Thread: ssl_library parameter
Extracted from the GnuTLS thread/patch, here is a patch to add a server-side read-only parameter ssl_library, which currently reports either 'OpenSSL' or an empty string, depending on what SSL library was built with. This is analogous to the libpq function call PQsslAttribute(conn, "library"), but there was no equivalent functionality on the server side. -- Peter Eisentraut http://www.2ndQuadrant.com/ PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
Attachment
> On 26 Jun 2018, at 11:06, Peter Eisentraut <peter.eisentraut@2ndquadrant.com> wrote: > > Extracted from the GnuTLS thread/patch, here is a patch to add a > server-side read-only parameter ssl_library, which currently reports > either 'OpenSSL' or an empty string, depending on what SSL library was > built with. This is analogous to the libpq function call > PQsslAttribute(conn, "library"), but there was no equivalent > functionality on the server side. Looks good to me, +1 cheers ./daniel
Peter Eisentraut <peter.eisentraut@2ndquadrant.com> writes: > Extracted from the GnuTLS thread/patch, here is a patch to add a > server-side read-only parameter ssl_library, which currently reports > either 'OpenSSL' or an empty string, depending on what SSL library was > built with. This is analogous to the libpq function call > PQsslAttribute(conn, "library"), but there was no equivalent > functionality on the server side. (1) I'm not really clear why we need this. GUC variables aren't free. (2) Are there security issues with exposing this info to everybody? regards, tom lane
On 6/26/18 17:48, Tom Lane wrote: > (1) I'm not really clear why we need this. GUC variables aren't free. > > (2) Are there security issues with exposing this info to everybody? This functionality was requested in the threads about GnuTLS and other SSL implementations so that users/admins can determine which SSL settings are applicable. I'm not sure about the security impact. We do expose all the other ssl_* settings to ordinary users, so if users want to see whether the server is misconfigured or something like that, they can already do that. I think in the context of an SSL connection, the server is not supposed to be the adversary of the client, so if the server can provide more information about what it's doing to protect the client's information, then the better. -- Peter Eisentraut http://www.2ndQuadrant.com/ PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
On 26/06/2018 11:49, Daniel Gustafsson wrote: >> Extracted from the GnuTLS thread/patch, here is a patch to add a >> server-side read-only parameter ssl_library, which currently reports >> either 'OpenSSL' or an empty string, depending on what SSL library was >> built with. This is analogous to the libpq function call >> PQsslAttribute(conn, "library"), but there was no equivalent >> functionality on the server side. > > Looks good to me, +1 committed -- Peter Eisentraut http://www.2ndQuadrant.com/ PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services