NotificationsYou must be signed in to change notification settings
Fork28
Star151

Commitf352f91

committed

Remove duplicate setting of SSL_OP_SINGLE_DH_USE option.

Commitc0a15e0 moved the setting of OpenSSL's SSL_OP_SINGLE_DH_USE optioninto a new subroutine initialize_dh(), but forgot to remove it from whereit was. SSL_CTX_set_options() is a trivial function, amounting indeed tojust "ctx->options |= op", hence there's no reason to contort the code orbreak separation of concerns to avoid calling it twice. So separating theDH setup from disabling of old protocol versions is a good change, but weneed to finish the job.Noted while poking into the question of SSL session tickets.

1 parent41cefbb commitf352f91Copy full SHA for f352f91

File tree

1 file changed

-3

lines changed

src/backend/libpq
- be-secure-openssl.c

1 file changed

-3

lines changed

`‎src/backend/libpq/be-secure-openssl.c`

Lines changed: 1 addition & 3 deletions

Original file line number	Diff line number	Diff line change
`@@ -286,9 +286,7 @@ be_tls_init(bool isServerStart)`
`286`	`286`	`}`
`287`	`287`
`288`	`288`	`/* disallow SSL v2/v3 */`
`289`		`-SSL_CTX_set_options(context,`
`290`		`-SSL_OP_SINGLE_DH_USE \|`
`291`		`-SSL_OP_NO_SSLv2 \|SSL_OP_NO_SSLv3);`
	`289`	`+SSL_CTX_set_options(context,SSL_OP_NO_SSLv2 \|SSL_OP_NO_SSLv3);`
`292`	`290`
`293`	`291`	`/* set up ephemeral DH and ECDH keys */`
`294`	`292`	`if (!initialize_dh(context,isServerStart))`

0 commit comments

Comments

(0)

Movatterモバイル変換

Navigation Menu

Search code, repositories, users, issues, pull requests...

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Commitf352f91

File tree

1 file changed

1 file changed

`‎src/backend/libpq/be-secure-openssl.c`

0 commit comments