PostgreSQL Source Code  git master
be-secure-openssl.c File Reference
#include "postgres.h"
#include <sys/stat.h>
#include <signal.h>
#include <fcntl.h>
#include <ctype.h>
#include <sys/socket.h>
#include <unistd.h>
#include <netdb.h>
#include <netinet/in.h>
#include <openssl/ssl.h>
#include <openssl/dh.h>
#include <openssl/conf.h>
#include <openssl/ec.h>
#include "common/openssl.h"
#include "libpq/libpq.h"
#include "miscadmin.h"
#include "pgstat.h"
#include "storage/fd.h"
#include "storage/latch.h"
#include "tcop/tcopprot.h"
#include "utils/memutils.h"
Include dependency graph for be-secure-openssl.c:

Go to the source code of this file.

Macros

#define BIO_get_data(bio)   (bio->ptr)
 
#define BIO_set_data(bio, data)   (bio->ptr = data)
 

Functions

static int my_sock_read (BIO *h, char *buf, int size)
 
static int my_sock_write (BIO *h, const char *buf, int size)
 
static BIO_METHOD * my_BIO_s_socket (void)
 
static int my_SSL_set_fd (Port *port, int fd)
 
static DH * load_dh_file (char *filename, bool isServerStart)
 
static DH * load_dh_buffer (const char *, size_t)
 
static int ssl_external_passwd_cb (char *buf, int size, int rwflag, void *userdata)
 
static int dummy_ssl_passwd_cb (char *buf, int size, int rwflag, void *userdata)
 
static int verify_cb (int, X509_STORE_CTX *)
 
static void info_cb (const SSL *ssl, int type, int args)
 
static bool initialize_dh (SSL_CTX *context, bool isServerStart)
 
static bool initialize_ecdh (SSL_CTX *context, bool isServerStart)
 
static const char * SSLerrmessage (unsigned long ecode)
 
static char * X509_NAME_to_cstring (X509_NAME *name)
 
static int ssl_protocol_version_to_openssl (int v, const char *guc_name, int loglevel)
 
int be_tls_init (bool isServerStart)
 
void be_tls_destroy (void)
 
int be_tls_open_server (Port *port)
 
void be_tls_close (Port *port)
 
ssize_t be_tls_read (Port *port, void *ptr, size_t len, int *waitfor)
 
ssize_t be_tls_write (Port *port, void *ptr, size_t len, int *waitfor)
 
int be_tls_get_cipher_bits (Port *port)
 
bool be_tls_get_compression (Port *port)
 
const char * be_tls_get_version (Port *port)
 
const char * be_tls_get_cipher (Port *port)
 
void be_tls_get_peer_subject_name (Port *port, char *ptr, size_t len)
 
void be_tls_get_peer_issuer_name (Port *port, char *ptr, size_t len)
 
void be_tls_get_peer_serial (Port *port, char *ptr, size_t len)
 

Variables

static SSL_CTX * SSL_context = NULL
 
static bool SSL_initialized = false
 
static bool dummy_ssl_passwd_cb_called = false
 
static bool ssl_is_server_start
 
static BIO_METHOD * my_bio_methods = NULL
 

Macro Definition Documentation

◆ BIO_get_data

#define BIO_get_data (   bio)    (bio->ptr)

Definition at line 673 of file be-secure-openssl.c.

Referenced by my_sock_read(), and my_sock_write().

◆ BIO_set_data

#define BIO_set_data (   bio,
  data 
)    (bio->ptr = data)

Definition at line 674 of file be-secure-openssl.c.

Referenced by my_SSL_set_fd().

Function Documentation

◆ be_tls_close()

void be_tls_close ( Port port)

Definition at line 508 of file be-secure-openssl.c.

References Port::peer_cn, pfree(), and Port::ssl_in_use.

Referenced by secure_close().

509 {
510  if (port->ssl)
511  {
512  SSL_shutdown(port->ssl);
513  SSL_free(port->ssl);
514  port->ssl = NULL;
515  port->ssl_in_use = false;
516  }
517 
518  if (port->peer)
519  {
520  X509_free(port->peer);
521  port->peer = NULL;
522  }
523 
524  if (port->peer_cn)
525  {
526  pfree(port->peer_cn);
527  port->peer_cn = NULL;
528  }
529 }
char * peer_cn
Definition: libpq-be.h:191
bool ssl_in_use
Definition: libpq-be.h:190
void pfree(void *pointer)
Definition: mcxt.c:1056

◆ be_tls_destroy()

void be_tls_destroy ( void  )

Definition at line 335 of file be-secure-openssl.c.

References SSL_context.

Referenced by secure_destroy().

336 {
337  if (SSL_context)
338  SSL_CTX_free(SSL_context);
339  SSL_context = NULL;
340  ssl_loaded_verify_locations = false;
341 }
static SSL_CTX * SSL_context

◆ be_tls_get_cipher()

const char* be_tls_get_cipher ( Port port)

Definition at line 1115 of file be-secure-openssl.c.

Referenced by PerformAuthentication(), and pgstat_bestart().

1116 {
1117  if (port->ssl)
1118  return SSL_get_cipher(port->ssl);
1119  else
1120  return NULL;
1121 }

◆ be_tls_get_cipher_bits()

int be_tls_get_cipher_bits ( Port port)

Definition at line 1083 of file be-secure-openssl.c.

Referenced by PerformAuthentication(), and pgstat_bestart().

1084 {
1085  int bits;
1086 
1087  if (port->ssl)
1088  {
1089  SSL_get_cipher_bits(port->ssl, &bits);
1090  return bits;
1091  }
1092  else
1093  return 0;
1094 }

◆ be_tls_get_compression()

bool be_tls_get_compression ( Port port)

Definition at line 1097 of file be-secure-openssl.c.

Referenced by PerformAuthentication(), and pgstat_bestart().

1098 {
1099  if (port->ssl)
1100  return (SSL_get_current_compression(port->ssl) != NULL);
1101  else
1102  return false;
1103 }

◆ be_tls_get_peer_issuer_name()

void be_tls_get_peer_issuer_name ( Port port,
char *  ptr,
size_t  len 
)

Definition at line 1133 of file be-secure-openssl.c.

References strlcpy(), and X509_NAME_to_cstring().

Referenced by pgstat_bestart().

1134 {
1135  if (port->peer)
1136  strlcpy(ptr, X509_NAME_to_cstring(X509_get_issuer_name(port->peer)), len);
1137  else
1138  ptr[0] = '\0';
1139 }
static char * X509_NAME_to_cstring(X509_NAME *name)
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: strlcpy.c:45

◆ be_tls_get_peer_serial()

void be_tls_get_peer_serial ( Port port,
char *  ptr,
size_t  len 
)

Definition at line 1142 of file be-secure-openssl.c.

References elog, ERROR, hash(), palloc(), port, and strlcpy().

Referenced by pgstat_bestart().

1143 {
1144  if (port->peer)
1145  {
1146  ASN1_INTEGER *serial;
1147  BIGNUM *b;
1148  char *decimal;
1149 
1150  serial = X509_get_serialNumber(port->peer);
1151  b = ASN1_INTEGER_to_BN(serial, NULL);
1152  decimal = BN_bn2dec(b);
1153 
1154  BN_free(b);
1155  strlcpy(ptr, decimal, len);
1156  OPENSSL_free(decimal);
1157  }
1158  else
1159  ptr[0] = '\0';
1160 }
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: strlcpy.c:45

◆ be_tls_get_peer_subject_name()

void be_tls_get_peer_subject_name ( Port port,
char *  ptr,
size_t  len 
)

Definition at line 1124 of file be-secure-openssl.c.

References strlcpy(), and X509_NAME_to_cstring().

Referenced by pgstat_bestart().

1125 {
1126  if (port->peer)
1127  strlcpy(ptr, X509_NAME_to_cstring(X509_get_subject_name(port->peer)), len);
1128  else
1129  ptr[0] = '\0';
1130 }
static char * X509_NAME_to_cstring(X509_NAME *name)
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: strlcpy.c:45

◆ be_tls_get_version()

const char* be_tls_get_version ( Port port)

Definition at line 1106 of file be-secure-openssl.c.

Referenced by PerformAuthentication(), and pgstat_bestart().

1107 {
1108  if (port->ssl)
1109  return SSL_get_version(port->ssl);
1110  else
1111  return NULL;
1112 }

◆ be_tls_init()

int be_tls_init ( bool  isServerStart)

Definition at line 79 of file be-secure-openssl.c.

References check_ssl_key_file_permissions(), dummy_ssl_passwd_cb(), dummy_ssl_passwd_cb_called, ereport, errcode(), errmsg(), error(), FATAL, initialize_dh(), initialize_ecdh(), LOG, ssl_ca_file, ssl_cert_file, SSL_context, ssl_crl_file, SSL_CTX_set_max_proto_version(), SSL_CTX_set_min_proto_version(), ssl_external_passwd_cb(), SSL_initialized, ssl_is_server_start, ssl_key_file, ssl_max_protocol_version, ssl_min_protocol_version, ssl_passphrase_command, ssl_passphrase_command_supports_reload, ssl_protocol_version_to_openssl(), SSLCipherSuites, SSLerrmessage(), SSLPreferServerCiphers, and verify_cb().

Referenced by secure_initialize().

80 {
81  STACK_OF(X509_NAME) *root_cert_list = NULL;
82  SSL_CTX *context;
83 
84  /* This stuff need be done only once. */
85  if (!SSL_initialized)
86  {
87 #ifdef HAVE_OPENSSL_INIT_SSL
88  OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG, NULL);
89 #else
90  OPENSSL_config(NULL);
91  SSL_library_init();
92  SSL_load_error_strings();
93 #endif
94  SSL_initialized = true;
95  }
96 
97  /*
98  * We use SSLv23_method() because it can negotiate use of the highest
99  * mutually supported protocol version, while alternatives like
100  * TLSv1_2_method() permit only one specific version. Note that we don't
101  * actually allow SSL v2 or v3, only TLS protocols (see below).
102  */
103  context = SSL_CTX_new(SSLv23_method());
104  if (!context)
105  {
106  ereport(isServerStart ? FATAL : LOG,
107  (errmsg("could not create SSL context: %s",
108  SSLerrmessage(ERR_get_error()))));
109  goto error;
110  }
111 
112  /*
113  * Disable OpenSSL's moving-write-buffer sanity check, because it causes
114  * unnecessary failures in nonblocking send cases.
115  */
116  SSL_CTX_set_mode(context, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
117 
118  /*
119  * Set password callback
120  */
121  if (isServerStart)
122  {
123  if (ssl_passphrase_command[0])
124  SSL_CTX_set_default_passwd_cb(context, ssl_external_passwd_cb);
125  }
126  else
127  {
129  SSL_CTX_set_default_passwd_cb(context, ssl_external_passwd_cb);
130  else
131 
132  /*
133  * If reloading and no external command is configured, override
134  * OpenSSL's default handling of passphrase-protected files,
135  * because we don't want to prompt for a passphrase in an
136  * already-running server.
137  */
138  SSL_CTX_set_default_passwd_cb(context, dummy_ssl_passwd_cb);
139  }
140  /* used by the callback */
141  ssl_is_server_start = isServerStart;
142 
143  /*
144  * Load and verify server's certificate and private key
145  */
146  if (SSL_CTX_use_certificate_chain_file(context, ssl_cert_file) != 1)
147  {
148  ereport(isServerStart ? FATAL : LOG,
149  (errcode(ERRCODE_CONFIG_FILE_ERROR),
150  errmsg("could not load server certificate file \"%s\": %s",
151  ssl_cert_file, SSLerrmessage(ERR_get_error()))));
152  goto error;
153  }
154 
155  if (!check_ssl_key_file_permissions(ssl_key_file, isServerStart))
156  goto error;
157 
158  /*
159  * OK, try to load the private key file.
160  */
162 
163  if (SSL_CTX_use_PrivateKey_file(context,
164  ssl_key_file,
165  SSL_FILETYPE_PEM) != 1)
166  {
168  ereport(isServerStart ? FATAL : LOG,
169  (errcode(ERRCODE_CONFIG_FILE_ERROR),
170  errmsg("private key file \"%s\" cannot be reloaded because it requires a passphrase",
171  ssl_key_file)));
172  else
173  ereport(isServerStart ? FATAL : LOG,
174  (errcode(ERRCODE_CONFIG_FILE_ERROR),
175  errmsg("could not load private key file \"%s\": %s",
176  ssl_key_file, SSLerrmessage(ERR_get_error()))));
177  goto error;
178  }
179 
180  if (SSL_CTX_check_private_key(context) != 1)
181  {
182  ereport(isServerStart ? FATAL : LOG,
183  (errcode(ERRCODE_CONFIG_FILE_ERROR),
184  errmsg("check of private key failed: %s",
185  SSLerrmessage(ERR_get_error()))));
186  goto error;
187  }
188 
190  {
192  "ssl_min_protocol_version",
193  isServerStart ? FATAL : LOG);
194 
195  if (ssl_ver == -1)
196  goto error;
197  if (!SSL_CTX_set_min_proto_version(context, ssl_ver))
198  {
199  ereport(isServerStart ? FATAL : LOG,
200  (errmsg("could not set minimum SSL protocol version")));
201  goto error;
202  }
203  }
204 
206  {
208  "ssl_max_protocol_version",
209  isServerStart ? FATAL : LOG);
210 
211  if (ssl_ver == -1)
212  goto error;
213  if (!SSL_CTX_set_max_proto_version(context, ssl_ver))
214  {
215  ereport(isServerStart ? FATAL : LOG,
216  (errmsg("could not set maximum SSL protocol version")));
217  goto error;
218  }
219  }
220 
221  /* disallow SSL session tickets */
222  SSL_CTX_set_options(context, SSL_OP_NO_TICKET);
223 
224  /* disallow SSL session caching, too */
225  SSL_CTX_set_session_cache_mode(context, SSL_SESS_CACHE_OFF);
226 
227  /* set up ephemeral DH and ECDH keys */
228  if (!initialize_dh(context, isServerStart))
229  goto error;
230  if (!initialize_ecdh(context, isServerStart))
231  goto error;
232 
233  /* set up the allowed cipher list */
234  if (SSL_CTX_set_cipher_list(context, SSLCipherSuites) != 1)
235  {
236  ereport(isServerStart ? FATAL : LOG,
237  (errcode(ERRCODE_CONFIG_FILE_ERROR),
238  errmsg("could not set the cipher list (no valid ciphers available)")));
239  goto error;
240  }
241 
242  /* Let server choose order */
244  SSL_CTX_set_options(context, SSL_OP_CIPHER_SERVER_PREFERENCE);
245 
246  /*
247  * Load CA store, so we can verify client certificates if needed.
248  */
249  if (ssl_ca_file[0])
250  {
251  if (SSL_CTX_load_verify_locations(context, ssl_ca_file, NULL) != 1 ||
252  (root_cert_list = SSL_load_client_CA_file(ssl_ca_file)) == NULL)
253  {
254  ereport(isServerStart ? FATAL : LOG,
255  (errcode(ERRCODE_CONFIG_FILE_ERROR),
256  errmsg("could not load root certificate file \"%s\": %s",
257  ssl_ca_file, SSLerrmessage(ERR_get_error()))));
258  goto error;
259  }
260  }
261 
262  /*----------
263  * Load the Certificate Revocation List (CRL).
264  * http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci803160,00.html
265  *----------
266  */
267  if (ssl_crl_file[0])
268  {
269  X509_STORE *cvstore = SSL_CTX_get_cert_store(context);
270 
271  if (cvstore)
272  {
273  /* Set the flags to check against the complete CRL chain */
274  if (X509_STORE_load_locations(cvstore, ssl_crl_file, NULL) == 1)
275  {
276  X509_STORE_set_flags(cvstore,
277  X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
278  }
279  else
280  {
281  ereport(isServerStart ? FATAL : LOG,
282  (errcode(ERRCODE_CONFIG_FILE_ERROR),
283  errmsg("could not load SSL certificate revocation list file \"%s\": %s",
284  ssl_crl_file, SSLerrmessage(ERR_get_error()))));
285  goto error;
286  }
287  }
288  }
289 
290  if (ssl_ca_file[0])
291  {
292  /*
293  * Always ask for SSL client cert, but don't fail if it's not
294  * presented. We might fail such connections later, depending on what
295  * we find in pg_hba.conf.
296  */
297  SSL_CTX_set_verify(context,
298  (SSL_VERIFY_PEER |
299  SSL_VERIFY_CLIENT_ONCE),
300  verify_cb);
301 
302  /*
303  * Tell OpenSSL to send the list of root certs we trust to clients in
304  * CertificateRequests. This lets a client with a keystore select the
305  * appropriate client certificate to send to us.
306  */
307  SSL_CTX_set_client_CA_list(context, root_cert_list);
308  }
309 
310  /*
311  * Success! Replace any existing SSL_context.
312  */
313  if (SSL_context)
314  SSL_CTX_free(SSL_context);
315 
316  SSL_context = context;
317 
318  /*
319  * Set flag to remember whether CA store has been loaded into SSL_context.
320  */
321  if (ssl_ca_file[0])
322  ssl_loaded_verify_locations = true;
323  else
324  ssl_loaded_verify_locations = false;
325 
326  return 0;
327 
328 error:
329  if (context)
330  SSL_CTX_free(context);
331  return -1;
332 }
static void error(void)
Definition: sql-dyntest.c:147
static bool dummy_ssl_passwd_cb_called
int errcode(int sqlerrcode)
Definition: elog.c:608
char * ssl_cert_file
Definition: be-secure.c:41
static bool initialize_ecdh(SSL_CTX *context, bool isServerStart)
#define LOG
Definition: elog.h:26
char * ssl_crl_file
Definition: be-secure.c:44
static int ssl_protocol_version_to_openssl(int v, const char *guc_name, int loglevel)
int ssl_min_protocol_version
Definition: be-secure.c:62
#define FATAL
Definition: elog.h:52
static bool SSL_initialized
char * SSLCipherSuites
Definition: be-secure.c:54
static int verify_cb(int, X509_STORE_CTX *)
#define ereport(elevel, rest)
Definition: elog.h:141
bool ssl_passphrase_command_supports_reload
Definition: be-secure.c:47
static int ssl_external_passwd_cb(char *buf, int size, int rwflag, void *userdata)
static bool ssl_is_server_start
static bool initialize_dh(SSL_CTX *context, bool isServerStart)
char * ssl_ca_file
Definition: be-secure.c:43
int SSL_CTX_set_min_proto_version(SSL_CTX *ctx, int version)
int ssl_max_protocol_version
Definition: be-secure.c:63
int errmsg(const char *fmt,...)
Definition: elog.c:822
static SSL_CTX * SSL_context
static const char * SSLerrmessage(unsigned long ecode)
char * ssl_passphrase_command
Definition: be-secure.c:46
int SSL_CTX_set_max_proto_version(SSL_CTX *ctx, int version)
static int dummy_ssl_passwd_cb(char *buf, int size, int rwflag, void *userdata)
char * ssl_key_file
Definition: be-secure.c:42
bool SSLPreferServerCiphers
Definition: be-secure.c:60
bool check_ssl_key_file_permissions(const char *ssl_key_file, bool isServerStart)

◆ be_tls_open_server()

int be_tls_open_server ( Port port)

Definition at line 344 of file be-secure-openssl.c.

References Assert, COMMERROR, ereport, errcode(), errcode_for_socket_access(), errmsg(), info_cb(), MemoryContextAlloc(), my_SSL_set_fd(), MyLatch, Port::noblock, Port::peer_cert_valid, Port::peer_cn, pfree(), Port::sock, SSL_context, Port::ssl_in_use, SSLerrmessage(), TopMemoryContext, WAIT_EVENT_SSL_OPEN_SERVER, WaitLatchOrSocket(), WL_EXIT_ON_PM_DEATH, WL_SOCKET_READABLE, and WL_SOCKET_WRITEABLE.

Referenced by secure_open_server().

345 {
346  int r;
347  int err;
348  int waitfor;
349  unsigned long ecode;
350 
351  Assert(!port->ssl);
352  Assert(!port->peer);
353 
354  if (!SSL_context)
355  {
357  (errcode(ERRCODE_PROTOCOL_VIOLATION),
358  errmsg("could not initialize SSL connection: SSL context not set up")));
359  return -1;
360  }
361 
362  if (!(port->ssl = SSL_new(SSL_context)))
363  {
365  (errcode(ERRCODE_PROTOCOL_VIOLATION),
366  errmsg("could not initialize SSL connection: %s",
367  SSLerrmessage(ERR_get_error()))));
368  return -1;
369  }
370  if (!my_SSL_set_fd(port, port->sock))
371  {
373  (errcode(ERRCODE_PROTOCOL_VIOLATION),
374  errmsg("could not set SSL socket: %s",
375  SSLerrmessage(ERR_get_error()))));
376  return -1;
377  }
378  port->ssl_in_use = true;
379 
380 aloop:
381 
382  /*
383  * Prepare to call SSL_get_error() by clearing thread's OpenSSL error
384  * queue. In general, the current thread's error queue must be empty
385  * before the TLS/SSL I/O operation is attempted, or SSL_get_error() will
386  * not work reliably. An extension may have failed to clear the
387  * per-thread error queue following another call to an OpenSSL I/O
388  * routine.
389  */
390  ERR_clear_error();
391  r = SSL_accept(port->ssl);
392  if (r <= 0)
393  {
394  err = SSL_get_error(port->ssl, r);
395 
396  /*
397  * Other clients of OpenSSL in the backend may fail to call
398  * ERR_get_error(), but we always do, so as to not cause problems for
399  * OpenSSL clients that don't call ERR_clear_error() defensively. Be
400  * sure that this happens by calling now. SSL_get_error() relies on
401  * the OpenSSL per-thread error queue being intact, so this is the
402  * earliest possible point ERR_get_error() may be called.
403  */
404  ecode = ERR_get_error();
405  switch (err)
406  {
407  case SSL_ERROR_WANT_READ:
408  case SSL_ERROR_WANT_WRITE:
409  /* not allowed during connection establishment */
410  Assert(!port->noblock);
411 
412  /*
413  * No need to care about timeouts/interrupts here. At this
414  * point authentication_timeout still employs
415  * StartupPacketTimeoutHandler() which directly exits.
416  */
417  if (err == SSL_ERROR_WANT_READ)
419  else
421 
422  (void) WaitLatchOrSocket(MyLatch, waitfor, port->sock, 0,
424  goto aloop;
425  case SSL_ERROR_SYSCALL:
426  if (r < 0)
429  errmsg("could not accept SSL connection: %m")));
430  else
432  (errcode(ERRCODE_PROTOCOL_VIOLATION),
433  errmsg("could not accept SSL connection: EOF detected")));
434  break;
435  case SSL_ERROR_SSL:
437  (errcode(ERRCODE_PROTOCOL_VIOLATION),
438  errmsg("could not accept SSL connection: %s",
439  SSLerrmessage(ecode))));
440  break;
441  case SSL_ERROR_ZERO_RETURN:
443  (errcode(ERRCODE_PROTOCOL_VIOLATION),
444  errmsg("could not accept SSL connection: EOF detected")));
445  break;
446  default:
448  (errcode(ERRCODE_PROTOCOL_VIOLATION),
449  errmsg("unrecognized SSL error code: %d",
450  err)));
451  break;
452  }
453  return -1;
454  }
455 
456  /* Get client certificate, if available. */
457  port->peer = SSL_get_peer_certificate(port->ssl);
458 
459  /* and extract the Common Name from it. */
460  port->peer_cn = NULL;
461  port->peer_cert_valid = false;
462  if (port->peer != NULL)
463  {
464  int len;
465 
466  len = X509_NAME_get_text_by_NID(X509_get_subject_name(port->peer),
467  NID_commonName, NULL, 0);
468  if (len != -1)
469  {
470  char *peer_cn;
471 
472  peer_cn = MemoryContextAlloc(TopMemoryContext, len + 1);
473  r = X509_NAME_get_text_by_NID(X509_get_subject_name(port->peer),
474  NID_commonName, peer_cn, len + 1);
475  peer_cn[len] = '\0';
476  if (r != len)
477  {
478  /* shouldn't happen */
479  pfree(peer_cn);
480  return -1;
481  }
482 
483  /*
484  * Reject embedded NULLs in certificate common name to prevent
485  * attacks like CVE-2009-4034.
486  */
487  if (len != strlen(peer_cn))
488  {
490  (errcode(ERRCODE_PROTOCOL_VIOLATION),
491  errmsg("SSL certificate's common name contains embedded null")));
492  pfree(peer_cn);
493  return -1;
494  }
495 
496  port->peer_cn = peer_cn;
497  }
498  port->peer_cert_valid = true;
499  }
500 
501  /* set up debugging/info callback */
502  SSL_CTX_set_info_callback(SSL_context, info_cb);
503 
504  return 0;
505 }
#define WL_SOCKET_WRITEABLE
Definition: latch.h:126
char * peer_cn
Definition: libpq-be.h:191
bool peer_cert_valid
Definition: libpq-be.h:192
static void info_cb(const SSL *ssl, int type, int args)
int errcode(int sqlerrcode)
Definition: elog.c:608
bool ssl_in_use
Definition: libpq-be.h:190
#define WL_SOCKET_READABLE
Definition: latch.h:125
pgsocket sock
Definition: libpq-be.h:122
void pfree(void *pointer)
Definition: mcxt.c:1056
static int my_SSL_set_fd(Port *port, int fd)
#define COMMERROR
Definition: elog.h:30
int WaitLatchOrSocket(Latch *latch, int wakeEvents, pgsocket sock, long timeout, uint32 wait_event_info)
Definition: latch.c:369
#define ereport(elevel, rest)
Definition: elog.h:141
MemoryContext TopMemoryContext
Definition: mcxt.c:44
int errcode_for_socket_access(void)
Definition: elog.c:702
#define Assert(condition)
Definition: c.h:739
bool noblock
Definition: libpq-be.h:123
int errmsg(const char *fmt,...)
Definition: elog.c:822
static SSL_CTX * SSL_context
void * MemoryContextAlloc(MemoryContext context, Size size)
Definition: mcxt.c:796
static const char * SSLerrmessage(unsigned long ecode)
struct Latch * MyLatch
Definition: globals.c:54
#define WL_EXIT_ON_PM_DEATH
Definition: latch.h:129

◆ be_tls_read()

ssize_t be_tls_read ( Port port,
void *  ptr,
size_t  len,
int *  waitfor 
)

Definition at line 532 of file be-secure-openssl.c.

References COMMERROR, ECONNRESET, ereport, errcode(), errmsg(), EWOULDBLOCK, SSLerrmessage(), WL_SOCKET_READABLE, and WL_SOCKET_WRITEABLE.

Referenced by secure_read().

533 {
534  ssize_t n;
535  int err;
536  unsigned long ecode;
537 
538  errno = 0;
539  ERR_clear_error();
540  n = SSL_read(port->ssl, ptr, len);
541  err = SSL_get_error(port->ssl, n);
542  ecode = (err != SSL_ERROR_NONE || n < 0) ? ERR_get_error() : 0;
543  switch (err)
544  {
545  case SSL_ERROR_NONE:
546  /* a-ok */
547  break;
548  case SSL_ERROR_WANT_READ:
549  *waitfor = WL_SOCKET_READABLE;
550  errno = EWOULDBLOCK;
551  n = -1;
552  break;
553  case SSL_ERROR_WANT_WRITE:
554  *waitfor = WL_SOCKET_WRITEABLE;
555  errno = EWOULDBLOCK;
556  n = -1;
557  break;
558  case SSL_ERROR_SYSCALL:
559  /* leave it to caller to ereport the value of errno */
560  if (n != -1)
561  {
562  errno = ECONNRESET;
563  n = -1;
564  }
565  break;
566  case SSL_ERROR_SSL:
568  (errcode(ERRCODE_PROTOCOL_VIOLATION),
569  errmsg("SSL error: %s", SSLerrmessage(ecode))));
570  errno = ECONNRESET;
571  n = -1;
572  break;
573  case SSL_ERROR_ZERO_RETURN:
574  /* connection was cleanly shut down by peer */
575  n = 0;
576  break;
577  default:
579  (errcode(ERRCODE_PROTOCOL_VIOLATION),
580  errmsg("unrecognized SSL error code: %d",
581  err)));
582  errno = ECONNRESET;
583  n = -1;
584  break;
585  }
586 
587  return n;
588 }
#define WL_SOCKET_WRITEABLE
Definition: latch.h:126
int errcode(int sqlerrcode)
Definition: elog.c:608
#define WL_SOCKET_READABLE
Definition: latch.h:125
#define COMMERROR
Definition: elog.h:30
#define ereport(elevel, rest)
Definition: elog.h:141
#define ECONNRESET
Definition: win32_port.h:333
int errmsg(const char *fmt,...)
Definition: elog.c:822
static const char * SSLerrmessage(unsigned long ecode)
#define EWOULDBLOCK
Definition: win32_port.h:329

◆ be_tls_write()

ssize_t be_tls_write ( Port port,
void *  ptr,
size_t  len,
int *  waitfor 
)

Definition at line 591 of file be-secure-openssl.c.

References COMMERROR, ECONNRESET, ereport, errcode(), errmsg(), EWOULDBLOCK, SSLerrmessage(), WL_SOCKET_READABLE, and WL_SOCKET_WRITEABLE.

Referenced by secure_write().

592 {
593  ssize_t n;
594  int err;
595  unsigned long ecode;
596 
597  errno = 0;
598  ERR_clear_error();
599  n = SSL_write(port->ssl, ptr, len);
600  err = SSL_get_error(port->ssl, n);
601  ecode = (err != SSL_ERROR_NONE || n < 0) ? ERR_get_error() : 0;
602  switch (err)
603  {
604  case SSL_ERROR_NONE:
605  /* a-ok */
606  break;
607  case SSL_ERROR_WANT_READ:
608  *waitfor = WL_SOCKET_READABLE;
609  errno = EWOULDBLOCK;
610  n = -1;
611  break;
612  case SSL_ERROR_WANT_WRITE:
613  *waitfor = WL_SOCKET_WRITEABLE;
614  errno = EWOULDBLOCK;
615  n = -1;
616  break;
617  case SSL_ERROR_SYSCALL:
618  /* leave it to caller to ereport the value of errno */
619  if (n != -1)
620  {
621  errno = ECONNRESET;
622  n = -1;
623  }
624  break;
625  case SSL_ERROR_SSL:
627  (errcode(ERRCODE_PROTOCOL_VIOLATION),
628  errmsg("SSL error: %s", SSLerrmessage(ecode))));
629  errno = ECONNRESET;
630  n = -1;
631  break;
632  case SSL_ERROR_ZERO_RETURN:
633 
634  /*
635  * the SSL connection was closed, leave it to the caller to
636  * ereport it
637  */
638  errno = ECONNRESET;
639  n = -1;
640  break;
641  default:
643  (errcode(ERRCODE_PROTOCOL_VIOLATION),
644  errmsg("unrecognized SSL error code: %d",
645  err)));
646  errno = ECONNRESET;
647  n = -1;
648  break;
649  }
650 
651  return n;
652 }
#define WL_SOCKET_WRITEABLE
Definition: latch.h:126
int errcode(int sqlerrcode)
Definition: elog.c:608
#define WL_SOCKET_READABLE
Definition: latch.h:125
#define COMMERROR
Definition: elog.h:30
#define ereport(elevel, rest)
Definition: elog.h:141
#define ECONNRESET
Definition: win32_port.h:333
int errmsg(const char *fmt,...)
Definition: elog.c:822
static const char * SSLerrmessage(unsigned long ecode)
#define EWOULDBLOCK
Definition: win32_port.h:329

◆ dummy_ssl_passwd_cb()

static int dummy_ssl_passwd_cb ( char *  buf,
int  size,
int  rwflag,
void *  userdata 
)
static

Definition at line 903 of file be-secure-openssl.c.

References Assert, and dummy_ssl_passwd_cb_called.

Referenced by be_tls_init().

904 {
905  /* Set flag to change the error message we'll report */
907  /* And return empty string */
908  Assert(size > 0);
909  buf[0] = '\0';
910  return 0;
911 }
static bool dummy_ssl_passwd_cb_called
static char * buf
Definition: pg_test_fsync.c:67
#define Assert(condition)
Definition: c.h:739

◆ info_cb()

static void info_cb ( const SSL *  ssl,
int  type,
int  args 
)
static

Definition at line 935 of file be-secure-openssl.c.

References DEBUG4, ereport, and errmsg_internal().

Referenced by be_tls_open_server().

936 {
937  switch (type)
938  {
939  case SSL_CB_HANDSHAKE_START:
940  ereport(DEBUG4,
941  (errmsg_internal("SSL: handshake start")));
942  break;
943  case SSL_CB_HANDSHAKE_DONE:
944  ereport(DEBUG4,
945  (errmsg_internal("SSL: handshake done")));
946  break;
947  case SSL_CB_ACCEPT_LOOP:
948  ereport(DEBUG4,
949  (errmsg_internal("SSL: accept loop")));
950  break;
951  case SSL_CB_ACCEPT_EXIT:
952  ereport(DEBUG4,
953  (errmsg_internal("SSL: accept exit (%d)", args)));
954  break;
955  case SSL_CB_CONNECT_LOOP:
956  ereport(DEBUG4,
957  (errmsg_internal("SSL: connect loop")));
958  break;
959  case SSL_CB_CONNECT_EXIT:
960  ereport(DEBUG4,
961  (errmsg_internal("SSL: connect exit (%d)", args)));
962  break;
963  case SSL_CB_READ_ALERT:
964  ereport(DEBUG4,
965  (errmsg_internal("SSL: read alert (0x%04x)", args)));
966  break;
967  case SSL_CB_WRITE_ALERT:
968  ereport(DEBUG4,
969  (errmsg_internal("SSL: write alert (0x%04x)", args)));
970  break;
971  }
972 }
#define DEBUG4
Definition: elog.h:22
#define ereport(elevel, rest)
Definition: elog.h:141
int errmsg_internal(const char *fmt,...)
Definition: elog.c:909

◆ initialize_dh()

static bool initialize_dh ( SSL_CTX *  context,
bool  isServerStart 
)
static

Definition at line 988 of file be-secure-openssl.c.

References ereport, errcode(), errmsg(), FATAL, load_dh_buffer(), load_dh_file(), LOG, ssl_dh_params_file, and SSLerrmessage().

Referenced by be_tls_init().

989 {
990  DH *dh = NULL;
991 
992  SSL_CTX_set_options(context, SSL_OP_SINGLE_DH_USE);
993 
994  if (ssl_dh_params_file[0])
995  dh = load_dh_file(ssl_dh_params_file, isServerStart);
996  if (!dh)
997  dh = load_dh_buffer(FILE_DH2048, sizeof(FILE_DH2048));
998  if (!dh)
999  {
1000  ereport(isServerStart ? FATAL : LOG,
1001  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1002  (errmsg("DH: could not load DH parameters"))));
1003  return false;
1004  }
1005 
1006  if (SSL_CTX_set_tmp_dh(context, dh) != 1)
1007  {
1008  ereport(isServerStart ? FATAL : LOG,
1009  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1010  (errmsg("DH: could not set DH parameters: %s",
1011  SSLerrmessage(ERR_get_error())))));
1012  DH_free(dh);
1013  return false;
1014  }
1015 
1016  DH_free(dh);
1017  return true;
1018 }
static DH * load_dh_file(char *filename, bool isServerStart)
int errcode(int sqlerrcode)
Definition: elog.c:608
#define LOG
Definition: elog.h:26
#define FATAL
Definition: elog.h:52
static DH * load_dh_buffer(const char *, size_t)
#define ereport(elevel, rest)
Definition: elog.h:141
char * ssl_dh_params_file
Definition: be-secure.c:45
int errmsg(const char *fmt,...)
Definition: elog.c:822
static const char * SSLerrmessage(unsigned long ecode)

◆ initialize_ecdh()

static bool initialize_ecdh ( SSL_CTX *  context,
bool  isServerStart 
)
static

Definition at line 1026 of file be-secure-openssl.c.

References ereport, errcode(), errmsg(), FATAL, LOG, and SSLECDHCurve.

Referenced by be_tls_init().

1027 {
1028 #ifndef OPENSSL_NO_ECDH
1029  EC_KEY *ecdh;
1030  int nid;
1031 
1032  nid = OBJ_sn2nid(SSLECDHCurve);
1033  if (!nid)
1034  {
1035  ereport(isServerStart ? FATAL : LOG,
1036  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1037  errmsg("ECDH: unrecognized curve name: %s", SSLECDHCurve)));
1038  return false;
1039  }
1040 
1041  ecdh = EC_KEY_new_by_curve_name(nid);
1042  if (!ecdh)
1043  {
1044  ereport(isServerStart ? FATAL : LOG,
1045  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1046  errmsg("ECDH: could not create key")));
1047  return false;
1048  }
1049 
1050  SSL_CTX_set_options(context, SSL_OP_SINGLE_ECDH_USE);
1051  SSL_CTX_set_tmp_ecdh(context, ecdh);
1052  EC_KEY_free(ecdh);
1053 #endif
1054 
1055  return true;
1056 }
int errcode(int sqlerrcode)
Definition: elog.c:608
#define LOG
Definition: elog.h:26
#define FATAL
Definition: elog.h:52
char * SSLECDHCurve
Definition: be-secure.c:57
#define ereport(elevel, rest)
Definition: elog.h:141
int errmsg(const char *fmt,...)
Definition: elog.c:822

◆ load_dh_buffer()

static DH * load_dh_buffer ( const char *  buffer,
size_t  len 
)
static

Definition at line 861 of file be-secure-openssl.c.

References DEBUG2, ereport, errmsg_internal(), SSLerrmessage(), and unconstify.

Referenced by initialize_dh().

862 {
863  BIO *bio;
864  DH *dh = NULL;
865 
866  bio = BIO_new_mem_buf(unconstify(char *, buffer), len);
867  if (bio == NULL)
868  return NULL;
869  dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
870  if (dh == NULL)
871  ereport(DEBUG2,
872  (errmsg_internal("DH load buffer: %s",
873  SSLerrmessage(ERR_get_error()))));
874  BIO_free(bio);
875 
876  return dh;
877 }
#define DEBUG2
Definition: elog.h:24
#define ereport(elevel, rest)
Definition: elog.h:141
#define unconstify(underlying_type, expr)
Definition: c.h:1193
int errmsg_internal(const char *fmt,...)
Definition: elog.c:909
static const char * SSLerrmessage(unsigned long ecode)

◆ load_dh_file()

static DH * load_dh_file ( char *  filename,
bool  isServerStart 
)
static

Definition at line 798 of file be-secure-openssl.c.

References AllocateFile(), ereport, errcode(), errcode_for_file_access(), errmsg(), FATAL, FreeFile(), LOG, and SSLerrmessage().

Referenced by initialize_dh().

799 {
800  FILE *fp;
801  DH *dh = NULL;
802  int codes;
803 
804  /* attempt to open file. It's not an error if it doesn't exist. */
805  if ((fp = AllocateFile(filename, "r")) == NULL)
806  {
807  ereport(isServerStart ? FATAL : LOG,
809  errmsg("could not open DH parameters file \"%s\": %m",
810  filename)));
811  return NULL;
812  }
813 
814  dh = PEM_read_DHparams(fp, NULL, NULL, NULL);
815  FreeFile(fp);
816 
817  if (dh == NULL)
818  {
819  ereport(isServerStart ? FATAL : LOG,
820  (errcode(ERRCODE_CONFIG_FILE_ERROR),
821  errmsg("could not load DH parameters file: %s",
822  SSLerrmessage(ERR_get_error()))));
823  return NULL;
824  }
825 
826  /* make sure the DH parameters are usable */
827  if (DH_check(dh, &codes) == 0)
828  {
829  ereport(isServerStart ? FATAL : LOG,
830  (errcode(ERRCODE_CONFIG_FILE_ERROR),
831  errmsg("invalid DH parameters: %s",
832  SSLerrmessage(ERR_get_error()))));
833  return NULL;
834  }
835  if (codes & DH_CHECK_P_NOT_PRIME)
836  {
837  ereport(isServerStart ? FATAL : LOG,
838  (errcode(ERRCODE_CONFIG_FILE_ERROR),
839  errmsg("invalid DH parameters: p is not prime")));
840  return NULL;
841  }
842  if ((codes & DH_NOT_SUITABLE_GENERATOR) &&
843  (codes & DH_CHECK_P_NOT_SAFE_PRIME))
844  {
845  ereport(isServerStart ? FATAL : LOG,
846  (errcode(ERRCODE_CONFIG_FILE_ERROR),
847  errmsg("invalid DH parameters: neither suitable generator or safe prime")));
848  return NULL;
849  }
850 
851  return dh;
852 }
int errcode(int sqlerrcode)
Definition: elog.c:608
#define LOG
Definition: elog.h:26
#define FATAL
Definition: elog.h:52
int errcode_for_file_access(void)
Definition: elog.c:631
FILE * AllocateFile(const char *name, const char *mode)
Definition: fd.c:2241
#define ereport(elevel, rest)
Definition: elog.h:141
int FreeFile(FILE *file)
Definition: fd.c:2440
static char * filename
Definition: pg_dumpall.c:90
int errmsg(const char *fmt,...)
Definition: elog.c:822
static const char * SSLerrmessage(unsigned long ecode)

◆ my_BIO_s_socket()

static BIO_METHOD * my_BIO_s_socket ( void  )
static

Definition at line 721 of file be-secure-openssl.c.

References malloc, my_bio_methods, my_sock_read(), and my_sock_write().

Referenced by my_SSL_set_fd().

722 {
723  if (!my_bio_methods)
724  {
725  BIO_METHOD *biom = (BIO_METHOD *) BIO_s_socket();
726 #ifdef HAVE_BIO_METH_NEW
727  int my_bio_index;
728 
729  my_bio_index = BIO_get_new_index();
730  if (my_bio_index == -1)
731  return NULL;
732  my_bio_methods = BIO_meth_new(my_bio_index, "PostgreSQL backend socket");
733  if (!my_bio_methods)
734  return NULL;
735  if (!BIO_meth_set_write(my_bio_methods, my_sock_write) ||
736  !BIO_meth_set_read(my_bio_methods, my_sock_read) ||
737  !BIO_meth_set_gets(my_bio_methods, BIO_meth_get_gets(biom)) ||
738  !BIO_meth_set_puts(my_bio_methods, BIO_meth_get_puts(biom)) ||
739  !BIO_meth_set_ctrl(my_bio_methods, BIO_meth_get_ctrl(biom)) ||
740  !BIO_meth_set_create(my_bio_methods, BIO_meth_get_create(biom)) ||
741  !BIO_meth_set_destroy(my_bio_methods, BIO_meth_get_destroy(biom)) ||
742  !BIO_meth_set_callback_ctrl(my_bio_methods, BIO_meth_get_callback_ctrl(biom)))
743  {
744  BIO_meth_free(my_bio_methods);
745  my_bio_methods = NULL;
746  return NULL;
747  }
748 #else
749  my_bio_methods = malloc(sizeof(BIO_METHOD));
750  if (!my_bio_methods)
751  return NULL;
752  memcpy(my_bio_methods, biom, sizeof(BIO_METHOD));
753  my_bio_methods->bread = my_sock_read;
754  my_bio_methods->bwrite = my_sock_write;
755 #endif
756  }
757  return my_bio_methods;
758 }
#define malloc(a)
Definition: header.h:50
static BIO_METHOD * my_bio_methods
static int my_sock_read(BIO *h, char *buf, int size)
static int my_sock_write(BIO *h, const char *buf, int size)

◆ my_sock_read()

static int my_sock_read ( BIO *  h,
char *  buf,
int  size 
)
static

Definition at line 680 of file be-secure-openssl.c.

References BIO_get_data, EAGAIN, EINTR, EWOULDBLOCK, and secure_raw_read().

Referenced by my_BIO_s_socket().

681 {
682  int res = 0;
683 
684  if (buf != NULL)
685  {
686  res = secure_raw_read(((Port *) BIO_get_data(h)), buf, size);
687  BIO_clear_retry_flags(h);
688  if (res <= 0)
689  {
690  /* If we were interrupted, tell caller to retry */
691  if (errno == EINTR || errno == EWOULDBLOCK || errno == EAGAIN)
692  {
693  BIO_set_retry_read(h);
694  }
695  }
696  }
697 
698  return res;
699 }
#define EAGAIN
Definition: win32_port.h:321
#define BIO_get_data(bio)
Definition: libpq-be.h:120
static char * buf
Definition: pg_test_fsync.c:67
ssize_t secure_raw_read(Port *port, void *ptr, size_t len)
Definition: be-secure.c:234
#define EWOULDBLOCK
Definition: win32_port.h:329
#define EINTR
Definition: win32_port.h:323

◆ my_sock_write()

static int my_sock_write ( BIO *  h,
const char *  buf,
int  size 
)
static

Definition at line 702 of file be-secure-openssl.c.

References BIO_get_data, EAGAIN, EINTR, EWOULDBLOCK, and secure_raw_write().

Referenced by my_BIO_s_socket().

703 {
704  int res = 0;
705 
706  res = secure_raw_write(((Port *) BIO_get_data(h)), buf, size);
707  BIO_clear_retry_flags(h);
708  if (res <= 0)
709  {
710  /* If we were interrupted, tell caller to retry */
711  if (errno == EINTR || errno == EWOULDBLOCK || errno == EAGAIN)
712  {
713  BIO_set_retry_write(h);
714  }
715  }
716 
717  return res;
718 }
#define EAGAIN
Definition: win32_port.h:321
#define BIO_get_data(bio)
ssize_t secure_raw_write(Port *port, const void *ptr, size_t len)
Definition: be-secure.c:330
Definition: libpq-be.h:120
static char * buf
Definition: pg_test_fsync.c:67
#define EWOULDBLOCK
Definition: win32_port.h:329
#define EINTR
Definition: win32_port.h:323

◆ my_SSL_set_fd()

static int my_SSL_set_fd ( Port port,
int  fd 
)
static

Definition at line 762 of file be-secure-openssl.c.

References BIO_set_data, and my_BIO_s_socket().

Referenced by be_tls_open_server().

763 {
764  int ret = 0;
765  BIO *bio;
766  BIO_METHOD *bio_method;
767 
768  bio_method = my_BIO_s_socket();
769  if (bio_method == NULL)
770  {
771  SSLerr(SSL_F_SSL_SET_FD, ERR_R_BUF_LIB);
772  goto err;
773  }
774  bio = BIO_new(bio_method);
775 
776  if (bio == NULL)
777  {
778  SSLerr(SSL_F_SSL_SET_FD, ERR_R_BUF_LIB);
779  goto err;
780  }
781  BIO_set_data(bio, port);
782 
783  BIO_set_fd(bio, fd, BIO_NOCLOSE);
784  SSL_set_bio(port->ssl, bio, bio);
785  ret = 1;
786 err:
787  return ret;
788 }
#define BIO_set_data(bio, data)
static BIO_METHOD * my_BIO_s_socket(void)
static int fd(const char *x, int i)
Definition: preproc-init.c:105

◆ ssl_external_passwd_cb()

static int ssl_external_passwd_cb ( char *  buf,
int  size,
int  rwflag,
void *  userdata 
)
static

Definition at line 883 of file be-secure-openssl.c.

References Assert, run_ssl_passphrase_command(), and ssl_is_server_start.

Referenced by be_tls_init().

884 {
885  /* same prompt as OpenSSL uses internally */
886  const char *prompt = "Enter PEM pass phrase:";
887 
888  Assert(rwflag == 0);
889 
890  return run_ssl_passphrase_command(prompt, ssl_is_server_start, buf, size);
891 }
static char * buf
Definition: pg_test_fsync.c:67
static bool ssl_is_server_start
#define Assert(condition)
Definition: c.h:739
int run_ssl_passphrase_command(const char *prompt, bool is_server_start, char *buf, int size)

◆ ssl_protocol_version_to_openssl()

static int ssl_protocol_version_to_openssl ( int  v,
const char *  guc_name,
int  loglevel 
)
static

Definition at line 1279 of file be-secure-openssl.c.

References ereport, errmsg(), GetConfigOption(), PG_TLS1_1_VERSION, PG_TLS1_2_VERSION, PG_TLS1_3_VERSION, PG_TLS1_VERSION, and PG_TLS_ANY.

Referenced by be_tls_init().

1280 {
1281  switch (v)
1282  {
1283  case PG_TLS_ANY:
1284  return 0;
1285  case PG_TLS1_VERSION:
1286  return TLS1_VERSION;
1287  case PG_TLS1_1_VERSION:
1288 #ifdef TLS1_1_VERSION
1289  return TLS1_1_VERSION;
1290 #else
1291  break;
1292 #endif
1293  case PG_TLS1_2_VERSION:
1294 #ifdef TLS1_2_VERSION
1295  return TLS1_2_VERSION;
1296 #else
1297  break;
1298 #endif
1299  case PG_TLS1_3_VERSION:
1300 #ifdef TLS1_3_VERSION
1301  return TLS1_3_VERSION;
1302 #else
1303  break;
1304 #endif
1305  }
1306 
1307  ereport(loglevel,
1308  (errmsg("%s setting %s not supported by this build",
1309  guc_name,
1310  GetConfigOption(guc_name, false, false))));
1311  return -1;
1312 }
const char * GetConfigOption(const char *name, bool missing_ok, bool restrict_privileged)
Definition: guc.c:7587
#define ereport(elevel, rest)
Definition: elog.h:141
int errmsg(const char *fmt,...)
Definition: elog.c:822

◆ SSLerrmessage()

static const char * SSLerrmessage ( unsigned long  ecode)
static

Definition at line 1068 of file be-secure-openssl.c.

References _, and snprintf.

Referenced by be_tls_init(), be_tls_open_server(), be_tls_read(), be_tls_write(), initialize_dh(), load_dh_buffer(), and load_dh_file().

1069 {
1070  const char *errreason;
1071  static char errbuf[36];
1072 
1073  if (ecode == 0)
1074  return _("no SSL error reported");
1075  errreason = ERR_reason_error_string(ecode);
1076  if (errreason != NULL)
1077  return errreason;
1078  snprintf(errbuf, sizeof(errbuf), _("SSL error code %lu"), ecode);
1079  return errbuf;
1080 }
#define snprintf
Definition: port.h:192
#define _(x)
Definition: elog.c:87

◆ verify_cb()

static int verify_cb ( int  ok,
X509_STORE_CTX *  ctx 
)
static

Definition at line 925 of file be-secure-openssl.c.

Referenced by be_tls_init().

926 {
927  return ok;
928 }

◆ X509_NAME_to_cstring()

static char * X509_NAME_to_cstring ( X509_NAME *  name)
static

Definition at line 1223 of file be-secure-openssl.c.

References i, pfree(), pg_any_to_server(), PG_UTF8, and pstrdup().

Referenced by be_tls_get_peer_issuer_name(), and be_tls_get_peer_subject_name().

1224 {
1225  BIO *membuf = BIO_new(BIO_s_mem());
1226  int i,
1227  nid,
1228  count = X509_NAME_entry_count(name);
1229  X509_NAME_ENTRY *e;
1230  ASN1_STRING *v;
1231  const char *field_name;
1232  size_t size;
1233  char nullterm;
1234  char *sp;
1235  char *dp;
1236  char *result;
1237 
1238  (void) BIO_set_close(membuf, BIO_CLOSE);
1239  for (i = 0; i < count; i++)
1240  {
1241  e = X509_NAME_get_entry(name, i);
1242  nid = OBJ_obj2nid(X509_NAME_ENTRY_get_object(e));
1243  v = X509_NAME_ENTRY_get_data(e);
1244  field_name = OBJ_nid2sn(nid);
1245  if (!field_name)
1246  field_name = OBJ_nid2ln(nid);
1247  BIO_printf(membuf, "/%s=", field_name);
1248  ASN1_STRING_print_ex(membuf, v,
1249  ((ASN1_STRFLGS_RFC2253 & ~ASN1_STRFLGS_ESC_MSB)
1250  | ASN1_STRFLGS_UTF8_CONVERT));
1251  }
1252 
1253  /* ensure null termination of the BIO's content */
1254  nullterm = '\0';
1255  BIO_write(membuf, &nullterm, 1);
1256  size = BIO_get_mem_data(membuf, &sp);
1257  dp = pg_any_to_server(sp, size - 1, PG_UTF8);
1258 
1259  result = pstrdup(dp);
1260  if (dp != sp)
1261  pfree(dp);
1262  BIO_free(membuf);
1263 
1264  return result;
1265 }
char * pstrdup(const char *in)
Definition: mcxt.c:1186
void pfree(void *pointer)
Definition: mcxt.c:1056
const char * name
Definition: encode.c:521
e
Definition: preproc-init.c:82
int i
char * pg_any_to_server(const char *s, int len, int encoding)
Definition: mbutils.c:581

Variable Documentation

◆ dummy_ssl_passwd_cb_called

bool dummy_ssl_passwd_cb_called = false
static

Definition at line 68 of file be-secure-openssl.c.

Referenced by be_tls_init(), and dummy_ssl_passwd_cb().

◆ my_bio_methods

BIO_METHOD* my_bio_methods = NULL
static

Definition at line 677 of file be-secure-openssl.c.

Referenced by my_BIO_s_socket().

◆ SSL_context

SSL_CTX* SSL_context = NULL
static

◆ SSL_initialized

bool SSL_initialized = false
static

Definition at line 67 of file be-secure-openssl.c.

Referenced by be_tls_init().

◆ ssl_is_server_start

bool ssl_is_server_start
static

Definition at line 69 of file be-secure-openssl.c.

Referenced by be_tls_init(), and ssl_external_passwd_cb().