pg.ddx.io pgsql-general@postgresql.org mailing list archive
help / color / mirror / Atom feedSV: SV: SV: SV: Problem with ssl and psql in Postgresql 13
4+ messages / 2 participants
[nested] [flat]
* SV: SV: SV: SV: Problem with ssl and psql in Postgresql 13
@ 2020-12-22 08:07 Gustavsson Mikael <mikael.gustavsson@smhi.se>
2020-12-23 09:50 ` SV: SV: SV: SV: Problem with ssl and psql in Postgresql 13 Gustavsson Mikael <mikael.gustavsson@smhi.se>
0 siblings, 1 reply; 4+ messages in thread
From: Gustavsson Mikael @ 2020-12-22 08:07 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Magnus Hagander <magnus@hagander.net>; Kyotaro Horiguchi <horikyota.ntt@gmail.com>; pgsql-general; Svensson Peter <peter.svensson@smhi.se>
Hi,
Yes it´s odd. I think we begin with download/reinstall and take it from there.
The server name is just letters and numbers so I think we can rule that out.
Christmas is coming up fast as usual so I think I will pick this up in January.
Thanks for all the help and Happy Christmas! Or God Jul as we say in Sweden.
KR
Mikael Gustavsson, SMHI
________________________________
Från: Tom Lane <tgl@sss.pgh.pa.us>
Skickat: den 18 december 2020 21:02:50
Till: Gustavsson Mikael
Kopia: Magnus Hagander; Kyotaro Horiguchi; pgsql-general@postgresql.org; Svensson Peter
Ämne: Re: SV: SV: SV: Problem with ssl and psql in Postgresql 13
Gustavsson Mikael <mikael.gustavsson@smhi.se> writes:
> pgsql-13 with require:
> $ /usr/pgsql-13/bin/psql "dbname=postgres user=kalle host=server sslmode=require"
> Password for user kalle:
> psql (13.1)
> Type "help" for help.
That is just bizarre. libpq should not ignore the sslmode=require option
like that, unless it thinks it's making a Unix-socket connection, which
it should not think given the host specification. (There's not a slash
in your server's real name, is there? But if there was, v11 should
misbehave too.)
It seems like there must be some environment setting, or maybe a service
file, changing the behavior from what it should be on its face. But
that theory has big flaws too: an explicit sslmode=require setting should
not be overridable from environment, and even if it was, why wouldn't v11
act the same?
The only other conclusion I can think of is that your copy of libpq.so
is broken. Maybe you should try redownloading/reinstalling v13.
regards, tom lane
^ permalink raw reply [nested|flat] 4+ messages in thread
* SV: SV: SV: SV: Problem with ssl and psql in Postgresql 13
2020-12-22 08:07 SV: SV: SV: SV: Problem with ssl and psql in Postgresql 13 Gustavsson Mikael <mikael.gustavsson@smhi.se>
@ 2020-12-23 09:50 ` Gustavsson Mikael <mikael.gustavsson@smhi.se>
2020-12-23 16:28 ` Re: SV: SV: SV: SV: Problem with ssl and psql in Postgresql 13 Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 4+ messages in thread
From: Gustavsson Mikael @ 2020-12-23 09:50 UTC (permalink / raw)
To: Tom Lane <tgl@sss.pgh.pa.us>; +Cc: Magnus Hagander <magnus@hagander.net>; Kyotaro Horiguchi <horikyota.ntt@gmail.com>; pgsql-general; Svensson Peter <peter.svensson@smhi.se>
Hi,
I did a final test before logging out for Christmas because i found a thread in hackers discussing some issue with GSS and SSL.
So if i set gssencmode=disable on my pgsql-13 to postgres 13 server connection i get an SSL connection.
Is this expected behaviour?
$ /usr/pgsql-13/bin/psql "dbname=postgres user=kalle host=server gssencmode=disable"
Password for user kalle:
psql (13.1)
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bits: 256, compression: off)
Type "help" for help.
postgres=>
KR, Mikael Gustavsson, SMHI
________________________________
Från: externaly-forwarded@smhi.se <externaly-forwarded@smhi.se> för Gustavsson Mikael <mikael.gustavsson@smhi.se>
Skickat: den 22 december 2020 09:07:17
Till: Tom Lane
Kopia: Magnus Hagander; Kyotaro Horiguchi; pgsql-general@postgresql.org; Svensson Peter
Ämne: SV: SV: SV: SV: Problem with ssl and psql in Postgresql 13
Hi,
Yes it´s odd. I think we begin with download/reinstall and take it from there.
The server name is just letters and numbers so I think we can rule that out.
Christmas is coming up fast as usual so I think I will pick this up in January.
Thanks for all the help and Happy Christmas! Or God Jul as we say in Sweden.
KR
Mikael Gustavsson, SMHI
________________________________
Från: Tom Lane <tgl@sss.pgh.pa.us>
Skickat: den 18 december 2020 21:02:50
Till: Gustavsson Mikael
Kopia: Magnus Hagander; Kyotaro Horiguchi; pgsql-general@postgresql.org; Svensson Peter
Ämne: Re: SV: SV: SV: Problem with ssl and psql in Postgresql 13
Gustavsson Mikael <mikael.gustavsson@smhi.se> writes:
> pgsql-13 with require:
> $ /usr/pgsql-13/bin/psql "dbname=postgres user=kalle host=server sslmode=require"
> Password for user kalle:
> psql (13.1)
> Type "help" for help.
That is just bizarre. libpq should not ignore the sslmode=require option
like that, unless it thinks it's making a Unix-socket connection, which
it should not think given the host specification. (There's not a slash
in your server's real name, is there? But if there was, v11 should
misbehave too.)
It seems like there must be some environment setting, or maybe a service
file, changing the behavior from what it should be on its face. But
that theory has big flaws too: an explicit sslmode=require setting should
not be overridable from environment, and even if it was, why wouldn't v11
act the same?
The only other conclusion I can think of is that your copy of libpq.so
is broken. Maybe you should try redownloading/reinstalling v13.
regards, tom lane
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: SV: SV: SV: SV: Problem with ssl and psql in Postgresql 13
2020-12-22 08:07 SV: SV: SV: SV: Problem with ssl and psql in Postgresql 13 Gustavsson Mikael <mikael.gustavsson@smhi.se>
2020-12-23 09:50 ` SV: SV: SV: SV: Problem with ssl and psql in Postgresql 13 Gustavsson Mikael <mikael.gustavsson@smhi.se>
@ 2020-12-23 16:28 ` Tom Lane <tgl@sss.pgh.pa.us>
2020-12-23 20:58 ` Re: SV: SV: SV: SV: Problem with ssl and psql in Postgresql 13 Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 1 reply; 4+ messages in thread
From: Tom Lane @ 2020-12-23 16:28 UTC (permalink / raw)
To: Gustavsson Mikael <mikael.gustavsson@smhi.se>; +Cc: Stephen Frost <sfrost@snowman.net>; Magnus Hagander <magnus@hagander.net>; Kyotaro Horiguchi <horikyota.ntt@gmail.com>; pgsql-general; Svensson Peter <peter.svensson@smhi.se>
Gustavsson Mikael <mikael.gustavsson@smhi.se> writes:
> I did a final test before logging out for Christmas because i found a thread in hackers discussing some issue with GSS and SSL.
> So if i set gssencmode=disable on my pgsql-13 to postgres 13 server connection i get an SSL connection.
Oooh ... that's the missing ingredient. Do you have a GSS credentials
cache on the client side, but no support on the server side?
It looks like, if there is a credentials cache and gssencmode isn't
explicitly disabled, we try GSS first. If the server refuses that:
if (gss_ok == 'N')
{
/* Server doesn't want GSSAPI; fall back if we can */
if (conn->gssencmode[0] == 'r')
{
appendPQExpBufferStr(&conn->errorMessage,
libpq_gettext("server doesn't support GSSAPI encryption, but it was required\n"));
goto error_return;
}
conn->try_gss = false;
conn->status = CONNECTION_MADE;
return PGRES_POLLING_WRITING;
}
that is, it decides the connection it has is good enough. This
is not OK if SSL should have been used.
regards, tom lane
^ permalink raw reply [nested|flat] 4+ messages in thread
* Re: SV: SV: SV: SV: Problem with ssl and psql in Postgresql 13
2020-12-22 08:07 SV: SV: SV: SV: Problem with ssl and psql in Postgresql 13 Gustavsson Mikael <mikael.gustavsson@smhi.se>
2020-12-23 09:50 ` SV: SV: SV: SV: Problem with ssl and psql in Postgresql 13 Gustavsson Mikael <mikael.gustavsson@smhi.se>
2020-12-23 16:28 ` Re: SV: SV: SV: SV: Problem with ssl and psql in Postgresql 13 Tom Lane <tgl@sss.pgh.pa.us>
@ 2020-12-23 20:58 ` Tom Lane <tgl@sss.pgh.pa.us>
0 siblings, 0 replies; 4+ messages in thread
From: Tom Lane @ 2020-12-23 20:58 UTC (permalink / raw)
To: Gustavsson Mikael <mikael.gustavsson@smhi.se>; +Cc: Stephen Frost <sfrost@snowman.net>; Magnus Hagander <magnus@hagander.net>; Kyotaro Horiguchi <horikyota.ntt@gmail.com>; pgsql-general; Svensson Peter <peter.svensson@smhi.se>
I wrote:
> Gustavsson Mikael <mikael.gustavsson@smhi.se> writes:
>> So if i set gssencmode=disable on my pgsql-13 to postgres 13 server connection i get an SSL connection.
> It looks like, if there is a credentials cache and gssencmode isn't
> explicitly disabled, we try GSS first. If the server refuses that:
> ...
> that is, it decides the connection it has is good enough. This
> is not OK if SSL should have been used.
No, I misread the code; what will happen next is that an SSL connection
will be tried. At least, it looks like that should happen, and it does
happen for me.
However: it is true (and undocumented, so we have at least a docs bug
to fix) that v12-and-later libpq will try for GSS encryption first,
and if it succeeds then it will not consider using SSL, regardless of
sslmode. So about 95% of your report could be explained by assuming
that you have a working Kerberos environment and the newer libpq is
preferring GSS encryption over SSL. There is just one thing this
theory is failing to explain: instead of "SSL connection", psql
should have printed "GSSAPI-encrypted connection" in your test
shown in <d3ab9042bce34aae85d323d69e3ee430@smhi.se>. It didn't,
so this can't be the true explanation. I think what must be
happening is that libpq is trying for GSS (hence you have at least
a credentials cache somewhere), failing to establish it, and then
for some reason advancing to the startup-packet step without
trying for SSL. But I can't see how to get the state machine to
do that.
Have you got any environment variables, service files, etc
that would affect libpq's behavior?
regards, tom lane
^ permalink raw reply [nested|flat] 4+ messages in thread
end of thread, other threads:[~2020-12-23 20:58 UTC | newest]
Thread overview: 4+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2020-12-22 08:07 SV: SV: SV: SV: Problem with ssl and psql in Postgresql 13 Gustavsson Mikael <mikael.gustavsson@smhi.se>
2020-12-23 09:50 ` Gustavsson Mikael <mikael.gustavsson@smhi.se>
2020-12-23 16:28 ` Tom Lane <tgl@sss.pgh.pa.us>
2020-12-23 20:58 ` Tom Lane <tgl@sss.pgh.pa.us>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox