Re: Setting min/max TLS protocol in clientside libpq
Michael Paquier <michael@paquier.xyz>
From: Michael Paquier <michael@paquier.xyz>
To: Daniel Gustafsson <daniel@yesql.se>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>, Tom Lane <tgl@sss.pgh.pa.us>, cary huang <hcary328@gmail.com>, PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Date: 2020-04-25T00:29:48Z
Lists: pgsql-hackers
On Fri, Apr 24, 2020 at 02:03:04PM +0200, Daniel Gustafsson wrote:
> That was brought up by Michael in the thread, but none of us followed up on it
> it seems. The current name was chosen to be consistent with the already
> existing ssl* client-side settings, but I don't really have strong opinions on
> if that makes sense or not. Perhaps use ssl_m{in|max}_protocolversion to make
> it more readable?
There was no hard push in favor of this comment so I did not insist,
but I am not wedded to the existing connection parameter names.
- {"sslminprotocolversion", "PGSSLMINPROTOCOLVERSION", NULL, NULL,
+ {"ssl_min_protocolversion", "PGSSLMINPROTOCOLVERSION", NULL, NULL,
Shouldn't that actually be "ssl_min_protocol_version" with one extra
underscore?
> The attached renames the userfacing setting, but keeps the environment variable
> without underscores as most settings have env vars without underscores.
There are two in this case: PG_COLOR and PG_COLORS. For readability
it could make sense to use something like PG_SSL_MIN_PROTOCOL_VERSION
or PGSSL_MIN_PROTOCOL_VERSION, but like Daniel I'd rather keep the env
variables without underscores.
--
Michael
Commits
-
Rename connection parameters to control min/max SSL protocol version in libpq
- 401aad67045b 13.0 landed
-
Add connection parameters to control SSL protocol min/max in libpq
- ff8ca5fadd81 13.0 landed
-
Move OpenSSL routines for min/max protocol setting to src/common/
- f7cd5896a696 13.0 landed