pgsql: SSL: Add configuration option to prefer server cipher order

From: Peter Eisentraut <peter_e(at)gmx(dot)net>
To: pgsql-committers(at)postgresql(dot)org
Subject: pgsql: SSL: Add configuration option to prefer server cipher order
Date: 2013-12-07 13:15:10
Message-ID: E1VpHiw-00074V-Fd@gemulon.postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-committers

SSL: Add configuration option to prefer server cipher order

By default, OpenSSL (and SSL/TLS in general) lets the client cipher
order take priority. This is OK for browsers where the ciphers were
tuned, but few PostgreSQL client libraries make the cipher order
configurable. So it makes sense to have the cipher order in
postgresql.conf take priority over client defaults.

This patch adds the setting "ssl_prefer_server_ciphers" that can be
turned on so that server cipher order is preferred. Per discussion,
this now defaults to on.

From: Marko Kreen <markokr(at)gmail(dot)com>
Reviewed-by: Adrian Klaver <adrian(dot)klaver(at)gmail(dot)com>

Branch
------
master

Details
-------
http://git.postgresql.org/pg/commitdiff/ef3267523d1ecf53bb6d4ffbeb6a0ae1af84ed47

Modified Files
--------------
doc/src/sgml/config.sgml | 21 +++++++++++++++++++++
src/backend/libpq/be-secure.c | 7 +++++++
src/backend/utils/misc/guc.c | 10 ++++++++++
src/backend/utils/misc/postgresql.conf.sample | 1 +
4 files changed, 39 insertions(+)

Browse pgsql-committers by date

  From Date Subject
Next Message Fujii Masao 2013-12-07 17:06:51 pgsql: Expose qurey ID in pg_stat_statements view.
Previous Message Bruce Momjian 2013-12-06 14:47:45 pgsql: docs: update partition encryption options