Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commita23c0b0

Browse files
committed
Disallow SSL renegotiation
SSL renegotiation is already disabled as of48d23c7, however this doesnot prevent the server to comply with a client willing to userenegotiation. In the last couple of years, renegotiation had its setof security issues and flaws (like the recentCVE-2021-3449), and itcould be possible to crash the backend with a client attemptingrenegotiation.This commit takes one extra step by disabling renegotiation in thebackend in the same way as SSL compression (f9264d1) or tickets(97d3a0b). OpenSSL 1.1.0h has added an option namedSSL_OP_NO_RENEGOTIATION able to achieve that. In older versionsthere is an option called SSL3_FLAGS_NO_RENEGOTIATE_CIPHERS thatwas undocumented, and could be set within the SSL object created whenthe TLS connection opens, but I have decided not to use it, as it feelstrickier to rely on, and it is not official. Note that this option isnot usable in OpenSSL < 1.1.0h as the internal contents of the *SSLobject are hidden to applications.SSL renegotiation concerns protocols up to TLSv1.2.Per original report from Robert Haas, with a patch based on a suggestionby Andres Freund.Author: Michael PaquierReviewed-by: Daniel GustafssonDiscussion:https://postgr.es/m/YKZBXx7RhU74FlTE@paquier.xyzBackpatch-through: 9.6
1 parent5b4791b commita23c0b0

File tree

1 file changed

+10
-0
lines changed

1 file changed

+10
-0
lines changed

‎src/backend/libpq/be-secure-openssl.c

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -248,6 +248,16 @@ be_tls_init(bool isServerStart)
248248
/* disallow SSL session caching, too */
249249
SSL_CTX_set_session_cache_mode(context,SSL_SESS_CACHE_OFF);
250250

251+
#ifdefSSL_OP_NO_RENEGOTIATION
252+
253+
/*
254+
* Disallow SSL renegotiation, option available since 1.1.0h. This
255+
* concerns only TLSv1.2 and older protocol versions, as TLSv1.3 has no
256+
* support for renegotiation.
257+
*/
258+
SSL_CTX_set_options(context,SSL_OP_NO_RENEGOTIATION);
259+
#endif
260+
251261
/* set up ephemeral DH and ECDH keys */
252262
if (!initialize_dh(context,isServerStart))
253263
gotoerror;

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp