Content-Type: multipart/mixed; boundary="------------CJV6M9mtlbEliB0HAYY0HoZY"
Message-ID: <5a79ed71-b365-4b20-80bc-9c2bf97bf84b@iki.fi>
Date: Wed, 24 Apr 2024 00:19:57 +0300
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: Direct SSL connection with ALPN and HBA rules
To: Jacob Champion <jacob.champion@enterprisedb.com>,
 Robert Haas <robertmhaas@gmail.com>
Cc: Michael Paquier <michael@paquier.xyz>,
 Postgres hackers <pgsql-hackers@lists.postgresql.org>
References: <ZiH7vHwEJeRKHlST@paquier.xyz>
 <c786e226-4039-4522-ba07-92501fce9b6a@iki.fi>
 <CAOYmi+kbYPX78nu0k7OODxUhoD6H1OXdugiMK1z9Nn33G-qdcQ@mail.gmail.com>
 <a0983295-67ae-487e-84e3-6e1148af3a25@iki.fi> <ZiYPmUZjcQtPz2j7@paquier.xyz>
 <feebbeee-df5f-484f-b07e-062bd0230bd2@iki.fi> <ZidKMB1tcgM3bzFZ@paquier.xyz>
 <CAOYmi+n57x+8DVi9J+dGmFQo+2Eb+bg_+geH=jqfh3E=NWHfOA@mail.gmail.com>
 <CA+TgmoaLpDVY2ywqQUfxvKEQZ+nwkabcw_f=i4Zyivt9CLjcmA@mail.gmail.com>
 <CAOYmi+=sj+1uydS0NR4nYzw-LRWp3Q-s5speBug5UCLSPMbvGA@mail.gmail.com>
Content-Language: en-US
From: Heikki Linnakangas <hlinnaka@iki.fi>
In-Reply-To: <CAOYmi+=sj+1uydS0NR4nYzw-LRWp3Q-s5speBug5UCLSPMbvGA@mail.gmail.com>
Archived-At: <https://www.postgresql.org/message-id/5a79ed71-b365-4b20-80bc-9c2bf97bf84b%40iki.fi>
Precedence: bulk

This is a multi-part message in MIME format.
--------------CJV6M9mtlbEliB0HAYY0HoZY
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

On 23/04/2024 22:33, Jacob Champion wrote:
> On Tue, Apr 23, 2024 at 10:43 AM Robert Haas <robertmhaas@gmail.com> wrote:
>> I've not followed this thread closely enough to understand the comment
>> about requiredirect maybe not actually requiring direct, but if that
>> were true it seems like it might be concerning.
> 
> It may be my misunderstanding. This seems to imply bad behavior:
> 
>> If the server rejects GSS encryption, SSL is
>> negotiated over the same TCP connection using the traditional postgres
>> protocol, regardless of <literal>sslnegotiation</literal>.
> 
> As does this comment:
> 
>> +   /*
>> +    * If enabled, try direct SSL. Unless we have a valid TCP connection that
>> +    * failed negotiating GSSAPI encryption or a plaintext connection in case
>> +    * of sslmode='allow'; in that case we prefer to reuse the connection with
>> +    * negotiated SSL, instead of reconnecting to do direct SSL. The point of
>> +    * direct SSL is to avoid the roundtrip from the negotiation, but
>> +    * reconnecting would also incur a roundtrip.
>> +    */
> 
> but when I actually try those cases, I see that requiredirect does
> actually cause a direct SSL connection to be done, even with
> sslmode=allow. So maybe it's just misleading documentation (or my
> misreading of it) that needs to be expanded? Am I missing a different
> corner case where requiredirect is ignored, Heikki?

You're right, the comment is wrong about sslmode=allow. There is no 
negotiation of a plaintext connection, the client just sends the startup 
packet directly. The HBA rules can reject it, but the client will have 
to disconnect and reconnect in that case.

The documentation and that comment are misleading about failed GSSAPI 
encryption too, and I also misremembered that. With 
sslnegotiation=requiredirect, libpq never uses negotiated SSL mode. It 
will reconnect after a rejected GSSAPI request. So that comment applies 
to sslnegotiation=direct, but not sslnegotiation=requiredirect.

Attached patch tries to fix and clarify those.

(Note that the client will only attempt GSSAPI encryption if it can find 
kerberos credentials in the environment.)

-- 
Heikki Linnakangas
Neon (https://neon.tech)

--------------CJV6M9mtlbEliB0HAYY0HoZY
Content-Type: text/x-patch; charset=UTF-8;
 name="0001-Fix-documentation-and-comments-on-what-happens-after.patch"
Content-Disposition: attachment;
 filename*0="0001-Fix-documentation-and-comments-on-what-happens-after.pa";
 filename*1="tch"
Content-Transfer-Encoding: base64

RnJvbSA2NjQ1NTVkZWNiNjk1MTIzYTRiZjI1ZWE1NmY3ODkyMDJiOTI2ZWEwIE1vbiBTZXAg
MTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBIZWlra2kgTGlubmFrYW5nYXMgPGhlaWtraS5saW5u
YWthbmdhc0Bpa2kuZmk+CkRhdGU6IFdlZCwgMjQgQXByIDIwMjQgMDA6MTA6MjQgKzAzMDAK
U3ViamVjdDogW1BBVENIIDEvMV0gRml4IGRvY3VtZW50YXRpb24gYW5kIGNvbW1lbnRzIG9u
IHdoYXQgaGFwcGVucyBhZnRlciBHU1MKIHJlamVjdGlvbgoKVGhlIHBhcmFncmFwaCBpbiB0
aGUgZG9jcyBhbmQgdGhlIGNvbW1lbnQgYXBwbGllZCB0bwpzc2xuZWdvdGlhdG9uPWRpcmVj
dCwgYnV0IG5vdCBzc2xuZWdvdGlhdGlvbj1yZXF1aXJlZGlyZWN0LiBJbgoncmVxdWlyZWRp
cmVjdCcgbW9kZSwgbmVnb3RpYXRlZCBTU0wgaXMgbmV2ZXIgdXNlZC4gTW92ZSB0aGUgcGFy
YWdyYXBoCmluIHRoZSBkb2NzIHVuZGVyIHRoZSBkZXNjcmlwdGlvbiBvZiAnZGlyZWN0JyBt
b2RlLCBhbmQgcmVwaHJhc2UgaXQuCgpBbHNvIHRoZSBjb21tZW50J3MgcmVmZXJlbmNlIHRv
IHJldXNpbmcgYSBwbGFpbnRleHQgY29ubmVjdGlvbiB3YXMKYm9ndXMuIEF1dGhlbnRpY2F0
aW9uIGZhaWx1cmUgaW4gcGxhaW50ZXh0IG1vZGUgb25seSBoYXBwZW5zIGFmdGVyCnNlbmRp
bmcgdGhlIHN0YXJ0dXAgcGFja2V0LCBzbyB0aGUgY29ubmVjdGlvbiBjYW5ub3QgYmUgcmV1
c2VkLgotLS0KIGRvYy9zcmMvc2dtbC9saWJwcS5zZ21sICAgICAgICAgICB8IDE5ICsrKysr
KysrKy0tLS0tLS0tLS0KIHNyYy9pbnRlcmZhY2VzL2xpYnBxL2ZlLWNvbm5lY3QuYyB8IDEx
ICsrKysrKy0tLS0tCiAyIGZpbGVzIGNoYW5nZWQsIDE1IGluc2VydGlvbnMoKyksIDE1IGRl
bGV0aW9ucygtKQoKZGlmZiAtLWdpdCBhL2RvYy9zcmMvc2dtbC9saWJwcS5zZ21sIGIvZG9j
L3NyYy9zZ21sL2xpYnBxLnNnbWwKaW5kZXggOTE5OWQwZDJlNS4uN2Y4NTRlZGZhMiAxMDA2
NDQKLS0tIGEvZG9jL3NyYy9zZ21sL2xpYnBxLnNnbWwKKysrIGIvZG9jL3NyYy9zZ21sL2xp
YnBxLnNnbWwKQEAgLTE4MDMsNiArMTgwMywxNSBAQCBwb3N0Z3Jlc3FsOi8vJTJGdmFyJTJG
bGliJTJGcG9zdGdyZXNxbC9kYm5hbWUKICAgICAgICAgICAgICBwcm9jZXNzIGFkZHMgc2ln
bmlmaWNhbnQgbGF0ZW5jeSBpZiB0aGUgaW5pdGlhbCBTU0wgY29ubmVjdGlvbgogICAgICAg
ICAgICAgIGZhaWxzLgogICAgICAgICAgICA8L3BhcmE+CisgICAgICAgICAgIDxwYXJhPgor
ICAgICAgICAgICAgIEFuIGV4Y2VwdGlvbiBpcyBpZiA8bGl0ZXJhbD5nc3NlbmNtb2RlPC9s
aXRlcmFsPiBpcyBzZXQKKyAgICAgICAgICAgICB0byA8bGl0ZXJhbD5wcmVmZXI8L2xpdGVy
YWw+LCBidXQgdGhlIHNlcnZlciByZWplY3RzIEdTUyBlbmNyeXB0aW9uLgorICAgICAgICAg
ICAgIEluIHRoYXQgY2FzZSwgU1NMIGlzIG5lZ290aWF0ZWQgb3ZlciB0aGUgc2FtZSBUQ1Ag
Y29ubmVjdGlvbiB1c2luZworICAgICAgICAgICAgIDxwcm9kdWN0bmFtZT5Qb3N0Z3JlU1FM
PC9wcm9kdWN0bmFtZT4gcHJvdG9jb2wgbmVnb3RpYXRpb24uIEluCisgICAgICAgICAgICAg
b3RoZXIgd29yZHMsIHRoZSBkaXJlY3QgU1NMIGhhbmRzaGFrZSBpcyBub3QgdXNlZCwgaWYg
YSBUQ1AKKyAgICAgICAgICAgICBjb25uZWN0aW9uIGhhcyBhbHJlYWR5IGJlZW4gZXN0YWJs
aXNoZWQgYW5kIGNhbiBiZSB1c2VkIGZvciB0aGUKKyAgICAgICAgICAgICBTU0wgaGFuZHNo
YWtlLgorICAgICAgICAgICA8L3BhcmE+CiAgICAgICAgICAgPC9saXN0aXRlbT4KICAgICAg
ICAgIDwvdmFybGlzdGVudHJ5PgogCkBAIC0xODE2LDE2ICsxODI1LDYgQEAgcG9zdGdyZXNx
bDovLyUyRnZhciUyRmxpYiUyRnBvc3RncmVzcWwvZGJuYW1lCiAgICAgICAgICAgPC9saXN0
aXRlbT4KICAgICAgICAgIDwvdmFybGlzdGVudHJ5PgogICAgICAgICA8L3ZhcmlhYmxlbGlz
dD4KLQotICAgICAgIDxwYXJhPgotICAgICAgICBOb3RlIHRoYXQgaWYgPGxpdGVyYWw+Z3Nz
ZW5jbW9kZTwvbGl0ZXJhbD4gaXMgc2V0Ci0gICAgICAgIHRvIDxsaXRlcmFsPnByZWZlcjwv
bGl0ZXJhbD4sIGEgPGFjcm9ueW0+R1NTPC9hY3JvbnltPiBjb25uZWN0aW9uIGlzCi0gICAg
ICAgIGF0dGVtcHRlZCBmaXJzdC4gSWYgdGhlIHNlcnZlciByZWplY3RzIEdTUyBlbmNyeXB0
aW9uLCBTU0wgaXMKLSAgICAgICAgbmVnb3RpYXRlZCBvdmVyIHRoZSBzYW1lIFRDUCBjb25u
ZWN0aW9uIHVzaW5nIHRoZSB0cmFkaXRpb25hbCBwb3N0Z3JlcwotICAgICAgICBwcm90b2Nv
bCwgcmVnYXJkbGVzcyBvZiA8bGl0ZXJhbD5zc2xuZWdvdGlhdGlvbjwvbGl0ZXJhbD4uIElu
IG90aGVyCi0gICAgICAgIHdvcmRzLCB0aGUgZGlyZWN0IFNTTCBoYW5kc2hha2UgaXMgbm90
IHVzZWQsIGlmIGEgVENQIGNvbm5lY3Rpb24gaGFzCi0gICAgICAgIGFscmVhZHkgYmVlbiBl
c3RhYmxpc2hlZCBhbmQgY2FuIGJlIHVzZWQgZm9yIHRoZSBTU0wgaGFuZHNoYWtlLgotICAg
ICAgIDwvcGFyYT4KICAgICAgIDwvbGlzdGl0ZW0+CiAgICAgIDwvdmFybGlzdGVudHJ5Pgog
CmRpZmYgLS1naXQgYS9zcmMvaW50ZXJmYWNlcy9saWJwcS9mZS1jb25uZWN0LmMgYi9zcmMv
aW50ZXJmYWNlcy9saWJwcS9mZS1jb25uZWN0LmMKaW5kZXggZWMyMGUzZjNhOS4uYjFkM2Jm
YTU5ZCAxMDA2NDQKLS0tIGEvc3JjL2ludGVyZmFjZXMvbGlicHEvZmUtY29ubmVjdC5jCisr
KyBiL3NyYy9pbnRlcmZhY2VzL2xpYnBxL2ZlLWNvbm5lY3QuYwpAQCAtNDQzMCwxMSArNDQz
MCwxMiBAQCBzZWxlY3RfbmV4dF9lbmNyeXB0aW9uX21ldGhvZChQR2Nvbm4gKmNvbm4sIGJv
b2wgaGF2ZV92YWxpZF9jb25uZWN0aW9uKQogCiAJLyoKIAkgKiBJZiBlbmFibGVkLCB0cnkg
ZGlyZWN0IFNTTC4gVW5sZXNzIHdlIGhhdmUgYSB2YWxpZCBUQ1AgY29ubmVjdGlvbiB0aGF0
Ci0JICogZmFpbGVkIG5lZ290aWF0aW5nIEdTU0FQSSBlbmNyeXB0aW9uIG9yIGEgcGxhaW50
ZXh0IGNvbm5lY3Rpb24gaW4gY2FzZQotCSAqIG9mIHNzbG1vZGU9J2FsbG93JzsgaW4gdGhh
dCBjYXNlIHdlIHByZWZlciB0byByZXVzZSB0aGUgY29ubmVjdGlvbiB3aXRoCi0JICogbmVn
b3RpYXRlZCBTU0wsIGluc3RlYWQgb2YgcmVjb25uZWN0aW5nIHRvIGRvIGRpcmVjdCBTU0wu
IFRoZSBwb2ludCBvZgotCSAqIGRpcmVjdCBTU0wgaXMgdG8gYXZvaWQgdGhlIHJvdW5kdHJp
cCBmcm9tIHRoZSBuZWdvdGlhdGlvbiwgYnV0Ci0JICogcmVjb25uZWN0aW5nIHdvdWxkIGFs
c28gaW5jdXIgYSByb3VuZHRyaXAuCisJICogZmFpbGVkIG5lZ290aWF0aW5nIEdTU0FQSSBl
bmNyeXB0aW9uOyBpbiB0aGF0IGNhc2Ugd2UgcHJlZmVyIHRvIHJldXNlCisJICogdGhlIGNv
bm5lY3Rpb24gd2l0aCBuZWdvdGlhdGVkIFNTTCwgaW5zdGVhZCBvZiByZWNvbm5lY3Rpbmcg
dG8gZG8KKwkgKiBkaXJlY3QgU1NMLiBUaGUgcG9pbnQgb2Ygc3NsbmVnb3RpYXRpb249ZGly
ZWN0IGlzIHRvIGF2b2lkIHRoZQorCSAqIHJvdW5kdHJpcCBmcm9tIHRoZSBuZWdvdGlhdGlv
biwgYnV0IHJlY29ubmVjdGluZyB3b3VsZCBhbHNvIGluY3VyIGEKKwkgKiByb3VuZHRyaXAu
IChJbiBzc2xuZWdvdGlhdGlvbj1yZXF1aXJlZGlyZWN0IG1vZGUsIG5lZ290aWF0aWVkIFNT
TCBpcworCSAqIG5vdCBpbiB0aGUgbGlzdCBvZiBhbGxvd2VkIG1ldGhvZHMgYW5kIHdlIHdp
bGwgcmVjb25uZWN0LikKIAkgKi8KIAlpZiAoaGF2ZV92YWxpZF9jb25uZWN0aW9uKQogCQlT
RUxFQ1RfTkVYVF9NRVRIT0QoRU5DX05FR09USUFURURfU1NMKTsKLS0gCjIuMzkuMgoK

--------------CJV6M9mtlbEliB0HAYY0HoZY--