Message-ID: <1a717f65-7390-4111-8efd-c6e9b213805e@iki.fi>
Date: Mon, 29 Apr 2024 22:06:27 +0300
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: Direct SSL connection with ALPN and HBA rules
To: Jacob Champion <jacob.champion@enterprisedb.com>,
 Daniel Gustafsson <daniel@yesql.se>
Cc: Robert Haas <robertmhaas@gmail.com>, Michael Paquier
 <michael@paquier.xyz>, Postgres hackers <pgsql-hackers@lists.postgresql.org>
References: <ZiH7vHwEJeRKHlST@paquier.xyz> <ZiYPmUZjcQtPz2j7@paquier.xyz>
 <feebbeee-df5f-484f-b07e-062bd0230bd2@iki.fi> <ZidKMB1tcgM3bzFZ@paquier.xyz>
 <CAOYmi+n57x+8DVi9J+dGmFQo+2Eb+bg_+geH=jqfh3E=NWHfOA@mail.gmail.com>
 <CA+TgmoaLpDVY2ywqQUfxvKEQZ+nwkabcw_f=i4Zyivt9CLjcmA@mail.gmail.com>
 <CAOYmi+=sj+1uydS0NR4nYzw-LRWp3Q-s5speBug5UCLSPMbvGA@mail.gmail.com>
 <5a79ed71-b365-4b20-80bc-9c2bf97bf84b@iki.fi>
 <CAOYmi+kfsRfopQRTuJwpsO50Urq=-gwYDJ1fWNkDr3oYM1wdjA@mail.gmail.com>
 <CA+TgmoZspODpL6AYbANpffhbF+Q12xo1pHXrR9ZSkYfEQWpP3w@mail.gmail.com>
 <CAOYmi+k3x-aKiVzyLfzdxFdmcBmVD8UvcwfB075BkNqyA1aa9w@mail.gmail.com>
 <CA+TgmobR1R8q-rT06oWdLw_Kp_i67Uey9b+rWVrrpCJVSDNBFQ@mail.gmail.com>
 <CAOYmi+=TB8=yfXoBk=p0k0GPaCD79F8xXcypZFkjKmPKuT0hjQ@mail.gmail.com>
 <f6833e88-2e21-459d-a661-152ced273c60@iki.fi>
 <CAOYmi+nWKJNihuMpT+ZVTC5-d+pQdACTK7xKhhwAB075EHrOMg@mail.gmail.com>
 <3a6f126c-e1aa-4dcc-9252-9868308f6cf0@iki.fi>
 <CAOYmi+k2kJcJLMj=K4Vb3S_J6tN6989Wfi5+amqf15VkHcej3Q@mail.gmail.com>
Content-Language: en-US
From: Heikki Linnakangas <hlinnaka@iki.fi>
In-Reply-To: <CAOYmi+k2kJcJLMj=K4Vb3S_J6tN6989Wfi5+amqf15VkHcej3Q@mail.gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit
Archived-At: <https://www.postgresql.org/message-id/1a717f65-7390-4111-8efd-c6e9b213805e%40iki.fi>
Precedence: bulk

On 29/04/2024 21:43, Jacob Champion wrote:
> On Mon, Apr 29, 2024 at 1:38 AM Heikki Linnakangas <hlinnaka@iki.fi> wrote:
>> If you only
>> have v17 servers in your environment, so you know all servers support
>> direct negotiation if they support SSL at all, but a mix of servers with
>> and without SSL, sslnegotiation=directonly would reduce roundtrips with
>> sslmode=prefer.
> 
> But if you're in that situation, what does the use of directonly give
> you over `sslnegotiation=direct`? You already know that servers
> support direct, so there's no additional performance penalty from the
> less strict mode.

Well, by that argument we don't need requiredirect/directonly at all. 
This goes back to whether it's a security feature or a performance feature.

There is a small benefit with sslmode=prefer if you connect to a server 
that doesn't support SSL, though. With sslnegotiation=direct, if the 
server rejects the direct SSL connection, the client will reconnect and 
try SSL with SSLRequest. The server will respond with 'N', and the 
client will proceed without encryption. sslnegotiation=directonly 
removes that SSLRequest attempt, eliminating one roundtrip.

>> Making requiredirect to imply sslmode=require, or error out unless you
>> also set sslmode=require, feels like a cavalier way of forcing SSL. We
>> should have a serious discussion on making sslmode=require the default
>> instead. That would be a more direct way of nudging people to use SSL.
>> It would cause a lot of breakage, but it would also be a big improvement
>> to security.
>>
>> Consider how sslnegotiation=requiredirect/directonly would feel, if we
>> made sslmode=require the default. If you explicitly set "sslmode=prefer"
>> or "sslmode=disable", it would be annoying if you would also need to
>> remove "sslnegotiation=requiredirect" from your connection string.
> 
> That's similar to how sslrootcert=system already works. To me, it
> feels great, because I don't have to worry about nonsensical
> combinations (with the exception of GSS, which we've touched on
> above). libpq complains loudly if I try to shoot myself in the foot,
> and if I'm using sslrootcert=system then it's a pretty clear signal
> that I care more about security than the temporary inconvenience of
> editing my connection string for one weird server that doesn't use SSL
> for some reason.

Oh I was not aware sslrootcert=system works like that. That's a bit 
surprising, none of the other ssl-related settings imply or require that 
SSL is actually used. Did we intend to set a precedence for new settings 
with that?

(adding Daniel in case he has an opinion)

-- 
Heikki Linnakangas
Neon (https://neon.tech)