Re: Experiments with Postgres and SSL

From: Heikki Linnakangas <hlinnaka(at)iki(dot)fi>
To: Jacob Champion <jacob(dot)champion(at)enterprisedb(dot)com>
Cc: Matthias van de Meent <boekewurm+postgres(at)gmail(dot)com>, PostgreSQL-development <pgsql-hackers(at)postgresql(dot)org>, Greg Stark <stark(at)mit(dot)edu>, Andrey Borodin <amborodin86(at)gmail(dot)com>, Jacob Champion <jchampion(at)timescale(dot)com>, Vladimir Sitnikov <sitnikov(dot)vladimir(at)gmail(dot)com>, Michael Paquier <michael(at)paquier(dot)xyz>
Subject: Re: Experiments with Postgres and SSL
Date: 2024-03-05 14:08:54
Views: Raw Message | Whole Thread | Download mbox | Resend email
Lists: pgsql-hackers

I hope I didn't joggle your elbow reviewing this, Jacob, but I spent
some time rebase and fix various little things:

- Incorporated Matthias's test changes

- Squashed the client, server and documentation patches. Not much point
in keeping them separate, as one requires the other, and if you're only
interested e.g. in the server parts, just look at src/backend.

- Squashed some of my refactorings with the main patches, because I'm
certain enough that they're desirable. I kept the last libpq state
machine refactoring separate though. I'm pretty sure we need a
refactoring like that, but I'm not 100% sure about the details.

- Added some comments to the new state machine logic in fe-connect.c.

- Removed the XXX comments about TLS alerts.

- Removed the "Allow pipelining data after ssl request" patch

- Reordered the patches so that the first two patches add the tests
different combinations of sslmode, gssencmode and server support. That
could be committed separately, without the rest of the patches. A later
patch expands the tests for the new sslnegotiation option.

The tests are still not distinguishing whether a connection was
established in direct or negotiated mode. So if we e.g. had a bug that
accidentally disabled direct SSL connection completely and always used
negotiated mode, the tests would still pass. I'd like to see some tests
that would catch that.

Heikki Linnakangas
Neon (

Attachment Content-Type Size
v8-0001-Move-Kerberos-module.patch text/x-patch 13.2 KB
v8-0002-Add-tests-for-libpq-choosing-encryption-mode.patch text/x-patch 15.8 KB
v8-0003-Direct-SSL-connections-client-and-server-support.patch text/x-patch 24.6 KB
v8-0004-Direct-SSL-connections-ALPN-support.patch text/x-patch 13.5 KB
v8-0005-Add-tests-for-sslnegotiation.patch text/x-patch 4.3 KB
v8-0006-WIP-refactor-state-machine-in-libpq.patch text/x-patch 25.1 KB

In response to


Browse pgsql-hackers by date

  From Date Subject
Next Message Teodor Sigaev 2024-03-05 14:16:30 Re: type cache cleanup improvements
Previous Message Jelte Fennema-Nio 2024-03-05 14:08:35 Re: Reducing the log spam