Re: Setting min/max TLS protocol in clientside libpq
Daniel Gustafsson <daniel@yesql.se>
From: Daniel Gustafsson <daniel@yesql.se>
To: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: Michael Paquier <michael@paquier.xyz>,
Tom Lane <tgl@sss.pgh.pa.us>,
cary huang <hcary328@gmail.com>,
PostgreSQL Hackers <pgsql-hackers@lists.postgresql.org>
Date: 2020-04-26T21:20:01Z
Lists: pgsql-hackers
Attachments
- minmaxproto_naming-v2.patch (application/octet-stream) patch v2
> On 26 Apr 2020, at 14:01, Peter Eisentraut <peter.eisentraut@2ndquadrant.com> wrote:
>
> On 2020-04-24 14:03, Daniel Gustafsson wrote:
>>> On 24 Apr 2020, at 12:56, Peter Eisentraut <peter.eisentraut@2ndquadrant.com> wrote:
>>>
>>> Can we reconsider whether we really want to name the new settings like "sslminprotocolversion", or whether we could add some underscores, both for readability and for consistency with the server-side options?
>> That was brought up by Michael in the thread, but none of us followed up on it
>> it seems. The current name was chosen to be consistent with the already
>> existing ssl* client-side settings, but I don't really have strong opinions on
>> if that makes sense or not. Perhaps use ssl_m{in|max}_protocolversion to make
>> it more readable?
>
> The names on the backend side are ssl_{min|max|_protocol_version.
That was the preferred name by Michael too elsewhere in the thread, so went
ahead and made it so.
>> The attached renames the userfacing setting, but keeps the environment variable
>> without underscores as most settings have env vars without underscores.
>
> Keeping the environment variable as is seems fine (also consistent with "channel_binding").
>
> I would, however, prefer to also rename the internal symbols.
Done in the attached v2.
cheers ./daniel
Commits
-
Rename connection parameters to control min/max SSL protocol version in libpq
- 401aad67045b 13.0 landed
-
Add connection parameters to control SSL protocol min/max in libpq
- ff8ca5fadd81 13.0 landed
-
Move OpenSSL routines for min/max protocol setting to src/common/
- f7cd5896a696 13.0 landed