Simplify the way OpenSSL renegotiation is initiated in server.

At least in all modern versions of OpenSSL, it is enough to call
SSL_renegotiate() once, and then forget about it. Subsequent SSL_write()
and SSL_read() calls will finish the handshake.

This is a backport from master.

diff --git a/src/backend/libpq/be-secure.c b/src/backend/libpq/be-secure.c
index 89c30d06542afb1fae3e5589af1b07d5204f472b..a8d14d5d8aadc19d8d79f31fcfd85e39713b52be 100644 (file)
--- a/src/backend/libpq/be-secure.c
+++ b/src/backend/libpq/be-secure.c
@@ -363,27 +363,6 @@ secure_write(Port *port, void *ptr, size_t len)
                                ereport(COMMERROR,
                                                (errcode(ERRCODE_PROTOCOL_VIOLATION),
                                                 errmsg("SSL failure during renegotiation start")));
-                       else
-                       {
-                               int                     retries;
-
-                               /*
-                                * A handshake can fail, so be prepared to retry it, but only
-                                * a few times.
-                                */
-                               for (retries = 0;; retries++)
-                               {
-                                       if (SSL_do_handshake(port->ssl) > 0)
-                                               break;  /* done */
-                                       ereport(COMMERROR,
-                                                       (errcode(ERRCODE_PROTOCOL_VIOLATION),
-                                                        errmsg("SSL handshake failure on renegotiation, retrying")));
-                                       if (retries >= 20)
-                                               ereport(FATAL,
-                                                               (errcode(ERRCODE_PROTOCOL_VIOLATION),
-                                                                errmsg("could not complete SSL handshake on renegotiation, too many failures")));
-                               }
-                       }
                }
 
 wloop: