Re: [HACKERS] [PATCH 1/2] SSL: GUC option to prefer server cipher order

2013-12-07 Thread Peter Eisentraut
Committed your v2 patch (with default to on). I added a small snippet of documentation explaining that this setting is mainly for backward compatibility. -- Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailp

Re: [HACKERS] [PATCH 1/2] SSL: GUC option to prefer server cipher order

2013-11-29 Thread Marko Kreen
On Fri, Nov 29, 2013 at 05:51:28PM +0200, Heikki Linnakangas wrote: > On 11/29/2013 05:43 PM, Marko Kreen wrote: > >On Fri, Nov 29, 2013 at 09:25:02AM -0500, Peter Eisentraut wrote: > >>On Thu, 2013-11-14 at 11:45 +0100, Magnus Hagander wrote: > >>>I think the default behaviour should be the one we

Re: [HACKERS] [PATCH 1/2] SSL: GUC option to prefer server cipher order

2013-11-29 Thread Heikki Linnakangas
On 11/29/2013 05:43 PM, Marko Kreen wrote: On Fri, Nov 29, 2013 at 09:25:02AM -0500, Peter Eisentraut wrote: On Thu, 2013-11-14 at 11:45 +0100, Magnus Hagander wrote: I think the default behaviour should be the one we recommend (which would be to have the server one be preferred). But I do agre

Re: [HACKERS] [PATCH 1/2] SSL: GUC option to prefer server cipher order

2013-11-29 Thread Marko Kreen
On Fri, Nov 29, 2013 at 09:25:02AM -0500, Peter Eisentraut wrote: > On Thu, 2013-11-14 at 11:45 +0100, Magnus Hagander wrote: > > I think the default behaviour should be the one we recommend (which > > would be to have the server one be preferred). But I do agree with the > > requirement to have a

Re: [HACKERS] [PATCH 1/2] SSL: GUC option to prefer server cipher order

2013-11-29 Thread Peter Eisentraut
On Thu, 2013-11-14 at 11:45 +0100, Magnus Hagander wrote: > I think the default behaviour should be the one we recommend (which > would be to have the server one be preferred). But I do agree with the > requirement to have a GUC to be able to remove it Is there a reason why you would want to turn

Re: [HACKERS] [PATCH 1/2] SSL: GUC option to prefer server cipher order

2013-11-14 Thread Magnus Hagander
On Thursday, November 7, 2013, Marko Kreen wrote: > On Wed, Nov 06, 2013 at 09:57:32PM -0300, Alvaro Herrera wrote: > > Marko Kreen escribió: > > > > > By default OpenSSL (and SSL/TLS in general) lets client cipher > > > order take priority. This is OK for browsers where the ciphers > > > were tu

Re: [HACKERS] [PATCH 1/2] SSL: GUC option to prefer server cipher order

2013-11-06 Thread Marko Kreen
On Wed, Nov 06, 2013 at 09:57:32PM -0300, Alvaro Herrera wrote: > Marko Kreen escribió: > > > By default OpenSSL (and SSL/TLS in general) lets client cipher > > order take priority. This is OK for browsers where the ciphers > > were tuned, but few Postgres client libraries make cipher order > > c

Re: [HACKERS] [PATCH 1/2] SSL: GUC option to prefer server cipher order

2013-11-06 Thread Alvaro Herrera
Marko Kreen escribió: > By default OpenSSL (and SSL/TLS in general) lets client cipher > order take priority. This is OK for browsers where the ciphers > were tuned, but few Postgres client libraries make cipher order > configurable. So it makes sense to make cipher order in > postgresql.conf ta