Skip to content

Commit b6c9165

Browse files
tglsfdctglsfdc
committed
Code review for SSLKEY patch.
1 parent 5ce7599 commit b6c9165

File tree

6 files changed

+38
-28
lines changed

6 files changed

+38
-28
lines changed

‎src/backend/libpq/be-secure.c

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
*
1212
*
1313
* IDENTIFICATION
14-
* $PostgreSQL: pgsql/src/backend/libpq/be-secure.c,v 1.78 2007/02/16 02:59:40 momjian Exp $
14+
* $PostgreSQL: pgsql/src/backend/libpq/be-secure.c,v 1.79 2007/02/16 17:06:59 tgl Exp $
1515
*
1616
* Since the server static private key ($DataDir/server.key)
1717
* will normally be stored unencrypted so that the database
@@ -95,8 +95,7 @@
9595
#if SSLEAY_VERSION_NUMBER >= 0x0907000L
9696
#include <openssl/conf.h>
9797
#endif
98-
99-
#endif
98+
#endif /* USE_SSL */
10099

101100
#include "libpq/libpq.h"
102101
#include "tcop/tcopprot.h"
@@ -130,8 +129,8 @@ static const char *SSLerrmessage(void);
130129

131130
static SSL_CTX *SSL_context = NULL;
132131

133-
/* GUC variable controlling SSL cipher list*/
134-
extern char *SSLCipherSuites;
132+
/* GUC variable controlling SSL cipher list */
133+
char *SSLCipherSuites = NULL;
135134

136135
#endif
137136

‎src/backend/postmaster/postmaster.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@
3737
*
3838
*
3939
* IDENTIFICATION
40-
* $PostgreSQL: pgsql/src/backend/postmaster/postmaster.c,v 1.524 2007/02/16 02:59:41 momjian Exp $
40+
* $PostgreSQL: pgsql/src/backend/postmaster/postmaster.c,v 1.525 2007/02/16 17:06:59 tgl Exp $
4141
*
4242
* NOTES
4343
*
@@ -187,7 +187,6 @@ static int SendStop = false;
187187

188188
/* still more option variables */
189189
bool EnableSSL = false;
190-
char *SSLCipherSuites;
191190
bool SilentMode = false; /* silent mode (-S) */
192191

193192
int PreAuthDelay = 0;

‎src/backend/utils/misc/guc.c

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
* Written by Peter Eisentraut <peter_e@gmx.net>.
1111
*
1212
* IDENTIFICATION
13-
* $PostgreSQL: pgsql/src/backend/utils/misc/guc.c,v 1.375 2007/02/16 02:59:41 momjian Exp $
13+
* $PostgreSQL: pgsql/src/backend/utils/misc/guc.c,v 1.376 2007/02/16 17:07:00 tgl Exp $
1414
*
1515
*--------------------------------------------------------------------
1616
*/
@@ -106,6 +106,11 @@ extern bool fullPageWrites;
106106
extern bool trace_sort;
107107
#endif
108108

109+
#ifdef USE_SSL
110+
extern char *SSLCipherSuites;
111+
#endif
112+
113+
109114
static const char *assign_log_destination(const char *value,
110115
bool doit, GucSource source);
111116

@@ -2314,6 +2319,7 @@ static struct config_string ConfigureNamesString[] =
23142319
NULL, assign_temp_tablespaces, NULL
23152320
},
23162321

2322+
#ifdef USE_SSL
23172323
{
23182324
{"ssl_ciphers", PGC_POSTMASTER, CONN_AUTH_SECURITY,
23192325
gettext_noop("Sets the list of allowed SSL ciphers."),
@@ -2323,7 +2329,8 @@ static struct config_string ConfigureNamesString[] =
23232329
&SSLCipherSuites,
23242330
"ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH", NULL, NULL
23252331
},
2326-
2332+
#endif /* USE_SSL */
2333+
23272334
/* End-of-list marker */
23282335
{
23292336
{NULL, 0, 0, NULL, NULL}, NULL, NULL, NULL, NULL

‎src/backend/utils/misc/postgresql.conf.sample

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,8 @@
7474

7575
#authentication_timeout = 1min # 1s-600s
7676
#ssl = off # (change requires restart)
77-
#ssl_ciphers = 'ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH' # List of ciphers to use
77+
#ssl_ciphers = 'ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH' # Allowed SSL ciphers
78+
# (change requires restart)
7879
#password_encryption = on
7980
#db_user_namespace = off
8081

‎src/include/postmaster/postmaster.h

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
* Portions Copyright (c) 1996-2007, PostgreSQL Global Development Group
77
* Portions Copyright (c) 1994, Regents of the University of California
88
*
9-
* $PostgreSQL: pgsql/src/include/postmaster/postmaster.h,v 1.16 2007/02/16 02:59:41 momjian Exp $
9+
* $PostgreSQL: pgsql/src/include/postmaster/postmaster.h,v 1.17 2007/02/16 17:07:00 tgl Exp $
1010
*
1111
*-------------------------------------------------------------------------
1212
*/
@@ -15,7 +15,6 @@
1515

1616
/* GUC options */
1717
extern bool EnableSSL;
18-
extern char *SSLCipherSuites;
1918
extern bool SilentMode;
2019
extern int ReservedBackends;
2120
extern int PostPortNumber;

‎src/interfaces/libpq/fe-secure.c

Lines changed: 21 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
*
1212
*
1313
* IDENTIFICATION
14-
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-secure.c,v 1.93 2007/02/16 02:59:41 momjian Exp $
14+
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-secure.c,v 1.94 2007/02/16 17:07:00 tgl Exp $
1515
*
1616
* NOTES
1717
* [ Most of these notes are wrong/obsolete, but perhaps not all ]
@@ -619,7 +619,7 @@ client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
619619
char *engine_env = getenv("PGSSLKEY");
620620
char *engine_colon = strchr(engine_env, ':');
621621
char *engine_str;
622-
ENGINE *engine_ptr = NULL;
622+
ENGINE *engine_ptr;
623623

624624
if (!engine_colon)
625625
{
@@ -630,34 +630,38 @@ client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
630630

631631
engine_str = malloc(engine_colon - engine_env + 1);
632632
strlcpy(engine_str, engine_env, engine_colon - engine_env + 1);
633-
if ((engine_ptr = ENGINE_by_id(engine_str)) == NULL)
633+
engine_ptr = ENGINE_by_id(engine_str);
634+
if (engine_ptr == NULL)
634635
{
635636
char *err = SSLerrmessage();
636637

637638
printfPQExpBuffer(&conn->errorMessage,
638-
libpq_gettext("could not load SSL engine \"%s\":%s\n"), engine_str, err);
639-
free(engine_str);
639+
libpq_gettext("could not load SSL engine \"%s\": %s\n"),
640+
engine_str, err);
640641
SSLerrfree(err);
642+
free(engine_str);
641643
return 0;
642644
}
643-
if ((*pkey = ENGINE_load_private_key(engine_ptr,
644-
engine_colon + 1, NULL, NULL)) == NULL)
645+
646+
*pkey = ENGINE_load_private_key(engine_ptr, engine_colon + 1,
647+
NULL, NULL);
648+
if (*pkey == NULL)
645649
{
646650
char *err = SSLerrmessage();
647651

648652
printfPQExpBuffer(&conn->errorMessage,
649-
libpq_gettext("could not read private SSL key %s from engine \"%s\": %s\n"),
650-
engine_colon + 1, engine_str, err);
653+
libpq_gettext("could not read private SSL key \"%s\" from engine \"%s\": %s\n"),
654+
engine_colon + 1, engine_str, err);
651655
SSLerrfree(err);
652656
free(engine_str);
653657
return 0;
654658
}
655659
free(engine_str);
656660
}
657661
else
658-
#endif
662+
#endif /* use PGSSLKEY */
659663
{
660-
/* read the user key from file*/
664+
/* read the user key from file */
661665
snprintf(fnbuf, sizeof(fnbuf), "%s/%s", homedir, USER_KEY_FILE);
662666
if (stat(fnbuf, &buf) == -1)
663667
{
@@ -666,7 +670,7 @@ client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
666670
fnbuf);
667671
return 0;
668672
}
669-
#ifndef WIN32
673+
#ifndef WIN32
670674
if (!S_ISREG(buf.st_mode) || (buf.st_mode & 0077) ||
671675
buf.st_uid != geteuid())
672676
{
@@ -675,23 +679,23 @@ client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
675679
fnbuf);
676680
return 0;
677681
}
678-
#endif
682+
#endif
679683
if ((fp = fopen(fnbuf, "r")) == NULL)
680684
{
681685
printfPQExpBuffer(&conn->errorMessage,
682686
libpq_gettext("could not open private key file \"%s\": %s\n"),
683687
fnbuf, pqStrerror(errno, sebuf, sizeof(sebuf)));
684688
return 0;
685689
}
686-
#ifndef WIN32
690+
#ifndef WIN32
687691
if (fstat(fileno(fp), &buf2) == -1 ||
688692
buf.st_dev != buf2.st_dev || buf.st_ino != buf2.st_ino)
689693
{
690694
printfPQExpBuffer(&conn->errorMessage,
691695
libpq_gettext("private key file \"%s\" changed during execution\n"), fnbuf);
692696
return 0;
693697
}
694-
#endif
698+
#endif
695699
if (PEM_read_PrivateKey(fp, pkey, NULL, NULL) == NULL)
696700
{
697701
char *err = SSLerrmessage();
@@ -705,6 +709,7 @@ client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
705709
}
706710
fclose(fp);
707711
}
712+
708713
/* verify that the cert and key go together */
709714
if (!X509_check_private_key(*x509, *pkey))
710715
{
@@ -788,7 +793,7 @@ init_ssl_system(PGconn *conn)
788793
{
789794
if (pq_initssllib)
790795
{
791-
#if (SSLEAY_VERSION_NUMBER >= 0x00907000L)
796+
#if SSLEAY_VERSION_NUMBER >= 0x00907000L
792797
OPENSSL_config(NULL);
793798
#endif
794799
SSL_library_init();

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy