MIME-Version: 1.0
References: <1C81CD0D-407E-44F9-833A-DD0331C202E5@yesql.se> <171658048932.1105.8754500817650927969.pgcf@coridan.postgresql.org>
In-Reply-To: <171658048932.1105.8754500817650927969.pgcf@coridan.postgresql.org>
From: Jacob Champion <jacob.champion@enterprisedb.com>
Date: Thu, 25 Jul 2024 11:00:41 -0700
Message-ID: <CAOYmi+=ZjGJLw8tCkzY88acd=ir1r8eAxO-+5wXm9gtCUV97Sg@mail.gmail.com>
Subject: Re: Serverside SNI support in libpq
To: Cary Huang <cary.huang@highgo.ca>
Cc: pgsql-hackers@lists.postgresql.org, Daniel Gustafsson <daniel@yesql.se>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://www.postgresql.org/message-id/CAOYmi%2B%3DZjGJLw8tCkzY88acd%3Dir1r8eAxO-%2B5wXm9gtCUV97Sg%40mail.gmail.com>
Precedence: bulk

On Fri, May 24, 2024 at 12:55=E2=80=AFPM Cary Huang <cary.huang@highgo.ca> =
wrote:
> pg_hosts should also have sslpassword_command just like in the postgresql=
.conf in
> case the sslkey for a particular host is encrypted with a different passw=
ord.

Good point. There is also the HBA-related handling of client
certificate settings (such as pg_ident)...

I really dislike that these things are governed by various different
files, but I also feel like I'm opening up a huge can of worms by
requesting nestable configurations.

> +       if (ssl_snimode !=3D SSL_SNIMODE_OFF)
> +               SSL_CTX_set_tlsext_servername_callback(context, sni_serve=
rname_cb);
>
> If libpq client does not provide SNI, this callback will not be called, s=
o there
> is not a chance to check for a hostname match from pg_hosts, swap the TLS=
 CONTEXT,
> or possibly reject the connection even in strict mode.

I'm mistrustful of my own test setup (see previous email to the
thread), but I don't seem to be able to reproduce this. With sslsni=3D0
set, strict mode correctly shuts down the connection for me. Can you
share your setup?

(The behavior you describe might be a useful setting in practice, to
let DBAs roll out strict protection for new clients gracefully without
immediately blocking older ones.)

Thanks,
--Jacob