From: | Bruce Momjian <bruce(at)momjian(dot)us> |
---|---|
To: | Bruce Momjian <bruce(at)momjian(dot)us> |
Cc: | Peter Eisentraut <peter_e(at)gmx(dot)net>, PostgreSQL-development <pgsql-hackers(at)postgresql(dot)org> |
Subject: | Re: libpq and sslmode=require |
Date: | 2008-11-04 22:36:54 |
Message-ID: | 200811042236.mA4Masx22273@momjian.us |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
Bruce Momjian wrote:
> > would impose a noticeable connection initiation overhead on everyone's
> > Unix-domain socket uses. You could make it use SSL in require mode, but
> > it seems weird that prefer mode would end up doing something different
> > than require mode.
> >
> > Maybe Magnus has an opinion on how we could make this fit into the new
> > scheme of things. I assume since we require certificates to be set up
> > now, SSL will by default be off and so using it over Unix-domain sockets
> > when enabled would not be in the common path, which was the objection
> > previously.
>
> Yep, the problem is that sslmode doesn't have any way to specify if we
> want unix domain sockets to behave differently from tcp sockets, and our
> default for sslmode makes that even worse.
I have added the following documentation patch to mention that 'sslmode'
is ignored for unix domain sockets; backpatched to 8.3.X.
--
Bruce Momjian <bruce(at)momjian(dot)us> http://momjian.us
EnterpriseDB http://enterprisedb.com
+ If your life is a hard drive, Christ can be your backup. +
Attachment | Content-Type | Size |
---|---|---|
/rtmp/diff | text/x-diff | 1.9 KB |
From | Date | Subject | |
---|---|---|---|
Next Message | Bruce Momjian | 2008-11-04 22:43:11 | Re: Updates of SE-PostgreSQL 8.4devel patches (r1168) |
Previous Message | Gregory Stark | 2008-11-04 22:18:39 | Re: [WIP] In-place upgrade |