pg.ddx.io  pgsql-hackers@postgresql.org mailing list archive  

help / color / mirror / Atom feed
From: Tom Lane <tgl@sss.pgh.pa.us>
To: Daniel Gustafsson <daniel@yesql.se>
Cc: Magnus Hagander <magnus@hagander.net>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: should libpq also require TLSv1.2 by default?
Date: Fri, 26 Jun 2020 17:27:44 -0400
Message-ID: <31488.1593206864@sss.pgh.pa.us> (raw)
In-Reply-To: <0817C931-564B-4DFF-921C-90915889F451@yesql.se>
References: <a9408304-4381-a5af-d259-e55d349ae4ce@2ndquadrant.com>
	<4FBC50DB-599A-42AA-90C8-3051E3A748BB@yesql.se>
	<CABUevEzn3BH0y+ToD8jkXkXmSvRSA7tAX4v+16M4fSr4fJDH4A@mail.gmail.com>
	<DF11E406-A9AB-43A6-9B0E-5291644CC16F@yesql.se>
	<2305871.1593125045@sss.pgh.pa.us>
	<F50C22DD-A2C0-461A-93CD-3B87847F8F82@yesql.se>
	<2339796.1593177583@sss.pgh.pa.us>
	<16724.1593185802@sss.pgh.pa.us>
	<29049.1593202957@sss.pgh.pa.us>
	<0817C931-564B-4DFF-921C-90915889F451@yesql.se>

Daniel Gustafsson <daniel@yesql.se> writes:
> SSL_R_UNKNOWN_PROTOCOL seem to covers cases when someone manages to perform
> something which OpenSSL believes is a broken SSLv2 connection, but their own
> client-level code use it to refer to SSL as well as TLS.  Maybe it's worth
> adding as a belts and suspenders type thing?

No objection on my part.

> Is this targeting v13 or v14?  In case of the former, the release notes entry
> for raising the default minimum version should perhaps be tweaked as it now
> just refers to the GUC which is a tad misleading.

I think Peter is proposing that we change this in v13.  I didn't look
at the release notes; usually we cover this sort of thing in-bulk
when we update the release notes later in beta.

> If anything it might useful to document in the comment that we're only
> concerned with TLS versions, SSL2/3 are disabled in the library initialization.

Good point.

			regards, tom lane





view thread (21+ messages)  latest in thread

Message-ID: <31488.1593206864@sss.pgh.pa.us>
Permalink:  ../31488.1593206864@sss.pgh.pa.us/
Also on:    postgresql.org/message-id/31488.1593206864@sss.pgh.pa.us

 · 

reply
Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-hackers@postgresql.org
  Cc: tgl@sss.pgh.pa.us, daniel@yesql.se, magnus@hagander.net, peter.eisentraut@2ndquadrant.com
  Subject: Re: should libpq also require TLSv1.2 by default?
  In-Reply-To: <31488.1593206864@sss.pgh.pa.us>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox