database/postgres
database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-05-09 18:21:05 +03:00
Code

Support disallowing SSL renegotiation when using LibreSSL

Browse Source 
LibreSSL doesn't support the SSL_OP_NO_RENEGOTIATION macro which is
used by OpenSSL, instead it has invented a similar one for client-
side renegotiation: SSL_OP_NO_CLIENT_RENEGOTIATION. This has been
supported since LibreSSL 2.5.1 which by now can be considered well
below the minimum requirement.

Reviewed-by: Peter Eisentraut <peter@eisentraut.org>
Reviewed-by: Michael Paquier <michael@paquier.xyz>
Discussion: https://postgr.es/m/eac70d46-e61c-4d71-a1e1-78e2bfa19485@eisentraut.org
This commit is contained in:
Daniel Gustafsson 2024-04-24 10:54:42 +02:00
parent 91d6429fad
commit 44e27f0a6d
1 changed files with 10 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
src/backend/libpq/be-secure-openssl.c
View File

@ -267,15 +267,20 @@ be_tls_init(bool isServerStart)
/* disallow SSL compression */ /* disallow SSL compression */
SSL_CTX_set_options(context, SSL_OP_NO_COMPRESSION); SSL_CTX_set_options(context, SSL_OP_NO_COMPRESSION);
#ifdef SSL_OP_NO_RENEGOTIATION
/* /*
* Disallow SSL renegotiation, option available since 1.1.0h. This * Disallow SSL renegotiation. This concerns only TLSv1.2 and older
* concerns only TLSv1.2 and older protocol versions, as TLSv1.3 has no * protocol versions, as TLSv1.3 has no support for renegotiation.
* support for renegotiation. * SSL_OP_NO_RENEGOTIATION is available in OpenSSL since 1.1.0h (via a
* backport from 1.1.1). SSL_OP_NO_CLIENT_RENEGOTIATION is available in
* LibreSSL since 2.5.1 disallowing all client-initiated renegotiation
* (this is usually on by default).
*/ */
#ifdef SSL_OP_NO_RENEGOTIATION
SSL_CTX_set_options(context, SSL_OP_NO_RENEGOTIATION); SSL_CTX_set_options(context, SSL_OP_NO_RENEGOTIATION);
#endif #endif
#ifdef SSL_OP_NO_CLIENT_RENEGOTIATION
SSL_CTX_set_options(context, SSL_OP_NO_CLIENT_RENEGOTIATION);
#endif
/* set up ephemeral DH and ECDH keys */ /* set up ephemeral DH and ECDH keys */
if (!initialize_dh(context, isServerStart)) if (!initialize_dh(context, isServerStart))