pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Florian Pflug <fgp@phlo.org>
Cc: Magnus Hagander <magnus@hagander.net>
Cc: Euler Taveira <euler@timbira.com>
Cc: Bruce Momjian <bruce@momjian.us>
Cc: Pgsql Hackers <pgsql-hackers@postgresql.org>
Subject: Re: libpq compression
Date: Sun, 17 Jun 2012 12:29:53 -0400
Message-ID: <27043.1339950593@sss.pgh.pa.us> (raw)
In-Reply-To: <9B10BD6E-31AA-4699-BB67-5C386B623F77@phlo.org>
References: <4FD9698F.2090407@timbira.com>
	<29853.1339651170@sss.pgh.pa.us>
	<4FD9E70B.9040607@timbira.com>
	<11502.1339699384@sss.pgh.pa.us>
	<20120615021938.GA21704@momjian.us>
	<CABUevEyv4T+1gR6_Uqm_1qUD9PNDg6UdXbJhwHZgFi9hpQQ6NQ@mail.gmail.com>
	<F3B8BAA6-23E9-423A-A7D1-D2E14769F326@phlo.org>
	<CABUevExi-cJ6AvF2kDOy+qQsB+0JHofrcvVmNVoJ2HziZMMaAg@mail.gmail.com>
	<22690C61-E960-4A2A-BFD5-DAD3D3B5C474@phlo.org>
	<CABUevEzVpqS5RCLz2fFREdPFkuYkEKsrMpnfPixYWPki2=iJOA@mail.gmail.com>
	<4FDB954F.9010606@timbira.com>
	<5136.1339799120@sss.pgh.pa.us>
	<5365.1339799869@sss.pgh.pa.us>
	<CABUevEz_V4YYc0tUhkC6KD2GddysM5Z76pcHcMYiMDd7dwMxVQ@mail.gmail.com>
	<11357.1339822502@sss.pgh.pa.us>
	<CABUevEy1sUTOeCjNicUggnMpT7MfgjWud8kQ=wkvJsfbCU8=WQ@mail.gmail.com>
	<19804.1339859730@sss.pgh.pa.us>
	<9B10BD6E-31AA-4699-BB67-5C386B623F77@phlo.org>

Florian Pflug <fgp@phlo.org> writes:
> Would we still tell openssl to only negotiate ciphers in the configured
> list of available ciphers + NULL? If not, what happens if a connection
> happens to use a cipher that is actually stronger than any cipher on
> the "list of acceptable ciphers" list? The DBA wouldn't necessarily be
> aware that such a cipher even exists, since it could have been made
> available by an openssl upgrade

So?  If the DBA has gone so far as to list specific ciphers, who are
we to second guess his judgment?  It's not for us to decide that cipher
X is "stronger" than the ones he listed.

> But if we restrict the negotiable ciphers to the configure list + NULL,
> then we're good I think.

The fly in the ointment with any of these ideas is that the "configure
list" is not a list of exact cipher names, as per Magnus' comment that
the current default includes tests like "!aNULL".  I am not sure that
we know how to evaluate such conditions if we are applying an
after-the-fact check on the selected cipher.  Does OpenSSL expose any
API for evaluating whether a selected cipher meets such a test?

			regards, tom lane



view thread (289+ messages)  latest in thread

Message-ID: <27043.1339950593@sss.pgh.pa.us>
Permalink:  ../27043.1339950593@sss.pgh.pa.us/
Also on:    postgresql.org/message-id/27043.1339950593@sss.pgh.pa.us

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: tgl@sss.pgh.pa.us, fgp@phlo.org, magnus@hagander.net, euler@timbira.com, bruce@momjian.us
  Subject: Re: libpq compression
  In-Reply-To: <27043.1339950593@sss.pgh.pa.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox