Use OpenSSL's SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER flag.

This disables an entirely unnecessary "sanity check" that causes failures
in nonblocking mode, because OpenSSL complains if we move or compact the
write buffer.  The only actual requirement is that we not modify pending
data once we've attempted to send it, which we don't.  Per testing and
research by Martin Pihlak, though this fix is a lot simpler than his patch.

I put the same change into the backend, although it's less clear whether
it's necessary there.  We do use nonblock mode in some situations in
streaming replication, so seems best to keep the same behavior in the
backend as in libpq.

Back-patch to all supported releases.

diff --git a/src/backend/libpq/be-secure.c b/src/backend/libpq/be-secure.c
index 6f38b2c7292e52383a8b16b3b2d3179d55d4177e..3f4c15dd259132f3d85ab7cb460d3c8548fc3f1d 100644 (file)
--- a/src/backend/libpq/be-secure.c
+++ b/src/backend/libpq/be-secure.c
@@ -729,6 +729,12 @@ initialize_SSL(void)
                                        (errmsg("could not create SSL context: %s",
                                                        SSLerrmessage())));
 
+               /*
+                * Disable OpenSSL's moving-write-buffer sanity check, because it
+                * causes unnecessary failures in nonblocking send cases.
+                */
+               SSL_CTX_set_mode(SSL_context, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
+
                /*
                 * Load and verify certificate and private key
                 */

diff --git a/src/interfaces/libpq/fe-secure.c b/src/interfaces/libpq/fe-secure.c
index e7cd2a4561e2825bcbe41927732279a36df91dc1..422ef1f1090c194bd9e8e69a0152f1c36a3dca0c 100644 (file)
--- a/src/interfaces/libpq/fe-secure.c
+++ b/src/interfaces/libpq/fe-secure.c
@@ -947,6 +947,12 @@ init_ssl_system(PGconn *conn)
 #endif
                        return -1;
                }
+
+               /*
+                * Disable OpenSSL's moving-write-buffer sanity check, because it
+                * causes unnecessary failures in nonblocking send cases.
+                */
+               SSL_CTX_set_mode(SSL_context, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
        }
 
 #ifdef ENABLE_THREAD_SAFETY