Content-Type: multipart/mixed; boundary="------------4WbehFBKBq0gNcVHMYNMfthJ"
Message-ID: <f1c0f7e9-6d40-42dc-9735-64ed014fd915@iki.fi>
Date: Tue, 23 Apr 2024 01:48:04 +0300
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: Direct SSL connection with ALPN and HBA rules
From: Heikki Linnakangas <hlinnaka@iki.fi>
To: Michael Paquier <michael@paquier.xyz>
Cc: Jacob Champion <jacob.champion@enterprisedb.com>,
 Postgres hackers <pgsql-hackers@lists.postgresql.org>
References: <ZiH7vHwEJeRKHlST@paquier.xyz>
 <c786e226-4039-4522-ba07-92501fce9b6a@iki.fi>
 <CAOYmi+kbYPX78nu0k7OODxUhoD6H1OXdugiMK1z9Nn33G-qdcQ@mail.gmail.com>
 <a0983295-67ae-487e-84e3-6e1148af3a25@iki.fi> <ZiYPmUZjcQtPz2j7@paquier.xyz>
 <feebbeee-df5f-484f-b07e-062bd0230bd2@iki.fi>
Content-Language: en-US
In-Reply-To: <feebbeee-df5f-484f-b07e-062bd0230bd2@iki.fi>
Archived-At: <https://www.postgresql.org/message-id/f1c0f7e9-6d40-42dc-9735-64ed014fd915%40iki.fi>
Precedence: bulk

This is a multi-part message in MIME format.
--------------4WbehFBKBq0gNcVHMYNMfthJ
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 8bit

On 22/04/2024 10:47, Heikki Linnakangas wrote:
> On 22/04/2024 10:19, Michael Paquier wrote:
>> On Sat, Apr 20, 2024 at 12:43:24AM +0300, Heikki Linnakangas wrote:
>>> On 19/04/2024 19:48, Jacob Champion wrote:
>>>> On Fri, Apr 19, 2024 at 6:56 AM Heikki Linnakangas <hlinnaka@iki.fi> wrote:
>>>>> With direct SSL negotiation, we always require ALPN.
>>>>
>>>>     (As an aside: I haven't gotten to test the version of the patch that
>>>> made it into 17 yet, but from a quick glance it looks like we're not
>>>> rejecting mismatched ALPN during the handshake as noted in [1].)
>>>
>>> Ah, good catch, that fell through the cracks. Agreed, the client should
>>> reject a direct SSL connection if the server didn't send ALPN. I'll add that
>>> to the Open Items so we don't forget again.
>>
>> Would somebody like to write a patch for that?  I'm planning to look
>> at this code more closely, as well.
> 
> I plan to write the patch later today.

Here's the patch for that. The error message is:

"direct SSL connection was established without ALPN protocol negotiation 
extension"

That's accurate, but I wonder if we could make it more useful to a user 
who's wondering what went wrong. I'd imagine that if the server doesn't 
support ALPN, it's because you have some kind of a (not necessarily 
malicious) generic SSL man-in-the-middle that doesn't support it. Or 
you're trying to connect to an HTTPS server. Suggestions welcome.

-- 
Heikki Linnakangas
Neon (https://neon.tech)

--------------4WbehFBKBq0gNcVHMYNMfthJ
Content-Type: text/x-patch; charset=UTF-8;
 name="require-alpn-in-direct-mode.patch"
Content-Disposition: attachment; filename="require-alpn-in-direct-mode.patch"
Content-Transfer-Encoding: base64

ZGlmZiAtLWdpdCBhL3NyYy9pbnRlcmZhY2VzL2xpYnBxL2ZlLWNvbm5lY3QuYyBiL3NyYy9p
bnRlcmZhY2VzL2xpYnBxL2ZlLWNvbm5lY3QuYwppbmRleCBlYzIwZTNmM2E5Li5mOTE1NmUy
OWNhIDEwMDY0NAotLS0gYS9zcmMvaW50ZXJmYWNlcy9saWJwcS9mZS1jb25uZWN0LmMKKysr
IGIvc3JjL2ludGVyZmFjZXMvbGlicHEvZmUtY29ubmVjdC5jCkBAIC0zNTI0LDYgKzM1MjQs
MTMgQEAga2VlcF9nb2luZzoJCQkJCQkvKiBXZSB3aWxsIGNvbWUgYmFjayB0byBoZXJlIHVu
dGlsIHRoZXJlIGlzCiAJCQkJcG9sbHJlcyA9IHBxc2VjdXJlX29wZW5fY2xpZW50KGNvbm4p
OwogCQkJCWlmIChwb2xscmVzID09IFBHUkVTX1BPTExJTkdfT0spCiAJCQkJeworCQkJCQkv
KiBBTFBOIGlzIG1hbmRhdG9yeSB3aXRoIGRpcmVjdCBTU0wgbmVnb3RpYXRpb24gKi8KKwkJ
CQkJaWYgKGNvbm4tPmN1cnJlbnRfZW5jX21ldGhvZCA9PSBFTkNfRElSRUNUX1NTTCAmJiAh
Y29ubi0+c3NsX2FscG5fdXNlZCkKKwkJCQkJeworCQkJCQkJbGlicHFfYXBwZW5kX2Nvbm5f
ZXJyb3IoY29ubiwgImRpcmVjdCBTU0wgY29ubmVjdGlvbiB3YXMgZXN0YWJsaXNoZWQgd2l0
aG91dCBBTFBOIHByb3RvY29sIG5lZ290aWF0aW9uIGV4dGVuc2lvbiIpOworCQkJCQkJQ09O
TkVDVElPTl9GQUlMRUQoKTsKKwkJCQkJfQorCiAJCQkJCS8qCiAJCQkJCSAqIEF0IHRoaXMg
cG9pbnQgd2Ugc2hvdWxkIGhhdmUgbm8gZGF0YSBhbHJlYWR5IGJ1ZmZlcmVkLgogCQkJCQkg
KiBJZiB3ZSBkbywgaXQgd2FzIHJlY2VpdmVkIGJlZm9yZSB3ZSBwZXJmb3JtZWQgdGhlIFNT
TApkaWZmIC0tZ2l0IGEvc3JjL2ludGVyZmFjZXMvbGlicHEvZmUtc2VjdXJlLW9wZW5zc2wu
YyBiL3NyYy9pbnRlcmZhY2VzL2xpYnBxL2ZlLXNlY3VyZS1vcGVuc3NsLmMKaW5kZXggZTdh
NGQwMDZlMS4uOGRmM2M3NTFkYiAxMDA2NDQKLS0tIGEvc3JjL2ludGVyZmFjZXMvbGlicHEv
ZmUtc2VjdXJlLW9wZW5zc2wuYworKysgYi9zcmMvaW50ZXJmYWNlcy9saWJwcS9mZS1zZWN1
cmUtb3BlbnNzbC5jCkBAIC0xNTg1LDYgKzE1ODUsMzEgQEAgb3Blbl9jbGllbnRfU1NMKFBH
Y29ubiAqY29ubikKIAkJfQogCX0KIAorCS8qIEdldCB0aGUgcHJvdG9jb2wgc2VsZWN0ZWQg
YnkgQUxQTiAqLworCXsKKwkJY29uc3QgdW5zaWduZWQgY2hhciAqc2VsZWN0ZWQ7CisJCXVu
c2lnbmVkIGludCBsZW47CisKKwkJU1NMX2dldDBfYWxwbl9zZWxlY3RlZChjb25uLT5zc2ws
ICZzZWxlY3RlZCwgJmxlbik7CisKKwkJLyogSWYgQUxQTiBpcyB1c2VkLCBjaGVjayB0aGF0
IHdlIG5lZ290aWF0ZWQgdGhlIGV4cGVjdGVkIHByb3RvY29sICovCisJCWlmIChzZWxlY3Rl
ZCAhPSBOVUxMKQorCQl7CisJCQlpZiAobGVuID09IHN0cmxlbihQR19BTFBOX1BST1RPQ09M
KSAmJgorCQkJCW1lbWNtcChzZWxlY3RlZCwgUEdfQUxQTl9QUk9UT0NPTCwgc3RybGVuKFBH
X0FMUE5fUFJPVE9DT0wpKSA9PSAwKQorCQkJeworCQkJCWNvbm4tPnNzbF9hbHBuX3VzZWQg
PSB0cnVlOworCQkJfQorCQkJZWxzZQorCQkJeworCQkJCS8qIHNob3VsZG4ndCBoYXBwZW4g
Ki8KKwkJCQlsaWJwcV9hcHBlbmRfY29ubl9lcnJvcihjb25uLCAiU1NMIGNvbm5lY3Rpb24g
d2FzIGVzdGFibGlzaGVkIHdpdGggdW5leHBlY3RlZCBBTFBOIHByb3RvY29sIik7CisJCQkJ
cGd0bHNfY2xvc2UoY29ubik7CisJCQkJcmV0dXJuIFBHUkVTX1BPTExJTkdfRkFJTEVEOwor
CQkJfQorCQl9CisJfQorCiAJLyoKIAkgKiBXZSBhbHJlYWR5IGNoZWNrZWQgdGhlIHNlcnZl
ciBjZXJ0aWZpY2F0ZSBpbiBpbml0aWFsaXplX1NTTCgpIHVzaW5nCiAJICogU1NMX0NUWF9z
ZXRfdmVyaWZ5KCksIGlmIHJvb3QuY3J0IGV4aXN0cy4KQEAgLTE2MzIsNiArMTY1Nyw3IEBA
IHBndGxzX2Nsb3NlKFBHY29ubiAqY29ubikKIAkJCWNvbm4tPnNzbCA9IE5VTEw7CiAJCQlj
b25uLT5zc2xfaW5fdXNlID0gZmFsc2U7CiAJCQljb25uLT5zc2xfaGFuZHNoYWtlX3N0YXJ0
ZWQgPSBmYWxzZTsKKwkJCWNvbm4tPnNzbF9hbHBuX3VzZWQgPSBmYWxzZTsKIAogCQkJZGVz
dHJveV9uZWVkZWQgPSB0cnVlOwogCQl9CmRpZmYgLS1naXQgYS9zcmMvaW50ZXJmYWNlcy9s
aWJwcS9saWJwcS1pbnQuaCBiL3NyYy9pbnRlcmZhY2VzL2xpYnBxL2xpYnBxLWludC5oCmlu
ZGV4IDM2OTFlNWVlOTYuLmE2NzkyOTE3Y2YgMTAwNjQ0Ci0tLSBhL3NyYy9pbnRlcmZhY2Vz
L2xpYnBxL2xpYnBxLWludC5oCisrKyBiL3NyYy9pbnRlcmZhY2VzL2xpYnBxL2xpYnBxLWlu
dC5oCkBAIC01NjksNiArNTY5LDcgQEAgc3RydWN0IHBnX2Nvbm4KIAlib29sCQlzc2xfaGFu
ZHNoYWtlX3N0YXJ0ZWQ7CiAJYm9vbAkJc3NsX2NlcnRfcmVxdWVzdGVkOyAvKiBEaWQgdGhl
IHNlcnZlciBhc2sgdXMgZm9yIGEgY2VydD8gKi8KIAlib29sCQlzc2xfY2VydF9zZW50Owkv
KiBEaWQgd2Ugc2VuZCBvbmUgaW4gcmVwbHk/ICovCisJYm9vbAkJc3NsX2FscG5fdXNlZDsJ
LyogRGlkIHdlIG5lZ290aWF0ZSBhIHByb3RvY29sIHdpdGggVExTIEFMUE4/ICovCiAKICNp
ZmRlZiBVU0VfU1NMCiAjaWZkZWYgVVNFX09QRU5TU0wK

--------------4WbehFBKBq0gNcVHMYNMfthJ--