Re: Frontend/Backend Protocol: SSL / GSS Protocol Negotiation Problem - Mailing list pgsql-hackers

From Jakob Egger
Subject Re: Frontend/Backend Protocol: SSL / GSS Protocol Negotiation Problem
Date
Msg-id A2171014-AF39-4231-B162-B094302E1C65@eggerapps.at
Whole thread Raw
In response to Re: Frontend/Backend Protocol: SSL / GSS Protocol Negotiation Problem  (Andrew Gierth <andrew@tao11.riddles.org.uk>)
List pgsql-hackers
> On 6. Dec 2019, at 16:45, Andrew Gierth <andrew@tao11.riddles.org.uk> wrote:
>
>>>>>> "Jakob" == Jakob Egger <jakob@eggerapps.at> writes:
>
> Jakob> But this also needs to be fixed on the client side as well,
> Jakob> otherwise affected clients can't connect to older servers
> Jakob> anymore.
>
> There's a workaround, which is to set PGGSSENCMODE=disable on the
> client.
>
> It would be far better to avoid complicating the client side with this
> if we can possibly do so.

As far as I understand, the bug impacts clients version 12.0 or later who have Kerberos when connecting to 12.0 or 12.1
serversthat don't have Kerberos. (Assuming that the bug will be fixed server side in 12.2) 

I don't know how many people use Kerberos, so I can't say if it's worth the additional complexiity to work around the
bug.

In any case, the workaround should probably be documented somewhere:

If you try to connect to a PostgreSQL 12.0 or 12.1 server and you get the following error message:

psql: error: could not connect to server: FATAL: unsupported frontend protocol 1234.5679: server supports 2.0 to 3.0

Then you need to use the connection parameter gssencmode=disable

Is there a place where such workarounds are documented, or do we rely on Google indexing the mailing list archive?

Best regards,

Jakob


pgsql-hackers by date:

Previous
From: Andrew Dunstan
Date:
Subject: Re: Using XLogFileNameP in critical section
Next
From: Alvaro Herrera
Date:
Subject: Re: log bind parameter values on error