| From: | Marko Kreen <markokr(at)gmail(dot)com> |
|---|---|
| To: | Noah Misch <noah(at)leadboat(dot)com>, Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> |
| Cc: | Postgres Hackers <pgsql-hackers(at)postgresql(dot)org> |
| Subject: | Re: pgcrypto seeding problem when ssl=on |
| Date: | 2013-01-13 21:50:10 |
| Message-ID: | CACMqXC+ioKc7o96=mHb8+jBK1iqoupGz14H2D3rkKcOXfrUmkQ@mail.gmail.com |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
On Fri, Dec 21, 2012 at 10:27 PM, Noah Misch <noah(at)leadboat(dot)com> wrote:
> How about instead calling RAND_cleanup() after each backend fork?
Attached is a patch that adds RAND_cleanup() to fork_process().
That way all forked processes start with fresh state. This should
make sure the problem does not happen in any processes
forked by postmaster.
Please backpatch.
...
Alternative is to put RAND_cleanup() to BackendInitialize() so only
new backends start with fresh state.
Another alternative is to put RAND_cleanup() after SSL_accept(),
that way core code sees no change, but other OpenSSL users
in backend operate securely.
--
marko
| Attachment | Content-Type | Size |
|---|---|---|
| rand_cleanup.diff | application/octet-stream | 637 bytes |
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Tom Lane | 2013-01-13 22:46:12 | Re: pgcrypto seeding problem when ssl=on |
| Previous Message | Tom Lane | 2013-01-13 21:43:28 | Re: count(*) of zero rows returns 1 |