pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Jacob Champion <pchampion@vmware.com>
To: magnus@hagander.net <magnus@hagander.net>
To: michael@paquier.xyz <michael@paquier.xyz>
Cc: stark@mit.edu <stark@mit.edu>
Cc: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Cc: sfrost@snowman.net <sfrost@snowman.net>
Cc: tgl@sss.pgh.pa.us <tgl@sss.pgh.pa.us>
Subject: Re: Proposal: Save user's original authenticated identity for logging
Date: Mon, 22 Mar 2021 18:51:10 +0000
Message-ID: <3d9a91695d369d0ee14e8e9f126995578e623b79.camel@vmware.com> (raw)
In-Reply-To: <CABUevEz_W11aYWf8JJf3vHo7sBG8Wx3UaiZAF9-qepH3di49Zw@mail.gmail.com>
References: <4b2ca51542fa84e6fa37ab678624d5b400c092c0.camel@vmware.com>
	<CABUevExVHryTasKmtJW5RtU-dBesYj4bV7ggpeVMfiPCHCvLNA@mail.gmail.com>
	<a2fab8e350c86aa4fe245d1af521b0bbc807f11e.camel@vmware.com>
	<fc536fc557a664ad7b9dc0bf46ea335039044905.camel@vmware.com>
	<679382aaff23627a2e53541322c7a3158d402394.camel@vmware.com>
	<e3f7433d3e2bf31e8f67a9fb3790f660b7af586e.camel@vmware.com>
	<YFML4MDZVWWuIBTF@paquier.xyz>
	<YFRfD6h+iosaiQY7@paquier.xyz>
	<65354d28ec024d610ee7fe0128a69075d2092043.camel@vmware.com>
	<d88b52ac2539caa7eb28bde6db589926e187ab76.camel@vmware.com>
	<YFg2QJolwvV7K33B@paquier.xyz>
	<CABUevEz_W11aYWf8JJf3vHo7sBG8Wx3UaiZAF9-qepH3di49Zw@mail.gmail.com>

On Mon, 2021-03-22 at 18:22 +0100, Magnus Hagander wrote:
> On Mon, Mar 22, 2021 at 7:16 AM Michael Paquier <michael@paquier.xyz> wrote:
> > 
> > I have briefly looked at 0002 (0001 in the attached set), and it seems
> > sane to me.  I still need to look at 0003 (well, now 0002) in details,
> > which is very sensible as one mistake would likely be a CVE-class
> > bug.
> 
> The 0002/0001/whateveritisaftertherebase is tracked over at
> https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.postgresql.org%2Fmessage-id%2F...
> isn't it? I've assumed the expectation is to have that one committed
> from that thread, and then rebase using that.

I think the primary thing that needs to be greenlit for both is the
idea of using the RFC 2253/4514 format for Subject DNs.

Other than that, the version here should only contain the changes
necessary for both features (that is, port->peer_dn), so there's no
hard dependency between the two. It's just on me to make sure my
version is up-to-date. Which I believe it is, as of today.

--Jacob


view thread (80+ messages)  latest in thread

Message-ID: <3d9a91695d369d0ee14e8e9f126995578e623b79.camel@vmware.com>
Permalink:  ../3d9a91695d369d0ee14e8e9f126995578e623b79.camel@vmware.com/
Also on:    postgresql.org/message-id/3d9a91695d369d0ee14e8e9f126995578e623b79.camel@vmware.com

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: pchampion@vmware.com, magnus@hagander.net, michael@paquier.xyz, stark@mit.edu, sfrost@snowman.net, tgl@sss.pgh.pa.us
  Subject: Re: Proposal: Save user's original authenticated identity for logging
  In-Reply-To: <3d9a91695d369d0ee14e8e9f126995578e623b79.camel@vmware.com>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox