From: | Marko Kreen <markokr(at)gmail(dot)com> |
---|---|
To: | pgsql-hackers(at)postgresql(dot)org |
Cc: | Marko Kreen <markokr(at)gmail(dot)com> |
Subject: | [PATCH 1/2] SSL: GUC option to prefer server cipher order |
Date: | 2013-11-06 23:59:37 |
Message-ID: | 1383782378-7342-1-git-send-email-markokr@gmail.com |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-hackers |
By default OpenSSL (and SSL/TLS in general) lets client cipher
order take priority. This is OK for browsers where the ciphers
were tuned, but few Postgres client libraries make cipher order
configurable. So it makes sense to make cipher order in
postgresql.conf take priority over client defaults.
This patch adds setting 'ssl_prefer_server_ciphers' which can be
turned on so that server cipher order is preferred.
The setting SSL_OP_CIPHER_SERVER_PREFERENCE appeared in
OpenSSL 0.9.7 (31 Dec 2002), not sure if #ifdef is required
for conditional compilation.
---
doc/src/sgml/config.sgml | 12 ++++++++++++
src/backend/libpq/be-secure.c | 7 +++++++
src/backend/utils/misc/guc.c | 10 ++++++++++
3 files changed, 29 insertions(+)
Attachment | Content-Type | Size |
---|---|---|
0001-SSL-GUC-option-to-prefer-server-cipher-order.patch | text/x-patch | 2.7 KB |
From | Date | Subject | |
---|---|---|---|
Next Message | Marko Kreen | 2013-11-06 23:59:38 | [PATCH 2/2] SSL: Support ECDH key excange. |
Previous Message | Andres Freund | 2013-11-06 23:30:55 | Re: alter_table regression test problem |