Date: Sat, 15 Aug 2020 13:18:22 -0400
From: Stephen Frost <sfrost@snowman.net>
To: Kyotaro Horiguchi <horikyota.ntt@gmail.com>
Cc: pgsql-hackers@postgresql.org
Subject: Re: Is it worth accepting multiple CRLs?
Message-ID: <20200815171822.GF29590@tamriel.snowman.net>
References: <20200731.173911.904649928639357911.horikyota.ntt@gmail.com>
 <20200731130014.GC12375@tamriel.snowman.net>
 <20200803.162040.876495006040204008.horikyota.ntt@gmail.com>
 <20200804.173708.930007886231591254.horikyota.ntt@gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="mXWEJCq0x1D2MX0F"
Content-Disposition: inline
In-Reply-To: <20200804.173708.930007886231591254.horikyota.ntt@gmail.com>
User-Agent: Mutt/1.5.24 (2015-08-30)
Precedence: bulk


--mXWEJCq0x1D2MX0F
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

Greetings,

* Kyotaro Horiguchi (horikyota.ntt@gmail.com) wrote:
> At Mon, 03 Aug 2020 16:20:40 +0900 (JST), Kyotaro Horiguchi <horikyota.nt=
t@gmail.com> wrote in=20
> > Thanks for the opinion. I'll continue working on this.
>=20
> This is it, but..=20

Thanks!

> Looking closer I realized that certificates are verified in each
> backend so CRL cache doesn't work at all for the hashed directory
> method. Therefore, all CRL files relevant to a certificate to be
> verfied are loaded every time a backend starts.
>=20
> The only advantage of this is avoiding irrelevant CRLs from being
> loaded in exchange of loading relevant CRLs at every session
> start. Session startup gets slower by many delta CRLs from the same
> CA.
>=20
> Seems far from promising.

I agree that it's not ideal, but I don't know that this is a reason to
not move forward with this feature..?

We could certainly have a later patch which improves this in some way
(though exactly how isn't clear...  if we move the CRL loading into
postmaster then we'd have to load *all* of them, and then we'd still
need to check if they've changed since we loaded them, and presumably
have some way to signal the postmaster to update its set from time to
time..), but that can be a future effort.

I took a quick look through the patch and it seemed pretty straight
forward to me and a good improvement.

Would love to hear other thoughts.  I hope you'll submit this for the
September CF and ping me when you do and I'll see if I can get it
committed.

Thanks!

Stephen

--mXWEJCq0x1D2MX0F
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJfOBjeAAoJEO1sijiDR2RVZJoP/1s5LHTI1uDFZGoOx68eK98x
KEFKqZjXh1wnNNnB/bVw1sii+lOJOxEYOx4mH3Uno+NUvqBgC1dMGZ2ZowPtq0mE
Fz+TpJH8197md8/jxEWxj0zU+qtE0jnQWgTj4vAlLmIa/UpEY2mq++BoXKk7poxM
GhQY3MI4r9onrlwcPX7O3pBiX5NDzq/XhwkcK6w36AcwIQv5MfSeg9A/R8f/11sO
ocOQJxQ0+5XN0XBwd4cwwRPPBUa49lSjzOce70FPC6HOfgpYS1cC96p8obm8ZI0A
3qAsjz1R+zaaAkdBGlYRC/WdkvtHFQCvTewxFtskSQ7BRV9o9JTlEF6r37wby526
FZzXkRpyn8pOaRXmbQQZWWERWxWUQ7YO8WWT5PiYs9d3je9mJeMuo3MxgDv7uvn7
J/RWxfYs4kBnq9L5IDibprPtkMMjIG/4xJH2LUD6c2dboNHqLlfTZwQ8/CeWygY/
M/UgWI/tuEIkGZX7KKnjT6ywOP374zfYjFwKAT4TGJfaTXJ9vgcR9fqo/znFSJJo
Sb19czCIddNVkTvc1lvd6LSh0wkHNYaoBLAN9tXZi1+eYkMusLpbNQFCyu3Ghbte
e8gevVZ1YQkODM4HLY0RBWh6SfFwTsFyC+jL33EhD+HT26dnDxrA5WoKVBkhFPqA
MP68P/y7/Wq6SsChXHMe
=fLUC
-----END PGP SIGNATURE-----

--mXWEJCq0x1D2MX0F--