* Ensure that the SSL protocol range given in input is correct. The check * is performed on the input string to keep it TLS backend agnostic. Input * to this function is expected verified with sslVerifyProtocolVersion(). */
| 7428 | * to this function is expected verified with sslVerifyProtocolVersion(). |
| 7429 | */ |
| 7430 | static bool |
| 7431 | sslVerifyProtocolRange(const char *min, const char *max) |
| 7432 | { |
| 7433 | Assert(sslVerifyProtocolVersion(min) && |
| 7434 | sslVerifyProtocolVersion(max)); |
| 7435 | |
| 7436 | /* If at least one of the bounds is not set, the range is valid */ |
| 7437 | if (min == NULL || max == NULL || strlen(min) == 0 || strlen(max) == 0) |
| 7438 | return true; |
| 7439 | |
| 7440 | /* |
| 7441 | * If the minimum version is the lowest one we accept, then all options |
| 7442 | * for the maximum are valid. |
| 7443 | */ |
| 7444 | if (pg_strcasecmp(min, "TLSv1") == 0) |
| 7445 | return true; |
| 7446 | |
| 7447 | /* |
| 7448 | * The minimum bound is valid, and cannot be TLSv1, so using TLSv1 for the |
| 7449 | * maximum is incorrect. |
| 7450 | */ |
| 7451 | if (pg_strcasecmp(max, "TLSv1") == 0) |
| 7452 | return false; |
| 7453 | |
| 7454 | /* |
| 7455 | * At this point we know that we have a mix of TLSv1.1 through 1.3 |
| 7456 | * versions. |
| 7457 | */ |
| 7458 | if (pg_strcasecmp(min, max) > 0) |
| 7459 | return false; |
| 7460 | |
| 7461 | return true; |
| 7462 | } |
| 7463 | |
| 7464 | |
| 7465 | /* |
no test coverage detected