aws / aws/amazon-redshift-python-driver
sslmode does not support allow, prefer, require, disable
- 主要言語
- Python
- スター
- 220
- フォーク
- 86
- PR マージ指標
- 30日以内にマージされた PR はありません
説明
## Driver version
2.0.910
## Redshift version
PostgreSQL 8.0.2 on i686-pc-linux-gnu, compiled by GCC gcc (GCC) 3.4.2 20041017 (Red Hat 3.4.2-6.fc3), Redshift 1.0.49780
## Client Operating System
macos monterey 12.6.2
## Python version
3.11
## Table schema
Does not apply
## Problem description
1. Expected behaviour:
In [postgreSQL](https://www.postgresql.org/docs/current/libpq-ssl.html#:~:text=SSL%20Mode%20Descriptions-,sslmode,-Eavesdropping%20protection), these 5 parameters are allowed values for sslmode. However, redshift_connector only allows for verify-ca, and verify-full for this parameter. Redshift_connector also has ssl as a parameter.
2. Actual behaviour:
There are a few problems with this difference between postgreSQL and redshift_connector:
a. To disable ssl, users using redshift_connector has to set ssl = False. Simply setting sslmode = disable will not set ssl to false. Since disable is not a recognizable value of sslmode in redshift_connector, redshift_connector will use the default of 'verify-ca' to make the connection.
b. According to the PostgreSQL [doc](https://www.postgresql.org/docs/current/libpq-connect.html#:~:text=%2Dencrypted%20connection.-,sslmode,-This%20option%20determines), the accepted values of sslmode behave as below:
disable
only try a non-SSL connection
allow
first try a non-SSL connection; if that fails, try an SSL connection
prefer (default)
first try an SSL connection; if that fails, try a non-SSL connection
require
only try an SSL connection. If a root CA file is present, verify the certificate in the same way as if verify-ca was specified
verify-ca
only try an SSL connection, and verify that the server certificate is issued by a trusted certificate authority (CA)
verify-full
only try an SSL connection, verify that the server certificate is issued by a trusted CA and that the requested server host name matches that in the certificate
Redshift_connector should also increase the values accepted by sslmode to align with PostgreSQL docs
After some investigation, here is a detailed table on the behavior of sslmode of redshift_connector and psycopg2:
sslmode | behavior in redshift connector (ssl, sslmode) | behavior in psycopg2 connector (sslmode)
-- | -- | --
disable | ssl=defaulted to true, sslmode=verify-ca (sslmode of disable is not recognized by redshift_connector, therefore falling back to default of verify-ca) | sslmode=disable
allow | ssl=defaulted to true, sslmode=verify-ca | first try with sslmode=disable, if fails, try with sslmode=verify-ca
prefer | ssl=defaulted to true, sslmode=verify-ca | first try with sslmode=verify-ca, if fails, try with sslmode=disable
require | ssl=defaulted to true, sslmode=verify-ca | ssl=true, sslmode=verify-ca
verify-ca | ssl=defaulted to true, sslmode=verify-ca | ssl=true, sslmode=verify-ca
verify-full | ssl=defaulted to true, sslmode=verify-full | ssl=true, sslmode=verify-full
コントリビューションガイド
調査の方向性
redshift_connector 内の sslmode の検証と接続設定を特定し、現在の動作を PostgreSQL の sslmode ドキュメントおよびこの issue の動作表と比較します。記載されている 6 つの値のカバレッジを追加し、各モードがドキュメントに記載された接続動作になることを確認します。
索引モデルが issue の本文から書いたものです。
評価
- 技術スタック
- postgresql, python
- 領域
- databases, security
- issue の種類
- 機能追加
- 難易度
- 4/5
- 見積もり時間
- 3〜5日
- 活発さ
- 停滞
- 明瞭さ
- おおむね明確
- 初心者へのやさしさ
- 42/100