From: Tom Lane <tgl@sss.pgh.pa.us>
To: Robert Haas <robertmhaas@gmail.com>
cc: Michael Paquier <michael@paquier.xyz>,
        Magnus Hagander <magnus@hagander.net>,
        Daniel Gustafsson <daniel@yesql.se>,
        Peter Eisentraut <peter.eisentraut@2ndquadrant.com>,
        pgsql-hackers <pgsql-hackers@postgresql.org>
Subject: Re: Update minimum SSL version
In-reply-to: 
 <CA+TgmoY4E8J3id=0xJW9m3vLwdLaOoYefj334nZpLx26T-XftA@mail.gmail.com>
References: <b327f8df-da98-054d-0cc5-b76a857cfed9@2ndquadrant.com>
 <224FD25C-BA10-44FA-95AA-F97C35FB3BB0@yesql.se>
 <CABUevEy4meLCVnrTbjU9zoJvRoWUjvmdmUUkaoAqKYkk0MWHYA@mail.gmail.com>
 <20191129125727.GN2505@paquier.xyz> <13786.1575041447@sss.pgh.pa.us>
 <20191130024345.GD99291@paquier.xyz>
 <CA+TgmobM7j=+NN+juu9=urfw0-Bt22QvDdxaPW8O-KK5yegADQ@mail.gmail.com>
 <929.1575304768@sss.pgh.pa.us>
 <CA+TgmoY4E8J3id=0xJW9m3vLwdLaOoYefj334nZpLx26T-XftA@mail.gmail.com>
Comments: In-reply-to Robert Haas <robertmhaas@gmail.com>
	message dated "Mon, 02 Dec 2019 12:40:18 -0500"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <4447.1575309086.1@sss.pgh.pa.us>
Date: Mon, 02 Dec 2019 12:51:26 -0500
Message-ID: <4448.1575309086@sss.pgh.pa.us>
Precedence: bulk

Robert Haas <robertmhaas@gmail.com> writes:
> On Mon, Dec 2, 2019 at 11:39 AM Tom Lane <tgl@sss.pgh.pa.us> wrote:
>> Maybe it'd be worth extending that to show the max supported
>> version, with some rats-nest of #ifdefs, but I'm not sure if
>> it's worth the trouble.

> Especially if we mess up the #ifdefs. :-)

Yah.  Although, looking at the code in be-secure-openssl.c,
it doesn't look that hard to do in an extensible way.
Something like (untested)

 static int
 ssl_protocol_version_to_openssl(int v, const char *guc_name, int loglevel)
 {
     switch (v)
     {
         case PG_TLS_ANY:
             return 0;
         case PG_TLS1_VERSION:
+#define PG_MAX_TLS_VERSION "TLSv1"
             return TLS1_VERSION;
         case PG_TLS1_1_VERSION:
 #ifdef TLS1_1_VERSION
+#undef PG_MAX_TLS_VERSION
+#define PG_MAX_TLS_VERSION "TLSv1.1"
             return TLS1_1_VERSION;
 #else
             break;
 #endif
         case PG_TLS1_2_VERSION:
 #ifdef TLS1_2_VERSION
+#undef PG_MAX_TLS_VERSION
+#define PG_MAX_TLS_VERSION "TLSv1.2"
             return TLS1_2_VERSION;
 #else
             break;
 #endif
         case PG_TLS1_3_VERSION:
 #ifdef TLS1_3_VERSION
+#undef PG_MAX_TLS_VERSION
+#define PG_MAX_TLS_VERSION "TLSv1.3"
             return TLS1_3_VERSION;
 #else
             break;
 #endif
     }
 
     ereport(loglevel,
             (errmsg("%s setting %s not supported by this build",
                     guc_name,
-                    GetConfigOption(guc_name, false, false))));
+                    GetConfigOption(guc_name, false, false)),
+             errdetail("Maximum supported TLS version is %s.",
+                       PG_MAX_TLS_VERSION)));
     return -1;
 }

			regards, tom lane