Re: Setting min/max TLS protocol in clientside libpq

Peter Eisentraut <peter.eisentraut@2ndquadrant.com>

From: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
To: Daniel Gustafsson <daniel@yesql.se>
Cc: Michael Paquier <michael@paquier.xyz>, Tom Lane <tgl@sss.pgh.pa.us>, cary huang <hcary328@gmail.com>, PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Date: 2020-04-26T12:01:04Z
Lists: pgsql-hackers
On 2020-04-24 14:03, Daniel Gustafsson wrote:
>> On 24 Apr 2020, at 12:56, Peter Eisentraut <peter.eisentraut@2ndquadrant.com> wrote:
>>
>> Can we reconsider whether we really want to name the new settings like "sslminprotocolversion", or whether we could add some underscores, both for readability and for consistency with the server-side options?
> 
> That was brought up by Michael in the thread, but none of us followed up on it
> it seems.  The current name was chosen to be consistent with the already
> existing ssl* client-side settings, but I don't really have strong opinions on
> if that makes sense or not.  Perhaps use ssl_m{in|max}_protocolversion to make
> it more readable?

The names on the backend side are ssl_{min|max|_protocol_version.

> The attached renames the userfacing setting, but keeps the environment variable
> without underscores as most settings have env vars without underscores.

Keeping the environment variable as is seems fine (also consistent with 
"channel_binding").

I would, however, prefer to also rename the internal symbols.

-- 
Peter Eisentraut              http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services



Commits

  1. Rename connection parameters to control min/max SSL protocol version in libpq

  2. Add connection parameters to control SSL protocol min/max in libpq

  3. Move OpenSSL routines for min/max protocol setting to src/common/