Re: Recent vendor SSL renegotiation patches break PostgreSQL

Bruce Momjian <bruce(at)momjian(dot)us> writes:
> Tom Lane wrote:
>> Chris Campbell <chris_campbell(at)mac(dot)com> writes:
>>> Is there a way to detect when the SSL library has renegotiation disabled?
>>
>> Probably not. The current set of emergency security patches would
>> certainly not have exposed any new API that would help us tell this :-(
>>
>> If said patches were done properly they'd have also turned an
>> application-level renegotiation request into a no-op, instead of
>> breaking apps by making it fail --- but apparently they were not done
>> properly.

> Is there anything remaining to do on this issue?

I'm not sure. My impression is that by the time we had anything in the
field, there will be real fixes for the SSL renegotiation problem.
So all we'd be accomplishing is to weaken security for people who have
those fixes, to cater to people who are using copies of openssl they'd
obtained in the past couple of months and then not updated to latest.
However, if anyone thinks that the SSL problem isn't going to get fixed
promptly, maybe it needs more consideration.

regards, tom lane