From: Jacob Champion <jchampion@timescale.com>
To: Andres Freund <andres@anarazel.de>
Cc: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
Cc: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH] Log details for client certificate failures
Date: Fri, 15 Jul 2022 14:51:38 -0700
Message-ID: <1d3d62a0-2d7f-4592-bf76-ba59a77e61cc@timescale.com> (raw)
In-Reply-To: <20220715211914.c5oasfknx2njndov@awork3.anarazel.de>
References: <2ef20161-e99d-a6ea-a36d-577843a2daae@enterprisedb.com>
<CAAWbhmiQVSAc_rOdW8q9R3GJehxkmaW5-CMbYLgrCjhotSs8Bg@mail.gmail.com>
<49b48719-d6cf-9e03-fab3-e4505cf9d585@enterprisedb.com>
<CAAWbhmhbM5zwjjVsYkhTOFrV308iFbsGceWiseSbFPQeq24Fww@mail.gmail.com>
<059e67f5-3769-24c8-f460-4e5d87af529a@enterprisedb.com>
<0167a8c5-1754-9121-b994-0719a6493a21@timescale.com>
<20220715191156.jecddreykoakdljm@awork3.anarazel.de>
<ca6eb74e-aafc-f7cc-50fd-a6b33bca858b@timescale.com>
<20220715203500.vanqxt23bmufjais@awork3.anarazel.de>
<2878aee8-a4a6-8078-9740-efe90fcf8328@timescale.com>
<20220715211914.c5oasfknx2njndov@awork3.anarazel.de>
On 7/15/22 14:19, Andres Freund wrote:
> On 2022-07-15 14:01:53 -0700, Jacob Champion wrote:
>> On 7/15/22 13:35, Andres Freund wrote:
>>> I don't know, but I don't think not caring at all is a good
>>> option. Particularly for unauthenticated data I'd say that escaping everything
>>> but printable ascii chars is a sensible approach.
>>
>> It'll also be painful for anyone whose infrastructure isn't in a Latin
>> character set... Maybe that's worth the tradeoff for a v1.
>
> I don't think it's a huge issue, or really avoidable, pre-authentication.
> Don't we require all server-side encodings to be supersets of ascii?
Well, I was going to say that for this feature, where the goal is to
debug a failed certificate chain, having to manually unescape the logged
certificate names if your infrastructure already handled UTF-8 natively
would be a real pain.
But your later point about truncation makes that moot; I forgot that my
patch can truncate in the middle of a UTF-8 sequence, so you're probably
dealing with replacement glyphs anyway. I don't really have a leg to
stand on there.
> We already have pg_clean_ascii() and use it for application_name, fwiw.
That seems much worse than escaping for this particular patch; if your
cert's Common Name is in (non-ASCII) UTF-8 then all you'll see is
"CN=?????????" in the log lines that were supposed to be helping you
root-cause. Escaping would be much more helpful in this case.
>> Is there an acceptable approach that could centralize it, so we fix it
>> once and are done? E.g. a log_encoding GUC and either conversion or
>> escaping in send_message_to_server_log()?
>
> Introducing escaping to ascii for all log messages seems like it'd be
> incredibly invasive, and would remove a lot of worthwhile information. Nor
> does it really address the whole scope - consider e.g. the truncation in this
> patch, that can't be done correctly by the time send_message_to_server_log()
> is reached - just chopping in the middle of a multi-byte string would have
> made the string invalidly encoded. And we can't perform encoding conversion
> from client data until we've gone further into the authentication process, I
> think.
>
> Always escaping ANSI escape codes (or rather the non-printable ascii range) is
> more convincing. Then we'd just need to make sure that client controlled data
> is properly encoded before handing it over to other parts of the system.
>
> I can see a point in a log_encoding GUC at some point, but it seems a bit
> separate from the discussion here.
Fair enough.
--Jacob
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: jchampion@timescale.com, andres@anarazel.de, peter.eisentraut@enterprisedb.com
Subject: Re: [PATCH] Log details for client certificate failures
In-Reply-To: <1d3d62a0-2d7f-4592-bf76-ba59a77e61cc@timescale.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox