From: Daniel Gustafsson <dgustafsson@postgresql.org>
To: pgsql-committers@lists.postgresql.org
Subject: pgsql: Support configuring multiple ECDH curves
Date: Thu, 24 Oct 2024 13:38:04 +0000
Message-ID: <E1t3y2P-002EUW-Bz@gemulon.postgresql.org> (raw)
Support configuring multiple ECDH curves
The ssl_ecdh_curve GUC only accepts a single value, but the TLS
handshake can list multiple curves in the groups extension (the
extension has been renamed to contain more than elliptic curves).
This changes the GUC to accept a colon-separated list of curves.
This commit also renames the GUC to ssl_groups to match the new
nomenclature for the TLS extension.
Original patch by Erica Zhang with additional hacking by me.
Author: Erica Zhang <ericazhangy2021@qq.com>
Author: Daniel Gustafsson <daniel@yesql.se>
Reviewed-by: Jacob Champion <jacob.champion@enterprisedb.com>
Reviewed-by: Andres Freund <andres@anarazel.de>
Reviewed-by: Peter Eisentraut <peter@eisentraut.org>
Reviewed-by: Jelte Fennema-Nio <postgres@jeltef.nl>
Discussion: https://postgr.es/m/tencent_063F89FA72CCF2E48A0DF5338841988E9809@qq.com
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/3d1ef3a15c3eb68dae44b94e89d04c422b26fc16
Modified Files
--------------
doc/src/sgml/config.sgml | 25 +++++++-----
src/backend/libpq/be-secure-openssl.c | 56 +++++++++++++++++----------
src/backend/utils/misc/guc.c | 1 +
src/backend/utils/misc/guc_tables.c | 6 +--
src/backend/utils/misc/postgresql.conf.sample | 2 +-
src/test/ssl/t/001_ssltests.pl | 12 ++++++
src/test/ssl/t/SSL/Server.pm | 3 ++
7 files changed, 72 insertions(+), 33 deletions(-)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-committers@postgresql.org
Cc: dgustafsson@postgresql.org, pgsql-committers@lists.postgresql.org
Subject: Re: pgsql: Support configuring multiple ECDH curves
In-Reply-To: <E1t3y2P-002EUW-Bz@gemulon.postgresql.org>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox