Re: [HACKERS] Removing SSL renegotiation (Was: Should we back-patch SSL renegotiation fixes?)

2015-06-27 Thread Andres Freund
On 2015-06-27 15:07:05 +0900, Michael Paquier wrote: On Sat, Jun 27, 2015 at 6:12 AM, Tom Lane t...@sss.pgh.pa.us wrote: Andres Freund and...@anarazel.de writes: On 2015-06-24 16:41:48 +0200, Andres Freund wrote: I, by now, have come to a different conclusion. I think it's time to

Re: [HACKERS] Removing SSL renegotiation (Was: Should we back-patch SSL renegotiation fixes?)

2015-06-27 Thread Tom Lane
Andres Freund and...@anarazel.de writes: On 2015-06-27 15:07:05 +0900, Michael Paquier wrote: +1 for removing on master and just disabling on back-branches. The problem with that approach is that it leaves people hanging in the dry if they've uncommented the default value, or changed it. That

Re: [HACKERS] Removing SSL renegotiation (Was: Should we back-patch SSL renegotiation fixes?)

2015-06-27 Thread Andres Freund
On 2015-06-27 12:10:49 -0400, Tom Lane wrote: Andres Freund and...@anarazel.de writes: On 2015-06-27 15:07:05 +0900, Michael Paquier wrote: +1 for removing on master and just disabling on back-branches. The problem with that approach is that it leaves people hanging in the dry if

Re: [HACKERS] Removing SSL renegotiation (Was: Should we back-patch SSL renegotiation fixes?)

2015-06-26 Thread Tom Lane
Andres Freund and...@anarazel.de writes: On 2015-06-24 16:41:48 +0200, Andres Freund wrote: I, by now, have come to a different conclusion. I think it's time to entirely drop the renegotiation support. I think by now we essentially concluded that we should do that. What I'm not sure yet is

Re: [HACKERS] Removing SSL renegotiation (Was: Should we back-patch SSL renegotiation fixes?)

2015-06-26 Thread Andres Freund
On 2015-06-24 16:41:48 +0200, Andres Freund wrote: I, by now, have come to a different conclusion. I think it's time to entirely drop the renegotiation support. I think by now we essentially concluded that we should do that. What I'm not sure yet is how: Do we want to rip it out in master and

Re: [HACKERS] Removing SSL renegotiation (Was: Should we back-patch SSL renegotiation fixes?)

2015-06-26 Thread David G. Johnston
On Fri, Jun 26, 2015 at 3:09 PM, Andres Freund and...@anarazel.de wrote: On 2015-06-24 16:41:48 +0200, Andres Freund wrote: I, by now, have come to a different conclusion. I think it's time to entirely drop the renegotiation support. I think by now we essentially concluded that we should

Re: [HACKERS] Removing SSL renegotiation (Was: Should we back-patch SSL renegotiation fixes?)

2015-06-26 Thread Andres Freund
On 2015-06-26 15:36:53 -0400, David G. Johnston wrote: On Fri, Jun 26, 2015 at 3:09 PM, Andres Freund and...@anarazel.de wrote: On 2015-06-24 16:41:48 +0200, Andres Freund wrote: I, by now, have come to a different conclusion. I think it's time to entirely drop the renegotiation

Re: [HACKERS] Removing SSL renegotiation (Was: Should we back-patch SSL renegotiation fixes?)

2015-06-25 Thread Magnus Hagander
On Jun 24, 2015 7:40 PM, Andres Freund and...@anarazel.de wrote: On 2015-06-24 12:57:03 -0400, Robert Haas wrote: On Wed, Jun 24, 2015 at 11:11 AM, Tom Lane t...@sss.pgh.pa.us wrote: Andres Freund and...@anarazel.de writes: I, by now, have come to a different conclusion. I think it's

Re: [HACKERS] Removing SSL renegotiation (Was: Should we back-patch SSL renegotiation fixes?)

2015-06-24 Thread Andres Freund
On 2015-06-24 11:11:16 -0400, Tom Lane wrote: On balance I think I agree that SSL renegotiation has not been worth the trouble. And we definitely aren't testing it adequately, so if we wanted to keep it then there's even *more* work that somebody ought to expend. Right. Our code was nearly

Re: [HACKERS] Removing SSL renegotiation (Was: Should we back-patch SSL renegotiation fixes?)

2015-06-24 Thread Tom Lane
Andres Freund and...@anarazel.de writes: I, by now, have come to a different conclusion. I think it's time to entirely drop the renegotiation support. Well, that's a radical proposal, but I think we should take it seriously. On balance I think I agree that SSL renegotiation has not been worth

Re: [HACKERS] Removing SSL renegotiation (Was: Should we back-patch SSL renegotiation fixes?)

2015-06-24 Thread Magnus Hagander
On Jun 24, 2015 5:13 PM, Tom Lane t...@sss.pgh.pa.us wrote: Andres Freund and...@anarazel.de writes: I, by now, have come to a different conclusion. I think it's time to entirely drop the renegotiation support. Well, that's a radical proposal, but I think we should take it seriously.

Re: [HACKERS] Removing SSL renegotiation (Was: Should we back-patch SSL renegotiation fixes?)

2015-06-24 Thread Andres Freund
On 2015-06-24 19:35:51 +0200, Andres Freund wrote: Our code currently uses crude hacks (c.f. comment around SSL_clear_num_renegotiations(), and the loop around SSL_do_handshake() in the back branches) to manage renegotiations. There's pending patches to substantially increase the amount of

Re: [HACKERS] Removing SSL renegotiation (Was: Should we back-patch SSL renegotiation fixes?)

2015-06-24 Thread Robert Haas
On Wed, Jun 24, 2015 at 11:11 AM, Tom Lane t...@sss.pgh.pa.us wrote: Andres Freund and...@anarazel.de writes: I, by now, have come to a different conclusion. I think it's time to entirely drop the renegotiation support. Well, that's a radical proposal, but I think we should take it seriously.

Re: [HACKERS] Removing SSL renegotiation (Was: Should we back-patch SSL renegotiation fixes?)

2015-06-24 Thread Andres Freund
On 2015-06-24 12:57:03 -0400, Robert Haas wrote: On Wed, Jun 24, 2015 at 11:11 AM, Tom Lane t...@sss.pgh.pa.us wrote: Andres Freund and...@anarazel.de writes: I, by now, have come to a different conclusion. I think it's time to entirely drop the renegotiation support. Well, that's a