mirror of https://github.com/postgres/postgres
Fix regression in TLS session ticket disabling
Commit 274bbced
disabled session tickets for TLSv1.3 on top of the
already disabled TLSv1.2 session tickets, but accidentally caused
a regression where TLSv1.2 session tickets were incorrectly sent.
Fix by unconditionally disabling TLSv1.2 session tickets and only
disable TLSv1.3 tickets when the right version of OpenSSL is used.
Backpatch to all supported branches.
Reported-by: Cameron Vogt <cvogt@automaticcontrols.net>
Reported-by: Fire Emerald <fire.github@gmail.com>
Reviewed-by: Jacob Champion <jacob.champion@enterprisedb.com>
Discussion: https://postgr.es/m/DM6PR16MB3145CF62857226F350C710D1AB852@DM6PR16MB3145.namprd16.prod.outlook.com
Backpatch-through: v12
This commit is contained in:
parent
c1bb534bae
commit
23c200940e
|
@ -260,9 +260,8 @@ be_tls_init(bool isServerStart)
|
|||
*/
|
||||
#ifdef HAVE_SSL_CTX_SET_NUM_TICKETS
|
||||
SSL_CTX_set_num_tickets(context, 0);
|
||||
#else
|
||||
SSL_CTX_set_options(context, SSL_OP_NO_TICKET);
|
||||
#endif
|
||||
SSL_CTX_set_options(context, SSL_OP_NO_TICKET);
|
||||
|
||||
/* disallow SSL session caching, too */
|
||||
SSL_CTX_set_session_cache_mode(context, SSL_SESS_CACHE_OFF);
|
||||
|
|
Loading…
Reference in New Issue