Add new configuration option ssl_prefer_server_ciphers

Add the new setting "ssl_prefer_server_ciphers" to let users configure if they
want client's or server's cipher order to take preference.

diff --git a/doc/src/sgml/ssl.sgml b/doc/src/sgml/ssl.sgml
index 0388e143cddc0b271cb0916f5205179f4451e8cd..1525fd43e709a0a0e7fd2de3112a6c00bd502df5 100644 (file)
--- a/doc/src/sgml/ssl.sgml
+++ b/doc/src/sgml/ssl.sgml
@@ -151,6 +151,24 @@
       </listitem>
     </varlistentry>
 
+    <varlistentry id="guc-ssl-prefer-server-ciphers" xreflabel="ssl_prefer_server_ciphers">
+      <term><varname>ssl_prefer_server_ciphers</varname> (<type>boolean</type>)
+        <indexterm>
+          <primary><varname>ssl_prefer_server_ciphers</varname> configuration parameter</primary>
+        </indexterm>
+    </term>
+    <listitem>
+      <para>
+        Specifies whether to use the server's <acronym>SSL</acronym>
+        cipher preferences, rather than the client's.
+        The default value is false.
+      </para>
+      <para>
+        This parameter can only be set at server start.
+      </para>
+      </listitem>
+    </varlistentry>
+
   </variablelist>
  </sect2>
 

diff --git a/src/config/pool_config_variables.c b/src/config/pool_config_variables.c
index 8989c8568421f1323220aec982753e182f39943f..806776ae02d5a24a95326ee3b2ebac1465a22795 100644 (file)
--- a/src/config/pool_config_variables.c
+++ b/src/config/pool_config_variables.c
@@ -478,6 +478,16 @@ static struct config_bool ConfigureNamesBool[] =
                NULL, NULL, NULL
        },
 
+       {
+               {"ssl_prefer_server_ciphers", CFGCXT_INIT, SSL_CONFIG,
+                       "Use server's SSL cipher preferences, rather than the client's",
+                       CONFIG_VAR_TYPE_BOOL, false, 0
+               },
+               &g_pool_config.ssl_prefer_server_ciphers,
+               false,
+               NULL, NULL, NULL
+       },
+
        {
                {"check_temp_table", CFGCXT_SESSION, GENERAL_CONFIG,
                        "Enables temporary table check.",

diff --git a/src/include/pool_config.h b/src/include/pool_config.h
index cd212ca9c2bc2c34870d46ad520191aff9bc14dc..9de9c281cd946a9e69553ac25dd585e2d6bd2743 100644 (file)
--- a/src/include/pool_config.h
+++ b/src/include/pool_config.h
@@ -334,6 +334,7 @@ typedef struct
        char       *ssl_ca_cert_dir;    /* path to directory containing CA
                                                                         * certificates */
        char       *ssl_ciphers;        /* allowed ssl ciphers */
+       bool            ssl_prefer_server_ciphers; /*Use SSL cipher preferences, rather than the client's*/
        int64           relcache_expire;        /* relation cache life time in seconds */
        int                     relcache_size;  /* number of relation cache life entry */
        bool            check_temp_table;       /* enable temporary table check */

diff --git a/src/sample/pgpool.conf.sample b/src/sample/pgpool.conf.sample
index f9dfa90b6fe5aa36c3afc72c4c3c8234546006bf..827cb2cfeb2dbe2c5754bfb90951681a6024e824 100644 (file)
--- a/src/sample/pgpool.conf.sample
+++ b/src/sample/pgpool.conf.sample
@@ -123,6 +123,10 @@ ssl = off
 ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL'
                                    # Allowed SSL ciphers
                                    # (change requires restart)
+ssl_prefer_server_ciphers = off
+                                   # Use server's SSL cipher preferences,
+                                   # rather than the client's
+                                   # (change requires restart)
 #------------------------------------------------------------------------------
 # POOLS
 #------------------------------------------------------------------------------

diff --git a/src/sample/pgpool.conf.sample-logical b/src/sample/pgpool.conf.sample-logical
index d7a9abde293e86cf7cf0a7164eceaefd7820e03a..dd4fce8d177c6b9b6c46b99809d465ba0a9044d0 100644 (file)
--- a/src/sample/pgpool.conf.sample-logical
+++ b/src/sample/pgpool.conf.sample-logical
@@ -123,6 +123,10 @@ ssl = off
 ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL'
                                    # Allowed SSL ciphers
                                    # (change requires restart)
+ssl_prefer_server_ciphers = off
+                                   # Use server's SSL cipher preferences,
+                                   # rather than the client's
+                                   # (change requires restart)
 #------------------------------------------------------------------------------
 # POOLS
 #------------------------------------------------------------------------------

diff --git a/src/sample/pgpool.conf.sample-master-slave b/src/sample/pgpool.conf.sample-master-slave
index d9f4fd4bcec8f6fe786b6441190a6cf4d7ab4495..caee02f77b5ce39d70d1da58fde2fbb3d597e379 100644 (file)
--- a/src/sample/pgpool.conf.sample-master-slave
+++ b/src/sample/pgpool.conf.sample-master-slave
@@ -122,6 +122,10 @@ ssl = off
 ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL'
                                    # Allowed SSL ciphers
                                    # (change requires restart)
+ssl_prefer_server_ciphers = off
+                                   # Use server's SSL cipher preferences,
+                                   # rather than the client's
+                                   # (change requires restart)
 #------------------------------------------------------------------------------
 # POOLS
 #------------------------------------------------------------------------------

diff --git a/src/sample/pgpool.conf.sample-replication b/src/sample/pgpool.conf.sample-replication
index 3b2884992c19d15c03b964d5470dc88c7ae8fc81..5090b0b80d4e9a206bde171a9fbfe4b51d6ff1ef 100644 (file)
--- a/src/sample/pgpool.conf.sample-replication
+++ b/src/sample/pgpool.conf.sample-replication
@@ -121,6 +121,10 @@ ssl = off
 ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL'
                                    # Allowed SSL ciphers
                                    # (change requires restart)
+ssl_prefer_server_ciphers = off
+                                   # Use server's SSL cipher preferences,
+                                   # rather than the client's
+                                   # (change requires restart)
 #------------------------------------------------------------------------------
 # POOLS
 #------------------------------------------------------------------------------

diff --git a/src/sample/pgpool.conf.sample-stream b/src/sample/pgpool.conf.sample-stream
index 7b9baee9475378b065457224a864e0a603dc41f9..9e6064365c1291d70dea813e06c417de0bbc135e 100644 (file)
--- a/src/sample/pgpool.conf.sample-stream
+++ b/src/sample/pgpool.conf.sample-stream
@@ -123,6 +123,10 @@ ssl = off
 ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL'
                                    # Allowed SSL ciphers
                                    # (change requires restart)
+ssl_prefer_server_ciphers = off
+                                   # Use server's SSL cipher preferences,
+                                   # rather than the client's
+                                   # (change requires restart)
 #------------------------------------------------------------------------------
 # POOLS
 #------------------------------------------------------------------------------

diff --git a/src/utils/pool_process_reporting.c b/src/utils/pool_process_reporting.c
index acf25bc301affebcc649f2292e496b7ab03a5b81..85ce5f7cfb713066443c9886647cd92cf8f285dd 100644 (file)
--- a/src/utils/pool_process_reporting.c
+++ b/src/utils/pool_process_reporting.c
@@ -262,6 +262,11 @@ get_config(int *nrows)
        StrNCpy(status[i].desc, "allowed SSL ciphers", POOLCONFIG_MAXDESCLEN);
        i++;
 
+       StrNCpy(status[i].name, "ssl_prefer_server_ciphers", POOLCONFIG_MAXNAMELEN);
+       snprintf(status[i].value, POOLCONFIG_MAXVALLEN, "%d", pool_config->ssl_prefer_server_ciphers);
+       StrNCpy(status[i].desc, "Use server's SSL cipher preferences", POOLCONFIG_MAXDESCLEN);
+       i++;
+
        /* POOLS */
 
        /* - Pool size -  */

diff --git a/src/utils/pool_ssl.c b/src/utils/pool_ssl.c
index b3a335da35352a2b953b92259497afe3d6d3b9c9..8248e352ca8135e9a20baf595aa71dc1a68f640a 100644 (file)
--- a/src/utils/pool_ssl.c
+++ b/src/utils/pool_ssl.c
@@ -314,7 +314,8 @@ init_ssl_ctx(POOL_CONNECTION * cp, enum ssl_conn_type conntype)
        SSL_RETURN_ERROR_IF((error != 1), "Setting allowed cipher list");
 
        /* Let server choose order */
-       SSL_CTX_set_options(cp->ssl_ctx, SSL_OP_CIPHER_SERVER_PREFERENCE);
+       if (pool_config->ssl_prefer_server_ciphers)
+               SSL_CTX_set_options(cp->ssl_ctx, SSL_OP_CIPHER_SERVER_PREFERENCE);
 
        if (conntype == ssl_conn_serverclient)
        {