Greetings, * Peter Eisentraut (peter.eisentr...@enterprisedb.com) wrote: > A customer asked about including Server Name Indication (SNI) into the SSL > connection from the client, so they can use an SSL-aware proxy to route > connections. There was a thread a few years ago where this was briefly > discussed but no patch appeared.[0] I whipped up a quick patch and it did > seem to do the job, so I figured I'd share it here.
This doesn't actually result in the ability to do that SSL connection proxying though, does it? At the least, whatever the proxy is would have to be taught how to send back an 'S' to the client, and send an 'S' to the server chosen after the client sends along the TLS ClientHello w/ SNI set, and then pass the traffic between afterwards. Perhaps it's worth doing this to allow proxy developers to do that, but this isn't enough to make it actually work without the proxy actually knowing PG and being able to be configured to do the right thing for the PG protocol. I would think that, ideally, we'd have some proxy author who would be willing to actually implement this and test that it all works with this patch applied, and then make sure to explain that proxies will need to be adapted to be able to work. Simply including this and then putting in the release notes that we now provide SNI as part of the SSL connection would likely lead people to believe that it'll 'just work'. Perhaps to manage expectations we'd want to say something like: - libpq will now include Server Name Indication as part of the PostgreSQL SSL startup process; proxies will need to understand the PostgreSQL protocol in order to be able to leverage this to perform routing. Or something along those lines, I would think. Of course, such a proxy would need to also understand how to tell a client that, for example, GSSAPI encryption isn't available if a 'G' came first from the client, and what to do if a plaintext connection was requested. > The question I had was whether this should be an optional behavior, or > conversely a behavior that can be turned off, or whether it should just be > turned on all the time. Certainly seems like something that we should support turning off, at least. As mentioned elsewhere, knowing the system that's being connected to is certainly interesting to attackers. Thanks, Stephen
signature.asc
Description: PGP signature
