From: | Alvaro Herrera <alvherre(at)2ndquadrant(dot)com> |
---|---|
To: | Pg Hackers <pgsql-hackers(at)postgresql(dot)org> |
Cc: | Sean Chittenden <sean(at)chittenden(dot)org> |
Subject: | Re: SSL renegotiation |
Date: | 2013-07-10 22:34:44 |
Message-ID: | 20130710223444.GF4941@eldon.alvh.no-ip.org |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-committers pgsql-hackers |
I think this block is better written as:
if (ssl_renegotiation_limit && port->count > ssl_renegotiation_limit * 1024L)
{
SSL_set_session_id_context(port->ssl, (void *) &SSL_context,
sizeof(SSL_context));
if (SSL_renegotiate(port->ssl) <= 0)
ereport(COMMERROR,
(errcode(ERRCODE_PROTOCOL_VIOLATION),
errmsg("SSL renegotiation failure in renegotiate")));
else
{
int handshake;
do {
handshake = SSL_do_handshake(port->ssl);
if (handshake <= 0)
ereport(COMMERROR,
(errcode(ERRCODE_PROTOCOL_VIOLATION),
errmsg("SSL renegotiation failure in handshake, retrying")));
} while (handshake <= 0);
if (port->ssl->state != SSL_ST_OK)
ereport(COMMERROR,
(errcode(ERRCODE_PROTOCOL_VIOLATION),
errmsg("SSL failed to send renegotiation request")));
else
port->count = 0;
}
}
In other words, retry the SSL_do_handshake() until it reports OK, but
not more than that; this seems to give better results in my (admittedly
crude) experiments. I am unsure about checking port->ssl->state after
the handshake; it's probably pointless, really.
In any case, the old code was calling SSL_do_handshake() even if
SSL_renegotiate() failed; and it was resetting the port->count even if
the handshake failed. Both of these smell like bugs to me.
--
Álvaro Herrera http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Training & Services
From | Date | Subject | |
---|---|---|---|
Next Message | Sean Chittenden | 2013-07-10 23:58:07 | Re: [SPAM] SSL renegotiation |
Previous Message | Alvaro Herrera | 2013-07-10 21:20:17 | SSL renegotiation |
From | Date | Subject | |
---|---|---|---|
Next Message | Andres Freund | 2013-07-10 22:45:39 | Re: changeset generation v5-01 - Patches & git tree |
Previous Message | Kevin Grittner | 2013-07-10 22:14:58 | Re: changeset generation v5-01 - Patches & git tree |