Re: OpenSSL key renegotiation with patched openssl - Mailing list pgsql-hackers

From Tom Lane
Subject Re: OpenSSL key renegotiation with patched openssl
Date
Msg-id 20759.1259359111@sss.pgh.pa.us
Whole thread Raw
In response to Re: OpenSSL key renegotiation with patched openssl  (Stefan Kaltenbrunner <stefan@kaltenbrunner.cc>)
Responses Re: OpenSSL key renegotiation with patched openssl
Re: OpenSSL key renegotiation with patched openssl
List pgsql-hackers
Stefan Kaltenbrunner <stefan@kaltenbrunner.cc> writes:
> Tom Lane wrote:
>> The discussion I saw suggested that you need such a patch at both ends.

> and likely requires a restart of both postgresql and slony afterwards...

Actually, after looking through the available info about this:
https://svn.resiprocate.org/rep/ietf-drafts/ekr/draft-rescorla-tls-renegotiate.txt
I think my comment above is wrong.  It is useful to patch the
*server*-side library to reject a renegotiation request.  Applying that
patch on the client side, however, is useless and simply breaks things.
        regards, tom lane


pgsql-hackers by date:

Previous
From: Stefan Kaltenbrunner
Date:
Subject: Re: OpenSSL key renegotiation with patched openssl
Next
From: Peter Eisentraut
Date:
Subject: Re: unknown libpq service entries ignored