From: Tom Lane <tgl@sss.pgh.pa.us>
To: Kyotaro Horiguchi <horikyota.ntt@gmail.com>
cc: sfrost@snowman.net, mikael.gustavsson@smhi.se, magnus@hagander.net,
        pgsql-general@postgresql.org, peter.svensson@smhi.se
Subject: Re: Problem with ssl and psql in Postgresql 13
In-reply-to: <20201224.120520.788085853846287470.horikyota.ntt@gmail.com>
References: <20201223214534.GS27507@tamriel.snowman.net>
 <740093.1608760567@sss.pgh.pa.us> <742641.1608762845@sss.pgh.pa.us>
 <20201224.120520.788085853846287470.horikyota.ntt@gmail.com>
Comments: In-reply-to Kyotaro Horiguchi <horikyota.ntt@gmail.com>
	message dated "Thu, 24 Dec 2020 12:05:20 +0900"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <755330.1608780141.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Wed, 23 Dec 2020 22:22:21 -0500
Message-ID: <755331.1608780141@sss.pgh.pa.us>
Precedence: bulk

Kyotaro Horiguchi <horikyota.ntt@gmail.com> writes:
> At Wed, 23 Dec 2020 17:34:05 -0500, Tom Lane <tgl@sss.pgh.pa.us> wrote i=
n =

>> However, in the tests Mikael ran after backing that pg_hba.conf entry
>> off to just "host", pg_hba wouldn't have caused an authentication-stage
>> failure, so it's not so clear why we'd have looped back at this step.

> In the hostssl case, there are two errors emitted on the server side:
> [24494] FATAL:  no pg_hba.conf entry for host "192.168.56.101", user "ho=
riguti", database "postgres", SSL off
> [24495] FATAL:  no pg_hba.conf entry for host "192.168.56.101", user "ho=
riguti", database "postgres", SSL off
> However, the first line is bogus. It should be like the following.
> FATAL:  no pg_hba.conf entry for host "192.168.56.101", user "horiguti",=
 database "postgres", GSSENC on
> FATAL:  no pg_hba.conf entry for host "192.168.56.101", user "horiguti",=
 database "postgres", SSL off
> The attached the first patch does that.

+1, it seems like a clear oversight that the GSSENC patches didn't adjust
these messages.  The reason SSL state is mentioned is that it's relevant
to which pg_hba entry gets chosen; and once we invented "hostgssenc"
entries, GSSENC state is also relevant.  I'm not sure though if we want
to spell it like "GSSENC on", or "GSS encryption on", or something else.
Stephen or other onlookers, any comments?

>> We'd need to explain the later cases to have a full theory.  It's
>> plenty plausible that something else caused an auth-stage failure,
>> but if so, why would the second GSS-free try work?

> Does my expample above works?

I don't see how it explains Mikael's later tests, but maybe I'm missing
something.

			regards, tom lane