From: | Michael Paquier <michael(dot)paquier(at)gmail(dot)com> |
---|---|
To: | Andreas Karlsson <andreas(at)proxel(dot)se> |
Cc: | Michael Banck <michael(dot)banck(at)credativ(dot)de>, Peter Geoghegan <pg(at)heroku(dot)com>, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, Peter Eisentraut <peter_e(at)gmx(dot)net>, PostgreSQL-development <pgsql-hackers(at)postgresql(dot)org> |
Subject: | Re: [PATCH] Reload SSL certificates on SIGHUP |
Date: | 2016-12-05 05:17:48 |
Message-ID: | CAB7nPqQU50-UMuFcffmynDbH7_kBx3N-Q3ujL-nM2OF3X8biMA@mail.gmail.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
On Mon, Dec 5, 2016 at 9:50 AM, Andreas Karlsson <andreas(at)proxel(dot)se> wrote:
> On 12/04/2016 03:20 PM, Michael Paquier wrote:
>> On Sun, Dec 4, 2016 at 11:11 PM, Andreas Karlsson <andreas(at)proxel(dot)se>
>> wrote:
>>> On 12/04/2016 02:12 PM, Michael Paquier wrote:
>>> Does this have a precedent in the code?
>>
>>
>> data_checksums in guc.c is an example, it is marked with
>> GUC_NOT_IN_SAMPLE | GUC_DISALLOW_IN_FILE and its value is updated with
>> SetConfigOption() when the control file is read. The idea would be to
>> do something like that with LoadedSSL.
OK, here is attached what I had in mind as reload-ssl-v08-02.patch for
reference. This applies on top of the main patch
reload-ssl-v08-01.patch that is the same version as v7 with the issues
I reported previously as addressed. LoadedSSL is mapped with a
read-only GUC parameter that new sessions can query after connecting.
The only use case where that would be useful would be when using
sslmode=prefer to check whether the SSL context is loaded even if ssl
has been switched from off to on. But let's be honest, pg_stat_ssl
reports already this kind of information, making this patch at the end
useless because LoadedSSL does not change for an already-spawned
backend.
> Thanks. I will be quite busy the upcoming couple of weeks so there will be a
> while until I can sit down with this. Feel free to contribute to the patch.
I am switching the patch as ready for committer. I have no more
comments about this patch.
Note to committer-san: please look only at v08-01.
--
Michael
Attachment | Content-Type | Size |
---|---|---|
reload-ssl-v08-01.patch | application/x-download | 25.0 KB |
reload-ssl-v08-02.patch | application/x-download | 2.7 KB |
From | Date | Subject | |
---|---|---|---|
Next Message | Michael Paquier | 2016-12-05 05:19:19 | Re: Document how to set up TAP tests for Perl 5.8.8 |
Previous Message | Haribabu Kommi | 2016-12-05 05:16:48 | Re: raw output from copy |