From: Heikki Linnakangas <hlinnaka@iki.fi>
To: Andres Freund <andres@anarazel.de>
To: Heikki Linnakangas <heikki.linnakangas@iki.fi>
Cc: pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Send ALPN in TLS handshake, require it in direct SSL connections
Date: Mon, 8 Apr 2024 05:06:38 +0300
Message-ID: <0f022354-c9cc-47c2-ace3-89d2101895f4@iki.fi> (raw)
In-Reply-To: <20240408015055.xsuahullywpfwyvu@awork3.anarazel.de>
References: <E1rtdlT-001387-J3@gemulon.postgresql.org>
<20240408015055.xsuahullywpfwyvu@awork3.anarazel.de>
On 08/04/2024 04:50, Andres Freund wrote:
> On 2024-04-08 01:25:40 +0000, Heikki Linnakangas wrote:
>> Send ALPN in TLS handshake, require it in direct SSL connections
>>
>> libpq now always tries to send ALPN. With the traditional negotiated
>> SSL connections, the server accepts the ALPN, and refuses the
>> connection if it's not what we expect, but connecting without ALPN is
>> still OK. With the new direct SSL connections, ALPN is mandatory.
>>
>> NOTE: This uses "TBD-pgsql" as the protocol ID. We must register a
>> proper one with IANA before the release!
>>
>> Author: Greg Stark, Heikki Linnakangas
>> Reviewed-by: Matthias van de Meent, Jacob Champion
>
> My compiler complains:
>
> [396/992 42 39%] Compiling C object src/backend/postgres_lib.a.p/libpq_be-secure-openssl.c.o
> ../../../../../home/andres/src/postgresql/src/backend/libpq/be-secure-openssl.c: In function 'alpn_cb':
> ../../../../../home/andres/src/postgresql/src/backend/libpq/be-secure-openssl.c:1327:69: warning: ordered comparison of pointer with integer zero [-Wextra]
> 1327 | if (*out == NULL || *outlen > sizeof(alpn_protos) || outlen <= 0)
> | ^~
> [991/992 1 99%] Linking target src/bin/pg_dump/pg_dump
>
> And I think it may show why the warning is a good idea - I assume
> "*outlen <= 0" was intended?
Yes. Fixed, thanks!
--
Heikki Linnakangas
Neon (https://neon.tech)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: hlinnaka@iki.fi, andres@anarazel.de, heikki.linnakangas@iki.fi, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Send ALPN in TLS handshake, require it in direct SSL connections
In-Reply-To: <0f022354-c9cc-47c2-ace3-89d2101895f4@iki.fi>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox