pgsql: Support configuring multiple ECDH curves

From: Daniel Gustafsson <dgustafsson(at)postgresql(dot)org>
To: pgsql-committers(at)lists(dot)postgresql(dot)org
Subject: pgsql: Support configuring multiple ECDH curves
Date: 2024-10-24 13:38:04
Message-ID: E1t3y2P-002EUW-Bz@gemulon.postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Support configuring multiple ECDH curves

The ssl_ecdh_curve GUC only accepts a single value, but the TLS
handshake can list multiple curves in the groups extension (the
extension has been renamed to contain more than elliptic curves).
This changes the GUC to accept a colon-separated list of curves.
This commit also renames the GUC to ssl_groups to match the new
nomenclature for the TLS extension.

Original patch by Erica Zhang with additional hacking by me.

Author: Erica Zhang <ericazhangy2021(at)qq(dot)com>
Author: Daniel Gustafsson <daniel(at)yesql(dot)se>
Reviewed-by: Jacob Champion <jacob(dot)champion(at)enterprisedb(dot)com>
Reviewed-by: Andres Freund <andres(at)anarazel(dot)de>
Reviewed-by: Peter Eisentraut <peter(at)eisentraut(dot)org>
Reviewed-by: Jelte Fennema-Nio <postgres(at)jeltef(dot)nl>
Discussion: https://postgr.es/m/tencent_063F89FA72CCF2E48A0DF5338841988E9809@qq.com

Branch
------
master

Details
-------
https://git.postgresql.org/pg/commitdiff/3d1ef3a15c3eb68dae44b94e89d04c422b26fc16

Modified Files
--------------
doc/src/sgml/config.sgml | 25 +++++++-----
src/backend/libpq/be-secure-openssl.c | 56 +++++++++++++++++----------
src/backend/utils/misc/guc.c | 1 +
src/backend/utils/misc/guc_tables.c | 6 +--
src/backend/utils/misc/postgresql.conf.sample | 2 +-
src/test/ssl/t/001_ssltests.pl | 12 ++++++
src/test/ssl/t/SSL/Server.pm | 3 ++
7 files changed, 72 insertions(+), 33 deletions(-)

Browse pgsql-committers by date

  From Date Subject
Next Message Fujii Masao 2024-10-24 15:21:39 pgsql: Refactor GetLockStatusData() to skip backends/groups without fas
Previous Message Alexander Korotkov 2024-10-24 12:04:14 pgsql: Add 'no_error' argument to pg_wal_replay_wait()