>From 768dd6560e262d7597d0efb37043a96e1594508e Mon Sep 17 00:00:00 2001 From: Andres Freund Date: Tue, 28 Jul 2015 18:41:32 +0200 Subject: [PATCH] Disable ssl renegotiation by default. While postgres' use of SSL renegotiation is a good idea in theory, it turned out to not work well in practice. The specification and openssl's implementation of it have lead to several security issues. Postgres' use of renegotiation also had its share of bugs. Additionally OpenSSL has a bunch of bugs around renegotiation, reported and open for years, that regularly lead to connections breaking with obscure error messages. We tried increasingly complex workarounds around these bugs, but we didn't find anything complete. Since these connection breakages often lead to hard to debug problems, e.g. spuriously failing base backups and significant latency spikes when synchronous replication is used, we have decided to change the default setting for ssl renegotiation to 0 (disabled) in the released backbranches and remove it entirely in 9.5 and master.. Author: Michael Paquier, with changes by me Discussion: 20150624144148.GQ4797@alap3.anarazel.de Backpatch: 9.0-9.4; 9.5 and master get a different patch --- doc/src/sgml/config.sgml | 10 +++++++++- src/backend/utils/misc/guc.c | 2 +- src/backend/utils/misc/postgresql.conf.sample | 2 +- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml index c669f75..871b04a 100644 --- a/doc/src/sgml/config.sgml +++ b/doc/src/sgml/config.sgml @@ -1040,7 +1040,7 @@ include_dir 'conf.d' cryptanalysis when large amounts of traffic can be examined, but it also carries a large performance penalty. The sum of sent and received traffic is used to check the limit. If this parameter is set to 0, - renegotiation is disabled. The default is 512MB. + renegotiation is disabled. The default is 0. @@ -1052,6 +1052,14 @@ include_dir 'conf.d' disabled. + + + + Due to bugs in OpenSSL enabling ssl renegotiation, by + configuring a non-zero ssl_renegotiation_limit, is likely + to lead to problems like long-lived connections breaking. + + diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c index 6ad0892..396c68b 100644 --- a/src/backend/utils/misc/guc.c +++ b/src/backend/utils/misc/guc.c @@ -2457,7 +2457,7 @@ static struct config_int ConfigureNamesInt[] = GUC_UNIT_KB, }, &ssl_renegotiation_limit, - 512 * 1024, 0, MAX_KILOBYTES, + 0, 0, MAX_KILOBYTES, NULL, NULL, NULL }, diff --git a/src/backend/utils/misc/postgresql.conf.sample b/src/backend/utils/misc/postgresql.conf.sample index 8dfd485..3845d57 100644 --- a/src/backend/utils/misc/postgresql.conf.sample +++ b/src/backend/utils/misc/postgresql.conf.sample @@ -83,7 +83,7 @@ # (change requires restart) #ssl_prefer_server_ciphers = on # (change requires restart) #ssl_ecdh_curve = 'prime256v1' # (change requires restart) -#ssl_renegotiation_limit = 512MB # amount of data between renegotiations +#ssl_renegotiation_limit = 0 # amount of data between renegotiations #ssl_cert_file = 'server.crt' # (change requires restart) #ssl_key_file = 'server.key' # (change requires restart) #ssl_ca_file = '' # (change requires restart) -- 2.4.0.rc2.1.g3d6bc9a