Slightly improved SSL bits...

From: Sean Chittenden <sean(at)chittenden(dot)org>
To: pgsql-patches(at)postgresql(dot)org
Subject: Slightly improved SSL bits...
Date: 2003-04-19 19:08:21
Message-ID: 20030419190821.GQ79923@perrin.int.nxad.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-patches

Well, the discussion about SSL a bit back perked my interest and I did
some reading on the subject.

1) PostgreSQL uses ephemeral keying, for its connections (good thing)

2) PostgreSQL doesn't set the cipher list that it allows (bad thing,
fixed)

3) PostgreSQL's renegotiation code wasn't text book correct (could be
bad, fixed)

4) The rate of renegotiating was insanely low (as Tom pointed out, set
to a more reasonable level)

I haven't checked around much to see if there are any other SSL bits
that need some review, but I'm doing some OpenSSL work right now
and'll send patches for improvements along the way (if I find them).
At the very least, the changes in this patch will make security folks
happier for sure. The constant renegotiation of sessions was likely a
boon to systems that had bad entropy gathering means (read: Slowaris
/dev/rand|/dev/urand != ANDIrand). The new limit for renegotiations
is 512MB which should be much more reasonable.

-sc

--
Sean Chittenden

Attachment Content-Type Size
patch text/plain 1.6 KB

Responses

Browse pgsql-patches by date

  From Date Subject
Next Message Nic Ferrier 2003-04-19 21:13:18 build patch
Previous Message Bruce Momjian 2003-04-18 23:45:43 Re: Win32 patch for COPY