rdelaage
/
postgresql
mirror of https://git.postgresql.org/git/postgresql.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Support disallowing SSL renegotiation when using LibreSSL 

LibreSSL doesn't support the SSL_OP_NO_RENEGOTIATION macro which is
used by OpenSSL, instead it has invented a similar one for client-
side renegotiation: SSL_OP_NO_CLIENT_RENEGOTIATION. This has been
supported since LibreSSL 2.5.1 which by now can be considered well
below the minimum requirement.

Reviewed-by: Peter Eisentraut <peter@eisentraut.org>
Reviewed-by: Michael Paquier <michael@paquier.xyz>
Discussion: https://postgr.es/m/eac70d46-e61c-4d71-a1e1-78e2bfa19485@eisentraut.org
This commit is contained in:
Daniel Gustafsson 2024-04-24 10:54:42 +02:00
parent 91d6429fad
commit 44e27f0a6d
1 changed files with 10 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/backend/libpq/be-secure-openssl.c
View File

@ -267,15 +267,20 @@ be_tls_init(bool isServerStart)
/* disallow SSL compression */
SSL_CTX_set_options(context, SSL_OP_NO_COMPRESSION);
#ifdef SSL_OP_NO_RENEGOTIATION
/*
* Disallow SSL renegotiation, option available since 1.1.0h. This
* concerns only TLSv1.2 and older protocol versions, as TLSv1.3 has no
* support for renegotiation.
* Disallow SSL renegotiation. This concerns only TLSv1.2 and older
* protocol versions, as TLSv1.3 has no support for renegotiation.
* SSL_OP_NO_RENEGOTIATION is available in OpenSSL since 1.1.0h (via a
* backport from 1.1.1). SSL_OP_NO_CLIENT_RENEGOTIATION is available in
* LibreSSL since 2.5.1 disallowing all client-initiated renegotiation
* (this is usually on by default).
*/
#ifdef SSL_OP_NO_RENEGOTIATION
SSL_CTX_set_options(context, SSL_OP_NO_RENEGOTIATION);
#endif
#ifdef SSL_OP_NO_CLIENT_RENEGOTIATION
SSL_CTX_set_options(context, SSL_OP_NO_CLIENT_RENEGOTIATION);
#endif
/* set up ephemeral DH and ECDH keys */
if (!initialize_dh(context, isServerStart))