From: Heikki Linnakangas <heikki.linnakangas@iki.fi>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Remove option to fall back from direct to postgres SSL negotiati
Date: Thu, 16 May 2024 14:22:04 +0000
Message-ID: <E1s7bzh-000V8z-18@gemulon.postgresql.org> (raw)
Remove option to fall back from direct to postgres SSL negotiation
There were three problems with the sslnegotiation options:
1. The sslmode=prefer and sslnegotiation=requiredirect combination was
somewhat dangerous, as you might unintentionally fall back to
plaintext authentication when connecting to a pre-v17 server.
2. There was an asymmetry between 'postgres' and 'direct'
options. 'postgres' meant "try only traditional negotiation", while
'direct' meant "try direct first, and fall back to traditional
negotiation if it fails". That was apparent only if you knew that the
'requiredirect' mode also exists.
3. The "require" word in 'requiredirect' suggests that it's somehow
more strict or more secure, similar to sslmode. However, I don't
consider direct SSL connections to be a security feature.
To address these problems:
- Only allow sslnegotiation='direct' if sslmode='require' or
stronger. And for the record, Jacob and Robert felt that we should do
that (or have sslnegotiation='direct' imply sslmode='require') anyway,
regardless of the first issue.
- Remove the 'direct' mode that falls back to traditional negotiation,
and rename what was called 'requiredirect' to 'direct' instead. In
other words, there is no "try both methods" option anymore, 'postgres'
now means the traditional negotiation and 'direct' means a direct SSL
connection.
Reviewed-by: Jelte Fennema-Nio, Robert Haas, Jacob Champion
Discussion: https://www.postgresql.org/message-id/d3b1608a-a1b6-4eda-9ec5-ddb3e4375808%40iki.fi
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/fb5718f35ff667104ab0b9dace3a238113666237
Modified Files
--------------
doc/src/sgml/libpq.sgml | 49 ++--
src/interfaces/libpq/fe-connect.c | 142 ++++++------
src/interfaces/libpq/fe-secure-openssl.c | 2 +-
src/interfaces/libpq/libpq-int.h | 6 +-
src/interfaces/libpq/t/005_negotiate_encryption.pl | 254 +++++++++------------
5 files changed, 200 insertions(+), 253 deletions(-)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: heikki.linnakangas@iki.fi, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Remove option to fall back from direct to postgres SSL negotiati
In-Reply-To: <E1s7bzh-000V8z-18@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox