Re: Direct SSL connection with ALPN and HBA rules

On Thu, Apr 25, 2024 at 10:35 AM Robert Haas <robertmhaas@gmail.com> wrote:
> Maybe I'm missing something here, but why doesn't sslnegotiation
> override sslmode completely? Or alternatively, why not remove
> sslnegotiation entirely and just have more sslmode values? I mean
> maybe this shouldn't happen categorically, but if I say I want to
> require a direct SSL connection, to me that implies that I don't want
> an indirect SSL connection, and I really don't want a non-SSL
> connection.

I think that comes down to the debate upthread, and whether you think
it's a performance tweak or a security feature. My take on it is,
`direct` mode is performance, and `requiredirect` is security.
(Especially since, with the current implementation, requiredirect can
slow things down?)

> I think it's pretty questionable in 2024 whether sslmode=allow and
> sslmode=prefer make any sense at all. I don't think it would be crazy
> to remove them entirely. But I certainly don't think that they should
> be allowed to bleed into the behavior of new, higher-security
> configurations. Surely if I say I want direct SSL, it's that or
> nothing, right?

I agree, but I more or less lost the battle at [1]. Like Matthias
mentioned in [2]:

> I'm not sure about this either. The 'gssencmode' option is already
> quite weird in that it seems to override the "require"d priority of
> "sslmode=require", which it IMO really shouldn't.

Thanks,
--Jacob

[1] https://www.postgresql.org/message-id/CAOYmi%2B%3DcnV-8V8TndSkEF6Htqa7qHQUL_KnQU8-DrT0Jjnm3_Q%40mail.gmail.com
[2] https://www.postgresql.org/message-id/CAEze2Wi9j5Q3mRnuoD2Hr%3DeOFV-cMzWAUZ88YmSXSwsiJLQOWA%40mail.gmail.com