From: Tom Lane <tgl@sss.pgh.pa.us>
To: Robert Haas <robertmhaas@gmail.com>
Cc: Michael Paquier <michael@paquier.xyz>
Cc: Magnus Hagander <magnus@hagander.net>
Cc: Daniel Gustafsson <daniel@yesql.se>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: Update minimum SSL version
Date: Mon, 02 Dec 2019 12:51:26 -0500
Message-ID: <4448.1575309086@sss.pgh.pa.us> (raw)
In-Reply-To: <CA+TgmoY4E8J3id=0xJW9m3vLwdLaOoYefj334nZpLx26T-XftA@mail.gmail.com>
References: <b327f8df-da98-054d-0cc5-b76a857cfed9@2ndquadrant.com>
<224FD25C-BA10-44FA-95AA-F97C35FB3BB0@yesql.se>
<CABUevEy4meLCVnrTbjU9zoJvRoWUjvmdmUUkaoAqKYkk0MWHYA@mail.gmail.com>
<20191129125727.GN2505@paquier.xyz>
<13786.1575041447@sss.pgh.pa.us>
<20191130024345.GD99291@paquier.xyz>
<CA+TgmobM7j=+NN+juu9=urfw0-Bt22QvDdxaPW8O-KK5yegADQ@mail.gmail.com>
<929.1575304768@sss.pgh.pa.us>
<CA+TgmoY4E8J3id=0xJW9m3vLwdLaOoYefj334nZpLx26T-XftA@mail.gmail.com>
Robert Haas <robertmhaas@gmail.com> writes:
> On Mon, Dec 2, 2019 at 11:39 AM Tom Lane <tgl@sss.pgh.pa.us> wrote:
>> Maybe it'd be worth extending that to show the max supported
>> version, with some rats-nest of #ifdefs, but I'm not sure if
>> it's worth the trouble.
> Especially if we mess up the #ifdefs. :-)
Yah. Although, looking at the code in be-secure-openssl.c,
it doesn't look that hard to do in an extensible way.
Something like (untested)
static int
ssl_protocol_version_to_openssl(int v, const char *guc_name, int loglevel)
{
switch (v)
{
case PG_TLS_ANY:
return 0;
case PG_TLS1_VERSION:
+#define PG_MAX_TLS_VERSION "TLSv1"
return TLS1_VERSION;
case PG_TLS1_1_VERSION:
#ifdef TLS1_1_VERSION
+#undef PG_MAX_TLS_VERSION
+#define PG_MAX_TLS_VERSION "TLSv1.1"
return TLS1_1_VERSION;
#else
break;
#endif
case PG_TLS1_2_VERSION:
#ifdef TLS1_2_VERSION
+#undef PG_MAX_TLS_VERSION
+#define PG_MAX_TLS_VERSION "TLSv1.2"
return TLS1_2_VERSION;
#else
break;
#endif
case PG_TLS1_3_VERSION:
#ifdef TLS1_3_VERSION
+#undef PG_MAX_TLS_VERSION
+#define PG_MAX_TLS_VERSION "TLSv1.3"
return TLS1_3_VERSION;
#else
break;
#endif
}
ereport(loglevel,
(errmsg("%s setting %s not supported by this build",
guc_name,
- GetConfigOption(guc_name, false, false))));
+ GetConfigOption(guc_name, false, false)),
+ errdetail("Maximum supported TLS version is %s.",
+ PG_MAX_TLS_VERSION)));
return -1;
}
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: tgl@sss.pgh.pa.us, robertmhaas@gmail.com, michael@paquier.xyz, magnus@hagander.net, daniel@yesql.se, peter.eisentraut@2ndquadrant.com
Subject: Re: Update minimum SSL version
In-Reply-To: <4448.1575309086@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox