aws / aws/amazon-redshift-python-driver

sslmode does not support allow, prefer, require, disable

Abierto
#158 1 comentario 0 reacciones 0 asignados Ver en GitHub
enhancement
Lenguaje dominante
Python
Estrellas
220
Forks
86
Métricas de merge de PR
Sin PR fusionados en 30 d

Descripción

## Driver version

2.0.910

## Redshift version

PostgreSQL 8.0.2 on i686-pc-linux-gnu, compiled by GCC gcc (GCC) 3.4.2 20041017 (Red Hat 3.4.2-6.fc3), Redshift 1.0.49780

## Client Operating System

macos monterey 12.6.2

## Python version

3.11
## Table schema

Does not apply
## Problem description

1. Expected behaviour:
In [postgreSQL](https://www.postgresql.org/docs/current/libpq-ssl.html#:~:text=SSL%20Mode%20Descriptions-,sslmode,-Eavesdropping%20protection), these 5 parameters are allowed values for sslmode. However, redshift_connector only allows for verify-ca, and verify-full for this parameter. Redshift_connector also has ssl as a parameter.

2. Actual behaviour:
There are a few problems with this difference between postgreSQL and redshift_connector:
a. To disable ssl, users using redshift_connector has to set ssl = False. Simply setting sslmode = disable will not set ssl to false. Since disable is not a recognizable value of sslmode in redshift_connector, redshift_connector will use the default of 'verify-ca' to make the connection.
b. According to the PostgreSQL [doc](https://www.postgresql.org/docs/current/libpq-connect.html#:~:text=%2Dencrypted%20connection.-,sslmode,-This%20option%20determines), the accepted values of sslmode behave as below:

disable
only try a non-SSL connection

allow
first try a non-SSL connection; if that fails, try an SSL connection

prefer (default)
first try an SSL connection; if that fails, try a non-SSL connection

require
only try an SSL connection. If a root CA file is present, verify the certificate in the same way as if verify-ca was specified

verify-ca
only try an SSL connection, and verify that the server certificate is issued by a trusted certificate authority (CA)

verify-full
only try an SSL connection, verify that the server certificate is issued by a trusted CA and that the requested server host name matches that in the certificate

Redshift_connector should also increase the values accepted by sslmode to align with PostgreSQL docs

After some investigation, here is a detailed table on the behavior of sslmode of redshift_connector and psycopg2:

sslmode | behavior in redshift connector (ssl, sslmode) | behavior in psycopg2 connector (sslmode)
-- | -- | --
disable | ssl=defaulted to true, sslmode=verify-ca (sslmode of disable is not recognized by redshift_connector, therefore falling back to default of verify-ca) | sslmode=disable
allow | ssl=defaulted to true, sslmode=verify-ca | first try with sslmode=disable, if fails, try with sslmode=verify-ca
prefer | ssl=defaulted to true, sslmode=verify-ca | first try with sslmode=verify-ca, if fails, try with sslmode=disable
require | ssl=defaulted to true, sslmode=verify-ca | ssl=true, sslmode=verify-ca
verify-ca | ssl=defaulted to true, sslmode=verify-ca | ssl=true, sslmode=verify-ca
verify-full | ssl=defaulted to true, sslmode=verify-full | ssl=true, sslmode=verify-full

Guía de contribución

Abrir la guía de contribución

Línea de trabajo

Localiza la validación de sslmode y la configuración de la conexión en redshift_connector; después, compara el comportamiento actual con la documentación de PostgreSQL sobre sslmode y con la tabla de comportamiento de este issue. Añade cobertura para los seis valores indicados y verifica que cada modo produzca el comportamiento de conexión documentado.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
postgresql, python
Área
databases, security
Tipo de issue
Nueva funcionalidad
Dificultad
4/5
Tiempo estimado
3-5 días
Estado de actividad
Estancado
Claridad
Bastante claro
Aptitud para principiantes
42/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.