postgres.git / summary / log / commit / refs

commit    19021d28cdf0e84ebc498382826b936df62f5dba
Author:   Daniel Gustafsson <dgustafsson@postgresql.org>
Date:     Mon Aug 19 10:55:11 2024 +0000
First released in: 18.0, 12.21, 13.17, 14.14, 15.9, 16.5, 17.0

    Fix regression in TLS session ticket disabling
    
    Commit 274bbced disabled session tickets for TLSv1.3 on top of the
    already disabled TLSv1.2 session tickets, but accidentally caused
    a regression where TLSv1.2 session tickets were incorrectly sent.
    Fix by unconditionally disabling TLSv1.2 session tickets and only
    disable TLSv1.3 tickets when the right version of OpenSSL is used.
    
    Backpatch to all supported branches.
    
    Reported-by: Cameron Vogt <cvogt@automaticcontrols.net>
    Reported-by: Fire Emerald <fire.github@gmail.com>
    Reviewed-by: Jacob Champion <jacob.champion@enterprisedb.com>
    Discussion: https://postgr.es/m/DM6PR16MB3145CF62857226F350C710D1AB852@DM6PR16MB3145.namprd16.prod.outlook.com
    Backpatch-through: v12


 src/backend/libpq/be-secure-openssl.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/src/backend/libpq/be-secure-openssl.c b/src/backend/libpq/be-secure-openssl.c
index ace0da9d04e..486a66b0bf1 100644
--- a/src/backend/libpq/be-secure-openssl.c
+++ b/src/backend/libpq/be-secure-openssl.c
@@ -269,9 +269,8 @@ be_tls_init(bool isServerStart)
 	 */
 #ifdef HAVE_SSL_CTX_SET_NUM_TICKETS
 	SSL_CTX_set_num_tickets(context, 0);
-#else
-	SSL_CTX_set_options(context, SSL_OP_NO_TICKET);
 #endif
+	SSL_CTX_set_options(context, SSL_OP_NO_TICKET);
 
 	/* disallow SSL session caching, too */
 	SSL_CTX_set_session_cache_mode(context, SSL_SESS_CACHE_OFF);


[parent: 1cc73d15ea58]