Re: [HACKERS] [PATCH] Automatic client certificate selection support for libpq v1

2009-05-11 Thread Magnus Hagander
Peter Eisentraut wrote: > On Monday 11 May 2009 11:02:17 Magnus Hagander wrote: >> Another thought: if we were to make ourselves support multiple SSL >> libraries (that has been suggested before - at that point, people wanted >> GnuTLS), we could also add support for Windows SChannel, which I'm sur

Re: [HACKERS] [PATCH] Automatic client certificate selection support for libpq v1

2009-05-11 Thread Peter Eisentraut
On Monday 11 May 2009 11:02:17 Magnus Hagander wrote: > Another thought: if we were to make ourselves support multiple SSL > libraries (that has been suggested before - at that point, people wanted > GnuTLS), we could also add support for Windows SChannel, which I'm sure > some win32 people would c

Re: [HACKERS] [PATCH] Automatic client certificate selection support for libpq v1

2009-05-11 Thread Seth Robertson
In message <20090511144317.gc8...@alvh.no-ip.org>, Alvaro Herrera writes: Magnus Hagander wrote: > Another thought: if we were to make ourselves support multiple SSL > libraries (that has been suggested before - at that point, people wanted > GnuTLS), we could also add suppor

Re: [HACKERS] [PATCH] Automatic client certificate selection support for libpq v1

2009-05-11 Thread Seth Robertson
In message <4a07db89.2080...@hagander.net>, Magnus Hagander writes: Is NSS available on all the platforms that we are (and that has OpenSSL today)? NSS stopped publishing their supported platform list for NSS for some strange reasons (older version have it). But I'd probably assume that

Re: [HACKERS] [PATCH] Automatic client certificate selection support for libpq v1

2009-05-11 Thread Alvaro Herrera
Magnus Hagander wrote: > Another thought: if we were to make ourselves support multiple SSL > libraries (that has been suggested before - at that point, people wanted > GnuTLS), we could also add support for Windows SChannel, which I'm sure > some win32 people would certainly prefer - much easier

Re: [HACKERS] [PATCH] Automatic client certificate selection support for libpq v1

2009-05-11 Thread Magnus Hagander
Seth Robertson wrote: > In message <14727.1241816...@sss.pgh.pa.us>, Tom Lane writes: > > > It is of course possible to support both at the same time (at > > compile-time, if nowhere else). > > Yes, I suppose we'd not wish to just drop openssl completely. > I wonder how much c

Re: [HACKERS] [PATCH] Automatic client certificate selection support for libpq v1

2009-05-11 Thread Magnus Hagander
Peter Eisentraut wrote: > On Friday 08 May 2009 22:03:56 Tom Lane wrote: >> I hesitate though to suggest that we think about porting >> ourselves to NSS --- I'm not sure that there would be benefits to us >> within the context of Postgres alone. > > That could be attractive if we ripped out the O

Re: [HACKERS] [PATCH] Automatic client certificate selection support for libpq v1

2009-05-11 Thread Peter Eisentraut
On Friday 08 May 2009 22:03:56 Tom Lane wrote: > I hesitate though to suggest that we think about porting > ourselves to NSS --- I'm not sure that there would be benefits to us > within the context of Postgres alone. That could be attractive if we ripped out the OpenSSL code at the same time, as

Re: [HACKERS] [PATCH] Automatic client certificate selection support for libpq v1

2009-05-08 Thread Seth Robertson
In message <14727.1241816...@sss.pgh.pa.us>, Tom Lane writes: > It is of course possible to support both at the same time (at > compile-time, if nowhere else). Yes, I suppose we'd not wish to just drop openssl completely. I wonder how much code duplication would ensue from a

Re: [HACKERS] [PATCH] Automatic client certificate selection support for libpq v1

2009-05-08 Thread Tom Lane
Seth Robertson writes: > In message <12314.1241809...@sss.pgh.pa.us>, Tom Lane writes: > BTW, I was reminded today that Fedora/Red Hat are hoping to standardize > all crypto-related functionality in their entire distro on the NSS > libraries: > I am not perfectly up to speed, but swit

Re: [HACKERS] [PATCH] Automatic client certificate selection support for libpq v1

2009-05-08 Thread Seth Robertson
In message <12314.1241809...@sss.pgh.pa.us>, Tom Lane writes: Seth Robertson writes: > In message <8766.1241799...@sss.pgh.pa.us>, Tom Lane writes: >> Hmm, shouldn't we fix *that* rather than inventing a hack like this? > Basically doing this would probably become a proj

Re: [HACKERS] [PATCH] Automatic client certificate selection support for libpq v1

2009-05-08 Thread Tom Lane
Seth Robertson writes: > In message <8766.1241799...@sss.pgh.pa.us>, Tom Lane writes: >> Hmm, shouldn't we fix *that* rather than inventing a hack like this? > Basically doing this would probably become a project instead of a 5 > minute hack to support 80% of the functionality. I understand

Re: [HACKERS] [PATCH] Automatic client certificate selection support for libpq v1

2009-05-08 Thread Seth Robertson
In message <8766.1241799...@sss.pgh.pa.us>, Tom Lane writes: Seth Robertson writes: > I had a situation where I needed to connect to multiple postgresql > servers in a variety of programs written in a variety of languages, > including some which connected to multiple servers at t

Re: [HACKERS] [PATCH] Automatic client certificate selection support for libpq v1

2009-05-08 Thread Tom Lane
Seth Robertson writes: > I had a situation where I needed to connect to multiple postgresql > servers in a variety of programs written in a variety of languages, > including some which connected to multiple servers at the same time. > As some of you might know, you cannot usefully put multiple > c

[HACKERS] [PATCH] Automatic client certificate selection support for libpq v1

2009-05-08 Thread Seth Robertson
I had a situation where I needed to connect to multiple postgresql servers in a variety of programs written in a variety of languages, including some which connected to multiple servers at the same time. As some of you might know, you cannot usefully put multiple certificates or keys in the postgr