diff options
| author | Magnus Hagander <magnus@hagander.net> | 2010-02-25 13:26:16 +0000 |
|---|---|---|
| committer | Magnus Hagander <magnus@hagander.net> | 2010-02-25 13:26:16 +0000 |
| commit | 413d34be4e1f47ce52b02a6c60858ef6f1285578 (patch) | |
| tree | 91eaa0868408dc24a559202b5f005b57dd14497b /src/backend/utils | |
| parent | 0ccc5153f81ccf71c255cd05186d0bb31a29f779 (diff) | |
| download | postgresql-413d34be4e1f47ce52b02a6c60858ef6f1285578.tar.gz postgresql-413d34be4e1f47ce52b02a6c60858ef6f1285578.zip | |
Add configuration parameter ssl_renegotiation_limit to control
how often we do SSL session key renegotiation. Can be set to
0 to disable renegotiation completely, which is required if
a broken SSL library is used (broken patches to CVE-2009-3555
a known cause) or when using a client library that can't do
renegotiation.
Diffstat (limited to 'src/backend/utils')
| -rw-r--r-- | src/backend/utils/misc/guc.c | 13 | ||||
| -rw-r--r-- | src/backend/utils/misc/postgresql.conf.sample | 1 |
2 files changed, 13 insertions, 1 deletions
diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c index bde3be91cf3..d5330788452 100644 --- a/src/backend/utils/misc/guc.c +++ b/src/backend/utils/misc/guc.c @@ -10,7 +10,7 @@ * Written by Peter Eisentraut <peter_e@gmx.net>. * * IDENTIFICATION - * $PostgreSQL: pgsql/src/backend/utils/misc/guc.c,v 1.541 2010/02/17 04:19:40 tgl Exp $ + * $PostgreSQL: pgsql/src/backend/utils/misc/guc.c,v 1.542 2010/02/25 13:26:15 mha Exp $ * *-------------------------------------------------------------------- */ @@ -117,6 +117,7 @@ extern char *temp_tablespaces; extern bool synchronize_seqscans; extern bool fullPageWrites; extern int vacuum_defer_cleanup_age; +extern int ssl_renegotiation_limit; int trace_recovery_messages = LOG; @@ -1969,6 +1970,16 @@ static struct config_int ConfigureNamesInt[] = }, { + {"ssl_renegotiation_limit", PGC_USERSET, CONN_AUTH_SECURITY, + gettext_noop("Set the amount of traffic to send and receive before renegotiating the encryption keys."), + NULL, + GUC_UNIT_KB, + }, + &ssl_renegotiation_limit, + 512 * 1024, 0, MAX_KILOBYTES, NULL, NULL + }, + + { {"tcp_keepalives_count", PGC_USERSET, CLIENT_CONN_OTHER, gettext_noop("Maximum number of TCP keepalive retransmits."), gettext_noop("This controls the number of consecutive keepalive retransmits that can be " diff --git a/src/backend/utils/misc/postgresql.conf.sample b/src/backend/utils/misc/postgresql.conf.sample index 1d2b9f0f673..b550132d11a 100644 --- a/src/backend/utils/misc/postgresql.conf.sample +++ b/src/backend/utils/misc/postgresql.conf.sample @@ -80,6 +80,7 @@ #ssl = off # (change requires restart) #ssl_ciphers = 'ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH' # allowed SSL ciphers # (change requires restart) +#ssl_renegotiation_limit = 512MB # amount of data between renegotiations #password_encryption = on #db_user_namespace = off |