| From: | Heikki Linnakangas <hlinnaka(at)iki(dot)fi> |
|---|---|
| To: | Andres Freund <andres(at)anarazel(dot)de>, Robert Haas <robertmhaas(at)gmail(dot)com> |
| Cc: | Peter Eisentraut <peter_e(at)gmx(dot)net>, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>, "pgsql-hackers(at)postgresql(dot)org" <pgsql-hackers(at)postgresql(dot)org> |
| Subject: | Re: Should we back-patch SSL renegotiation fixes? |
| Date: | 2015-06-25 12:47:22 |
| Message-ID: | 558BF85A.5040206@iki.fi |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
On 06/25/2015 03:03 PM, Andres Freund wrote:
> The situation is this: We have broken code using broken code. I think we
> either got to apply, darn nontrivial, fixes from
> http://archives.postgresql.org/message-id/54DE6FAF.6050005%40vmware.com
> or we got to cripple the options.
>
> It's also not the first breakage, we've applied a lot of bandaids to
> this code already. Our way of doing renegotiation also has broken
> several SSL client implementations...
Note that even with those patches, renegotiation is still broken in some
scenarios:
http://www.postgresql.org/message-id/54DCF736.2060207@vmware.com. As far
as I can tell, OpenSSL's handling of renegotiation is fundamentally
broken, and there is nothing we can do in the application to completely
work around that.
+1 for changing the default to disable renegotiation, in all branches.
- Heikki
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Peter Eisentraut | 2015-06-25 13:15:43 | Re: Should we back-patch SSL renegotiation fixes? |
| Previous Message | Ilya Kosmodemiansky | 2015-06-25 12:40:42 | Re: RFC: replace pg_stat_activity.waiting with something more descriptive |