Support TLS for Postgres wire protocol#73812
Support TLS for Postgres wire protocol#73812alexey-milovidov merged 5 commits intoClickHouse:masterfrom
Conversation
|
I've added the changelog entry. Without the changelog entry, CI couldn't run. |
|
This is an automated comment for commit 173103f with description of existing statuses. It's updated for the latest CI running ✅ Click here to open a full report in a separate page Successful checks
|
|
Thanks, this looks perfect! I don't see a test that checks the operation over TLS. |
| <loadDefaultCAFile>true</loadDefaultCAFile> | ||
| <cacheSessions>true</cacheSessions> | ||
| <disableProtocols>sslv2,sslv3</disableProtocols> | ||
| <disableProtocols>sslv2,sslv3,tlsv1,tlsv1_1,tlsv1_2</disableProtocols> |
There was a problem hiding this comment.
What is the point of this change?
There was a problem hiding this comment.
to only allow tls 1.3?
There was a problem hiding this comment.
Yes, it is useful to set tls version 1.3
| return TCPServerConnectionFactory::Ptr(new MySQLHandlerFactory(*this, ProfileEvents::InterfaceMySQLReceiveBytes, ProfileEvents::InterfaceMySQLSendBytes)); | ||
| if (type == "postgres") | ||
| #if USE_SSL | ||
| return TCPServerConnectionFactory::Ptr(new PostgreSQLHandlerFactory(*this, conf_name + ".", ProfileEvents::InterfacePostgreSQLReceiveBytes, ProfileEvents::InterfacePostgreSQLSendBytes)); |
There was a problem hiding this comment.
Does it mean that TLS was always supported internally, we just forgot to pass its configuration?
There was a problem hiding this comment.
I think so - previously SSL was made with default settings, so I added the configuration for TLS
The tests already had ssl enabled (https://github.com/ClickHouse/ClickHouse/blob/master/tests/integration/test_postgresql_protocol/test.py#L67), and in postgres enabling ssl and tls is similar, so I think that the existing tests are sufficient |
Changelog category (leave one):
Changelog entry (a user-readable short description of the changes that goes to CHANGELOG.md):
Support TLS for Postgres wire protocol.
Documentation entry for user-facing changes
CI Settings (Only check the boxes if you know what you are doing)
All builds in Builds_1 and Builds_2 stages are always mandatory
and will run independently of the checks below: