Re: Experiments with Postgres and SSL

Greg Stark <stark@mit.edu>

View thread

From: Greg Stark <stark@mit.edu>

To: Vladimir Sitnikov <sitnikov.vladimir@gmail.com>

Cc: Andrey Borodin <amborodin86@gmail.com>, PostgreSQL-development <pgsql-hackers@postgresql.org>

Date: 2023-03-20T20:31:03Z

Lists: pgsql-hackers

Attachments

v3-0004-alpn-support.patch (text/x-patch) patch v3-0004
v3-0001-Direct-SSL-connections-postmaster-support.patch (text/x-patch) patch v3-0001
v3-0002-Direct-SSL-connections-client-support.patch (text/x-patch) patch v3-0002
v3-0003-Direct-SSL-connections-documentation.patch (text/x-patch) patch v3-0003

Here's a first cut at ALPN support.

Currently it's using a hard coded "Postgres/3.0" protocol (hard coded
both in the client and the server...). And it's hard coded to be
required for direct connections and supported but not required for
regular connections.

IIRC I put a variable labeled a "GUC" but forgot to actually make it a
GUC. But I'm thinking of maybe removing that variable since I don't
see much of a use case for controlling this manually. I *think* ALPN
is supported by all the versions of OpenSSL we support.

The other patches are unchanged (modulo a free() that I missed in the
client before). They still have the semi-open issues I mentioned in
the previous email.




--
greg

Commits

Same data as JSON: GET /api/v1/messages/:b64id/commits the thread's linked commits as JSON, with link sources. API reference →

Enhance libpq encryption negotiation tests with new GUC
- 705843d294d5 17.0 landed
With gssencmode='require', check credential cache before connecting
- 20f9b61cc192 17.0 landed
Add tests for libpq gssencmode and sslmode options
- 1169920ff770 17.0 landed
Move Kerberos module
- 9f899562d420 17.0 landed
Give nicer error message when connecting to a v10 server requiring SCRAM.
- 96d0f988b150 9.4.12 cited