Re: [PATCH] add ssl_protocols configuration option

Dag-Erling Smørgrav wrote:
> Michael Paquier <michael(dot)paquier(at)gmail(dot)com> writes:
> > Please note that new features can only be added to the version
> > currently in development, aka 9.5.
>
> I understand this policy. However, this new feature a) has absolutely
> no impact unless the admin makes a conscious decision to use it and b)
> will make life much easier for everyone if a POODLE-like vulnerability
> is discovered in TLS.

I see this as vaguely related to
http://www.postgresql.org/message-id/20131114202733.GB7583@eldon.alvh.no-ip.org
where we want to have SSL behavior configurable in the back branches due
to renegotiation issues: there was talk in that thread about introducing
new GUC variables in back branches to control the behavior. The current
patch really doesn't add much in the way of features (SSLv3 support and
so on already exist in back branches) --- what it does add is a way to
control whether these are used.

--
Álvaro Herrera http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Training & Services