Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit6ccb5ae

Browse files
committed
I was playing around with 7.3.1 and found some more SSL problems. The
first, that I missed when checking over 7.3.1, was that the clientmethod was switched to SSLv23 along with the server. The SSLv23 clientmethod does SSLv2 by default, but can also understand SSLv3. In oursituation the SSLv2 backwords compatibility is really only needed on theserver. This is the first patch.The last thing is that I found a way for the server to understand SSLv2HELLO messages (sent by pre-7.3 clients) but then get them to talkSSLv3. This is the last one.Nathan Mueller
1 parentd31b20a commit6ccb5ae

File tree

2 files changed

+4
-4
lines changed

2 files changed

+4
-4
lines changed

‎src/backend/libpq/be-secure.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
*
1212
*
1313
* IDENTIFICATION
14-
* $Header: /cvsroot/pgsql/src/backend/libpq/be-secure.c,v 1.21 2002/12/23 22:19:00 momjian Exp $
14+
* $Header: /cvsroot/pgsql/src/backend/libpq/be-secure.c,v 1.22 2003/01/08 22:56:58 momjian Exp $
1515
*
1616
* Since the server static private key ($DataDir/server.key)
1717
* will normally be stored unencrypted so that the database
@@ -637,7 +637,7 @@ initialize_SSL(void)
637637

638638
/* set up empheral DH keys */
639639
SSL_CTX_set_tmp_dh_callback(SSL_context,tmp_dh_cb);
640-
SSL_CTX_set_options(SSL_context,SSL_OP_SINGLE_DH_USE);
640+
SSL_CTX_set_options(SSL_context,SSL_OP_SINGLE_DH_USE |SSL_OP_NO_SSLv2);
641641

642642
/* accept client certificates, but don't require them. */
643643
snprintf(fnbuf,sizeoffnbuf,"%s/root.crt",DataDir);

‎src/interfaces/libpq/fe-secure.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
*
1212
*
1313
* IDENTIFICATION
14-
* $Header: /cvsroot/pgsql/src/interfaces/libpq/fe-secure.c,v 1.18 2002/12/18 13:15:15 pgsql Exp $
14+
* $Header: /cvsroot/pgsql/src/interfaces/libpq/fe-secure.c,v 1.19 2003/01/08 22:56:58 momjian Exp $
1515
*
1616
* NOTES
1717
* The client *requires* a valid server certificate. Since
@@ -714,7 +714,7 @@ initialize_SSL(PGconn *conn)
714714
{
715715
SSL_library_init();
716716
SSL_load_error_strings();
717-
SSL_context=SSL_CTX_new(SSLv23_method());
717+
SSL_context=SSL_CTX_new(TLSv1_method());
718718
if (!SSL_context)
719719
{
720720
printfPQExpBuffer(&conn->errorMessage,

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp