pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Daniel Gustafsson <daniel@yesql.se>
Cc: Magnus Hagander <magnus@hagander.net>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: should libpq also require TLSv1.2 by default?
Date: Sat, 27 Jun 2020 12:55:21 -0400
Message-ID: <142460.1593276921@sss.pgh.pa.us> (raw)
In-Reply-To: <31488.1593206864@sss.pgh.pa.us>
References: <a9408304-4381-a5af-d259-e55d349ae4ce@2ndquadrant.com>
	<4FBC50DB-599A-42AA-90C8-3051E3A748BB@yesql.se>
	<CABUevEzn3BH0y+ToD8jkXkXmSvRSA7tAX4v+16M4fSr4fJDH4A@mail.gmail.com>
	<DF11E406-A9AB-43A6-9B0E-5291644CC16F@yesql.se>
	<2305871.1593125045@sss.pgh.pa.us>
	<F50C22DD-A2C0-461A-93CD-3B87847F8F82@yesql.se>
	<2339796.1593177583@sss.pgh.pa.us>
	<16724.1593185802@sss.pgh.pa.us>
	<29049.1593202957@sss.pgh.pa.us>
	<0817C931-564B-4DFF-921C-90915889F451@yesql.se>
	<31488.1593206864@sss.pgh.pa.us>

I wrote:
> Daniel Gustafsson <daniel@yesql.se> writes:
>> SSL_R_UNKNOWN_PROTOCOL seem to covers cases when someone manages to perform
>> something which OpenSSL believes is a broken SSLv2 connection, but their own
>> client-level code use it to refer to SSL as well as TLS.  Maybe it's worth
>> adding as a belts and suspenders type thing?

> No objection on my part.

>> If anything it might useful to document in the comment that we're only
>> concerned with TLS versions, SSL2/3 are disabled in the library initialization.

> Good point.

Pushed with those corrections.  I also rewrote the comment about which
error codes we'd seen in practice, after realizing that one of my tests
had been affected by the presence of "MinProtocol = TLSv1.2" in
RHEL8's openssl.cnf (causing a max setting less than that to be a local
configuration error, not something the server had rejected).

			regards, tom lane





view thread (21+ messages)

Message-ID: <142460.1593276921@sss.pgh.pa.us>
Permalink:  ../142460.1593276921@sss.pgh.pa.us/
Also on:    postgresql.org/message-id/142460.1593276921@sss.pgh.pa.us

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: tgl@sss.pgh.pa.us, daniel@yesql.se, magnus@hagander.net, peter.eisentraut@2ndquadrant.com
  Subject: Re: should libpq also require TLSv1.2 by default?
  In-Reply-To: <142460.1593276921@sss.pgh.pa.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox