Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitab60847

Browse files
committed
Disable ssl renegotiation by default.
While postgres' use of SSL renegotiation is a good idea in theory, itturned out to not work well in practice. The specification and openssl'simplementation of it have lead to several security issues. Postgres' useof renegotiation also had its share of bugs.Additionally OpenSSL has a bunch of bugs around renegotiation, reportedand open for years, that regularly lead to connections breaking withobscure error messages. We tried increasingly complex workarounds to getaround these bugs, but we didn't find anything complete.Since these connection breakages often lead to hard to debug problems,e.g. spuriously failing base backups and significant latency spikes whensynchronous replication is used, we have decided to change the defaultsetting for ssl renegotiation to 0 (disabled) in the releasedbackbranches and remove it entirely in 9.5 and master..Author: Michael Paquier, with changes by meDiscussion: 20150624144148.GQ4797@alap3.anarazel.deBackpatch: 9.0-9.4; 9.5 and master get a different patch
1 parent450bf0b commitab60847

File tree

3 files changed

+11
-3
lines changed

3 files changed

+11
-3
lines changed

‎doc/src/sgml/config.sgml

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1040,7 +1040,7 @@ include_dir 'conf.d'
10401040
cryptanalysis when large amounts of traffic can be examined, but it
10411041
also carries a large performance penalty. The sum of sent and received
10421042
traffic is used to check the limit. If this parameter is set to 0,
1043-
renegotiation is disabled. The default is <literal>512MB</>.
1043+
renegotiation is disabled. The default is <literal>0</>.
10441044
</para>
10451045
<note>
10461046
<para>
@@ -1052,6 +1052,14 @@ include_dir 'conf.d'
10521052
disabled.
10531053
</para>
10541054
</note>
1055+
1056+
<warning>
1057+
<para>
1058+
Due to bugs in <productname>OpenSSL</> enabling ssl renegotiation, by
1059+
configuring a non-zero <varname>ssl_renegotiation_limit</>, is likely
1060+
to lead to problems like long-lived connections breaking.
1061+
</para>
1062+
</warning>
10551063
</listitem>
10561064
</varlistentry>
10571065

‎src/backend/utils/misc/guc.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2457,7 +2457,7 @@ static struct config_int ConfigureNamesInt[] =
24572457
GUC_UNIT_KB,
24582458
},
24592459
&ssl_renegotiation_limit,
2460-
512*1024,0,MAX_KILOBYTES,
2460+
0,0,MAX_KILOBYTES,
24612461
NULL,NULL,NULL
24622462
},
24632463

‎src/backend/utils/misc/postgresql.conf.sample

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@
8383
# (change requires restart)
8484
#ssl_prefer_server_ciphers = on# (change requires restart)
8585
#ssl_ecdh_curve = 'prime256v1'# (change requires restart)
86-
#ssl_renegotiation_limit =512MB# amount of data between renegotiations
86+
#ssl_renegotiation_limit =0# amount of data between renegotiations
8787
#ssl_cert_file = 'server.crt'# (change requires restart)
8888
#ssl_key_file = 'server.key'# (change requires restart)
8989
#ssl_ca_file = ''# (change requires restart)

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp