47 #ifdef ENABLE_THREAD_SAFETY
62 #include <openssl/conf.h>
64 #include <openssl/engine.h>
66 #include <openssl/x509v3.h>
69 static int verify_cb(
int ok, X509_STORE_CTX *ctx);
71 ASN1_STRING *name_entry,
74 ASN1_OCTET_STRING *addr_entry,
94 #ifdef ENABLE_THREAD_SAFETY
95 static long crypto_open_connections = 0;
101 static long win32_ssl_create_mutex = 0;
115 #ifdef ENABLE_THREAD_SAFETY
121 if (crypto_open_connections != 0)
133 if (
conn->ssl == NULL)
155 int result_errno = 0;
173 n = SSL_read(
conn->ssl, ptr,
len);
174 err = SSL_get_error(
conn->ssl, n);
184 ecode = (
err != SSL_ERROR_NONE || n < 0) ? ERR_get_error() : 0;
192 "SSL_read failed but did not provide error information\n");
197 case SSL_ERROR_WANT_READ:
200 case SSL_ERROR_WANT_WRITE:
209 case SSL_ERROR_SYSCALL:
213 if (result_errno == EPIPE ||
216 "\tThis probably means the server terminated abnormally\n"
217 "\tbefore or while processing the request.");
221 sebuf,
sizeof(sebuf)));
242 case SSL_ERROR_ZERO_RETURN:
270 return SSL_pending(
conn->ssl) > 0;
277 int result_errno = 0;
284 n = SSL_write(
conn->ssl, ptr,
len);
285 err = SSL_get_error(
conn->ssl, n);
286 ecode = (
err != SSL_ERROR_NONE || n < 0) ? ERR_get_error() : 0;
294 "SSL_write failed but did not provide error information\n");
299 case SSL_ERROR_WANT_READ:
307 case SSL_ERROR_WANT_WRITE:
310 case SSL_ERROR_SYSCALL:
314 if (result_errno == EPIPE || result_errno ==
ECONNRESET)
316 "\tThis probably means the server terminated abnormally\n"
317 "\tbefore or while processing the request.");
321 sebuf,
sizeof(sebuf)));
342 case SSL_ERROR_ZERO_RETURN:
367 #if defined(HAVE_X509_GET_SIGNATURE_NID) || defined(HAVE_X509_GET_SIGNATURE_INFO)
372 const EVP_MD *algo_type;
373 unsigned char hash[EVP_MAX_MD_SIZE];
374 unsigned int hash_size;
383 peer_cert =
conn->peer;
390 #if HAVE_X509_GET_SIGNATURE_INFO
391 if (!X509_get_signature_info(peer_cert, &algo_nid, NULL, NULL, NULL))
393 if (!OBJ_find_sigid_algs(X509_get_signature_nid(peer_cert),
411 algo_type = EVP_sha256();
414 algo_type = EVP_get_digestbynid(algo_nid);
415 if (algo_type == NULL)
418 OBJ_nid2sn(algo_nid));
424 if (!X509_digest(peer_cert, algo_type,
hash, &hash_size))
431 cert_hash =
malloc(hash_size);
432 if (cert_hash == NULL)
437 memcpy(cert_hash,
hash, hash_size);
465 #ifdef HAVE_SSL_CTX_SET_CERT_CB
476 cert_cb(SSL *ssl,
void *
arg)
483 if (SSL_get_certificate(ssl))
504 const unsigned char *namedata;
507 if (name_entry == NULL)
516 #ifdef HAVE_ASN1_STRING_GET0_DATA
517 namedata = ASN1_STRING_get0_data(name_entry);
519 namedata = ASN1_STRING_data(name_entry);
521 len = ASN1_STRING_length(name_entry);
534 ASN1_OCTET_STRING *addr_entry,
538 const unsigned char *addrdata;
541 if (addr_entry == NULL)
551 #ifdef HAVE_ASN1_STRING_GET0_DATA
552 addrdata = ASN1_STRING_get0_data(addr_entry);
554 addrdata = ASN1_STRING_data(addr_entry);
556 len = ASN1_STRING_length(addr_entry);
564 struct in_addr dummy4;
565 #ifdef HAVE_INET_PTON
566 struct in6_addr dummy6;
570 #ifdef HAVE_INET_PTON
571 || (inet_pton(AF_INET6, host, &dummy6) == 1)
586 STACK_OF(GENERAL_NAME) * peer_san;
591 bool check_cn =
true;
616 host_type = GEN_IPADD;
624 peer_san = (STACK_OF(GENERAL_NAME) *)
625 X509_get_ext_d2i(
conn->peer, NID_subject_alt_name, NULL, NULL);
629 int san_len = sk_GENERAL_NAME_num(peer_san);
631 for (
i = 0;
i < san_len;
i++)
633 const GENERAL_NAME *
name = sk_GENERAL_NAME_value(peer_san,
i);
634 char *alt_name = NULL;
636 if (
name->type == host_type)
645 if (
name->type == GEN_DNS)
652 else if (
name->type == GEN_IPADD)
663 *first_name = alt_name;
678 sk_GENERAL_NAME_pop_free(peer_san, GENERAL_NAME_free);
691 X509_NAME *subject_name;
693 subject_name = X509_get_subject_name(
conn->peer);
694 if (subject_name != NULL)
698 cn_index = X509_NAME_get_index_by_NID(subject_name,
702 char *common_name = NULL;
706 X509_NAME_ENTRY_get_data(X509_NAME_get_entry(subject_name, cn_index)),
712 *first_name = common_name;
723 #if defined(ENABLE_THREAD_SAFETY) && defined(HAVE_CRYPTO_LOCK)
733 pq_threadidcallback(
void)
746 pq_lockingcallback(
int mode,
int n,
const char *file,
int line)
753 if (
mode & CRYPTO_LOCK)
779 #ifdef ENABLE_THREAD_SAFETY
782 if (ssl_config_mutex == NULL)
784 while (InterlockedExchange(&win32_ssl_create_mutex, 1) == 1)
786 if (ssl_config_mutex == NULL)
791 InterlockedExchange(&win32_ssl_create_mutex, 0);
797 #ifdef HAVE_CRYPTO_LOCK
804 if (pq_lockarray == NULL)
814 for (
i = 0;
i < CRYPTO_num_locks();
i++)
826 if (do_crypto && !
conn->crypto_loaded)
828 if (crypto_open_connections++ == 0)
835 if (CRYPTO_get_id_callback() == NULL)
836 CRYPTO_set_id_callback(pq_threadidcallback);
837 if (CRYPTO_get_locking_callback() == NULL)
838 CRYPTO_set_locking_callback(pq_lockingcallback);
841 conn->crypto_loaded =
true;
851 #ifdef HAVE_OPENSSL_INIT_SSL
852 OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG, NULL);
854 OPENSSL_config(NULL);
856 SSL_load_error_strings();
862 #ifdef ENABLE_THREAD_SAFETY
883 #if defined(ENABLE_THREAD_SAFETY) && defined(HAVE_CRYPTO_LOCK)
889 --crypto_open_connections;
897 if (CRYPTO_get_locking_callback() == pq_lockingcallback)
898 CRYPTO_set_locking_callback(NULL);
899 if (CRYPTO_get_id_callback() == pq_threadidcallback)
900 CRYPTO_set_id_callback(NULL);
932 EVP_PKEY *pkey = NULL;
946 have_homedir =
false;
984 #ifdef HAVE_SSL_CTX_SET_CERT_CB
990 SSL_CTX_set_options(
SSL_context, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);
1000 if (ssl_min_ver == -1)
1026 if (ssl_max_ver == -1)
1049 SSL_CTX_set_mode(
SSL_context, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
1058 else if (have_homedir)
1059 snprintf(fnbuf,
sizeof(fnbuf),
"%s/%s", homedir, ROOT_CERT_FILE);
1063 if (fnbuf[0] !=
'\0' &&
1066 X509_STORE *cvstore;
1068 if (SSL_CTX_load_verify_locations(
SSL_context, fnbuf, NULL) != 1)
1079 if ((cvstore = SSL_CTX_get_cert_store(
SSL_context)) != NULL)
1090 if (!fname && !dname && have_homedir)
1092 snprintf(fnbuf,
sizeof(fnbuf),
"%s/%s", homedir, ROOT_CRL_FILE);
1097 if ((fname || dname) &&
1098 X509_STORE_load_locations(cvstore, fname, dname) == 1)
1100 X509_STORE_set_flags(cvstore,
1101 X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
1107 have_rootcert =
true;
1123 if (fnbuf[0] ==
'\0')
1125 "Either provide the file or change sslmode to disable server certificate verification.");
1128 "Either provide the file or change sslmode to disable server certificate verification.", fnbuf);
1132 have_rootcert =
false;
1138 else if (have_homedir)
1139 snprintf(fnbuf,
sizeof(fnbuf),
"%s/%s", homedir, USER_CERT_FILE);
1148 else if (fnbuf[0] ==
'\0')
1153 else if (
stat(fnbuf, &
buf) != 0)
1160 if (errno != ENOENT && errno != ENOTDIR)
1163 fnbuf,
strerror_r(errno, sebuf,
sizeof(sebuf)));
1176 if (SSL_CTX_use_certificate_chain_file(
SSL_context, fnbuf) != 1)
1199 !SSL_set_app_data(
conn->ssl,
conn) ||
1228 if (host && host[0] &&
1229 !(strspn(host,
"0123456789.") == strlen(host) ||
1232 if (SSL_set_tlsext_host_name(
conn->ssl, host) != 1)
1251 #ifdef USE_SSL_ENGINE
1262 if (engine_str == NULL)
1269 engine_colon = strchr(engine_str,
':');
1271 *engine_colon =
'\0';
1274 conn->engine = ENGINE_by_id(engine_str);
1275 if (
conn->engine == NULL)
1286 if (ENGINE_init(
conn->engine) == 0)
1293 ENGINE_free(
conn->engine);
1294 conn->engine = NULL;
1299 pkey = ENGINE_load_private_key(
conn->engine, engine_colon,
1306 engine_colon, engine_str,
err);
1308 ENGINE_finish(
conn->engine);
1309 ENGINE_free(
conn->engine);
1310 conn->engine = NULL;
1314 if (SSL_use_PrivateKey(
conn->ssl, pkey) != 1)
1319 engine_colon, engine_str,
err);
1321 ENGINE_finish(
conn->engine);
1322 ENGINE_free(
conn->engine);
1323 conn->engine = NULL;
1340 else if (have_homedir)
1343 snprintf(fnbuf,
sizeof(fnbuf),
"%s/%s", homedir, USER_KEY_FILE);
1348 if (have_cert && fnbuf[0] !=
'\0')
1354 if (errno == ENOENT)
1393 #if !defined(WIN32) && !defined(__CYGWIN__)
1394 if (
buf.st_uid == 0 ?
1399 "private key file \"%s\" has group or world access; file must have permissions u=rw (0600) or less if owned by the current user, or permissions u=rw,g=r (0640) or less if owned by root",
1405 if (SSL_use_PrivateKey_file(
conn->ssl, fnbuf, SSL_FILETYPE_PEM) != 1)
1421 if (SSL_use_PrivateKey_file(
conn->ssl, fnbuf, SSL_FILETYPE_ASN1) != 1)
1435 SSL_check_private_key(
conn->ssl) != 1)
1456 SSL_set_options(
conn->ssl, SSL_OP_NO_COMPRESSION);
1458 SSL_clear_options(
conn->ssl, SSL_OP_NO_COMPRESSION);
1472 r = SSL_connect(
conn->ssl);
1475 int err = SSL_get_error(
conn->ssl, r);
1476 unsigned long ecode;
1478 ecode = ERR_get_error();
1481 case SSL_ERROR_WANT_READ:
1484 case SSL_ERROR_WANT_WRITE:
1487 case SSL_ERROR_SYSCALL:
1505 switch (ERR_GET_REASON(ecode))
1521 case SSL_R_NO_PROTOCOLS_AVAILABLE:
1522 case SSL_R_UNSUPPORTED_PROTOCOL:
1523 case SSL_R_BAD_PROTOCOL_VERSION_NUMBER:
1524 case SSL_R_UNKNOWN_PROTOCOL:
1525 case SSL_R_UNKNOWN_SSL_VERSION:
1526 case SSL_R_UNSUPPORTED_SSL_VERSION:
1527 case SSL_R_WRONG_SSL_VERSION:
1528 case SSL_R_WRONG_VERSION_NUMBER:
1529 case SSL_R_TLSV1_ALERT_PROTOCOL_VERSION:
1530 #ifdef SSL_R_VERSION_TOO_HIGH
1531 case SSL_R_VERSION_TOO_HIGH:
1532 case SSL_R_VERSION_TOO_LOW:
1537 MIN_OPENSSL_TLS_VERSION,
1540 MAX_OPENSSL_TLS_VERSION);
1562 conn->peer = SSL_get_peer_certificate(
conn->ssl);
1563 if (
conn->peer == NULL)
1586 bool destroy_needed =
false;
1598 SSL_shutdown(
conn->ssl);
1599 SSL_free(
conn->ssl);
1603 destroy_needed =
true;
1608 X509_free(
conn->peer);
1612 #ifdef USE_SSL_ENGINE
1615 ENGINE_finish(
conn->engine);
1616 ENGINE_free(
conn->engine);
1617 conn->engine = NULL;
1628 if (
conn->crypto_loaded)
1629 destroy_needed =
true;
1643 conn->crypto_loaded =
false;
1657 static char ssl_nomem[] =
"out of memory allocating error description";
1659 #define SSL_ERR_LEN 128
1664 const char *errreason;
1675 errreason = ERR_reason_error_string(ecode);
1676 if (errreason != NULL)
1712 if (strcmp(struct_name,
"OpenSSL") == 0)
1720 static const char *
const openssl_attrs[] = {
1728 static const char *
const empty_attrs[] = {NULL};
1733 return openssl_attrs;
1737 if (
conn->ssl == NULL)
1740 return openssl_attrs;
1749 if (strcmp(attribute_name,
"library") == 0)
1755 if (
conn->ssl == NULL)
1758 if (strcmp(attribute_name,
"library") == 0)
1761 if (strcmp(attribute_name,
"key_bits") == 0)
1763 static char sslbits_str[12];
1766 SSL_get_cipher_bits(
conn->ssl, &sslbits);
1767 snprintf(sslbits_str,
sizeof(sslbits_str),
"%d", sslbits);
1771 if (strcmp(attribute_name,
"cipher") == 0)
1772 return SSL_get_cipher(
conn->ssl);
1774 if (strcmp(attribute_name,
"compression") == 0)
1775 return SSL_get_current_compression(
conn->ssl) ?
"on" :
"off";
1777 if (strcmp(attribute_name,
"protocol") == 0)
1778 return SSL_get_version(
conn->ssl);
1794 #ifndef HAVE_BIO_GET_DATA
1795 #define BIO_get_data(bio) (bio->ptr)
1796 #define BIO_set_data(bio, data) (bio->ptr = data)
1807 BIO_clear_retry_flags(h);
1816 #if defined(EWOULDBLOCK) && (!defined(EAGAIN) || (EWOULDBLOCK != EAGAIN))
1820 BIO_set_retry_read(h);
1837 BIO_clear_retry_flags(h);
1846 #if defined(EWOULDBLOCK) && (!defined(EAGAIN) || (EWOULDBLOCK != EAGAIN))
1850 BIO_set_retry_write(h);
1866 BIO_METHOD *biom = (BIO_METHOD *) BIO_s_socket();
1867 #ifdef HAVE_BIO_METH_NEW
1870 my_bio_index = BIO_get_new_index();
1871 if (my_bio_index == -1)
1873 my_bio_index |= (BIO_TYPE_DESCRIPTOR | BIO_TYPE_SOURCE_SINK);
1887 !BIO_meth_set_create(
my_bio_methods, BIO_meth_get_create(biom)) ||
1888 !BIO_meth_set_destroy(
my_bio_methods, BIO_meth_get_destroy(biom)) ||
1889 !BIO_meth_set_callback_ctrl(
my_bio_methods, BIO_meth_get_callback_ctrl(biom)))
1913 BIO_METHOD *bio_method;
1916 if (bio_method == NULL)
1918 SSLerr(SSL_F_SSL_SET_FD, ERR_R_BUF_LIB);
1921 bio = BIO_new(bio_method);
1924 SSLerr(SSL_F_SSL_SET_FD, ERR_R_BUF_LIB);
1929 SSL_set_bio(
conn->ssl, bio, bio);
1930 BIO_set_fd(bio,
fd, BIO_NOCLOSE);
1949 buf[size - 1] =
'\0';
2001 return TLS1_VERSION;
2003 #ifdef TLS1_1_VERSION
2005 return TLS1_1_VERSION;
2008 #ifdef TLS1_2_VERSION
2010 return TLS1_2_VERSION;
2013 #ifdef TLS1_3_VERSION
2015 return TLS1_3_VERSION;
static SSL_CTX * SSL_context
static void PGresult * res
void err(int eval, const char *fmt,...)
bool pqGetHomeDirectory(char *buf, int bufsize)
void libpq_append_conn_error(PGconn *conn, const char *fmt,...)
int pq_verify_peer_name_matches_certificate_name(PGconn *conn, const char *namedata, size_t namelen, char **store_name)
int pq_verify_peer_name_matches_certificate_ip(PGconn *conn, const unsigned char *ipdata, size_t iplen, char **store_name)
bool pq_verify_peer_name_matches_certificate(PGconn *conn)
static int ssl_protocol_version_to_openssl(const char *protocol)
static void destroy_ssl_system(void)
static int my_SSL_set_fd(PGconn *conn, int fd)
static void SSLerrfree(char *buf)
PQsslKeyPassHook_OpenSSL_type PQgetSSLKeyPassHook_OpenSSL(void)
int pgtls_verify_peer_name_matches_certificate_guts(PGconn *conn, int *names_examined, char **first_name)
PostgresPollingStatusType pgtls_open_client(PGconn *conn)
bool pgtls_read_pending(PGconn *conn)
static bool pq_init_crypto_lib
int PQdefaultSSLKeyPassHook_OpenSSL(char *buf, int size, PGconn *conn)
static BIO_METHOD * my_bio_methods
static int openssl_verify_peer_name_matches_certificate_name(PGconn *conn, ASN1_STRING *name_entry, char **store_name)
void pgtls_init_library(bool do_ssl, int do_crypto)
#define BIO_get_data(bio)
ssize_t pgtls_read(PGconn *conn, void *ptr, size_t len)
static bool ssl_lib_initialized
ssize_t pgtls_write(PGconn *conn, const void *ptr, size_t len)
static PQsslKeyPassHook_OpenSSL_type PQsslKeyPassHook
int pgtls_init(PGconn *conn, bool do_ssl, bool do_crypto)
static BIO_METHOD * my_BIO_s_socket(void)
const char *const * PQsslAttributeNames(PGconn *conn)
static bool pq_init_ssl_lib
#define BIO_set_data(bio, data)
void * PQgetssl(PGconn *conn)
void * PQsslStruct(PGconn *conn, const char *struct_name)
static int initialize_SSL(PGconn *conn)
static int verify_cb(int ok, X509_STORE_CTX *ctx)
static int PQssl_passwd_cb(char *buf, int size, int rwflag, void *userdata)
static char * SSLerrmessage(unsigned long ecode)
static int openssl_verify_peer_name_matches_certificate_ip(PGconn *conn, ASN1_OCTET_STRING *addr_entry, char **store_name)
static PostgresPollingStatusType open_client_SSL(PGconn *conn)
const char * PQsslAttribute(PGconn *conn, const char *attribute_name)
void pgtls_close(PGconn *conn)
void PQsetSSLKeyPassHook_OpenSSL(PQsslKeyPassHook_OpenSSL_type hook)
static int my_sock_write(BIO *h, const char *buf, int size)
static int my_sock_read(BIO *h, char *buf, int size)
static bool is_ip_address(const char *host)
ssize_t pqsecure_raw_read(PGconn *conn, void *ptr, size_t len)
ssize_t pqsecure_raw_write(PGconn *conn, const void *ptr, size_t len)
int(* PQsslKeyPassHook_OpenSSL_type)(char *buf, int size, PGconn *conn)
PostgresPollingStatusType
#define SOCK_ERRNO_SET(e)
Assert(fmt[strlen(fmt) - 1] !='\n')
static PgChecksumMode mode
#define PG_STRERROR_R_BUFLEN
int pg_strcasecmp(const char *s1, const char *s2)
int inet_aton(const char *cp, struct in_addr *addr)
size_t strlcpy(char *dst, const char *src, size_t siz)
void appendPQExpBufferStr(PQExpBuffer str, const char *data)
static int fd(const char *x, int i)
int SSL_CTX_set_max_proto_version(SSL_CTX *ctx, int version)
int SSL_CTX_set_min_proto_version(SSL_CTX *ctx, int version)
int pthread_mutex_unlock(pthread_mutex_t *mp)
int pthread_mutex_lock(pthread_mutex_t *mp)
int pthread_mutex_init(pthread_mutex_t *mp, void *attr)
CRITICAL_SECTION * pthread_mutex_t
static unsigned hash(unsigned *uv, int n)
char * ssl_max_protocol_version
char * ssl_min_protocol_version
PQExpBufferData errorMessage