From: Stephen Frost <sfrost@snowman.net>
To: Kyotaro Horiguchi <horikyota.ntt@gmail.com>
Cc: pgsql-hackers@postgresql.org
Subject: Re: Is it worth accepting multiple CRLs?
Date: Sat, 15 Aug 2020 13:18:22 -0400
Message-ID: <20200815171822.GF29590@tamriel.snowman.net> (raw)
In-Reply-To: <20200804.173708.930007886231591254.horikyota.ntt@gmail.com>
References: <20200731.173911.904649928639357911.horikyota.ntt@gmail.com>
<20200731130014.GC12375@tamriel.snowman.net>
<20200803.162040.876495006040204008.horikyota.ntt@gmail.com>
<20200804.173708.930007886231591254.horikyota.ntt@gmail.com>
Greetings,
* Kyotaro Horiguchi (horikyota.ntt@gmail.com) wrote:
> At Mon, 03 Aug 2020 16:20:40 +0900 (JST), Kyotaro Horiguchi <horikyota.ntt@gmail.com> wrote in
> > Thanks for the opinion. I'll continue working on this.
>
> This is it, but..
Thanks!
> Looking closer I realized that certificates are verified in each
> backend so CRL cache doesn't work at all for the hashed directory
> method. Therefore, all CRL files relevant to a certificate to be
> verfied are loaded every time a backend starts.
>
> The only advantage of this is avoiding irrelevant CRLs from being
> loaded in exchange of loading relevant CRLs at every session
> start. Session startup gets slower by many delta CRLs from the same
> CA.
>
> Seems far from promising.
I agree that it's not ideal, but I don't know that this is a reason to
not move forward with this feature..?
We could certainly have a later patch which improves this in some way
(though exactly how isn't clear... if we move the CRL loading into
postmaster then we'd have to load *all* of them, and then we'd still
need to check if they've changed since we loaded them, and presumably
have some way to signal the postmaster to update its set from time to
time..), but that can be a future effort.
I took a quick look through the patch and it seemed pretty straight
forward to me and a good improvement.
Would love to hear other thoughts. I hope you'll submit this for the
September CF and ping me when you do and I'll see if I can get it
committed.
Thanks!
Stephen
Attachments:
signature.asc (application/pgp-signature, 818B) download
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: sfrost@snowman.net, horikyota.ntt@gmail.com
Subject: Re: Is it worth accepting multiple CRLs?
In-Reply-To: <20200815171822.GF29590@tamriel.snowman.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox