1berry/postgres
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix regression in TLS session ticket disabling

Browse Source 
Commit 274bbced disabled session tickets for TLSv1.3 on top of the
already disabled TLSv1.2 session tickets, but accidentally caused
a regression where TLSv1.2 session tickets were incorrectly sent.
Fix by unconditionally disabling TLSv1.2 session tickets and only
disable TLSv1.3 tickets when the right version of OpenSSL is used.

Backpatch to all supported branches.

Reported-by: Cameron Vogt <cvogt@automaticcontrols.net>
Reported-by: Fire Emerald <fire.github@gmail.com>
Reviewed-by: Jacob Champion <jacob.champion@enterprisedb.com>
Discussion: https://postgr.es/m/DM6PR16MB3145CF62857226F350C710D1AB852@DM6PR16MB3145.namprd16.prod.outlook.com
Backpatch-through: v12
This commit is contained in:
Daniel Gustafsson 2024-08-19 12:55:11 +02:00
parent f18d3e47f0
commit cd98a142cb
1 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/backend/libpq/be-secure-openssl.c
View File

@ -236,10 +236,9 @@ be_tls_init(bool isServerStart)
*/ */
#ifdef HAVE_SSL_CTX_SET_NUM_TICKETS #ifdef HAVE_SSL_CTX_SET_NUM_TICKETS
SSL_CTX_set_num_tickets(context, 0); SSL_CTX_set_num_tickets(context, 0);
#else #endif
#ifdef SSL_OP_NO_TICKET /* added in OpenSSL 0.9.8f */ #ifdef SSL_OP_NO_TICKET /* added in OpenSSL 0.9.8f */
SSL_CTX_set_options(context, SSL_OP_NO_TICKET); SSL_CTX_set_options(context, SSL_OP_NO_TICKET);
#endif
#endif #endif
/* disallow SSL session caching, too */ /* disallow SSL session caching, too */