diff options
| -rw-r--r-- | doc/src/sgml/config.sgml | 21 | ||||
| -rw-r--r-- | src/backend/libpq/be-secure.c | 7 | ||||
| -rw-r--r-- | src/backend/utils/misc/guc.c | 10 | ||||
| -rw-r--r-- | src/backend/utils/misc/postgresql.conf.sample | 1 |
4 files changed, 39 insertions, 0 deletions
diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml index 932ee17b095..1946bb083d9 100644 --- a/doc/src/sgml/config.sgml +++ b/doc/src/sgml/config.sgml @@ -886,6 +886,27 @@ include 'filename' </listitem> </varlistentry> + <varlistentry id="guc-ssl-prefer-server-ciphers" xreflabel="ssl_prefer_server_ciphers"> + <term><varname>ssl_prefer_server_ciphers</varname> (<type>bool</type>)</term> + <indexterm> + <primary><varname>ssl_prefer_server_ciphers</> configuration parameter</primary> + </indexterm> + <listitem> + <para> + Specifies whether to use the server's SSL cipher preferences, rather + than the client's. The default is true. + </para> + + <para> + Older PostgreSQL versions do not have this setting and always use the + client's preferences. This setting is mainly for backward + compatibility with those versions. Using the server's preferences is + usually better because it is more likely that the server is appropriately + configured. + </para> + </listitem> + </varlistentry> + <varlistentry id="guc-password-encryption" xreflabel="password_encryption"> <term><varname>password_encryption</varname> (<type>boolean</type>)</term> <indexterm> diff --git a/src/backend/libpq/be-secure.c b/src/backend/libpq/be-secure.c index 573ad3e731d..51f3b12bb97 100644 --- a/src/backend/libpq/be-secure.c +++ b/src/backend/libpq/be-secure.c @@ -112,6 +112,9 @@ static bool ssl_loaded_verify_locations = false; /* GUC variable controlling SSL cipher list */ char *SSLCipherSuites = NULL; +/* GUC variable: if false, prefer client ciphers */ +bool SSLPreferServerCiphers; + /* ------------------------------------------------------------ */ /* Hardcoded values */ /* ------------------------------------------------------------ */ @@ -854,6 +857,10 @@ initialize_SSL(void) if (SSL_CTX_set_cipher_list(SSL_context, SSLCipherSuites) != 1) elog(FATAL, "could not set the cipher list (no valid ciphers available)"); + /* Let server choose order */ + if (SSLPreferServerCiphers) + SSL_CTX_set_options(SSL_context, SSL_OP_CIPHER_SERVER_PREFERENCE); + /* * Load CA store, so we can verify client certificates if needed. */ diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c index cbf3186789c..5c39de5a522 100644 --- a/src/backend/utils/misc/guc.c +++ b/src/backend/utils/misc/guc.c @@ -127,6 +127,7 @@ extern char *temp_tablespaces; extern bool ignore_checksum_failure; extern bool synchronize_seqscans; extern char *SSLCipherSuites; +extern bool SSLPreferServerCiphers; #ifdef TRACE_SORT extern bool trace_sort; @@ -801,6 +802,15 @@ static struct config_bool ConfigureNamesBool[] = check_ssl, NULL, NULL }, { + {"ssl_prefer_server_ciphers", PGC_POSTMASTER, CONN_AUTH_SECURITY, + gettext_noop("Give priority to server ciphersuite order."), + NULL + }, + &SSLPreferServerCiphers, + true, + NULL, NULL, NULL + }, + { {"fsync", PGC_SIGHUP, WAL_SETTINGS, gettext_noop("Forces synchronization of updates to disk."), gettext_noop("The server will use the fsync() system call in several places to make " diff --git a/src/backend/utils/misc/postgresql.conf.sample b/src/backend/utils/misc/postgresql.conf.sample index 7a18e727506..a0f564bb9cf 100644 --- a/src/backend/utils/misc/postgresql.conf.sample +++ b/src/backend/utils/misc/postgresql.conf.sample @@ -81,6 +81,7 @@ #ssl = off # (change requires restart) #ssl_ciphers = 'DEFAULT:!LOW:!EXP:!MD5:@STRENGTH' # allowed SSL ciphers # (change requires restart) +#ssl_prefer_server_ciphers = on # (change requires restart) #ssl_renegotiation_limit = 512MB # amount of data between renegotiations #ssl_cert_file = 'server.crt' # (change requires restart) #ssl_key_file = 'server.key' # (change requires restart) |