From: Tom Lane <tgl@sss.pgh.pa.us>
To: Daniel Gustafsson <daniel@yesql.se>
cc: Magnus Hagander <magnus@hagander.net>,
        Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
        pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: should libpq also require TLSv1.2 by default?
In-reply-to: <31488.1593206864@sss.pgh.pa.us>
References: <a9408304-4381-a5af-d259-e55d349ae4ce@2ndquadrant.com>
 <4FBC50DB-599A-42AA-90C8-3051E3A748BB@yesql.se>
 <CABUevEzn3BH0y+ToD8jkXkXmSvRSA7tAX4v+16M4fSr4fJDH4A@mail.gmail.com>
 <DF11E406-A9AB-43A6-9B0E-5291644CC16F@yesql.se>
 <2305871.1593125045@sss.pgh.pa.us>
 <F50C22DD-A2C0-461A-93CD-3B87847F8F82@yesql.se>
 <2339796.1593177583@sss.pgh.pa.us> <16724.1593185802@sss.pgh.pa.us>
 <29049.1593202957@sss.pgh.pa.us>
 <0817C931-564B-4DFF-921C-90915889F451@yesql.se>
 <31488.1593206864@sss.pgh.pa.us>
Comments: In-reply-to Tom Lane <tgl@sss.pgh.pa.us>
	message dated "Fri, 26 Jun 2020 17:27:44 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <142459.1593276921.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Sat, 27 Jun 2020 12:55:21 -0400
Message-ID: <142460.1593276921@sss.pgh.pa.us>
Precedence: bulk

I wrote:
> Daniel Gustafsson <daniel@yesql.se> writes:
>> SSL_R_UNKNOWN_PROTOCOL seem to covers cases when someone manages to per=
form
>> something which OpenSSL believes is a broken SSLv2 connection, but thei=
r own
>> client-level code use it to refer to SSL as well as TLS.  Maybe it's wo=
rth
>> adding as a belts and suspenders type thing?

> No objection on my part.

>> If anything it might useful to document in the comment that we're only
>> concerned with TLS versions, SSL2/3 are disabled in the library initial=
ization.

> Good point.

Pushed with those corrections.  I also rewrote the comment about which
error codes we'd seen in practice, after realizing that one of my tests
had been affected by the presence of "MinProtocol =3D TLSv1.2" in
RHEL8's openssl.cnf (causing a max setting less than that to be a local
configuration error, not something the server had rejected).

			regards, tom lane