Skip to content

Commit 697f8d2

Browse files
danielgustafssondanielgustafsson
committed
Revert "Add notBefore and notAfter to SSL cert info display"
This reverts commit 6acb0a6 since LibreSSL didn't support ASN1_TIME_diff until OpenBSD 7.1, leaving the older OpenBSD animals in the buildfarm complaining. Per plover in the buildfarm. Discussion: https://postgr.es/m/F0DF7102-192D-4C21-96AE-9A01AE153AD1@yesql.se
1 parent 473182c commit 697f8d2

File tree

19 files changed

+34
-308
lines changed

19 files changed

+34
-308
lines changed

‎contrib/sslinfo/Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ OBJS = \
66
sslinfo.o
77

88
EXTENSION = sslinfo
9-
DATA = sslinfo--1.2--1.3.sql sslinfo--1.2.sql sslinfo--1.1--1.2.sql sslinfo--1.0--1.1.sql
9+
DATA = sslinfo--1.2.sql sslinfo--1.1--1.2.sql sslinfo--1.0--1.1.sql
1010
PGFILEDESC = "sslinfo - information about client SSL certificate"
1111

1212
ifdef USE_PGXS

‎contrib/sslinfo/meson.build

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,6 @@ install_data(
2626
'sslinfo--1.0--1.1.sql',
2727
'sslinfo--1.1--1.2.sql',
2828
'sslinfo--1.2.sql',
29-
'sslinfo--1.2--1.3.sql',
3029
'sslinfo.control',
3130
kwargs: contrib_data_args,
3231
)

‎contrib/sslinfo/sslinfo--1.2--1.3.sql

Lines changed: 0 additions & 12 deletions
This file was deleted.

‎contrib/sslinfo/sslinfo.c

Lines changed: 0 additions & 95 deletions
Original file line numberDiff line numberDiff line change
@@ -14,12 +14,10 @@
1414
#include <openssl/asn1.h>
1515

1616
#include "access/htup_details.h"
17-
#include "common/int.h"
1817
#include "funcapi.h"
1918
#include "libpq/libpq-be.h"
2019
#include "miscadmin.h"
2120
#include "utils/builtins.h"
22-
#include "utils/timestamp.h"
2321

2422
/*
2523
* On Windows, <wincrypt.h> includes a #define for X509_NAME, which breaks our
@@ -36,7 +34,6 @@ PG_MODULE_MAGIC;
3634

3735
static Datum X509_NAME_field_to_text(X509_NAME *name, text *fieldName);
3836
static Datum ASN1_STRING_to_text(ASN1_STRING *str);
39-
static Datum ASN1_TIME_to_timestamptz(ASN1_TIME *time);
4037

4138
/*
4239
* Function context for data persisting over repeated calls.
@@ -228,66 +225,6 @@ X509_NAME_field_to_text(X509_NAME *name, text *fieldName)
228225
}
229226

230227

231-
/*
232-
* Converts OpenSSL ASN1_TIME structure into timestamptz
233-
*
234-
* OpenSSL 1.0.2 doesn't expose a function to convert an ASN1_TIME to a tm
235-
* struct, it's only available in 1.1.1 and onwards. Instead we can ask for the
236-
* difference between the ASN1_TIME and a known timestamp and get the actual
237-
* timestamp that way. Until support for OpenSSL 1.0.2 is retired we have to do
238-
* it this way.
239-
*
240-
* Parameter: time - OpenSSL ASN1_TIME structure.
241-
* Returns Datum, which can be directly returned from a C language SQL
242-
* function.
243-
*/
244-
static Datum
245-
ASN1_TIME_to_timestamptz(ASN1_TIME *ASN1_cert_ts)
246-
{
247-
int days;
248-
int seconds;
249-
const char postgres_epoch[] = "20000101000000Z";
250-
ASN1_TIME *ASN1_epoch;
251-
int64 result_days;
252-
int64 result_secs;
253-
int64 result;
254-
255-
/* Create an epoch to compare against */
256-
ASN1_epoch = ASN1_TIME_new();
257-
if (!ASN1_epoch)
258-
ereport(ERROR,
259-
(errcode(ERRCODE_OUT_OF_MEMORY),
260-
errmsg("could not allocate memory for ASN1 TIME structure")));
261-
262-
/* Calculate the diff from the epoch to the certificate timestamp */
263-
if (!ASN1_TIME_set_string(ASN1_epoch, postgres_epoch) ||
264-
!ASN1_TIME_diff(&days, &seconds, ASN1_epoch, ASN1_cert_ts))
265-
ereport(ERROR,
266-
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
267-
errmsg("failed to read certificate validity")));
268-
269-
/*
270-
* Unlike when freeing other OpenSSL memory structures, there is no error
271-
* return on freeing ASN1 strings.
272-
*/
273-
ASN1_TIME_free(ASN1_epoch);
274-
275-
/*
276-
* Convert the reported date into usecs to be used as a TimestampTz. The
277-
* date should really not overflow an int64 but rather than trusting the
278-
* certificate we take overflow into consideration.
279-
*/
280-
if (pg_mul_s64_overflow(days, USECS_PER_DAY, &result_days) ||
281-
pg_mul_s64_overflow(seconds, USECS_PER_SEC, &result_secs) ||
282-
pg_add_s64_overflow(result_days, result_secs, &result))
283-
{
284-
return TimestampTzGetDatum(0);
285-
}
286-
287-
return TimestampTzGetDatum(result);
288-
}
289-
290-
291228
/*
292229
* Returns specified field of client certificate distinguished name
293230
*
@@ -545,35 +482,3 @@ ssl_extension_info(PG_FUNCTION_ARGS)
545482
/* All done */
546483
SRF_RETURN_DONE(funcctx);
547484
}
548-
549-
/*
550-
* Returns current client certificate notBefore timestamp in
551-
* timestamptz data type
552-
*/
553-
PG_FUNCTION_INFO_V1(ssl_client_get_notbefore);
554-
Datum
555-
ssl_client_get_notbefore(PG_FUNCTION_ARGS)
556-
{
557-
X509 *cert = MyProcPort->peer;
558-
559-
if (!MyProcPort->ssl_in_use || !MyProcPort->peer_cert_valid)
560-
PG_RETURN_NULL();
561-
562-
return ASN1_TIME_to_timestamptz(X509_get_notBefore(cert));
563-
}
564-
565-
/*
566-
* Returns current client certificate notAfter timestamp in
567-
* timestamptz data type
568-
*/
569-
PG_FUNCTION_INFO_V1(ssl_client_get_notafter);
570-
Datum
571-
ssl_client_get_notafter(PG_FUNCTION_ARGS)
572-
{
573-
X509 *cert = MyProcPort->peer;
574-
575-
if (!MyProcPort->ssl_in_use || !MyProcPort->peer_cert_valid)
576-
PG_RETURN_NULL();
577-
578-
return ASN1_TIME_to_timestamptz(X509_get_notAfter(cert));
579-
}

‎contrib/sslinfo/sslinfo.control

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# sslinfo extension
22
comment = 'information about SSL certificates'
3-
default_version = '1.3'
3+
default_version = '1.2'
44
module_pathname = '$libdir/sslinfo'
55
relocatable = true

‎doc/src/sgml/monitoring.sgml

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -2292,26 +2292,6 @@ description | Waiting for a newly initialized WAL file to reach durable storage
22922292
This field is truncated like <structfield>client_dn</structfield>.
22932293
</para></entry>
22942294
</row>
2295-
2296-
<row>
2297-
<entry role="catalog_table_entry"><para role="column_definition">
2298-
<structfield>not_before</structfield> <type>text</type>
2299-
</para>
2300-
<para>
2301-
Not before timestamp of the client certificate, or NULL if no client
2302-
certificate was supplied.
2303-
</para></entry>
2304-
</row>
2305-
2306-
<row>
2307-
<entry role="catalog_table_entry"><para role="column_definition">
2308-
<structfield>not_after</structfield> <type>text</type>
2309-
</para>
2310-
<para>
2311-
Not after timestamp of the client certificate, or NULL if no client
2312-
certificate was supplied.
2313-
</para></entry>
2314-
</row>
23152295
</tbody>
23162296
</tgroup>
23172297
</table>

‎doc/src/sgml/sslinfo.sgml

Lines changed: 0 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -240,36 +240,6 @@ emailAddress
240240
</para>
241241
</listitem>
242242
</varlistentry>
243-
244-
<varlistentry>
245-
<term>
246-
<function>ssl_client_get_notbefore() returns timestamptz</function>
247-
<indexterm>
248-
<primary>ssl_client_get_notbefore</primary>
249-
</indexterm>
250-
</term>
251-
<listitem>
252-
<para>
253-
Return the <structfield>not before</structfield> timestamp of the client
254-
certificate.
255-
</para>
256-
</listitem>
257-
</varlistentry>
258-
259-
<varlistentry>
260-
<term>
261-
<function>ssl_client_get_notafter() returns timestamptz</function>
262-
<indexterm>
263-
<primary>ssl_client_get_notafter</primary>
264-
</indexterm>
265-
</term>
266-
<listitem>
267-
<para>
268-
Return the <structfield>not after</structfield> timestamp of the client
269-
certificate.
270-
</para>
271-
</listitem>
272-
</varlistentry>
273243
</variablelist>
274244
</sect2>
275245

‎src/backend/catalog/system_views.sql

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -992,9 +992,7 @@ CREATE VIEW pg_stat_ssl AS
992992
S.sslbits AS bits,
993993
S.ssl_client_dn AS client_dn,
994994
S.ssl_client_serial AS client_serial,
995-
S.ssl_issuer_dn AS issuer_dn,
996-
S.ssl_not_before AS not_before,
997-
S.ssl_not_after AS not_after
995+
S.ssl_issuer_dn AS issuer_dn
998996
FROM pg_stat_get_activity(NULL) AS S
999997
WHERE S.client_port IS NOT NULL;
1000998

‎src/backend/libpq/be-secure-openssl.c

Lines changed: 0 additions & 78 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@
2727
#include <netinet/tcp.h>
2828
#include <arpa/inet.h>
2929

30-
#include "common/int.h"
3130
#include "common/string.h"
3231
#include "libpq/libpq.h"
3332
#include "miscadmin.h"
@@ -37,7 +36,6 @@
3736
#include "tcop/tcopprot.h"
3837
#include "utils/builtins.h"
3938
#include "utils/memutils.h"
40-
#include "utils/timestamp.h"
4139

4240
/*
4341
* These SSL-related #includes must come after all system-provided headers.
@@ -74,7 +72,6 @@ static bool initialize_ecdh(SSL_CTX *context, bool isServerStart);
7472
static const char *SSLerrmessage(unsigned long ecode);
7573

7674
static char *X509_NAME_to_cstring(X509_NAME *name);
77-
static TimestampTz ASN1_TIME_to_timestamptz(ASN1_TIME *time);
7875

7976
static SSL_CTX *SSL_context = NULL;
8077
static bool SSL_initialized = false;
@@ -1433,24 +1430,6 @@ be_tls_get_peer_issuer_name(Port *port, char *ptr, size_t len)
14331430
ptr[0] = '\0';
14341431
}
14351432

1436-
void
1437-
be_tls_get_peer_not_before(Port *port, TimestampTz *ptr)
1438-
{
1439-
if (port->peer)
1440-
*ptr = ASN1_TIME_to_timestamptz(X509_get_notBefore(port->peer));
1441-
else
1442-
*ptr = 0;
1443-
}
1444-
1445-
void
1446-
be_tls_get_peer_not_after(Port *port, TimestampTz *ptr)
1447-
{
1448-
if (port->peer)
1449-
*ptr = ASN1_TIME_to_timestamptz(X509_get_notAfter(port->peer));
1450-
else
1451-
*ptr = 0;
1452-
}
1453-
14541433
void
14551434
be_tls_get_peer_serial(Port *port, char *ptr, size_t len)
14561435
{
@@ -1594,63 +1573,6 @@ X509_NAME_to_cstring(X509_NAME *name)
15941573
return result;
15951574
}
15961575

1597-
/*
1598-
* Convert an ASN1_TIME to a Timestamptz. OpenSSL 1.0.2 doesn't expose a function
1599-
* to convert an ASN1_TIME to a tm struct, it's only available in 1.1.1 and
1600-
* onwards. Instead we can ask for the difference between the ASN1_TIME and a
1601-
* known timestamp and get the actual timestamp that way. Until support for
1602-
* OpenSSL 1.0.2 is retired we have to do it this way.
1603-
*/
1604-
static TimestampTz
1605-
ASN1_TIME_to_timestamptz(ASN1_TIME *ASN1_cert_ts)
1606-
{
1607-
int days;
1608-
int seconds;
1609-
const char postgres_epoch[] = "20000101000000Z";
1610-
ASN1_TIME *ASN1_epoch;
1611-
int64 result_days;
1612-
int64 result_seconds;
1613-
int64 result;
1614-
1615-
/* Create an epoch to compare against */
1616-
ASN1_epoch = ASN1_TIME_new();
1617-
if (!ASN1_epoch)
1618-
ereport(ERROR,
1619-
(errcode(ERRCODE_OUT_OF_MEMORY),
1620-
errmsg("could not allocate memory for ASN1 TIME structure")));
1621-
1622-
/*
1623-
* Calculate the diff from the epoch to the certificate timestamp.
1624-
* POSTGRES_EPOCH_JDATE cannot be used here since OpenSSL needs an epoch
1625-
* in the ASN.1 format.
1626-
*/
1627-
if (!ASN1_TIME_set_string(ASN1_epoch, postgres_epoch) ||
1628-
!ASN1_TIME_diff(&days, &seconds, ASN1_epoch, ASN1_cert_ts))
1629-
ereport(ERROR,
1630-
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
1631-
errmsg("failed to read certificate validity")));
1632-
1633-
/*
1634-
* Unlike when freeing other OpenSSL memory structures, there is no error
1635-
* return on freeing ASN1 strings.
1636-
*/
1637-
ASN1_TIME_free(ASN1_epoch);
1638-
1639-
/*
1640-
* Convert the reported date into usecs to be used as a TimestampTz. The
1641-
* date should really not overflow an int64 but rather than trusting the
1642-
* certificate we take overflow into consideration.
1643-
*/
1644-
if (pg_mul_s64_overflow(days, USECS_PER_DAY, &result_days) ||
1645-
pg_mul_s64_overflow(seconds, USECS_PER_SEC, &result_seconds) ||
1646-
pg_add_s64_overflow(result_seconds, result_days, &result))
1647-
{
1648-
return 0;
1649-
}
1650-
1651-
return result;
1652-
}
1653-
16541576
/*
16551577
* Convert TLS protocol version GUC enum to OpenSSL values
16561578
*

‎src/backend/utils/activity/backend_status.c

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -348,8 +348,6 @@ pgstat_bestart(void)
348348
be_tls_get_peer_subject_name(MyProcPort, lsslstatus.ssl_client_dn, NAMEDATALEN);
349349
be_tls_get_peer_serial(MyProcPort, lsslstatus.ssl_client_serial, NAMEDATALEN);
350350
be_tls_get_peer_issuer_name(MyProcPort, lsslstatus.ssl_issuer_dn, NAMEDATALEN);
351-
be_tls_get_peer_not_before(MyProcPort, &lsslstatus.ssl_not_before);
352-
be_tls_get_peer_not_after(MyProcPort, &lsslstatus.ssl_not_after);
353351
}
354352
else
355353
{

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy