Re: Direct SSL connection with ALPN and HBA rules - Mailing list pgsql-hackers

From Jacob Champion
Subject Re: Direct SSL connection with ALPN and HBA rules
Date
Msg-id CAOYmi+=TB8=yfXoBk=p0k0GPaCD79F8xXcypZFkjKmPKuT0hjQ@mail.gmail.com
Whole thread Raw
In response to Re: Direct SSL connection with ALPN and HBA rules  (Robert Haas <robertmhaas@gmail.com>)
Responses Re: Direct SSL connection with ALPN and HBA rules
List pgsql-hackers
On Thu, Apr 25, 2024 at 10:35 AM Robert Haas <robertmhaas@gmail.com> wrote:
> Maybe I'm missing something here, but why doesn't sslnegotiation
> override sslmode completely? Or alternatively, why not remove
> sslnegotiation entirely and just have more sslmode values? I mean
> maybe this shouldn't happen categorically, but if I say I want to
> require a direct SSL connection, to me that implies that I don't want
> an indirect SSL connection, and I really don't want a non-SSL
> connection.

I think that comes down to the debate upthread, and whether you think
it's a performance tweak or a security feature. My take on it is,
`direct` mode is performance, and `requiredirect` is security.
(Especially since, with the current implementation, requiredirect can
slow things down?)

> I think it's pretty questionable in 2024 whether sslmode=allow and
> sslmode=prefer make any sense at all. I don't think it would be crazy
> to remove them entirely. But I certainly don't think that they should
> be allowed to bleed into the behavior of new, higher-security
> configurations. Surely if I say I want direct SSL, it's that or
> nothing, right?

I agree, but I more or less lost the battle at [1]. Like Matthias
mentioned in [2]:

> I'm not sure about this either. The 'gssencmode' option is already
> quite weird in that it seems to override the "require"d priority of
> "sslmode=require", which it IMO really shouldn't.

Thanks,
--Jacob

[1] https://www.postgresql.org/message-id/CAOYmi%2B%3DcnV-8V8TndSkEF6Htqa7qHQUL_KnQU8-DrT0Jjnm3_Q%40mail.gmail.com
[2] https://www.postgresql.org/message-id/CAEze2Wi9j5Q3mRnuoD2Hr%3DeOFV-cMzWAUZ88YmSXSwsiJLQOWA%40mail.gmail.com



pgsql-hackers by date:

Previous
From: Daniel Gustafsson
Date:
Subject: Re: some additional (small) problems with pg_combinebackup and tablespaces
Next
From: Anton Voloshin
Date:
Subject: Re: pgsql: psql: add an optional execution-count limit to \watch.