diff options
| author | Peter Eisentraut <peter_e@gmx.net> | 2018-03-17 08:56:50 -0400 |
|---|---|---|
| committer | Peter Eisentraut <peter_e@gmx.net> | 2018-03-17 09:17:33 -0400 |
| commit | e3bdb2d92600ed45bd46aaf48309a436a9628218 (patch) | |
| tree | aad06fef22e4e4c08268fd32ff840dcdf350df25 /src | |
| parent | 8a3d9425290ff5f6434990349886afae9e1c6008 (diff) | |
| download | postgresql-e3bdb2d92600ed45bd46aaf48309a436a9628218.tar.gz postgresql-e3bdb2d92600ed45bd46aaf48309a436a9628218.zip | |
Set libpq sslcompression to off by default
Since SSL compression is no longer recommended, turn the default in
libpq from on to off.
OpenSSL 1.1.0 and many distribution packages already turn compression
off by default, so such a server won't accept compression anyway. So
this will mainly affect users of older OpenSSL installations.
Also update the documentation to make clear that this setting is no
longer recommended.
Discussion: https://www.postgresql.org/message-id/flat/595cf3b1-4ffe-7f05-6f72-f72b7afa7993%402ndquadrant.com
Diffstat (limited to 'src')
| -rw-r--r-- | src/interfaces/libpq/fe-connect.c | 2 | ||||
| -rw-r--r-- | src/interfaces/libpq/fe-secure-openssl.c | 8 |
2 files changed, 5 insertions, 5 deletions
diff --git a/src/interfaces/libpq/fe-connect.c b/src/interfaces/libpq/fe-connect.c index 77eebb0ba13..39c19998c22 100644 --- a/src/interfaces/libpq/fe-connect.c +++ b/src/interfaces/libpq/fe-connect.c @@ -279,7 +279,7 @@ static const internalPQconninfoOption PQconninfoOptions[] = { "SSL-Mode", "", 12, /* sizeof("verify-full") == 12 */ offsetof(struct pg_conn, sslmode)}, - {"sslcompression", "PGSSLCOMPRESSION", "1", NULL, + {"sslcompression", "PGSSLCOMPRESSION", "0", NULL, "SSL-Compression", "", 1, offsetof(struct pg_conn, sslcompression)}, diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c index 127122563c2..1a35b30dbcd 100644 --- a/src/interfaces/libpq/fe-secure-openssl.c +++ b/src/interfaces/libpq/fe-secure-openssl.c @@ -1188,14 +1188,14 @@ initialize_SSL(PGconn *conn) SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, verify_cb); /* - * If the OpenSSL version used supports it (from 1.0.0 on) and the user - * requested it, disable SSL compression. + * Set compression option if the OpenSSL version used supports it (from + * 1.0.0 on). */ #ifdef SSL_OP_NO_COMPRESSION if (conn->sslcompression && conn->sslcompression[0] == '0') - { SSL_set_options(conn->ssl, SSL_OP_NO_COMPRESSION); - } + else + SSL_clear_options(conn->ssl, SSL_OP_NO_COMPRESSION); #endif return 0; |