From: Peter Eisentraut <peter.eisentraut@enterprisedb.com>
Subject: SSL SNI
To: pgsql-hackers <pgsql-hackers@postgresql.org>
Organization: EnterpriseDB
Message-ID: <7289d5eb-62a5-a732-c3b9-438cee2cb709@enterprisedb.com>
Date: Mon, 15 Feb 2021 15:09:47 +0100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:52.0)
 Gecko/20100101 Thunderbird/52.9.1
MIME-Version: 1.0
Content-Type: multipart/mixed;
 boundary="------------B778BDAF4BCBA6917647FACF"
Content-Language: en-US
Precedence: bulk

This is a multi-part message in MIME format.
--------------B778BDAF4BCBA6917647FACF
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit

A customer asked about including Server Name Indication (SNI) into the 
SSL connection from the client, so they can use an SSL-aware proxy to 
route connections.  There was a thread a few years ago where this was 
briefly discussed but no patch appeared.[0]  I whipped up a quick patch 
and it did seem to do the job, so I figured I'd share it here.

The question I had was whether this should be an optional behavior, or 
conversely a behavior that can be turned off, or whether it should just 
be turned on all the time.

Technically, it seems pretty harmless.  It adds another field to the TLS 
handshake, and if the server is not interested in it, it just gets ignored.

The Wikipedia page[1] discusses some privacy concerns in the context of 
web browsing, but it seems there is no principled solution to those. 
The relevant RFC[2] "recommends" that SNI is used for all applicable TLS 
connections.


[0]: 
https://www.postgresql.org/message-id/flat/CAPPwrB_tsOw8MtVaA_DFyOFRY2ohNdvMnLoA_JRr3yB67Rggmg%40mail.gmail.com
[1]: https://en.wikipedia.org/wiki/Server_Name_Indication
[2]: https://tools.ietf.org/html/rfc6066#section-3

--------------B778BDAF4BCBA6917647FACF
Content-Type: text/plain; charset=UTF-8; x-mac-type="0"; x-mac-creator="0";
 name="0001-Set-SNI-for-SSL-connections-from-the-client.patch"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
 filename="0001-Set-SNI-for-SSL-connections-from-the-client.patch"

RnJvbSAzZTRhYWU4YjAxYTA1ZmU3ODAxNzY1OWJiM2JlMTk0MmE3ZjFjY2Y1IE1vbiBTZXAg
MTcgMDA6MDA6MDAgMjAwMQpGcm9tOiBQZXRlciBFaXNlbnRyYXV0IDxwZXRlckBlaXNlbnRy
YXV0Lm9yZz4KRGF0ZTogTW9uLCAxNSBGZWIgMjAyMSAxNDoxMToyNyArMDEwMApTdWJqZWN0
OiBbUEFUQ0hdIFNldCBTTkkgZm9yIFNTTCBjb25uZWN0aW9ucyBmcm9tIHRoZSBjbGllbnQK
ClRoaXMgYWxsb3dzIGFuIFNOSS1hd2FyZSBwcm94eSB0byByb3V0ZSBjb25uZWN0aW9ucy4K
LS0tCiBzcmMvaW50ZXJmYWNlcy9saWJwcS9mZS1zZWN1cmUtb3BlbnNzbC5jIHwgMTkgKysr
KysrKysrKysrKysrKysrKwogMSBmaWxlIGNoYW5nZWQsIDE5IGluc2VydGlvbnMoKykKCmRp
ZmYgLS1naXQgYS9zcmMvaW50ZXJmYWNlcy9saWJwcS9mZS1zZWN1cmUtb3BlbnNzbC5jIGIv
c3JjL2ludGVyZmFjZXMvbGlicHEvZmUtc2VjdXJlLW9wZW5zc2wuYwppbmRleCA1YjRhNDE1
N2Q1Li42ZTQzOTY3OWU1IDEwMDY0NAotLS0gYS9zcmMvaW50ZXJmYWNlcy9saWJwcS9mZS1z
ZWN1cmUtb3BlbnNzbC5jCisrKyBiL3NyYy9pbnRlcmZhY2VzL2xpYnBxL2ZlLXNlY3VyZS1v
cGVuc3NsLmMKQEAgLTEwNjYsNiArMTA2NiwyNSBAQCBpbml0aWFsaXplX1NTTChQR2Nvbm4g
KmNvbm4pCiAJU1NMX0NUWF9mcmVlKFNTTF9jb250ZXh0KTsKIAlTU0xfY29udGV4dCA9IE5V
TEw7CiAKKwkvKgorCSAqIFNldCBTZXJ2ZXIgTmFtZSBJbmRpY2F0aW9uIChTTkkpLCBidXQg
bm90IGlmIGl0J3MgYSBsaXRlcmFsIElQIGFkZHJlc3MuCisJICogKFJGQyA2MDY2KQorCSAq
LworCWlmICghKChjb25uLT5wZ2hvc3RbMF0gPj0gJzAnICYmIGNvbm4tPnBnaG9zdFswXSA8
PSAnOScpIHx8IHN0cmNocihjb25uLT5wZ2hvc3QsICc6JykpKQorCXsKKwkJaWYgKFNTTF9z
ZXRfdGxzZXh0X2hvc3RfbmFtZShjb25uLT5zc2wsIGNvbm4tPnBnaG9zdCkgIT0gMSkKKwkJ
eworCQkJY2hhcgkgICAqZXJyID0gU1NMZXJybWVzc2FnZShFUlJfZ2V0X2Vycm9yKCkpOwor
CisJCQlhcHBlbmRQUUV4cEJ1ZmZlcigmY29ubi0+ZXJyb3JNZXNzYWdlLAorCQkJCQkJCSAg
bGlicHFfZ2V0dGV4dCgiY291bGQgbm90IHNldCBTU0wgU2VydmVyIE5hbWUgSW5kaWNhdGlv
biAoU05JKTogJXNcbiIpLAorCQkJCQkJCSAgZXJyKTsKKwkJCVNTTGVycmZyZWUoZXJyKTsK
KwkJCVNTTF9DVFhfZnJlZShTU0xfY29udGV4dCk7CisJCQlyZXR1cm4gLTE7CisJCX0KKwl9
CisKIAkvKgogCSAqIFJlYWQgdGhlIFNTTCBrZXkuIElmIGEga2V5IGlzIHNwZWNpZmllZCwg
dHJlYXQgaXQgYXMgYW4gZW5naW5lOmtleQogCSAqIGNvbWJpbmF0aW9uIGlmIHRoZXJlIGlz
IGNvbG9uIHByZXNlbnQgLSB3ZSBkb24ndCBzdXBwb3J0IGZpbGVzIHdpdGgKLS0gCjIuMzAu
MAoK
--------------B778BDAF4BCBA6917647FACF--