Re: Experiments with Postgres and SSL - Mailing list pgsql-hackers

From Jacob Champion
Subject Re: Experiments with Postgres and SSL
Date
Msg-id CAAWbhmjetCVgu9pHJFkQ4ejuXuaz2mD1oniXokRHft0usCa7Yg@mail.gmail.com
Whole thread Raw
In response to Re: Experiments with Postgres and SSL  (Greg Stark <stark@mit.edu>)
List pgsql-hackers
On Tue, Feb 28, 2023 at 10:33 AM Greg Stark <stark@mit.edu> wrote:
> On Wed, 22 Feb 2023 at 07:27, Heikki Linnakangas <hlinnaka@iki.fi> wrote:
> > Good idea. Do we want to just require the protocol to be "postgres", or
> > perhaps "postgres/3.0"? Need to register that with IANA, I guess.
>
> I had never heard of this before, it does seem useful. But if I
> understand it right it's entirely independent of this patch.

It can be. If you want to use it in the strongest possible way,
though, you'd have to require its use by clients. Introducing that
requirement later would break existing ones, so I think it makes sense
to do it at the same time as the initial implementation, if there's
interest.

> We can
> add it to all our Client/Server exchanges whether they're the initial
> direct SSL connection or the STARTTLS negotiation?

I'm not sure it would buy you anything during the STARTTLS-style
opening. You already know what protocol you're speaking in that case.
(So with the ALPACA example, the damage is already done.)

Thanks,
--Jacob



pgsql-hackers by date:

Previous
From: Tomas Vondra
Date:
Subject: Re: Memory leak from ExecutorState context?
Next
From: Alvaro Herrera
Date:
Subject: Re: cataloguing NOT NULL constraints