Content-Type: multipart/alternative;
 boundary="------------QS8CgKj4gf5pjbjRW0WM2f2m"
Message-ID: <68ff85d7-9b41-40ec-bddf-0ca74fe09875@headcrashing.eu>
Date: Wed, 25 Dec 2024 18:05:29 +0100
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
To: pgsql-bugs@lists.postgresql.org
From: Markus KARG <markus@headcrashing.eu>
Subject: psql v16.3 successfully connects via TLSv1.3 proxy, but psql v16.4
 says "tlsv1 alert no application protocol"
Archived-At: 
 <https://www.postgresql.org/message-id/68ff85d7-9b41-40ec-bddf-0ca74fe09875%40headcrashing.eu>
Precedence: bulk

This is a multi-part message in MIME format.
--------------QS8CgKj4gf5pjbjRW0WM2f2m
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

Summary: The TLS behavior of psql changed between 16.3 and 16.4 as shown 
below. If this is a bug, I kindly ask to fix it. If this is intended 
behavior, I kindly as for a link with instructions how to work around 
the problem.


Server:

I am running the official PostgreSQL 17.2 Docker Container 
(https://hub.docker.com/layers/library/postgres/17.2/images/sha256-c063081175f45f4a3a5ac03c234e060e67618ebe75b49e2a7ffb79f8357bd1e6) 
proxied by a TLSv1.3 proxy (official Traefik 3.2.3 Docker Container 
https://hub.docker.com/layers/library/traefik/v3.2.3/images/sha256-06966a9ba1747ad724a490b8f27df1434c64e8eee5d681df03c4761c9653f62c). 
Traefik utilizes ACME with Let's Encrypt to produce the TLS certificate.

I have neither reconfigured TLS in any other way, nor have I manually 
provided TLS certificates to neither client nor server.


Client:

Using the official PostgresSQL Docker Container (16.3 vs 16.4+), I am 
asking psql to connect to my server. While psql 16.3 and earlier 
versions successfully connect via the TLS proxy to the PostgreSQL 
server, psql 16.4 and later versions fail doing so:

root@hetzner-2:~# docker run -it postgres:16.3 psql "host=headcrashing.eu port=5432 
dbname=postgres user=postgres password=... sslmode=require"
psql (16.3 (Debian 16.3-1.pgdg120+1), server 17.2 (Debian 17.2-1.pgdg120+1))
WARNING: psql major version 16, server major version 17.
          Some psql features might not work.
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_128_GCM_SHA256, compression: off)
Type"help" for help.

postgres=# \q
root@hetzner-2:~# docker run -it postgres:16.4 psql "host=headcrashing.eu port=5432 
dbname=postgres user=postgres password=... sslmode=require"
psql: error: connection to server at"headcrashing.eu" (49.13.53.107), port 5432 failed: SSL error: tlsv1 alert no application protocol


Public Test Environment

Feel free to connect to my personal PostgreSQL 17 instance running at 
|postgres.headcrashing.eu:5432| (TLS required).


With kind regards

-Markus

--------------QS8CgKj4gf5pjbjRW0WM2f2m
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: 7bit

<!DOCTYPE html>
<html>
  <head>

    <meta http-equiv="content-type" content="text/html; charset=UTF-8">
  </head>
  <body>
    <p>Summary: The TLS behavior of psql changed between 16.3 and 16.4
      as shown below. If this is a bug, I kindly ask to fix it. If this
      is intended behavior, I kindly as for a link with instructions how
      to work around the problem.</p>
    <p></p>
    <p><br>
    </p>
    <p>Server:</p>
    <p>I am running the official PostgreSQL 17.2 Docker Container
(<a class="moz-txt-link-freetext" href="https://hub.docker.com/layers/library/postgres/17.2/images/sha256-c063081175f45f4a3a5ac03c234e060e67618ebe75b49e2a7ffb79f8357bd1e6">https://hub.docker.com/layers/library/postgres/17.2/images/sha256-c063081175f45f4a3a5ac03c234e060e67618ebe75b49e2a7ffb79f8357bd1e6</a>)
      proxied by a TLSv1.3 proxy (official Traefik 3.2.3 Docker
      Container
<a class="moz-txt-link-freetext" href="https://hub.docker.com/layers/library/traefik/v3.2.3/images/sha256-06966a9ba1747ad724a490b8f27df1434c64e8eee5d681df03c4761c9653f62c">https://hub.docker.com/layers/library/traefik/v3.2.3/images/sha256-06966a9ba1747ad724a490b8f27df1434c64e8eee5d681df03c4761c9653f62c</a>).
      Traefik utilizes ACME with Let's Encrypt to produce the TLS
      certificate.</p>
    <p>I have neither reconfigured TLS in any other way, nor have I
      manually provided TLS certificates to neither client nor server.<br>
    </p>
    <p><br>
    </p>
    <p>Client:</p>
    <p>Using the official PostgresSQL Docker Container (16.3 vs 16.4+),
      I am asking psql to connect to my server. While psql 16.3 and
      earlier versions successfully connect via the TLS proxy to the
      PostgreSQL server, psql 16.4 and later versions fail doing so:</p>
    <pre class="notranslate">root@hetzner-2:<span class="pl-k">~</span><span
    class="pl-c"><span class="pl-c">#</span> docker run -it postgres:16.3 psql "host=headcrashing.eu port=5432 dbname=postgres user=postgres password=... sslmode=require"</span>
psql (16.3 (Debian 16.3-1.pgdg120+1), server 17.2 (Debian 17.2-1.pgdg120+1))
WARNING: psql major version 16, server major version 17.
         Some psql features might not work.
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_128_GCM_SHA256, compression: off)
Type <span class="pl-s"><span class="pl-pds">"</span>help<span
    class="pl-pds">"</span></span> <span class="pl-k">for</span> help.

postgres=<span class="pl-c"><span class="pl-c">#</span> \q</span>
root@hetzner-2:<span class="pl-k">~</span><span class="pl-c"><span
    class="pl-c">#</span> docker run -it postgres:16.4 psql "host=headcrashing.eu port=5432 dbname=postgres user=postgres password=... sslmode=require"</span>
psql: error: connection to server at <span class="pl-s"><span
    class="pl-pds">"</span>headcrashing.eu<span class="pl-pds">"</span></span> (49.13.53.107), port 5432 failed: SSL error: tlsv1 alert no application protocol
</pre>
    <br>
    <p>Public Test Environment</p>
    <p>Feel free to connect to my personal PostgreSQL 17 instance
      running at <code class="notranslate">postgres.headcrashing.eu:5432</code>
      (TLS required). <br>
    </p>
    <p><br>
    </p>
    <p>With kind regards</p>
    <p>-Markus<br>
    </p>
    <p></p>
  </body>
</html>

--------------QS8CgKj4gf5pjbjRW0WM2f2m--