diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/backend/libpq/be-secure-openssl.c | 16 | ||||
| -rw-r--r-- | src/include/pg_config.h.in | 3 |
2 files changed, 17 insertions, 2 deletions
diff --git a/src/backend/libpq/be-secure-openssl.c b/src/backend/libpq/be-secure-openssl.c index e19f4f0981c..378e06b4d6e 100644 --- a/src/backend/libpq/be-secure-openssl.c +++ b/src/backend/libpq/be-secure-openssl.c @@ -225,10 +225,22 @@ be_tls_init(bool isServerStart) } } - /* disallow SSL session tickets */ -#ifdef SSL_OP_NO_TICKET /* added in OpenSSL 0.9.8f */ + /* + * Disallow SSL session tickets. OpenSSL use both stateful and stateless + * tickets for TLSv1.3, and stateless ticket for TLSv1.2. SSL_OP_NO_TICKET + * is available since 0.9.8f but only turns off stateless tickets. In + * order to turn off stateful tickets we need SSL_CTX_set_num_tickets, + * which is available since OpenSSL 1.1.1. LibreSSL 3.5.4 (from OpenBSD + * 7.1) introduced this API for compatibility, but doesn't support session + * tickets at all so it's a no-op there. + */ +#ifdef HAVE_SSL_CTX_SET_NUM_TICKETS + SSL_CTX_set_num_tickets(context, 0); +#else +#ifdef SSL_OP_NO_TICKET /* added in OpenSSL 0.9.8f */ SSL_CTX_set_options(context, SSL_OP_NO_TICKET); #endif +#endif /* disallow SSL session caching, too */ SSL_CTX_set_session_cache_mode(context, SSL_SESS_CACHE_OFF); diff --git a/src/include/pg_config.h.in b/src/include/pg_config.h.in index 1e9d21c3e47..e7f6fe164a1 100644 --- a/src/include/pg_config.h.in +++ b/src/include/pg_config.h.in @@ -736,6 +736,9 @@ /* Define to 1 if you have the `X509_get_signature_nid' function. */ #undef HAVE_X509_GET_SIGNATURE_NID +/* Define to 1 if you have the `SSL_CTX_set_num_tickets' function. */ +#undef HAVE_SSL_CTX_SET_NUM_TICKETS + /* Define to 1 if the assembler supports X86_64's POPCNTQ instruction. */ #undef HAVE_X86_64_POPCNTQ |