[PATCH] Remove useless DH param code on client side
От | Martijn van Oosterhout |
---|---|
Тема | [PATCH] Remove useless DH param code on client side |
Дата | |
Msg-id | 20060412063634.GB22456@svana.org обсуждение исходный текст |
Ответы |
Re: [PATCH] Remove useless DH param code on client side
Re: [PATCH] Remove useless DH param code on client side |
Список | pgsql-patches |
In the SSL code in libpq it does some processing with DH parameters: SSL_CTX_set_tmp_dh_callback() This function is marked as server use only[1], the client always uses the DH parameters in the server, so all the code in the client dealing with the DH parameters is useless. This patch removes it. It's not clear why the code was added in the first place, it's been there almost since the beginning[2]. At the time there was a suggestion of merging the front-end and backend SSL code, but looking at the changes since, that seems unlikely. As a further example, the s_server program allows you to specify DH params, but s_client doesn't. In the GnuTLS documentation under gnutls_dh_params_generate2() it says[3]: Also note that the DH parameters are only useful to servers. Since clients use the parameters sent by the server, it's of no use to call this in client side. Have a nice day, [1] http://www.openssl.org/docs/ssl/SSL_CTX_set_tmp_dh_callback.html# [2] http://developer.postgresql.org/cvsweb.cgi/pgsql/src/interfaces/libpq/fe-secure.c#rev1.2 [3] http://www.gnu.org/software/gnutls/reference/gnutls-gnutls.html#gnutls-dh-params-generate2 -- Martijn van Oosterhout <kleptog@svana.org> http://svana.org/kleptog/ > Patent. n. Genius is 5% inspiration and 95% perspiration. A patent is a > tool for doing 5% of the work and then sitting around waiting for someone > else to do the other 95% so you can sue them.
Вложения
В списке pgsql-patches по дате отправления: