Noah Misch <noah@leadboat.com> writes:
> libpq: Support TLS versions beyond TLSv1.
> Per report from Jeffrey Walton, libpq has been accepting only TLSv1
> exactly. Along the lines of the backend code, libpq will now support
> new versions as OpenSSL adds them.
This patch seems fishy. The commit comment claims that it makes libpq
consistent with the backend, but it doesn't: in the backend, we use
SSLv23_method() but then set only the option SSL_OP_NO_SSLv2. With the
patch, libpq now also sets the option SSL_OP_NO_SSLv3, which I assume
means that we just disabled SSL v3 protocol. Did we actually want to
do that? If so, why wasn't this patch advertised as doing that, and
why wasn't the backend also made to reject SSL v3?
regards, tom lane
