From: | Jacob Champion <jacob(dot)champion(at)enterprisedb(dot)com> |
---|---|
To: | Robert Haas <robertmhaas(at)gmail(dot)com> |
Cc: | Heikki Linnakangas <hlinnaka(at)iki(dot)fi>, Michael Paquier <michael(at)paquier(dot)xyz>, Postgres hackers <pgsql-hackers(at)lists(dot)postgresql(dot)org> |
Subject: | Re: Direct SSL connection with ALPN and HBA rules |
Date: | 2024-04-25 18:13:12 |
Message-ID: | CAOYmi+=TB8=yfXoBk=p0k0GPaCD79F8xXcypZFkjKmPKuT0hjQ@mail.gmail.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
On Thu, Apr 25, 2024 at 10:35 AM Robert Haas <robertmhaas(at)gmail(dot)com> wrote:
> Maybe I'm missing something here, but why doesn't sslnegotiation
> override sslmode completely? Or alternatively, why not remove
> sslnegotiation entirely and just have more sslmode values? I mean
> maybe this shouldn't happen categorically, but if I say I want to
> require a direct SSL connection, to me that implies that I don't want
> an indirect SSL connection, and I really don't want a non-SSL
> connection.
I think that comes down to the debate upthread, and whether you think
it's a performance tweak or a security feature. My take on it is,
`direct` mode is performance, and `requiredirect` is security.
(Especially since, with the current implementation, requiredirect can
slow things down?)
> I think it's pretty questionable in 2024 whether sslmode=allow and
> sslmode=prefer make any sense at all. I don't think it would be crazy
> to remove them entirely. But I certainly don't think that they should
> be allowed to bleed into the behavior of new, higher-security
> configurations. Surely if I say I want direct SSL, it's that or
> nothing, right?
I agree, but I more or less lost the battle at [1]. Like Matthias
mentioned in [2]:
> I'm not sure about this either. The 'gssencmode' option is already
> quite weird in that it seems to override the "require"d priority of
> "sslmode=require", which it IMO really shouldn't.
Thanks,
--Jacob
[1] https://www.postgresql.org/message-id/CAOYmi%2B%3DcnV-8V8TndSkEF6Htqa7qHQUL_KnQU8-DrT0Jjnm3_Q%40mail.gmail.com
[2] https://www.postgresql.org/message-id/CAEze2Wi9j5Q3mRnuoD2Hr%3DeOFV-cMzWAUZ88YmSXSwsiJLQOWA%40mail.gmail.com
From | Date | Subject | |
---|---|---|---|
Next Message | Anton Voloshin | 2024-04-25 18:22:49 | Re: pgsql: psql: add an optional execution-count limit to \watch. |
Previous Message | Daniel Gustafsson | 2024-04-25 18:03:03 | Re: some additional (small) problems with pg_combinebackup and tablespaces |