Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit01e6f1a

Browse files
committed
Disallow SSL renegotiation
SSL renegotiation is already disabled as of48d23c7, however this doesnot prevent the server to comply with a client willing to userenegotiation. In the last couple of years, renegotiation had its setof security issues and flaws (like the recentCVE-2021-3449), and itcould be possible to crash the backend with a client attemptingrenegotiation.This commit takes one extra step by disabling renegotiation in thebackend in the same way as SSL compression (f9264d1) or tickets(97d3a0b). OpenSSL 1.1.0h has added an option namedSSL_OP_NO_RENEGOTIATION able to achieve that. In older versionsthere is an option called SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS thatwas undocumented, and could be set within the SSL object created whenthe TLS connection opens, but I have decided not to use it, as it feelstrickier to rely on, and it is not official. Note that this option isnot usable in OpenSSL < 1.1.0h as the internal contents of the *SSLobject are hidden to applications.SSL renegotiation concerns protocols up to TLSv1.2.Per original report from Robert Haas, with a patch based on a suggestionby Andres Freund.Author: Michael PaquierReviewed-by: Daniel GustafssonDiscussion:https://postgr.es/m/YKZBXx7RhU74FlTE@paquier.xyzBackpatch-through: 9.6
1 parentcba5c70 commit01e6f1a

File tree

1 file changed

+10
-0
lines changed

1 file changed

+10
-0
lines changed

‎src/backend/libpq/be-secure-openssl.c

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -251,6 +251,16 @@ be_tls_init(bool isServerStart)
251251
/* disallow SSL compression */
252252
SSL_CTX_set_options(context,SSL_OP_NO_COMPRESSION);
253253

254+
#ifdefSSL_OP_NO_RENEGOTIATION
255+
256+
/*
257+
* Disallow SSL renegotiation, option available since 1.1.0h. This
258+
* concerns only TLSv1.2 and older protocol versions, as TLSv1.3 has no
259+
* support for renegotiation.
260+
*/
261+
SSL_CTX_set_options(context,SSL_OP_NO_RENEGOTIATION);
262+
#endif
263+
254264
/* set up ephemeral DH and ECDH keys */
255265
if (!initialize_dh(context,isServerStart))
256266
gotoerror;

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp