postgres.git / summary / log / commit / refs

commit    dda04b9dd1bdfcda2edc180b0eb346988f3497da
Author:   Tom Lane <tgl@sss.pgh.pa.us>
Date:     Fri Aug 04 15:07:10 2017 +0000

    Disallow SSL session tickets.
    
    We don't actually support session tickets, since we do not create an SSL
    session identifier.  But it seems that OpenSSL will issue a session ticket
    on-demand anyway, which will then fail when used.  This results in
    reconnection failures when using ticket-aware client-side SSL libraries
    (such as the Npgsql .NET driver), as reported by Shay Rojansky.
    
    To fix, just tell OpenSSL not to issue tickets.  At some point in the
    far future, we might consider enabling tickets instead.  But the security
    implications of that aren't entirely clear; and besides it would have
    little benefit except for very short-lived database connections, which is
    Something We're Bad At anyhow.  It would take a lot of other work to get
    to a point where that would really be an exciting thing to do.
    
    While at it, also tell OpenSSL not to use a session cache.  This doesn't
    really do anything, since a backend would never populate the cache anyway,
    but it might gain some micro-efficiencies and/or reduce security
    exposures.
    
    Patch by me, per discussion with Heikki Linnakangas and Shay Rojansky.
    Back-patch to all supported versions.
    
    Discussion: https://postgr.es/m/CADT4RqBU8N-csyZuzaook-c795dt22Zcwg1aHWB6tfVdAkodZA@mail.gmail.com


 src/backend/libpq/be-secure.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/backend/libpq/be-secure.c b/src/backend/libpq/be-secure.c
index c6573b40e7b..b620ee73a10 100644
--- a/src/backend/libpq/be-secure.c
+++ b/src/backend/libpq/be-secure.c
@@ -935,6 +935,14 @@ initialize_SSL(void)
 	SSL_CTX_set_tmp_dh_callback(SSL_context, tmp_dh_cb);
 	SSL_CTX_set_options(SSL_context, SSL_OP_SINGLE_DH_USE | SSL_OP_NO_SSLv2);
 
+	/* disallow SSL session tickets */
+#ifdef SSL_OP_NO_TICKET			/* added in openssl 0.9.8f */
+	SSL_CTX_set_options(SSL_context, SSL_OP_NO_TICKET);
+#endif
+
+	/* disallow SSL session caching, too */
+	SSL_CTX_set_session_cache_mode(SSL_context, SSL_SESS_CACHE_OFF);
+
 	/* set up the allowed cipher list */
 	if (SSL_CTX_set_cipher_list(SSL_context, SSLCipherSuites) != 1)
 		elog(FATAL, "could not set the cipher list (no valid ciphers available)");


[parent: b7d1bc820e19]