Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kuGZG-0002wq-4b for pgsql-general@arkaria.postgresql.org; Tue, 29 Dec 2020 15:05:47 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1kuGZD-0003Fb-MS for pgsql-general@arkaria.postgresql.org; Tue, 29 Dec 2020 15:05:43 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kuGZD-0003FT-AZ for pgsql-general@lists.postgresql.org; Tue, 29 Dec 2020 15:05:43 +0000 Received: from smtpout.smhi.se ([91.192.30.29] helo=smtpout1.smhi.se) by makus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1kuGZ5-00076S-Fw for pgsql-general@postgresql.org; Tue, 29 Dec 2020 15:05:41 +0000 Received: from winserv744.ad.smhi.se (winserv744.ad.smhi.se [172.16.6.35]) by smtpout1.smhi.se (Postfix) with ESMTPS id CE53E1095089; Tue, 29 Dec 2020 15:05:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smhi.se; s=20180112; t=1609254331; bh=eNa8zDHDPr+oPvzuUyVefrJzhHwsN/mBkgjl9LtPF9A=; h=From:To:CC:Subject:Date:References:In-Reply-To:From; b=aOMdOftajhpY+BETAntovU8I1B4uQStrI1gLYt6xnZWi7S72K7Cn8aKZjtic4VIRQ 4aDtYSrj1bHvE7WULRsquSEpa9gBF5mlAAma7yOkgc2EesBGuA3II6UQLAoovGfORV wJY/8XchvHx9T+Bo+Euy3moSAaLA21EYr/2UUv9U= Received: from winserv743.ad.smhi.se (172.16.6.38) by winserv744.ad.smhi.se (172.16.6.35) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2106.2; Tue, 29 Dec 2020 16:05:31 +0100 Received: from winserv743.ad.smhi.se ([fe80::5131:d3be:e529:5c0f]) by winserv743.ad.smhi.se ([fe80::5131:d3be:e529:5c0f%3]) with mapi id 15.01.2106.006; Tue, 29 Dec 2020 16:05:31 +0100 From: Svensson Peter To: Tom Lane , Stephen Frost CC: Gustavsson Mikael , Magnus Hagander , Kyotaro Horiguchi , "pgsql-general@postgresql.org" Subject: SV: Problem with ssl and psql in Postgresql 13 Thread-Topic: Problem with ssl and psql in Postgresql 13 Thread-Index: AQHW2XCv/n2P1PSSEkSn6AB8zluswqoFIS2AgAAFEACAAALzgIAACpuAgAScwQCAABJ5gIAEUDpm Date: Tue, 29 Dec 2020 15:05:31 +0000 Message-ID: <52f3b4e6e3e8414cbc0b0c8343058a9f@smhi.se> References: <89909.1608222331@sss.pgh.pa.us> <61e2a65bbc2f47d297a6f3cdac2cc6cc@smhi.se> <169637.1608321770@sss.pgh.pa.us> <723586.1608740901@sss.pgh.pa.us> <737386.1608757126@sss.pgh.pa.us> <20201223211448.GR27507@tamriel.snowman.net> <738715.1608758847@sss.pgh.pa.us> <20201223214534.GS27507@tamriel.snowman.net> <740093.1608760567@sss.pgh.pa.us> <742641.1608762845@sss.pgh.pa.us> <1308863.1609016410@sss.pgh.pa.us>,<1333636.1609020377@sss.pgh.pa.us> In-Reply-To: <1333636.1609020377@sss.pgh.pa.us> Accept-Language: sv-SE, en-US Content-Language: sv-SE X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.65.0.33] Content-Type: multipart/alternative; boundary="_000_52f3b4e6e3e8414cbc0b0c8343058a9fsmhise_" MIME-Version: 1.0 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --_000_52f3b4e6e3e8414cbc0b0c8343058a9fsmhise_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi, Yes, libpq patch solved our problem. Before patch: psql -h myserver -U myuser -d postgres psql: error: FATAL: no pg_hba.conf entry for host "ip", user "myuser", dat= abase "postgres", SSL off FATAL: no pg_hba.conf entry for host "ip", user "myuser", database "postgr= es", SSL off With patched libpq: $ psql -h myserver -U myuser -d postgres Password for user myuser: psql (13.1) SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bits: 25= 6, compression: off) Type "help" for help. postgres=3D> Best regards, Peter Svensson, SMHI ________________________________ Fr=E5n: Tom Lane Skickat: den 26 december 2020 23:06 Till: Stephen Frost Kopia: Gustavsson Mikael; Magnus Hagander; Kyotaro Horiguchi; pgsql-general= @postgresql.org; Svensson Peter =C4mne: Re: Problem with ssl and psql in Postgresql 13 Here's a draft patch for the libpq-side issues. The core of the fix is to get rid of pqsecure_open_gss's clearing of allow_ssl_try, and instead check whether GSS encryption is already enabled before we try to enable SSL. While I was at it I also fixed the places where we drop an attempted GSS connection: they should set need_new_connection =3D true rather than incompletely doing it for themselves. Notably that coding misses resetting auth_req_received and password_needed; the consequences of that are minor but not zero. There are things to fix on the server side, and the documentation needs work, but this should be enough to solve Mikael's problem if he's in a position to apply the patch locally. regards, tom lane --_000_52f3b4e6e3e8414cbc0b0c8343058a9fsmhise_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Hi,

Yes, libpq patch solved our problem.

Before patch:
psql -h myserver -U myuser -d postgres
psql: error: FATAL:  no pg_hba.conf entry for host "ip", use= r "myuser", database "postgres", SSL off
FATAL:  no pg_hba.conf entry for host "ip", user "myuse= r", database "postgres", SSL off


With patched libpq:

$ psql -h myserver -U myuser -d postgres
Password for user myuser:
psql (13.1)
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bits: 25= 6, compression: off)
Type "help" for help.

postgres=3D>


Best regards,

Peter Svensson, SMHI


Fr=E5n: Tom Lane <tgl@= sss.pgh.pa.us>
Skickat: den 26 december 2020 23:06
Till: Stephen Frost
Kopia: Gustavsson Mikael; Magnus Hagander; Kyotaro Horiguchi; pgsql-= general@postgresql.org; Svensson Peter
=C4mne: Re: Problem with ssl and psql in Postgresql 13
 
Here's a draft patch for the libpq-side issues.&nb= sp; The core of the
fix is to get rid of pqsecure_open_gss's clearing of allow_ssl_try,
and instead check whether GSS encryption is already enabled before
we try to enable SSL.  While I was at it I also fixed the places
where we drop an attempted GSS connection: they should set
need_new_connection =3D true rather than incompletely doing it for
themselves.  Notably that coding misses resetting auth_req_received and password_needed; the consequences of that are minor but not zero.

There are things to fix on the server side, and the documentation
needs work, but this should be enough to solve Mikael's problem
if he's in a position to apply the patch locally.

            &nb= sp;           regards, to= m lane

--_000_52f3b4e6e3e8414cbc0b0c8343058a9fsmhise_--