConnection that (currently) owns this connector. Null if the connector isn't

/// owned (i.e. idle in the pool)

/// </summary>

internal NpgsqlConnection? Connection { get; set; }

/// <summary>

/// The number of messages that were prepended to the current message chain, but not yet sent.

/// Note that this only tracks messages which produce a ReadyForQuery message

/// </summary>

internal int PendingPrependedResponses { get; set; }

/// <summary>

/// A ManualResetEventSlim used to make sure a cancellation request doesn't run

/// while we're reading responses for the prepended query

/// as we can't gracefully handle their cancellation.

/// </summary>

readonly ManualResetEventSlim ReadingPrependedMessagesMRE = new(initialState: true);

internal NpgsqlDataReader? CurrentReader;

internal PreparedStatementManager PreparedStatementManager { get; }

internal SqlQueryParser SqlQueryParser { get; } = new();

/// <summary>

/// If the connector is currently in COPY mode, holds a reference to the importer/exporter object.

/// Otherwise null.

/// </summary>

internal ICancelable? CurrentCopyOperation;

/// <summary>

/// Holds all run-time parameters received from the backend (via ParameterStatus messages)

/// </summary>

internal Dictionary<string, string> PostgresParameters { get; }

/// <summary>

/// Holds all run-time parameters in raw, binary format for efficient handling without allocations.

/// </summary>

readonly List<(byte[] Name, byte[] Value)> _rawParameters = new();

/// <summary>

/// If this connector was broken, this contains the exception that caused the break.

/// </summary>

volatile Exception? _breakReason;

// Used by replication to change our cancellation behaviour on ColumnStreams.

internal bool LongRunningConnection { get; set; }

/// <summary>

/// <para>

/// Used by the pool to indicate that I/O is currently in progress on this connector, so that another write

/// isn't started concurrently. Note that since we have only one write loop, this is only ever usedto

/// protect against an over-capacity writes into a connector that's currently *asynchronously* writing.

/// </para>

/// <para>

/// It is guaranteed that the currently-executing

/// Specifically, reading may occur - and the connector may even be returned to the pool - before this is

/// released.

/// </para>

/// </summary>

internal volatile int MultiplexAsyncWritingLock;

/// <seealso cref="MultiplexAsyncWritingLock"/>

internal void FlagAsNotWritableForMultiplexing()

}

/// <seealso cref="MultiplexAsyncWritingLock"/>

internal void FlagAsWritableForMultiplexing()

}

/// <summary>

/// A lock that's taken while a cancellation is being delivered; new queries are blocked until the

/// cancellation is delivered. This reduces the chance that a cancellation meant for a previous

/// command will accidentally cancel a later one, see #615.

/// </summary>

object CancelLock { get; } = new();

/// <summary>

/// A lock that's taken to make sure no other concurrent operation is running.

/// Break takes it to set the state of the connector.

/// Anyone else should immediately check the state and exit

/// if the connector is closed.

/// </summary>

object SyncObj { get; } = new();

/// <summary>

/// A lock that's used to wait for the Cleanup to complete while breaking the connection.

/// </summary>

object CleanupLock { get; } = new();

readonly bool _isKeepAliveEnabled;

readonly Timer? _keepAliveTimer;

/// <summary>

/// The command currently being executed by the connector, null otherwise.

/// Used only for concurrent use error reporting purposes.

/// </summary>

NpgsqlCommand? _currentCommand;

bool _sendResetOnClose;

/// <summary>

/// The connector source (e.g. pool) from where this connector came, and to which it will be returned.

/// Note that in multi-host scenarios, this references the host-specific <see cref="PoolingDataSource"/> rather than the

/// <see cref="NpgsqlMultiHostDataSource"/>.

/// </summary>

internal NpgsqlDataSource DataSource { get; }

internal string UserFacingConnectionString => DataSource.ConnectionString;

/// <summary>

/// Contains the UTC timestamp when this connector was opened, used to implement

/// <see cref="NpgsqlConnectionStringBuilder.ConnectionLifetime"/>.

/// </summary>

internal DateTime OpenTimestamp { get; private set; }

internal int ClearCounter { get; set; }

volatile bool _postgresCancellationPerformed;

internal bool PostgresCancellationPerformed

}

volatile bool _userCancellationRequested;

CancellationTokenRegistration _cancellationTokenRegistration;

internal bool UserCancellationRequested => _userCancellationRequested;

internal CancellationToken UserCancellationToken { get; set; }

internal bool AttemptPostgresCancellation { get; private set; }

static readonly TimeSpan _cancelImmediatelyTimeout = TimeSpan.FromMilliseconds(-1);

IDisposable? _certificate;

internal NpgsqlLoggingConfiguration LoggingConfiguration { get; }

internal ILogger ConnectionLogger { get; }

internal ILogger CommandLogger { get; }

internal ILogger TransactionLogger { get; }

internal ILogger CopyLogger { get; }

internal readonly Stopwatch QueryLogStopWatch = new();

internal EndPoint? ConnectedEndPoint { get; private set; }

#endregion

#region Constants

/// <summary>

/// The minimum timeout that can be set on internal commands such as COMMIT, ROLLBACK.

/// </summary>

/// <remarks>Precision is seconds</remarks>

internal const int MinimumInternalCommandTimeout = 3;

#endregion

#region Reusable Message Objects

byte[]? _resetWithoutDeallocateMessage;

int _resetWithoutDeallocateResponseCount;

// Backend

readonly CommandCompleteMessage _commandCompleteMessage = new();

readonly ReadyForQueryMessage _readyForQueryMessage = new();

readonly ParameterDescriptionMessage _parameterDescriptionMessage = new();

readonly DataRowMessage _dataRowMessage = new();

readonly RowDescriptionMessage _rowDescriptionMessage = new(connectorOwned: true);

// Since COPY is rarely used, allocate these lazily

CopyInResponseMessage? _copyInResponseMessage;

CopyOutResponseMessage? _copyOutResponseMessage;

CopyDataMessage? _copyDataMessage;

CopyBothResponseMessage? _copyBothResponseMessage;

#endregion

internal NpgsqlDataReader DataReader { get; set; }

internal NpgsqlDataReader? UnboundDataReader { get; set; }

#region Constructors

internal NpgsqlConnector(NpgsqlDataSource dataSource, NpgsqlConnection conn)

}

NpgsqlConnector(NpgsqlConnector connector)

}

NpgsqlConnector(NpgsqlDataSource dataSource)

}

#endregion

#region Configuration settings

internal string Host => Settings.Host!;

internal int Port => Settings.Port;

internal string Database => Settings.Database!;

string KerberosServiceName => Settings.KerberosServiceName;

int ConnectionTimeout => Settings.Timeout;

#endregion Configuration settings

#region State management

int _state;

/// <summary>

/// Gets the current state of the connector

/// </summary>

internal ConnectorState State

}

/// <summary>

/// Returns whether the connector is open, regardless of any task it is currently performing

/// </summary>

bool IsConnected => State is not (ConnectorState.Closed or ConnectorState.Connecting or ConnectorState.Broken);

internal bool IsReady => State == ConnectorState.Ready;

internal bool IsClosed => State == ConnectorState.Closed;

internal bool IsBroken => State == ConnectorState.Broken;

#endregion

#region Open

/// <summary>

/// Opens the physical connection to the server.

/// </summary>

/// <remarks>Usually called by the RequestConnector

/// Method of the connection pool manager.</remarks>

internal async Task Open(NpgsqlTimeout timeout, bool async, CancellationToken cancellationToken)

{

Debug.Assert(State == ConnectorState.Closed);

State = ConnectorState.Connecting;

LogMessages.OpeningPhysicalConnection(ConnectionLogger, Host, Port, Database, UserFacingConnectionString);

var stopwatch = Stopwatch.StartNew();

try

{

await OpenCore(this, Settings.SslMode, timeout, async, cancellationToken).ConfigureAwait(false);

await DataSource.Bootstrap(this, timeout, forceReload: false, async, cancellationToken).ConfigureAwait(false);

Debug.Assert(DataSource.SerializerOptions is not null);

Debug.Assert(DataSource.DatabaseInfo is not null);

SerializerOptions = DataSource.SerializerOptions;

DatabaseInfo = DataSource.DatabaseInfo;

if (Settings.Pooling && !Settings.Multiplexing && !Settings.NoResetOnClose && DatabaseInfo.SupportsDiscard)

{

_sendResetOnClose = true;

GenerateResetMessage();

}

OpenTimestamp = DateTime.UtcNow;

if (Settings.Multiplexing)

{

// Start an infinite async loop, which processes incoming multiplexing traffic.

// It is intentionally not awaited and will run as long as the connector is alive.

// The CommandsInFlightWriter channel is completed in Cleanup, which should cause this task

// to complete.

_ = Task.Run(MultiplexingReadLoop, CancellationToken.None)

.ContinueWith(t =>

{

// Note that we *must* observe the exception if the task is faulted.

ConnectionLogger.LogError(t.Exception!, "Exception bubbled out of multiplexing read loop", Id);

}, TaskContinuationOptions.OnlyOnFaulted);

}

if (_isKeepAliveEnabled)

{

// Start the keep alive mechanism to work by scheduling the timer.

// Otherwise, it doesn't work for cases when no query executed during

// the connection lifetime in case of a new connector.

lock (SyncObj)

{

var keepAlive = Settings.KeepAlive * 1000;

_keepAliveTimer!.Change(keepAlive, keepAlive);

}

}

if (DataSource.ConnectionInitializerAsync is not null)

{

Debug.Assert(DataSource.ConnectionInitializer is not null);

var tempConnection = new NpgsqlConnection(DataSource, this);

try

{

if (async)

await DataSource.ConnectionInitializerAsync(tempConnection).ConfigureAwait(false);

else if (!async)

DataSource.ConnectionInitializer(tempConnection);

}

finally

{

// Note that we can't just close/dispose the NpgsqlConnection, since that puts the connector back in the pool.

// But we transition it to disposed immediately, in case the user decides to capture the NpgsqlConnection and use it

// later.

Connection?.MakeDisposed();

Connection = null;

}

}

LogMessages.OpenedPhysicalConnection(

ConnectionLogger, Host, Port, Database, UserFacingConnectionString, stopwatch.ElapsedMilliseconds, Id);

}

catch (Exception e)

{

Break(e);

throw;

}

static async Task OpenCore(

NpgsqlConnector conn,

SslMode sslMode,

NpgsqlTimeout timeout,

bool async,

CancellationToken cancellationToken)

{

await conn.RawOpen(sslMode, timeout, async, cancellationToken).ConfigureAwait(false);

var username = await conn.GetUsernameAsync(async, cancellationToken).ConfigureAwait(false);

timeout.CheckAndApply(conn);

conn.WriteStartupMessage(username);

await conn.Flush(async, cancellationToken).ConfigureAwait(false);

using var cancellationRegistration = conn.StartCancellableOperation(cancellationToken, attemptPgCancellation: false);

try

{

await conn.Authenticate(username, timeout, async, cancellationToken).ConfigureAwait(false);

}

catch (PostgresException e)

when (e.SqlState == PostgresErrorCodes.InvalidAuthorizationSpecification &&

(sslMode == SslMode.Prefer && conn.IsSecure || sslMode == SslMode.Allow && !conn.IsSecure))

{

cancellationRegistration.Dispose();

Debug.Assert(!conn.IsBroken);

conn.Cleanup();

// If Prefer was specified and we failed (with SSL), retry without SSL.

// If Allow was specified and we failed (without SSL), retry with SSL

await OpenCore(

conn,

sslMode == SslMode.Prefer ? SslMode.Disable : SslMode.Require,

timeout,

async,

cancellationToken).ConfigureAwait(false);

return;

}

// We treat BackendKeyData as optional because some PostgreSQL-like database

// don't send it (CockroachDB, CrateDB)

var msg = await conn.ReadMessage(async).ConfigureAwait(false);

if (msg.Code == BackendMessageCode.BackendKeyData)

{

var keyDataMsg = (BackendKeyDataMessage)msg;

conn.BackendProcessId = keyDataMsg.BackendProcessId;

conn._backendSecretKey = keyDataMsg.BackendSecretKey;

msg = await conn.ReadMessage(async).ConfigureAwait(false);

}

if (msg.Code != BackendMessageCode.ReadyForQuery)

throw new NpgsqlException($"Received backend message {msg.Code} while expecting ReadyForQuery. Please file a bug.");

conn.State = ConnectorState.Ready;

}

}

internal async ValueTask<DatabaseState> QueryDatabaseState(

NpgsqlTimeout timeout, bool async, CancellationToken cancellationToken = default)

{

using var batch = CreateBatch();

batch.BatchCommands.Add(new NpgsqlBatchCommand("select pg_is_in_recovery()"));

batch.BatchCommands.Add(new NpgsqlBatchCommand("SHOW default_transaction_read_only"));

batch.Timeout = (int)timeout.CheckAndGetTimeLeft().TotalSeconds;

var reader = async ? await batch.ExecuteReaderAsync(cancellationToken).ConfigureAwait(false) : batch.ExecuteReader();

try

{

if (async)

{

await reader.ReadAsync(cancellationToken).ConfigureAwait(false);

_isHotStandBy = reader.GetBoolean(0);

await reader.NextResultAsync(cancellationToken).ConfigureAwait(false);

await reader.ReadAsync(cancellationToken).ConfigureAwait(false);

}

else

{

reader.Read();

_isHotStandBy = reader.GetBoolean(0);

reader.NextResult();

reader.Read();

}

_isTransactionReadOnly = reader.GetString(0) != "off";

var databaseState = UpdateDatabaseState();

Debug.Assert(databaseState.HasValue);

return databaseState.Value;

}

finally

{

if (async)

await reader.DisposeAsync().ConfigureAwait(false);

else

reader.Dispose();

}

}

void WriteStartupMessage(string username)

{

var startupParams = new Dictionary<string, string>

{

["user"] = username,

["client_encoding"] = Settings.ClientEncoding ??

PostgresEnvironment.ClientEncoding ??

"UTF8"

};

if (Settings.Database is not null)

startupParams["database"] = Settings.Database;

if (Settings.ApplicationName?.Length > 0)

startupParams["application_name"] = Settings.ApplicationName;

if (Settings.SearchPath?.Length > 0)

startupParams["search_path"] = Settings.SearchPath;

var timezone = Settings.Timezone ?? PostgresEnvironment.TimeZone;

if (timezone != null)

startupParams["TimeZone"] = timezone;

var options = Settings.Options ?? PostgresEnvironment.Options;

if (options?.Length > 0)

startupParams["options"] = options;

switch (Settings.ReplicationMode)

{

case ReplicationMode.Logical:

startupParams["replication"] = "database";

break;

case ReplicationMode.Physical:

startupParams["replication"] = "true";

break;

}

WriteStartup(startupParams);

}

ValueTask<string> GetUsernameAsync(bool async, CancellationToken cancellationToken)

{

var username = Settings.Username;

if (username?.Length > 0)

{

InferredUserName = username;

return new(username);

}

username = PostgresEnvironment.User;

if (username?.Length > 0)

{

InferredUserName = username;

return new(username);

}

return GetUsernameAsyncInternal();

async ValueTask<string> GetUsernameAsyncInternal()

{

if (!RuntimeInformation.IsOSPlatform(OSPlatform.Windows))

{

username = await DataSource.IntegratedSecurityHandler.GetUsername(async, Settings.IncludeRealm, ConnectionLogger,

cancellationToken).ConfigureAwait(false);

if (username?.Length > 0)

{

InferredUserName = username;

return username;

}

}

username = Environment.UserName;

if (username?.Length > 0)

{

InferredUserName = username;

return username;

}

throw new NpgsqlException("No username could be found, please specify one explicitly");

}

}

async Task RawOpen(SslMode sslMode, NpgsqlTimeout timeout, bool async, CancellationToken cancellationToken)

{

try

{

if (async)

await ConnectAsync(timeout, cancellationToken).ConfigureAwait(false);

else

Connect(timeout);

_baseStream = new NetworkStream(_socket, true);

_stream = _baseStream;

if (Settings.Encoding == "UTF8")

{

TextEncoding = NpgsqlWriteBuffer.UTF8Encoding;

RelaxedTextEncoding = NpgsqlWriteBuffer.RelaxedUTF8Encoding;

}

else

{

TextEncoding = Encoding.GetEncoding(Settings.Encoding, EncoderFallback.ExceptionFallback, DecoderFallback.ExceptionFallback);

RelaxedTextEncoding = Encoding.GetEncoding(Settings.Encoding, EncoderFallback.ReplacementFallback, DecoderFallback.ReplacementFallback);

}

ReadBuffer = new NpgsqlReadBuffer(this, _stream, _socket, Settings.ReadBufferSize, TextEncoding, RelaxedTextEncoding);

WriteBuffer = new NpgsqlWriteBuffer(this, _stream, _socket, Settings.WriteBufferSize, TextEncoding);

timeout.CheckAndApply(this);

IsSecure = false;

if ((sslMode is SslMode.Prefer && DataSource.TransportSecurityHandler.SupportEncryption) ||

sslMode is SslMode.Require or SslMode.VerifyCA or SslMode.VerifyFull)

{

WriteSslRequest();

await Flush(async, cancellationToken).ConfigureAwait(false);

await ReadBuffer.Ensure(1, async).ConfigureAwait(false);

var response = (char)ReadBuffer.ReadByte();

timeout.CheckAndApply(this);

switch (response)

{

default:

throw new NpgsqlException($"Received unknown response {response} for SSLRequest (expecting S or N)");

case 'N':

if (sslMode != SslMode.Prefer)

throw new NpgsqlException("SSL connection requested. No SSL enabled connection from this host is configured.");

break;

case 'S':

await DataSource.TransportSecurityHandler.NegotiateEncryption(async, this, sslMode, timeout).ConfigureAwait(false);

break;

}

if (ReadBuffer.ReadBytesLeft > 0)

throw new NpgsqlException("Additional unencrypted data received after SSL negotiation - this should never happen, and may be an indication of a man-in-the-middle attack.");

}

ConnectionLogger.LogTrace("Socket connected to {Host}:{Port}", Host, Port);

}

catch

{

_stream?.Dispose();

_stream = null!;

_baseStream?.Dispose();

_baseStream = null!;

_socket?.Dispose();

_socket = null!;

throw;

}

}

internal async Task NegotiateEncryption(SslMode sslMode, NpgsqlTimeout timeout, bool async)

{

var clientCertificates = new X509Certificate2Collection();

var certPath = Settings.SslCertificate ?? PostgresEnvironment.SslCert ?? PostgresEnvironment.SslCertDefault;

if (certPath != null)

{

var password = Settings.SslPassword;

X509Certificate2? cert = null;

if (Path.GetExtension(certPath).ToUpperInvariant() != ".PFX")

{

// It's PEM time

var keyPath = Settings.SslKey ?? PostgresEnvironment.SslKey ?? PostgresEnvironment.SslKeyDefault;

cert = string.IsNullOrEmpty(password)

? X509Certificate2.CreateFromPemFile(certPath, keyPath)

: X509Certificate2.CreateFromEncryptedPemFile(certPath, password, keyPath);

if (RuntimeInformation.IsOSPlatform(OSPlatform.Windows))

{

// Windows crypto API has a bug with pem certs

// See #3650

using var previousCert = cert;

cert = new X509Certificate2(cert.Export(X509ContentType.Pkcs12));

}

}

cert ??= new X509Certificate2(certPath, password);

clientCertificates.Add(cert);

_certificate = cert;

}

try

{

ClientCertificatesCallback?.Invoke(clientCertificates);

var checkCertificateRevocation = Settings.CheckCertificateRevocation;

RemoteCertificateValidationCallback? certificateValidationCallback;

X509Certificate2? caCert;

string? certRootPath = null;

if (UserCertificateValidationCallback is not null)

{

if (sslMode is SslMode.VerifyCA or SslMode.VerifyFull)

throw new ArgumentException(string.Format(NpgsqlStrings.CannotUseSslVerifyWithUserCallback, sslMode));

if (Settings.RootCertificate is not null)

throw new ArgumentException(NpgsqlStrings.CannotUseSslRootCertificateWithUserCallback);

if (DataSource.TransportSecurityHandler.RootCertificateCallback is not null)

throw new ArgumentException(NpgsqlStrings.CannotUseValidationRootCertificateCallbackWithUserCallback);

certificateValidationCallback = UserCertificateValidationCallback;

}

else if (sslMode is SslMode.Prefer or SslMode.Require)

{

certificateValidationCallback = SslTrustServerValidation;

checkCertificateRevocation = false;

}

else if ((caCert = DataSource.TransportSecurityHandler.RootCertificateCallback?.Invoke()) is not null ||

(certRootPath = Settings.RootCertificate ??

PostgresEnvironment.SslCertRoot ?? PostgresEnvironment.SslCertRootDefault) is not null)

{

certificateValidationCallback = SslRootValidation(sslMode == SslMode.VerifyFull, certRootPath, caCert);

}

else if (sslMode == SslMode.VerifyCA)

{

certificateValidationCallback = SslVerifyCAValidation;

}

else

{

Debug.Assert(sslMode == SslMode.VerifyFull);

certificateValidationCallback = SslVerifyFullValidation;

}

var host = Host;

#if !NET8_0_OR_GREATER

// If the host is a valid IP address - replace it with an empty string

// We do that because .NET uses targetHost argument to send SNI to the server

// RFC explicitly prohibits sending an IP address so some servers might fail

// This was already fixed for .NET 8

// See #5543 for discussion

if (IPAddress.TryParse(host, out _))

host = string.Empty;

#endif

timeout.CheckAndApply(this);

try

{

var sslStream = new SslStream(_stream, leaveInnerStreamOpen: false, certificateValidationCallback);

if (async)

await sslStream.AuthenticateAsClientAsync(host, clientCertificates, SslProtocols.None, checkCertificateRevocation).ConfigureAwait(false);

else

sslStream.AuthenticateAsClient(host, clientCertificates, SslProtocols.None, checkCertificateRevocation);

_stream = sslStream;

}

catch (Exception e)

{

throw new NpgsqlException("Exception while performing SSL handshake", e);

}

ReadBuffer.Underlying = _stream;

WriteBuffer.Underlying = _stream;

IsSecure = true;

ConnectionLogger.LogTrace("SSL negotiation successful");

}

catch

{

_certificate?.Dispose();

_certificate = null;

throw;

}

}

void Connect(NpgsqlTimeout timeout)

{

// Note that there aren't any timeout-able or cancellable DNS methods

var endpoints = NpgsqlConnectionStringBuilder.IsUnixSocket(Host, Port, out var socketPath)

? new EndPoint[] { new UnixDomainSocketEndPoint(socketPath) }

: IPAddressesToEndpoints(Dns.GetHostAddresses(Host), Port);

timeout.Check();

// Give each endpoint an equal share of the remaining time

var perEndpointTimeout = -1; // Default to infinity

if (timeout.IsSet)

perEndpointTimeout = (int)(timeout.CheckAndGetTimeLeft().Ticks / endpoints.Length / 10);

for (var i = 0; i < endpoints.Length; i++)

{

var endpoint = endpoints[i];

ConnectionLogger.LogTrace("Attempting to connect to {Endpoint}", endpoint);

var protocolType =

endpoint.AddressFamily == AddressFamily.InterNetwork ||

endpoint.AddressFamily == AddressFamily.InterNetworkV6

? ProtocolType.Tcp

: ProtocolType.IP;

var socket = new Socket(endpoint.AddressFamily, SocketType.Stream, protocolType)

{

Blocking = false

};

try

{

try

{

socket.Connect(endpoint);

}

catch (SocketException e)

{

if (e.SocketErrorCode != SocketError.WouldBlock)

throw;

}

var write = new List<Socket> { socket };

var error = new List<Socket> { socket };

Socket.Select(null, write, error, perEndpointTimeout);

var errorCode = (int) socket.GetSocketOption(SocketOptionLevel.Socket, SocketOptionName.Error)!;

if (errorCode != 0)

throw new SocketException(errorCode);

if (write.Count is 0)

throw new TimeoutException("Timeout during connection attempt");

socket.Blocking = true;

SetSocketOptions(socket);

_socket = socket;