Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1s1W6n-00CreG-88 for pgsql-hackers@arkaria.postgresql.org; Mon, 29 Apr 2024 18:52:13 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.94.2) (envelope-from ) id 1s1W6k-001Sky-Ew for pgsql-hackers@arkaria.postgresql.org; Mon, 29 Apr 2024 18:52:11 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from ) id 1s1W6k-001Skp-56 for pgsql-hackers@lists.postgresql.org; Mon, 29 Apr 2024 18:52:11 +0000 Received: from mail-qv1-xf2e.google.com ([2607:f8b0:4864:20::f2e]) by magus.postgresql.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.94.2) (envelope-from ) id 1s1W6h-000iZL-MN for pgsql-hackers@lists.postgresql.org; Mon, 29 Apr 2024 18:52:09 +0000 Received: by mail-qv1-xf2e.google.com with SMTP id 6a1803df08f44-69b50b8239fso44810346d6.0 for ; Mon, 29 Apr 2024 11:52:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=enterprisedb.com; s=google; t=1714416725; x=1715021525; darn=lists.postgresql.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=DAAMdFGBJ24Ep2ObXYRpLQwiyvbQcY0SFe11ThNEgHU=; b=NoQk9f+tQNWOBVIDaeEP4kXdG+7MxzGTKSAvyatWAeHs1GEl0bvzxGVZGI6Vy56SaV 2UokxbG/vN8FQ510pm/GCR4006m95hekeDnhRxZmHHaQWcrEEfoWiOFYiD4JnAupgaG3 v9YB6uroU7OX+1+5Uu5jYJHATpl0Hwgi+6O4fPmjRRxMxMhfWTjLUmP1ylysvEd9Lfcg /mAIvQMyCH+857h6NFV3ssO7/wA2lmnLhPLd9y1fJEOLjvfJ++XU2qYDKSyVZ6Xpb4qc wXR+tULicmPUrf77MaNJcnkSa0wtfKNcN547aJwv1SQl7tdBBsLshvtSRT6zqXeAVrAB zwDw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1714416725; x=1715021525; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=DAAMdFGBJ24Ep2ObXYRpLQwiyvbQcY0SFe11ThNEgHU=; b=wh+w4+D8/McAsiLzdPSdMWd7FE02DpEQMfTNKGD/h1z2yvxM5ypoWVPB+2R0fB9SZ3 rrX6HfNu/WwbHUJnM3M1JczkVlAEOnRgk++DuWGE2emK4D6w73f4adjMADv6f1nNtVbL uOKShnCrwYNiRhPWNMwIFFdrAEJtP8qCa1/ozXFRlrYsi5cVAH0T9z97OD5CG5ecAFz8 9QePzTTKm9Iod2rhWJ/qNvH+idXGa0v8gR5pZ0EkUwPznH3HoD5EOgpjAvO2cfIFt+/r gZsiFkTsuP996Pzi1BM30OfZlO7aETepu0pu6a3AxZ2ExCYSfQnmpP/iNVgHe1KjnNfi G/rw== X-Forwarded-Encrypted: i=1; AJvYcCWx2vyJw+fsaWMygW4hK7DUqSSirn7OhhVEXoLnhXIiqV4Z5YHqabJ8t1f6ILX4brBT3W81NdRaZhSFtCD2OktgS8e5jOjuFnqGGlTN/i3WVffm X-Gm-Message-State: AOJu0Yz9GCM8QtbHchVTVVrEM+tF/MfF+i7g8/FeBOyqZoG6ck8Uid/1 DxOYTYEHfm/D6otvhy8gF1V1x5LxNRW1UcSr5SdcJmrd17KCJxiMGad46Fc3ix+c6K3mk1Vj6w2 g3M4t9Yd1HjPSzTvq+/bVSrYTbwAFKYGCPr2UXZNf3Lz/pNA= X-Google-Smtp-Source: AGHT+IGbqDgy8InvFJ143zqh40QNSUPVtiOcCZkTfzTq86eusVXvDwZ7pbXc/xBpbwV0dO5A3Eof1zhFAEAikIf7tzc= X-Received: by 2002:a0c:ed46:0:b0:6a0:8886:b888 with SMTP id v6-20020a0ced46000000b006a08886b888mr861511qvq.13.1714416725648; Mon, 29 Apr 2024 11:52:05 -0700 (PDT) MIME-Version: 1.0 References: <6aedcaa5-60f3-49af-a857-2c76ba55a1f3@iki.fi> In-Reply-To: From: Jacob Champion Date: Mon, 29 Apr 2024 11:51:54 -0700 Message-ID: Subject: Re: Direct SSL connection with ALPN and HBA rules To: Heikki Linnakangas Cc: Michael Paquier , Postgres hackers Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Archived-At: Precedence: bulk On Mon, Apr 29, 2024 at 11:43=E2=80=AFAM Heikki Linnakangas wrote: > Note that if the client does not request ALPN at all, the callback is > not called, and the connection is accepted. Old clients still work > because they do not request ALPN. Ugh, sorry for the noise -- I couldn't figure out why all my old clients were failing and then realized it was because I'd left some test code in place for the OpenSSL bug. I'll rebuild everything and keep reviewing. --Jacob