Skip to content

Commit 45188c2

Browse files
danielgustafssondanielgustafsson
committed
Support configuring TLSv1.3 cipher suites
The ssl_ciphers GUC can only set cipher suites for TLSv1.2, and lower, connections. For TLSv1.3 connections a different OpenSSL API must be used. This adds a new GUC, ssl_tls13_ciphers, which can be used to configure a colon separated list of cipher suites to support when performing a TLSv1.3 handshake. Original patch by Erica Zhang with additional hacking by me. Author: Erica Zhang <ericazhangy2021@qq.com> Author: Daniel Gustafsson <daniel@yesql.se> Reviewed-by: Jacob Champion <jacob.champion@enterprisedb.com> Reviewed-by: Andres Freund <andres@anarazel.de> Reviewed-by: Peter Eisentraut <peter@eisentraut.org> Reviewed-by: Jelte Fennema-Nio <postgres@jeltef.nl> Discussion: https://postgr.es/m/tencent_063F89FA72CCF2E48A0DF5338841988E9809@qq.com
1 parent 3d1ef3a commit 45188c2

File tree

7 files changed

+66
-15
lines changed

7 files changed

+66
-15
lines changed

‎doc/src/sgml/config.sgml‎

Lines changed: 28 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1340,6 +1340,28 @@ include_dir 'conf.d'
13401340
</listitem>
13411341
</varlistentry>
13421342

1343+
<varlistentry id="guc-ssl-tls13-ciphers" xreflabel="ssl_tls13_ciphers">
1344+
<term><varname>ssl_tls13_ciphers</varname> (<type>string</type>)
1345+
<indexterm>
1346+
<primary><varname>ssl_tls13_ciphers</varname> configuration parameter</primary>
1347+
</indexterm>
1348+
</term>
1349+
<listitem>
1350+
<para>
1351+
Specifies a list of cipher suites that are allowed by connections using
1352+
<acronym>TLS</acronym> version 1.3. Multiple cipher suites can be
1353+
specified by using a colon separated list. If left blank, the default
1354+
set of cipher suites in <productname>OpenSSL</productname> will be used.
1355+
</para>
1356+
1357+
<para>
1358+
This parameter can only be set in the
1359+
<filename>postgresql.conf</filename> file or on the server command
1360+
line.
1361+
</para>
1362+
</listitem>
1363+
</varlistentry>
1364+
13431365
<varlistentry id="guc-ssl-ciphers" xreflabel="ssl_ciphers">
13441366
<term><varname>ssl_ciphers</varname> (<type>string</type>)
13451367
<indexterm>
@@ -1348,15 +1370,13 @@ include_dir 'conf.d'
13481370
</term>
13491371
<listitem>
13501372
<para>
1351-
Specifies a list of <acronym>SSL</acronym> cipher suites that are
1352-
allowed to be used by SSL connections. See the
1353-
<citerefentry><refentrytitle>ciphers</refentrytitle></citerefentry>
1373+
Specifies a list of <acronym>SSL</acronym> ciphers that are allowed by
1374+
connections using TLS version 1.2 and lower, see
1375+
<xref linkend="guc-ssl-tls13-ciphers"/> for TLS version 1.3 connections. See
1376+
the <citerefentry><refentrytitle>ciphers</refentrytitle></citerefentry>
13541377
manual page in the <productname>OpenSSL</productname> package for the
1355-
syntax of this setting and a list of supported values. Only
1356-
connections using TLS version 1.2 and lower are affected. There is
1357-
currently no setting that controls the cipher choices used by TLS
1358-
version 1.3 connections. The default value is
1359-
<literal>HIGH:MEDIUM:+3DES:!aNULL</literal>. The default is usually a
1378+
syntax of this setting and a list of supported values. The default value
1379+
is <literal>HIGH:MEDIUM:+3DES:!aNULL</literal>. The default is usually a
13601380
reasonable choice unless you have specific security requirements.
13611381
</para>
13621382

‎src/backend/libpq/be-secure-openssl.c‎

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -288,15 +288,31 @@ be_tls_init(bool isServerStart)
288288
if (!initialize_ecdh(context, isServerStart))
289289
goto error;
290290

291-
/* set up the allowed cipher list */
292-
if (SSL_CTX_set_cipher_list(context, SSLCipherSuites) != 1)
291+
/* set up the allowed cipher list for TLSv1.2 and below */
292+
if (SSL_CTX_set_cipher_list(context, SSLCipherList) != 1)
293293
{
294294
ereport(isServerStart ? FATAL : LOG,
295295
(errcode(ERRCODE_CONFIG_FILE_ERROR),
296-
errmsg("could not set the cipher list (no valid ciphers available)")));
296+
errmsg("could not set the TLSv1.2 cipher list (no valid ciphers available)")));
297297
goto error;
298298
}
299299

300+
/*
301+
* Set up the allowed cipher suites for TLSv1.3. If the GUC is an empty
302+
* string we leave the allowed suites to be the OpenSSL default value.
303+
*/
304+
if (SSLCipherSuites[0])
305+
{
306+
/* set up the allowed cipher suites */
307+
if (SSL_CTX_set_ciphersuites(context, SSLCipherSuites) != 1)
308+
{
309+
ereport(isServerStart ? FATAL : LOG,
310+
(errcode(ERRCODE_CONFIG_FILE_ERROR),
311+
errmsg("could not set the TLSv1.3 cipher suites (no valid ciphers available)")));
312+
goto error;
313+
}
314+
}
315+
300316
/* Let server choose order */
301317
if (SSLPreferServerCiphers)
302318
SSL_CTX_set_options(context, SSL_OP_CIPHER_SERVER_PREFERENCE);

‎src/backend/libpq/be-secure.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@ bool ssl_loaded_verify_locations = false;
4949

5050
/* GUC variable controlling SSL cipher list */
5151
char *SSLCipherSuites = NULL;
52+
char *SSLCipherList = NULL;
5253

5354
/* GUC variable for default ECHD curve. */
5455
char *SSLECDHCurve;

‎src/backend/utils/misc/guc_tables.c‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4641,12 +4641,23 @@ struct config_string ConfigureNamesString[] =
46414641
},
46424642

46434643
{
4644-
{"ssl_ciphers", PGC_SIGHUP, CONN_AUTH_SSL,
4645-
gettext_noop("Sets the list of allowed SSL ciphers."),
4644+
{"ssl_tls13_ciphers", PGC_SIGHUP, CONN_AUTH_SSL,
4645+
gettext_noop("Sets the list of allowed TLSv1.3 cipher suites (leave blank for default)."),
46464646
NULL,
46474647
GUC_SUPERUSER_ONLY
46484648
},
46494649
&SSLCipherSuites,
4650+
"",
4651+
NULL, NULL, NULL
4652+
},
4653+
4654+
{
4655+
{"ssl_ciphers", PGC_SIGHUP, CONN_AUTH_SSL,
4656+
gettext_noop("Sets the list of allowed TLSv1.2 (and lower) ciphers."),
4657+
NULL,
4658+
GUC_SUPERUSER_ONLY
4659+
},
4660+
&SSLCipherList,
46504661
#ifdef USE_OPENSSL
46514662
"HIGH:MEDIUM:+3DES:!aNULL",
46524663
#else

‎src/backend/utils/misc/postgresql.conf.sample‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,8 @@
110110
#ssl_crl_file = ''
111111
#ssl_crl_dir = ''
112112
#ssl_key_file = 'server.key'
113-
#ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL' # allowed SSL ciphers
113+
#ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL' # allowed TLSv1.2 ciphers
114+
#ssl_tls13_ciphers = '' # allowed TLSv1.3 cipher suites, blank for default
114115
#ssl_prefer_server_ciphers = on
115116
#ssl_groups = 'prime256v1'
116117
#ssl_min_protocol_version = 'TLSv1.2'

‎src/include/libpq/libpq.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,7 @@ extern ssize_t secure_open_gssapi(Port *port);
118118

119119
/* GUCs */
120120
extern PGDLLIMPORT char *SSLCipherSuites;
121+
extern PGDLLIMPORT char *SSLCipherList;
121122
extern PGDLLIMPORT char *SSLECDHCurve;
122123
extern PGDLLIMPORT bool SSLPreferServerCiphers;
123124
extern PGDLLIMPORT int ssl_min_protocol_version;

‎src/test/ssl/t/SSL/Server.pm‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -300,8 +300,9 @@ sub switch_server_cert
300300
ok(unlink($node->data_dir . '/sslconfig.conf'));
301301
$node->append_conf('sslconfig.conf', "ssl=on");
302302
$node->append_conf('sslconfig.conf', $backend->set_server_cert(\%params));
303-
# use lists of ECDH curves for syntax testing
303+
# use lists of ECDH curves and cipher suites for syntax testing
304304
$node->append_conf('sslconfig.conf', 'ssl_groups=prime256v1:secp521r1');
305+
$node->append_conf('sslconfig.conf', 'ssl_tls13_ciphers=TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256');
305306

306307
$node->append_conf('sslconfig.conf',
307308
"ssl_passphrase_command='" . $params{passphrase_cmd} . "'")

0 commit comments

Comments
 (0)