Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit3df7f44

Browse files
Disable all TLS session tickets
OpenSSL supports two types of session tickets for TLSv1.3, statelessand stateful. The option we've used only turns off stateless ticketsleaving stateful tickets active. Use the new API introduced in 1.1.1to disable all types of tickets.Backpatch to all supported versions.Reviewed-by: Heikki Linnakangas <hlinnaka@iki.fi>Reported-by: Andres Freund <andres@anarazel.de>Discussion:https://postgr.es/m/20240617173803.6alnafnxpiqvlh3g@awork3.anarazel.deBackpatch-through: v12
1 parent8a1a408 commit3df7f44

File tree

5 files changed

+23
-6
lines changed

5 files changed

+23
-6
lines changed

‎configure‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12591,12 +12591,13 @@ fi
1259112591
done
1259212592

1259312593
# Function introduced in OpenSSL 1.1.1.
12594-
for ac_func in X509_get_signature_info
12594+
for ac_func in X509_get_signature_info SSL_CTX_set_num_tickets
1259512595
do :
12596-
ac_fn_c_check_func "$LINENO" "X509_get_signature_info" "ac_cv_func_X509_get_signature_info"
12597-
if test "x$ac_cv_func_X509_get_signature_info" = xyes; then :
12596+
as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
12597+
ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
12598+
if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
1259812599
cat >>confdefs.h <<_ACEOF
12599-
#defineHAVE_X509_GET_SIGNATURE_INFO 1
12600+
#define`$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
1260012601
_ACEOF
1260112602

1260212603
fi

‎configure.ac‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1358,7 +1358,7 @@ if test "$with_ssl" = openssl ; then
13581358
# function was removed.
13591359
AC_CHECK_FUNCS([CRYPTO_lock])
13601360
# Function introduced in OpenSSL 1.1.1.
1361-
AC_CHECK_FUNCS([X509_get_signature_info])
1361+
AC_CHECK_FUNCS([X509_get_signature_info SSL_CTX_set_num_tickets])
13621362
AC_DEFINE([USE_OPENSSL],1,[Define to 1 to build with OpenSSL support. (--with-ssl=openssl)])
13631363
elif test "$with_ssl" != no ; then
13641364
AC_MSG_ERROR([--with-ssl must specify openssl])

‎meson.build‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1362,6 +1362,7 @@ if sslopt in ['auto', 'openssl']
13621362

13631363
# Function introduced in OpenSSL 1.1.1
13641364
['X509_get_signature_info'],
1365+
['SSL_CTX_set_num_tickets'],
13651366
]
13661367

13671368
are_openssl_funcs_complete=true

‎src/backend/libpq/be-secure-openssl.c‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -258,8 +258,20 @@ be_tls_init(bool isServerStart)
258258
}
259259
}
260260

261-
/* disallow SSL session tickets */
261+
/*
262+
* Disallow SSL session tickets. OpenSSL use both stateful and stateless
263+
* tickets for TLSv1.3, and stateless ticket for TLSv1.2. SSL_OP_NO_TICKET
264+
* is available since 0.9.8f but only turns off stateless tickets. In
265+
* order to turn off stateful tickets we need SSL_CTX_set_num_tickets,
266+
* which is available since OpenSSL 1.1.1. LibreSSL 3.5.4 (from OpenBSD
267+
* 7.1) introduced this API for compatibility, but doesn't support session
268+
* tickets at all so it's a no-op there.
269+
*/
270+
#ifdefHAVE_SSL_CTX_SET_NUM_TICKETS
271+
SSL_CTX_set_num_tickets(context,0);
272+
#else
262273
SSL_CTX_set_options(context,SSL_OP_NO_TICKET);
274+
#endif
263275

264276
/* disallow SSL session caching, too */
265277
SSL_CTX_set_session_cache_mode(context,SSL_SESS_CACHE_OFF);

‎src/include/pg_config.h.in‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -510,6 +510,9 @@
510510
/* Define to 1 if you have the `X509_get_signature_info' function. */
511511
#undef HAVE_X509_GET_SIGNATURE_INFO
512512

513+
/* Define to 1 if you have the `SSL_CTX_set_num_tickets' function. */
514+
#undef HAVE_SSL_CTX_SET_NUM_TICKETS
515+
513516
/* Define to 1 if the assembler supports X86_64's POPCNTQ instruction. */
514517
#undef HAVE_X86_64_POPCNTQ
515518

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp