MIME-Version: 1.0
References: <ZiH7vHwEJeRKHlST@paquier.xyz> <CAOYmi+kfsRfopQRTuJwpsO50Urq=-gwYDJ1fWNkDr3oYM1wdjA@mail.gmail.com>
 <CA+TgmoZspODpL6AYbANpffhbF+Q12xo1pHXrR9ZSkYfEQWpP3w@mail.gmail.com>
 <CAOYmi+k3x-aKiVzyLfzdxFdmcBmVD8UvcwfB075BkNqyA1aa9w@mail.gmail.com>
 <CA+TgmobR1R8q-rT06oWdLw_Kp_i67Uey9b+rWVrrpCJVSDNBFQ@mail.gmail.com>
 <CAOYmi+=TB8=yfXoBk=p0k0GPaCD79F8xXcypZFkjKmPKuT0hjQ@mail.gmail.com>
 <f6833e88-2e21-459d-a661-152ced273c60@iki.fi> <CAOYmi+nWKJNihuMpT+ZVTC5-d+pQdACTK7xKhhwAB075EHrOMg@mail.gmail.com>
 <3a6f126c-e1aa-4dcc-9252-9868308f6cf0@iki.fi> <CAOYmi+k2kJcJLMj=K4Vb3S_J6tN6989Wfi5+amqf15VkHcej3Q@mail.gmail.com>
 <1a717f65-7390-4111-8efd-c6e9b213805e@iki.fi> <CAOYmi+mAfO2hXfpOrpjhSZZf7Rq-rCywdyyfygkqbZ0KZjOBTg@mail.gmail.com>
 <d3b1608a-a1b6-4eda-9ec5-ddb3e4375808@iki.fi> <3fdaf4b1-82d1-45bb-8175-f97ff53a1f01@iki.fi>
 <CA+TgmoayZ5pBHqgfrYeZQ1dsubSLazq0CLfHM8m=dC1YrPL+UQ@mail.gmail.com>
 <CAOYmi+k367=YR1kr04bcMusVWiJBA8ZPTC=_ASSdLSd4RTB1iw@mail.gmail.com> <2b5b0c20-c531-4f51-a169-17617ba73dd6@iki.fi>
In-Reply-To: <2b5b0c20-c531-4f51-a169-17617ba73dd6@iki.fi>
From: Jacob Champion <jacob.champion@enterprisedb.com>
Date: Wed, 15 May 2024 11:24:00 -0700
Message-ID: <CAOYmi+nuXOoA=PUq9-Sm8jM+5PbPwznEzRNWS3phX7YE8QwWOg@mail.gmail.com>
Subject: Re: Direct SSL connection with ALPN and HBA rules
To: Heikki Linnakangas <hlinnaka@iki.fi>
Cc: Robert Haas <robertmhaas@gmail.com>, Daniel Gustafsson <daniel@yesql.se>, 
	Michael Paquier <michael@paquier.xyz>, Postgres hackers <pgsql-hackers@lists.postgresql.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Archived-At: <https://www.postgresql.org/message-id/CAOYmi%2BnuXOoA%3DPUq9-Sm8jM%2B5PbPwznEzRNWS3phX7YE8QwWOg%40mail.gmail.com>
Precedence: bulk

On Wed, May 15, 2024 at 6:33=E2=80=AFAM Heikki Linnakangas <hlinnaka@iki.fi=
> wrote:
> Ok, yeah, I can see that now. Here's a new version to address that. I
> merged ENC_SSL_NEGOTIATED_SSL and ENC_SSL_DIRECT_SSL to a single method,
> ENC_SSL. The places that need to distinguish between them now check
> conn-sslnegotiation. That seems more clear now that there is no fallback.

That change and the new comment that were added seem a lot clearer to
me, too; +1. And I like that this potentially preps for
encryption=3Dgss/ssl/none or similar.

This assertion seems a little strange to me:

>                   if (conn->sslnegotiation[0] =3D=3D 'p')
>                   {
>                       ProtocolVersion pv;
>
>                       Assert(conn->sslnegotiation[0] =3D=3D 'p');

But other than that nitpick, nothing else jumps out at me at the moment.

Thanks,
--Jacob