PostgreSQL Source Code  git master
be-secure-openssl.c File Reference
#include "postgres.h"
#include <sys/stat.h>
#include <signal.h>
#include <fcntl.h>
#include <ctype.h>
#include <sys/socket.h>
#include <unistd.h>
#include <netdb.h>
#include <netinet/in.h>
#include <openssl/ssl.h>
#include <openssl/dh.h>
#include <openssl/conf.h>
#include <openssl/ec.h>
#include "common/openssl.h"
#include "libpq/libpq.h"
#include "miscadmin.h"
#include "pgstat.h"
#include "storage/fd.h"
#include "storage/latch.h"
#include "tcop/tcopprot.h"
#include "utils/memutils.h"
Include dependency graph for be-secure-openssl.c:

Go to the source code of this file.

Macros

#define BIO_get_data(bio)   (bio->ptr)
 
#define BIO_set_data(bio, data)   (bio->ptr = data)
 

Functions

static void default_openssl_tls_init (SSL_CTX *context, bool isServerStart)
 
static int my_sock_read (BIO *h, char *buf, int size)
 
static int my_sock_write (BIO *h, const char *buf, int size)
 
static BIO_METHOD * my_BIO_s_socket (void)
 
static int my_SSL_set_fd (Port *port, int fd)
 
static DH * load_dh_file (char *filename, bool isServerStart)
 
static DH * load_dh_buffer (const char *, size_t)
 
static int ssl_external_passwd_cb (char *buf, int size, int rwflag, void *userdata)
 
static int dummy_ssl_passwd_cb (char *buf, int size, int rwflag, void *userdata)
 
static int verify_cb (int, X509_STORE_CTX *)
 
static void info_cb (const SSL *ssl, int type, int args)
 
static bool initialize_dh (SSL_CTX *context, bool isServerStart)
 
static bool initialize_ecdh (SSL_CTX *context, bool isServerStart)
 
static const char * SSLerrmessage (unsigned long ecode)
 
static char * X509_NAME_to_cstring (X509_NAME *name)
 
static int ssl_protocol_version_to_openssl (int v)
 
static const char * ssl_protocol_version_to_string (int v)
 
int be_tls_init (bool isServerStart)
 
void be_tls_destroy (void)
 
int be_tls_open_server (Port *port)
 
void be_tls_close (Port *port)
 
ssize_t be_tls_read (Port *port, void *ptr, size_t len, int *waitfor)
 
ssize_t be_tls_write (Port *port, void *ptr, size_t len, int *waitfor)
 
int be_tls_get_cipher_bits (Port *port)
 
bool be_tls_get_compression (Port *port)
 
const char * be_tls_get_version (Port *port)
 
const char * be_tls_get_cipher (Port *port)
 
void be_tls_get_peer_subject_name (Port *port, char *ptr, size_t len)
 
void be_tls_get_peer_issuer_name (Port *port, char *ptr, size_t len)
 
void be_tls_get_peer_serial (Port *port, char *ptr, size_t len)
 

Variables

openssl_tls_init_hook_typ openssl_tls_init_hook = default_openssl_tls_init
 
static SSL_CTX * SSL_context = NULL
 
static bool SSL_initialized = false
 
static bool dummy_ssl_passwd_cb_called = false
 
static bool ssl_is_server_start
 
static BIO_METHOD * my_bio_methods = NULL
 

Macro Definition Documentation

◆ BIO_get_data

#define BIO_get_data (   bio)    (bio->ptr)

Definition at line 735 of file be-secure-openssl.c.

Referenced by my_sock_read(), and my_sock_write().

◆ BIO_set_data

#define BIO_set_data (   bio,
  data 
)    (bio->ptr = data)

Definition at line 736 of file be-secure-openssl.c.

Referenced by my_SSL_set_fd().

Function Documentation

◆ be_tls_close()

void be_tls_close ( Port port)

Definition at line 570 of file be-secure-openssl.c.

References Port::peer_cn, pfree(), and Port::ssl_in_use.

Referenced by secure_close().

571 {
572  if (port->ssl)
573  {
574  SSL_shutdown(port->ssl);
575  SSL_free(port->ssl);
576  port->ssl = NULL;
577  port->ssl_in_use = false;
578  }
579 
580  if (port->peer)
581  {
582  X509_free(port->peer);
583  port->peer = NULL;
584  }
585 
586  if (port->peer_cn)
587  {
588  pfree(port->peer_cn);
589  port->peer_cn = NULL;
590  }
591 }
char * peer_cn
Definition: libpq-be.h:191
bool ssl_in_use
Definition: libpq-be.h:190
void pfree(void *pointer)
Definition: mcxt.c:1056

◆ be_tls_destroy()

void be_tls_destroy ( void  )

Definition at line 354 of file be-secure-openssl.c.

References SSL_context.

Referenced by secure_destroy().

355 {
356  if (SSL_context)
357  SSL_CTX_free(SSL_context);
358  SSL_context = NULL;
359  ssl_loaded_verify_locations = false;
360 }
static SSL_CTX * SSL_context

◆ be_tls_get_cipher()

const char* be_tls_get_cipher ( Port port)

Definition at line 1178 of file be-secure-openssl.c.

Referenced by PerformAuthentication(), and pgstat_bestart().

1179 {
1180  if (port->ssl)
1181  return SSL_get_cipher(port->ssl);
1182  else
1183  return NULL;
1184 }

◆ be_tls_get_cipher_bits()

int be_tls_get_cipher_bits ( Port port)

Definition at line 1146 of file be-secure-openssl.c.

Referenced by PerformAuthentication(), and pgstat_bestart().

1147 {
1148  int bits;
1149 
1150  if (port->ssl)
1151  {
1152  SSL_get_cipher_bits(port->ssl, &bits);
1153  return bits;
1154  }
1155  else
1156  return 0;
1157 }

◆ be_tls_get_compression()

bool be_tls_get_compression ( Port port)

Definition at line 1160 of file be-secure-openssl.c.

Referenced by PerformAuthentication(), and pgstat_bestart().

1161 {
1162  if (port->ssl)
1163  return (SSL_get_current_compression(port->ssl) != NULL);
1164  else
1165  return false;
1166 }

◆ be_tls_get_peer_issuer_name()

void be_tls_get_peer_issuer_name ( Port port,
char *  ptr,
size_t  len 
)

Definition at line 1196 of file be-secure-openssl.c.

References strlcpy(), and X509_NAME_to_cstring().

Referenced by pgstat_bestart().

1197 {
1198  if (port->peer)
1199  strlcpy(ptr, X509_NAME_to_cstring(X509_get_issuer_name(port->peer)), len);
1200  else
1201  ptr[0] = '\0';
1202 }
static char * X509_NAME_to_cstring(X509_NAME *name)
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: strlcpy.c:45

◆ be_tls_get_peer_serial()

void be_tls_get_peer_serial ( Port port,
char *  ptr,
size_t  len 
)

Definition at line 1205 of file be-secure-openssl.c.

References elog, ERROR, hash(), palloc(), port, and strlcpy().

Referenced by pgstat_bestart().

1206 {
1207  if (port->peer)
1208  {
1209  ASN1_INTEGER *serial;
1210  BIGNUM *b;
1211  char *decimal;
1212 
1213  serial = X509_get_serialNumber(port->peer);
1214  b = ASN1_INTEGER_to_BN(serial, NULL);
1215  decimal = BN_bn2dec(b);
1216 
1217  BN_free(b);
1218  strlcpy(ptr, decimal, len);
1219  OPENSSL_free(decimal);
1220  }
1221  else
1222  ptr[0] = '\0';
1223 }
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: strlcpy.c:45

◆ be_tls_get_peer_subject_name()

void be_tls_get_peer_subject_name ( Port port,
char *  ptr,
size_t  len 
)

Definition at line 1187 of file be-secure-openssl.c.

References strlcpy(), and X509_NAME_to_cstring().

Referenced by pgstat_bestart().

1188 {
1189  if (port->peer)
1190  strlcpy(ptr, X509_NAME_to_cstring(X509_get_subject_name(port->peer)), len);
1191  else
1192  ptr[0] = '\0';
1193 }
static char * X509_NAME_to_cstring(X509_NAME *name)
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: strlcpy.c:45

◆ be_tls_get_version()

const char* be_tls_get_version ( Port port)

Definition at line 1169 of file be-secure-openssl.c.

Referenced by PerformAuthentication(), and pgstat_bestart().

1170 {
1171  if (port->ssl)
1172  return SSL_get_version(port->ssl);
1173  else
1174  return NULL;
1175 }

◆ be_tls_init()

int be_tls_init ( bool  isServerStart)

Definition at line 82 of file be-secure-openssl.c.

References check_ssl_key_file_permissions(), dummy_ssl_passwd_cb_called, ereport, errcode(), errdetail(), errmsg(), error(), FATAL, GetConfigOption(), initialize_dh(), initialize_ecdh(), LOG, ssl_ca_file, ssl_cert_file, SSL_context, ssl_crl_file, SSL_CTX_set_max_proto_version(), SSL_CTX_set_min_proto_version(), SSL_initialized, ssl_is_server_start, ssl_key_file, ssl_max_protocol_version, ssl_min_protocol_version, ssl_protocol_version_to_openssl(), SSLCipherSuites, SSLerrmessage(), SSLPreferServerCiphers, and verify_cb().

Referenced by secure_initialize().

83 {
84  STACK_OF(X509_NAME) * root_cert_list = NULL;
85  SSL_CTX *context;
86  int ssl_ver_min = -1;
87  int ssl_ver_max = -1;
88 
89  /* This stuff need be done only once. */
90  if (!SSL_initialized)
91  {
92 #ifdef HAVE_OPENSSL_INIT_SSL
93  OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG, NULL);
94 #else
95  OPENSSL_config(NULL);
96  SSL_library_init();
97  SSL_load_error_strings();
98 #endif
99  SSL_initialized = true;
100  }
101 
102  /*
103  * We use SSLv23_method() because it can negotiate use of the highest
104  * mutually supported protocol version, while alternatives like
105  * TLSv1_2_method() permit only one specific version. Note that we don't
106  * actually allow SSL v2 or v3, only TLS protocols (see below).
107  */
108  context = SSL_CTX_new(SSLv23_method());
109  if (!context)
110  {
111  ereport(isServerStart ? FATAL : LOG,
112  (errmsg("could not create SSL context: %s",
113  SSLerrmessage(ERR_get_error()))));
114  goto error;
115  }
116 
117  /*
118  * Disable OpenSSL's moving-write-buffer sanity check, because it causes
119  * unnecessary failures in nonblocking send cases.
120  */
121  SSL_CTX_set_mode(context, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
122 
123  /*
124  * Call init hook (usually to set password callback)
125  */
126  (*openssl_tls_init_hook) (context, isServerStart);
127 
128  /* used by the callback */
129  ssl_is_server_start = isServerStart;
130 
131  /*
132  * Load and verify server's certificate and private key
133  */
134  if (SSL_CTX_use_certificate_chain_file(context, ssl_cert_file) != 1)
135  {
136  ereport(isServerStart ? FATAL : LOG,
137  (errcode(ERRCODE_CONFIG_FILE_ERROR),
138  errmsg("could not load server certificate file \"%s\": %s",
139  ssl_cert_file, SSLerrmessage(ERR_get_error()))));
140  goto error;
141  }
142 
143  if (!check_ssl_key_file_permissions(ssl_key_file, isServerStart))
144  goto error;
145 
146  /*
147  * OK, try to load the private key file.
148  */
150 
151  if (SSL_CTX_use_PrivateKey_file(context,
152  ssl_key_file,
153  SSL_FILETYPE_PEM) != 1)
154  {
156  ereport(isServerStart ? FATAL : LOG,
157  (errcode(ERRCODE_CONFIG_FILE_ERROR),
158  errmsg("private key file \"%s\" cannot be reloaded because it requires a passphrase",
159  ssl_key_file)));
160  else
161  ereport(isServerStart ? FATAL : LOG,
162  (errcode(ERRCODE_CONFIG_FILE_ERROR),
163  errmsg("could not load private key file \"%s\": %s",
164  ssl_key_file, SSLerrmessage(ERR_get_error()))));
165  goto error;
166  }
167 
168  if (SSL_CTX_check_private_key(context) != 1)
169  {
170  ereport(isServerStart ? FATAL : LOG,
171  (errcode(ERRCODE_CONFIG_FILE_ERROR),
172  errmsg("check of private key failed: %s",
173  SSLerrmessage(ERR_get_error()))));
174  goto error;
175  }
176 
178  {
180 
181  if (ssl_ver_min == -1)
182  {
183  ereport(isServerStart ? FATAL : LOG,
184  (errmsg("\"%s\" setting \"%s\" not supported by this build",
185  "ssl_min_protocol_version",
186  GetConfigOption("ssl_min_protocol_version",
187  false, false))));
188  goto error;
189  }
190 
191  if (!SSL_CTX_set_min_proto_version(context, ssl_ver_min))
192  {
193  ereport(isServerStart ? FATAL : LOG,
194  (errmsg("could not set minimum SSL protocol version")));
195  goto error;
196  }
197  }
198 
200  {
202 
203  if (ssl_ver_max == -1)
204  {
205  ereport(isServerStart ? FATAL : LOG,
206  (errmsg("\"%s\" setting \"%s\" not supported by this build",
207  "ssl_max_protocol_version",
208  GetConfigOption("ssl_max_protocol_version",
209  false, false))));
210  goto error;
211  }
212 
213  if (!SSL_CTX_set_max_proto_version(context, ssl_ver_max))
214  {
215  ereport(isServerStart ? FATAL : LOG,
216  (errmsg("could not set maximum SSL protocol version")));
217  goto error;
218  }
219  }
220 
221  /* Check compatibility of min/max protocols */
224  {
225  /*
226  * No need to check for invalid values (-1) for each protocol number
227  * as the code above would have already generated an error.
228  */
229  if (ssl_ver_min > ssl_ver_max)
230  {
231  ereport(isServerStart ? FATAL : LOG,
232  (errmsg("could not set SSL protocol version range"),
233  errdetail("\"%s\" cannot be higher than \"%s\"",
234  "ssl_min_protocol_version",
235  "ssl_max_protocol_version")));
236  goto error;
237  }
238  }
239 
240  /* disallow SSL session tickets */
241  SSL_CTX_set_options(context, SSL_OP_NO_TICKET);
242 
243  /* disallow SSL session caching, too */
244  SSL_CTX_set_session_cache_mode(context, SSL_SESS_CACHE_OFF);
245 
246  /* set up ephemeral DH and ECDH keys */
247  if (!initialize_dh(context, isServerStart))
248  goto error;
249  if (!initialize_ecdh(context, isServerStart))
250  goto error;
251 
252  /* set up the allowed cipher list */
253  if (SSL_CTX_set_cipher_list(context, SSLCipherSuites) != 1)
254  {
255  ereport(isServerStart ? FATAL : LOG,
256  (errcode(ERRCODE_CONFIG_FILE_ERROR),
257  errmsg("could not set the cipher list (no valid ciphers available)")));
258  goto error;
259  }
260 
261  /* Let server choose order */
263  SSL_CTX_set_options(context, SSL_OP_CIPHER_SERVER_PREFERENCE);
264 
265  /*
266  * Load CA store, so we can verify client certificates if needed.
267  */
268  if (ssl_ca_file[0])
269  {
270  if (SSL_CTX_load_verify_locations(context, ssl_ca_file, NULL) != 1 ||
271  (root_cert_list = SSL_load_client_CA_file(ssl_ca_file)) == NULL)
272  {
273  ereport(isServerStart ? FATAL : LOG,
274  (errcode(ERRCODE_CONFIG_FILE_ERROR),
275  errmsg("could not load root certificate file \"%s\": %s",
276  ssl_ca_file, SSLerrmessage(ERR_get_error()))));
277  goto error;
278  }
279  }
280 
281  /*----------
282  * Load the Certificate Revocation List (CRL).
283  * http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci803160,00.html
284  *----------
285  */
286  if (ssl_crl_file[0])
287  {
288  X509_STORE *cvstore = SSL_CTX_get_cert_store(context);
289 
290  if (cvstore)
291  {
292  /* Set the flags to check against the complete CRL chain */
293  if (X509_STORE_load_locations(cvstore, ssl_crl_file, NULL) == 1)
294  {
295  X509_STORE_set_flags(cvstore,
296  X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
297  }
298  else
299  {
300  ereport(isServerStart ? FATAL : LOG,
301  (errcode(ERRCODE_CONFIG_FILE_ERROR),
302  errmsg("could not load SSL certificate revocation list file \"%s\": %s",
303  ssl_crl_file, SSLerrmessage(ERR_get_error()))));
304  goto error;
305  }
306  }
307  }
308 
309  if (ssl_ca_file[0])
310  {
311  /*
312  * Always ask for SSL client cert, but don't fail if it's not
313  * presented. We might fail such connections later, depending on what
314  * we find in pg_hba.conf.
315  */
316  SSL_CTX_set_verify(context,
317  (SSL_VERIFY_PEER |
318  SSL_VERIFY_CLIENT_ONCE),
319  verify_cb);
320 
321  /*
322  * Tell OpenSSL to send the list of root certs we trust to clients in
323  * CertificateRequests. This lets a client with a keystore select the
324  * appropriate client certificate to send to us.
325  */
326  SSL_CTX_set_client_CA_list(context, root_cert_list);
327  }
328 
329  /*
330  * Success! Replace any existing SSL_context.
331  */
332  if (SSL_context)
333  SSL_CTX_free(SSL_context);
334 
335  SSL_context = context;
336 
337  /*
338  * Set flag to remember whether CA store has been loaded into SSL_context.
339  */
340  if (ssl_ca_file[0])
341  ssl_loaded_verify_locations = true;
342  else
343  ssl_loaded_verify_locations = false;
344 
345  return 0;
346 
347 error:
348  if (context)
349  SSL_CTX_free(context);
350  return -1;
351 }
static int ssl_protocol_version_to_openssl(int v)
static void error(void)
Definition: sql-dyntest.c:147
static bool dummy_ssl_passwd_cb_called
const char * GetConfigOption(const char *name, bool missing_ok, bool restrict_privileged)
Definition: guc.c:7738
int errcode(int sqlerrcode)
Definition: elog.c:610
char * ssl_cert_file
Definition: be-secure.c:41
static bool initialize_ecdh(SSL_CTX *context, bool isServerStart)
#define LOG
Definition: elog.h:26
char * ssl_crl_file
Definition: be-secure.c:44
int ssl_min_protocol_version
Definition: be-secure.c:62
#define FATAL
Definition: elog.h:52
int errdetail(const char *fmt,...)
Definition: elog.c:957
static bool SSL_initialized
char * SSLCipherSuites
Definition: be-secure.c:54
static int verify_cb(int, X509_STORE_CTX *)
static bool ssl_is_server_start
static bool initialize_dh(SSL_CTX *context, bool isServerStart)
char * ssl_ca_file
Definition: be-secure.c:43
#define ereport(elevel,...)
Definition: elog.h:144
int SSL_CTX_set_min_proto_version(SSL_CTX *ctx, int version)
int ssl_max_protocol_version
Definition: be-secure.c:63
int errmsg(const char *fmt,...)
Definition: elog.c:824
static SSL_CTX * SSL_context
static const char * SSLerrmessage(unsigned long ecode)
int SSL_CTX_set_max_proto_version(SSL_CTX *ctx, int version)
char * ssl_key_file
Definition: be-secure.c:42
bool SSLPreferServerCiphers
Definition: be-secure.c:60
bool check_ssl_key_file_permissions(const char *ssl_key_file, bool isServerStart)

◆ be_tls_open_server()

int be_tls_open_server ( Port port)

Definition at line 363 of file be-secure-openssl.c.

References Assert, COMMERROR, ereport, errcode(), errcode_for_socket_access(), errhint(), errmsg(), info_cb(), MemoryContextAlloc(), my_SSL_set_fd(), MyLatch, Port::noblock, Port::peer_cert_valid, Port::peer_cn, pfree(), Port::sock, SSL_context, Port::ssl_in_use, ssl_max_protocol_version, ssl_min_protocol_version, ssl_protocol_version_to_string(), SSLerrmessage(), TopMemoryContext, WAIT_EVENT_SSL_OPEN_SERVER, WaitLatchOrSocket(), WL_EXIT_ON_PM_DEATH, WL_SOCKET_READABLE, and WL_SOCKET_WRITEABLE.

Referenced by secure_open_server().

364 {
365  int r;
366  int err;
367  int waitfor;
368  unsigned long ecode;
369  bool give_proto_hint;
370 
371  Assert(!port->ssl);
372  Assert(!port->peer);
373 
374  if (!SSL_context)
375  {
377  (errcode(ERRCODE_PROTOCOL_VIOLATION),
378  errmsg("could not initialize SSL connection: SSL context not set up")));
379  return -1;
380  }
381 
382  if (!(port->ssl = SSL_new(SSL_context)))
383  {
385  (errcode(ERRCODE_PROTOCOL_VIOLATION),
386  errmsg("could not initialize SSL connection: %s",
387  SSLerrmessage(ERR_get_error()))));
388  return -1;
389  }
390  if (!my_SSL_set_fd(port, port->sock))
391  {
393  (errcode(ERRCODE_PROTOCOL_VIOLATION),
394  errmsg("could not set SSL socket: %s",
395  SSLerrmessage(ERR_get_error()))));
396  return -1;
397  }
398  port->ssl_in_use = true;
399 
400 aloop:
401 
402  /*
403  * Prepare to call SSL_get_error() by clearing thread's OpenSSL error
404  * queue. In general, the current thread's error queue must be empty
405  * before the TLS/SSL I/O operation is attempted, or SSL_get_error() will
406  * not work reliably. An extension may have failed to clear the
407  * per-thread error queue following another call to an OpenSSL I/O
408  * routine.
409  */
410  ERR_clear_error();
411  r = SSL_accept(port->ssl);
412  if (r <= 0)
413  {
414  err = SSL_get_error(port->ssl, r);
415 
416  /*
417  * Other clients of OpenSSL in the backend may fail to call
418  * ERR_get_error(), but we always do, so as to not cause problems for
419  * OpenSSL clients that don't call ERR_clear_error() defensively. Be
420  * sure that this happens by calling now. SSL_get_error() relies on
421  * the OpenSSL per-thread error queue being intact, so this is the
422  * earliest possible point ERR_get_error() may be called.
423  */
424  ecode = ERR_get_error();
425  switch (err)
426  {
427  case SSL_ERROR_WANT_READ:
428  case SSL_ERROR_WANT_WRITE:
429  /* not allowed during connection establishment */
430  Assert(!port->noblock);
431 
432  /*
433  * No need to care about timeouts/interrupts here. At this
434  * point authentication_timeout still employs
435  * StartupPacketTimeoutHandler() which directly exits.
436  */
437  if (err == SSL_ERROR_WANT_READ)
439  else
441 
442  (void) WaitLatchOrSocket(MyLatch, waitfor, port->sock, 0,
444  goto aloop;
445  case SSL_ERROR_SYSCALL:
446  if (r < 0)
449  errmsg("could not accept SSL connection: %m")));
450  else
452  (errcode(ERRCODE_PROTOCOL_VIOLATION),
453  errmsg("could not accept SSL connection: EOF detected")));
454  break;
455  case SSL_ERROR_SSL:
456  switch (ERR_GET_REASON(ecode))
457  {
458  /*
459  * UNSUPPORTED_PROTOCOL, WRONG_VERSION_NUMBER, and
460  * TLSV1_ALERT_PROTOCOL_VERSION have been observed
461  * when trying to communicate with an old OpenSSL
462  * library, or when the client and server specify
463  * disjoint protocol ranges. NO_PROTOCOLS_AVAILABLE
464  * occurs if there's a local misconfiguration (which
465  * can happen despite our checks, if openssl.cnf
466  * injects a limit we didn't account for). It's not
467  * very clear what would make OpenSSL return the other
468  * codes listed here, but a hint about protocol
469  * versions seems like it's appropriate for all.
470  */
471  case SSL_R_NO_PROTOCOLS_AVAILABLE:
472  case SSL_R_UNSUPPORTED_PROTOCOL:
473  case SSL_R_BAD_PROTOCOL_VERSION_NUMBER:
474  case SSL_R_UNKNOWN_PROTOCOL:
475  case SSL_R_UNKNOWN_SSL_VERSION:
476  case SSL_R_UNSUPPORTED_SSL_VERSION:
477  case SSL_R_WRONG_SSL_VERSION:
478  case SSL_R_WRONG_VERSION_NUMBER:
479  case SSL_R_TLSV1_ALERT_PROTOCOL_VERSION:
480 #ifdef SSL_R_VERSION_TOO_HIGH
481  case SSL_R_VERSION_TOO_HIGH:
482  case SSL_R_VERSION_TOO_LOW:
483 #endif
484  give_proto_hint = true;
485  break;
486  default:
487  give_proto_hint = false;
488  break;
489  }
491  (errcode(ERRCODE_PROTOCOL_VIOLATION),
492  errmsg("could not accept SSL connection: %s",
493  SSLerrmessage(ecode)),
494  give_proto_hint ?
495  errhint("This may indicate that the client does not support any SSL protocol version between %s and %s.",
498  MIN_OPENSSL_TLS_VERSION,
501  MAX_OPENSSL_TLS_VERSION) : 0));
502  break;
503  case SSL_ERROR_ZERO_RETURN:
505  (errcode(ERRCODE_PROTOCOL_VIOLATION),
506  errmsg("could not accept SSL connection: EOF detected")));
507  break;
508  default:
510  (errcode(ERRCODE_PROTOCOL_VIOLATION),
511  errmsg("unrecognized SSL error code: %d",
512  err)));
513  break;
514  }
515  return -1;
516  }
517 
518  /* Get client certificate, if available. */
519  port->peer = SSL_get_peer_certificate(port->ssl);
520 
521  /* and extract the Common Name from it. */
522  port->peer_cn = NULL;
523  port->peer_cert_valid = false;
524  if (port->peer != NULL)
525  {
526  int len;
527 
528  len = X509_NAME_get_text_by_NID(X509_get_subject_name(port->peer),
529  NID_commonName, NULL, 0);
530  if (len != -1)
531  {
532  char *peer_cn;
533 
534  peer_cn = MemoryContextAlloc(TopMemoryContext, len + 1);
535  r = X509_NAME_get_text_by_NID(X509_get_subject_name(port->peer),
536  NID_commonName, peer_cn, len + 1);
537  peer_cn[len] = '\0';
538  if (r != len)
539  {
540  /* shouldn't happen */
541  pfree(peer_cn);
542  return -1;
543  }
544 
545  /*
546  * Reject embedded NULLs in certificate common name to prevent
547  * attacks like CVE-2009-4034.
548  */
549  if (len != strlen(peer_cn))
550  {
552  (errcode(ERRCODE_PROTOCOL_VIOLATION),
553  errmsg("SSL certificate's common name contains embedded null")));
554  pfree(peer_cn);
555  return -1;
556  }
557 
558  port->peer_cn = peer_cn;
559  }
560  port->peer_cert_valid = true;
561  }
562 
563  /* set up debugging/info callback */
564  SSL_CTX_set_info_callback(SSL_context, info_cb);
565 
566  return 0;
567 }
#define WL_SOCKET_WRITEABLE
Definition: latch.h:126
int errhint(const char *fmt,...)
Definition: elog.c:1071
char * peer_cn
Definition: libpq-be.h:191
bool peer_cert_valid
Definition: libpq-be.h:192
static void info_cb(const SSL *ssl, int type, int args)
int errcode(int sqlerrcode)
Definition: elog.c:610
bool ssl_in_use
Definition: libpq-be.h:190
#define WL_SOCKET_READABLE
Definition: latch.h:125
pgsocket sock
Definition: libpq-be.h:122
int ssl_min_protocol_version
Definition: be-secure.c:62
void pfree(void *pointer)
Definition: mcxt.c:1056
static int my_SSL_set_fd(Port *port, int fd)
#define COMMERROR
Definition: elog.h:30
int WaitLatchOrSocket(Latch *latch, int wakeEvents, pgsocket sock, long timeout, uint32 wait_event_info)
Definition: latch.c:438
MemoryContext TopMemoryContext
Definition: mcxt.c:44
int errcode_for_socket_access(void)
Definition: elog.c:704
#define ereport(elevel,...)
Definition: elog.h:144
#define Assert(condition)
Definition: c.h:745
bool noblock
Definition: libpq-be.h:123
int ssl_max_protocol_version
Definition: be-secure.c:63
int errmsg(const char *fmt,...)
Definition: elog.c:824
static SSL_CTX * SSL_context
void * MemoryContextAlloc(MemoryContext context, Size size)
Definition: mcxt.c:796
static const char * SSLerrmessage(unsigned long ecode)
struct Latch * MyLatch
Definition: globals.c:54
static const char * ssl_protocol_version_to_string(int v)
#define WL_EXIT_ON_PM_DEATH
Definition: latch.h:129

◆ be_tls_read()

ssize_t be_tls_read ( Port port,
void *  ptr,
size_t  len,
int *  waitfor 
)

Definition at line 594 of file be-secure-openssl.c.

References COMMERROR, ECONNRESET, ereport, errcode(), errmsg(), EWOULDBLOCK, SSLerrmessage(), WL_SOCKET_READABLE, and WL_SOCKET_WRITEABLE.

Referenced by secure_read().

595 {
596  ssize_t n;
597  int err;
598  unsigned long ecode;
599 
600  errno = 0;
601  ERR_clear_error();
602  n = SSL_read(port->ssl, ptr, len);
603  err = SSL_get_error(port->ssl, n);
604  ecode = (err != SSL_ERROR_NONE || n < 0) ? ERR_get_error() : 0;
605  switch (err)
606  {
607  case SSL_ERROR_NONE:
608  /* a-ok */
609  break;
610  case SSL_ERROR_WANT_READ:
611  *waitfor = WL_SOCKET_READABLE;
612  errno = EWOULDBLOCK;
613  n = -1;
614  break;
615  case SSL_ERROR_WANT_WRITE:
616  *waitfor = WL_SOCKET_WRITEABLE;
617  errno = EWOULDBLOCK;
618  n = -1;
619  break;
620  case SSL_ERROR_SYSCALL:
621  /* leave it to caller to ereport the value of errno */
622  if (n != -1)
623  {
624  errno = ECONNRESET;
625  n = -1;
626  }
627  break;
628  case SSL_ERROR_SSL:
630  (errcode(ERRCODE_PROTOCOL_VIOLATION),
631  errmsg("SSL error: %s", SSLerrmessage(ecode))));
632  errno = ECONNRESET;
633  n = -1;
634  break;
635  case SSL_ERROR_ZERO_RETURN:
636  /* connection was cleanly shut down by peer */
637  n = 0;
638  break;
639  default:
641  (errcode(ERRCODE_PROTOCOL_VIOLATION),
642  errmsg("unrecognized SSL error code: %d",
643  err)));
644  errno = ECONNRESET;
645  n = -1;
646  break;
647  }
648 
649  return n;
650 }
#define WL_SOCKET_WRITEABLE
Definition: latch.h:126
int errcode(int sqlerrcode)
Definition: elog.c:610
#define WL_SOCKET_READABLE
Definition: latch.h:125
#define COMMERROR
Definition: elog.h:30
#define ereport(elevel,...)
Definition: elog.h:144
#define ECONNRESET
Definition: win32_port.h:333
int errmsg(const char *fmt,...)
Definition: elog.c:824
static const char * SSLerrmessage(unsigned long ecode)
#define EWOULDBLOCK
Definition: win32_port.h:329

◆ be_tls_write()

ssize_t be_tls_write ( Port port,
void *  ptr,
size_t  len,
int *  waitfor 
)

Definition at line 653 of file be-secure-openssl.c.

References COMMERROR, ECONNRESET, ereport, errcode(), errmsg(), EWOULDBLOCK, SSLerrmessage(), WL_SOCKET_READABLE, and WL_SOCKET_WRITEABLE.

Referenced by secure_write().

654 {
655  ssize_t n;
656  int err;
657  unsigned long ecode;
658 
659  errno = 0;
660  ERR_clear_error();
661  n = SSL_write(port->ssl, ptr, len);
662  err = SSL_get_error(port->ssl, n);
663  ecode = (err != SSL_ERROR_NONE || n < 0) ? ERR_get_error() : 0;
664  switch (err)
665  {
666  case SSL_ERROR_NONE:
667  /* a-ok */
668  break;
669  case SSL_ERROR_WANT_READ:
670  *waitfor = WL_SOCKET_READABLE;
671  errno = EWOULDBLOCK;
672  n = -1;
673  break;
674  case SSL_ERROR_WANT_WRITE:
675  *waitfor = WL_SOCKET_WRITEABLE;
676  errno = EWOULDBLOCK;
677  n = -1;
678  break;
679  case SSL_ERROR_SYSCALL:
680  /* leave it to caller to ereport the value of errno */
681  if (n != -1)
682  {
683  errno = ECONNRESET;
684  n = -1;
685  }
686  break;
687  case SSL_ERROR_SSL:
689  (errcode(ERRCODE_PROTOCOL_VIOLATION),
690  errmsg("SSL error: %s", SSLerrmessage(ecode))));
691  errno = ECONNRESET;
692  n = -1;
693  break;
694  case SSL_ERROR_ZERO_RETURN:
695 
696  /*
697  * the SSL connection was closed, leave it to the caller to
698  * ereport it
699  */
700  errno = ECONNRESET;
701  n = -1;
702  break;
703  default:
705  (errcode(ERRCODE_PROTOCOL_VIOLATION),
706  errmsg("unrecognized SSL error code: %d",
707  err)));
708  errno = ECONNRESET;
709  n = -1;
710  break;
711  }
712 
713  return n;
714 }
#define WL_SOCKET_WRITEABLE
Definition: latch.h:126
int errcode(int sqlerrcode)
Definition: elog.c:610
#define WL_SOCKET_READABLE
Definition: latch.h:125
#define COMMERROR
Definition: elog.h:30
#define ereport(elevel,...)
Definition: elog.h:144
#define ECONNRESET
Definition: win32_port.h:333
int errmsg(const char *fmt,...)
Definition: elog.c:824
static const char * SSLerrmessage(unsigned long ecode)
#define EWOULDBLOCK
Definition: win32_port.h:329

◆ default_openssl_tls_init()

static void default_openssl_tls_init ( SSL_CTX *  context,
bool  isServerStart 
)
static

Definition at line 1400 of file be-secure-openssl.c.

References dummy_ssl_passwd_cb(), ssl_external_passwd_cb(), ssl_passphrase_command, and ssl_passphrase_command_supports_reload.

1401 {
1402  if (isServerStart)
1403  {
1404  if (ssl_passphrase_command[0])
1405  SSL_CTX_set_default_passwd_cb(context, ssl_external_passwd_cb);
1406  }
1407  else
1408  {
1410  SSL_CTX_set_default_passwd_cb(context, ssl_external_passwd_cb);
1411  else
1412 
1413  /*
1414  * If reloading and no external command is configured, override
1415  * OpenSSL's default handling of passphrase-protected files,
1416  * because we don't want to prompt for a passphrase in an
1417  * already-running server.
1418  */
1419  SSL_CTX_set_default_passwd_cb(context, dummy_ssl_passwd_cb);
1420  }
1421 }
bool ssl_passphrase_command_supports_reload
Definition: be-secure.c:47
static int ssl_external_passwd_cb(char *buf, int size, int rwflag, void *userdata)
char * ssl_passphrase_command
Definition: be-secure.c:46
static int dummy_ssl_passwd_cb(char *buf, int size, int rwflag, void *userdata)

◆ dummy_ssl_passwd_cb()

static int dummy_ssl_passwd_cb ( char *  buf,
int  size,
int  rwflag,
void *  userdata 
)
static

Definition at line 966 of file be-secure-openssl.c.

References Assert, and dummy_ssl_passwd_cb_called.

Referenced by default_openssl_tls_init().

967 {
968  /* Set flag to change the error message we'll report */
970  /* And return empty string */
971  Assert(size > 0);
972  buf[0] = '\0';
973  return 0;
974 }
static bool dummy_ssl_passwd_cb_called
static char * buf
Definition: pg_test_fsync.c:67
#define Assert(condition)
Definition: c.h:745

◆ info_cb()

static void info_cb ( const SSL *  ssl,
int  type,
int  args 
)
static

Definition at line 998 of file be-secure-openssl.c.

References DEBUG4, ereport, and errmsg_internal().

Referenced by be_tls_open_server().

999 {
1000  switch (type)
1001  {
1002  case SSL_CB_HANDSHAKE_START:
1003  ereport(DEBUG4,
1004  (errmsg_internal("SSL: handshake start")));
1005  break;
1006  case SSL_CB_HANDSHAKE_DONE:
1007  ereport(DEBUG4,
1008  (errmsg_internal("SSL: handshake done")));
1009  break;
1010  case SSL_CB_ACCEPT_LOOP:
1011  ereport(DEBUG4,
1012  (errmsg_internal("SSL: accept loop")));
1013  break;
1014  case SSL_CB_ACCEPT_EXIT:
1015  ereport(DEBUG4,
1016  (errmsg_internal("SSL: accept exit (%d)", args)));
1017  break;
1018  case SSL_CB_CONNECT_LOOP:
1019  ereport(DEBUG4,
1020  (errmsg_internal("SSL: connect loop")));
1021  break;
1022  case SSL_CB_CONNECT_EXIT:
1023  ereport(DEBUG4,
1024  (errmsg_internal("SSL: connect exit (%d)", args)));
1025  break;
1026  case SSL_CB_READ_ALERT:
1027  ereport(DEBUG4,
1028  (errmsg_internal("SSL: read alert (0x%04x)", args)));
1029  break;
1030  case SSL_CB_WRITE_ALERT:
1031  ereport(DEBUG4,
1032  (errmsg_internal("SSL: write alert (0x%04x)", args)));
1033  break;
1034  }
1035 }
#define DEBUG4
Definition: elog.h:22
#define ereport(elevel,...)
Definition: elog.h:144
int errmsg_internal(const char *fmt,...)
Definition: elog.c:911

◆ initialize_dh()

static bool initialize_dh ( SSL_CTX *  context,
bool  isServerStart 
)
static

Definition at line 1051 of file be-secure-openssl.c.

References ereport, errcode(), errmsg(), FATAL, load_dh_buffer(), load_dh_file(), LOG, ssl_dh_params_file, and SSLerrmessage().

Referenced by be_tls_init().

1052 {
1053  DH *dh = NULL;
1054 
1055  SSL_CTX_set_options(context, SSL_OP_SINGLE_DH_USE);
1056 
1057  if (ssl_dh_params_file[0])
1058  dh = load_dh_file(ssl_dh_params_file, isServerStart);
1059  if (!dh)
1060  dh = load_dh_buffer(FILE_DH2048, sizeof(FILE_DH2048));
1061  if (!dh)
1062  {
1063  ereport(isServerStart ? FATAL : LOG,
1064  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1065  errmsg("DH: could not load DH parameters")));
1066  return false;
1067  }
1068 
1069  if (SSL_CTX_set_tmp_dh(context, dh) != 1)
1070  {
1071  ereport(isServerStart ? FATAL : LOG,
1072  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1073  errmsg("DH: could not set DH parameters: %s",
1074  SSLerrmessage(ERR_get_error()))));
1075  DH_free(dh);
1076  return false;
1077  }
1078 
1079  DH_free(dh);
1080  return true;
1081 }
static DH * load_dh_file(char *filename, bool isServerStart)
int errcode(int sqlerrcode)
Definition: elog.c:610
#define LOG
Definition: elog.h:26
#define FATAL
Definition: elog.h:52
static DH * load_dh_buffer(const char *, size_t)
#define ereport(elevel,...)
Definition: elog.h:144
char * ssl_dh_params_file
Definition: be-secure.c:45
int errmsg(const char *fmt,...)
Definition: elog.c:824
static const char * SSLerrmessage(unsigned long ecode)

◆ initialize_ecdh()

static bool initialize_ecdh ( SSL_CTX *  context,
bool  isServerStart 
)
static

Definition at line 1089 of file be-secure-openssl.c.

References ereport, errcode(), errmsg(), FATAL, LOG, and SSLECDHCurve.

Referenced by be_tls_init().

1090 {
1091 #ifndef OPENSSL_NO_ECDH
1092  EC_KEY *ecdh;
1093  int nid;
1094 
1095  nid = OBJ_sn2nid(SSLECDHCurve);
1096  if (!nid)
1097  {
1098  ereport(isServerStart ? FATAL : LOG,
1099  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1100  errmsg("ECDH: unrecognized curve name: %s", SSLECDHCurve)));
1101  return false;
1102  }
1103 
1104  ecdh = EC_KEY_new_by_curve_name(nid);
1105  if (!ecdh)
1106  {
1107  ereport(isServerStart ? FATAL : LOG,
1108  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1109  errmsg("ECDH: could not create key")));
1110  return false;
1111  }
1112 
1113  SSL_CTX_set_options(context, SSL_OP_SINGLE_ECDH_USE);
1114  SSL_CTX_set_tmp_ecdh(context, ecdh);
1115  EC_KEY_free(ecdh);
1116 #endif
1117 
1118  return true;
1119 }
int errcode(int sqlerrcode)
Definition: elog.c:610
#define LOG
Definition: elog.h:26
#define FATAL
Definition: elog.h:52
char * SSLECDHCurve
Definition: be-secure.c:57
#define ereport(elevel,...)
Definition: elog.h:144
int errmsg(const char *fmt,...)
Definition: elog.c:824

◆ load_dh_buffer()

static DH * load_dh_buffer ( const char *  buffer,
size_t  len 
)
static

Definition at line 924 of file be-secure-openssl.c.

References DEBUG2, ereport, errmsg_internal(), SSLerrmessage(), and unconstify.

Referenced by initialize_dh().

925 {
926  BIO *bio;
927  DH *dh = NULL;
928 
929  bio = BIO_new_mem_buf(unconstify(char *, buffer), len);
930  if (bio == NULL)
931  return NULL;
932  dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
933  if (dh == NULL)
934  ereport(DEBUG2,
935  (errmsg_internal("DH load buffer: %s",
936  SSLerrmessage(ERR_get_error()))));
937  BIO_free(bio);
938 
939  return dh;
940 }
#define DEBUG2
Definition: elog.h:24
#define unconstify(underlying_type, expr)
Definition: c.h:1212
#define ereport(elevel,...)
Definition: elog.h:144
int errmsg_internal(const char *fmt,...)
Definition: elog.c:911
static const char * SSLerrmessage(unsigned long ecode)

◆ load_dh_file()

static DH * load_dh_file ( char *  filename,
bool  isServerStart 
)
static

Definition at line 860 of file be-secure-openssl.c.

References AllocateFile(), ereport, errcode(), errcode_for_file_access(), errmsg(), FATAL, FreeFile(), LOG, and SSLerrmessage().

Referenced by initialize_dh().

861 {
862  FILE *fp;
863  DH *dh = NULL;
864  int codes;
865 
866  /* attempt to open file. It's not an error if it doesn't exist. */
867  if ((fp = AllocateFile(filename, "r")) == NULL)
868  {
869  ereport(isServerStart ? FATAL : LOG,
871  errmsg("could not open DH parameters file \"%s\": %m",
872  filename)));
873  return NULL;
874  }
875 
876  dh = PEM_read_DHparams(fp, NULL, NULL, NULL);
877  FreeFile(fp);
878 
879  if (dh == NULL)
880  {
881  ereport(isServerStart ? FATAL : LOG,
882  (errcode(ERRCODE_CONFIG_FILE_ERROR),
883  errmsg("could not load DH parameters file: %s",
884  SSLerrmessage(ERR_get_error()))));
885  return NULL;
886  }
887 
888  /* make sure the DH parameters are usable */
889  if (DH_check(dh, &codes) == 0)
890  {
891  ereport(isServerStart ? FATAL : LOG,
892  (errcode(ERRCODE_CONFIG_FILE_ERROR),
893  errmsg("invalid DH parameters: %s",
894  SSLerrmessage(ERR_get_error()))));
895  return NULL;
896  }
897  if (codes & DH_CHECK_P_NOT_PRIME)
898  {
899  ereport(isServerStart ? FATAL : LOG,
900  (errcode(ERRCODE_CONFIG_FILE_ERROR),
901  errmsg("invalid DH parameters: p is not prime")));
902  return NULL;
903  }
904  if ((codes & DH_NOT_SUITABLE_GENERATOR) &&
905  (codes & DH_CHECK_P_NOT_SAFE_PRIME))
906  {
907  ereport(isServerStart ? FATAL : LOG,
908  (errcode(ERRCODE_CONFIG_FILE_ERROR),
909  errmsg("invalid DH parameters: neither suitable generator or safe prime")));
910  return NULL;
911  }
912 
913  return dh;
914 }
int errcode(int sqlerrcode)
Definition: elog.c:610
#define LOG
Definition: elog.h:26
#define FATAL
Definition: elog.h:52
int errcode_for_file_access(void)
Definition: elog.c:633
FILE * AllocateFile(const char *name, const char *mode)
Definition: fd.c:2322
#define ereport(elevel,...)
Definition: elog.h:144
int FreeFile(FILE *file)
Definition: fd.c:2521
static char * filename
Definition: pg_dumpall.c:90
int errmsg(const char *fmt,...)
Definition: elog.c:824
static const char * SSLerrmessage(unsigned long ecode)

◆ my_BIO_s_socket()

static BIO_METHOD * my_BIO_s_socket ( void  )
static

Definition at line 783 of file be-secure-openssl.c.

References malloc, my_bio_methods, my_sock_read(), and my_sock_write().

Referenced by my_SSL_set_fd().

784 {
785  if (!my_bio_methods)
786  {
787  BIO_METHOD *biom = (BIO_METHOD *) BIO_s_socket();
788 #ifdef HAVE_BIO_METH_NEW
789  int my_bio_index;
790 
791  my_bio_index = BIO_get_new_index();
792  if (my_bio_index == -1)
793  return NULL;
794  my_bio_methods = BIO_meth_new(my_bio_index, "PostgreSQL backend socket");
795  if (!my_bio_methods)
796  return NULL;
797  if (!BIO_meth_set_write(my_bio_methods, my_sock_write) ||
798  !BIO_meth_set_read(my_bio_methods, my_sock_read) ||
799  !BIO_meth_set_gets(my_bio_methods, BIO_meth_get_gets(biom)) ||
800  !BIO_meth_set_puts(my_bio_methods, BIO_meth_get_puts(biom)) ||
801  !BIO_meth_set_ctrl(my_bio_methods, BIO_meth_get_ctrl(biom)) ||
802  !BIO_meth_set_create(my_bio_methods, BIO_meth_get_create(biom)) ||
803  !BIO_meth_set_destroy(my_bio_methods, BIO_meth_get_destroy(biom)) ||
804  !BIO_meth_set_callback_ctrl(my_bio_methods, BIO_meth_get_callback_ctrl(biom)))
805  {
806  BIO_meth_free(my_bio_methods);
807  my_bio_methods = NULL;
808  return NULL;
809  }
810 #else
811  my_bio_methods = malloc(sizeof(BIO_METHOD));
812  if (!my_bio_methods)
813  return NULL;
814  memcpy(my_bio_methods, biom, sizeof(BIO_METHOD));
815  my_bio_methods->bread = my_sock_read;
816  my_bio_methods->bwrite = my_sock_write;
817 #endif
818  }
819  return my_bio_methods;
820 }
#define malloc(a)
Definition: header.h:50
static BIO_METHOD * my_bio_methods
static int my_sock_read(BIO *h, char *buf, int size)
static int my_sock_write(BIO *h, const char *buf, int size)

◆ my_sock_read()

static int my_sock_read ( BIO *  h,
char *  buf,
int  size 
)
static

Definition at line 742 of file be-secure-openssl.c.

References BIO_get_data, EAGAIN, EINTR, EWOULDBLOCK, and secure_raw_read().

Referenced by my_BIO_s_socket().

743 {
744  int res = 0;
745 
746  if (buf != NULL)
747  {
748  res = secure_raw_read(((Port *) BIO_get_data(h)), buf, size);
749  BIO_clear_retry_flags(h);
750  if (res <= 0)
751  {
752  /* If we were interrupted, tell caller to retry */
753  if (errno == EINTR || errno == EWOULDBLOCK || errno == EAGAIN)
754  {
755  BIO_set_retry_read(h);
756  }
757  }
758  }
759 
760  return res;
761 }
#define EAGAIN
Definition: win32_port.h:321
#define BIO_get_data(bio)
Definition: libpq-be.h:120
static char * buf
Definition: pg_test_fsync.c:67
ssize_t secure_raw_read(Port *port, void *ptr, size_t len)
Definition: be-secure.c:234
#define EWOULDBLOCK
Definition: win32_port.h:329
#define EINTR
Definition: win32_port.h:323

◆ my_sock_write()

static int my_sock_write ( BIO *  h,
const char *  buf,
int  size 
)
static

Definition at line 764 of file be-secure-openssl.c.

References BIO_get_data, EAGAIN, EINTR, EWOULDBLOCK, and secure_raw_write().

Referenced by my_BIO_s_socket().

765 {
766  int res = 0;
767 
768  res = secure_raw_write(((Port *) BIO_get_data(h)), buf, size);
769  BIO_clear_retry_flags(h);
770  if (res <= 0)
771  {
772  /* If we were interrupted, tell caller to retry */
773  if (errno == EINTR || errno == EWOULDBLOCK || errno == EAGAIN)
774  {
775  BIO_set_retry_write(h);
776  }
777  }
778 
779  return res;
780 }
#define EAGAIN
Definition: win32_port.h:321
#define BIO_get_data(bio)
ssize_t secure_raw_write(Port *port, const void *ptr, size_t len)
Definition: be-secure.c:330
Definition: libpq-be.h:120
static char * buf
Definition: pg_test_fsync.c:67
#define EWOULDBLOCK
Definition: win32_port.h:329
#define EINTR
Definition: win32_port.h:323

◆ my_SSL_set_fd()

static int my_SSL_set_fd ( Port port,
int  fd 
)
static

Definition at line 824 of file be-secure-openssl.c.

References BIO_set_data, and my_BIO_s_socket().

Referenced by be_tls_open_server().

825 {
826  int ret = 0;
827  BIO *bio;
828  BIO_METHOD *bio_method;
829 
830  bio_method = my_BIO_s_socket();
831  if (bio_method == NULL)
832  {
833  SSLerr(SSL_F_SSL_SET_FD, ERR_R_BUF_LIB);
834  goto err;
835  }
836  bio = BIO_new(bio_method);
837 
838  if (bio == NULL)
839  {
840  SSLerr(SSL_F_SSL_SET_FD, ERR_R_BUF_LIB);
841  goto err;
842  }
843  BIO_set_data(bio, port);
844 
845  BIO_set_fd(bio, fd, BIO_NOCLOSE);
846  SSL_set_bio(port->ssl, bio, bio);
847  ret = 1;
848 err:
849  return ret;
850 }
#define BIO_set_data(bio, data)
static BIO_METHOD * my_BIO_s_socket(void)
static int fd(const char *x, int i)
Definition: preproc-init.c:105

◆ ssl_external_passwd_cb()

static int ssl_external_passwd_cb ( char *  buf,
int  size,
int  rwflag,
void *  userdata 
)
static

Definition at line 946 of file be-secure-openssl.c.

References Assert, run_ssl_passphrase_command(), and ssl_is_server_start.

Referenced by default_openssl_tls_init().

947 {
948  /* same prompt as OpenSSL uses internally */
949  const char *prompt = "Enter PEM pass phrase:";
950 
951  Assert(rwflag == 0);
952 
953  return run_ssl_passphrase_command(prompt, ssl_is_server_start, buf, size);
954 }
static char * buf
Definition: pg_test_fsync.c:67
static bool ssl_is_server_start
#define Assert(condition)
Definition: c.h:745
int run_ssl_passphrase_command(const char *prompt, bool is_server_start, char *buf, int size)

◆ ssl_protocol_version_to_openssl()

static int ssl_protocol_version_to_openssl ( int  v)
static

Definition at line 1344 of file be-secure-openssl.c.

References PG_TLS1_1_VERSION, PG_TLS1_2_VERSION, PG_TLS1_3_VERSION, PG_TLS1_VERSION, and PG_TLS_ANY.

Referenced by be_tls_init().

1345 {
1346  switch (v)
1347  {
1348  case PG_TLS_ANY:
1349  return 0;
1350  case PG_TLS1_VERSION:
1351  return TLS1_VERSION;
1352  case PG_TLS1_1_VERSION:
1353 #ifdef TLS1_1_VERSION
1354  return TLS1_1_VERSION;
1355 #else
1356  break;
1357 #endif
1358  case PG_TLS1_2_VERSION:
1359 #ifdef TLS1_2_VERSION
1360  return TLS1_2_VERSION;
1361 #else
1362  break;
1363 #endif
1364  case PG_TLS1_3_VERSION:
1365 #ifdef TLS1_3_VERSION
1366  return TLS1_3_VERSION;
1367 #else
1368  break;
1369 #endif
1370  }
1371 
1372  return -1;
1373 }

◆ ssl_protocol_version_to_string()

static const char * ssl_protocol_version_to_string ( int  v)
static

Definition at line 1379 of file be-secure-openssl.c.

References PG_TLS1_1_VERSION, PG_TLS1_2_VERSION, PG_TLS1_3_VERSION, PG_TLS1_VERSION, and PG_TLS_ANY.

Referenced by be_tls_open_server().

1380 {
1381  switch (v)
1382  {
1383  case PG_TLS_ANY:
1384  return "any";
1385  case PG_TLS1_VERSION:
1386  return "TLSv1";
1387  case PG_TLS1_1_VERSION:
1388  return "TLSv1.1";
1389  case PG_TLS1_2_VERSION:
1390  return "TLSv1.2";
1391  case PG_TLS1_3_VERSION:
1392  return "TLSv1.3";
1393  }
1394 
1395  return "(unrecognized)";
1396 }

◆ SSLerrmessage()

static const char * SSLerrmessage ( unsigned long  ecode)
static

Definition at line 1131 of file be-secure-openssl.c.

References _, and snprintf.

Referenced by be_tls_init(), be_tls_open_server(), be_tls_read(), be_tls_write(), initialize_dh(), load_dh_buffer(), and load_dh_file().

1132 {
1133  const char *errreason;
1134  static char errbuf[36];
1135 
1136  if (ecode == 0)
1137  return _("no SSL error reported");
1138  errreason = ERR_reason_error_string(ecode);
1139  if (errreason != NULL)
1140  return errreason;
1141  snprintf(errbuf, sizeof(errbuf), _("SSL error code %lu"), ecode);
1142  return errbuf;
1143 }
#define snprintf
Definition: port.h:193
#define _(x)
Definition: elog.c:88

◆ verify_cb()

static int verify_cb ( int  ok,
X509_STORE_CTX *  ctx 
)
static

Definition at line 988 of file be-secure-openssl.c.

Referenced by be_tls_init().

989 {
990  return ok;
991 }

◆ X509_NAME_to_cstring()

static char * X509_NAME_to_cstring ( X509_NAME *  name)
static

Definition at line 1286 of file be-secure-openssl.c.

References i, pfree(), pg_any_to_server(), PG_UTF8, and pstrdup().

Referenced by be_tls_get_peer_issuer_name(), and be_tls_get_peer_subject_name().

1287 {
1288  BIO *membuf = BIO_new(BIO_s_mem());
1289  int i,
1290  nid,
1291  count = X509_NAME_entry_count(name);
1292  X509_NAME_ENTRY *e;
1293  ASN1_STRING *v;
1294  const char *field_name;
1295  size_t size;
1296  char nullterm;
1297  char *sp;
1298  char *dp;
1299  char *result;
1300 
1301  (void) BIO_set_close(membuf, BIO_CLOSE);
1302  for (i = 0; i < count; i++)
1303  {
1304  e = X509_NAME_get_entry(name, i);
1305  nid = OBJ_obj2nid(X509_NAME_ENTRY_get_object(e));
1306  v = X509_NAME_ENTRY_get_data(e);
1307  field_name = OBJ_nid2sn(nid);
1308  if (!field_name)
1309  field_name = OBJ_nid2ln(nid);
1310  BIO_printf(membuf, "/%s=", field_name);
1311  ASN1_STRING_print_ex(membuf, v,
1312  ((ASN1_STRFLGS_RFC2253 & ~ASN1_STRFLGS_ESC_MSB)
1313  | ASN1_STRFLGS_UTF8_CONVERT));
1314  }
1315 
1316  /* ensure null termination of the BIO's content */
1317  nullterm = '\0';
1318  BIO_write(membuf, &nullterm, 1);
1319  size = BIO_get_mem_data(membuf, &sp);
1320  dp = pg_any_to_server(sp, size - 1, PG_UTF8);
1321 
1322  result = pstrdup(dp);
1323  if (dp != sp)
1324  pfree(dp);
1325  BIO_free(membuf);
1326 
1327  return result;
1328 }
char * pstrdup(const char *in)
Definition: mcxt.c:1186
void pfree(void *pointer)
Definition: mcxt.c:1056
const char * name
Definition: encode.c:561
e
Definition: preproc-init.c:82
int i
char * pg_any_to_server(const char *s, int len, int encoding)
Definition: mbutils.c:619

Variable Documentation

◆ dummy_ssl_passwd_cb_called

bool dummy_ssl_passwd_cb_called = false
static

Definition at line 71 of file be-secure-openssl.c.

Referenced by be_tls_init(), and dummy_ssl_passwd_cb().

◆ my_bio_methods

BIO_METHOD* my_bio_methods = NULL
static

Definition at line 739 of file be-secure-openssl.c.

Referenced by my_BIO_s_socket().

◆ openssl_tls_init_hook

openssl_tls_init_hook_typ openssl_tls_init_hook = default_openssl_tls_init

Definition at line 50 of file be-secure-openssl.c.

Referenced by _PG_init().

◆ SSL_context

SSL_CTX* SSL_context = NULL
static

◆ SSL_initialized

bool SSL_initialized = false
static

Definition at line 70 of file be-secure-openssl.c.

Referenced by be_tls_init().

◆ ssl_is_server_start

bool ssl_is_server_start
static

Definition at line 72 of file be-secure-openssl.c.

Referenced by be_tls_init(), and ssl_external_passwd_cb().