Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1s7bZY-006NG6-0O for pgsql-hackers@arkaria.postgresql.org; Thu, 16 May 2024 13:55:05 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1s7bYZ-009GxT-NG for pgsql-hackers@arkaria.postgresql.org; Thu, 16 May 2024 13:54:03 +0000 Received: from makus.postgresql.org ([2001:4800:3e1:1::229]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1s7bYZ-009GxL-Da for pgsql-hackers@lists.postgresql.org; Thu, 16 May 2024 13:54:03 +0000 Received: from mail-ed1-x533.google.com ([2a00:1450:4864:20::533]) by makus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.94.2) (envelope-from ) id 1s7bYW-000VJB-TB for pgsql-hackers@lists.postgresql.org; Thu, 16 May 2024 13:54:02 +0000 Received: by mail-ed1-x533.google.com with SMTP id 4fb4d7f45d1cf-5731ffcc905so3888019a12.2 for ; Thu, 16 May 2024 06:54:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1715867639; x=1716472439; darn=lists.postgresql.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=MRAZIhIQihknhXibIb1Gnbunm9V/6sD/MBZUCR+HkeA=; b=eVJ2I6yrXsd+nffgiiC1NeQ18ypNGCfnoa2lKIXO0vb9IWZMAp8Soij1fsjbo+VsYF gSw+Nb30Ps/JxF0CH/y7Yun2rNTtXvMFisEcMSh2kufRIZCMa2a71q5nIQcvqOim0JVq 4Az1/oxu5wxQcAY3jg9mdd1v7g+h982GWjJB1lYhB/Bjzs0PQ79uzUixx88QiHWjdUtP 5YMY4dwEl75v6z9Lpeq+ch+0/akU3j7rw+RaOP3NjN8uFpg8iQaeWlSKhcS1IWhQRswc VMwcU5hGwUH0Jxpy2QrBuqk1smyNgaWOLSkPxoooVZYAVO9yVgiNjqV2CZOl+gnfw0uS wDbQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1715867639; x=1716472439; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=MRAZIhIQihknhXibIb1Gnbunm9V/6sD/MBZUCR+HkeA=; b=N+ZZHT84vR1vRfYydimS/k1S1sx+76fVim93PRiEUDewf8kq1OkZhOsEBUcFFoyG3c G8pOqc3NxQZzVCtZfisx1/q+8T8TgqL7GG7gte8x42AvKP04uaGnyEbSGrjACKsyPy+h mqs27yiuhg3yGdQvA0S3AxQvm5ML9dXRqWMUKxPZrFKqgUt4hIVfKAUa1hpl46OC0gJW YGnzbQcUGSUFTUdepcKKrfKBBE8djyx78/MV/3z4AUv27omEPKxnMv50mkyLL+nr1IJR Phmv5k+JUOHqMQuKAUkKcLnxrIaEQRQUG61Cs9GLvm28Or+BCaw9CphM7KyIIWlO6Z3S ga/A== X-Forwarded-Encrypted: i=1; AJvYcCV+CXZk/hZfLcNC3MGCJFa0KBs0tw2BjJFk532IQSl2fDXNb5tLEVgHVisNzU4NLKGJ1j1jNgK7zOGvb1kaRb8kJCt8xqvEDJKQvukCyPAbSob4 X-Gm-Message-State: AOJu0YxQkK8HybnzQKulTEHlt0+E4MdT35bxlrX3ErgTYK4xLdzS3+PD wGT+plpzDm1ojtITsDFah0uQI8IAhIQXUOCqLGqHwMWBGWKrjitGR9bivJci9E1NLtwaoW+ziK7 2zzo7uxu/KzQZk4VQI+6vbHROjGY= X-Google-Smtp-Source: AGHT+IFlMQRNiH89588sOw0N1fDaPPYh+zrdUBnnbYdf+BoEMY70rEbH0oFJmfhSsyxqveAG5NiIT75nEvjdWHxRhcM= X-Received: by 2002:a17:906:235b:b0:a59:a532:ed58 with SMTP id a640c23a62f3a-a5a2d55ac04mr1157144166b.28.1715867639029; Thu, 16 May 2024 06:53:59 -0700 (PDT) MIME-Version: 1.0 References: <3a6f126c-e1aa-4dcc-9252-9868308f6cf0@iki.fi> <1a717f65-7390-4111-8efd-c6e9b213805e@iki.fi> <3fdaf4b1-82d1-45bb-8175-f97ff53a1f01@iki.fi> <2b5b0c20-c531-4f51-a169-17617ba73dd6@iki.fi> In-Reply-To: <2b5b0c20-c531-4f51-a169-17617ba73dd6@iki.fi> From: Robert Haas Date: Thu, 16 May 2024 09:53:47 -0400 Message-ID: Subject: Re: Direct SSL connection with ALPN and HBA rules To: Heikki Linnakangas Cc: Jacob Champion , Daniel Gustafsson , Michael Paquier , Postgres hackers Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk On Wed, May 15, 2024 at 9:33=E2=80=AFAM Heikki Linnakangas wrote: > Ok, yeah, I can see that now. Here's a new version to address that. I > merged ENC_SSL_NEGOTIATED_SSL and ENC_SSL_DIRECT_SSL to a single method, > ENC_SSL. The places that need to distinguish between them now check > conn-sslnegotiation. That seems more clear now that there is no fallback. Unless there is a compelling reason to do otherwise, we should expedite getting this committed so that it is included in beta1. Release freeze begins Saturday. Thanks, --=20 Robert Haas EDB: http://www.enterprisedb.com