[PATCH] add ssl_protocols configuration option

From: Dag-Erling Smørgrav <des(at)des(dot)no>
To: pgsql-hackers(at)postgresql(dot)org
Subject: [PATCH] add ssl_protocols configuration option
Date: 2014-10-17 10:58:10
Message-ID: 86a94vt131.fsf@nine.des.no
Views: Raw Message | Whole Thread | Download mbox | Resend email
Lists: pgsql-hackers

The attached patches add an ssl_protocols configuration option which
control which versions of SSL or TLS the server will use. The syntax is
similar to Apache's SSLProtocols directive, except that the list is
colon-separated instead of whitespace-separated, although that is easy
to change if it proves unpopular.

Summary of the patch:

- In src/backend/libpq/be-secure.c:
- Add an SSLProtocols variable for the option.
- Add a function, parse_SSL_protocols(), that parses an ssl_protocols
string and returns a bitmask suitable for SSL_CTX_set_options().
- Change initialize_SSL() to call parse_SSL_protocols() and pass the
result to SSL_CTX_set_options().
- In src/backend/utils/misc/guc.c:
- Add an extern declaration for SSLProtocols.
- Add an entry in the ConfigureNamesString array for the
ssl_protocols option.
- In src/backend/utils/misc/postgresql.conf.sample:
- Add a sample ssl_protocols line.
- In doc/src/sgml/config.sgml:
- Document the ssl_protocols option.

The file names are slightly different in 9.5, since be-secure.c was
split in two and the declaration was moved into libpq.h.

The default is "ALL:-SSLv2" in 9.0-9.3 and "ALL:-SSL" in 9.4 and up.
This corresponds to the current hardcoded values, so the default
behavior is unchanged, but the admin now has the option to select a
different settings, e.g. if a serious vulnerability is found in TLS 1.0.

Attachment Content-Type Size
postgresql-master-ssl-protocols.diff text/x-patch 8.3 KB
postgresql-9.4-ssl-protocols.diff text/x-patch 7.8 KB
postgresql-9.3-ssl-protocols.diff text/x-patch 7.6 KB
postgresql-9.2-ssl-protocols.diff text/x-patch 7.6 KB
postgresql-9.1-ssl-protocols.diff text/x-patch 7.6 KB
postgresql-9.0-ssl-protocols.diff text/x-patch 7.5 KB
unknown_filename text/plain 43 bytes


Browse pgsql-hackers by date

  From Date Subject
Next Message Simon Riggs 2014-10-17 10:59:33 Re: pg_receivexlog --status-interval add fsync feedback
Previous Message Jeevan Chalke 2014-10-17 10:36:45 Re: detect custom-format dumps in psql and emit a useful error