This section describes the message flow. There are four different
types of flows depending on the state of the connection: start-up,
query, function call, and termination. There are also special
provisions for notification responses and command cancellation,
which can occur at any time after the start-up phase.
Initially, the frontend sends a StartupPacket. The server uses
this info and the contents of the pg_hba.conf
file to determine what authentication method the frontend must
use. The server then responds with one of the following messages:
- ErrorResponse
The server then immediately closes the connection.
- AuthenticationOk
The authentication exchange is completed.
- AuthenticationKerberosV4
The frontend must then take part in a Kerberos V4
authentication dialog (not described here, part of the
Kerberos specification) with the server. If this is
successful, the server responds with an AuthenticationOk,
otherwise it responds with an ErrorResponse.
- AuthenticationKerberosV5
The frontend must then take part in a Kerberos V5
authentication dialog (not described here, part of the
Kerberos specification) with the server. If this is
successful, the server responds with an AuthenticationOk,
otherwise it responds with an ErrorResponse.
- AuthenticationCleartextPassword
The frontend must then send a PasswordPacket containing the
password in clear-text form. If
this is the correct password, the server responds with an
AuthenticationOk, otherwise it responds with an ErrorResponse.
- AuthenticationCryptPassword
The frontend must then send a PasswordPacket containing the
password encrypted via crypt(3), using the 2-character salt
specified in the AuthenticationCryptPassword packet. If
this is the correct password, the server responds with an
AuthenticationOk, otherwise it responds with an ErrorResponse.
- AuthenticationMD5Password
The frontend must then send a PasswordPacket containing the
password encrypted via MD5, using the 4-character salt
specified in the AuthenticationMD5Password packet. If
this is the correct password, the server responds with an
AuthenticationOk, otherwise it responds with an ErrorResponse.
- AuthenticationSCMCredential
This method is only possible for local Unix-domain connections
on platforms that support SCM credential messages. The frontend
must issue an SCM credential message and then send a single data
byte. (The contents of the data byte are uninteresting; it's
only used to ensure that the server waits long enough to receive
the credential message.) If the credential is acceptable,
the server responds with an
AuthenticationOk, otherwise it responds with an ErrorResponse.
If the frontend does not support the authentication method
requested by the server, then it should immediately close the
connection.
After having received AuthenticationOk, the frontend should wait
for further messages from the server. The possible messages from
the backend in this phase are:
- BackendKeyData
This message provides secret-key data that the frontend must
save if it wants to be able to issue cancel requests later.
The frontend should not respond to this message, but should
continue listening for a ReadyForQuery message.
- ReadyForQuery
Start-up is completed. The frontend may now issue query or
function call messages.
- ErrorResponse
Start-up failed. The connection is closed after sending this
message.
- NoticeResponse
A warning message has been issued. The frontend should
display the message but continue listening for ReadyForQuery
or ErrorResponse.
The ReadyForQuery message is the same one that the backend will
issue after each query cycle. Depending on the coding needs of
the frontend, it is reasonable to consider ReadyForQuery as
starting a query cycle (and then BackendKeyData indicates
successful conclusion of the start-up phase), or to consider
ReadyForQuery as ending the start-up phase and each subsequent
query cycle.
A Query cycle is initiated by the frontend sending a Query message
to the backend. The backend then sends one or more response
messages depending on the contents of the query command string,
and finally a ReadyForQuery response message. ReadyForQuery
informs the frontend that it may safely send a new query or
function call.
The possible response messages from the backend are:
- CompletedResponse
An SQL command completed normally.
- CopyInResponse
The backend is ready to copy data from the frontend to a
table. The frontend should then send a CopyDataRows message.
The backend will then respond with a CompletedResponse message
with a tag of COPY.
- CopyOutResponse
The backend is ready to copy data from a table to the
frontend. It then sends a CopyDataRows message, and then a
CompletedResponse message with a tag of COPY.
- CursorResponse
Beginning of the response to a SELECT,
FETCH, INSERT,
UPDATE, or DELETE
query. In the FETCH case the name of the
cursor being fetched from is included in the message. Otherwise
the message always mentions the "blank" cursor.
- RowDescription
Indicates that rows are about to be returned in response to
a SELECT or FETCH query.
The message contents describe the layout of the rows. This
will be followed by an AsciiRow or BinaryRow message (depending on
whether a binary cursor was specified) for each row being returned
to the frontend.
- EmptyQueryResponse
An empty query string was recognized.
- ErrorResponse
An error has occurred.
- ReadyForQuery
Processing of the query string is complete. A separate
message is sent to indicate this because the query string may
contain multiple SQL commands. (CompletedResponse marks the
end of processing one SQL command, not the whole string.)
ReadyForQuery will always be sent, whether processing
terminates successfully or with an error.
- NoticeResponse
A warning message has been issued in relation to the query.
Notices are in addition to other responses, i.e., the backend
will continue processing the command.
The response to a SELECT or FETCH query
normally consists of CursorResponse, RowDescription, zero or more
AsciiRow or BinaryRow messages, and finally CompletedResponse.
INSERT, UPDATE, and
DELETE queries produce CursorResponse followed by
CompletedResponse.
COPY to or from the frontend invokes special protocol
as mentioned above.
All other query types normally produce only
a CompletedResponse message.
Since a query string could contain several queries (separated by
semicolons), there might be several such response sequences before the
backend finishes processing the query string. ReadyForQuery is issued
when the entire string has been processed and the backend is ready to
accept a new query string.
If a completely empty (no contents other than whitespace) query string
is received, the response is EmptyQueryResponse followed by ReadyForQuery.
(The need to specially distinguish this case is historical.)
In the event of an error, ErrorResponse is issued followed by
ReadyForQuery. All further processing of the query string is aborted by
ErrorResponse (even if more queries remained in it). Note that this
may occur partway through the sequence of messages generated by an
individual query.
A frontend must be prepared to accept ErrorResponse and
NoticeResponse messages whenever it is expecting any other type of
message.
Actually, it is possible for NoticeResponse to arrive even when
the frontend is not expecting any kind of message, that is, the
backend is nominally idle. (In particular, the backend can be
commanded to terminate by its parent process. In that case it will
send a NoticeResponse before closing the connection.) It is
recommended that the frontend check for such asynchronous notices
just before issuing any new command.
Also, if the frontend issues any LISTEN
commands then it must be prepared to accept NotificationResponse
messages at any time; see below.
Recommended practice is to code frontends in a state-machine style
that will accept any message type at any time that it could make sense,
rather than wiring in assumptions about the exact sequence of messages.
A Function Call cycle is initiated by the frontend sending a
FunctionCall message to the backend. The backend then sends one
or more response messages depending on the results of the function
call, and finally a ReadyForQuery response message. ReadyForQuery
informs the frontend that it may safely send a new query or
function call.
The possible response messages from the backend are:
- ErrorResponse
An error has occurred.
- FunctionResultResponse
The function call was executed and returned a result.
- FunctionVoidResponse
The function call was executed and returned no result.
- ReadyForQuery
Processing of the function call is complete. ReadyForQuery
will always be sent, whether processing terminates
successfully or with an error.
- NoticeResponse
A warning message has been issued in relation to the function
call. Notices are in addition to other responses, i.e., the
backend will continue processing the command.
A frontend must be prepared to accept ErrorResponse and
NoticeResponse messages whenever it is expecting any other type of
message. Also, if it issues any LISTEN
commands then it must be prepared to accept NotificationResponse
messages at any time; see below.
If a frontend issues a LISTEN command, then the
backend will send a NotificationResponse message (not to be
confused with NoticeResponse!) whenever a
NOTIFY command is executed for the same
notification name.
Notification responses are permitted at any point in the protocol
(after start-up), except within another backend message. Thus,
the frontend must be prepared to recognize a NotificationResponse
message whenever it is expecting any message. Indeed, it should
be able to handle NotificationResponse messages even when it is
not engaged in a query.
- NotificationResponse
A NOTIFY command has been executed for a
name for which a previous LISTEN command
was executed. Notifications may be sent at any time.
It may be worth pointing out that the names used in listen and
notify commands need not have anything to do with names of
relations (tables) in the SQL database. Notification names are
simply arbitrarily chosen condition names.
During the processing of a query, the frontend may request
cancellation of the query. The cancel request is not sent
directly on the open connection to the backend for reasons of
implementation efficiency: we don't want to have the backend
constantly checking for new input from the frontend during query
processing. Cancel requests should be relatively infrequent, so
we make them slightly cumbersome in order to avoid a penalty in
the normal case.
To issue a cancel request, the frontend opens a new connection to
the server and sends a CancelRequest message, rather than the
StartupPacket message that would ordinarily be sent across a new
connection. The server will process this request and then close
the connection. For security reasons, no direct reply is made to
the cancel request message.
A CancelRequest message will be ignored unless it contains the
same key data (PID and secret key) passed to the frontend during
connection start-up. If the request matches the PID and secret
key for a currently executing backend, the processing of the
current query is aborted. (In the existing implementation, this is
done by sending a special signal to the backend process that is
processing the query.)
The cancellation signal may or may not have any effect --- for
example, if it arrives after the backend has finished processing
the query, then it will have no effect. If the cancellation is
effective, it results in the current command being terminated
early with an error message.
The upshot of all this is that for reasons of both security and
efficiency, the frontend has no direct way to tell whether a
cancel request has succeeded. It must continue to wait for the
backend to respond to the query. Issuing a cancel simply improves
the odds that the current query will finish soon, and improves the
odds that it will fail with an error message instead of
succeeding.
Since the cancel request is sent across a new connection to the
server and not across the regular frontend/backend communication
link, it is possible for the cancel request to be issued by any
process, not just the frontend whose query is to be canceled.
This may have some benefits of flexibility in building
multiple-process applications. It also introduces a security
risk, in that unauthorized persons might try to cancel queries.
The security risk is addressed by requiring a dynamically
generated secret key to be supplied in cancel requests.
The normal, graceful termination procedure is that the frontend
sends a Terminate message and immediately closes the connection.
On receipt of the message, the backend immediately closes the
connection and terminates.
An ungraceful termination may occur due to software failure (i.e.,
core dump) at either end. If either frontend or backend sees an
unexpected closure of the connection, it should clean up and
terminate. The frontend has the option of launching a new backend
by recontacting the server if it doesn't want to terminate
itself.
For either normal or abnormal termination, any open transaction is
rolled back, not committed. One should note however that if a
frontend disconnects while a query is being processed, the backend
will probably finish the query before noticing the disconnection.
If the query is outside any transaction block (BEGIN
... COMMIT sequence) then its results may be committed
before the disconnection is recognized.
Recent releases of PostgreSQL allow frontend/backend
communication to be encrypted using SSL. This provides communication
security in environments where attackers might be able to capture the
session traffic.
To initiate an SSL-encrypted connection, the frontend initially sends
an SSLRequest message rather than a StartupPacket. The server then
responds with a single byte containing Y or N,
indicating that it is willing or unwilling to perform SSL, respectively.
The frontend may close the connection at this point if it is dissatisfied
with the response. To continue after Y, perform an SSL
startup handshake (not described here, part of the SSL specification)
with the server. If this is successful, continue with
sending the usual StartupPacket. In this case the StartupPacket and
all subsequent data will be SSL-encrypted. To continue after
N, send the usual StartupPacket and proceed without
encryption.
The frontend should also be prepared to handle an ErrorMessage response
to SSLRequest from the server. This would only occur if the server
predates the addition of SSL support to PostgreSQL.
In this case the connection must be closed, but the frontend may choose
to open a fresh connection and proceed without requesting SSL.
An initial SSLRequest may also be used in a connection that is being
opened to send a CancelRequest message.
While the protocol itself does not provide a way for the server to
force SSL encryption, the administrator may configure the server to
reject unencrypted sessions as a byproduct of authentication checking.
