Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit97d3a0b

Browse files
committed
Disallow SSL session tickets.
We don't actually support session tickets, since we do not create an SSLsession identifier. But it seems that OpenSSL will issue a session ticketon-demand anyway, which will then fail when used. This results inreconnection failures when using ticket-aware client-side SSL libraries(such as the Npgsql .NET driver), as reported by Shay Rojansky.To fix, just tell OpenSSL not to issue tickets. At some point in thefar future, we might consider enabling tickets instead. But the securityimplications of that aren't entirely clear; and besides it would havelittle benefit except for very short-lived database connections, which isSomething We're Bad At anyhow. It would take a lot of other work to getto a point where that would really be an exciting thing to do.While at it, also tell OpenSSL not to use a session cache. This doesn'treally do anything, since a backend would never populate the cache anyway,but it might gain some micro-efficiencies and/or reduce securityexposures.Patch by me, per discussion with Heikki Linnakangas and Shay Rojansky.Back-patch to all supported versions.Discussion:https://postgr.es/m/CADT4RqBU8N-csyZuzaook-c795dt22Zcwg1aHWB6tfVdAkodZA@mail.gmail.com
1 parentb374481 commit97d3a0b

File tree

1 file changed

+8
-0
lines changed

1 file changed

+8
-0
lines changed

‎src/backend/libpq/be-secure-openssl.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -288,6 +288,14 @@ be_tls_init(bool isServerStart)
288288
/* disallow SSL v2/v3 */
289289
SSL_CTX_set_options(context,SSL_OP_NO_SSLv2 |SSL_OP_NO_SSLv3);
290290

291+
/* disallow SSL session tickets */
292+
#ifdefSSL_OP_NO_TICKET/* added in openssl 0.9.8f */
293+
SSL_CTX_set_options(context,SSL_OP_NO_TICKET);
294+
#endif
295+
296+
/* disallow SSL session caching, too */
297+
SSL_CTX_set_session_cache_mode(context,SSL_SESS_CACHE_OFF);
298+
291299
/* set up ephemeral DH and ECDH keys */
292300
if (!initialize_dh(context,isServerStart))
293301
gotoerror;

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp