Date: Tue, 19 Aug 2014 11:52:37 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Andres Freund <andres@2ndquadrant.com>
Cc: Heikki Linnakangas <hlinnakangas@vmware.com>,
 PostgreSQL-development <pgsql-hackers@postgreSQL.org>
Subject: Re: PQgetssl() and alternative SSL implementations
Message-ID: <20140819155237.GE16422@tamriel.snowman.net>
References: <53F1E989.8020609@vmware.com>
 <20140819144841.GA16422@tamriel.snowman.net>
 <20140819145547.GB30525@awork2.anarazel.de>
 <20140819150507.GB16422@tamriel.snowman.net>
 <20140819152613.GC30525@awork2.anarazel.de>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
 protocol="application/pgp-signature"; boundary="1UnTAs3dvDkZxKOo"
Content-Disposition: inline
In-Reply-To: <20140819152613.GC30525@awork2.anarazel.de>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org


--1UnTAs3dvDkZxKOo
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

* Andres Freund (andres@2ndquadrant.com) wrote:
> No. We should build something that's suitable for postgres, not
> something general. We'll fail otherwise. For anything fancy the user has
> to look at the certificate themselves. We should make it easy to get at
> the whole certificate chain in a consistent manner.

I don't buy this argument at all.

> > Telling users they simply can't have this information isn't
> > acceptable.
>=20
> Meh. Why? Most of that isn't something a normal libpq user is going to
> need.

I'm not interested in SSL support for users who don't use or care about
SSL (which would be 'normal libpq users', really).  I've *long* been
frustrated by our poor support of SSL and at how painful it is to get
proper SSL working- and it's been a real problem getting PG to pass the
security compliance requirements because of that poor support.  Let's
stop the rhetoric that PG doesn't need anything but the most basic
SSL/auditing/security capabilities.

> > If we end up not being able to provide everything for all of the
> > libraries we support then perhaps we can document which are available
> > from all of them, but I'd hope the list of "only in X" is pretty small.
>=20
> I'm pretty sure that we can't build a reasonable list of the information
> exposed by any library. Especially as we're likely going to need some
> mapping to agree to map to the common names.

Per Apache's documentation, mod_ssl and mod_gnutls support the same set
of environment variables (with the same names even), so I don't buy this
argument either.

	Thanks,

		Stephen

--1UnTAs3dvDkZxKOo
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBAgAGBQJT83LFAAoJEO1sijiDR2RVecsQAI9pk55TLnzVcmkpLwTiWc2M
mphaIPDmR0u1ROl4FtqSlPwPWXkwLhYeNJoAfN7mt4AGCsU8UUPcDR1FM8A1jsP6
uC1+g6m1dGOXTv+SAqy6WuCVq715EXaN2ylU5vDhbK7aInLXv5rv3tTfzmyklYna
kqvxSKLyskKwywv8M9DaQZVyNbpIVsMpwyr/d+IaeZNnM2mt3M/rhAb+WlkznJ9G
ImYw3rKdxjn1jlYI0s/tILJWE8PXPhrfAPA3CtjNyIoLwFuLe/bNDe6bqf3/VhtT
sBKuifEEnqKnClyODFZ35Z5KRFl65+dKkPQITQWFzn0NFgIQYHNGLpsIF0LVgZ9v
nl/7mjNgzGMonmsjpo1TgD/2mC0orZp6sT/xpYrVCwzyrfHwHErRzKiFWuchFPZ6
eb27ucfz03Xtwr6IRQSQgLM9ulhi8f880elPgEYOghUN98KpJZJ5Fnr9P+OVTl9d
0xnIYse15XkB3v9UotJHf/TaZOSTs8YWkNkhxUPAZuXt1BjoPTCQznRJAYVMHHEz
jtcZze3V1g1cn+avMJS1274OuXpbpMWTKoaKpev3GbnaMvb13r7Jz0pChBP8PYBj
BdD+dWT5hQca2fa2mk0nJIlUAniH2U/MhQgvenQlLwln9O/fIZU7VPkeQ3MxekZF
jlcVuE3b/RrB9mEd72sE
=J0XT
-----END PGP SIGNATURE-----

--1UnTAs3dvDkZxKOo--