Date: Wed, 28 Jan 2015 12:30:17 -0500
From: Stephen Frost <sfrost@snowman.net>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Robert Haas <robertmhaas@gmail.com>,
 Heikki Linnakangas <hlinnakangas@vmware.com>,
 Magnus Hagander <magnus@hagander.net>,
 PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: PQgetssl() and alternative SSL implementations
Message-ID: <20150128173017.GZ3854@tamriel.snowman.net>
References: 
 <CA+TgmoZDJ6CKiuBMqNk3iS7LQ9GZuzS7RTYSOvRu8kJjRKWLng@mail.gmail.com>
 <CABUevExpTZpMAMvr=BkeO5-XG_zgZP=TKdyCCpgEpYc0Htjr8Q@mail.gmail.com>
 <10419.1408475397@sss.pgh.pa.us>
 <CABUevEy03OvP3N3wBRVP7BcmwcHf=Qi6Crb2MHo4dVmG--ZnVg@mail.gmail.com>
 <CA+TgmoaKHd+HW8kOgzovdSTWhauEsV0qeRsxPLpEZfSNDiSP=g@mail.gmail.com>
 <53F3C87E.2080401@vmware.com> <54C8FCB0.4050304@vmware.com>
 <CA+TgmoYrAH=o8m9959O_TgHm7OcK9C=f3WJfUHryb4pzu5uZ0A@mail.gmail.com>
 <20150128165847.GY3854@tamriel.snowman.net>
 <32652.1422464685@sss.pgh.pa.us>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
 protocol="application/pgp-signature"; boundary="5qKznMjKMQvXoTz3"
Content-Disposition: inline
In-Reply-To: <32652.1422464685@sss.pgh.pa.us>
User-Agent: Mutt/1.5.21 (2010-09-15)
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org


--5qKznMjKMQvXoTz3
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

* Tom Lane (tgl@sss.pgh.pa.us) wrote:
> Stephen Frost <sfrost@snowman.net> writes:
> > What bothers me about this is that it punts SSL work to the application
> > and requires that they be coded to work with both OpenSSL and whatever
> > else we implement (eg: GnuTLS) to do anything but the most simple
> > checks.  That's a problem because people are *not* going to want to
> > #include both OpenSSL and GnuTLS headers into their applications because
> > they don't know which PG will be compiled with..  Not to mention that
> > it'd be darn awkward to do so.
>=20
> The point of this is to provide an escape hatch for people who really
> want to do XYZ even though we provide no API for XYZ in libpq.  Hopefully,
> those people will be few and far between, because anything that's a really
> common requirement should be catered for by libpq.

I understand that, but 4 variables is pretty darn far from what an
application developing for SSL is going to want.  As I've mentioned
before when this has been brought up, I'm of the opinion that we should
be providing, from the start, the same set as Apache's SSL environment
variables:

The mod_ssl (OpenSSL-based) documentation:
http://httpd.apache.org/docs/2.2/mod/mod_ssl.html

For mod_gnutls, this is the list of SSL variables provided:
http://www.outoforder.cc/projects/apache/mod_gnutls/docs/#environment-varia=
bles

Note that they're pretty much the same set, so providing them for
OpenSSL isn't closing off the ability to provide GnuTLS in the future.

To be clear, I'm not asking for all of this to happen in the first
patch, but I'd like whomever is going forward with this to at least
agree that they're going to try and cover the Apache set for whatever
libraries are supported in the first major release we put out with this.
Considering the example is already there, I'm really hopeful that isn't
too difficult to do..

	Thanks,

		Stephen

--5qKznMjKMQvXoTz3
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJUyRypAAoJEO1sijiDR2RVOlkP/2MjD7WRqqLm4YrlR6IbG0Gb
kvAdhVPwBynY+FQQyLiEACrruMnjEagmixPZW4tlO5TyW8La3nHoxmrlCBok3Gqy
WE8f3YFc71tWBVdiekNnlJcgYfnABc+xIvfvqYdg+tMUSo/B5rHVf0PvSFdeH3Rx
DvatwpyXlQf6XaCkeV7aCco7mGjINXC3ABWRmrujNZBCs0k7zRYOpAwp5flT7JHw
srtoxrQJ8fRMP3xShga6qnJ6Ai3ohVcbLSb4gSPH2P1kL9aWjptM0CNyNonFOLBZ
mJ2uO+fiuxV1jzKToQLU42RfNeioHmRRI7tfaERyh2P/kiXiJ00+FmTi++/RgNHO
uyRFobROI4KU4Ik/VBFU+X45DLP1N2gNk8YjMg3F0TsvZRnX6H7Eto0oKOCREWzy
imyEwcCIEWXYqQilsiEGavu27RSzoiD0861weba1ysreJBywjK13u7qmY9N12rFT
J795qwDYU0pLa4WxWbYD922XcsWLzYcpdQeAUknNPuB2bWlISap04HJy+ayoFdOi
FYElCDTU2nnef1MzQrS0M9Jol24xsbDimAyKkwp0P+Yaa6ihcrwZ9iODhCl8PC12
Z07F70uaIQTxFuizvk39GTZNJ4EN1cainnH5iCJQ3d7G/7dAPdih7MJaeG96xE8U
PmD67sZqqSlXaJOZzYg+
=dUti
-----END PGP SIGNATURE-----

--5qKznMjKMQvXoTz3--