Re: Recent vendor SSL renegotiation patches break PostgreSQL

From: Bruce Momjian <bruce(at)momjian(dot)us>
To: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
Cc: Chris Campbell <chris_campbell(at)mac(dot)com>, Robert Haas <robertmhaas(at)gmail(dot)com>, pgsql-hackers(at)postgresql(dot)org
Subject: Re: Recent vendor SSL renegotiation patches break PostgreSQL
Date: 2010-02-03 17:07:09
Message-ID: 201002031707.o13H7A115232@momjian.us
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

Tom Lane wrote:
> Chris Campbell <chris_campbell(at)mac(dot)com> writes:
> > Is there a way to detect when the SSL library has renegotiation disabled?
>
> Probably not. The current set of emergency security patches would
> certainly not have exposed any new API that would help us tell this :-(
>
> If said patches were done properly they'd have also turned an
> application-level renegotiation request into a no-op, instead of
> breaking apps by making it fail --- but apparently they were not done
> properly.

Yea, and also keep in mind any SSL library checks need to be done at
run-time (because I believe openssl is usually linked as a shared
object), which even further limits our options.

--
Bruce Momjian <bruce(at)momjian(dot)us> http://momjian.us
EnterpriseDB http://enterprisedb.com

+ If your life is a hard drive, Christ can be your backup. +

In response to

Browse pgsql-hackers by date

  From Date Subject
Next Message Simon Riggs 2010-02-03 17:10:11 Re: Hot Standby and VACUUM FULL
Previous Message Bruce Momjian 2010-02-03 17:05:30 Re: Hot Standby and VACUUM FULL