database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-06-27 23:21:58 +03:00
Code Activity

Back-patch addition of ssl_renegotiation_limit into 7.4 through 8.1.

Browse Source
This commit is contained in:
Tom Lane
2010-02-25 23:44:27 +00:00
parent 26662b73ae
commit a3609304b7
4 changed files with 45 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
doc/src/sgml/config.sgml
View File

@ -1,5 +1,5 @@
<!--
$PostgreSQL: pgsql/doc/src/sgml/config.sgml,v 1.36.2.8 2007/04/20 02:38:04 tgl Exp $
$PostgreSQL: pgsql/doc/src/sgml/config.sgml,v 1.36.2.9 2010/02/25 23:44:27 tgl Exp $
-->
<chapter Id="runtime-config">
<title>Server Configuration</title>
@ -538,6 +538,32 @@ SET ENABLE_SEQSCAN TO OFF;
</listitem>
</varlistentry>
<varlistentry id="guc-ssl-renegotiation-limit" xreflabel="ssl_renegotiation_limit">
<term><varname>ssl_renegotiation_limit</varname> (<type>int</type>)</term>
<indexterm>
<primary><varname>ssl_renegotiation_limit</> configuration parameter</primary>
</indexterm>
<listitem>
<para>
Specifies how much data can flow over an <acronym>SSL</> encrypted connection
before renegotiation of the session will take place. Renegotiation of the
session decreases the chance of doing cryptanalysis when large amounts of data
are sent, but it also carries a large performance penalty. The sum of
sent and received traffic is used to check the limit. If the parameter is
set to 0, renegotiation is disabled. The default is <literal>512MB</>.
</para>
<note>
<para>
SSL libraries from before November 2009 are insecure when using SSL
renegotiation, due to a vulnerability in the SSL protocol. As a stop-gap fix
for this vulnerability, some vendors also shipped SSL libraries incapable
of doing renegotiation. If any of these libraries are in use on the client
or server, SSL renegotiation should be disabled.
</para>
</note>
</listitem>
</varlistentry>
<varlistentry id="guc-password-encryption" xreflabel="password_encryption">
<term><varname>password_encryption</varname> (<type>boolean</type>)</term>
<indexterm>