Content-Type: text/plain;
	charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3774.500.171.1.1\))
Subject: Re: Question about UNIX socket connections and SSL
From: Daniel Gustafsson <daniel@yesql.se>
In-Reply-To: <1514893.1718219853@sss.pgh.pa.us>
Date: Wed, 12 Jun 2024 21:32:22 +0200
Cc: Casey & Gina <cg@osss.net>,
 pgsql-general@postgresql.org
Content-Transfer-Encoding: 7bit
Message-Id: <83B23251-97B6-453B-A63F-0B2A234E69AA@yesql.se>
References: <5EDB1F7F-569B-48B2-8DCD-44EE17D41F1A@osss.net>
 <1514893.1718219853@sss.pgh.pa.us>
To: Tom Lane <tgl@sss.pgh.pa.us>
Archived-At: <https://www.postgresql.org/message-id/83B23251-97B6-453B-A63F-0B2A234E69AA%40yesql.se>
Precedence: bulk

> On 12 Jun 2024, at 21:17, Tom Lane <tgl@sss.pgh.pa.us> wrote:
> 
> Casey & Gina <cg@osss.net> writes:
>> So why can't I use SSL when connecting from a client to a UNIX socket?
> 
> (1) It'd add overhead without adding any security.  Data going through
> a UNIX socket will only pass through the local kernel, and if that's
> compromised then it's game over anyway.
> 
> (2) I'm less sure about this part, but I seem to recall that openssl
> doesn't actually work if given a UNIX socket.

That indeed used to be the case, at least until 1.0.2 and possibly 1.1.1, but
AF_UNIX is supported in 3+ IIRC. That being said, I agree with your (1).

--
Daniel Gustafsson