pgpool2.git / summary / log / commit / refs
commit 56cfadecb0ab421e66e412b8895f9656bfafe42d
Author: Muhammad Usama <m.usama@highgo.ca>
Commit: Muhammad Usama <m.usama@gmail.com>
Date: Tue May 05 19:30:33 2020 +0000
Fix: 0000608: pgpool ssl front end accept all ciphers. not working as expected.
SSL cipher_list needed to be set for server-side SSL context
instead for the client-side context.
src/utils/pool_ssl.c | 19 ++++++++-----------
1 file changed, 8 insertions(+), 11 deletions(-)
diff --git a/src/utils/pool_ssl.c b/src/utils/pool_ssl.c
index 0e62282d8..3792b8535 100644
--- a/src/utils/pool_ssl.c
+++ b/src/utils/pool_ssl.c
@@ -317,14 +317,6 @@ init_ssl_ctx(POOL_CONNECTION * cp, enum ssl_conn_type conntype)
*/
SSL_CTX_set_mode(cp->ssl_ctx, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
- /* set up the allowed cipher list */
- error = SSL_CTX_set_cipher_list(cp->ssl_ctx, pool_config->ssl_ciphers);
- SSL_RETURN_ERROR_IF((error != 1), "Setting allowed cipher list");
-
- /* Let server choose order */
- if (pool_config->ssl_prefer_server_ciphers)
- SSL_CTX_set_options(cp->ssl_ctx, SSL_OP_CIPHER_SERVER_PREFERENCE);
-
if (conntype == ssl_conn_serverclient)
{
/* between frontend and pgpool */
@@ -522,9 +514,6 @@ verify_cb(int ok, X509_STORE_CTX *ctx)
/*
* Initialize global SSL context.
*
- * If isServerStart is true, report any errors as FATAL (so we don't return).
- * Otherwise, log errors at LOG level and return -1 to indicate trouble,
- * preserving the old SSL state if any. Returns 0 if OK.
*/
int
SSL_ServerSide_init(void)
@@ -675,6 +664,14 @@ SSL_ServerSide_init(void)
if (!initialize_ecdh(context))
goto error;
+ /* set up the allowed cipher list */
+ if (SSL_CTX_set_cipher_list(context, pool_config->ssl_ciphers) != 1)
+ goto error;
+
+ /* Let server choose order */
+ if (pool_config->ssl_prefer_server_ciphers)
+ SSL_CTX_set_options(context, SSL_OP_CIPHER_SERVER_PREFERENCE);
+
/*
* Load CA store, so we can verify client certificates if needed.
*/
[parent: 87e6e11c1931]