database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-06-14 18:42:34 +03:00
Code Activity

Remove support for SSL compression

Browse Source 
PostgreSQL disabled compression as of e3bdb2d and the documentation
recommends against using it since.  Additionally, SSL compression has
been disabled in OpenSSL since version 1.1.0, and was disabled in many
distributions long before that.  The most recent TLS version, TLSv1.3,
disallows compression at the protocol level.

This commit removes the feature itself, removing support for the libpq
parameter sslcompression (parameter still listed for compatibility
reasons with existing connection strings, just ignored), and removes
the equivalent field in pg_stat_ssl and de facto PgBackendSSLStatus.

Note that, on top of removing the ability to activate compression by
configuration, compression is actively disabled in both frontend and
backend to avoid overrides from local configurations.

A TAP test is added for deprecated SSL parameters to check after
backwards compatibility.

Bump catalog version.

Author: Daniel Gustafsson
Reviewed-by: Peter Eisentraut, Magnus Hagander, Michael Paquier
Discussion:  https://postgr.es/m/7E384D48-11C5-441B-9EC3-F7DB1F8518F6@yesql.se
This commit is contained in:
Michael Paquier
2021-03-09 11:16:47 +09:00
parent d4545dc19b
commit f9264d1524
19 changed files with 60 additions and 112 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
doc/src/sgml/libpq.sgml
View File

@ -1635,24 +1635,7 @@ postgresql://%2Fvar%2Flib%2Fpostgresql/dbname
<term><literal>sslcompression</literal></term>
<listitem>
<para>
If set to 1, data sent over SSL connections will be compressed. If
set to 0, compression will be disabled. The default is 0. This
parameter is ignored if a connection without SSL is made.
</para>
<para>
SSL compression is nowadays considered insecure and its use is no
longer recommended. <productname>OpenSSL</productname> 1.1.0 disables
compression by default, and many operating system distributions
disable it in prior versions as well, so setting this parameter to on
will not have any effect if the server does not accept compression.
</para>
<para>
If security is not a primary concern, compression can improve
throughput if the network is the bottleneck. Disabling compression
can improve response time and throughput if CPU performance is the
limiting factor.
Ignored (formerly, this specified whether to attempt SSL compression).
</para>
</listitem>
</varlistentry>
@ -2545,9 +2528,7 @@ const char *PQsslAttribute(const PGconn *conn, const char *attribute_name);
<term><literal>compression</literal></term>
<listitem>
<para>
If SSL compression is in use, returns the name of the compression
algorithm, or "on" if compression is used but the algorithm is
not known. If compression is not in use, returns "off".
SSL compression is no longer supported, always returns "off".
</para>
</listitem>
</varlistentry>
@ -7182,16 +7163,6 @@ myEventProc(PGEventId evtId, void *evtInfo, void *passThrough)
</para>
</listitem>
<listitem>
<para>
<indexterm>
<primary><envar>PGSSLCOMPRESSION</envar></primary>
</indexterm>
<envar>PGSSLCOMPRESSION</envar> behaves the same as the <xref
linkend="libpq-connect-sslcompression"/> connection parameter.
</para>
</listitem>
<listitem>
<para>
<indexterm>

10
doc/src/sgml/monitoring.sgml
View File

@ -3065,16 +3065,6 @@ SELECT pid, wait_event_type, wait_event FROM pg_stat_activity WHERE wait_event i
</para></entry>
</row>
<row>
<entry role="catalog_table_entry"><para role="column_definition">
<structfield>compression</structfield> <type>boolean</type>
</para>
<para>
True if SSL compression is in use, false if not,
or NULL if SSL is not in use on this connection
</para></entry>
</row>
<row>
<entry role="catalog_table_entry"><para role="column_definition">
<structfield>client_dn</structfield> <type>text</type>