diff options
| author | Heikki Linnakangas <heikki.linnakangas@iki.fi> | 2024-04-28 22:39:35 +0300 |
|---|---|---|
| committer | Heikki Linnakangas <heikki.linnakangas@iki.fi> | 2024-04-28 22:39:35 +0300 |
| commit | 5c9f35fc48ea99e59300a267e090e3eafd1b3b0e (patch) | |
| tree | 39699d59162ce0d368212a791e0f5b406f1865af /doc/src | |
| parent | 42b041243c00fb20023c983357e7f1ffd3710fff (diff) | |
| download | postgresql-5c9f35fc48ea99e59300a267e090e3eafd1b3b0e.tar.gz postgresql-5c9f35fc48ea99e59300a267e090e3eafd1b3b0e.zip | |
Fix documentation and comments on what happens after GSS rejection
The paragraph in the docs and the comment applied to
sslnegotiaton=direct, but not sslnegotiation=requiredirect. In
'requiredirect' mode, negotiated SSL is never used. Move the paragraph
in the docs under the description of 'direct' mode, and rephrase it.
Also the comment's reference to reusing a plaintext connection was
bogus. Authentication failure in plaintext mode only happens after
sending the startup packet, so the connection cannot be reused.
Reported-by: Jacob Champion
Discussion: https://www.postgresql.org/message-id/CAOYmi+=sj+1uydS0NR4nYzw-LRWp3Q-s5speBug5UCLSPMbvGA@mail.gmail.com
Diffstat (limited to 'doc/src')
| -rw-r--r-- | doc/src/sgml/libpq.sgml | 19 |
1 files changed, 9 insertions, 10 deletions
diff --git a/doc/src/sgml/libpq.sgml b/doc/src/sgml/libpq.sgml index 0db3667fdf2..aed45f3428b 100644 --- a/doc/src/sgml/libpq.sgml +++ b/doc/src/sgml/libpq.sgml @@ -1803,6 +1803,15 @@ postgresql://%2Fvar%2Flib%2Fpostgresql/dbname process adds significant latency if the initial SSL connection fails. </para> + <para> + An exception is if <literal>gssencmode</literal> is set + to <literal>prefer</literal>, but the server rejects GSS encryption. + In that case, SSL is negotiated over the same TCP connection using + <productname>PostgreSQL</productname> protocol negotiation. In + other words, the direct SSL handshake is not used, if a TCP + connection has already been established and can be used for the + SSL handshake. + </para> </listitem> </varlistentry> @@ -1816,16 +1825,6 @@ postgresql://%2Fvar%2Flib%2Fpostgresql/dbname </listitem> </varlistentry> </variablelist> - - <para> - Note that if <literal>gssencmode</literal> is set - to <literal>prefer</literal>, a <acronym>GSS</acronym> connection is - attempted first. If the server rejects GSS encryption, SSL is - negotiated over the same TCP connection using the traditional postgres - protocol, regardless of <literal>sslnegotiation</literal>. In other - words, the direct SSL handshake is not used, if a TCP connection has - already been established and can be used for the SSL handshake. - </para> </listitem> </varlistentry> |