Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitdda04b9

Browse files
committed
Disallow SSL session tickets.
We don't actually support session tickets, since we do not create an SSLsession identifier. But it seems that OpenSSL will issue a session ticketon-demand anyway, which will then fail when used. This results inreconnection failures when using ticket-aware client-side SSL libraries(such as the Npgsql .NET driver), as reported by Shay Rojansky.To fix, just tell OpenSSL not to issue tickets. At some point in thefar future, we might consider enabling tickets instead. But the securityimplications of that aren't entirely clear; and besides it would havelittle benefit except for very short-lived database connections, which isSomething We're Bad At anyhow. It would take a lot of other work to getto a point where that would really be an exciting thing to do.While at it, also tell OpenSSL not to use a session cache. This doesn'treally do anything, since a backend would never populate the cache anyway,but it might gain some micro-efficiencies and/or reduce securityexposures.Patch by me, per discussion with Heikki Linnakangas and Shay Rojansky.Back-patch to all supported versions.Discussion:https://postgr.es/m/CADT4RqBU8N-csyZuzaook-c795dt22Zcwg1aHWB6tfVdAkodZA@mail.gmail.com
1 parentb7d1bc8 commitdda04b9

File tree

1 file changed

+8
-0
lines changed

1 file changed

+8
-0
lines changed

‎src/backend/libpq/be-secure.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -935,6 +935,14 @@ initialize_SSL(void)
935935
SSL_CTX_set_tmp_dh_callback(SSL_context,tmp_dh_cb);
936936
SSL_CTX_set_options(SSL_context,SSL_OP_SINGLE_DH_USE |SSL_OP_NO_SSLv2);
937937

938+
/* disallow SSL session tickets */
939+
#ifdefSSL_OP_NO_TICKET/* added in openssl 0.9.8f */
940+
SSL_CTX_set_options(SSL_context,SSL_OP_NO_TICKET);
941+
#endif
942+
943+
/* disallow SSL session caching, too */
944+
SSL_CTX_set_session_cache_mode(SSL_context,SSL_SESS_CACHE_OFF);
945+
938946
/* set up the allowed cipher list */
939947
if (SSL_CTX_set_cipher_list(SSL_context,SSLCipherSuites)!=1)
940948
elog(FATAL,"could not set the cipher list (no valid ciphers available)");

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp