60 #include <openssl/conf.h>
62 #include <openssl/engine.h>
64 #include <openssl/x509v3.h>
67 static int verify_cb(
int ok, X509_STORE_CTX *ctx);
69 ASN1_STRING *name_entry,
72 ASN1_OCTET_STRING *addr_entry,
98 static long win32_ssl_create_mutex = 0;
126 if (
conn->ssl == NULL)
148 int result_errno = 0;
166 n = SSL_read(
conn->ssl, ptr,
len);
167 err = SSL_get_error(
conn->ssl, n);
177 ecode = (
err != SSL_ERROR_NONE || n < 0) ? ERR_get_error() : 0;
185 "SSL_read failed but did not provide error information\n");
190 case SSL_ERROR_WANT_READ:
193 case SSL_ERROR_WANT_WRITE:
202 case SSL_ERROR_SYSCALL:
206 if (result_errno == EPIPE ||
209 "\tThis probably means the server terminated abnormally\n"
210 "\tbefore or while processing the request.");
214 sebuf,
sizeof(sebuf)));
235 case SSL_ERROR_ZERO_RETURN:
263 return SSL_pending(
conn->ssl) > 0;
270 int result_errno = 0;
277 n = SSL_write(
conn->ssl, ptr,
len);
278 err = SSL_get_error(
conn->ssl, n);
279 ecode = (
err != SSL_ERROR_NONE || n < 0) ? ERR_get_error() : 0;
287 "SSL_write failed but did not provide error information\n");
292 case SSL_ERROR_WANT_READ:
300 case SSL_ERROR_WANT_WRITE:
303 case SSL_ERROR_SYSCALL:
307 if (result_errno == EPIPE || result_errno ==
ECONNRESET)
309 "\tThis probably means the server terminated abnormally\n"
310 "\tbefore or while processing the request.");
314 sebuf,
sizeof(sebuf)));
335 case SSL_ERROR_ZERO_RETURN:
364 const EVP_MD *algo_type;
365 unsigned char hash[EVP_MAX_MD_SIZE];
366 unsigned int hash_size;
375 peer_cert =
conn->peer;
382 #if HAVE_X509_GET_SIGNATURE_INFO
383 if (!X509_get_signature_info(peer_cert, &algo_nid, NULL, NULL, NULL))
385 if (!OBJ_find_sigid_algs(X509_get_signature_nid(peer_cert),
403 algo_type = EVP_sha256();
406 algo_type = EVP_get_digestbynid(algo_nid);
407 if (algo_type == NULL)
410 OBJ_nid2sn(algo_nid));
416 if (!X509_digest(peer_cert, algo_type,
hash, &hash_size))
423 cert_hash =
malloc(hash_size);
424 if (cert_hash == NULL)
429 memcpy(cert_hash,
hash, hash_size);
456 #ifdef HAVE_SSL_CTX_SET_CERT_CB
467 cert_cb(SSL *ssl,
void *
arg)
474 if (SSL_get_certificate(ssl))
495 const unsigned char *namedata;
498 if (name_entry == NULL)
507 #ifdef HAVE_ASN1_STRING_GET0_DATA
508 namedata = ASN1_STRING_get0_data(name_entry);
510 namedata = ASN1_STRING_data(name_entry);
512 len = ASN1_STRING_length(name_entry);
525 ASN1_OCTET_STRING *addr_entry,
529 const unsigned char *addrdata;
532 if (addr_entry == NULL)
542 #ifdef HAVE_ASN1_STRING_GET0_DATA
543 addrdata = ASN1_STRING_get0_data(addr_entry);
545 addrdata = ASN1_STRING_data(addr_entry);
547 len = ASN1_STRING_length(addr_entry);
555 struct in_addr dummy4;
556 #ifdef HAVE_INET_PTON
557 struct in6_addr dummy6;
561 #ifdef HAVE_INET_PTON
562 || (inet_pton(AF_INET6, host, &dummy6) == 1)
577 STACK_OF(GENERAL_NAME) * peer_san;
582 bool check_cn =
true;
607 host_type = GEN_IPADD;
615 peer_san = (STACK_OF(GENERAL_NAME) *)
616 X509_get_ext_d2i(
conn->peer, NID_subject_alt_name, NULL, NULL);
620 int san_len = sk_GENERAL_NAME_num(peer_san);
622 for (
i = 0;
i < san_len;
i++)
624 const GENERAL_NAME *
name = sk_GENERAL_NAME_value(peer_san,
i);
625 char *alt_name = NULL;
627 if (
name->type == host_type)
636 if (
name->type == GEN_DNS)
643 else if (
name->type == GEN_IPADD)
654 *first_name = alt_name;
669 sk_GENERAL_NAME_pop_free(peer_san, GENERAL_NAME_free);
682 X509_NAME *subject_name;
684 subject_name = X509_get_subject_name(
conn->peer);
685 if (subject_name != NULL)
689 cn_index = X509_NAME_get_index_by_NID(subject_name,
693 char *common_name = NULL;
697 X509_NAME_ENTRY_get_data(X509_NAME_get_entry(subject_name, cn_index)),
703 *first_name = common_name;
714 #if defined(HAVE_CRYPTO_LOCK)
724 pq_threadidcallback(
void)
737 pq_lockingcallback(
int mode,
int n,
const char *file,
int line)
744 if (
mode & CRYPTO_LOCK)
774 while (InterlockedExchange(&win32_ssl_create_mutex, 1) == 1)
781 InterlockedExchange(&win32_ssl_create_mutex, 0);
787 #ifdef HAVE_CRYPTO_LOCK
794 if (pq_lockarray == NULL)
804 for (
i = 0;
i < CRYPTO_num_locks();
i++)
816 if (do_crypto && !
conn->crypto_loaded)
825 if (CRYPTO_get_id_callback() == NULL)
826 CRYPTO_set_id_callback(pq_threadidcallback);
827 if (CRYPTO_get_locking_callback() == NULL)
828 CRYPTO_set_locking_callback(pq_lockingcallback);
831 conn->crypto_loaded =
true;
840 #ifdef HAVE_OPENSSL_INIT_SSL
841 OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG, NULL);
843 OPENSSL_config(NULL);
845 SSL_load_error_strings();
870 #if defined(HAVE_CRYPTO_LOCK)
884 if (CRYPTO_get_locking_callback() == pq_lockingcallback)
885 CRYPTO_set_locking_callback(NULL);
886 if (CRYPTO_get_id_callback() == pq_threadidcallback)
887 CRYPTO_set_id_callback(NULL);
919 EVP_PKEY *pkey = NULL;
933 have_homedir =
false;
971 #ifdef HAVE_SSL_CTX_SET_CERT_CB
977 SSL_CTX_set_options(
SSL_context, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);
987 if (ssl_min_ver == -1)
1013 if (ssl_max_ver == -1)
1036 SSL_CTX_set_mode(
SSL_context, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
1045 else if (have_homedir)
1046 snprintf(fnbuf,
sizeof(fnbuf),
"%s/%s", homedir, ROOT_CERT_FILE);
1050 if (strcmp(fnbuf,
"system") == 0)
1059 if (SSL_CTX_set_default_verify_paths(
SSL_context) != 1)
1069 have_rootcert =
true;
1071 else if (fnbuf[0] !=
'\0' &&
1074 X509_STORE *cvstore;
1076 if (SSL_CTX_load_verify_locations(
SSL_context, fnbuf, NULL) != 1)
1087 if ((cvstore = SSL_CTX_get_cert_store(
SSL_context)) != NULL)
1098 if (!fname && !dname && have_homedir)
1100 snprintf(fnbuf,
sizeof(fnbuf),
"%s/%s", homedir, ROOT_CRL_FILE);
1105 if ((fname || dname) &&
1106 X509_STORE_load_locations(cvstore, fname, dname) == 1)
1108 X509_STORE_set_flags(cvstore,
1109 X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
1115 have_rootcert =
true;
1131 if (fnbuf[0] ==
'\0')
1133 "Either provide the file, use the system's trusted roots with sslrootcert=system, or change sslmode to disable server certificate verification.");
1136 "Either provide the file, use the system's trusted roots with sslrootcert=system, or change sslmode to disable server certificate verification.", fnbuf);
1140 have_rootcert =
false;
1146 else if (have_homedir)
1147 snprintf(fnbuf,
sizeof(fnbuf),
"%s/%s", homedir, USER_CERT_FILE);
1156 else if (fnbuf[0] ==
'\0')
1161 else if (
stat(fnbuf, &
buf) != 0)
1168 if (errno != ENOENT && errno != ENOTDIR)
1171 fnbuf,
strerror_r(errno, sebuf,
sizeof(sebuf)));
1184 if (SSL_CTX_use_certificate_chain_file(
SSL_context, fnbuf) != 1)
1207 !SSL_set_app_data(
conn->ssl,
conn) ||
1236 if (host && host[0] &&
1237 !(strspn(host,
"0123456789.") == strlen(host) ||
1240 if (SSL_set_tlsext_host_name(
conn->ssl, host) != 1)
1259 #ifdef USE_SSL_ENGINE
1270 if (engine_str == NULL)
1277 engine_colon = strchr(engine_str,
':');
1279 *engine_colon =
'\0';
1282 conn->engine = ENGINE_by_id(engine_str);
1283 if (
conn->engine == NULL)
1294 if (ENGINE_init(
conn->engine) == 0)
1301 ENGINE_free(
conn->engine);
1302 conn->engine = NULL;
1307 pkey = ENGINE_load_private_key(
conn->engine, engine_colon,
1314 engine_colon, engine_str,
err);
1316 ENGINE_finish(
conn->engine);
1317 ENGINE_free(
conn->engine);
1318 conn->engine = NULL;
1322 if (SSL_use_PrivateKey(
conn->ssl, pkey) != 1)
1327 engine_colon, engine_str,
err);
1329 ENGINE_finish(
conn->engine);
1330 ENGINE_free(
conn->engine);
1331 conn->engine = NULL;
1348 else if (have_homedir)
1351 snprintf(fnbuf,
sizeof(fnbuf),
"%s/%s", homedir, USER_KEY_FILE);
1356 if (have_cert && fnbuf[0] !=
'\0')
1362 if (errno == ENOENT)
1401 #if !defined(WIN32) && !defined(__CYGWIN__)
1402 if (
buf.st_uid == 0 ?
1407 "private key file \"%s\" has group or world access; file must have permissions u=rw (0600) or less if owned by the current user, or permissions u=rw,g=r (0640) or less if owned by root",
1413 if (SSL_use_PrivateKey_file(
conn->ssl, fnbuf, SSL_FILETYPE_PEM) != 1)
1429 if (SSL_use_PrivateKey_file(
conn->ssl, fnbuf, SSL_FILETYPE_ASN1) != 1)
1443 SSL_check_private_key(
conn->ssl) != 1)
1464 SSL_set_options(
conn->ssl, SSL_OP_NO_COMPRESSION);
1466 SSL_clear_options(
conn->ssl, SSL_OP_NO_COMPRESSION);
1481 r = SSL_connect(
conn->ssl);
1485 int err = SSL_get_error(
conn->ssl, r);
1486 unsigned long ecode;
1488 ecode = ERR_get_error();
1491 case SSL_ERROR_WANT_READ:
1494 case SSL_ERROR_WANT_WRITE:
1497 case SSL_ERROR_SYSCALL:
1500 unsigned long vcode;
1502 vcode = SSL_get_verify_result(
conn->ssl);
1513 if (!save_errno && vcode == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY &&
1516 X509_verify_cert_error_string(vcode));
1531 switch (ERR_GET_REASON(ecode))
1547 case SSL_R_NO_PROTOCOLS_AVAILABLE:
1548 case SSL_R_UNSUPPORTED_PROTOCOL:
1549 case SSL_R_BAD_PROTOCOL_VERSION_NUMBER:
1550 case SSL_R_UNKNOWN_PROTOCOL:
1551 case SSL_R_UNKNOWN_SSL_VERSION:
1552 case SSL_R_UNSUPPORTED_SSL_VERSION:
1553 case SSL_R_WRONG_SSL_VERSION:
1554 case SSL_R_WRONG_VERSION_NUMBER:
1555 case SSL_R_TLSV1_ALERT_PROTOCOL_VERSION:
1556 #ifdef SSL_R_VERSION_TOO_HIGH
1557 case SSL_R_VERSION_TOO_HIGH:
1558 case SSL_R_VERSION_TOO_LOW:
1563 MIN_OPENSSL_TLS_VERSION,
1566 MAX_OPENSSL_TLS_VERSION);
1588 conn->peer = SSL_get_peer_certificate(
conn->ssl);
1589 if (
conn->peer == NULL)
1612 bool destroy_needed =
false;
1624 SSL_shutdown(
conn->ssl);
1625 SSL_free(
conn->ssl);
1629 destroy_needed =
true;
1634 X509_free(
conn->peer);
1638 #ifdef USE_SSL_ENGINE
1641 ENGINE_finish(
conn->engine);
1642 ENGINE_free(
conn->engine);
1643 conn->engine = NULL;
1654 if (
conn->crypto_loaded)
1655 destroy_needed =
true;
1669 conn->crypto_loaded =
false;
1683 static char ssl_nomem[] =
"out of memory allocating error description";
1685 #define SSL_ERR_LEN 128
1690 const char *errreason;
1701 errreason = ERR_reason_error_string(ecode);
1702 if (errreason != NULL)
1738 if (strcmp(struct_name,
"OpenSSL") == 0)
1746 static const char *
const openssl_attrs[] = {
1754 static const char *
const empty_attrs[] = {NULL};
1759 return openssl_attrs;
1763 if (
conn->ssl == NULL)
1766 return openssl_attrs;
1775 if (strcmp(attribute_name,
"library") == 0)
1781 if (
conn->ssl == NULL)
1784 if (strcmp(attribute_name,
"library") == 0)
1787 if (strcmp(attribute_name,
"key_bits") == 0)
1789 static char sslbits_str[12];
1792 SSL_get_cipher_bits(
conn->ssl, &sslbits);
1793 snprintf(sslbits_str,
sizeof(sslbits_str),
"%d", sslbits);
1797 if (strcmp(attribute_name,
"cipher") == 0)
1798 return SSL_get_cipher(
conn->ssl);
1800 if (strcmp(attribute_name,
"compression") == 0)
1801 return SSL_get_current_compression(
conn->ssl) ?
"on" :
"off";
1803 if (strcmp(attribute_name,
"protocol") == 0)
1804 return SSL_get_version(
conn->ssl);
1818 #ifndef HAVE_BIO_GET_DATA
1819 #define BIO_get_data(bio) (bio->ptr)
1820 #define BIO_set_data(bio, data) (bio->ptr = data)
1831 BIO_clear_retry_flags(h);
1840 #if defined(EWOULDBLOCK) && (!defined(EAGAIN) || (EWOULDBLOCK != EAGAIN))
1844 BIO_set_retry_read(h);
1861 BIO_clear_retry_flags(h);
1870 #if defined(EWOULDBLOCK) && (!defined(EAGAIN) || (EWOULDBLOCK != EAGAIN))
1874 BIO_set_retry_write(h);
1890 BIO_METHOD *biom = (BIO_METHOD *) BIO_s_socket();
1891 #ifdef HAVE_BIO_METH_NEW
1894 my_bio_index = BIO_get_new_index();
1895 if (my_bio_index == -1)
1897 my_bio_index |= (BIO_TYPE_DESCRIPTOR | BIO_TYPE_SOURCE_SINK);
1911 !BIO_meth_set_create(
my_bio_methods, BIO_meth_get_create(biom)) ||
1912 !BIO_meth_set_destroy(
my_bio_methods, BIO_meth_get_destroy(biom)) ||
1913 !BIO_meth_set_callback_ctrl(
my_bio_methods, BIO_meth_get_callback_ctrl(biom)))
1937 BIO_METHOD *bio_method;
1940 if (bio_method == NULL)
1942 SSLerr(SSL_F_SSL_SET_FD, ERR_R_BUF_LIB);
1945 bio = BIO_new(bio_method);
1948 SSLerr(SSL_F_SSL_SET_FD, ERR_R_BUF_LIB);
1953 SSL_set_bio(
conn->ssl, bio, bio);
1954 BIO_set_fd(bio,
fd, BIO_NOCLOSE);
1973 buf[size - 1] =
'\0';
2025 return TLS1_VERSION;
2027 #ifdef TLS1_1_VERSION
2029 return TLS1_1_VERSION;
2032 #ifdef TLS1_2_VERSION
2034 return TLS1_2_VERSION;
2037 #ifdef TLS1_3_VERSION
2039 return TLS1_3_VERSION;
static SSL_CTX * SSL_context
static void PGresult * res
void err(int eval, const char *fmt,...)
bool pqGetHomeDirectory(char *buf, int bufsize)
void libpq_append_conn_error(PGconn *conn, const char *fmt,...)
int pq_verify_peer_name_matches_certificate_name(PGconn *conn, const char *namedata, size_t namelen, char **store_name)
int pq_verify_peer_name_matches_certificate_ip(PGconn *conn, const unsigned char *ipdata, size_t iplen, char **store_name)
bool pq_verify_peer_name_matches_certificate(PGconn *conn)
static int ssl_protocol_version_to_openssl(const char *protocol)
static void destroy_ssl_system(void)
static int my_SSL_set_fd(PGconn *conn, int fd)
static void SSLerrfree(char *buf)
PQsslKeyPassHook_OpenSSL_type PQgetSSLKeyPassHook_OpenSSL(void)
int pgtls_verify_peer_name_matches_certificate_guts(PGconn *conn, int *names_examined, char **first_name)
PostgresPollingStatusType pgtls_open_client(PGconn *conn)
bool pgtls_read_pending(PGconn *conn)
static bool pq_init_crypto_lib
int PQdefaultSSLKeyPassHook_OpenSSL(char *buf, int size, PGconn *conn)
static long crypto_open_connections
static BIO_METHOD * my_bio_methods
static int openssl_verify_peer_name_matches_certificate_name(PGconn *conn, ASN1_STRING *name_entry, char **store_name)
void pgtls_init_library(bool do_ssl, int do_crypto)
#define BIO_get_data(bio)
ssize_t pgtls_read(PGconn *conn, void *ptr, size_t len)
static bool ssl_lib_initialized
ssize_t pgtls_write(PGconn *conn, const void *ptr, size_t len)
static PQsslKeyPassHook_OpenSSL_type PQsslKeyPassHook
int pgtls_init(PGconn *conn, bool do_ssl, bool do_crypto)
static BIO_METHOD * my_BIO_s_socket(void)
const char *const * PQsslAttributeNames(PGconn *conn)
static bool pq_init_ssl_lib
#define BIO_set_data(bio, data)
void * PQgetssl(PGconn *conn)
void * PQsslStruct(PGconn *conn, const char *struct_name)
static int initialize_SSL(PGconn *conn)
static pthread_mutex_t ssl_config_mutex
static int verify_cb(int ok, X509_STORE_CTX *ctx)
static int PQssl_passwd_cb(char *buf, int size, int rwflag, void *userdata)
static char * SSLerrmessage(unsigned long ecode)
static int openssl_verify_peer_name_matches_certificate_ip(PGconn *conn, ASN1_OCTET_STRING *addr_entry, char **store_name)
char * pgtls_get_peer_certificate_hash(PGconn *conn, size_t *len)
static PostgresPollingStatusType open_client_SSL(PGconn *conn)
const char * PQsslAttribute(PGconn *conn, const char *attribute_name)
void pgtls_close(PGconn *conn)
void PQsetSSLKeyPassHook_OpenSSL(PQsslKeyPassHook_OpenSSL_type hook)
static int my_sock_write(BIO *h, const char *buf, int size)
static int my_sock_read(BIO *h, char *buf, int size)
static bool is_ip_address(const char *host)
ssize_t pqsecure_raw_read(PGconn *conn, void *ptr, size_t len)
ssize_t pqsecure_raw_write(PGconn *conn, const void *ptr, size_t len)
int(* PQsslKeyPassHook_OpenSSL_type)(char *buf, int size, PGconn *conn)
PostgresPollingStatusType
#define SOCK_ERRNO_SET(e)
Assert(fmt[strlen(fmt) - 1] !='\n')
static PgChecksumMode mode
#define PG_STRERROR_R_BUFLEN
int pg_strcasecmp(const char *s1, const char *s2)
int inet_aton(const char *cp, struct in_addr *addr)
size_t strlcpy(char *dst, const char *src, size_t siz)
void appendPQExpBufferStr(PQExpBuffer str, const char *data)
static int fd(const char *x, int i)
int SSL_CTX_set_max_proto_version(SSL_CTX *ctx, int version)
int SSL_CTX_set_min_proto_version(SSL_CTX *ctx, int version)
int pthread_mutex_unlock(pthread_mutex_t *mp)
int pthread_mutex_lock(pthread_mutex_t *mp)
int pthread_mutex_init(pthread_mutex_t *mp, void *attr)
CRITICAL_SECTION * pthread_mutex_t
static unsigned hash(unsigned *uv, int n)
char * ssl_max_protocol_version
char * ssl_min_protocol_version
PQExpBufferData errorMessage