Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit48d23c7

Browse files
committed
Disable ssl renegotiation by default.
While postgres' use of SSL renegotiation is a good idea in theory, itturned out to not work well in practice. The specification and openssl'simplementation of it have lead to several security issues. Postgres' useof renegotiation also had its share of bugs.Additionally OpenSSL has a bunch of bugs around renegotiation, reportedand open for years, that regularly lead to connections breaking withobscure error messages. We tried increasingly complex workarounds to getaround these bugs, but we didn't find anything complete.Since these connection breakages often lead to hard to debug problems,e.g. spuriously failing base backups and significant latency spikes whensynchronous replication is used, we have decided to change the defaultsetting for ssl renegotiation to 0 (disabled) in the releasedbackbranches and remove it entirely in 9.5 and master..Author: Michael Paquier, with changes by meDiscussion: 20150624144148.GQ4797@alap3.anarazel.deBackpatch: 9.0-9.4; 9.5 and master get a different patch
1 parent03d7f3b commit48d23c7

File tree

3 files changed

+11
-3
lines changed

3 files changed

+11
-3
lines changed

‎doc/src/sgml/config.sgml

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -858,7 +858,7 @@ include 'filename'
858858
cryptanalysis when large amounts of traffic can be examined, but it
859859
also carries a large performance penalty. The sum of sent and received
860860
traffic is used to check the limit. If this parameter is set to 0,
861-
renegotiation is disabled. The default is <literal>512MB</>.
861+
renegotiation is disabled. The default is <literal>0</>.
862862
</para>
863863
<note>
864864
<para>
@@ -870,6 +870,14 @@ include 'filename'
870870
disabled.
871871
</para>
872872
</note>
873+
874+
<warning>
875+
<para>
876+
Due to bugs in <productname>OpenSSL</> enabling ssl renegotiation, by
877+
configuring a non-zero <varname>ssl_renegotiation_limit</>, is likely
878+
to lead to problems like long-lived connections breaking.
879+
</para>
880+
</warning>
873881
</listitem>
874882
</varlistentry>
875883

‎src/backend/utils/misc/guc.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2377,7 +2377,7 @@ static struct config_int ConfigureNamesInt[] =
23772377
GUC_UNIT_KB,
23782378
},
23792379
&ssl_renegotiation_limit,
2380-
512*1024,0,MAX_KILOBYTES,
2380+
0,0,MAX_KILOBYTES,
23812381
NULL,NULL,NULL
23822382
},
23832383

‎src/backend/utils/misc/postgresql.conf.sample

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@
8181
#ssl = off# (change requires restart)
8282
#ssl_ciphers = 'DEFAULT:!LOW:!EXP:!MD5:@STRENGTH'# allowed SSL ciphers
8383
# (change requires restart)
84-
#ssl_renegotiation_limit =512MB# amount of data between renegotiations
84+
#ssl_renegotiation_limit =0# amount of data between renegotiations
8585
#ssl_cert_file = 'server.crt'# (change requires restart)
8686
#ssl_key_file = 'server.key'# (change requires restart)
8787
#ssl_ca_file = ''# (change requires restart)

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp