feat(socket) change LuaSec ssl_protocol default options #103
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
jeremymv2
force-pushed
the
feat/ssl_version_opts
branch
10 times, most recently
from
cd42c1d to
67dcd04
Compare
Contributor
Author
|
cc: @thibaultcha |
The underlying LuaSec SSL library allows for setting the encryption protocol to 'any' [1]. When set as such, the client negotiates the highest encryption protocol available. This `any` protocol version setting is widely in use in the luasec repository [2]. In addition, this change limits the lowest allowable ssl protocol version to a version not less than TLSv1.1. In support of the above, the implementation is two-fold: - add no_sslv2, no_sslv3, and no_tlsv1 LuaSec options similar to what has been done in lua-cassandra [3] - set default LuaSec ssl_protocol to 'any' also similar to what has been done in lua-cassandra [4] [1] - https://github.com/brunoos/luasec/blob/711a98b7605ad87b521ba607024947113bc1f527/CHANGELOG#L101 [2] - https://github.com/brunoos/luasec/search?q=protocol+%3D+%22any%22 [3] - thibaultcha/lua-cassandra@b6dff88 [4] - thibaultcha/lua-cassandra@d742d5c Signed-off-by: Jeremy J. Miller <[email protected]> disable prefer server ciphers Signed-off-by: Jeremy J. Miller <[email protected]>
jeremymv2
force-pushed
the
feat/ssl_version_opts
branch
from
67dcd04 to
61a1f2c
Compare
Owner
|
Looks good to me, thanks for getting the tests working. Tell me if you're good for the merge. |
Contributor
Author
I wanted to do some triple checking with a product I'm working on (Kong) and this change. Everything checks out. With this change I can connect to PG9.5 and PG13 instances using TLSV1.1, TLSV1.2 and TLSV1.3 (in PG13). When trying to connect with TLSv1 or lower you will get: I think this is ready for a merge. Thank you! |
Owner
|
Thanks for the patch, I'll push out a new versioned number shortly |
leafo
added a commit
that referenced
this pull request
Mar 3, 2021
ghost
mentioned this pull request
fffonion
pushed a commit
to fffonion/pgmoon
that referenced
this pull request
Feb 16, 2022
fffonion
added a commit
to fffonion/pgmoon
that referenced
this pull request
Feb 16, 2022
fffonion
added a commit
to Kong/pgmoon
that referenced
this pull request
Feb 18, 2022
tyler-ball
pushed a commit
to Kong/pgmoon
that referenced
this pull request
Feb 25, 2022
tball: Updating for 1.14 code base
gruceo
pushed a commit
to Kong/pgmoon
that referenced
this pull request
Jun 29, 2022
tball: Updating for 1.14 code base
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The underlying LuaSec SSL library allows for setting the encryption protocol
to 'any' [1]. When set as such, the client negotiates the highest
encryption protocol available. This
anyprotocol version setting iswidely in use in the luasec repository [2].
In addition, this change limits the lowest allowable ssl protocol
version to a version not less than TLSv1.1.
In support of the above, the implementation is two-fold:
has been done in lua-cassandra [3]
been done in lua-cassandra [4]
[1] - https://github.com/brunoos/luasec/blob/711a98b7605ad87b521ba607024947113bc1f527/CHANGELOG#L101
[2] - https://github.com/brunoos/luasec/search?q=protocol+%3D+%22any%22
[3] - thibaultcha/lua-cassandra@b6dff88
[4] - thibaultcha/lua-cassandra@d742d5c
Signed-off-by: Jeremy J. Miller [email protected]