Feedback-ID: i0fe9450f:Fastmail
Date: Fri, 19 Apr 2024 14:06:04 +0900
From: Michael Paquier <michael@paquier.xyz>
To: Postgres hackers <pgsql-hackers@lists.postgresql.org>
Subject: Direct SSL connection with ALPN and HBA rules 
Message-ID: <ZiH7vHwEJeRKHlST@paquier.xyz>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="3NdCv67WViAsWkUy"
Content-Disposition: inline
Archived-At: <https://www.postgresql.org/message-id/ZiH7vHwEJeRKHlST%40paquier.xyz>
Precedence: bulk


--3NdCv67WViAsWkUy
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

Hi all,
(Heikki in CC.)

Since 91044ae4baea (require ALPN for direct SSL connections) and
d39a49c1e459 (direct hanshake), direct SSL connections are supported
(yeah!), still the thread where this has been discussed does not cover
the potential impact on HBA rules:
https://www.postgresql.org/message-id/CAM-w4HOEAzxyY01ZKOj-iq%3DM4-VDk%3DvzQgUsuqiTFjFDZaebdg%40mail.gmail.com

My point is, would there be a point in being able to enforce that ALPN
is used from the server rather than just relying on the client-side
sslnegotiation to decide if direct SSL connections should be forced or
not?

Hence, I'd imagine that we could have an HBA option for hostssl rules,
like a negotiation={direct,postgres,all} that cross-checks
Port->alpn_used with the option value in a hostssl entry, rejecting
the use of connections using direct connections or the default
protocol if these are not used, giving users a way to avoid one.  As
this is a new thing, there may be an argument in this option for
security reasons, as well, so as it would be possible for operators to
turn that off in the server.

Thoughts or comments?
--
Michael

--3NdCv67WViAsWkUy
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAmYh+7wACgkQnvQgOdby
QH14uw//dmGU9BLVFDl2HkVPWEZmIQPr/WCycU5ayJRtYlkEknFBFYZEX7xndwLn
Qq5PbgXQChKyeVSAwtgGhMGItM310+OT7cdwCyLmwXgR2T7otgAZysTFEnga71hu
+Xt3gkAL7/49vl8j/knjXEcVZZURg1n1qS5FIdUZGw+t/3+D63/f3NE352BsgaO5
smQ/RnOMqti/uCeMWoqluishrguJ6jV1M03RU0PnZbijHwBBJIJ0NU8cXoAJIIlx
bcCZlUmr7A+N4N1Q/ljbMLcL7ZRNvqdNlXU3+z4oGTabjIiwycSwdArAIp1iSp1o
zDJrFremLtNulKJTGUhfmBufw34A6MyodCtNa19CwEEyO7/Iw039z1Fx8ZAtjMLp
mh3rSwuMp4Pt1PfD0Aok8TYHq9/2TmSj4jofRMntpKdkyrZqJ++zKvF7Pw4bPq5s
1H3/pnIWGyCYumHnxwQlCM2PZc2wZO09IAmpuB8OwNj7olVK/KLy4Mc3NEcWHjuW
FyuDQtyWt+qCT8WekwzpbTu+64hMCJuq4b1X0NH/GS1G5kig1uy0sPQ1HKceWAAt
LvjVU7LjxOmnx4dlobkLDSd98R3SMiqtC+KO9f1k8HduVLl72llfJfsnj4jKvaoK
VFtQEkmnLEvc0Fg+jvrtN5y+REFg4p4ybejc2cyiy3eLo+eMnWU=
=agB9
-----END PGP SIGNATURE-----

--3NdCv67WViAsWkUy--