pgsql: Reject SSL connection if ALPN is used but there's no common prot

From: Heikki Linnakangas <heikki(dot)linnakangas(at)iki(dot)fi>
To: pgsql-committers(at)lists(dot)postgresql(dot)org
Subject: pgsql: Reject SSL connection if ALPN is used but there's no common prot
Date: 2024-04-29 15:14:26
Message-ID: E1s1Si1-000dPK-6j@gemulon.postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Reject SSL connection if ALPN is used but there's no common protocol

If the client supports ALPN but tries to use some other protocol, like
HTTPS, reject the connection in the server. That is surely a confusion
of some sort. Furthermore, the ALPN RFC 7301 says:

> In the event that the server supports no protocols that the client
> advertises, then the server SHALL respond with a fatal
> "no_application_protocol" alert.

This commit makes the server follow that advice.

In the client, specifically check for the OpenSSL error code for the
"no_application_protocol" alert. Otherwise you got a cryptic "SSL
error: SSL error code 167773280" error if you tried to connect to a
non-PostgreSQL server that rejects the connection with
"no_application_protocol". ERR_reason_error_string() returns NULL for
that code, which frankly seems like an OpenSSL bug to me, but we can
easily print a better message ourselves.

Reported-by: Jacob Champion
Discussion: https://www.postgresql.org/message-id/6aedcaa5-60f3-49af-a857-2c76ba55a1f3@iki.fi

Branch
------
master

Details
-------
https://git.postgresql.org/pg/commitdiff/17a834a04d5a60aedd6899488a53d939d525fb16

Modified Files
--------------
src/backend/libpq/be-secure-openssl.c | 10 +++++++---
src/interfaces/libpq/fe-secure-openssl.c | 12 ++++++++++++
2 files changed, 19 insertions(+), 3 deletions(-)

Responses

Browse pgsql-committers by date

  From Date Subject
Next Message Noah Misch 2024-04-29 17:30:40 pgsql: Close race condition between datfrozen and relfrozen updates.
Previous Message Michael Paquier 2024-04-29 12:12:00 pgsql: Make two-phase tests of ECPG and main suite more concurrent-proo