PostgreSQL Source Code  git master
be-secure-openssl.c
Go to the documentation of this file.
1 /*-------------------------------------------------------------------------
2  *
3  * be-secure-openssl.c
4  * functions for OpenSSL support in the backend.
5  *
6  *
7  * Portions Copyright (c) 1996-2019, PostgreSQL Global Development Group
8  * Portions Copyright (c) 1994, Regents of the University of California
9  *
10  *
11  * IDENTIFICATION
12  * src/backend/libpq/be-secure-openssl.c
13  *
14  *-------------------------------------------------------------------------
15  */
16 
17 #include "postgres.h"
18 
19 #include <sys/stat.h>
20 #include <signal.h>
21 #include <fcntl.h>
22 #include <ctype.h>
23 #include <sys/socket.h>
24 #include <unistd.h>
25 #include <netdb.h>
26 #include <netinet/in.h>
27 #ifdef HAVE_NETINET_TCP_H
28 #include <netinet/tcp.h>
29 #include <arpa/inet.h>
30 #endif
31 
32 #include <openssl/ssl.h>
33 #include <openssl/dh.h>
34 #include <openssl/conf.h>
35 #ifndef OPENSSL_NO_ECDH
36 #include <openssl/ec.h>
37 #endif
38 
39 #include "libpq/libpq.h"
40 #include "miscadmin.h"
41 #include "pgstat.h"
42 #include "storage/fd.h"
43 #include "storage/latch.h"
44 #include "tcop/tcopprot.h"
45 #include "utils/memutils.h"
46 
47 
48 static int my_sock_read(BIO *h, char *buf, int size);
49 static int my_sock_write(BIO *h, const char *buf, int size);
50 static BIO_METHOD *my_BIO_s_socket(void);
51 static int my_SSL_set_fd(Port *port, int fd);
52 
53 static DH *load_dh_file(char *filename, bool isServerStart);
54 static DH *load_dh_buffer(const char *, size_t);
55 static int ssl_external_passwd_cb(char *buf, int size, int rwflag, void *userdata);
56 static int dummy_ssl_passwd_cb(char *buf, int size, int rwflag, void *userdata);
57 static int verify_cb(int, X509_STORE_CTX *);
58 static void info_cb(const SSL *ssl, int type, int args);
59 static bool initialize_dh(SSL_CTX *context, bool isServerStart);
60 static bool initialize_ecdh(SSL_CTX *context, bool isServerStart);
61 static const char *SSLerrmessage(unsigned long ecode);
62 
63 static char *X509_NAME_to_cstring(X509_NAME *name);
64 
65 static SSL_CTX *SSL_context = NULL;
66 static bool SSL_initialized = false;
67 static bool dummy_ssl_passwd_cb_called = false;
68 static bool ssl_is_server_start;
69 
70 static int ssl_protocol_version_to_openssl(int v, const char *guc_name,
71  int loglevel);
72 #ifndef SSL_CTX_set_min_proto_version
73 static int SSL_CTX_set_min_proto_version(SSL_CTX *ctx, int version);
74 static int SSL_CTX_set_max_proto_version(SSL_CTX *ctx, int version);
75 #endif
76 
77 
78 /* ------------------------------------------------------------ */
79 /* Public interface */
80 /* ------------------------------------------------------------ */
81 
82 int
83 be_tls_init(bool isServerStart)
84 {
85  STACK_OF(X509_NAME) *root_cert_list = NULL;
86  SSL_CTX *context;
87 
88  /* This stuff need be done only once. */
89  if (!SSL_initialized)
90  {
91 #ifdef HAVE_OPENSSL_INIT_SSL
92  OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG, NULL);
93 #else
94  OPENSSL_config(NULL);
95  SSL_library_init();
96  SSL_load_error_strings();
97 #endif
98  SSL_initialized = true;
99  }
100 
101  /*
102  * We use SSLv23_method() because it can negotiate use of the highest
103  * mutually supported protocol version, while alternatives like
104  * TLSv1_2_method() permit only one specific version. Note that we don't
105  * actually allow SSL v2 or v3, only TLS protocols (see below).
106  */
107  context = SSL_CTX_new(SSLv23_method());
108  if (!context)
109  {
110  ereport(isServerStart ? FATAL : LOG,
111  (errmsg("could not create SSL context: %s",
112  SSLerrmessage(ERR_get_error()))));
113  goto error;
114  }
115 
116  /*
117  * Disable OpenSSL's moving-write-buffer sanity check, because it causes
118  * unnecessary failures in nonblocking send cases.
119  */
120  SSL_CTX_set_mode(context, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
121 
122  /*
123  * Set password callback
124  */
125  if (isServerStart)
126  {
127  if (ssl_passphrase_command[0])
128  SSL_CTX_set_default_passwd_cb(context, ssl_external_passwd_cb);
129  }
130  else
131  {
133  SSL_CTX_set_default_passwd_cb(context, ssl_external_passwd_cb);
134  else
135 
136  /*
137  * If reloading and no external command is configured, override
138  * OpenSSL's default handling of passphrase-protected files,
139  * because we don't want to prompt for a passphrase in an
140  * already-running server.
141  */
142  SSL_CTX_set_default_passwd_cb(context, dummy_ssl_passwd_cb);
143  }
144  /* used by the callback */
145  ssl_is_server_start = isServerStart;
146 
147  /*
148  * Load and verify server's certificate and private key
149  */
150  if (SSL_CTX_use_certificate_chain_file(context, ssl_cert_file) != 1)
151  {
152  ereport(isServerStart ? FATAL : LOG,
153  (errcode(ERRCODE_CONFIG_FILE_ERROR),
154  errmsg("could not load server certificate file \"%s\": %s",
155  ssl_cert_file, SSLerrmessage(ERR_get_error()))));
156  goto error;
157  }
158 
159  if (!check_ssl_key_file_permissions(ssl_key_file, isServerStart))
160  goto error;
161 
162  /*
163  * OK, try to load the private key file.
164  */
166 
167  if (SSL_CTX_use_PrivateKey_file(context,
168  ssl_key_file,
169  SSL_FILETYPE_PEM) != 1)
170  {
172  ereport(isServerStart ? FATAL : LOG,
173  (errcode(ERRCODE_CONFIG_FILE_ERROR),
174  errmsg("private key file \"%s\" cannot be reloaded because it requires a passphrase",
175  ssl_key_file)));
176  else
177  ereport(isServerStart ? FATAL : LOG,
178  (errcode(ERRCODE_CONFIG_FILE_ERROR),
179  errmsg("could not load private key file \"%s\": %s",
180  ssl_key_file, SSLerrmessage(ERR_get_error()))));
181  goto error;
182  }
183 
184  if (SSL_CTX_check_private_key(context) != 1)
185  {
186  ereport(isServerStart ? FATAL : LOG,
187  (errcode(ERRCODE_CONFIG_FILE_ERROR),
188  errmsg("check of private key failed: %s",
189  SSLerrmessage(ERR_get_error()))));
190  goto error;
191  }
192 
194  {
196  "ssl_min_protocol_version",
197  isServerStart ? FATAL : LOG);
198 
199  if (ssl_ver == -1)
200  goto error;
201  if (!SSL_CTX_set_min_proto_version(context, ssl_ver))
202  {
203  ereport(isServerStart ? FATAL : LOG,
204  (errmsg("could not set minimum SSL protocol version")));
205  goto error;
206  }
207  }
208 
210  {
212  "ssl_max_protocol_version",
213  isServerStart ? FATAL : LOG);
214 
215  if (ssl_ver == -1)
216  goto error;
217  if (!SSL_CTX_set_max_proto_version(context, ssl_ver))
218  {
219  ereport(isServerStart ? FATAL : LOG,
220  (errmsg("could not set maximum SSL protocol version")));
221  goto error;
222  }
223  }
224 
225  /* disallow SSL session tickets */
226 #ifdef SSL_OP_NO_TICKET /* added in OpenSSL 0.9.8f */
227  SSL_CTX_set_options(context, SSL_OP_NO_TICKET);
228 #endif
229 
230  /* disallow SSL session caching, too */
231  SSL_CTX_set_session_cache_mode(context, SSL_SESS_CACHE_OFF);
232 
233  /* set up ephemeral DH and ECDH keys */
234  if (!initialize_dh(context, isServerStart))
235  goto error;
236  if (!initialize_ecdh(context, isServerStart))
237  goto error;
238 
239  /* set up the allowed cipher list */
240  if (SSL_CTX_set_cipher_list(context, SSLCipherSuites) != 1)
241  {
242  ereport(isServerStart ? FATAL : LOG,
243  (errcode(ERRCODE_CONFIG_FILE_ERROR),
244  errmsg("could not set the cipher list (no valid ciphers available)")));
245  goto error;
246  }
247 
248  /* Let server choose order */
250  SSL_CTX_set_options(context, SSL_OP_CIPHER_SERVER_PREFERENCE);
251 
252  /*
253  * Load CA store, so we can verify client certificates if needed.
254  */
255  if (ssl_ca_file[0])
256  {
257  if (SSL_CTX_load_verify_locations(context, ssl_ca_file, NULL) != 1 ||
258  (root_cert_list = SSL_load_client_CA_file(ssl_ca_file)) == NULL)
259  {
260  ereport(isServerStart ? FATAL : LOG,
261  (errcode(ERRCODE_CONFIG_FILE_ERROR),
262  errmsg("could not load root certificate file \"%s\": %s",
263  ssl_ca_file, SSLerrmessage(ERR_get_error()))));
264  goto error;
265  }
266  }
267 
268  /*----------
269  * Load the Certificate Revocation List (CRL).
270  * http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci803160,00.html
271  *----------
272  */
273  if (ssl_crl_file[0])
274  {
275  X509_STORE *cvstore = SSL_CTX_get_cert_store(context);
276 
277  if (cvstore)
278  {
279  /* Set the flags to check against the complete CRL chain */
280  if (X509_STORE_load_locations(cvstore, ssl_crl_file, NULL) == 1)
281  {
282  X509_STORE_set_flags(cvstore,
283  X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
284  }
285  else
286  {
287  ereport(isServerStart ? FATAL : LOG,
288  (errcode(ERRCODE_CONFIG_FILE_ERROR),
289  errmsg("could not load SSL certificate revocation list file \"%s\": %s",
290  ssl_crl_file, SSLerrmessage(ERR_get_error()))));
291  goto error;
292  }
293  }
294  }
295 
296  if (ssl_ca_file[0])
297  {
298  /*
299  * Always ask for SSL client cert, but don't fail if it's not
300  * presented. We might fail such connections later, depending on what
301  * we find in pg_hba.conf.
302  */
303  SSL_CTX_set_verify(context,
304  (SSL_VERIFY_PEER |
305  SSL_VERIFY_CLIENT_ONCE),
306  verify_cb);
307 
308  /*
309  * Tell OpenSSL to send the list of root certs we trust to clients in
310  * CertificateRequests. This lets a client with a keystore select the
311  * appropriate client certificate to send to us.
312  */
313  SSL_CTX_set_client_CA_list(context, root_cert_list);
314  }
315 
316  /*
317  * Success! Replace any existing SSL_context.
318  */
319  if (SSL_context)
320  SSL_CTX_free(SSL_context);
321 
322  SSL_context = context;
323 
324  /*
325  * Set flag to remember whether CA store has been loaded into SSL_context.
326  */
327  if (ssl_ca_file[0])
328  ssl_loaded_verify_locations = true;
329  else
330  ssl_loaded_verify_locations = false;
331 
332  return 0;
333 
334 error:
335  if (context)
336  SSL_CTX_free(context);
337  return -1;
338 }
339 
340 void
342 {
343  if (SSL_context)
344  SSL_CTX_free(SSL_context);
345  SSL_context = NULL;
346  ssl_loaded_verify_locations = false;
347 }
348 
349 int
351 {
352  int r;
353  int err;
354  int waitfor;
355  unsigned long ecode;
356 
357  Assert(!port->ssl);
358  Assert(!port->peer);
359 
360  if (!SSL_context)
361  {
363  (errcode(ERRCODE_PROTOCOL_VIOLATION),
364  errmsg("could not initialize SSL connection: SSL context not set up")));
365  return -1;
366  }
367 
368  if (!(port->ssl = SSL_new(SSL_context)))
369  {
371  (errcode(ERRCODE_PROTOCOL_VIOLATION),
372  errmsg("could not initialize SSL connection: %s",
373  SSLerrmessage(ERR_get_error()))));
374  return -1;
375  }
376  if (!my_SSL_set_fd(port, port->sock))
377  {
379  (errcode(ERRCODE_PROTOCOL_VIOLATION),
380  errmsg("could not set SSL socket: %s",
381  SSLerrmessage(ERR_get_error()))));
382  return -1;
383  }
384  port->ssl_in_use = true;
385 
386 aloop:
387 
388  /*
389  * Prepare to call SSL_get_error() by clearing thread's OpenSSL error
390  * queue. In general, the current thread's error queue must be empty
391  * before the TLS/SSL I/O operation is attempted, or SSL_get_error() will
392  * not work reliably. An extension may have failed to clear the
393  * per-thread error queue following another call to an OpenSSL I/O
394  * routine.
395  */
396  ERR_clear_error();
397  r = SSL_accept(port->ssl);
398  if (r <= 0)
399  {
400  err = SSL_get_error(port->ssl, r);
401 
402  /*
403  * Other clients of OpenSSL in the backend may fail to call
404  * ERR_get_error(), but we always do, so as to not cause problems for
405  * OpenSSL clients that don't call ERR_clear_error() defensively. Be
406  * sure that this happens by calling now. SSL_get_error() relies on
407  * the OpenSSL per-thread error queue being intact, so this is the
408  * earliest possible point ERR_get_error() may be called.
409  */
410  ecode = ERR_get_error();
411  switch (err)
412  {
413  case SSL_ERROR_WANT_READ:
414  case SSL_ERROR_WANT_WRITE:
415  /* not allowed during connection establishment */
416  Assert(!port->noblock);
417 
418  /*
419  * No need to care about timeouts/interrupts here. At this
420  * point authentication_timeout still employs
421  * StartupPacketTimeoutHandler() which directly exits.
422  */
423  if (err == SSL_ERROR_WANT_READ)
425  else
427 
428  (void) WaitLatchOrSocket(MyLatch, waitfor, port->sock, 0,
430  goto aloop;
431  case SSL_ERROR_SYSCALL:
432  if (r < 0)
435  errmsg("could not accept SSL connection: %m")));
436  else
438  (errcode(ERRCODE_PROTOCOL_VIOLATION),
439  errmsg("could not accept SSL connection: EOF detected")));
440  break;
441  case SSL_ERROR_SSL:
443  (errcode(ERRCODE_PROTOCOL_VIOLATION),
444  errmsg("could not accept SSL connection: %s",
445  SSLerrmessage(ecode))));
446  break;
447  case SSL_ERROR_ZERO_RETURN:
449  (errcode(ERRCODE_PROTOCOL_VIOLATION),
450  errmsg("could not accept SSL connection: EOF detected")));
451  break;
452  default:
454  (errcode(ERRCODE_PROTOCOL_VIOLATION),
455  errmsg("unrecognized SSL error code: %d",
456  err)));
457  break;
458  }
459  return -1;
460  }
461 
462  /* Get client certificate, if available. */
463  port->peer = SSL_get_peer_certificate(port->ssl);
464 
465  /* and extract the Common Name from it. */
466  port->peer_cn = NULL;
467  port->peer_cert_valid = false;
468  if (port->peer != NULL)
469  {
470  int len;
471 
472  len = X509_NAME_get_text_by_NID(X509_get_subject_name(port->peer),
473  NID_commonName, NULL, 0);
474  if (len != -1)
475  {
476  char *peer_cn;
477 
478  peer_cn = MemoryContextAlloc(TopMemoryContext, len + 1);
479  r = X509_NAME_get_text_by_NID(X509_get_subject_name(port->peer),
480  NID_commonName, peer_cn, len + 1);
481  peer_cn[len] = '\0';
482  if (r != len)
483  {
484  /* shouldn't happen */
485  pfree(peer_cn);
486  return -1;
487  }
488 
489  /*
490  * Reject embedded NULLs in certificate common name to prevent
491  * attacks like CVE-2009-4034.
492  */
493  if (len != strlen(peer_cn))
494  {
496  (errcode(ERRCODE_PROTOCOL_VIOLATION),
497  errmsg("SSL certificate's common name contains embedded null")));
498  pfree(peer_cn);
499  return -1;
500  }
501 
502  port->peer_cn = peer_cn;
503  }
504  port->peer_cert_valid = true;
505  }
506 
507  /* set up debugging/info callback */
508  SSL_CTX_set_info_callback(SSL_context, info_cb);
509 
510  return 0;
511 }
512 
513 void
515 {
516  if (port->ssl)
517  {
518  SSL_shutdown(port->ssl);
519  SSL_free(port->ssl);
520  port->ssl = NULL;
521  port->ssl_in_use = false;
522  }
523 
524  if (port->peer)
525  {
526  X509_free(port->peer);
527  port->peer = NULL;
528  }
529 
530  if (port->peer_cn)
531  {
532  pfree(port->peer_cn);
533  port->peer_cn = NULL;
534  }
535 }
536 
537 ssize_t
538 be_tls_read(Port *port, void *ptr, size_t len, int *waitfor)
539 {
540  ssize_t n;
541  int err;
542  unsigned long ecode;
543 
544  errno = 0;
545  ERR_clear_error();
546  n = SSL_read(port->ssl, ptr, len);
547  err = SSL_get_error(port->ssl, n);
548  ecode = (err != SSL_ERROR_NONE || n < 0) ? ERR_get_error() : 0;
549  switch (err)
550  {
551  case SSL_ERROR_NONE:
552  /* a-ok */
553  break;
554  case SSL_ERROR_WANT_READ:
555  *waitfor = WL_SOCKET_READABLE;
556  errno = EWOULDBLOCK;
557  n = -1;
558  break;
559  case SSL_ERROR_WANT_WRITE:
560  *waitfor = WL_SOCKET_WRITEABLE;
561  errno = EWOULDBLOCK;
562  n = -1;
563  break;
564  case SSL_ERROR_SYSCALL:
565  /* leave it to caller to ereport the value of errno */
566  if (n != -1)
567  {
568  errno = ECONNRESET;
569  n = -1;
570  }
571  break;
572  case SSL_ERROR_SSL:
574  (errcode(ERRCODE_PROTOCOL_VIOLATION),
575  errmsg("SSL error: %s", SSLerrmessage(ecode))));
576  errno = ECONNRESET;
577  n = -1;
578  break;
579  case SSL_ERROR_ZERO_RETURN:
580  /* connection was cleanly shut down by peer */
581  n = 0;
582  break;
583  default:
585  (errcode(ERRCODE_PROTOCOL_VIOLATION),
586  errmsg("unrecognized SSL error code: %d",
587  err)));
588  errno = ECONNRESET;
589  n = -1;
590  break;
591  }
592 
593  return n;
594 }
595 
596 ssize_t
597 be_tls_write(Port *port, void *ptr, size_t len, int *waitfor)
598 {
599  ssize_t n;
600  int err;
601  unsigned long ecode;
602 
603  errno = 0;
604  ERR_clear_error();
605  n = SSL_write(port->ssl, ptr, len);
606  err = SSL_get_error(port->ssl, n);
607  ecode = (err != SSL_ERROR_NONE || n < 0) ? ERR_get_error() : 0;
608  switch (err)
609  {
610  case SSL_ERROR_NONE:
611  /* a-ok */
612  break;
613  case SSL_ERROR_WANT_READ:
614  *waitfor = WL_SOCKET_READABLE;
615  errno = EWOULDBLOCK;
616  n = -1;
617  break;
618  case SSL_ERROR_WANT_WRITE:
619  *waitfor = WL_SOCKET_WRITEABLE;
620  errno = EWOULDBLOCK;
621  n = -1;
622  break;
623  case SSL_ERROR_SYSCALL:
624  /* leave it to caller to ereport the value of errno */
625  if (n != -1)
626  {
627  errno = ECONNRESET;
628  n = -1;
629  }
630  break;
631  case SSL_ERROR_SSL:
633  (errcode(ERRCODE_PROTOCOL_VIOLATION),
634  errmsg("SSL error: %s", SSLerrmessage(ecode))));
635  errno = ECONNRESET;
636  n = -1;
637  break;
638  case SSL_ERROR_ZERO_RETURN:
639 
640  /*
641  * the SSL connection was closed, leave it to the caller to
642  * ereport it
643  */
644  errno = ECONNRESET;
645  n = -1;
646  break;
647  default:
649  (errcode(ERRCODE_PROTOCOL_VIOLATION),
650  errmsg("unrecognized SSL error code: %d",
651  err)));
652  errno = ECONNRESET;
653  n = -1;
654  break;
655  }
656 
657  return n;
658 }
659 
660 /* ------------------------------------------------------------ */
661 /* Internal functions */
662 /* ------------------------------------------------------------ */
663 
664 /*
665  * Private substitute BIO: this does the sending and receiving using send() and
666  * recv() instead. This is so that we can enable and disable interrupts
667  * just while calling recv(). We cannot have interrupts occurring while
668  * the bulk of OpenSSL runs, because it uses malloc() and possibly other
669  * non-reentrant libc facilities. We also need to call send() and recv()
670  * directly so it gets passed through the socket/signals layer on Win32.
671  *
672  * These functions are closely modelled on the standard socket BIO in OpenSSL;
673  * see sock_read() and sock_write() in OpenSSL's crypto/bio/bss_sock.c.
674  * XXX OpenSSL 1.0.1e considers many more errcodes than just EINTR as reasons
675  * to retry; do we need to adopt their logic for that?
676  */
677 
678 #ifndef HAVE_BIO_GET_DATA
679 #define BIO_get_data(bio) (bio->ptr)
680 #define BIO_set_data(bio, data) (bio->ptr = data)
681 #endif
682 
683 static BIO_METHOD *my_bio_methods = NULL;
684 
685 static int
686 my_sock_read(BIO *h, char *buf, int size)
687 {
688  int res = 0;
689 
690  if (buf != NULL)
691  {
692  res = secure_raw_read(((Port *) BIO_get_data(h)), buf, size);
693  BIO_clear_retry_flags(h);
694  if (res <= 0)
695  {
696  /* If we were interrupted, tell caller to retry */
697  if (errno == EINTR || errno == EWOULDBLOCK || errno == EAGAIN)
698  {
699  BIO_set_retry_read(h);
700  }
701  }
702  }
703 
704  return res;
705 }
706 
707 static int
708 my_sock_write(BIO *h, const char *buf, int size)
709 {
710  int res = 0;
711 
712  res = secure_raw_write(((Port *) BIO_get_data(h)), buf, size);
713  BIO_clear_retry_flags(h);
714  if (res <= 0)
715  {
716  /* If we were interrupted, tell caller to retry */
717  if (errno == EINTR || errno == EWOULDBLOCK || errno == EAGAIN)
718  {
719  BIO_set_retry_write(h);
720  }
721  }
722 
723  return res;
724 }
725 
726 static BIO_METHOD *
728 {
729  if (!my_bio_methods)
730  {
731  BIO_METHOD *biom = (BIO_METHOD *) BIO_s_socket();
732 #ifdef HAVE_BIO_METH_NEW
733  int my_bio_index;
734 
735  my_bio_index = BIO_get_new_index();
736  if (my_bio_index == -1)
737  return NULL;
738  my_bio_methods = BIO_meth_new(my_bio_index, "PostgreSQL backend socket");
739  if (!my_bio_methods)
740  return NULL;
741  if (!BIO_meth_set_write(my_bio_methods, my_sock_write) ||
742  !BIO_meth_set_read(my_bio_methods, my_sock_read) ||
743  !BIO_meth_set_gets(my_bio_methods, BIO_meth_get_gets(biom)) ||
744  !BIO_meth_set_puts(my_bio_methods, BIO_meth_get_puts(biom)) ||
745  !BIO_meth_set_ctrl(my_bio_methods, BIO_meth_get_ctrl(biom)) ||
746  !BIO_meth_set_create(my_bio_methods, BIO_meth_get_create(biom)) ||
747  !BIO_meth_set_destroy(my_bio_methods, BIO_meth_get_destroy(biom)) ||
748  !BIO_meth_set_callback_ctrl(my_bio_methods, BIO_meth_get_callback_ctrl(biom)))
749  {
750  BIO_meth_free(my_bio_methods);
751  my_bio_methods = NULL;
752  return NULL;
753  }
754 #else
755  my_bio_methods = malloc(sizeof(BIO_METHOD));
756  if (!my_bio_methods)
757  return NULL;
758  memcpy(my_bio_methods, biom, sizeof(BIO_METHOD));
759  my_bio_methods->bread = my_sock_read;
760  my_bio_methods->bwrite = my_sock_write;
761 #endif
762  }
763  return my_bio_methods;
764 }
765 
766 /* This should exactly match OpenSSL's SSL_set_fd except for using my BIO */
767 static int
769 {
770  int ret = 0;
771  BIO *bio;
772  BIO_METHOD *bio_method;
773 
774  bio_method = my_BIO_s_socket();
775  if (bio_method == NULL)
776  {
777  SSLerr(SSL_F_SSL_SET_FD, ERR_R_BUF_LIB);
778  goto err;
779  }
780  bio = BIO_new(bio_method);
781 
782  if (bio == NULL)
783  {
784  SSLerr(SSL_F_SSL_SET_FD, ERR_R_BUF_LIB);
785  goto err;
786  }
787  BIO_set_data(bio, port);
788 
789  BIO_set_fd(bio, fd, BIO_NOCLOSE);
790  SSL_set_bio(port->ssl, bio, bio);
791  ret = 1;
792 err:
793  return ret;
794 }
795 
796 /*
797  * Load precomputed DH parameters.
798  *
799  * To prevent "downgrade" attacks, we perform a number of checks
800  * to verify that the DBA-generated DH parameters file contains
801  * what we expect it to contain.
802  */
803 static DH *
804 load_dh_file(char *filename, bool isServerStart)
805 {
806  FILE *fp;
807  DH *dh = NULL;
808  int codes;
809 
810  /* attempt to open file. It's not an error if it doesn't exist. */
811  if ((fp = AllocateFile(filename, "r")) == NULL)
812  {
813  ereport(isServerStart ? FATAL : LOG,
815  errmsg("could not open DH parameters file \"%s\": %m",
816  filename)));
817  return NULL;
818  }
819 
820  dh = PEM_read_DHparams(fp, NULL, NULL, NULL);
821  FreeFile(fp);
822 
823  if (dh == NULL)
824  {
825  ereport(isServerStart ? FATAL : LOG,
826  (errcode(ERRCODE_CONFIG_FILE_ERROR),
827  errmsg("could not load DH parameters file: %s",
828  SSLerrmessage(ERR_get_error()))));
829  return NULL;
830  }
831 
832  /* make sure the DH parameters are usable */
833  if (DH_check(dh, &codes) == 0)
834  {
835  ereport(isServerStart ? FATAL : LOG,
836  (errcode(ERRCODE_CONFIG_FILE_ERROR),
837  errmsg("invalid DH parameters: %s",
838  SSLerrmessage(ERR_get_error()))));
839  return NULL;
840  }
841  if (codes & DH_CHECK_P_NOT_PRIME)
842  {
843  ereport(isServerStart ? FATAL : LOG,
844  (errcode(ERRCODE_CONFIG_FILE_ERROR),
845  errmsg("invalid DH parameters: p is not prime")));
846  return NULL;
847  }
848  if ((codes & DH_NOT_SUITABLE_GENERATOR) &&
849  (codes & DH_CHECK_P_NOT_SAFE_PRIME))
850  {
851  ereport(isServerStart ? FATAL : LOG,
852  (errcode(ERRCODE_CONFIG_FILE_ERROR),
853  errmsg("invalid DH parameters: neither suitable generator or safe prime")));
854  return NULL;
855  }
856 
857  return dh;
858 }
859 
860 /*
861  * Load hardcoded DH parameters.
862  *
863  * To prevent problems if the DH parameters files don't even
864  * exist, we can load DH parameters hardcoded into this file.
865  */
866 static DH *
867 load_dh_buffer(const char *buffer, size_t len)
868 {
869  BIO *bio;
870  DH *dh = NULL;
871 
872  bio = BIO_new_mem_buf(unconstify(char *, buffer), len);
873  if (bio == NULL)
874  return NULL;
875  dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
876  if (dh == NULL)
877  ereport(DEBUG2,
878  (errmsg_internal("DH load buffer: %s",
879  SSLerrmessage(ERR_get_error()))));
880  BIO_free(bio);
881 
882  return dh;
883 }
884 
885 /*
886  * Passphrase collection callback using ssl_passphrase_command
887  */
888 static int
889 ssl_external_passwd_cb(char *buf, int size, int rwflag, void *userdata)
890 {
891  /* same prompt as OpenSSL uses internally */
892  const char *prompt = "Enter PEM pass phrase:";
893 
894  Assert(rwflag == 0);
895 
896  return run_ssl_passphrase_command(prompt, ssl_is_server_start, buf, size);
897 }
898 
899 /*
900  * Dummy passphrase callback
901  *
902  * If OpenSSL is told to use a passphrase-protected server key, by default
903  * it will issue a prompt on /dev/tty and try to read a key from there.
904  * That's no good during a postmaster SIGHUP cycle, not to mention SSL context
905  * reload in an EXEC_BACKEND postmaster child. So override it with this dummy
906  * function that just returns an empty passphrase, guaranteeing failure.
907  */
908 static int
909 dummy_ssl_passwd_cb(char *buf, int size, int rwflag, void *userdata)
910 {
911  /* Set flag to change the error message we'll report */
913  /* And return empty string */
914  Assert(size > 0);
915  buf[0] = '\0';
916  return 0;
917 }
918 
919 /*
920  * Certificate verification callback
921  *
922  * This callback allows us to log intermediate problems during
923  * verification, but for now we'll see if the final error message
924  * contains enough information.
925  *
926  * This callback also allows us to override the default acceptance
927  * criteria (e.g., accepting self-signed or expired certs), but
928  * for now we accept the default checks.
929  */
930 static int
931 verify_cb(int ok, X509_STORE_CTX *ctx)
932 {
933  return ok;
934 }
935 
936 /*
937  * This callback is used to copy SSL information messages
938  * into the PostgreSQL log.
939  */
940 static void
941 info_cb(const SSL *ssl, int type, int args)
942 {
943  switch (type)
944  {
945  case SSL_CB_HANDSHAKE_START:
946  ereport(DEBUG4,
947  (errmsg_internal("SSL: handshake start")));
948  break;
949  case SSL_CB_HANDSHAKE_DONE:
950  ereport(DEBUG4,
951  (errmsg_internal("SSL: handshake done")));
952  break;
953  case SSL_CB_ACCEPT_LOOP:
954  ereport(DEBUG4,
955  (errmsg_internal("SSL: accept loop")));
956  break;
957  case SSL_CB_ACCEPT_EXIT:
958  ereport(DEBUG4,
959  (errmsg_internal("SSL: accept exit (%d)", args)));
960  break;
961  case SSL_CB_CONNECT_LOOP:
962  ereport(DEBUG4,
963  (errmsg_internal("SSL: connect loop")));
964  break;
965  case SSL_CB_CONNECT_EXIT:
966  ereport(DEBUG4,
967  (errmsg_internal("SSL: connect exit (%d)", args)));
968  break;
969  case SSL_CB_READ_ALERT:
970  ereport(DEBUG4,
971  (errmsg_internal("SSL: read alert (0x%04x)", args)));
972  break;
973  case SSL_CB_WRITE_ALERT:
974  ereport(DEBUG4,
975  (errmsg_internal("SSL: write alert (0x%04x)", args)));
976  break;
977  }
978 }
979 
980 /*
981  * Set DH parameters for generating ephemeral DH keys. The
982  * DH parameters can take a long time to compute, so they must be
983  * precomputed.
984  *
985  * Since few sites will bother to create a parameter file, we also
986  * provide a fallback to the parameters provided by the OpenSSL
987  * project.
988  *
989  * These values can be static (once loaded or computed) since the
990  * OpenSSL library can efficiently generate random keys from the
991  * information provided.
992  */
993 static bool
994 initialize_dh(SSL_CTX *context, bool isServerStart)
995 {
996  DH *dh = NULL;
997 
998  SSL_CTX_set_options(context, SSL_OP_SINGLE_DH_USE);
999 
1000  if (ssl_dh_params_file[0])
1001  dh = load_dh_file(ssl_dh_params_file, isServerStart);
1002  if (!dh)
1003  dh = load_dh_buffer(FILE_DH2048, sizeof(FILE_DH2048));
1004  if (!dh)
1005  {
1006  ereport(isServerStart ? FATAL : LOG,
1007  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1008  (errmsg("DH: could not load DH parameters"))));
1009  return false;
1010  }
1011 
1012  if (SSL_CTX_set_tmp_dh(context, dh) != 1)
1013  {
1014  ereport(isServerStart ? FATAL : LOG,
1015  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1016  (errmsg("DH: could not set DH parameters: %s",
1017  SSLerrmessage(ERR_get_error())))));
1018  return false;
1019  }
1020  return true;
1021 }
1022 
1023 /*
1024  * Set ECDH parameters for generating ephemeral Elliptic Curve DH
1025  * keys. This is much simpler than the DH parameters, as we just
1026  * need to provide the name of the curve to OpenSSL.
1027  */
1028 static bool
1029 initialize_ecdh(SSL_CTX *context, bool isServerStart)
1030 {
1031 #ifndef OPENSSL_NO_ECDH
1032  EC_KEY *ecdh;
1033  int nid;
1034 
1035  nid = OBJ_sn2nid(SSLECDHCurve);
1036  if (!nid)
1037  {
1038  ereport(isServerStart ? FATAL : LOG,
1039  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1040  errmsg("ECDH: unrecognized curve name: %s", SSLECDHCurve)));
1041  return false;
1042  }
1043 
1044  ecdh = EC_KEY_new_by_curve_name(nid);
1045  if (!ecdh)
1046  {
1047  ereport(isServerStart ? FATAL : LOG,
1048  (errcode(ERRCODE_CONFIG_FILE_ERROR),
1049  errmsg("ECDH: could not create key")));
1050  return false;
1051  }
1052 
1053  SSL_CTX_set_options(context, SSL_OP_SINGLE_ECDH_USE);
1054  SSL_CTX_set_tmp_ecdh(context, ecdh);
1055  EC_KEY_free(ecdh);
1056 #endif
1057 
1058  return true;
1059 }
1060 
1061 /*
1062  * Obtain reason string for passed SSL errcode
1063  *
1064  * ERR_get_error() is used by caller to get errcode to pass here.
1065  *
1066  * Some caution is needed here since ERR_reason_error_string will
1067  * return NULL if it doesn't recognize the error code. We don't
1068  * want to return NULL ever.
1069  */
1070 static const char *
1071 SSLerrmessage(unsigned long ecode)
1072 {
1073  const char *errreason;
1074  static char errbuf[36];
1075 
1076  if (ecode == 0)
1077  return _("no SSL error reported");
1078  errreason = ERR_reason_error_string(ecode);
1079  if (errreason != NULL)
1080  return errreason;
1081  snprintf(errbuf, sizeof(errbuf), _("SSL error code %lu"), ecode);
1082  return errbuf;
1083 }
1084 
1085 int
1087 {
1088  int bits;
1089 
1090  if (port->ssl)
1091  {
1092  SSL_get_cipher_bits(port->ssl, &bits);
1093  return bits;
1094  }
1095  else
1096  return 0;
1097 }
1098 
1099 bool
1101 {
1102  if (port->ssl)
1103  return (SSL_get_current_compression(port->ssl) != NULL);
1104  else
1105  return false;
1106 }
1107 
1108 const char *
1110 {
1111  if (port->ssl)
1112  return SSL_get_version(port->ssl);
1113  else
1114  return NULL;
1115 }
1116 
1117 const char *
1119 {
1120  if (port->ssl)
1121  return SSL_get_cipher(port->ssl);
1122  else
1123  return NULL;
1124 }
1125 
1126 void
1127 be_tls_get_peer_subject_name(Port *port, char *ptr, size_t len)
1128 {
1129  if (port->peer)
1130  strlcpy(ptr, X509_NAME_to_cstring(X509_get_subject_name(port->peer)), len);
1131  else
1132  ptr[0] = '\0';
1133 }
1134 
1135 void
1136 be_tls_get_peer_issuer_name(Port *port, char *ptr, size_t len)
1137 {
1138  if (port->peer)
1139  strlcpy(ptr, X509_NAME_to_cstring(X509_get_issuer_name(port->peer)), len);
1140  else
1141  ptr[0] = '\0';
1142 }
1143 
1144 void
1145 be_tls_get_peer_serial(Port *port, char *ptr, size_t len)
1146 {
1147  if (port->peer)
1148  {
1149  ASN1_INTEGER *serial;
1150  BIGNUM *b;
1151  char *decimal;
1152 
1153  serial = X509_get_serialNumber(port->peer);
1154  b = ASN1_INTEGER_to_BN(serial, NULL);
1155  decimal = BN_bn2dec(b);
1156 
1157  BN_free(b);
1158  strlcpy(ptr, decimal, len);
1159  OPENSSL_free(decimal);
1160  }
1161  else
1162  ptr[0] = '\0';
1163 }
1164 
1165 #ifdef HAVE_X509_GET_SIGNATURE_NID
1166 char *
1167 be_tls_get_certificate_hash(Port *port, size_t *len)
1168 {
1169  X509 *server_cert;
1170  char *cert_hash;
1171  const EVP_MD *algo_type = NULL;
1172  unsigned char hash[EVP_MAX_MD_SIZE]; /* size for SHA-512 */
1173  unsigned int hash_size;
1174  int algo_nid;
1175 
1176  *len = 0;
1177  server_cert = SSL_get_certificate(port->ssl);
1178  if (server_cert == NULL)
1179  return NULL;
1180 
1181  /*
1182  * Get the signature algorithm of the certificate to determine the hash
1183  * algorithm to use for the result.
1184  */
1185  if (!OBJ_find_sigid_algs(X509_get_signature_nid(server_cert),
1186  &algo_nid, NULL))
1187  elog(ERROR, "could not determine server certificate signature algorithm");
1188 
1189  /*
1190  * The TLS server's certificate bytes need to be hashed with SHA-256 if
1191  * its signature algorithm is MD5 or SHA-1 as per RFC 5929
1192  * (https://tools.ietf.org/html/rfc5929#section-4.1). If something else
1193  * is used, the same hash as the signature algorithm is used.
1194  */
1195  switch (algo_nid)
1196  {
1197  case NID_md5:
1198  case NID_sha1:
1199  algo_type = EVP_sha256();
1200  break;
1201  default:
1202  algo_type = EVP_get_digestbynid(algo_nid);
1203  if (algo_type == NULL)
1204  elog(ERROR, "could not find digest for NID %s",
1205  OBJ_nid2sn(algo_nid));
1206  break;
1207  }
1208 
1209  /* generate and save the certificate hash */
1210  if (!X509_digest(server_cert, algo_type, hash, &hash_size))
1211  elog(ERROR, "could not generate server certificate hash");
1212 
1213  cert_hash = palloc(hash_size);
1214  memcpy(cert_hash, hash, hash_size);
1215  *len = hash_size;
1216 
1217  return cert_hash;
1218 }
1219 #endif
1220 
1221 /*
1222  * Convert an X509 subject name to a cstring.
1223  *
1224  */
1225 static char *
1227 {
1228  BIO *membuf = BIO_new(BIO_s_mem());
1229  int i,
1230  nid,
1231  count = X509_NAME_entry_count(name);
1232  X509_NAME_ENTRY *e;
1233  ASN1_STRING *v;
1234  const char *field_name;
1235  size_t size;
1236  char nullterm;
1237  char *sp;
1238  char *dp;
1239  char *result;
1240 
1241  (void) BIO_set_close(membuf, BIO_CLOSE);
1242  for (i = 0; i < count; i++)
1243  {
1244  e = X509_NAME_get_entry(name, i);
1245  nid = OBJ_obj2nid(X509_NAME_ENTRY_get_object(e));
1246  v = X509_NAME_ENTRY_get_data(e);
1247  field_name = OBJ_nid2sn(nid);
1248  if (!field_name)
1249  field_name = OBJ_nid2ln(nid);
1250  BIO_printf(membuf, "/%s=", field_name);
1251  ASN1_STRING_print_ex(membuf, v,
1252  ((ASN1_STRFLGS_RFC2253 & ~ASN1_STRFLGS_ESC_MSB)
1253  | ASN1_STRFLGS_UTF8_CONVERT));
1254  }
1255 
1256  /* ensure null termination of the BIO's content */
1257  nullterm = '\0';
1258  BIO_write(membuf, &nullterm, 1);
1259  size = BIO_get_mem_data(membuf, &sp);
1260  dp = pg_any_to_server(sp, size - 1, PG_UTF8);
1261 
1262  result = pstrdup(dp);
1263  if (dp != sp)
1264  pfree(dp);
1265  BIO_free(membuf);
1266 
1267  return result;
1268 }
1269 
1270 /*
1271  * Convert TLS protocol version GUC enum to OpenSSL values
1272  *
1273  * This is a straightforward one-to-one mapping, but doing it this way makes
1274  * guc.c independent of OpenSSL availability and version.
1275  *
1276  * If a version is passed that is not supported by the current OpenSSL
1277  * version, then we log with the given loglevel and return (if we return) -1.
1278  * If a nonnegative value is returned, subsequent code can assume it's working
1279  * with a supported version.
1280  */
1281 static int
1282 ssl_protocol_version_to_openssl(int v, const char *guc_name, int loglevel)
1283 {
1284  switch (v)
1285  {
1286  case PG_TLS_ANY:
1287  return 0;
1288  case PG_TLS1_VERSION:
1289  return TLS1_VERSION;
1290  case PG_TLS1_1_VERSION:
1291 #ifdef TLS1_1_VERSION
1292  return TLS1_1_VERSION;
1293 #else
1294  break;
1295 #endif
1296  case PG_TLS1_2_VERSION:
1297 #ifdef TLS1_2_VERSION
1298  return TLS1_2_VERSION;
1299 #else
1300  break;
1301 #endif
1302  case PG_TLS1_3_VERSION:
1303 #ifdef TLS1_3_VERSION
1304  return TLS1_3_VERSION;
1305 #else
1306  break;
1307 #endif
1308  }
1309 
1310  ereport(loglevel,
1311  (errmsg("%s setting %s not supported by this build",
1312  guc_name,
1313  GetConfigOption(guc_name, false, false))));
1314  return -1;
1315 }
1316 
1317 /*
1318  * Replacements for APIs present in newer versions of OpenSSL
1319  */
1320 #ifndef SSL_CTX_set_min_proto_version
1321 
1322 /*
1323  * OpenSSL versions that support TLS 1.3 shouldn't get here because they
1324  * already have these functions. So we don't have to keep updating the below
1325  * code for every new TLS version, and eventually it can go away. But let's
1326  * just check this to make sure ...
1327  */
1328 #ifdef TLS1_3_VERSION
1329 #error OpenSSL version mismatch
1330 #endif
1331 
1332 static int
1333 SSL_CTX_set_min_proto_version(SSL_CTX *ctx, int version)
1334 {
1335  int ssl_options = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3;
1336 
1337  if (version > TLS1_VERSION)
1338  ssl_options |= SSL_OP_NO_TLSv1;
1339  /*
1340  * Some OpenSSL versions define TLS*_VERSION macros but not the
1341  * corresponding SSL_OP_NO_* macro, so in those cases we have to return
1342  * unsuccessfully here.
1343  */
1344 #ifdef TLS1_1_VERSION
1345  if (version > TLS1_1_VERSION)
1346  {
1347 #ifdef SSL_OP_NO_TLSv1_1
1348  ssl_options |= SSL_OP_NO_TLSv1_1;
1349 #else
1350  return 0;
1351 #endif
1352  }
1353 #endif
1354 #ifdef TLS1_2_VERSION
1355  if (version > TLS1_2_VERSION)
1356  {
1357 #ifdef SSL_OP_NO_TLSv1_2
1358  ssl_options |= SSL_OP_NO_TLSv1_2;
1359 #else
1360  return 0;
1361 #endif
1362  }
1363 #endif
1364 
1365  SSL_CTX_set_options(ctx, ssl_options);
1366 
1367  return 1; /* success */
1368 }
1369 
1370 static int
1371 SSL_CTX_set_max_proto_version(SSL_CTX *ctx, int version)
1372 {
1373  int ssl_options = 0;
1374 
1375  AssertArg(version != 0);
1376 
1377  /*
1378  * Some OpenSSL versions define TLS*_VERSION macros but not the
1379  * corresponding SSL_OP_NO_* macro, so in those cases we have to return
1380  * unsuccessfully here.
1381  */
1382 #ifdef TLS1_1_VERSION
1383  if (version < TLS1_1_VERSION)
1384  {
1385 #ifdef SSL_OP_NO_TLSv1_1
1386  ssl_options |= SSL_OP_NO_TLSv1_1;
1387 #else
1388  return 0;
1389 #endif
1390  }
1391 #endif
1392 #ifdef TLS1_2_VERSION
1393  if (version < TLS1_2_VERSION)
1394  {
1395 #ifdef SSL_OP_NO_TLSv1_2
1396  ssl_options |= SSL_OP_NO_TLSv1_2;
1397 #else
1398  return 0;
1399 #endif
1400  }
1401 #endif
1402 
1403  SSL_CTX_set_options(ctx, ssl_options);
1404 
1405  return 1; /* success */
1406 }
1407 
1408 #endif /* !SSL_CTX_set_min_proto_version */
ssize_t be_tls_read(Port *port, void *ptr, size_t len, int *waitfor)
#define WL_SOCKET_WRITEABLE
Definition: latch.h:126
static int SSL_CTX_set_max_proto_version(SSL_CTX *ctx, int version)
#define BIO_set_data(bio, data)
static void error(void)
Definition: sql-dyntest.c:147
static int SSL_CTX_set_min_proto_version(SSL_CTX *ctx, int version)
static bool dummy_ssl_passwd_cb_called
#define EAGAIN
Definition: win32_port.h:321
static BIO_METHOD * my_BIO_s_socket(void)
static DH * load_dh_file(char *filename, bool isServerStart)
char * peer_cn
Definition: libpq-be.h:191
#define BIO_get_data(bio)
char * pstrdup(const char *in)
Definition: mcxt.c:1186
bool peer_cert_valid
Definition: libpq-be.h:192
ssize_t secure_raw_write(Port *port, const void *ptr, size_t len)
Definition: be-secure.c:330
static void info_cb(const SSL *ssl, int type, int args)
const char * GetConfigOption(const char *name, bool missing_ok, bool restrict_privileged)
Definition: guc.c:7551
int errcode(int sqlerrcode)
Definition: elog.c:608
Definition: libpq-be.h:120
bool ssl_in_use
Definition: libpq-be.h:190
#define WL_SOCKET_READABLE
Definition: latch.h:125
char * ssl_cert_file
Definition: be-secure.c:41
static bool initialize_ecdh(SSL_CTX *context, bool isServerStart)
#define LOG
Definition: elog.h:26
#define DEBUG4
Definition: elog.h:22
char * ssl_crl_file
Definition: be-secure.c:44
static int fd(const char *x, int i)
Definition: preproc-init.c:105
static int ssl_protocol_version_to_openssl(int v, const char *guc_name, int loglevel)
pgsocket sock
Definition: libpq-be.h:122
int be_tls_init(bool isServerStart)
int ssl_min_protocol_version
Definition: be-secure.c:62
#define malloc(a)
Definition: header.h:50
void pfree(void *pointer)
Definition: mcxt.c:1056
static int my_SSL_set_fd(Port *port, int fd)
#define ERROR
Definition: elog.h:43
bool be_tls_get_compression(Port *port)
#define FATAL
Definition: elog.h:52
char * SSLECDHCurve
Definition: be-secure.c:57
#define DEBUG2
Definition: elog.h:24
ssize_t be_tls_write(Port *port, void *ptr, size_t len, int *waitfor)
static char * buf
Definition: pg_test_fsync.c:67
#define COMMERROR
Definition: elog.h:30
int errcode_for_file_access(void)
Definition: elog.c:631
static bool SSL_initialized
char * SSLCipherSuites
Definition: be-secure.c:54
FILE * AllocateFile(const char *name, const char *mode)
Definition: fd.c:2204
static int verify_cb(int, X509_STORE_CTX *)
int WaitLatchOrSocket(Latch *latch, int wakeEvents, pgsocket sock, long timeout, uint32 wait_event_info)
Definition: latch.c:369
static DH * load_dh_buffer(const char *, size_t)
void be_tls_destroy(void)
#define ereport(elevel, rest)
Definition: elog.h:141
#define AssertArg(condition)
Definition: c.h:735
MemoryContext TopMemoryContext
Definition: mcxt.c:44
static char * X509_NAME_to_cstring(X509_NAME *name)
bool ssl_passphrase_command_supports_reload
Definition: be-secure.c:47
int errcode_for_socket_access(void)
Definition: elog.c:702
static int port
Definition: pg_regress.c:91
#define unconstify(underlying_type, expr)
Definition: c.h:1188
static int ssl_external_passwd_cb(char *buf, int size, int rwflag, void *userdata)
#define SSL_get_current_compression(x)
Definition: port.h:450
int be_tls_get_cipher_bits(Port *port)
static bool ssl_is_server_start
static bool initialize_dh(SSL_CTX *context, bool isServerStart)
char * ssl_ca_file
Definition: be-secure.c:43
int be_tls_open_server(Port *port)
ssize_t secure_raw_read(Port *port, void *ptr, size_t len)
Definition: be-secure.c:234
size_t strlcpy(char *dst, const char *src, size_t siz)
Definition: strlcpy.c:45
int errmsg_internal(const char *fmt,...)
Definition: elog.c:911
static BIO_METHOD * my_bio_methods
#define Assert(condition)
Definition: c.h:733
static int my_sock_read(BIO *h, char *buf, int size)
bool noblock
Definition: libpq-be.h:123
#define ECONNRESET
Definition: win32_port.h:333
char * ssl_dh_params_file
Definition: be-secure.c:45
const char * name
Definition: encode.c:521
const char * be_tls_get_version(Port *port)
void be_tls_get_peer_issuer_name(Port *port, char *ptr, size_t len)
int ssl_max_protocol_version
Definition: be-secure.c:63
int FreeFile(FILE *file)
Definition: fd.c:2403
static char * filename
Definition: pg_dumpall.c:90
e
Definition: preproc-init.c:82
void be_tls_get_peer_subject_name(Port *port, char *ptr, size_t len)
void * palloc(Size size)
Definition: mcxt.c:949
int errmsg(const char *fmt,...)
Definition: elog.c:822
static SSL_CTX * SSL_context
void * MemoryContextAlloc(MemoryContext context, Size size)
Definition: mcxt.c:796
void be_tls_get_peer_serial(Port *port, char *ptr, size_t len)
static int my_sock_write(BIO *h, const char *buf, int size)
#define elog(elevel,...)
Definition: elog.h:228
int i
static const char * SSLerrmessage(unsigned long ecode)
void be_tls_close(Port *port)
struct Latch * MyLatch
Definition: globals.c:54
const char * be_tls_get_cipher(Port *port)
#define EWOULDBLOCK
Definition: win32_port.h:329
int run_ssl_passphrase_command(const char *prompt, bool is_server_start, char *buf, int size)
char * ssl_passphrase_command
Definition: be-secure.c:46
#define EINTR
Definition: win32_port.h:323
char * pg_any_to_server(const char *s, int len, int encoding)
Definition: mbutils.c:581
static int dummy_ssl_passwd_cb(char *buf, int size, int rwflag, void *userdata)
static unsigned hash(unsigned *uv, int n)
Definition: rege_dfa.c:541
#define snprintf
Definition: port.h:192
#define _(x)
Definition: elog.c:87
char * ssl_key_file
Definition: be-secure.c:42
#define WL_EXIT_ON_PM_DEATH
Definition: latch.h:129
bool SSLPreferServerCiphers
Definition: be-secure.c:60
bool check_ssl_key_file_permissions(const char *ssl_key_file, bool isServerStart)