From: Tom Lane <tgl@sss.pgh.pa.us>
To: Markus KARG <markus@headcrashing.eu>
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: psql v16.3 successfully connects via TLSv1.3 proxy, but psql v16.4 says "tlsv1 alert no application protocol"
Date: Wed, 25 Dec 2024 14:37:00 -0500
Message-ID: <1807243.1735155420@sss.pgh.pa.us> (raw)
In-Reply-To: <81360110-1708-4126-8c0d-333ead43a6df@headcrashing.eu>
References: <68ff85d7-9b41-40ec-bddf-0ca74fe09875@headcrashing.eu>
<2bfb5b13-63d7-4bce-96b4-8e075fe7d97a@iki.fi>
<8a8cba41-fa82-492b-8500-a7538e5d5cf7@headcrashing.eu>
<81360110-1708-4126-8c0d-333ead43a6df@headcrashing.eu>
Markus KARG <markus@headcrashing.eu> writes:
> Following this theory, sslnegotiation=postgres used with psql v17.x
> should solve the problem, as it falls back to the same mechanism
> supported in v16.3, correct?
No, sorry, it looks like we insert the ALPN extension into the SSL
request packet regardless of that. Maybe there should have been
a way to suppress that, but v17 libpq doesn't provide one.
> Regarding your question: I have tried "sslnegotiation=postgres" and
> "ssqlnegotiation=direct" with the original official PostgreSQL Docker
> Container found on Docker Hub.
Let's clarify something here: there is nothing "official" about either
that docker container or anything else you might find on DockerHub.
The Postgres community does not produce any such packaging. You'd
have to discussion the inclusion of v17 libpq with whoever did build
that container. I know that Debian thinks it's a good idea to use
latest libpq with older servers, and this builder might be following
their lead. (The timing would be about right, since v17.0 came out
about the same time as 16.4.) This example does show that there
are pitfalls in that policy.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: tgl@sss.pgh.pa.us, markus@headcrashing.eu, pgsql-bugs@lists.postgresql.org
Subject: Re: psql v16.3 successfully connects via TLSv1.3 proxy, but psql v16.4 says "tlsv1 alert no application protocol"
In-Reply-To: <1807243.1735155420@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox