Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1ks0n3-0003pb-Gu for pgsql-general@arkaria.postgresql.org; Wed, 23 Dec 2020 09:50:42 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1ks0n1-0004nw-2u for pgsql-general@arkaria.postgresql.org; Wed, 23 Dec 2020 09:50:39 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1ks0n0-0004np-JM for pgsql-general@lists.postgresql.org; Wed, 23 Dec 2020 09:50:38 +0000 Received: from smtpout1.smhi.se ([2001:67c:274:5501::30]) by makus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1ks0mt-0007ff-Dk for pgsql-general@postgresql.org; Wed, 23 Dec 2020 09:50:37 +0000 Received: from winserv743.ad.smhi.se (winserv743.ad.smhi.se [172.16.6.38]) by smtpout1.smhi.se (Postfix) with ESMTPS id 8DF23109508F; Wed, 23 Dec 2020 09:50:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=smhi.se; s=20180112; t=1608717025; bh=I+Ysxdtu8J1+fEPdknhMzdkdsUBUSaYBfodEk+X0Ueg=; h=From:To:CC:Subject:Date:References:In-Reply-To:From; b=bRgU3m8xQLaGUM/+rTexvc85faOwIunEeF2lTaKcmJ//QWMn4mSfZB+K6ijR+EaP7 d7zetleXqbrCJ5GgaOxC8JDncP3hsMGrBMTqL7x3RTW2RXREYTsrReamhNWL62ExGJ GZQnDJ+wZ1HWMHWQMmjl7FUwXHoY15oO9zdmlSFY= Received: from winserv744.ad.smhi.se (172.16.6.35) by winserv743.ad.smhi.se (172.16.6.38) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2106.2; Wed, 23 Dec 2020 10:50:25 +0100 Received: from winserv744.ad.smhi.se ([fe80::c19c:d0f0:5830:a72b]) by winserv744.ad.smhi.se ([fe80::c19c:d0f0:5830:a72b%9]) with mapi id 15.01.2106.006; Wed, 23 Dec 2020 10:50:25 +0100 From: Gustavsson Mikael To: Tom Lane CC: Magnus Hagander , Kyotaro Horiguchi , "pgsql-general@postgresql.org" , Svensson Peter Subject: SV: SV: SV: SV: Problem with ssl and psql in Postgresql 13 Thread-Topic: SV: SV: SV: Problem with ssl and psql in Postgresql 13 Thread-Index: AQHW1ER+dWnFD/e9/0CWjk1hYinUxan65DcAgAAT2weAAE4KgIAAEwPs///2LoCAAB6Q7f//9RsAgAAS+1X///M6gAACMBNMACAAxLAAF7C+AACx1Ea8ADYQzQk= Date: Wed, 23 Dec 2020 09:50:25 +0000 Message-ID: References: <20201217.172938.170511532557914014.horikyota.ntt@gmail.com> <06191eae74d045e192a786a84a73ba53@smhi.se> <65644.1608214801@sss.pgh.pa.us> , <698125e1105644adaa27578bb37b18f6@smhi.se>,<89909.1608222331@sss.pgh.pa.us>,<61e2a65bbc2f47d297a6f3cdac2cc6cc@smhi.se> ,<169637.1608321770@sss.pgh.pa.us>, In-Reply-To: Accept-Language: sv-SE, en-US Content-Language: sv-SE X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.122.0.145] Content-Type: multipart/alternative; boundary="_000_de4dc5a4f22d43a28300bccb70d99db6smhise_" MIME-Version: 1.0 List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --_000_de4dc5a4f22d43a28300bccb70d99db6smhise_ Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable Hi, I did a final test before logging out for Christmas because i found a threa= d in hackers discussing some issue with GSS and SSL. So if i set gssencmode=3Ddisable on my pgsql-13 to postgres 13 server conne= ction i get an SSL connection. Is this expected behaviour? $ /usr/pgsql-13/bin/psql "dbname=3Dpostgres user=3Dkalle host=3Dserver gsse= ncmode=3Ddisable" Password for user kalle: psql (13.1) SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bits: 25= 6, compression: off) Type "help" for help. postgres=3D> KR, Mikael Gustavsson, SMHI ________________________________ Fr=E5n: externaly-forwarded@smhi.se f=F6r Gus= tavsson Mikael Skickat: den 22 december 2020 09:07:17 Till: Tom Lane Kopia: Magnus Hagander; Kyotaro Horiguchi; pgsql-general@postgresql.org; Sv= ensson Peter =C4mne: SV: SV: SV: SV: Problem with ssl and psql in Postgresql 13 Hi, Yes it=B4s odd. I think we begin with download/reinstall and take it from t= here. The server name is just letters and numbers so I think we can rule that out= . Christmas is coming up fast as usual so I think I will pick this up in Janu= ary. Thanks for all the help and Happy Christmas! Or God Jul as we say in Sweden= . KR Mikael Gustavsson, SMHI ________________________________ Fr=E5n: Tom Lane Skickat: den 18 december 2020 21:02:50 Till: Gustavsson Mikael Kopia: Magnus Hagander; Kyotaro Horiguchi; pgsql-general@postgresql.org; Sv= ensson Peter =C4mne: Re: SV: SV: SV: Problem with ssl and psql in Postgresql 13 Gustavsson Mikael writes: > pgsql-13 with require: > $ /usr/pgsql-13/bin/psql "dbname=3Dpostgres user=3Dkalle host=3Dserver ss= lmode=3Drequire" > Password for user kalle: > psql (13.1) > Type "help" for help. That is just bizarre. libpq should not ignore the sslmode=3Drequire option like that, unless it thinks it's making a Unix-socket connection, which it should not think given the host specification. (There's not a slash in your server's real name, is there? But if there was, v11 should misbehave too.) It seems like there must be some environment setting, or maybe a service file, changing the behavior from what it should be on its face. But that theory has big flaws too: an explicit sslmode=3Drequire setting should not be overridable from environment, and even if it was, why wouldn't v11 act the same? The only other conclusion I can think of is that your copy of libpq.so is broken. Maybe you should try redownloading/reinstalling v13. regards, tom lane --_000_de4dc5a4f22d43a28300bccb70d99db6smhise_ Content-Type: text/html; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable

Hi,


I did a final test before logging out for Christmas because i found a th= read in hackers discussing some issue with GSS and SSL.

So if i set gssencmode=3Ddisable on my pgsql-13 to postgre= s 13 server connection i get an SSL connection.


Is this expected behaviour?


$ /usr/pgsql-13/bin/psql "dbname=3Dpostgres user=3Dkalle host=3Ds= erver gssencmode=3Ddisable"
Password for user kalle: 
psql (13.1)
SSL connection (protocol: TLSv1.3, cipher: TLS_AES_256_GCM_SHA384, bit= s: 256, compression: off)
Type "help" for help.

postgres=3D>

KR, Mikael Gustavsson, SMHI


Fr=E5n: externaly-forwarded= @smhi.se <externaly-forwarded@smhi.se> f=F6r Gustavsson Mikael <mi= kael.gustavsson@smhi.se>
Skickat: den 22 december 2020 09:07:17
Till: Tom Lane
Kopia: Magnus Hagander; Kyotaro Horiguchi; pgsql-general@postgresql.= org; Svensson Peter
=C4mne: SV: SV: SV: SV: Problem with ssl and psql in Postgresql 13
 

Hi, 


Yes it=B4s odd. I think we begin with download/reinstall and take i= t from there.

The server name is just letters and numbers so I think we can rule = that out. 


Christmas is coming up fast as usual so I think I will pick this up in J= anuary.

Thanks for all the help and Happy Christmas! Or God Jul as we say in Swe= den.


KR 

Mikael Gustavsson, SMHI

Fr=E5n: Tom Lane <tgl@= sss.pgh.pa.us>
Skickat: den 18 december 2020 21:02:50
Till: Gustavsson Mikael
Kopia: Magnus Hagander; Kyotaro Horiguchi; pgsql-general@postgresql.= org; Svensson Peter
=C4mne: Re: SV: SV: SV: Problem with ssl and psql in Postgresql 13
 
Gustavsson Mikael <mikael.gustavsson@smhi.se>= ; writes:
> pgsql-13 with require:
> $ /usr/pgsql-13/bin/psql "dbname=3Dpostgres user=3Dkalle host=3Ds= erver sslmode=3Drequire"
> Password for user kalle:
> psql (13.1)
> Type "help" for help.

That is just bizarre.  libpq should not ignore the sslmode=3Drequire o= ption
like that, unless it thinks it's making a Unix-socket connection, which
it should not think given the host specification.  (There's not a slas= h
in your server's real name, is there?  But if there was, v11 should misbehave too.)

It seems like there must be some environment setting, or maybe a service file, changing the behavior from what it should be on its face.  But that theory has big flaws too: an explicit sslmode=3Drequire setting should=
not be overridable from environment, and even if it was, why wouldn't v11 act the same?

The only other conclusion I can think of is that your copy of libpq.so
is broken.  Maybe you should try redownloading/reinstalling v13.

            &nb= sp;           regards, to= m lane


--_000_de4dc5a4f22d43a28300bccb70d99db6smhise_--