diff options
| author | Michael Paquier <michael@paquier.xyz> | 2020-01-28 10:40:48 +0900 |
|---|---|---|
| committer | Michael Paquier <michael@paquier.xyz> | 2020-01-28 10:40:48 +0900 |
| commit | ff8ca5fadd819155c82bd16fcc6b7231af649cf8 (patch) | |
| tree | 1e68ff107bb0607f796078c47f333be146fdffe4 /src/backend/libpq/be-secure-openssl.c | |
| parent | 6f38d4dac381b5b8bead302a0b4f81761042cd25 (diff) | |
| download | postgresql-ff8ca5fadd819155c82bd16fcc6b7231af649cf8.tar.gz postgresql-ff8ca5fadd819155c82bd16fcc6b7231af649cf8.zip | |
Add connection parameters to control SSL protocol min/max in libpq
These two new parameters, named sslminprotocolversion and
sslmaxprotocolversion, allow to respectively control the minimum and the
maximum version of the SSL protocol used for the SSL connection attempt.
The default setting is to allow any version for both the minimum and the
maximum bounds, causing libpq to rely on the bounds set by the backend
when negotiating the protocol to use for an SSL connection. The bounds
are checked when the values are set at the earliest stage possible as
this makes the checks independent of any SSL implementation.
Author: Daniel Gustafsson
Reviewed-by: Michael Paquier, Cary Huang
Discussion: https://postgr.es/m/4F246AE3-A7AE-471E-BD3D-C799D3748E03@yesql.se
Diffstat (limited to 'src/backend/libpq/be-secure-openssl.c')
| -rw-r--r-- | src/backend/libpq/be-secure-openssl.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/src/backend/libpq/be-secure-openssl.c b/src/backend/libpq/be-secure-openssl.c index 0cc59f1be14..987ab660cbe 100644 --- a/src/backend/libpq/be-secure-openssl.c +++ b/src/backend/libpq/be-secure-openssl.c @@ -1274,6 +1274,9 @@ X509_NAME_to_cstring(X509_NAME *name) * version, then we log with the given loglevel and return (if we return) -1. * If a nonnegative value is returned, subsequent code can assume it's working * with a supported version. + * + * Note: this is rather similar to libpq's routine in fe-secure-openssl.c, + * so make sure to update both routines if changing this one. */ static int ssl_protocol_version_to_openssl(int v, const char *guc_name, int loglevel) |