pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: ktm@rice.edu <ktm@rice.edu>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Magnus Hagander <magnus@hagander.net>
Cc: Euler Taveira <euler@timbira.com>
Cc: Florian Pflug <fgp@phlo.org>
Cc: Bruce Momjian <bruce@momjian.us>
Cc: Pgsql Hackers <pgsql-hackers@postgresql.org>
Subject: Re: libpq compression
Date: Sat, 16 Jun 2012 11:25:12 -0500
Message-ID: <20120616162512.GL6547@aart.rice.edu> (raw)
In-Reply-To: <19804.1339859730@sss.pgh.pa.us>
References: <CABUevExi-cJ6AvF2kDOy+qQsB+0JHofrcvVmNVoJ2HziZMMaAg@mail.gmail.com>
	<22690C61-E960-4A2A-BFD5-DAD3D3B5C474@phlo.org>
	<CABUevEzVpqS5RCLz2fFREdPFkuYkEKsrMpnfPixYWPki2=iJOA@mail.gmail.com>
	<4FDB954F.9010606@timbira.com>
	<5136.1339799120@sss.pgh.pa.us>
	<5365.1339799869@sss.pgh.pa.us>
	<CABUevEz_V4YYc0tUhkC6KD2GddysM5Z76pcHcMYiMDd7dwMxVQ@mail.gmail.com>
	<11357.1339822502@sss.pgh.pa.us>
	<CABUevEy1sUTOeCjNicUggnMpT7MfgjWud8kQ=wkvJsfbCU8=WQ@mail.gmail.com>
	<19804.1339859730@sss.pgh.pa.us>

On Sat, Jun 16, 2012 at 11:15:30AM -0400, Tom Lane wrote:
> Magnus Hagander <magnus@hagander.net> writes:
> > On Sat, Jun 16, 2012 at 12:55 PM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
> >> It's not obvious to me that we actually *need* anything except the
> >> ability to recognize that a null-encrypted SSL connection probably
> >> shouldn't be treated as matching a hostssl line; which is not something
> >> that requires any fundamental rearrangements, since it only requires an
> >> after-the-fact check of what was selected.
> 
> > Maybe I spelled it out wrong. It does require it insofar that if we
> > want to use this for compression, we must *always* enable openssl on
> > the connection. So the "with these encryption method" boils down to
> > "NULL encryption only" or "whatever other standards I have for
> > encryption". We don't need the ability to change the "whatever other
> > standards" per subnet, but we need to control the
> > accept-NULL-encryption on a per subnet basis.
> 
> After sleeping on it, I wonder if we couldn't redefine the existing
> "list of acceptable ciphers" option as the "list of ciphers that are
> considered to provide encrypted transport".  So you'd be allowed to
> connect with SSL using any unapproved cipher (including NULL), the
> backend just considers it as equivalent to a non-SSL connection for
> pg_hba purposes.  Then no change is needed in any configuration stuff.
> 
> 			regards, tom lane
> 

+1 That is nice and clean.

Regards,
Ken



view thread (289+ messages)  latest in thread

Message-ID: <20120616162512.GL6547@aart.rice.edu>
Permalink:  ../20120616162512.GL6547@aart.rice.edu/
Also on:    postgresql.org/message-id/20120616162512.GL6547@aart.rice.edu

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: ktm@rice.edu, tgl@sss.pgh.pa.us, magnus@hagander.net, euler@timbira.com, fgp@phlo.org, bruce@momjian.us
  Subject: Re: libpq compression
  In-Reply-To: <20120616162512.GL6547@aart.rice.edu>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox