Feedback-ID: i0fe9450f:Fastmail
Date: Fri, 29 Jul 2022 14:44:47 +0900
From: Michael Paquier <michael@paquier.xyz>
To: * Neustradamus * <neustradamus@hotmail.com>
Cc: "pgsql-bugs@lists.postgresql.org" <pgsql-bugs@lists.postgresql.org>,
	Jacob Champion <jchampion@timescale.com>
Subject: Re: RFC 9266: Channel Bindings for TLS 1.3 support
Message-ID: <YuNzz767HkB79sys@paquier.xyz>
References: 
 <PA4PR01MB992243D329F60932DE56BAAFCB969@PA4PR01MB9922.eurprd01.prod.exchangelabs.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="BwcyBwH5G0F9acWp"
Content-Disposition: inline
In-Reply-To: 
 <PA4PR01MB992243D329F60932DE56BAAFCB969@PA4PR01MB9922.eurprd01.prod.exchangelabs.com>
Archived-At: 
 <https://www.postgresql.org/message-id/YuNzz767HkB79sys%40paquier.xyz>
Precedence: bulk


--BwcyBwH5G0F9acWp
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Hi,

On Thu, Jul 28, 2022 at 08:33:50PM +0000, * Neustradamus * wrote:
> Can you add the support of RFC 9266: Channel Bindings for TLS 1.3?
> - https://datatracker.ietf.org/doc/html/rfc9266=20
>=20
> Little details, to know easily:
> - tls-unique for TLS =3D< 1.2

tls-unique is not planned, as we have already tls-server-end-point for
TLS1.2 and Postgres requires a certificate, anyway.

> - tls-exporter for TLS =3D 1.3=20
>=20
> It is linked to:
> - https://github.com/postgres/postgres/search?q=3Dtls-unique

So, tls-exporter has been made an official thing, finally.  I was
wondering when this was going to happen.  Jacob Champion has given me
a patch to support that, based on OpenSSL's SSL_export_keying_material()
to do the job.  The base integration is not complicated, but I still
need to think a bit more about it when it comes to the min/max TLS
protocols we allow in libpq, for example, and polish the whole with
tests.  We don't force any failures depending on the other connection
parameters for tls-server-end-point, so I suspect that we should be
fine with keeping things at their simplest.

I should be able to get something sent to the mailing lists for the
commit fest of September, so as we could have this feature in v16~.
--
Michael

--BwcyBwH5G0F9acWp
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAmLjc88ACgkQnvQgOdby
QH17sg//a7Ix+0nRxcRRxTnAvF+Fx/glS/CrMzeuU/sJ0ZRoWoJZhr60NdsiS6wH
uJXTSjEmgqHp4uzdnoCjNFY0zBHFN82AqOAjVrNR1hTZdQera/QvEsWMt1Uypt6y
SgvJsWmM5/MOQIlLjMj9NUraTg1CI2oGk5G+wTFLe0i49ZTYkwRVU8Zc/jOWqNwi
sgcWCEf4XxJUtt0iBocInRxIBDWOajbICCizHn8hddV78qP49q0/tc2OQX6/zW8j
oK2N3fuCviv8SNlfXSl3mwuTPO0roC0qotAIRSrOSm6Ha0H/U1nSFErzFmZnq8we
sqjqTfNQGpjjltl8b7M+J3j3B9xLMIPDkpGk9jYVbJawfPfUco4vZ3r0HC86Qp1R
0wv6wH8RG7CwuDr9xnWU4bfhM3YVRAPulbtW3vTNitzrEa1QNBJh93K7C5smwU/w
xisyUPjmDYeKbX5QE2VQsRRpQvLZo+svIt3blfk2rb6q/phQaC5mYRT8ZF0CNLn2
8GuDKYqbc1AQj2yfG5EZowF5lFW4OjbHqbD43pF0wVO3wxeeCgqUo2Kg9hwJnYoY
lAFvR0q1bf7GlRPfteGgev/VBrSqFA1Qnx95fDj8PSIwihVbzwNLzyjieqjDsE9h
Dy6h5vbDeHOqfRpx5RLYrFGQFJX3xXahoAi0XC5fA2nXA2IP4QY=
=qEbR
-----END PGP SIGNATURE-----

--BwcyBwH5G0F9acWp--