diff options
| -rw-r--r-- | doc/src/sgml/config.sgml | 10 | ||||
| -rw-r--r-- | src/backend/utils/misc/guc.c | 2 | ||||
| -rw-r--r-- | src/backend/utils/misc/postgresql.conf.sample | 2 |
3 files changed, 11 insertions, 3 deletions
diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml index 179c60e46b9..75877551d7e 100644 --- a/doc/src/sgml/config.sgml +++ b/doc/src/sgml/config.sgml @@ -674,7 +674,7 @@ SET ENABLE_SEQSCAN TO OFF; cryptanalysis when large amounts of traffic can be examined, but it also carries a large performance penalty. The sum of sent and received traffic is used to check the limit. If this parameter is set to 0, - renegotiation is disabled. The default is <literal>512MB</>. + renegotiation is disabled. The default is <literal>0</>. </para> <note> <para> @@ -686,6 +686,14 @@ SET ENABLE_SEQSCAN TO OFF; disabled. </para> </note> + + <warning> + <para> + Due to bugs in <productname>OpenSSL</> enabling ssl renegotiation, by + configuring a non-zero <varname>ssl_renegotiation_limit</>, is likely + to lead to problems like long-lived connections breaking. + </para> + </warning> </listitem> </varlistentry> diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c index a66a7d9198c..a3e86223db7 100644 --- a/src/backend/utils/misc/guc.c +++ b/src/backend/utils/misc/guc.c @@ -2291,7 +2291,7 @@ static struct config_int ConfigureNamesInt[] = GUC_UNIT_KB, }, &ssl_renegotiation_limit, - 512 * 1024, 0, MAX_KILOBYTES, + 0, 0, MAX_KILOBYTES, NULL, NULL, NULL }, diff --git a/src/backend/utils/misc/postgresql.conf.sample b/src/backend/utils/misc/postgresql.conf.sample index 82c8ae4a0c8..40ea0f21f0e 100644 --- a/src/backend/utils/misc/postgresql.conf.sample +++ b/src/backend/utils/misc/postgresql.conf.sample @@ -80,7 +80,7 @@ #ssl = off # (change requires restart) #ssl_ciphers = 'ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH' # allowed SSL ciphers # (change requires restart) -#ssl_renegotiation_limit = 512MB # amount of data between renegotiations +#ssl_renegotiation_limit = 0 # amount of data between renegotiations #password_encryption = on #db_user_namespace = off |