PostgreSQL Source Code  git master
 All Data Structures Namespaces Files Functions Variables Typedefs Enumerations Enumerator Macros
be-secure-openssl.c
Go to the documentation of this file.
1 /*-------------------------------------------------------------------------
2  *
3  * be-secure-openssl.c
4  * functions for OpenSSL support in the backend.
5  *
6  *
7  * Portions Copyright (c) 1996-2017, PostgreSQL Global Development Group
8  * Portions Copyright (c) 1994, Regents of the University of California
9  *
10  *
11  * IDENTIFICATION
12  * src/backend/libpq/be-secure-openssl.c
13  *
14  * Since the server static private key ($DataDir/server.key)
15  * will normally be stored unencrypted so that the database
16  * backend can restart automatically, it is important that
17  * we select an algorithm that continues to provide confidentiality
18  * even if the attacker has the server's private key. Ephemeral
19  * DH (EDH) keys provide this and more (Perfect Forward Secrecy
20  * aka PFS).
21  *
22  * N.B., the static private key should still be protected to
23  * the largest extent possible, to minimize the risk of
24  * impersonations.
25  *
26  * Another benefit of EDH is that it allows the backend and
27  * clients to use DSA keys. DSA keys can only provide digital
28  * signatures, not encryption, and are often acceptable in
29  * jurisdictions where RSA keys are unacceptable.
30  *
31  * The downside to EDH is that it makes it impossible to
32  * use ssldump(1) if there's a problem establishing an SSL
33  * session. In this case you'll need to temporarily disable
34  * EDH by commenting out the callback.
35  *
36  *-------------------------------------------------------------------------
37  */
38 
39 #include "postgres.h"
40 
41 #include <sys/stat.h>
42 #include <signal.h>
43 #include <fcntl.h>
44 #include <ctype.h>
45 #include <sys/socket.h>
46 #include <unistd.h>
47 #include <netdb.h>
48 #include <netinet/in.h>
49 #ifdef HAVE_NETINET_TCP_H
50 #include <netinet/tcp.h>
51 #include <arpa/inet.h>
52 #endif
53 
54 #include <openssl/ssl.h>
55 #include <openssl/dh.h>
56 #include <openssl/conf.h>
57 #ifndef OPENSSL_NO_ECDH
58 #include <openssl/ec.h>
59 #endif
60 
61 #include "libpq/libpq.h"
62 #include "miscadmin.h"
63 #include "pgstat.h"
64 #include "storage/latch.h"
65 #include "tcop/tcopprot.h"
66 #include "utils/memutils.h"
67 
68 
69 static int my_sock_read(BIO *h, char *buf, int size);
70 static int my_sock_write(BIO *h, const char *buf, int size);
71 static BIO_METHOD *my_BIO_s_socket(void);
72 static int my_SSL_set_fd(Port *port, int fd);
73 
74 static DH *load_dh_file(int keylength);
75 static DH *load_dh_buffer(const char *, size_t);
76 static DH *generate_dh_parameters(int prime_len, int generator);
77 static DH *tmp_dh_cb(SSL *s, int is_export, int keylength);
78 static int ssl_passwd_cb(char *buf, int size, int rwflag, void *userdata);
79 static int verify_cb(int, X509_STORE_CTX *);
80 static void info_cb(const SSL *ssl, int type, int args);
81 static bool initialize_ecdh(SSL_CTX *context, bool isServerStart);
82 static const char *SSLerrmessage(unsigned long ecode);
83 
84 static char *X509_NAME_to_cstring(X509_NAME *name);
85 
86 static SSL_CTX *SSL_context = NULL;
87 static bool SSL_initialized = false;
88 static bool ssl_passwd_cb_called = false;
89 
90 /* ------------------------------------------------------------ */
91 /* Hardcoded values */
92 /* ------------------------------------------------------------ */
93 
94 /*
95  * Hardcoded DH parameters, used in ephemeral DH keying.
96  * As discussed above, EDH protects the confidentiality of
97  * sessions even if the static private key is compromised,
98  * so we are *highly* motivated to ensure that we can use
99  * EDH even if the DBA... or an attacker... deletes the
100  * $DataDir/dh*.pem files.
101  *
102  * We could refuse SSL connections unless a good DH parameter
103  * file exists, but some clients may quietly renegotiate an
104  * unsecured connection without fully informing the user.
105  * Very uncool.
106  *
107  * Alternatively, the backend could attempt to load these files
108  * on startup if SSL is enabled - and refuse to start if any
109  * do not exist - but this would tend to piss off DBAs.
110  *
111  * If you want to create your own hardcoded DH parameters
112  * for fun and profit, review "Assigned Number for SKIP
113  * Protocols" (http://www.skip-vpn.org/spec/numbers.html)
114  * for suggestions.
115  */
116 
117 static const char file_dh512[] =
118 "-----BEGIN DH PARAMETERS-----\n\
119 MEYCQQD1Kv884bEpQBgRjXyEpwpy1obEAxnIByl6ypUM2Zafq9AKUJsCRtMIPWak\n\
120 XUGfnHy9iUsiGSa6q6Jew1XpKgVfAgEC\n\
121 -----END DH PARAMETERS-----\n";
122 
123 static const char file_dh1024[] =
124 "-----BEGIN DH PARAMETERS-----\n\
125 MIGHAoGBAPSI/VhOSdvNILSd5JEHNmszbDgNRR0PfIizHHxbLY7288kjwEPwpVsY\n\
126 jY67VYy4XTjTNP18F1dDox0YbN4zISy1Kv884bEpQBgRjXyEpwpy1obEAxnIByl6\n\
127 ypUM2Zafq9AKUJsCRtMIPWakXUGfnHy9iUsiGSa6q6Jew1XpL3jHAgEC\n\
128 -----END DH PARAMETERS-----\n";
129 
130 static const char file_dh2048[] =
131 "-----BEGIN DH PARAMETERS-----\n\
132 MIIBCAKCAQEA9kJXtwh/CBdyorrWqULzBej5UxE5T7bxbrlLOCDaAadWoxTpj0BV\n\
133 89AHxstDqZSt90xkhkn4DIO9ZekX1KHTUPj1WV/cdlJPPT2N286Z4VeSWc39uK50\n\
134 T8X8dryDxUcwYc58yWb/Ffm7/ZFexwGq01uejaClcjrUGvC/RgBYK+X0iP1YTknb\n\
135 zSC0neSRBzZrM2w4DUUdD3yIsxx8Wy2O9vPJI8BD8KVbGI2Ou1WMuF040zT9fBdX\n\
136 Q6MdGGzeMyEstSr/POGxKUAYEY18hKcKctaGxAMZyAcpesqVDNmWn6vQClCbAkbT\n\
137 CD1mpF1Bn5x8vYlLIhkmuquiXsNV6TILOwIBAg==\n\
138 -----END DH PARAMETERS-----\n";
139 
140 static const char file_dh4096[] =
141 "-----BEGIN DH PARAMETERS-----\n\
142 MIICCAKCAgEA+hRyUsFN4VpJ1O8JLcCo/VWr19k3BCgJ4uk+d+KhehjdRqNDNyOQ\n\
143 l/MOyQNQfWXPeGKmOmIig6Ev/nm6Nf9Z2B1h3R4hExf+zTiHnvVPeRBhjdQi81rt\n\
144 Xeoh6TNrSBIKIHfUJWBh3va0TxxjQIs6IZOLeVNRLMqzeylWqMf49HsIXqbcokUS\n\
145 Vt1BkvLdW48j8PPv5DsKRN3tloTxqDJGo9tKvj1Fuk74A+Xda1kNhB7KFlqMyN98\n\
146 VETEJ6c7KpfOo30mnK30wqw3S8OtaIR/maYX72tGOno2ehFDkq3pnPtEbD2CScxc\n\
147 alJC+EL7RPk5c/tgeTvCngvc1KZn92Y//EI7G9tPZtylj2b56sHtMftIoYJ9+ODM\n\
148 sccD5Piz/rejE3Ome8EOOceUSCYAhXn8b3qvxVI1ddd1pED6FHRhFvLrZxFvBEM9\n\
149 ERRMp5QqOaHJkM+Dxv8Cj6MqrCbfC4u+ZErxodzuusgDgvZiLF22uxMZbobFWyte\n\
150 OvOzKGtwcTqO/1wV5gKkzu1ZVswVUQd5Gg8lJicwqRWyyNRczDDoG9jVDxmogKTH\n\
151 AaqLulO7R8Ifa1SwF2DteSGVtgWEN8gDpN3RBmmPTDngyF2DHb5qmpnznwtFKdTL\n\
152 KWbuHn491xNO25CQWMtem80uKw+pTnisBRF/454n1Jnhub144YRBoN8CAQI=\n\
153 -----END DH PARAMETERS-----\n";
154 
155 
156 /* ------------------------------------------------------------ */
157 /* Public interface */
158 /* ------------------------------------------------------------ */
159 
160 /*
161  * Initialize global SSL context.
162  *
163  * If isServerStart is true, report any errors as FATAL (so we don't return).
164  * Otherwise, log errors at LOG level and return -1 to indicate trouble,
165  * preserving the old SSL state if any. Returns 0 if OK.
166  */
167 int
168 be_tls_init(bool isServerStart)
169 {
170  STACK_OF(X509_NAME) *root_cert_list = NULL;
171  SSL_CTX *context;
172  struct stat buf;
173 
174  /* This stuff need be done only once. */
175  if (!SSL_initialized)
176  {
177 #ifdef HAVE_OPENSSL_INIT_SSL
178  OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG, NULL);
179 #else
180  OPENSSL_config(NULL);
181  SSL_library_init();
182  SSL_load_error_strings();
183 #endif
184  SSL_initialized = true;
185  }
186 
187  /*
188  * We use SSLv23_method() because it can negotiate use of the highest
189  * mutually supported protocol version, while alternatives like
190  * TLSv1_2_method() permit only one specific version. Note that we don't
191  * actually allow SSL v2 or v3, only TLS protocols (see below).
192  */
193  context = SSL_CTX_new(SSLv23_method());
194  if (!context)
195  {
196  ereport(isServerStart ? FATAL : LOG,
197  (errmsg("could not create SSL context: %s",
198  SSLerrmessage(ERR_get_error()))));
199  goto error;
200  }
201 
202  /*
203  * Disable OpenSSL's moving-write-buffer sanity check, because it causes
204  * unnecessary failures in nonblocking send cases.
205  */
206  SSL_CTX_set_mode(context, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
207 
208  /*
209  * If reloading, override OpenSSL's default handling of
210  * passphrase-protected files, because we don't want to prompt for a
211  * passphrase in an already-running server. (Not that the default
212  * handling is very desirable during server start either, but some people
213  * insist we need to keep it.)
214  */
215  if (!isServerStart)
216  SSL_CTX_set_default_passwd_cb(context, ssl_passwd_cb);
217 
218  /*
219  * Load and verify server's certificate and private key
220  */
221  if (SSL_CTX_use_certificate_chain_file(context, ssl_cert_file) != 1)
222  {
223  ereport(isServerStart ? FATAL : LOG,
224  (errcode(ERRCODE_CONFIG_FILE_ERROR),
225  errmsg("could not load server certificate file \"%s\": %s",
226  ssl_cert_file, SSLerrmessage(ERR_get_error()))));
227  goto error;
228  }
229 
230  if (stat(ssl_key_file, &buf) != 0)
231  {
232  ereport(isServerStart ? FATAL : LOG,
234  errmsg("could not access private key file \"%s\": %m",
235  ssl_key_file)));
236  goto error;
237  }
238 
239  if (!S_ISREG(buf.st_mode))
240  {
241  ereport(isServerStart ? FATAL : LOG,
242  (errcode(ERRCODE_CONFIG_FILE_ERROR),
243  errmsg("private key file \"%s\" is not a regular file",
244  ssl_key_file)));
245  goto error;
246  }
247 
248  /*
249  * Refuse to load key files owned by users other than us or root.
250  *
251  * XXX surely we can check this on Windows somehow, too.
252  */
253 #if !defined(WIN32) && !defined(__CYGWIN__)
254  if (buf.st_uid != geteuid() && buf.st_uid != 0)
255  {
256  ereport(isServerStart ? FATAL : LOG,
257  (errcode(ERRCODE_CONFIG_FILE_ERROR),
258  errmsg("private key file \"%s\" must be owned by the database user or root",
259  ssl_key_file)));
260  goto error;
261  }
262 #endif
263 
264  /*
265  * Require no public access to key file. If the file is owned by us,
266  * require mode 0600 or less. If owned by root, require 0640 or less to
267  * allow read access through our gid, or a supplementary gid that allows
268  * to read system-wide certificates.
269  *
270  * XXX temporarily suppress check when on Windows, because there may not
271  * be proper support for Unix-y file permissions. Need to think of a
272  * reasonable check to apply on Windows. (See also the data directory
273  * permission check in postmaster.c)
274  */
275 #if !defined(WIN32) && !defined(__CYGWIN__)
276  if ((buf.st_uid == geteuid() && buf.st_mode & (S_IRWXG | S_IRWXO)) ||
277  (buf.st_uid == 0 && buf.st_mode & (S_IWGRP | S_IXGRP | S_IRWXO)))
278  {
279  ereport(isServerStart ? FATAL : LOG,
280  (errcode(ERRCODE_CONFIG_FILE_ERROR),
281  errmsg("private key file \"%s\" has group or world access",
282  ssl_key_file),
283  errdetail("File must have permissions u=rw (0600) or less if owned by the database user, or permissions u=rw,g=r (0640) or less if owned by root.")));
284  goto error;
285  }
286 #endif
287 
288  /*
289  * OK, try to load the private key file.
290  */
291  ssl_passwd_cb_called = false;
292 
293  if (SSL_CTX_use_PrivateKey_file(context,
294  ssl_key_file,
295  SSL_FILETYPE_PEM) != 1)
296  {
298  ereport(isServerStart ? FATAL : LOG,
299  (errcode(ERRCODE_CONFIG_FILE_ERROR),
300  errmsg("private key file \"%s\" cannot be reloaded because it requires a passphrase",
301  ssl_key_file)));
302  else
303  ereport(isServerStart ? FATAL : LOG,
304  (errcode(ERRCODE_CONFIG_FILE_ERROR),
305  errmsg("could not load private key file \"%s\": %s",
306  ssl_key_file, SSLerrmessage(ERR_get_error()))));
307  goto error;
308  }
309 
310  if (SSL_CTX_check_private_key(context) != 1)
311  {
312  ereport(isServerStart ? FATAL : LOG,
313  (errcode(ERRCODE_CONFIG_FILE_ERROR),
314  errmsg("check of private key failed: %s",
315  SSLerrmessage(ERR_get_error()))));
316  goto error;
317  }
318 
319  /* set up ephemeral DH keys, and disallow SSL v2/v3 while at it */
320  SSL_CTX_set_tmp_dh_callback(context, tmp_dh_cb);
321  SSL_CTX_set_options(context,
322  SSL_OP_SINGLE_DH_USE |
323  SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);
324 
325  /* set up ephemeral ECDH keys */
326  if (!initialize_ecdh(context, isServerStart))
327  goto error;
328 
329  /* set up the allowed cipher list */
330  if (SSL_CTX_set_cipher_list(context, SSLCipherSuites) != 1)
331  {
332  ereport(isServerStart ? FATAL : LOG,
333  (errcode(ERRCODE_CONFIG_FILE_ERROR),
334  errmsg("could not set the cipher list (no valid ciphers available)")));
335  goto error;
336  }
337 
338  /* Let server choose order */
340  SSL_CTX_set_options(context, SSL_OP_CIPHER_SERVER_PREFERENCE);
341 
342  /*
343  * Load CA store, so we can verify client certificates if needed.
344  */
345  if (ssl_ca_file[0])
346  {
347  if (SSL_CTX_load_verify_locations(context, ssl_ca_file, NULL) != 1 ||
348  (root_cert_list = SSL_load_client_CA_file(ssl_ca_file)) == NULL)
349  {
350  ereport(isServerStart ? FATAL : LOG,
351  (errcode(ERRCODE_CONFIG_FILE_ERROR),
352  errmsg("could not load root certificate file \"%s\": %s",
353  ssl_ca_file, SSLerrmessage(ERR_get_error()))));
354  goto error;
355  }
356  }
357 
358  /*----------
359  * Load the Certificate Revocation List (CRL).
360  * http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci803160,00.html
361  *----------
362  */
363  if (ssl_crl_file[0])
364  {
365  X509_STORE *cvstore = SSL_CTX_get_cert_store(context);
366 
367  if (cvstore)
368  {
369  /* Set the flags to check against the complete CRL chain */
370  if (X509_STORE_load_locations(cvstore, ssl_crl_file, NULL) == 1)
371  {
372  /* OpenSSL 0.96 does not support X509_V_FLAG_CRL_CHECK */
373 #ifdef X509_V_FLAG_CRL_CHECK
374  X509_STORE_set_flags(cvstore,
375  X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
376 #else
377  ereport(LOG,
378  (errcode(ERRCODE_CONFIG_FILE_ERROR),
379  errmsg("SSL certificate revocation list file \"%s\" ignored",
380  ssl_crl_file),
381  errdetail("SSL library does not support certificate revocation lists.")));
382 #endif
383  }
384  else
385  {
386  ereport(isServerStart ? FATAL : LOG,
387  (errcode(ERRCODE_CONFIG_FILE_ERROR),
388  errmsg("could not load SSL certificate revocation list file \"%s\": %s",
389  ssl_crl_file, SSLerrmessage(ERR_get_error()))));
390  goto error;
391  }
392  }
393  }
394 
395  if (ssl_ca_file[0])
396  {
397  /*
398  * Always ask for SSL client cert, but don't fail if it's not
399  * presented. We might fail such connections later, depending on what
400  * we find in pg_hba.conf.
401  */
402  SSL_CTX_set_verify(context,
403  (SSL_VERIFY_PEER |
404  SSL_VERIFY_CLIENT_ONCE),
405  verify_cb);
406 
407  /*
408  * Tell OpenSSL to send the list of root certs we trust to clients in
409  * CertificateRequests. This lets a client with a keystore select the
410  * appropriate client certificate to send to us.
411  */
412  SSL_CTX_set_client_CA_list(context, root_cert_list);
413  }
414 
415  /*
416  * Success! Replace any existing SSL_context.
417  */
418  if (SSL_context)
419  SSL_CTX_free(SSL_context);
420 
421  SSL_context = context;
422 
423  /*
424  * Set flag to remember whether CA store has been loaded into SSL_context.
425  */
426  if (ssl_ca_file[0])
428  else
430 
431  return 0;
432 
433 error:
434  if (context)
435  SSL_CTX_free(context);
436  return -1;
437 }
438 
439 /*
440  * Destroy global SSL context, if any.
441  */
442 void
444 {
445  if (SSL_context)
446  SSL_CTX_free(SSL_context);
447  SSL_context = NULL;
449 }
450 
451 /*
452  * Attempt to negotiate SSL connection.
453  */
454 int
456 {
457  int r;
458  int err;
459  int waitfor;
460  unsigned long ecode;
461 
462  Assert(!port->ssl);
463  Assert(!port->peer);
464 
465  if (!SSL_context)
466  {
468  (errcode(ERRCODE_PROTOCOL_VIOLATION),
469  errmsg("could not initialize SSL connection: SSL context not set up")));
470  return -1;
471  }
472 
473  if (!(port->ssl = SSL_new(SSL_context)))
474  {
476  (errcode(ERRCODE_PROTOCOL_VIOLATION),
477  errmsg("could not initialize SSL connection: %s",
478  SSLerrmessage(ERR_get_error()))));
479  return -1;
480  }
481  if (!my_SSL_set_fd(port, port->sock))
482  {
484  (errcode(ERRCODE_PROTOCOL_VIOLATION),
485  errmsg("could not set SSL socket: %s",
486  SSLerrmessage(ERR_get_error()))));
487  return -1;
488  }
489  port->ssl_in_use = true;
490 
491 aloop:
492 
493  /*
494  * Prepare to call SSL_get_error() by clearing thread's OpenSSL error
495  * queue. In general, the current thread's error queue must be empty
496  * before the TLS/SSL I/O operation is attempted, or SSL_get_error() will
497  * not work reliably. An extension may have failed to clear the
498  * per-thread error queue following another call to an OpenSSL I/O
499  * routine.
500  */
501  ERR_clear_error();
502  r = SSL_accept(port->ssl);
503  if (r <= 0)
504  {
505  err = SSL_get_error(port->ssl, r);
506 
507  /*
508  * Other clients of OpenSSL in the backend may fail to call
509  * ERR_get_error(), but we always do, so as to not cause problems for
510  * OpenSSL clients that don't call ERR_clear_error() defensively. Be
511  * sure that this happens by calling now. SSL_get_error() relies on
512  * the OpenSSL per-thread error queue being intact, so this is the
513  * earliest possible point ERR_get_error() may be called.
514  */
515  ecode = ERR_get_error();
516  switch (err)
517  {
518  case SSL_ERROR_WANT_READ:
519  case SSL_ERROR_WANT_WRITE:
520  /* not allowed during connection establishment */
521  Assert(!port->noblock);
522 
523  /*
524  * No need to care about timeouts/interrupts here. At this
525  * point authentication_timeout still employs
526  * StartupPacketTimeoutHandler() which directly exits.
527  */
528  if (err == SSL_ERROR_WANT_READ)
529  waitfor = WL_SOCKET_READABLE;
530  else
531  waitfor = WL_SOCKET_WRITEABLE;
532 
533  WaitLatchOrSocket(MyLatch, waitfor, port->sock, 0,
535  goto aloop;
536  case SSL_ERROR_SYSCALL:
537  if (r < 0)
540  errmsg("could not accept SSL connection: %m")));
541  else
543  (errcode(ERRCODE_PROTOCOL_VIOLATION),
544  errmsg("could not accept SSL connection: EOF detected")));
545  break;
546  case SSL_ERROR_SSL:
548  (errcode(ERRCODE_PROTOCOL_VIOLATION),
549  errmsg("could not accept SSL connection: %s",
550  SSLerrmessage(ecode))));
551  break;
552  case SSL_ERROR_ZERO_RETURN:
554  (errcode(ERRCODE_PROTOCOL_VIOLATION),
555  errmsg("could not accept SSL connection: EOF detected")));
556  break;
557  default:
559  (errcode(ERRCODE_PROTOCOL_VIOLATION),
560  errmsg("unrecognized SSL error code: %d",
561  err)));
562  break;
563  }
564  return -1;
565  }
566 
567  /* Get client certificate, if available. */
568  port->peer = SSL_get_peer_certificate(port->ssl);
569 
570  /* and extract the Common Name from it. */
571  port->peer_cn = NULL;
572  port->peer_cert_valid = false;
573  if (port->peer != NULL)
574  {
575  int len;
576 
577  len = X509_NAME_get_text_by_NID(X509_get_subject_name(port->peer),
578  NID_commonName, NULL, 0);
579  if (len != -1)
580  {
581  char *peer_cn;
582 
583  peer_cn = MemoryContextAlloc(TopMemoryContext, len + 1);
584  r = X509_NAME_get_text_by_NID(X509_get_subject_name(port->peer),
585  NID_commonName, peer_cn, len + 1);
586  peer_cn[len] = '\0';
587  if (r != len)
588  {
589  /* shouldn't happen */
590  pfree(peer_cn);
591  return -1;
592  }
593 
594  /*
595  * Reject embedded NULLs in certificate common name to prevent
596  * attacks like CVE-2009-4034.
597  */
598  if (len != strlen(peer_cn))
599  {
601  (errcode(ERRCODE_PROTOCOL_VIOLATION),
602  errmsg("SSL certificate's common name contains embedded null")));
603  pfree(peer_cn);
604  return -1;
605  }
606 
607  port->peer_cn = peer_cn;
608  }
609  port->peer_cert_valid = true;
610  }
611 
612  ereport(DEBUG2,
613  (errmsg("SSL connection from \"%s\"",
614  port->peer_cn ? port->peer_cn : "(anonymous)")));
615 
616  /* set up debugging/info callback */
617  SSL_CTX_set_info_callback(SSL_context, info_cb);
618 
619  return 0;
620 }
621 
622 /*
623  * Close SSL connection.
624  */
625 void
627 {
628  if (port->ssl)
629  {
630  SSL_shutdown(port->ssl);
631  SSL_free(port->ssl);
632  port->ssl = NULL;
633  port->ssl_in_use = false;
634  }
635 
636  if (port->peer)
637  {
638  X509_free(port->peer);
639  port->peer = NULL;
640  }
641 
642  if (port->peer_cn)
643  {
644  pfree(port->peer_cn);
645  port->peer_cn = NULL;
646  }
647 }
648 
649 /*
650  * Read data from a secure connection.
651  */
652 ssize_t
653 be_tls_read(Port *port, void *ptr, size_t len, int *waitfor)
654 {
655  ssize_t n;
656  int err;
657  unsigned long ecode;
658 
659  errno = 0;
660  ERR_clear_error();
661  n = SSL_read(port->ssl, ptr, len);
662  err = SSL_get_error(port->ssl, n);
663  ecode = (err != SSL_ERROR_NONE || n < 0) ? ERR_get_error() : 0;
664  switch (err)
665  {
666  case SSL_ERROR_NONE:
667  /* a-ok */
668  break;
669  case SSL_ERROR_WANT_READ:
670  *waitfor = WL_SOCKET_READABLE;
671  errno = EWOULDBLOCK;
672  n = -1;
673  break;
674  case SSL_ERROR_WANT_WRITE:
675  *waitfor = WL_SOCKET_WRITEABLE;
676  errno = EWOULDBLOCK;
677  n = -1;
678  break;
679  case SSL_ERROR_SYSCALL:
680  /* leave it to caller to ereport the value of errno */
681  if (n != -1)
682  {
683  errno = ECONNRESET;
684  n = -1;
685  }
686  break;
687  case SSL_ERROR_SSL:
689  (errcode(ERRCODE_PROTOCOL_VIOLATION),
690  errmsg("SSL error: %s", SSLerrmessage(ecode))));
691  errno = ECONNRESET;
692  n = -1;
693  break;
694  case SSL_ERROR_ZERO_RETURN:
695  /* connection was cleanly shut down by peer */
696  n = 0;
697  break;
698  default:
700  (errcode(ERRCODE_PROTOCOL_VIOLATION),
701  errmsg("unrecognized SSL error code: %d",
702  err)));
703  errno = ECONNRESET;
704  n = -1;
705  break;
706  }
707 
708  return n;
709 }
710 
711 /*
712  * Write data to a secure connection.
713  */
714 ssize_t
715 be_tls_write(Port *port, void *ptr, size_t len, int *waitfor)
716 {
717  ssize_t n;
718  int err;
719  unsigned long ecode;
720 
721  errno = 0;
722  ERR_clear_error();
723  n = SSL_write(port->ssl, ptr, len);
724  err = SSL_get_error(port->ssl, n);
725  ecode = (err != SSL_ERROR_NONE || n < 0) ? ERR_get_error() : 0;
726  switch (err)
727  {
728  case SSL_ERROR_NONE:
729  /* a-ok */
730  break;
731  case SSL_ERROR_WANT_READ:
732  *waitfor = WL_SOCKET_READABLE;
733  errno = EWOULDBLOCK;
734  n = -1;
735  break;
736  case SSL_ERROR_WANT_WRITE:
737  *waitfor = WL_SOCKET_WRITEABLE;
738  errno = EWOULDBLOCK;
739  n = -1;
740  break;
741  case SSL_ERROR_SYSCALL:
742  /* leave it to caller to ereport the value of errno */
743  if (n != -1)
744  {
745  errno = ECONNRESET;
746  n = -1;
747  }
748  break;
749  case SSL_ERROR_SSL:
751  (errcode(ERRCODE_PROTOCOL_VIOLATION),
752  errmsg("SSL error: %s", SSLerrmessage(ecode))));
753  errno = ECONNRESET;
754  n = -1;
755  break;
756  case SSL_ERROR_ZERO_RETURN:
757  /*
758  * the SSL connnection was closed, leave it to the caller
759  * to ereport it
760  */
761  errno = ECONNRESET;
762  n = -1;
763  break;
764  default:
766  (errcode(ERRCODE_PROTOCOL_VIOLATION),
767  errmsg("unrecognized SSL error code: %d",
768  err)));
769  errno = ECONNRESET;
770  n = -1;
771  break;
772  }
773 
774  return n;
775 }
776 
777 /* ------------------------------------------------------------ */
778 /* Internal functions */
779 /* ------------------------------------------------------------ */
780 
781 /*
782  * Private substitute BIO: this does the sending and receiving using send() and
783  * recv() instead. This is so that we can enable and disable interrupts
784  * just while calling recv(). We cannot have interrupts occurring while
785  * the bulk of openssl runs, because it uses malloc() and possibly other
786  * non-reentrant libc facilities. We also need to call send() and recv()
787  * directly so it gets passed through the socket/signals layer on Win32.
788  *
789  * These functions are closely modelled on the standard socket BIO in OpenSSL;
790  * see sock_read() and sock_write() in OpenSSL's crypto/bio/bss_sock.c.
791  * XXX OpenSSL 1.0.1e considers many more errcodes than just EINTR as reasons
792  * to retry; do we need to adopt their logic for that?
793  */
794 
795 #ifndef HAVE_BIO_GET_DATA
796 #define BIO_get_data(bio) (bio->ptr)
797 #define BIO_set_data(bio, data) (bio->ptr = data)
798 #endif
799 
800 static BIO_METHOD *my_bio_methods = NULL;
801 
802 static int
803 my_sock_read(BIO *h, char *buf, int size)
804 {
805  int res = 0;
806 
807  if (buf != NULL)
808  {
809  res = secure_raw_read(((Port *) BIO_get_data(h)), buf, size);
810  BIO_clear_retry_flags(h);
811  if (res <= 0)
812  {
813  /* If we were interrupted, tell caller to retry */
814  if (errno == EINTR || errno == EWOULDBLOCK || errno == EAGAIN)
815  {
816  BIO_set_retry_read(h);
817  }
818  }
819  }
820 
821  return res;
822 }
823 
824 static int
825 my_sock_write(BIO *h, const char *buf, int size)
826 {
827  int res = 0;
828 
829  res = secure_raw_write(((Port *) BIO_get_data(h)), buf, size);
830  BIO_clear_retry_flags(h);
831  if (res <= 0)
832  {
833  /* If we were interrupted, tell caller to retry */
834  if (errno == EINTR || errno == EWOULDBLOCK || errno == EAGAIN)
835  {
836  BIO_set_retry_write(h);
837  }
838  }
839 
840  return res;
841 }
842 
843 static BIO_METHOD *
845 {
846  if (!my_bio_methods)
847  {
848  BIO_METHOD *biom = (BIO_METHOD *) BIO_s_socket();
849 #ifdef HAVE_BIO_METH_NEW
850  int my_bio_index;
851 
852  my_bio_index = BIO_get_new_index();
853  if (my_bio_index == -1)
854  return NULL;
855  my_bio_methods = BIO_meth_new(my_bio_index, "PostgreSQL backend socket");
856  if (!my_bio_methods)
857  return NULL;
858  if (!BIO_meth_set_write(my_bio_methods, my_sock_write) ||
859  !BIO_meth_set_read(my_bio_methods, my_sock_read) ||
860  !BIO_meth_set_gets(my_bio_methods, BIO_meth_get_gets(biom)) ||
861  !BIO_meth_set_puts(my_bio_methods, BIO_meth_get_puts(biom)) ||
862  !BIO_meth_set_ctrl(my_bio_methods, BIO_meth_get_ctrl(biom)) ||
863  !BIO_meth_set_create(my_bio_methods, BIO_meth_get_create(biom)) ||
864  !BIO_meth_set_destroy(my_bio_methods, BIO_meth_get_destroy(biom)) ||
865  !BIO_meth_set_callback_ctrl(my_bio_methods, BIO_meth_get_callback_ctrl(biom)))
866  {
867  BIO_meth_free(my_bio_methods);
869  return NULL;
870  }
871 #else
872  my_bio_methods = malloc(sizeof(BIO_METHOD));
873  if (!my_bio_methods)
874  return NULL;
875  memcpy(my_bio_methods, biom, sizeof(BIO_METHOD));
876  my_bio_methods->bread = my_sock_read;
877  my_bio_methods->bwrite = my_sock_write;
878 #endif
879  }
880  return my_bio_methods;
881 }
882 
883 /* This should exactly match openssl's SSL_set_fd except for using my BIO */
884 static int
886 {
887  int ret = 0;
888  BIO *bio;
889  BIO_METHOD *bio_method;
890 
891  bio_method = my_BIO_s_socket();
892  if (bio_method == NULL)
893  {
894  SSLerr(SSL_F_SSL_SET_FD, ERR_R_BUF_LIB);
895  goto err;
896  }
897  bio = BIO_new(bio_method);
898 
899  if (bio == NULL)
900  {
901  SSLerr(SSL_F_SSL_SET_FD, ERR_R_BUF_LIB);
902  goto err;
903  }
904  BIO_set_data(bio, port);
905 
906  BIO_set_fd(bio, fd, BIO_NOCLOSE);
907  SSL_set_bio(port->ssl, bio, bio);
908  ret = 1;
909 err:
910  return ret;
911 }
912 
913 /*
914  * Load precomputed DH parameters.
915  *
916  * To prevent "downgrade" attacks, we perform a number of checks
917  * to verify that the DBA-generated DH parameters file contains
918  * what we expect it to contain.
919  */
920 static DH *
921 load_dh_file(int keylength)
922 {
923  FILE *fp;
924  char fnbuf[MAXPGPATH];
925  DH *dh = NULL;
926  int codes;
927 
928  /* attempt to open file. It's not an error if it doesn't exist. */
929  snprintf(fnbuf, sizeof(fnbuf), "dh%d.pem", keylength);
930  if ((fp = fopen(fnbuf, "r")) == NULL)
931  return NULL;
932 
933 /* flock(fileno(fp), LOCK_SH); */
934  dh = PEM_read_DHparams(fp, NULL, NULL, NULL);
935 /* flock(fileno(fp), LOCK_UN); */
936  fclose(fp);
937 
938  /* is the prime the correct size? */
939  if (dh != NULL && 8 * DH_size(dh) < keylength)
940  {
941  elog(LOG, "DH errors (%s): %d bits expected, %d bits found",
942  fnbuf, keylength, 8 * DH_size(dh));
943  dh = NULL;
944  }
945 
946  /* make sure the DH parameters are usable */
947  if (dh != NULL)
948  {
949  if (DH_check(dh, &codes) == 0)
950  {
951  elog(LOG, "DH_check error (%s): %s", fnbuf,
952  SSLerrmessage(ERR_get_error()));
953  return NULL;
954  }
955  if (codes & DH_CHECK_P_NOT_PRIME)
956  {
957  elog(LOG, "DH error (%s): p is not prime", fnbuf);
958  return NULL;
959  }
960  if ((codes & DH_NOT_SUITABLE_GENERATOR) &&
961  (codes & DH_CHECK_P_NOT_SAFE_PRIME))
962  {
963  elog(LOG,
964  "DH error (%s): neither suitable generator or safe prime",
965  fnbuf);
966  return NULL;
967  }
968  }
969 
970  return dh;
971 }
972 
973 /*
974  * Load hardcoded DH parameters.
975  *
976  * To prevent problems if the DH parameters files don't even
977  * exist, we can load DH parameters hardcoded into this file.
978  */
979 static DH *
980 load_dh_buffer(const char *buffer, size_t len)
981 {
982  BIO *bio;
983  DH *dh = NULL;
984 
985  bio = BIO_new_mem_buf((char *) buffer, len);
986  if (bio == NULL)
987  return NULL;
988  dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
989  if (dh == NULL)
990  ereport(DEBUG2,
991  (errmsg_internal("DH load buffer: %s",
992  SSLerrmessage(ERR_get_error()))));
993  BIO_free(bio);
994 
995  return dh;
996 }
997 
998 /*
999  * Generate DH parameters.
1000  *
1001  * Last resort if we can't load precomputed nor hardcoded
1002  * parameters.
1003  */
1004 static DH *
1006 {
1007  DH *dh;
1008 
1009  if ((dh = DH_new()) == NULL)
1010  return NULL;
1011 
1012  if (DH_generate_parameters_ex(dh, prime_len, generator, NULL))
1013  return dh;
1014 
1015  DH_free(dh);
1016  return NULL;
1017 }
1018 
1019 /*
1020  * Generate an ephemeral DH key. Because this can take a long
1021  * time to compute, we can use precomputed parameters of the
1022  * common key sizes.
1023  *
1024  * Since few sites will bother to precompute these parameter
1025  * files, we also provide a fallback to the parameters provided
1026  * by the OpenSSL project.
1027  *
1028  * These values can be static (once loaded or computed) since
1029  * the OpenSSL library can efficiently generate random keys from
1030  * the information provided.
1031  */
1032 static DH *
1033 tmp_dh_cb(SSL *s, int is_export, int keylength)
1034 {
1035  DH *r = NULL;
1036  static DH *dh = NULL;
1037  static DH *dh512 = NULL;
1038  static DH *dh1024 = NULL;
1039  static DH *dh2048 = NULL;
1040  static DH *dh4096 = NULL;
1041 
1042  switch (keylength)
1043  {
1044  case 512:
1045  if (dh512 == NULL)
1046  dh512 = load_dh_file(keylength);
1047  if (dh512 == NULL)
1048  dh512 = load_dh_buffer(file_dh512, sizeof file_dh512);
1049  r = dh512;
1050  break;
1051 
1052  case 1024:
1053  if (dh1024 == NULL)
1054  dh1024 = load_dh_file(keylength);
1055  if (dh1024 == NULL)
1056  dh1024 = load_dh_buffer(file_dh1024, sizeof file_dh1024);
1057  r = dh1024;
1058  break;
1059 
1060  case 2048:
1061  if (dh2048 == NULL)
1062  dh2048 = load_dh_file(keylength);
1063  if (dh2048 == NULL)
1064  dh2048 = load_dh_buffer(file_dh2048, sizeof file_dh2048);
1065  r = dh2048;
1066  break;
1067 
1068  case 4096:
1069  if (dh4096 == NULL)
1070  dh4096 = load_dh_file(keylength);
1071  if (dh4096 == NULL)
1072  dh4096 = load_dh_buffer(file_dh4096, sizeof file_dh4096);
1073  r = dh4096;
1074  break;
1075 
1076  default:
1077  if (dh == NULL)
1078  dh = load_dh_file(keylength);
1079  r = dh;
1080  }
1081 
1082  /* this may take a long time, but it may be necessary... */
1083  if (r == NULL || 8 * DH_size(r) < keylength)
1084  {
1085  ereport(DEBUG2,
1086  (errmsg_internal("DH: generating parameters (%d bits)",
1087  keylength)));
1088  r = generate_dh_parameters(keylength, DH_GENERATOR_2);
1089  }
1090 
1091  return r;
1092 }
1093 
1094 /*
1095  * Passphrase collection callback
1096  *
1097  * If OpenSSL is told to use a passphrase-protected server key, by default
1098  * it will issue a prompt on /dev/tty and try to read a key from there.
1099  * That's no good during a postmaster SIGHUP cycle, not to mention SSL context
1100  * reload in an EXEC_BACKEND postmaster child. So override it with this dummy
1101  * function that just returns an empty passphrase, guaranteeing failure.
1102  */
1103 static int
1104 ssl_passwd_cb(char *buf, int size, int rwflag, void *userdata)
1105 {
1106  /* Set flag to change the error message we'll report */
1107  ssl_passwd_cb_called = true;
1108  /* And return empty string */
1109  Assert(size > 0);
1110  buf[0] = '\0';
1111  return 0;
1112 }
1113 
1114 /*
1115  * Certificate verification callback
1116  *
1117  * This callback allows us to log intermediate problems during
1118  * verification, but for now we'll see if the final error message
1119  * contains enough information.
1120  *
1121  * This callback also allows us to override the default acceptance
1122  * criteria (e.g., accepting self-signed or expired certs), but
1123  * for now we accept the default checks.
1124  */
1125 static int
1126 verify_cb(int ok, X509_STORE_CTX *ctx)
1127 {
1128  return ok;
1129 }
1130 
1131 /*
1132  * This callback is used to copy SSL information messages
1133  * into the PostgreSQL log.
1134  */
1135 static void
1136 info_cb(const SSL *ssl, int type, int args)
1137 {
1138  switch (type)
1139  {
1140  case SSL_CB_HANDSHAKE_START:
1141  ereport(DEBUG4,
1142  (errmsg_internal("SSL: handshake start")));
1143  break;
1144  case SSL_CB_HANDSHAKE_DONE:
1145  ereport(DEBUG4,
1146  (errmsg_internal("SSL: handshake done")));
1147  break;
1148  case SSL_CB_ACCEPT_LOOP:
1149  ereport(DEBUG4,
1150  (errmsg_internal("SSL: accept loop")));
1151  break;
1152  case SSL_CB_ACCEPT_EXIT:
1153  ereport(DEBUG4,
1154  (errmsg_internal("SSL: accept exit (%d)", args)));
1155  break;
1156  case SSL_CB_CONNECT_LOOP:
1157  ereport(DEBUG4,
1158  (errmsg_internal("SSL: connect loop")));
1159  break;
1160  case SSL_CB_CONNECT_EXIT:
1161  ereport(DEBUG4,
1162  (errmsg_internal("SSL: connect exit (%d)", args)));
1163  break;
1164  case SSL_CB_READ_ALERT:
1165  ereport(DEBUG4,
1166  (errmsg_internal("SSL: read alert (0x%04x)", args)));
1167  break;
1168  case SSL_CB_WRITE_ALERT:
1169  ereport(DEBUG4,
1170  (errmsg_internal("SSL: write alert (0x%04x)", args)));
1171  break;
1172  }
1173 }
1174 
1175 static bool
1176 initialize_ecdh(SSL_CTX *context, bool isServerStart)
1177 {
1178 #ifndef OPENSSL_NO_ECDH
1179  EC_KEY *ecdh;
1180  int nid;
1181 
1182  nid = OBJ_sn2nid(SSLECDHCurve);
1183  if (!nid)
1184  {
1185  ereport(isServerStart ? FATAL : LOG,
1186  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1187  errmsg("ECDH: unrecognized curve name: %s", SSLECDHCurve)));
1188  return false;
1189  }
1190 
1191  ecdh = EC_KEY_new_by_curve_name(nid);
1192  if (!ecdh)
1193  {
1194  ereport(isServerStart ? FATAL : LOG,
1195  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1196  errmsg("ECDH: could not create key")));
1197  return false;
1198  }
1199 
1200  SSL_CTX_set_options(context, SSL_OP_SINGLE_ECDH_USE);
1201  SSL_CTX_set_tmp_ecdh(context, ecdh);
1202  EC_KEY_free(ecdh);
1203 #endif
1204 
1205  return true;
1206 }
1207 
1208 /*
1209  * Obtain reason string for passed SSL errcode
1210  *
1211  * ERR_get_error() is used by caller to get errcode to pass here.
1212  *
1213  * Some caution is needed here since ERR_reason_error_string will
1214  * return NULL if it doesn't recognize the error code. We don't
1215  * want to return NULL ever.
1216  */
1217 static const char *
1218 SSLerrmessage(unsigned long ecode)
1219 {
1220  const char *errreason;
1221  static char errbuf[32];
1222 
1223  if (ecode == 0)
1224  return _("no SSL error reported");
1225  errreason = ERR_reason_error_string(ecode);
1226  if (errreason != NULL)
1227  return errreason;
1228  snprintf(errbuf, sizeof(errbuf), _("SSL error code %lu"), ecode);
1229  return errbuf;
1230 }
1231 
1232 /*
1233  * Return information about the SSL connection
1234  */
1235 int
1237 {
1238  int bits;
1239 
1240  if (port->ssl)
1241  {
1242  SSL_get_cipher_bits(port->ssl, &bits);
1243  return bits;
1244  }
1245  else
1246  return 0;
1247 }
1248 
1249 bool
1251 {
1252  if (port->ssl)
1253  return (SSL_get_current_compression(port->ssl) != NULL);
1254  else
1255  return false;
1256 }
1257 
1258 void
1259 be_tls_get_version(Port *port, char *ptr, size_t len)
1260 {
1261  if (port->ssl)
1262  strlcpy(ptr, SSL_get_version(port->ssl), len);
1263  else
1264  ptr[0] = '\0';
1265 }
1266 
1267 void
1268 be_tls_get_cipher(Port *port, char *ptr, size_t len)
1269 {
1270  if (port->ssl)
1271  strlcpy(ptr, SSL_get_cipher(port->ssl), len);
1272  else
1273  ptr[0] = '\0';
1274 }
1275 
1276 void
1277 be_tls_get_peerdn_name(Port *port, char *ptr, size_t len)
1278 {
1279  if (port->peer)
1280  strlcpy(ptr, X509_NAME_to_cstring(X509_get_subject_name(port->peer)), len);
1281  else
1282  ptr[0] = '\0';
1283 }
1284 
1285 /*
1286  * Convert an X509 subject name to a cstring.
1287  *
1288  */
1289 static char *
1291 {
1292  BIO *membuf = BIO_new(BIO_s_mem());
1293  int i,
1294  nid,
1295  count = X509_NAME_entry_count(name);
1296  X509_NAME_ENTRY *e;
1297  ASN1_STRING *v;
1298  const char *field_name;
1299  size_t size;
1300  char nullterm;
1301  char *sp;
1302  char *dp;
1303  char *result;
1304 
1305  (void) BIO_set_close(membuf, BIO_CLOSE);
1306  for (i = 0; i < count; i++)
1307  {
1308  e = X509_NAME_get_entry(name, i);
1309  nid = OBJ_obj2nid(X509_NAME_ENTRY_get_object(e));
1310  v = X509_NAME_ENTRY_get_data(e);
1311  field_name = OBJ_nid2sn(nid);
1312  if (!field_name)
1313  field_name = OBJ_nid2ln(nid);
1314  BIO_printf(membuf, "/%s=", field_name);
1315  ASN1_STRING_print_ex(membuf, v,
1316  ((ASN1_STRFLGS_RFC2253 & ~ASN1_STRFLGS_ESC_MSB)
1317  | ASN1_STRFLGS_UTF8_CONVERT));
1318  }
1319 
1320  /* ensure null termination of the BIO's content */
1321  nullterm = '\0';
1322  BIO_write(membuf, &nullterm, 1);
1323  size = BIO_get_mem_data(membuf, &sp);
1324  dp = pg_any_to_server(sp, size - 1, PG_UTF8);
1325 
1326  result = pstrdup(dp);
1327  if (dp != sp)
1328  pfree(dp);
1329  BIO_free(membuf);
1330 
1331  return result;
1332 }
#define EWOULDBLOCK
Definition: win32.h:291
ssize_t be_tls_read(Port *port, void *ptr, size_t len, int *waitfor)
#define WL_SOCKET_WRITEABLE
Definition: latch.h:126
#define BIO_set_data(bio, data)
static void error(void)
Definition: sql-dyntest.c:147
static BIO_METHOD * my_BIO_s_socket(void)
char * peer_cn
Definition: libpq-be.h:182
#define BIO_get_data(bio)
char * pstrdup(const char *in)
Definition: mcxt.c:1077
bool ssl_loaded_verify_locations
bool peer_cert_valid
Definition: libpq-be.h:183
ssize_t secure_raw_write(Port *port, const void *ptr, size_t len)
Definition: be-secure.c:302
static void info_cb(const SSL *ssl, int type, int args)
int errcode(int sqlerrcode)
Definition: elog.c:575
Definition: libpq-be.h:116
return result
Definition: formatting.c:1633
bool ssl_in_use
Definition: libpq-be.h:181
int snprintf(char *str, size_t count, const char *fmt,...) pg_attribute_printf(3
#define WL_SOCKET_READABLE
Definition: latch.h:125
static const char file_dh512[]
char * ssl_cert_file
Definition: be-secure.c:43
static bool initialize_ecdh(SSL_CTX *context, bool isServerStart)
#define LOG
Definition: elog.h:26
#define DEBUG4
Definition: elog.h:22
char * ssl_crl_file
Definition: be-secure.c:46
static int fd(const char *x, int i)
Definition: preproc-init.c:105
pgsocket sock
Definition: libpq-be.h:118
int be_tls_init(bool isServerStart)
#define ECONNRESET
Definition: win32.h:295
#define S_IXGRP
Definition: win32.h:450
#define malloc(a)
Definition: header.h:50
#define EAGAIN
Definition: win32.h:283
static DH * generate_dh_parameters(int prime_len, int generator)
void pfree(void *pointer)
Definition: mcxt.c:950
static int my_SSL_set_fd(Port *port, int fd)
#define S_IWGRP
Definition: win32.h:449
bool be_tls_get_compression(Port *port)
#define FATAL
Definition: elog.h:52
#define MAXPGPATH
char * SSLECDHCurve
Definition: be-secure.c:56
#define DEBUG2
Definition: elog.h:24
ssize_t be_tls_write(Port *port, void *ptr, size_t len, int *waitfor)
static char * buf
Definition: pg_test_fsync.c:66
int errdetail(const char *fmt,...)
Definition: elog.c:873
#define COMMERROR
Definition: elog.h:30
int errcode_for_file_access(void)
Definition: elog.c:598
static bool SSL_initialized
char * SSLCipherSuites
Definition: be-secure.c:53
static int verify_cb(int, X509_STORE_CTX *)
static DH * load_dh_buffer(const char *, size_t)
static int ssl_passwd_cb(char *buf, int size, int rwflag, void *userdata)
void be_tls_destroy(void)
#define ereport(elevel, rest)
Definition: elog.h:122
MemoryContext TopMemoryContext
Definition: mcxt.c:43
static char * X509_NAME_to_cstring(X509_NAME *name)
int errcode_for_socket_access(void)
Definition: elog.c:669
static int port
Definition: pg_regress.c:89
static const char file_dh4096[]
static const char file_dh2048[]
#define SSL_get_current_compression(x)
Definition: port.h:422
int be_tls_get_cipher_bits(Port *port)
#define EINTR
Definition: win32.h:285
void be_tls_get_version(Port *port, char *ptr, size_t len)
char * ssl_ca_file
Definition: be-secure.c:45
#define S_IRWXO
Definition: win32.h:455
int be_tls_open_server(Port *port)
void be_tls_get_peerdn_name(Port *port, char *ptr, size_t len)
ssize_t secure_raw_read(Port *port, void *ptr, size_t len)
Definition: be-secure.c:216
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: strlcpy.c:45
int errmsg_internal(const char *fmt,...)
Definition: elog.c:827
static const char file_dh1024[]
static BIO_METHOD * my_bio_methods
#define NULL
Definition: c.h:229
#define Assert(condition)
Definition: c.h:675
int WaitLatchOrSocket(volatile Latch *latch, int wakeEvents, pgsocket sock, long timeout, uint32 wait_event_info)
Definition: latch.c:356
WalTimeSample buffer[LAG_TRACKER_BUFFER_SIZE]
Definition: walsender.c:214
static int my_sock_read(BIO *h, char *buf, int size)
bool noblock
Definition: libpq-be.h:119
static DH * tmp_dh_cb(SSL *s, int is_export, int keylength)
const char * name
Definition: encode.c:521
static bool ssl_passwd_cb_called
#define S_IRWXG
Definition: win32.h:451
e
Definition: preproc-init.c:82
int errmsg(const char *fmt,...)
Definition: elog.c:797
static SSL_CTX * SSL_context
void * MemoryContextAlloc(MemoryContext context, Size size)
Definition: mcxt.c:707
void be_tls_get_cipher(Port *port, char *ptr, size_t len)
static int my_sock_write(BIO *h, const char *buf, int size)
int i
static const char * SSLerrmessage(unsigned long ecode)
void be_tls_close(Port *port)
struct Latch * MyLatch
Definition: globals.c:52
#define elog
Definition: elog.h:219
char * pg_any_to_server(const char *s, int len, int encoding)
Definition: mbutils.c:572
static DH * load_dh_file(int keylength)
#define _(x)
Definition: elog.c:84
char * ssl_key_file
Definition: be-secure.c:44
bool SSLPreferServerCiphers
Definition: be-secure.c:59