Feedback-ID: i0fe9450f:Fastmail
Date: Tue, 23 Apr 2024 16:07:32 +0900
From: Michael Paquier <michael@paquier.xyz>
To: Heikki Linnakangas <hlinnaka@iki.fi>
Cc: Jacob Champion <jacob.champion@enterprisedb.com>,
	Postgres hackers <pgsql-hackers@lists.postgresql.org>
Subject: Re: Direct SSL connection with ALPN and HBA rules
Message-ID: <ZideNHji0G4gxmc3@paquier.xyz>
References: <ZiH7vHwEJeRKHlST@paquier.xyz>
 <c786e226-4039-4522-ba07-92501fce9b6a@iki.fi>
 <CAOYmi+kbYPX78nu0k7OODxUhoD6H1OXdugiMK1z9Nn33G-qdcQ@mail.gmail.com>
 <a0983295-67ae-487e-84e3-6e1148af3a25@iki.fi>
 <ZiYPmUZjcQtPz2j7@paquier.xyz>
 <feebbeee-df5f-484f-b07e-062bd0230bd2@iki.fi>
 <f1c0f7e9-6d40-42dc-9735-64ed014fd915@iki.fi>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="xxsayu6cmz3xNbws"
Content-Disposition: inline
In-Reply-To: <f1c0f7e9-6d40-42dc-9735-64ed014fd915@iki.fi>
Archived-At: <https://www.postgresql.org/message-id/ZideNHji0G4gxmc3%40paquier.xyz>
Precedence: bulk


--xxsayu6cmz3xNbws
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Tue, Apr 23, 2024 at 01:48:04AM +0300, Heikki Linnakangas wrote:
> Here's the patch for that. The error message is:
>=20
> "direct SSL connection was established without ALPN protocol negotiation
> extension"

WFM.

> That's accurate, but I wonder if we could make it more useful to a user
> who's wondering what went wrong. I'd imagine that if the server doesn't
> support ALPN, it's because you have some kind of a (not necessarily
> malicious) generic SSL man-in-the-middle that doesn't support it. Or you'=
re
> trying to connect to an HTTPS server. Suggestions welcome.

Hmm.  Is there any point in calling SSL_get0_alpn_selected() in
open_client_SSL() to get the ALPN if current_enc_method is not
ENC_DIRECT_SSL?

In the documentation of PQsslAttribute(), it is mentioned that empty
string is returned for "alpn" if ALPN was not used, however the code
returns NULL in this case:
        SSL_get0_alpn_selected(conn->ssl, &data, &len);
        if (data =3D=3D NULL || len =3D=3D 0 || len > sizeof(alpn_str) - 1)
            return NULL;
--
Michael

--xxsayu6cmz3xNbws
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAmYnXjQACgkQnvQgOdby
QH2BOQ//fAhrLiY0vxTIvj7/JN1Uazo0z3sIdS62ydcj9L/HlhaBPBpgVmdlzFqs
AXU2MN0oZR5yBIA481cxEO+wSa1Nku6wSNtcK/r0tEsBCxtYLQZvVfBJgnY6c0jG
2ZxVTyE03Gthf0tRtt9V7hJnYEOpPXekWiWLZ0cSa9hixyoi6UEb7ayD4qmAl5+W
vbQmOAj5LmCPNkAo0zhJTq+OiBBcK2PXBwYf7+qdIasqWIY8SbcymnUZ6w1pwv4O
w99UoTlRfFonypYNS1xZaXDx4MZSdCKF6d2z6kPt63u3Viwrs2a6QUfrW/sgkSnE
mZOBswn82AGb40Jm6BsG1M8Qv4+PTwzcVyg892s5z/gSbcKlJDYisMydbQe9EbBu
1upsqLviXKxwVYYLFifx3SR/Ne8wxZkPa/41EwL08YdBUYJOXZ3+hMrwKFkcEKa/
JjTym1x4NdyYoSdlO3FgTj6eeAmtTd1k7ujfTmteKpBtqbya3G48H1OydT0JfMcN
rQy//hicSbiE/1ApMa9KG4v5C+EHGj9tghVQ3sT8505mWd3htjaok1+yq3/1nElB
znp2KSEzAoyuKpZk20LcXtFnOwVy5wQZBBP5joqNou33ewkrCHVBa43wn4s4yy63
5mwZ2X0CIKvYvE0cRQAnNd8g+vAVUAHcivRJTc6Z4/umVhKYX8s=
=6/EN
-----END PGP SIGNATURE-----

--xxsayu6cmz3xNbws--