Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commite73e67c

Browse files
committed
Add settings to control SSL/TLS protocol version
For example: ssl_min_protocol_version = 'TLSv1.1' ssl_max_protocol_version = 'TLSv1.2'Reviewed-by: Steve Singer <steve@ssinger.info>Discussion:https://www.postgresql.org/message-id/flat/1822da87-b862-041a-9fc2-d0310c3da173@2ndquadrant.com
1 parent2d9140e commite73e67c

File tree

6 files changed

+214
-2
lines changed

6 files changed

+214
-2
lines changed

‎doc/src/sgml/config.sgml

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1291,6 +1291,50 @@ include_dir 'conf.d'
12911291
</listitem>
12921292
</varlistentry>
12931293

1294+
<varlistentry id="guc-ssl-min-protocol-version" xreflabel="ssl_min_protocol_version">
1295+
<term><varname>ssl_min_protocol_version</varname> (<type>enum</type>)
1296+
<indexterm>
1297+
<primary><varname>ssl_min_protocol_version</varname> configuration parameter</primary>
1298+
</indexterm>
1299+
</term>
1300+
<listitem>
1301+
<para>
1302+
Sets the minimum SSL/TLS protocol version to use. Valid values are
1303+
currently: <literal>TLSv1</literal>, <literal>TLSv1.1</literal>,
1304+
<literal>TLSv1.2</literal>, <literal>TLSv1.3</literal>. Older
1305+
versions of the <productname>OpenSSL</productname> library do not
1306+
support all values; an error will be raised if an unsupported setting
1307+
is chosen. Protocol versions before TLS 1.0, namely SSL version 2 and
1308+
3, are always disabled.
1309+
</para>
1310+
1311+
<para>
1312+
The default is <literal>TLSv1</literal>, mainly to support older
1313+
versions of the <productname>OpenSSL</productname> library. You might
1314+
want to set this to a higher value if all software components can
1315+
support the newer protocol versions.
1316+
</para>
1317+
</listitem>
1318+
</varlistentry>
1319+
1320+
<varlistentry id="guc-ssl-max-protocol-version" xreflabel="ssl_max_protocol_version">
1321+
<term><varname>ssl_max_protocol_version</varname> (<type>enum</type>)
1322+
<indexterm>
1323+
<primary><varname>ssl_max_protocol_version</varname> configuration parameter</primary>
1324+
</indexterm>
1325+
</term>
1326+
<listitem>
1327+
<para>
1328+
Sets the maximum SSL/TLS protocol version to use. Valid values are as
1329+
for <xref linkend="guc-ssl-min-protocol-version"/>, with addition of
1330+
an empty string, which allows any protocol version. The default is to
1331+
allow any version. Setting the maximum protocol version is mainly
1332+
useful for testing or if some component has issues working with a
1333+
newer protocol.
1334+
</para>
1335+
</listitem>
1336+
</varlistentry>
1337+
12941338
<varlistentry id="guc-ssl-dh-params-file" xreflabel="ssl_dh_params_file">
12951339
<term><varname>ssl_dh_params_file</varname> (<type>string</type>)
12961340
<indexterm>

‎src/backend/libpq/be-secure-openssl.c

Lines changed: 121 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,12 @@ static bool SSL_initialized = false;
6767
staticbooldummy_ssl_passwd_cb_called= false;
6868
staticboolssl_is_server_start;
6969

70+
staticintssl_protocol_version_to_openssl(intv,constchar*guc_name);
71+
#if (OPENSSL_VERSION_NUMBER<0x10100000L)
72+
staticintSSL_CTX_set_min_proto_version(SSL_CTX*ctx,intversion);
73+
staticintSSL_CTX_set_max_proto_version(SSL_CTX*ctx,intversion);
74+
#endif
75+
7076

7177
/* ------------------------------------------------------------ */
7278
/* Public interface*/
@@ -183,8 +189,14 @@ be_tls_init(bool isServerStart)
183189
gotoerror;
184190
}
185191

186-
/* disallow SSL v2/v3 */
187-
SSL_CTX_set_options(context,SSL_OP_NO_SSLv2 |SSL_OP_NO_SSLv3);
192+
if (ssl_min_protocol_version)
193+
SSL_CTX_set_min_proto_version(context,
194+
ssl_protocol_version_to_openssl(ssl_min_protocol_version,
195+
"ssl_min_protocol_version"));
196+
if (ssl_max_protocol_version)
197+
SSL_CTX_set_max_proto_version(context,
198+
ssl_protocol_version_to_openssl(ssl_max_protocol_version,
199+
"ssl_max_protocol_version"));
188200

189201
/* disallow SSL session tickets */
190202
#ifdefSSL_OP_NO_TICKET/* added in OpenSSL 0.9.8f */
@@ -1209,3 +1221,110 @@ X509_NAME_to_cstring(X509_NAME *name)
12091221

12101222
returnresult;
12111223
}
1224+
1225+
/*
1226+
* Convert TLS protocol version GUC enum to OpenSSL values
1227+
*
1228+
* This is a straightforward one-to-one mapping, but doing it this way makes
1229+
* guc.c independent of OpenSSL availability and version.
1230+
*
1231+
* If a version is passed that is not supported by the current OpenSSL
1232+
* version, then we throw an error, so that subsequent code can assume it's
1233+
* working with a supported version.
1234+
*/
1235+
staticint
1236+
ssl_protocol_version_to_openssl(intv,constchar*guc_name)
1237+
{
1238+
switch (v)
1239+
{
1240+
casePG_TLS_ANY:
1241+
return0;
1242+
casePG_TLS1_VERSION:
1243+
returnTLS1_VERSION;
1244+
casePG_TLS1_1_VERSION:
1245+
#ifdefTLS1_1_VERSION
1246+
returnTLS1_1_VERSION;
1247+
#else
1248+
gotoerror;
1249+
#endif
1250+
casePG_TLS1_2_VERSION:
1251+
#ifdefTLS1_2_VERSION
1252+
returnTLS1_2_VERSION;
1253+
#else
1254+
gotoerror;
1255+
#endif
1256+
casePG_TLS1_3_VERSION:
1257+
#ifdefTLS1_3_VERSION
1258+
returnTLS1_3_VERSION;
1259+
#else
1260+
gotoerror;
1261+
#endif
1262+
}
1263+
1264+
error:
1265+
pg_attribute_unused();
1266+
ereport(ERROR,
1267+
(errmsg("%s setting %s not supported by this build",
1268+
guc_name,
1269+
GetConfigOption(guc_name, false, false))));
1270+
return-1;
1271+
}
1272+
1273+
/*
1274+
* Replacements for APIs present in newer versions of OpenSSL
1275+
*/
1276+
#if (OPENSSL_VERSION_NUMBER<0x10100000L)
1277+
1278+
/*
1279+
* OpenSSL versions that support TLS 1.3 shouldn't get here because they
1280+
* already have these functions. So we don't have to keep updating the below
1281+
* code for every new TLS version, and eventually it can go away. But let's
1282+
* just check this to make sure ...
1283+
*/
1284+
#ifdefTLS1_3_VERSION
1285+
#error OpenSSL version mismatch
1286+
#endif
1287+
1288+
staticint
1289+
SSL_CTX_set_min_proto_version(SSL_CTX*ctx,intversion)
1290+
{
1291+
intssl_options=SSL_OP_NO_SSLv2 |SSL_OP_NO_SSLv3;
1292+
1293+
if (version>TLS1_VERSION)
1294+
ssl_options |=SSL_OP_NO_TLSv1;
1295+
#ifdefTLS1_1_VERSION
1296+
if (version>TLS1_1_VERSION)
1297+
ssl_options |=SSL_OP_NO_TLSv1_1;
1298+
#endif
1299+
#ifdefTLS1_2_VERSION
1300+
if (version>TLS1_2_VERSION)
1301+
ssl_options |=SSL_OP_NO_TLSv1_2;
1302+
#endif
1303+
1304+
SSL_CTX_set_options(ctx,ssl_options);
1305+
1306+
return1;/* success */
1307+
}
1308+
1309+
staticint
1310+
SSL_CTX_set_max_proto_version(SSL_CTX*ctx,intversion)
1311+
{
1312+
intssl_options=0;
1313+
1314+
AssertArg(version!=0);
1315+
1316+
#ifdefTLS1_1_VERSION
1317+
if (version<TLS1_1_VERSION)
1318+
ssl_options |=SSL_OP_NO_TLSv1_1;
1319+
#endif
1320+
#ifdefTLS1_2_VERSION
1321+
if (version<TLS1_2_VERSION)
1322+
ssl_options |=SSL_OP_NO_TLSv1_2;
1323+
#endif
1324+
1325+
SSL_CTX_set_options(ctx,ssl_options);
1326+
1327+
return1;/* success */
1328+
}
1329+
1330+
#endif/* OPENSSL_VERSION_NUMBER */

‎src/backend/libpq/be-secure.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,9 @@ char *SSLECDHCurve;
6060
/* GUC variable: if false, prefer client ciphers */
6161
boolSSLPreferServerCiphers;
6262

63+
intssl_min_protocol_version;
64+
intssl_max_protocol_version;
65+
6366
/* ------------------------------------------------------------ */
6467
/* Procedures common to all secure sessions*/
6568
/* ------------------------------------------------------------ */

‎src/backend/utils/misc/guc.c

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -428,6 +428,15 @@ static const struct config_enum_entry password_encryption_options[] = {
428428
{NULL,0, false}
429429
};
430430

431+
conststructconfig_enum_entryssl_protocol_versions_info[]= {
432+
{"",PG_TLS_ANY, false},
433+
{"TLSv1",PG_TLS1_VERSION, false},
434+
{"TLSv1.1",PG_TLS1_1_VERSION, false},
435+
{"TLSv1.2",PG_TLS1_2_VERSION, false},
436+
{"TLSv1.3",PG_TLS1_3_VERSION, false},
437+
{NULL,0, false}
438+
};
439+
431440
/*
432441
* Options for enum values stored in other modules
433442
*/
@@ -4193,6 +4202,30 @@ static struct config_enum ConfigureNamesEnum[] =
41934202
NULL,NULL,NULL
41944203
},
41954204

4205+
{
4206+
{"ssl_min_protocol_version",PGC_SIGHUP,CONN_AUTH_SSL,
4207+
gettext_noop("Sets the minimum SSL/TLS protocol version to use."),
4208+
NULL,
4209+
GUC_SUPERUSER_ONLY
4210+
},
4211+
&ssl_min_protocol_version,
4212+
PG_TLS1_VERSION,
4213+
ssl_protocol_versions_info+1/* don't allow PG_TLS_ANY */,
4214+
NULL,NULL,NULL
4215+
},
4216+
4217+
{
4218+
{"ssl_max_protocol_version",PGC_SIGHUP,CONN_AUTH_SSL,
4219+
gettext_noop("Sets the maximum SSL/TLS protocol version to use."),
4220+
NULL,
4221+
GUC_SUPERUSER_ONLY
4222+
},
4223+
&ssl_max_protocol_version,
4224+
PG_TLS_ANY,
4225+
ssl_protocol_versions_info,
4226+
NULL,NULL,NULL
4227+
},
4228+
41964229
/* End-of-list marker */
41974230
{
41984231
{NULL,0,0,NULL,NULL},NULL,0,NULL,NULL,NULL,NULL

‎src/backend/utils/misc/postgresql.conf.sample

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,8 @@
103103
#ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL' # allowed SSL ciphers
104104
#ssl_prefer_server_ciphers = on
105105
#ssl_ecdh_curve = 'prime256v1'
106+
#ssl_min_protocol_version = 'TLSv1'
107+
#ssl_max_protocol_version = ''
106108
#ssl_dh_params_file = ''
107109
#ssl_passphrase_command = ''
108110
#ssl_passphrase_command_supports_reload = off

‎src/include/libpq/libpq.h

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,6 +102,17 @@ extern WaitEventSet *FeBeWaitSet;
102102
externchar*SSLCipherSuites;
103103
externchar*SSLECDHCurve;
104104
externboolSSLPreferServerCiphers;
105+
externintssl_min_protocol_version;
106+
externintssl_max_protocol_version;
107+
108+
enumssl_protocol_versions
109+
{
110+
PG_TLS_ANY=0,
111+
PG_TLS1_VERSION,
112+
PG_TLS1_1_VERSION,
113+
PG_TLS1_2_VERSION,
114+
PG_TLS1_3_VERSION,
115+
};
105116

106117
/*
107118
* prototypes for functions in be-secure-common.c

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp