Horton

Support configuring TLSv1.3 cipher suites

Daniel Gustafsson <dgustafsson@postgresql.org>

View on postgr.es
Commit: 45188c2ea2391b7b24039e1632c726e2fc6b8008
Author: Daniel Gustafsson <dgustafsson@postgresql.org>
Date: 2024-10-24T13:20:32Z
Releases: 18.0 
Support configuring TLSv1.3 cipher suites

The ssl_ciphers GUC can only set cipher suites for TLSv1.2, and lower,
connections. For TLSv1.3 connections a different OpenSSL API must be
used.  This adds a new GUC, ssl_tls13_ciphers, which can be used to
configure a colon separated list of cipher suites to support when
performing a TLSv1.3 handshake.

Original patch by Erica Zhang with additional hacking by me.

Author: Erica Zhang <ericazhangy2021@qq.com>
Author: Daniel Gustafsson <daniel@yesql.se>
Reviewed-by: Jacob Champion <jacob.champion@enterprisedb.com>
Reviewed-by: Andres Freund <andres@anarazel.de>
Reviewed-by: Peter Eisentraut <peter@eisentraut.org>
Reviewed-by: Jelte Fennema-Nio <postgres@jeltef.nl>
Discussion: https://postgr.es/m/tencent_063F89FA72CCF2E48A0DF5338841988E9809@qq.com

Files

PathChange+/−
doc/src/sgml/config.sgml modified +28 −8
src/backend/libpq/be-secure.c modified +1 −0
src/backend/libpq/be-secure-openssl.c modified +19 −3
src/backend/utils/misc/guc_tables.c modified +13 −2
src/backend/utils/misc/postgresql.conf.sample modified +2 −1
src/include/libpq/libpq.h modified +1 −0
src/test/ssl/t/SSL/Server.pm modified +2 −1

Documentation touched

Discussion