SSL Support available?

[ruuns]

Hi,
I have only a small question about your current mongodb driver for haskell :)

Is it currently possible with the latest version to connect to a mongodb server, which only accepts SSL connection? (e.g. configured with http://docs.mongodb.org/v2.6/tutorial/configure-ssl/ )

I was planing to experiment a little with your driver and couldn't find anything within the API (hope i didn't forget something). I'm a little afraid of this because i would like to avoid at all cost that the message communication between client/server is done in plaintext :/

If that's the case, keep this as an active issue :) if there is already some approach, just close this ^^.

Otherwise, do you use maybe some workarounds? (some db management applications like robomongo seems to have an option to use an external SSH-Tunnel before the connection is established).

[gregwebs]

The general approach is to run the client & server in the same datacenter.

[Yuras]

@gregwebs I was able to setup ssl connection to mongodb using tls package. But that required a lot of copy'n'paste from Database.MongoDB.Internal.Protocol. E.g. I needed getReply, putRequest, genRequestId.

Would you accept a patch that introduces ssl support or makes it easier to implement? I see 3 options:

• Add ssl to mongodb package unconditionally. Then everybody will have to install tls package even if they don't need ssl.
• The same, but guard it with a cabal flag. So this functionality will be available only when necessary
• Export everything necessary from the internal module and let users implement ssl support externally. That way anyone may implement its own ssl support, e.g. using OpenSSL instead on tls.

Thoughts?

[gregwebs]

Is there another option where a user can provide SSL (an interface that would work for OpenSSL or tls) when setting up the connection and if it is provided it will be used?

[Yuras]

Yes, that may work too.

Actually what we need is just a pair of functions to write lazy bytestring and to read specified amount or data as a lazy bytestring. Note that it is different from IOStream because the later allows reading the whole chunk, but we need analog of hGetN.

The design space is pretty wide, so it is up to you to decide.

[gregwebs]

The SSL interface would be best. http-client would be a point of reference

[VictorDenisov]

This is addressed in pull request #46