Received: from magus.postgresql.org (magus.postgresql.org [87.238.57.229])
	by mail.postgresql.org (Postfix) with ESMTP id 489E213FA3D7
	for <pgsql-hackers@postgresql.org>;
	Mon, 18 Jun 2012 14:43:12 -0300 (ADT)
Received: from [2400:c400::113:212:99:188] (helo=svana.org)
	by magus.postgresql.org with esmtp (Exim 4.72)
	(envelope-from <kleptog@svana.org>) id 1Sgfyn-0000y6-Q8
	for pgsql-hackers@postgresql.org; Mon, 18 Jun 2012 17:43:12 +0000
Received: from kleptog by svana.org with local (Exim 4.72)
	(envelope-from <kleptog@svana.org>)
	id 1SgfyE-0006SQ-OB; Tue, 19 Jun 2012 03:42:35 +1000
Date: Mon, 18 Jun 2012 19:42:34 +0200
From: Martijn van Oosterhout <kleptog@svana.org>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Florian Pflug <fgp@phlo.org>, Magnus Hagander <magnus@hagander.net>,
	Euler Taveira <euler@timbira.com>, Bruce Momjian <bruce@momjian.us>,
	Pgsql Hackers <pgsql-hackers@postgresql.org>
Subject: Re: libpq compression
Message-ID: <20120618174233.GA24681@svana.org>
Reply-To: Martijn van Oosterhout <kleptog@svana.org>
References: 
 <CABUevEzVpqS5RCLz2fFREdPFkuYkEKsrMpnfPixYWPki2=iJOA@mail.gmail.com>
	<4FDB954F.9010606@timbira.com> <5136.1339799120@sss.pgh.pa.us>
	<5365.1339799869@sss.pgh.pa.us>
	<CABUevEz_V4YYc0tUhkC6KD2GddysM5Z76pcHcMYiMDd7dwMxVQ@mail.gmail.com>
	<11357.1339822502@sss.pgh.pa.us>
	<CABUevEy1sUTOeCjNicUggnMpT7MfgjWud8kQ=wkvJsfbCU8=WQ@mail.gmail.com>
	<19804.1339859730@sss.pgh.pa.us>
	<9B10BD6E-31AA-4699-BB67-5C386B623F77@phlo.org>
	<27043.1339950593@sss.pgh.pa.us>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="3MwIy2ne0vdjdPXF"
Content-Disposition: inline
In-Reply-To: <27043.1339950593@sss.pgh.pa.us>
X-PGP-Key-ID: Length=1024; ID=0x6F0B424C
X-PGP-Key-Fingerprint: 34A8 8EAC F902 8C8D CA72  DCC7 201E DB34 6F0B 424C
User-Agent: Mutt/1.5.20 (2009-06-14)
X-SA-Exim-Connect-IP: <locally generated>
X-SA-Exim-Mail-From: kleptog@svana.org
X-SA-Exim-Scanned: No (on svana.org); SAEximRunCond expanded to false
X-Host-Lookup-Failed: Reverse DNS lookup failed for 2400:c400::113:212:99:188
	(failed)
X-Pg-Spam-Score: -1.1 (-)
X-Archive-Number: 201206/905
X-Sequence-Number: 209745


--3MwIy2ne0vdjdPXF
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sun, Jun 17, 2012 at 12:29:53PM -0400, Tom Lane wrote:
> The fly in the ointment with any of these ideas is that the "configure
> list" is not a list of exact cipher names, as per Magnus' comment that
> the current default includes tests like "!aNULL".  I am not sure that
> we know how to evaluate such conditions if we are applying an
> after-the-fact check on the selected cipher.  Does OpenSSL expose any
> API for evaluating whether a selected cipher meets such a test?

I'm not sure whether there's an API for it, but you can certainly check
manually with "openssl ciphers -v", for example:

$ openssl ciphers -v 'ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP'
NULL-SHA                SSLv3 Kx=3DRSA      Au=3DRSA  Enc=3DNone      Mac=
=3DSHA1
NULL-MD5                SSLv3 Kx=3DRSA      Au=3DRSA  Enc=3DNone      Mac=
=3DMD5

=2E..etc...

So unless the openssl includes the code twice there must be a way to
extract the list from the library.

Have a nice ay,
--=20
Martijn van Oosterhout   <kleptog@svana.org>   http://svana.org/kleptog/
> He who writes carelessly confesses thereby at the very outset that he does
> not attach much importance to his own thoughts.
   -- Arthur Schopenhauer

--3MwIy2ne0vdjdPXF
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQIVAwUBT99oiUvt++dL5i1EAQjmug//TXcbuEqKLInUGsGRdw+Km+yaA8tSeTFR
hZJZDH3TNZ+DsU6RNKRdffl/GqS1Q6a5bdAkgIkU5Y/BGwo27hLCPH6xniaCAzKN
xFz7ZZjd4K1FNaZ4gOSYFWbFJuuHqNixNvAqoKJoLpDCM9eNFTkJEkeJnoexQqP5
76oAZkt/npjuNebg2dmEGgxeeiUdRg4LVpMHeJ3U9yKgzUvnmDaWUeIYTrj5npxC
tQn+RP4ySunUnXknsAFLhHpr9/pX5+NVmdgP2uWJ+9L7e57nRJ9L0M8sjyAoDkZk
BJlvE3HXi1plm3cZINIKYvXf5wJanfoBeZKun5uu9hnuitJrZ8XZ7EYa20jE+bHZ
doqRAetEKOgw2FdjAABxVLdxdvA23cf0B1WLDLhldBXkorBY2nu37BSmmvkGaiud
M0gJ8Le/3gdMrPuykUY94P2m/GbueLmyxCu9/iyx/9qj1sYpNgQKc0Ooz1Py46Ud
//pCcPyZLfS6ok3reaLx6SIaOyPEjP5qTLeGpo9vjdLNsRHVQbXfXTC7W2AO7b3B
c4J8p0rgBCCC5VNmyYTldUspEoDffyobmhPy4xZrW02e8B13H/N0hmq1ulcyA9+m
fRBIz6ohEduHNee8qsdG7MgMP1W8/VjnpgPE5DRlCVLmkNvbZk+EEMEAn6bAcPpN
o3mGKjA6Pvo=
=9J8z
-----END PGP SIGNATURE-----

--3MwIy2ne0vdjdPXF--