Date: Wed, 28 Jan 2015 11:58:47 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Robert Haas <robertmhaas@gmail.com>
Cc: Heikki Linnakangas <hlinnakangas@vmware.com>,
 Magnus Hagander <magnus@hagander.net>, Tom Lane <tgl@sss.pgh.pa.us>,
 PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: PQgetssl() and alternative SSL implementations
Message-ID: <20150128165847.GY3854@tamriel.snowman.net>
References: <53F1E989.8020609@vmware.com>
 <CA+TgmoZDJ6CKiuBMqNk3iS7LQ9GZuzS7RTYSOvRu8kJjRKWLng@mail.gmail.com>
 <CABUevExpTZpMAMvr=BkeO5-XG_zgZP=TKdyCCpgEpYc0Htjr8Q@mail.gmail.com>
 <10419.1408475397@sss.pgh.pa.us>
 <CABUevEy03OvP3N3wBRVP7BcmwcHf=Qi6Crb2MHo4dVmG--ZnVg@mail.gmail.com>
 <CA+TgmoaKHd+HW8kOgzovdSTWhauEsV0qeRsxPLpEZfSNDiSP=g@mail.gmail.com>
 <53F3C87E.2080401@vmware.com> <54C8FCB0.4050304@vmware.com>
 <CA+TgmoYrAH=o8m9959O_TgHm7OcK9C=f3WJfUHryb4pzu5uZ0A@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature"; boundary="5NsQWDwfMDrsTk14"
Content-Disposition: inline
In-Reply-To: 
 <CA+TgmoYrAH=o8m9959O_TgHm7OcK9C=f3WJfUHryb4pzu5uZ0A@mail.gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org


--5NsQWDwfMDrsTk14
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

* Robert Haas (robertmhaas@gmail.com) wrote:
> On Wed, Jan 28, 2015 at 10:13 AM, Heikki Linnakangas
> <hlinnakangas@vmware.com> wrote:
> > Here's a patch to implement the above scheme. It adds four functions to
> > libpq, to interrogate the SSL status:
> >
> > int PQsslInUse(const PGconn *conn)
> > Returns true (1) if the connection uses SSL, false (0) if not.
> >
> > const char *PQsslAttribute(const PGconn *conn, const char *attribute_na=
me)
> > Returns a piece of information. The list of attributes depends on the
> > implementation, but there are a few that are expected to be supported b=
y all
> > of them. See docs for details.
> >
> > const char **PQsslAttributes(const PGconn *conn);
> > Return an array of SSL attribute names available.
> >
> > void *PQsslStruct(const PGconn *conn, const char *struct_name)
> > Return a pointer to an SSL-implementation specific object describing the
> > connection. PQsslStruct(conn, "OpenSSL SSL") is equivalent to
> > PQgetssl(conn).
> >
> > I think this is expandable enough, because you can easily add attributes
> > later on, and different implementations can support different attribute=
s. It
> > contains the escape hatch for applications that need to do more, and ha=
ve
> > intimate knowledge of OpenSSL structs. It's also pretty easy to use.
>=20
> I like it!
>=20
> Although I think "OpenSSL SSL" is a little bit duplicatively
> redundant.  Why not just "OpenSSL"?

I wondered also, but figured it was probably because it's OpenSSL's
"ssl" structure, which then made sense.

What bothers me about this is that it punts SSL work to the application
and requires that they be coded to work with both OpenSSL and whatever
else we implement (eg: GnuTLS) to do anything but the most simple
checks.  That's a problem because people are *not* going to want to
#include both OpenSSL and GnuTLS headers into their applications because
they don't know which PG will be compiled with..  Not to mention that
it'd be darn awkward to do so.

My hope is that Heikki's attribute approach will be extended quite a bit
in the near future (to hopefully avoid too many apps having to deal with
the complexity of supporting multiple major PG versions where the older
ones don't have the necessary attributes..), but I'm not sure that this
will actually make it much easier to support GnuTLS, nor am I sure that
anyone is going to actually go through that effort..  And if we don't
then we really aren't making an improvement here since it'll still all
be OpenSSL-centric.

	Thanks,

		Stephen

--5NsQWDwfMDrsTk14
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJUyRVHAAoJEO1sijiDR2RVzYUP/3Jtv8HWD/vfhYVWLvQnfvt0
eF23IMXpTwkIIV8qmvTFwRfSCleZHsEDwWXucE4eJfcKkjY/hPJGgfjNYp/UbAgu
8ciGD7erpSPfzrTed/ZXeQXfaHXj9I+9cfFO+d21CwItkHTErFYp+5gHfq+gYb+m
ilp/XJVmyCh00XQMKYWE90IdXlZrascoUioipxQKRTIZTIGNy5mOKB6lvc/OZe/V
VWqXY6s4wzE6hBe40cOMiRN9VAcdIpsyN8cMCmENXekm9jSIWNQOtSwXwxQsfNsT
wrH1M0ZhmfIIEg5/D1vnVPZIVA6EP+dxuRoFDzZAiqCc1SXSbxA4e77+0FOxDQ49
hWolxdGLWRc90mxC3eTY8kivDcr7J1bqPlI3tQn4VkeIqdlaiWeyJumsOpdZxNU3
Gkrc1FcO+7ZndQAm/Pt7lxr5LOB209F8uTkHmVzTlZhefPOQjZtlsOibBXyr3Iz/
T22QYC4ZHRUYud4sKeBWKjS4WNyjelcgmwID/PkhvawrefoN7laWaHiqUACV48sI
iJZeFajsSsq9sCML81t6MFoiID9mCYjDm05fqSdSDsTtQCGIHmrsJca/zwaRHpR1
ztALcbHMAMi+ihB3oVk3OAoKlGQObdmuup2zeQPkYl9ed5rlNW7bwyigV0n/URRY
zrgIV6xUWgCfl/LwWxTM
=YEfY
-----END PGP SIGNATURE-----

--5NsQWDwfMDrsTk14--