Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitb798ea8

Browse files
committed
Disallow SSL session tickets.
We don't actually support session tickets, since we do not create an SSLsession identifier. But it seems that OpenSSL will issue a session ticketon-demand anyway, which will then fail when used. This results inreconnection failures when using ticket-aware client-side SSL libraries(such as the Npgsql .NET driver), as reported by Shay Rojansky.To fix, just tell OpenSSL not to issue tickets. At some point in thefar future, we might consider enabling tickets instead. But the securityimplications of that aren't entirely clear; and besides it would havelittle benefit except for very short-lived database connections, which isSomething We're Bad At anyhow. It would take a lot of other work to getto a point where that would really be an exciting thing to do.While at it, also tell OpenSSL not to use a session cache. This doesn'treally do anything, since a backend would never populate the cache anyway,but it might gain some micro-efficiencies and/or reduce securityexposures.Patch by me, per discussion with Heikki Linnakangas and Shay Rojansky.Back-patch to all supported versions.Discussion:https://postgr.es/m/CADT4RqBU8N-csyZuzaook-c795dt22Zcwg1aHWB6tfVdAkodZA@mail.gmail.com
1 parentdf04db0 commitb798ea8

File tree

1 file changed

+8
-0
lines changed

1 file changed

+8
-0
lines changed

‎src/backend/libpq/be-secure-openssl.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -270,6 +270,14 @@ be_tls_init(void)
270270
SSL_OP_SINGLE_DH_USE |
271271
SSL_OP_NO_SSLv2 |SSL_OP_NO_SSLv3);
272272

273+
/* disallow SSL session tickets */
274+
#ifdefSSL_OP_NO_TICKET/* added in openssl 0.9.8f */
275+
SSL_CTX_set_options(SSL_context,SSL_OP_NO_TICKET);
276+
#endif
277+
278+
/* disallow SSL session caching, too */
279+
SSL_CTX_set_session_cache_mode(SSL_context,SSL_SESS_CACHE_OFF);
280+
273281
/* set up ephemeral ECDH keys */
274282
initialize_ecdh();
275283

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp