On Thu, Jul 13, 2017 at 5:32 PM, Heikki Linnakangas <hlinn...@iki.fi> wrote: > I rebased the patch, did some other clean up of error reporting, and added a > GUC along those lines, as well as docs. How does this look? > > It's late in the release cycle, but it would be nice to sneak this into v10. > Using weak 1024 bit DH parameters is arguably a security issue; it was > originally reported as such. There's a work-around for older versions: > generate custom 2048 bit parameters and place them in a file called > "dh1024.pem", but that's completely undocumented. > > Thoughts?
The patch looks in good shape to me. #include "utils/memutils.h" - static int my_sock_read(BIO *h, char *buf, int size); That's unnecessary noise. + * Very uncool. Alternatively, the system could refuse to start + * if a DH parameters if not specified, but this would tend to + * piss off DBAs. "is not specified". > Objections to committing this now, instead of waiting for v11? But I am -1 for the sneak part. It is not the time to have a new feature in 10, the focus is to stabilize. -- Michael -- Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-hackers