@@ -385,63 +385,70 @@ PGconn *PQconnectdbParams(const char **keywords, const char **values, int expand
385
385
This option determines whether or with what priority a secure
386
386
<acronym>SSL</> TCP/IP connection will be negotiated with the
387
387
server. There are six modes:
388
- </para>
389
388
390
- <table id="libpq-connect-sslmode-options">
391
- <title><literal>sslmode</literal> Options</title>
392
- <tgroup cols="2">
393
- <thead>
394
- <row>
395
- <entry>Option</entry>
396
- <entry>Description</entry>
397
- </row>
398
- </thead>
399
-
400
- <tbody>
401
-
402
- <row>
403
- <entry><literal>disable</></entry>
404
- <entry>only try a non-<acronym>SSL</> connection</entry>
405
- </row>
406
-
407
- <row>
408
- <entry><literal>allow</></entry>
409
- <entry>first try a non-<acronym>SSL</>
410
- connection; if that fails, try an <acronym>SSL</>
411
- connection</entry>
412
- </row>
413
-
414
- <row>
415
- <entry><literal>prefer</> (default)</entry>
416
- <entry>first try an <acronym>SSL</> connection; if
417
- that fails, try a non-<acronym>SSL</>
418
- connection</entry>
419
- </row>
420
-
421
- <row>
422
- <entry><literal>require</></entry>
423
- <entry>only try an <acronym>SSL</> connection</entry>
424
- </row>
425
-
426
- <row>
427
- <entry><literal>verify-ca</></entry>
428
- <entry>only try an <acronym>SSL</> connection, and verify that
429
- the server certificate is issued by a trusted certificate
430
- authority (<acronym>CA</>)</entry>
431
- </row>
432
-
433
- <row>
434
- <entry><literal>verify-full</></entry>
435
- <entry>only try an <acronym>SSL</> connection, verify that
436
- the server certificate is issued by a trusted <acronym>CA</> and
437
- that the server host name matches that in the certificate</entry>
438
- </row>
439
-
440
- </tbody>
441
- </tgroup>
442
- </table>
389
+ <variablelist>
390
+ <varlistentry>
391
+ <term><literal>disable</literal></term>
392
+ <listitem>
393
+ <para>
394
+ only try a non-<acronym>SSL</> connection
395
+ </para>
396
+ </listitem>
397
+ </varlistentry>
398
+
399
+ <varlistentry>
400
+ <term><literal>allow</literal></term>
401
+ <listitem>
402
+ <para>
403
+ first try a non-<acronym>SSL</> connection; if that
404
+ fails, try an <acronym>SSL</> connection
405
+ </para>
406
+ </listitem>
407
+ </varlistentry>
408
+
409
+ <varlistentry>
410
+ <term><literal>prefer</literal> (default)</term>
411
+ <listitem>
412
+ <para>
413
+ first try an <acronym>SSL</> connection; if that fails,
414
+ try a non-<acronym>SSL</> connection
415
+ </para>
416
+ </listitem>
417
+ </varlistentry>
418
+
419
+ <varlistentry>
420
+ <term><literal>require</literal></term>
421
+ <listitem>
422
+ <para>
423
+ only try an <acronym>SSL</> connection
424
+ </para>
425
+ </listitem>
426
+ </varlistentry>
427
+
428
+ <varlistentry>
429
+ <term><literal>verify-ca</literal></term>
430
+ <listitem>
431
+ <para>
432
+ only try an <acronym>SSL</> connection, and verify that
433
+ the server certificate is issued by a trusted
434
+ certificate authority (<acronym>CA</>)
435
+ </para>
436
+ </listitem>
437
+ </varlistentry>
438
+
439
+ <varlistentry>
440
+ <term><literal>verify-full</literal></term>
441
+ <listitem>
442
+ <para>
443
+ only try an <acronym>SSL</> connection, verify that the
444
+ server certificate is issued by a
445
+ trusted <acronym>CA</> and that the server host name
446
+ matches that in the certificate
447
+ </para>
448
+ </listitem>
449
+ </varlistentry>
450
+ </variablelist>
443
451
444
- <para>
445
452
See <xref linkend="libpq-ssl"> for a detailed description of how
446
453
these options work.
447
454
</para>
@@ -6773,30 +6780,23 @@ ldap://ldap.acme.com/cn=dbserver,cn=hosts?pgconnectinfo?base?(objectclass=*)
6773
6780
The different values for the <literal>sslmode</> parameter provide different
6774
6781
levels of protection. SSL can provide
6775
6782
protection against three types of attacks:
6776
- </para>
6777
- <table id="libpq-ssl-protect-attacks">
6778
- <title>SSL Attacks</title>
6779
- <tgroup cols="2">
6780
- <thead>
6781
- <row>
6782
- <entry>Type</entry>
6783
- <entry>Description</entry>
6784
- </row>
6785
- </thead>
6786
6783
6787
- <tbody>
6788
- <row>
6789
- <entry>Eavesdropping</entry>
6790
- <entry>If a third party can examine the network traffic between the
6784
+ <variablelist>
6785
+ <varlistentry>
6786
+ <term>Eavesdropping</term>
6787
+ <listitem>
6788
+ <para>If a third party can examine the network traffic between the
6791
6789
client and the server, it can read both connection information (including
6792
6790
the user name and password) and the data that is passed. <acronym>SSL</>
6793
6791
uses encryption to prevent this.
6794
- </entry>
6795
- </row>
6792
+ </para>
6793
+ </listitem>
6794
+ </varlistentry>
6796
6795
6797
- <row>
6798
- <entry>Man in the middle (<acronym>MITM</>)</entry>
6799
- <entry>If a third party can modify the data while passing between the
6796
+ <varlistentry>
6797
+ <term>Man in the middle (<acronym>MITM</>)</term>
6798
+ <listitem>
6799
+ <para>If a third party can modify the data while passing between the
6800
6800
client and server, it can pretend to be the server and therefore see and
6801
6801
modify data <emphasis>even if it is encrypted</>. The third party can then
6802
6802
forward the connection information and data to the original server,
@@ -6805,21 +6805,23 @@ ldap://ldap.acme.com/cn=dbserver,cn=hosts?pgconnectinfo?base?(objectclass=*)
6805
6805
to a different server than intended. There are also several other
6806
6806
attack methods that can accomplish this. <acronym>SSL</> uses certificate
6807
6807
verification to prevent this, by authenticating the server to the client.
6808
- </entry>
6809
- </row>
6808
+ </para>
6809
+ </listitem>
6810
+ </varlistentry>
6810
6811
6811
- <row>
6812
- <entry>Impersonation</entry>
6813
- <entry>If a third party can pretend to be an authorized client, it can
6812
+ <varlistentry>
6813
+ <term>Impersonation</term>
6814
+ <listitem>
6815
+ <para>If a third party can pretend to be an authorized client, it can
6814
6816
simply access data it should not have access to. Typically this can
6815
6817
happen through insecure password management. <acronym>SSL</> uses
6816
6818
client certificates to prevent this, by making sure that only holders
6817
6819
of valid certificates can access the server.
6818
- </entry >
6819
- </row >
6820
- </tbody >
6821
- </tgroup >
6822
- </table >
6820
+ </para >
6821
+ </listitem >
6822
+ </varlistentry >
6823
+ </variablelist >
6824
+ </para >
6823
6825
6824
6826
<para>
6825
6827
For a connection to be known secure, SSL usage must be configured
@@ -6844,9 +6846,9 @@ ldap://ldap.acme.com/cn=dbserver,cn=hosts?pgconnectinfo?base?(objectclass=*)
6844
6846
<para>
6845
6847
All <acronym>SSL</> options carry overhead in the form of encryption and
6846
6848
key-exchange, so there is a tradeoff that has to be made between performance
6847
- and security. The following table illustrates the risks the different
6848
- <literal>sslmode</> values protect against, and what statement they make
6849
- about security and overhead:
6849
+ and security. <xref linkend="libpq-ssl-sslmode-statements">
6850
+ illustrates the risks the different <literal>sslmode</> values
6851
+ protect against, and what statement they make about security and overhead.
6850
6852
</para>
6851
6853
6852
6854
<table id="libpq-ssl-sslmode-statements">
@@ -6942,6 +6944,12 @@ ldap://ldap.acme.com/cn=dbserver,cn=hosts?pgconnectinfo?base?(objectclass=*)
6942
6944
6943
6945
<sect2 id="libpq-ssl-fileusage">
6944
6946
<title>SSL Client File Usage</title>
6947
+
6948
+ <para>
6949
+ <xref linkend="libpq-ssl-file-usage"> summarizes the files that are
6950
+ relevant to the SSL setup on the client.
6951
+ </para>
6952
+
6945
6953
<table id="libpq-ssl-file-usage">
6946
6954
<title>Libpq/Client SSL File Usage</title>
6947
6955
<tgroup cols="3">
0 commit comments