From: Tom Lane <tgl@sss.pgh.pa.us>
To: Stephen Frost <sfrost@snowman.net>
Cc: Gustavsson Mikael <mikael.gustavsson@smhi.se>
Cc: Magnus Hagander <magnus@hagander.net>
Cc: Kyotaro Horiguchi <horikyota.ntt@gmail.com>
Cc: pgsql-general@postgresql.org <pgsql-general@postgresql.org>
Cc: Svensson Peter <peter.svensson@smhi.se>
Subject: Re: Problem with ssl and psql in Postgresql 13
Date: Wed, 23 Dec 2020 16:27:27 -0500
Message-ID: <738715.1608758847@sss.pgh.pa.us> (raw)
In-Reply-To: <20201223211448.GR27507@tamriel.snowman.net>
References: <CABUevEz_eHh=R6C_C7GChF8w_aG4pMPDAvjJFa92cspAb3SSkg@mail.gmail.com>
<698125e1105644adaa27578bb37b18f6@smhi.se>
<89909.1608222331@sss.pgh.pa.us>
<61e2a65bbc2f47d297a6f3cdac2cc6cc@smhi.se>
<d3ab9042bce34aae85d323d69e3ee430@smhi.se>
<169637.1608321770@sss.pgh.pa.us>
<c347c62b507743ceac0aaebd0ccff533@smhi.se>
<de4dc5a4f22d43a28300bccb70d99db6@smhi.se>
<723586.1608740901@sss.pgh.pa.us>
<737386.1608757126@sss.pgh.pa.us>
<20201223211448.GR27507@tamriel.snowman.net>
Stephen Frost <sfrost@snowman.net> writes:
> * Tom Lane (tgl@sss.pgh.pa.us) wrote:
>> However: it is true (and undocumented, so we have at least a docs bug
>> to fix) that v12-and-later libpq will try for GSS encryption first,
>> and if it succeeds then it will not consider using SSL, regardless of
>> sslmode. So about 95% of your report could be explained by assuming
>> that you have a working Kerberos environment and the newer libpq is
>> preferring GSS encryption over SSL. There is just one thing this
>> theory is failing to explain: instead of "SSL connection", psql
>> should have printed "GSSAPI-encrypted connection" in your test
>> shown in <d3ab9042bce34aae85d323d69e3ee430@smhi.se>. It didn't,
>> so this can't be the true explanation. I think what must be
>> happening is that libpq is trying for GSS (hence you have at least
>> a credentials cache somewhere), failing to establish it, and then
>> for some reason advancing to the startup-packet step without
>> trying for SSL. But I can't see how to get the state machine to
>> do that.
> Though we also say under sslmode / prefer (default) -
> first try an SSL connection; if that fails, try a non-SSL connection
> Obviously they can't both be 'first', so it would probably make sense to
> update the documentation, though exactly how I'm not sure.
Yeah; the problem is that the sslmode docs don't mention that GSS comes
first. I was thinking of adding verbiage along the lines of "Note that
if GSS encryption is possible, that will be used in preference to SSL,
regardless of the value of sslmode".
In the meantime, I did spot a code path that would explain the symptoms:
pqsecure_open_gss() clears allow_ssl_try sooner than it oughta. If
gss_wrap_size_limit() failed for some reason, we'd abandon the GSS
connection and try another one, and we would *not* try to SSL-ify
the new one. While that's clearly a bug, I'm dubious that it explains
this report, because it hardly seems likely that gss_wrap_size_limit()
would fail when we've already successfully negotiated an encrypted
connection. Can you think of a plausible reason for that to happen?
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-general@postgresql.org
Cc: tgl@sss.pgh.pa.us, sfrost@snowman.net, mikael.gustavsson@smhi.se, magnus@hagander.net, horikyota.ntt@gmail.com, peter.svensson@smhi.se
Subject: Re: Problem with ssl and psql in Postgresql 13
In-Reply-To: <738715.1608758847@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox