postgres.git / summary / log / commit / refs

commit    a5b0d95744cf27f8b68dce3eb0415c0d3a0e949b
Author:   Tom Lane <tgl@sss.pgh.pa.us>
Date:     Sun Jul 24 19:18:16 2011 +0000
First released in: 9.2.0, 8.2.22, 8.3.16, 8.4.9, 9.0.5, 9.1.0

    Use OpenSSL's SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER flag.
    
    This disables an entirely unnecessary "sanity check" that causes failures
    in nonblocking mode, because OpenSSL complains if we move or compact the
    write buffer.  The only actual requirement is that we not modify pending
    data once we've attempted to send it, which we don't.  Per testing and
    research by Martin Pihlak, though this fix is a lot simpler than his patch.
    
    I put the same change into the backend, although it's less clear whether
    it's necessary there.  We do use nonblock mode in some situations in
    streaming replication, so seems best to keep the same behavior in the
    backend as in libpq.
    
    Back-patch to all supported releases.


 src/backend/libpq/be-secure.c    | 6 ++++++
 src/interfaces/libpq/fe-secure.c | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/src/backend/libpq/be-secure.c b/src/backend/libpq/be-secure.c
index 3612f5be0e4..3a936852855 100644
--- a/src/backend/libpq/be-secure.c
+++ b/src/backend/libpq/be-secure.c
@@ -718,6 +718,12 @@ initialize_SSL(void)
 					(errmsg("could not create SSL context: %s",
 							SSLerrmessage())));
 
+		/*
+		 * Disable OpenSSL's moving-write-buffer sanity check, because it
+		 * causes unnecessary failures in nonblocking send cases.
+		 */
+		SSL_CTX_set_mode(SSL_context, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
+
 		/*
 		 * Load and verify certificate and private key
 		 */
diff --git a/src/interfaces/libpq/fe-secure.c b/src/interfaces/libpq/fe-secure.c
index 0cd0197a25a..ed49735902e 100644
--- a/src/interfaces/libpq/fe-secure.c
+++ b/src/interfaces/libpq/fe-secure.c
@@ -757,6 +757,12 @@ init_ssl_system(PGconn *conn)
 #endif
 			return -1;
 		}
+
+		/*
+		 * Disable OpenSSL's moving-write-buffer sanity check, because it
+		 * causes unnecessary failures in nonblocking send cases.
+		 */
+		SSL_CTX_set_mode(SSL_context, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
 	}
 #ifdef ENABLE_THREAD_SAFETY
 	pthread_mutex_unlock(&init_mutex);


[parent: 18e52ae1722b]