Content-Type: multipart/alternative;
 boundary="------------6JeENwZOEcfSo3xQMvqxRWJ2"
Message-ID: <5fc24305-136e-4a6e-993e-b10dc2300403@headcrashing.eu>
Date: Wed, 25 Dec 2024 23:47:15 +0100
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: psql v16.3 successfully connects via TLSv1.3 proxy, but psql
 v16.4 says "tlsv1 alert no application protocol"
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: pgsql-bugs@lists.postgresql.org
References: <68ff85d7-9b41-40ec-bddf-0ca74fe09875@headcrashing.eu>
 <2bfb5b13-63d7-4bce-96b4-8e075fe7d97a@iki.fi>
 <8a8cba41-fa82-492b-8500-a7538e5d5cf7@headcrashing.eu>
 <81360110-1708-4126-8c0d-333ead43a6df@headcrashing.eu>
 <1807243.1735155420@sss.pgh.pa.us>
From: Markus KARG <markus@headcrashing.eu>
In-Reply-To: <1807243.1735155420@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/5fc24305-136e-4a6e-993e-b10dc2300403%40headcrashing.eu>
Precedence: bulk

This is a multi-part message in MIME format.
--------------6JeENwZOEcfSo3xQMvqxRWJ2
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

> Markus KARG<markus@headcrashing.eu> writes:
>> Following this theory, sslnegotiation=postgres used with psql v17.x
>> should solve the problem, as it falls back to the same mechanism
>> supported in v16.3, correct?
> No, sorry, it looks like we insert the ALPN extension into the SSL
> request packet regardless of that.  Maybe there should have been
> a way to suppress that, but v17 libpq doesn't provide one.

Thank you, Tom, you saved my day! I have explicitly added the name 
`postgresql` to the ALPN configuration on Traefik, and immediately psql 
v16.4+ (including psql v17) worked like a charm!

As a reference for others, in `traefik-dynamic.yaml` add the follwing to 
make it work (as long as you patch the `default` TLS options, take care 
to keep all those protocols contained; alternative path a per-router tls 
config instead to ONLY have postgresql in that list):

     ## Dynamic configuration
     tls:
       options:
         default:
           alpnProtocols:
             - acme-tls/1
             - http/1.1
             - h2
             - postgresql

>> Regarding your question: I have tried "sslnegotiation=postgres" and
>> "ssqlnegotiation=direct" with the original official PostgreSQL Docker
>> Container found on Docker Hub.
> Let's clarify something here: there is nothing "official" about either
> that docker container or anything else you might find on DockerHub.
> The Postgres community does not produce any such packaging.  You'd
> have to discussion the inclusion of v17 libpq with whoever did build
> that container.  I know that Debian thinks it's a good idea to use
> latest libpq with older servers, and this builder might be following
> their lead.  (The timing would be about right, since v17.0 came out
> about the same time as 16.4.)  This example does show that there
> are pitfalls in that policy.

Thanks a lot for this really essential information! In fact, the authors 
of that official docker image (they really call it that way) call 
themselves "The PostgreSQL Docker Community". This is totally 
misleading, as one understands that to be "The Docker Community withing 
the PostgreSQL Community", which it (apparently) is not. Instead, it 
seems that it actually is "The PostgreSQL Community at Docker, Inc.", 
people totally unrelated to the "real" PostgreSQL Community!

Thanks a lot, Tom, for your kind help. You provided the best Christmas 
present this year! :-)

--------------6JeENwZOEcfSo3xQMvqxRWJ2
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 8bit

<!DOCTYPE html>
<html>
  <head>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <blockquote type="cite" cite="mid:1807243.1735155420@sss.pgh.pa.us">
      <pre wrap="" class="moz-quote-pre">Markus KARG <a class="moz-txt-link-rfc2396E" href="mailto:markus@headcrashing.eu">&lt;markus@headcrashing.eu&gt;</a> writes:
</pre>
      <blockquote type="cite">
        <pre wrap="" class="moz-quote-pre">Following this theory, sslnegotiation=postgres used with psql v17.x 
should solve the problem, as it falls back to the same mechanism 
supported in v16.3, correct?
</pre>
      </blockquote>
      <pre wrap="" class="moz-quote-pre">
No, sorry, it looks like we insert the ALPN extension into the SSL
request packet regardless of that.  Maybe there should have been
a way to suppress that, but v17 libpq doesn't provide one.</pre>
    </blockquote>
    <p>Thank you, Tom, you saved my day! I have explicitly added the
      name `postgresql` to the ALPN configuration on Traefik, and
      immediately psql v16.4+ (including psql v17) worked like a charm!</p>
    <p>As a reference for others, in `traefik-dynamic.yaml` add the
      follwing to make it work (as long as you patch the `default` TLS
      options, take care to keep all those protocols contained;
      alternative path a per-router tls config instead to ONLY have
      postgresql in that list):</p>
    <div
style="color: #cccccc;background-color: #1f1f1f;font-family: Consolas, 'Courier New', monospace;font-weight: normal;font-size: 14px;line-height: 19px;white-space: pre;"><div><span
    style="color: #ce9178;">    ## Dynamic configuration</span></div><div><span
    style="color: #ce9178;">    tls:</span></div><div><span
    style="color: #ce9178;">      options:</span></div><div><span
    style="color: #ce9178;">        default:</span></div><div><span
    style="color: #ce9178;">          alpnProtocols:</span></div><div><span
    style="color: #ce9178;">            - acme-tls/1</span></div><div><span
    style="color: #ce9178;">            - http/1.1</span></div><div><span
    style="color: #ce9178;">            - h2</span></div><div><span
    style="color: #ce9178;">            - postgresql</span></div></div>
    <p><span style="white-space: pre-wrap">
</span></p>
    <blockquote type="cite" cite="mid:1807243.1735155420@sss.pgh.pa.us">
      <blockquote type="cite">
        <pre wrap="" class="moz-quote-pre">Regarding your question: I have tried "sslnegotiation=postgres" and 
"ssqlnegotiation=direct" with the original official PostgreSQL Docker 
Container found on Docker Hub.
</pre>
      </blockquote>
      <pre wrap="" class="moz-quote-pre">
Let's clarify something here: there is nothing "official" about either
that docker container or anything else you might find on DockerHub.
The Postgres community does not produce any such packaging.  You'd
have to discussion the inclusion of v17 libpq with whoever did build
that container.  I know that Debian thinks it's a good idea to use
latest libpq with older servers, and this builder might be following
their lead.  (The timing would be about right, since v17.0 came out
about the same time as 16.4.)  This example does show that there
are pitfalls in that policy.
</pre>
    </blockquote>
    <p>Thanks a lot for this really essential information! In fact, the
      authors of that official docker image (they really call it that
      way) call themselves "The PostgreSQL Docker Community". This is
      totally misleading, as one understands that to be "The Docker
      Community withing the PostgreSQL Community", which it (apparently)
      is not. Instead, it seems that it actually is "The PostgreSQL
      Community at Docker, Inc.", people totally unrelated to the "real"
      PostgreSQL Community!</p>
    <p>Thanks a lot, Tom, for your kind help. You provided the best
      Christmas present this year! :-)<br>
    </p>
    <blockquote type="cite" cite="mid:1807243.1735155420@sss.pgh.pa.us">
      <pre wrap="" class="moz-quote-pre">
</pre>
    </blockquote>
  </body>
</html>

--------------6JeENwZOEcfSo3xQMvqxRWJ2--