pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Andreas Karlsson <andreas@proxel.se>
Cc: Stephen Frost <sfrost@snowman.net>
Cc: Magnus Hagander <magnus@hagander.net>
Cc: Michael Paquier <michael.paquier@gmail.com>
Cc: Michael Banck <michael.banck@credativ.de>
Cc: Peter Geoghegan <pg@heroku.com>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH] Reload SSL certificates on SIGHUP
Date: Wed, 04 Jan 2017 10:57:20 -0500
Message-ID: <23703.1483545440@sss.pgh.pa.us> (raw)
In-Reply-To: <cf2ea102-13cd-d51a-8dfe-dfe6b9269e63@2ndquadrant.com>
References: <05677cd3-63b2-b15b-7afd-798e34e607c7@proxel.se>
	<CAB7nPqQU50-UMuFcffmynDbH7_kBx3N-Q3ujL-nM2OF3X8biMA@mail.gmail.com>
	<16e282a4-2573-f629-09e8-e6b0ac615890@2ndquadrant.com>
	<29982.1483412575@sss.pgh.pa.us>
	<CABUevExczKi876tfqH5dY7QcMQu6v3KFBwckozD_OJr0kgVidw@mail.gmail.com>
	<23913.1483458895@sss.pgh.pa.us>
	<CABUevEzWtbL8PqcYXEagCVH_NHYQdMcXqZv4GXEeCW=kkd-J0Q@mail.gmail.com>
	<20995.1483541230@sss.pgh.pa.us>
	<CABUevExdkO3TTLYhc2oQAOWXbnz+mJ8=Tfg+WsB2P6p-_wfYyg@mail.gmail.com>
	<7fca80da-0274-3f36-eb25-d53f940c1977@proxel.se>
	<20170104151429.GP18360@tamriel.snowman.net>
	<1254e97b-a65a-5a63-e938-810507a16d71@proxel.se>
	<22644.1483543579@sss.pgh.pa.us>
	<cf2ea102-13cd-d51a-8dfe-dfe6b9269e63@2ndquadrant.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>

Peter Eisentraut <peter.eisentraut@2ndquadrant.com> writes:
> On 1/4/17 10:26 AM, Tom Lane wrote:
>> How will you know whether there's a pass phrase?

> One could register a password callback that remembers whether it was called.

Hmm ... actually, we don't even need to work that hard.  If we simply
use the callback that's there now, but only during reloads not server
start, then we get the desired behavior.  Reloads will fail because
the wrong passphrase was returned by the callback, and we'll keep the
current SSL state.  It would probably be worth tweaking things to minimize
the amount of log spam that you get from that; but it would work, for
values of "work" similar to what was there before.

I still maintain that the existing solution for passphrases is useless,
but in the interest of removing objections to the current patch, I'll
go make that happen.

			regards, tom lane


-- 
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers



view thread (69+ messages)  latest in thread

Message-ID: <23703.1483545440@sss.pgh.pa.us>
Permalink:  ../23703.1483545440@sss.pgh.pa.us/
Also on:    postgresql.org/message-id/23703.1483545440@sss.pgh.pa.us

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: tgl@sss.pgh.pa.us, peter.eisentraut@2ndquadrant.com, andreas@proxel.se, sfrost@snowman.net, magnus@hagander.net, michael.paquier@gmail.com, michael.banck@credativ.de, pg@heroku.com
  Subject: Re: [PATCH] Reload SSL certificates on SIGHUP
  In-Reply-To: <23703.1483545440@sss.pgh.pa.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox