From: Tom Lane <tgl@sss.pgh.pa.us>
To: Daniel Gustafsson <daniel@yesql.se>
cc: Magnus Hagander <magnus@hagander.net>,
        Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
        pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: should libpq also require TLSv1.2 by default?
In-reply-to: <0817C931-564B-4DFF-921C-90915889F451@yesql.se>
References: <a9408304-4381-a5af-d259-e55d349ae4ce@2ndquadrant.com>
 <4FBC50DB-599A-42AA-90C8-3051E3A748BB@yesql.se>
 <CABUevEzn3BH0y+ToD8jkXkXmSvRSA7tAX4v+16M4fSr4fJDH4A@mail.gmail.com>
 <DF11E406-A9AB-43A6-9B0E-5291644CC16F@yesql.se>
 <2305871.1593125045@sss.pgh.pa.us>
 <F50C22DD-A2C0-461A-93CD-3B87847F8F82@yesql.se>
 <2339796.1593177583@sss.pgh.pa.us> <16724.1593185802@sss.pgh.pa.us>
 <29049.1593202957@sss.pgh.pa.us>
 <0817C931-564B-4DFF-921C-90915889F451@yesql.se>
Comments: In-reply-to Daniel Gustafsson <daniel@yesql.se>
	message dated "Fri, 26 Jun 2020 23:18:58 +0200"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <31487.1593206864.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Fri, 26 Jun 2020 17:27:44 -0400
Message-ID: <31488.1593206864@sss.pgh.pa.us>
Precedence: bulk

Daniel Gustafsson <daniel@yesql.se> writes:
> SSL_R_UNKNOWN_PROTOCOL seem to covers cases when someone manages to perf=
orm
> something which OpenSSL believes is a broken SSLv2 connection, but their=
 own
> client-level code use it to refer to SSL as well as TLS.  Maybe it's wor=
th
> adding as a belts and suspenders type thing?

No objection on my part.

> Is this targeting v13 or v14?  In case of the former, the release notes =
entry
> for raising the default minimum version should perhaps be tweaked as it =
now
> just refers to the GUC which is a tad misleading.

I think Peter is proposing that we change this in v13.  I didn't look
at the release notes; usually we cover this sort of thing in-bulk
when we update the release notes later in beta.

> If anything it might useful to document in the comment that we're only
> concerned with TLS versions, SSL2/3 are disabled in the library initiali=
zation.

Good point.

			regards, tom lane