diff options
| author | Heikki Linnakangas <heikki.linnakangas@iki.fi> | 2015-02-13 21:46:08 +0200 |
|---|---|---|
| committer | Heikki Linnakangas <heikki.linnakangas@iki.fi> | 2015-02-13 21:46:08 +0200 |
| commit | 272923a0a6956187471df4f032eee06559520390 (patch) | |
| tree | ecdec58a0f5485366ab61b36d4f9301883227cdf /src | |
| parent | dc01efa5ccdd9804b0c97d4d9b651ba9360ebb11 (diff) | |
| download | postgresql-272923a0a6956187471df4f032eee06559520390.tar.gz | |
Simplify the way OpenSSL renegotiation is initiated in server.
At least in all modern versions of OpenSSL, it is enough to call
SSL_renegotiate() once, and then forget about it. Subsequent SSL_write()
and SSL_read() calls will finish the handshake.
The SSL_set_session_id_context() call is unnecessary too. We only have
one SSL context, and the SSL session was created with that to begin with.
Diffstat (limited to 'src')
| -rw-r--r-- | src/backend/libpq/be-secure-openssl.c | 23 |
1 files changed, 0 insertions, 23 deletions
diff --git a/src/backend/libpq/be-secure-openssl.c b/src/backend/libpq/be-secure-openssl.c index d5f97122ff..d13ce334cc 100644 --- a/src/backend/libpq/be-secure-openssl.c +++ b/src/backend/libpq/be-secure-openssl.c @@ -624,33 +624,10 @@ be_tls_write(Port *port, void *ptr, size_t len) */ SSL_clear_num_renegotiations(port->ssl); - SSL_set_session_id_context(port->ssl, (void *) &SSL_context, - sizeof(SSL_context)); if (SSL_renegotiate(port->ssl) <= 0) ereport(COMMERROR, (errcode(ERRCODE_PROTOCOL_VIOLATION), errmsg("SSL failure during renegotiation start"))); - else - { - int retries; - - /* - * A handshake can fail, so be prepared to retry it, but only - * a few times. - */ - for (retries = 0;; retries++) - { - if (SSL_do_handshake(port->ssl) > 0) - break; /* done */ - ereport(COMMERROR, - (errcode(ERRCODE_PROTOCOL_VIOLATION), - errmsg("SSL handshake failure on renegotiation, retrying"))); - if (retries >= 20) - ereport(FATAL, - (errcode(ERRCODE_PROTOCOL_VIOLATION), - errmsg("could not complete SSL handshake on renegotiation, too many failures"))); - } - } } wloop: |