From: Stephen Frost <sfrost@snowman.net>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Robert Haas <robertmhaas@gmail.com>
Cc: Heikki Linnakangas <hlinnakangas@vmware.com>
Cc: Magnus Hagander <magnus@hagander.net>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: PQgetssl() and alternative SSL implementations
Date: Wed, 28 Jan 2015 12:30:17 -0500
Message-ID: <20150128173017.GZ3854@tamriel.snowman.net> (raw)
In-Reply-To: <32652.1422464685@sss.pgh.pa.us>
References: <CA+TgmoZDJ6CKiuBMqNk3iS7LQ9GZuzS7RTYSOvRu8kJjRKWLng@mail.gmail.com>
<CABUevExpTZpMAMvr=BkeO5-XG_zgZP=TKdyCCpgEpYc0Htjr8Q@mail.gmail.com>
<10419.1408475397@sss.pgh.pa.us>
<CABUevEy03OvP3N3wBRVP7BcmwcHf=Qi6Crb2MHo4dVmG--ZnVg@mail.gmail.com>
<CA+TgmoaKHd+HW8kOgzovdSTWhauEsV0qeRsxPLpEZfSNDiSP=g@mail.gmail.com>
<53F3C87E.2080401@vmware.com>
<54C8FCB0.4050304@vmware.com>
<CA+TgmoYrAH=o8m9959O_TgHm7OcK9C=f3WJfUHryb4pzu5uZ0A@mail.gmail.com>
<20150128165847.GY3854@tamriel.snowman.net>
<32652.1422464685@sss.pgh.pa.us>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
* Tom Lane (tgl@sss.pgh.pa.us) wrote:
> Stephen Frost <sfrost@snowman.net> writes:
> > What bothers me about this is that it punts SSL work to the application
> > and requires that they be coded to work with both OpenSSL and whatever
> > else we implement (eg: GnuTLS) to do anything but the most simple
> > checks. That's a problem because people are *not* going to want to
> > #include both OpenSSL and GnuTLS headers into their applications because
> > they don't know which PG will be compiled with.. Not to mention that
> > it'd be darn awkward to do so.
>
> The point of this is to provide an escape hatch for people who really
> want to do XYZ even though we provide no API for XYZ in libpq. Hopefully,
> those people will be few and far between, because anything that's a really
> common requirement should be catered for by libpq.
I understand that, but 4 variables is pretty darn far from what an
application developing for SSL is going to want. As I've mentioned
before when this has been brought up, I'm of the opinion that we should
be providing, from the start, the same set as Apache's SSL environment
variables:
The mod_ssl (OpenSSL-based) documentation:
http://httpd.apache.org/docs/2.2/mod/mod_ssl.html
For mod_gnutls, this is the list of SSL variables provided:
http://www.outoforder.cc/projects/apache/mod_gnutls/docs/#environment-variables
Note that they're pretty much the same set, so providing them for
OpenSSL isn't closing off the ability to provide GnuTLS in the future.
To be clear, I'm not asking for all of this to happen in the first
patch, but I'd like whomever is going forward with this to at least
agree that they're going to try and cover the Apache set for whatever
libraries are supported in the first major release we put out with this.
Considering the example is already there, I'm really hopeful that isn't
too difficult to do..
Thanks,
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: sfrost@snowman.net, tgl@sss.pgh.pa.us, robertmhaas@gmail.com, hlinnakangas@vmware.com, magnus@hagander.net
Subject: Re: PQgetssl() and alternative SSL implementations
In-Reply-To: <20150128173017.GZ3854@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox