Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit274bbce

Browse files
Disable all TLS session tickets
OpenSSL supports two types of session tickets for TLSv1.3, statelessand stateful. The option we've used only turns off stateless ticketsleaving stateful tickets active. Use the new API introduced in 1.1.1to disable all types of tickets.Backpatch to all supported versions.Reviewed-by: Heikki Linnakangas <hlinnaka@iki.fi>Reported-by: Andres Freund <andres@anarazel.de>Discussion:https://postgr.es/m/20240617173803.6alnafnxpiqvlh3g@awork3.anarazel.deBackpatch-through: v12
1 parent6f9a62b commit274bbce

File tree

5 files changed

+23
-6
lines changed

5 files changed

+23
-6
lines changed

‎configure

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12591,12 +12591,13 @@ fi
1259112591
done
1259212592

1259312593
# Function introduced in OpenSSL 1.1.1.
12594-
for ac_func in X509_get_signature_info
12594+
for ac_func in X509_get_signature_info SSL_CTX_set_num_tickets
1259512595
do :
12596-
ac_fn_c_check_func "$LINENO" "X509_get_signature_info" "ac_cv_func_X509_get_signature_info"
12597-
if test "x$ac_cv_func_X509_get_signature_info" = xyes; then :
12596+
as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
12597+
ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
12598+
if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
1259812599
cat >>confdefs.h <<_ACEOF
12599-
#defineHAVE_X509_GET_SIGNATURE_INFO 1
12600+
#define`$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
1260012601
_ACEOF
1260112602

1260212603
fi

‎configure.ac

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1358,7 +1358,7 @@ if test "$with_ssl" = openssl ; then
13581358
# function was removed.
13591359
AC_CHECK_FUNCS([CRYPTO_lock])
13601360
# Function introduced in OpenSSL 1.1.1.
1361-
AC_CHECK_FUNCS([X509_get_signature_info])
1361+
AC_CHECK_FUNCS([X509_get_signature_info SSL_CTX_set_num_tickets])
13621362
AC_DEFINE([USE_OPENSSL],1,[Define to 1 to build with OpenSSL support. (--with-ssl=openssl)])
13631363
elif test "$with_ssl" != no ; then
13641364
AC_MSG_ERROR([--with-ssl must specify openssl])

‎meson.build

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1362,6 +1362,7 @@ if sslopt in ['auto', 'openssl']
13621362

13631363
# Function introduced in OpenSSL 1.1.1
13641364
['X509_get_signature_info'],
1365+
['SSL_CTX_set_num_tickets'],
13651366
]
13661367

13671368
are_openssl_funcs_complete=true

‎src/backend/libpq/be-secure-openssl.c

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -259,8 +259,20 @@ be_tls_init(bool isServerStart)
259259
}
260260
}
261261

262-
/* disallow SSL session tickets */
262+
/*
263+
* Disallow SSL session tickets. OpenSSL use both stateful and stateless
264+
* tickets for TLSv1.3, and stateless ticket for TLSv1.2. SSL_OP_NO_TICKET
265+
* is available since 0.9.8f but only turns off stateless tickets. In
266+
* order to turn off stateful tickets we need SSL_CTX_set_num_tickets,
267+
* which is available since OpenSSL 1.1.1. LibreSSL 3.5.4 (from OpenBSD
268+
* 7.1) introduced this API for compatibility, but doesn't support session
269+
* tickets at all so it's a no-op there.
270+
*/
271+
#ifdefHAVE_SSL_CTX_SET_NUM_TICKETS
272+
SSL_CTX_set_num_tickets(context,0);
273+
#else
263274
SSL_CTX_set_options(context,SSL_OP_NO_TICKET);
275+
#endif
264276

265277
/* disallow SSL session caching, too */
266278
SSL_CTX_set_session_cache_mode(context,SSL_SESS_CACHE_OFF);

‎src/include/pg_config.h.in

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -517,6 +517,9 @@
517517
/* Define to 1 if you have the `X509_get_signature_info' function. */
518518
#undef HAVE_X509_GET_SIGNATURE_INFO
519519

520+
/* Define to 1 if you have the `SSL_CTX_set_num_tickets' function. */
521+
#undef HAVE_SSL_CTX_SET_NUM_TICKETS
522+
520523
/* Define to 1 if the assembler supports X86_64's POPCNTQ instruction. */
521524
#undef HAVE_X86_64_POPCNTQ
522525

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp