database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-09-02 04:21:28 +03:00
Code Activity

Support configuring TLSv1.3 cipher suites

Browse Source 
The ssl_ciphers GUC can only set cipher suites for TLSv1.2, and lower,
connections. For TLSv1.3 connections a different OpenSSL API must be
used.  This adds a new GUC, ssl_tls13_ciphers, which can be used to
configure a colon separated list of cipher suites to support when
performing a TLSv1.3 handshake.

Original patch by Erica Zhang with additional hacking by me.

Author: Erica Zhang <ericazhangy2021@qq.com>
Author: Daniel Gustafsson <daniel@yesql.se>
Reviewed-by: Jacob Champion <jacob.champion@enterprisedb.com>
Reviewed-by: Andres Freund <andres@anarazel.de>
Reviewed-by: Peter Eisentraut <peter@eisentraut.org>
Reviewed-by: Jelte Fennema-Nio <postgres@jeltef.nl>
Discussion: https://postgr.es/m/tencent_063F89FA72CCF2E48A0DF5338841988E9809@qq.com
This commit is contained in:
Daniel Gustafsson
2024-10-24 15:20:32 +02:00
parent 3d1ef3a15c
commit 45188c2ea2
7 changed files with 66 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
doc/src/sgml/config.sgml
View File

@@ -1340,6 +1340,28 @@ include_dir 'conf.d'
</listitem>
</varlistentry>
<varlistentry id="guc-ssl-tls13-ciphers" xreflabel="ssl_tls13_ciphers">
<term><varname>ssl_tls13_ciphers</varname> (<type>string</type>)
<indexterm>
<primary><varname>ssl_tls13_ciphers</varname> configuration parameter</primary>
</indexterm>
</term>
<listitem>
<para>
Specifies a list of cipher suites that are allowed by connections using
<acronym>TLS</acronym> version 1.3. Multiple cipher suites can be
specified by using a colon separated list. If left blank, the default
set of cipher suites in <productname>OpenSSL</productname> will be used.
</para>
<para>
This parameter can only be set in the
<filename>postgresql.conf</filename> file or on the server command
line.
</para>
</listitem>
</varlistentry>
<varlistentry id="guc-ssl-ciphers" xreflabel="ssl_ciphers">
<term><varname>ssl_ciphers</varname> (<type>string</type>)
<indexterm>
@@ -1348,15 +1370,13 @@ include_dir 'conf.d'
</term>
<listitem>
<para>
Specifies a list of <acronym>SSL</acronym> cipher suites that are
allowed to be used by SSL connections. See the
<citerefentry><refentrytitle>ciphers</refentrytitle></citerefentry>
Specifies a list of <acronym>SSL</acronym> ciphers that are allowed by
connections using TLS version 1.2 and lower, see
<xref linkend="guc-ssl-tls13-ciphers"/> for TLS version 1.3 connections. See
the <citerefentry><refentrytitle>ciphers</refentrytitle></citerefentry>
manual page in the <productname>OpenSSL</productname> package for the
syntax of this setting and a list of supported values. Only
connections using TLS version 1.2 and lower are affected. There is
currently no setting that controls the cipher choices used by TLS
version 1.3 connections. The default value is
<literal>HIGH:MEDIUM:+3DES:!aNULL</literal>. The default is usually a
syntax of this setting and a list of supported values. The default value
is <literal>HIGH:MEDIUM:+3DES:!aNULL</literal>. The default is usually a
reasonable choice unless you have specific security requirements.
</para>