database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-08-28 18:48:04 +03:00
Code Activity

Fix documentation and comments on what happens after GSS rejection

Browse Source 
The paragraph in the docs and the comment applied to
sslnegotiaton=direct, but not sslnegotiation=requiredirect. In
'requiredirect' mode, negotiated SSL is never used. Move the paragraph
in the docs under the description of 'direct' mode, and rephrase it.

Also the comment's reference to reusing a plaintext connection was
bogus. Authentication failure in plaintext mode only happens after
sending the startup packet, so the connection cannot be reused.

Reported-by: Jacob Champion
Discussion: https://www.postgresql.org/message-id/CAOYmi+=sj+1uydS0NR4nYzw-LRWp3Q-s5speBug5UCLSPMbvGA@mail.gmail.com
This commit is contained in:
Heikki Linnakangas
2024-04-28 22:39:35 +03:00
parent 42b041243c
commit 5c9f35fc48
2 changed files with 15 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/interfaces/libpq/fe-connect.c
View File

@@ -4430,11 +4430,12 @@ select_next_encryption_method(PGconn *conn, bool have_valid_connection)
/*
* If enabled, try direct SSL. Unless we have a valid TCP connection that
* failed negotiating GSSAPI encryption or a plaintext connection in case
* of sslmode='allow'; in that case we prefer to reuse the connection with
* negotiated SSL, instead of reconnecting to do direct SSL. The point of
* direct SSL is to avoid the roundtrip from the negotiation, but
* reconnecting would also incur a roundtrip.
* failed negotiating GSSAPI encryption; in that case we prefer to reuse
* the connection with negotiated SSL, instead of reconnecting to do
* direct SSL. The point of sslnegotiation=direct is to avoid the
* roundtrip from the negotiation, but reconnecting would also incur a
* roundtrip. (In sslnegotiation=requiredirect mode, negotiated SSL is not
* in the list of allowed methods and we will reconnect.)
*/
if (have_valid_connection)
SELECT_NEXT_METHOD(ENC_NEGOTIATED_SSL);