From: Svensson Peter <peter.svensson@smhi.se>
To: Tom Lane <tgl@sss.pgh.pa.us>
To: Stephen Frost <sfrost@snowman.net>
Cc: Gustavsson Mikael <mikael.gustavsson@smhi.se>
Cc: Magnus Hagander <magnus@hagander.net>
Cc: Kyotaro Horiguchi <horikyota.ntt@gmail.com>
Cc: pgsql-general@postgresql.org <pgsql-general@postgresql.org>
Subject: SV: Problem with ssl and psql in Postgresql 13
Date: Tue, 29 Dec 2020 15:05:31 +0000
Message-ID: <52f3b4e6e3e8414cbc0b0c8343058a9f@smhi.se> (raw)
In-Reply-To: <1333636.1609020377@sss.pgh.pa.us>
References: <89909.1608222331@sss.pgh.pa.us>
<61e2a65bbc2f47d297a6f3cdac2cc6cc@smhi.se>
<d3ab9042bce34aae85d323d69e3ee430@smhi.se>
<169637.1608321770@sss.pgh.pa.us>
<c347c62b507743ceac0aaebd0ccff533@smhi.se>
<de4dc5a4f22d43a28300bccb70d99db6@smhi.se>
<723586.1608740901@sss.pgh.pa.us>
<737386.1608757126@sss.pgh.pa.us>
<20201223211448.GR27507@tamriel.snowman.net>
<738715.1608758847@sss.pgh.pa.us>
<20201223214534.GS27507@tamriel.snowman.net>
<740093.1608760567@sss.pgh.pa.us>
<742641.1608762845@sss.pgh.pa.us>
<1308863.1609016410@sss.pgh.pa.us>
<1333636.1609020377@sss.pgh.pa.us>
Hi,
Yes, libpq patch solved our problem.
Before patch:
psql -h myserver -U myuser -d postgres
psql: error: FATAL: no pg_hba.conf entry for host "ip", user "myuser", database "postgres", SSL off
FATAL: no pg_hba.conf entry for host "ip", user "myuser", database "postgres", SSL off
With patched libpq:
$ psql -h myserver -U myuser -d postgres
Password for user myuser:
psql (13.1)
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bits: 256, compression: off)
Type "help" for help.
postgres=>
Best regards,
Peter Svensson, SMHI
________________________________
Från: Tom Lane <tgl@sss.pgh.pa.us>
Skickat: den 26 december 2020 23:06
Till: Stephen Frost
Kopia: Gustavsson Mikael; Magnus Hagander; Kyotaro Horiguchi; pgsql-general@postgresql.org; Svensson Peter
Ämne: Re: Problem with ssl and psql in Postgresql 13
Here's a draft patch for the libpq-side issues. The core of the
fix is to get rid of pqsecure_open_gss's clearing of allow_ssl_try,
and instead check whether GSS encryption is already enabled before
we try to enable SSL. While I was at it I also fixed the places
where we drop an attempted GSS connection: they should set
need_new_connection = true rather than incompletely doing it for
themselves. Notably that coding misses resetting auth_req_received
and password_needed; the consequences of that are minor but not zero.
There are things to fix on the server side, and the documentation
needs work, but this should be enough to solve Mikael's problem
if he's in a position to apply the patch locally.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-general@postgresql.org
Cc: peter.svensson@smhi.se, tgl@sss.pgh.pa.us, sfrost@snowman.net, mikael.gustavsson@smhi.se, magnus@hagander.net, horikyota.ntt@gmail.com
Subject: Re: SV: Problem with ssl and psql in Postgresql 13
In-Reply-To: <52f3b4e6e3e8414cbc0b0c8343058a9f@smhi.se>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox