From: Heikki Linnakangas <heikki.linnakangas@iki.fi>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Send ALPN in TLS handshake, require it in direct SSL connections
Date: Mon, 08 Apr 2024 01:25:40 +0000
Message-ID: <E1rtdlT-001387-J3@gemulon.postgresql.org> (raw)
Send ALPN in TLS handshake, require it in direct SSL connections
libpq now always tries to send ALPN. With the traditional negotiated
SSL connections, the server accepts the ALPN, and refuses the
connection if it's not what we expect, but connecting without ALPN is
still OK. With the new direct SSL connections, ALPN is mandatory.
NOTE: This uses "TBD-pgsql" as the protocol ID. We must register a
proper one with IANA before the release!
Author: Greg Stark, Heikki Linnakangas
Reviewed-by: Matthias van de Meent, Jacob Champion
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/91044ae4baeac2e501e34164a69bd5d9c4976d21
Modified Files
--------------
doc/src/sgml/libpq.sgml | 12 +++++
src/backend/libpq/be-secure-openssl.c | 77 ++++++++++++++++++++++++++++++++
src/backend/tcop/backend_startup.c | 8 ++++
src/bin/psql/command.c | 7 ++-
src/include/libpq/libpq-be.h | 1 +
src/include/libpq/pqcomm.h | 19 ++++++++
src/interfaces/libpq/fe-secure-openssl.c | 35 +++++++++++++++
7 files changed, 157 insertions(+), 2 deletions(-)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: heikki.linnakangas@iki.fi, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Send ALPN in TLS handshake, require it in direct SSL connections
In-Reply-To: <E1rtdlT-001387-J3@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox