Frist of all really appreciate the review of my patch. I've seperated the patch into two: patch_support_tls1.3 for tls1.3 support and patch_support_curves_group for a set of curves list.
TLS1.3 support - patch_support_tls1.3I agree with Jelte that it's better to have different options for tls1.2 and lower(cipher list) and tls1.3(cipher suite) since openssl provided different APIs for each. As for users not faimilar with TLS（they don't care TLS,）we can still keep the default value as described here
https://www.postgresql.org/docs/devel/runtime-config-connection.html. If TLS is critical to them(they should have figured out the different options in tls1.2 and tls1.3), then they can set the values on-demand. Moreover we can add some description of these two options.
ssl_ciphers | HIGH:MEDIUM:+3DES:!aNULL | Sets the list of allowed SSL ciphers for TLS1.2 and lower.
ssl_ciphers_suites | HIGH:MEDIUM:+3DES:!aNULL | Sets the list of allowed SSL cipher suites for TLS1.3.
Curves groups - patch_support_curves_group
Indeed SSL_CTX_set1_curves_list is deprecated it's bette to change to SSL_CTX_set1_groups_list instead.
Sender:"Jelte Fennema-Nio"< postgres@jeltef.nl >;
Sent Time:2024/6/12 16:51
To:"Daniel Gustafsson"< daniel@yesql.se >;
Cc recipient:"Erica Zhang"< ericazhangy2021@qq.com >;"Jacob Champion"< jacob.champion@enterprisedb.com >;"Peter Eisentraut"< peter@eisentraut.org >;"pgsql-hackers"< pgsql-hackers@lists.postgresql.org >;
Subject:Re: Add support to TLS 1.3 cipher suites and curves lists
On Mon, 10 Jun 2024 at 12:31, Daniel Gustafsson wrote:
> Regarding the ciphersuites portion of the patch. I'm not particularly thrilled
> about having a GUC for TLSv1.2 ciphers and one for TLSv1.3 ciphersuites, users
> not all that familiar with TLS will likely find it confusing to figure out what
> to do.
I don't think it's easy to create a single GUC because OpenSSL has
different APIs for both. So we'd have to add some custom parsing for
the combined string, which is likely to cause some problems imho. I
think separating them is the best option from the options we have and
I don't think it matters much practice for users. Users not familiar
with TLS might indeed be confused, but those users shouldn't touch
these settings anyway, and just use the defaults. The users that care
about this probably already get two cipher strings from their
compliance teams, because many other applications also have two
separate options for specifying both.