From: Tom Lane <tgl@sss.pgh.pa.us>
To: Michael Paquier <michael@paquier.xyz>
Cc: Magnus Hagander <magnus@hagander.net>
Cc: Daniel Gustafsson <daniel@yesql.se>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: Update minimum SSL version
Date: Fri, 29 Nov 2019 22:06:54 -0500
Message-ID: <22675.1575083214@sss.pgh.pa.us> (raw)
In-Reply-To: <20191130024345.GD99291@paquier.xyz>
References: <b327f8df-da98-054d-0cc5-b76a857cfed9@2ndquadrant.com>
<224FD25C-BA10-44FA-95AA-F97C35FB3BB0@yesql.se>
<CABUevEy4meLCVnrTbjU9zoJvRoWUjvmdmUUkaoAqKYkk0MWHYA@mail.gmail.com>
<20191129125727.GN2505@paquier.xyz>
<13786.1575041447@sss.pgh.pa.us>
<20191130024345.GD99291@paquier.xyz>
Michael Paquier <michael@paquier.xyz> writes:
> On Fri, Nov 29, 2019 at 10:30:47AM -0500, Tom Lane wrote:
>> What's the impact going to be on buildfarm members with older openssl
>> installations? Perhaps "none", if they aren't running the ssl test
>> suite, but we should be clear about it.
> Actually, no, what I am writing here is incorrect. We should make
> sure of that the default configuration is correct at initdb time, and
> the patch does not do that.
Yeah, that's sort of what I was getting at, but not quite. On newer
openssl versions, this doesn't seem like it's really changing anything
at all --- AFAIK, the client and server will already negotiate the
highest jointly-supported TLS version. OTOH, with an openssl version
old enough to not understand TLS >= 1.2, this change likewise won't do
anything, except break configurations that used to work (for some
not-too-secure value of "work").
I think the real question we have to answer is this: are we intent on
making people upgrade ancient openssl installations? If so, shouldn't
we be doing something even more aggressive than this? If not, wouldn't
the patch need to try to autoconfigure the minimum TLS version? As
proposed, the patch seems to be somewhere in a passive-aggressive middle
ground of being annoying without really enforcing anything. So I don't
quite see the point.
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: tgl@sss.pgh.pa.us, michael@paquier.xyz, magnus@hagander.net, daniel@yesql.se, peter.eisentraut@2ndquadrant.com
Subject: Re: Update minimum SSL version
In-Reply-To: <22675.1575083214@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox