pgpool2.git / summary / log / commit / refs

commit    93424727fe97013686dabcb291a34d5686bb19e2
Author:   Muhammad Usama <m.usama@gmail.com>
Date:     Mon May 23 15:24:08 2016 +0000

    Permit pgpool to support multiple SSL cipher protocols
    
    Currently TLSv1_method() is used to initialize the SSL context, that puts an
    unnecessary limitation to allow only TLSv1 protocol for SSL communication.
    While postgreSQL supports other ciphers protocols as well. The commit changes
    the above and initializes the SSLSession using the SSLv23_method()
    (same is also used by PostgreSQL). Because it can negotiate the use of the
    highest mutually supported protocol version and remove the limitation of one
    specific protocol version.


 src/utils/pool_ssl.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/src/utils/pool_ssl.c b/src/utils/pool_ssl.c
index 82ba82e55..32f755f1d 100644
--- a/src/utils/pool_ssl.c
+++ b/src/utils/pool_ssl.c
@@ -253,8 +253,18 @@ static int init_ssl_ctx(POOL_CONNECTION *cp, enum ssl_conn_type conntype) {
 	char *cacert = NULL, *cacert_dir = NULL;
 
 	/* initialize SSL members */
-	cp->ssl_ctx = SSL_CTX_new(TLSv1_method());
+#if (OPENSSL_VERSION_NUMBER >= 0x10100000L)
+		cp->ssl_ctx = SSL_CTX_new(TLS_method());
+#else
+		cp->ssl_ctx = SSL_CTX_new(SSLv23_method());
+#endif
+
 	SSL_RETURN_ERROR_IF( (! cp->ssl_ctx), "SSL_CTX_new" );
+	/*
+	 * Disable OpenSSL's moving-write-buffer sanity check, because it
+	 * causes unnecessary failures in nonblocking send cases.
+	 */
+	SSL_CTX_set_mode(cp->ssl_ctx, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
 
 	if ( conntype == ssl_conn_serverclient) {
 		error = SSL_CTX_use_certificate_chain_file(cp->ssl_ctx,


[parent: b8a7454f921a]