8000 Revert "Add GUC checks for ssl_min_protocol_version and ssl_max_proto… · postgrespro/postgres@414c2fd · GitHub
[go: up one dir, main page]
Skip to content

Commit 414c2fd

Browse files
michaelpqmichaelpq
committed
Revert "Add GUC checks for ssl_min_protocol_version and ssl_max_protocol_version"
This reverts commit 41aadee, as the GUC checks could run on older values with the new values used, and result in incorrect errors if both parameters are changed at the same time. Per complaint from Tom Lane. Discussion: https://postgr.es/m/27574.1581015893@sss.pgh.pa.us Backpatch-through: 12
1 parent fc7a5e9 commit 414c2fd

File tree

2 files changed

+3
-68
lines changed

2 files changed

+3
-68
lines changed

‎src/backend/utils/misc/guc.c

Lines changed: 2 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -205,10 +205,6 @@ static const char *show_log_file_mode(void);
205205
static const char *show_data_directory_mode(void);
206206
static bool check_backtrace_functions(char **newval, void **extra, GucSource source);
207207
static void assign_backtrace_functions(const char *newval, void *extra);
208-
static bool check_ssl_min_protocol_version(int *newval, void **extra,
209-
GucSource source);
210-
static bool check_ssl_max_protocol_version(int *newval, void **extra,
211-
GucSource source);
212208
static bool check_recovery_target_timeline(char **newval, void **extra, GucSource source);
213209
static void assign_recovery_target_timeline(const char *newval, void *extra);
214210
static bool check_recovery_target(char **newval, void **extra, GucSource source);
@@ -4657,7 +4653,7 @@ static struct config_enum ConfigureNamesEnum[] =
46574653
&ssl_min_protocol_version,
46584654
PG_TLS1_2_VERSION,
46594655
ssl_protocol_versions_info + 1, /* don't allow PG_TLS_ANY */
4660-
check_ssl_min_protocol_version, NULL, NULL
4656+
NULL, NULL, NULL
46614657
},
46624658

46634659
{
@@ -4669,7 +4665,7 @@ static struct config_enum ConfigureNamesEnum[] =
46694665
&ssl_max_protocol_version,
46704666
PG_TLS_ANY,
46714667
ssl_protocol_versions_info,
4672-
check_ssl_max_protocol_version, NULL, NULL
4668+
NULL, NULL, NULL
46734669
},
46744670

46754671
/* End-of-list marker */
@@ -11642,49 +11638,6 @@ assign_backtrace_functions(const char *newval, void *extra)
1164211638
backtrace_symbol_list = (char *) extra;
1164311639
}
1164411640

11645-
static bool
11646-
check_ssl_min_protocol_version(int *newval, void **extra, GucSource source)
11647-
{
11648-
int new_ssl_min_protocol_version = *newval;
11649-
11650-
/* PG_TLS_ANY is not supported for the minimum bound */
11651-
Assert(new_ssl_min_protocol_version > PG_TLS_ANY);
11652-
11653-
if (ssl_max_protocol_version &&
11654-
new_ssl_min_protocol_version > ssl_max_protocol_version)
11655-
{
11656-
GUC_check_errhint("\"%s\" cannot be higher than \"%s\".",
11657-
"ssl_min_protocol_version",
11658-
"ssl_max_protocol_version");
11659-
GUC_check_errcode(ERRCODE_INVALID_PARAMETER_VALUE);
11660-
return false;
11661-
}
11662-
11663-
return true;
11664-
}
11665-
11666-
static bool
11667-
check_ssl_max_protocol_version(int *newval, void **extra, GucSource source)
11668-
{
11669-
int new_ssl_max_protocol_version = *newval;
11670-
11671-
/* if PG_TLS_ANY, there is no need to check the bounds */
11672-
if (new_ssl_max_protocol_version == PG_TLS_ANY)
11673-
return true;
11674-
11675-
if (ssl_min_protocol_version &&
11676-
ssl_min_protocol_version > new_ssl_max_protocol_version)
11677-
{
11678-
GUC_check_errhint("\"%s\" cannot be lower than \"%s\".",
11679-
"ssl_max_protocol_version",
11680-
"ssl_min_protocol_version");
11681-
GUC_check_errcode(ERRCODE_INVALID_PARAMETER_VALUE);
11682-
return false;
11683-
}
11684-
11685-
return true;
11686-
}
11687-
1168811641
static bool
1168911642
check_recovery_target_timeline(char **newval, void **extra, GucSource source)
1169011643
{

‎src/test/ssl/t/001_ssltests.pl

Lines changed: 1 addition & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313

1414
if ($ENV{with_openssl} eq 'yes')
1515
{
16-
plan tests => 93;
16+
plan tests => 91;
1717
}
1818
else
1919
{
@@ -97,24 +97,6 @@
9797
'restart succeeds with password-protected key file');
9898
$node->_update_pid(1);
9999

100-
# Test compatibility of SSL protocols.
101-
# TLSv1.1 is lower than TLSv1.2, so it won't work.
102-
$node->append_conf(
103-
'postgresql.conf',
104-
qq{ssl_min_protocol_version='TLSv1.2'
105-
ssl_max_protocol_version='TLSv1.1'});
106-
command_fails(
107-
[ 'pg_ctl', '-D', $node->data_dir, '-l', $node->logfile, 'restart' ],
108-
'restart fails with incorrect SSL protocol bounds');
109-
# Go back to the defaults, this works.
110-
$node->append_conf(
111-
'postgresql.conf',
112-
qq{ssl_min_protocol_version='TLSv1.2'
113-
ssl_max_protocol_version=''});
114-
command_ok(
115-
[ 'pg_ctl', '-D', $node->data_dir, '-l', $node->logfile, 'restart' ],
116-
'restart succeeds with correct SSL protocol bounds');
117-
118100
### Run client-side tests.
119101
###
120102
### Test that libpq accepts/rejects the connection correctly, depending

0 commit comments

Comments
 (0)
0