libpq.h File Reference

#include <netinet/in.h>
#include "lib/stringinfo.h"
#include "libpq/libpq-be.h"
#include "storage/latch.h"

Include dependency graph for libpq.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Data Structures
struct	PQcommMethods

Macros
#define	PQ_SMALL_MESSAGE_LIMIT   10000
#define	PQ_LARGE_MESSAGE_LIMIT   (MaxAllocSize - 1)
#define	pq_comm_reset()   (PqCommMethods->comm_reset())
#define	pq_flush()   (PqCommMethods->flush())
#define	pq_flush_if_writable()   (PqCommMethods->flush_if_writable())
#define	pq_is_send_pending()   (PqCommMethods->is_send_pending())
#define	pq_putmessage(msgtype, s, len)    (PqCommMethods->putmessage(msgtype, s, len))
#define	pq_putmessage_noblock(msgtype, s, len)    (PqCommMethods->putmessage_noblock(msgtype, s, len))
#define	FeBeWaitSetSocketPos   0
#define	FeBeWaitSetLatchPos   1
#define	FeBeWaitSetNEvents   3

Enumerations
enum	ssl_protocol_versions {   PG_TLS_ANY = 0 , PG_TLS1_VERSION , PG_TLS1_1_VERSION , PG_TLS1_2_VERSION ,   PG_TLS1_3_VERSION }

Functions
int	StreamServerPort (int family, const char *hostName, unsigned short portNumber, const char *unixSocketDir, pgsocket ListenSocket[], int MaxListen)
int	StreamConnection (pgsocket server_fd, Port *port)
void	StreamClose (pgsocket sock)
void	TouchSocketFiles (void)
void	RemoveSocketFiles (void)
void	pq_init (void)
int	pq_getbytes (char *s, size_t len)
void	pq_startmsgread (void)
void	pq_endmsgread (void)
bool	pq_is_reading_msg (void)
int	pq_getmessage (StringInfo s, int maxlen)
int	pq_getbyte (void)
int	pq_peekbyte (void)
int	pq_getbyte_if_available (unsigned char *c)
bool	pq_buffer_has_data (void)
int	pq_putmessage_v2 (char msgtype, const char *s, size_t len)
bool	pq_check_connection (void)
int	secure_initialize (bool isServerStart)
bool	secure_loaded_verify_locations (void)
void	secure_destroy (void)
int	secure_open_server (Port *port)
void	secure_close (Port *port)
ssize_t	secure_read (Port *port, void *ptr, size_t len)
ssize_t	secure_write (Port *port, void *ptr, size_t len)
ssize_t	secure_raw_read (Port *port, void *ptr, size_t len)
ssize_t	secure_raw_write (Port *port, const void *ptr, size_t len)
int	run_ssl_passphrase_command (const char *prompt, bool is_server_start, char *buf, int size)
bool	check_ssl_key_file_permissions (const char *ssl_key_file, bool isServerStart)

Variables
const PGDLLIMPORT PQcommMethods *	PqCommMethods
PGDLLIMPORT WaitEventSet *	FeBeWaitSet
PGDLLIMPORT char *	ssl_library
PGDLLIMPORT char *	ssl_cert_file
PGDLLIMPORT char *	ssl_key_file
PGDLLIMPORT char *	ssl_ca_file
PGDLLIMPORT char *	ssl_crl_file
PGDLLIMPORT char *	ssl_crl_dir
PGDLLIMPORT char *	ssl_dh_params_file
PGDLLIMPORT char *	ssl_passphrase_command
PGDLLIMPORT bool	ssl_passphrase_command_supports_reload
PGDLLIMPORT char *	SSLCipherSuites
PGDLLIMPORT char *	SSLECDHCurve
PGDLLIMPORT bool	SSLPreferServerCiphers
PGDLLIMPORT int	ssl_min_protocol_version
PGDLLIMPORT int	ssl_max_protocol_version

Macro Definition Documentation

FeBeWaitSetLatchPos

#define FeBeWaitSetLatchPos   1

Definition at line 64 of file libpq.h.

FeBeWaitSetNEvents

#define FeBeWaitSetNEvents   3

Definition at line 65 of file libpq.h.

FeBeWaitSetSocketPos

#define FeBeWaitSetSocketPos   0

Definition at line 63 of file libpq.h.

pq_comm_reset

#define pq_comm_reset

(

)

(PqCommMethods->comm_reset())

Definition at line 45 of file libpq.h.

pq_flush

#define pq_flush

(

)

(PqCommMethods->flush())

Definition at line 46 of file libpq.h.

pq_flush_if_writable

#define pq_flush_if_writable

(

)

(PqCommMethods->flush_if_writable())

Definition at line 47 of file libpq.h.

pq_is_send_pending

#define pq_is_send_pending

(

)

(PqCommMethods->is_send_pending())

Definition at line 48 of file libpq.h.

PQ_LARGE_MESSAGE_LIMIT

#define PQ_LARGE_MESSAGE_LIMIT   (MaxAllocSize - 1)

Definition at line 31 of file libpq.h.

pq_putmessage

#define pq_putmessage	(		msgtype,
			s,
			len
	)		(PqCommMethods->putmessage(msgtype, s, len))

Definition at line 49 of file libpq.h.

pq_putmessage_noblock

#define pq_putmessage_noblock	(		msgtype,
			s,
			len
	)		(PqCommMethods->putmessage_noblock(msgtype, s, len))

Definition at line 51 of file libpq.h.

PQ_SMALL_MESSAGE_LIMIT

#define PQ_SMALL_MESSAGE_LIMIT   10000

Definition at line 30 of file libpq.h.

Enumeration Type Documentation

ssl_protocol_versions

enum ssl_protocol_versions

Enumerator
PG_TLS_ANY
PG_TLS1_VERSION
PG_TLS1_1_VERSION
PG_TLS1_2_VERSION
PG_TLS1_3_VERSION

Definition at line 127 of file libpq.h.

{
    PG_TLS_ANY = 0,
    PG_TLS1_VERSION,
    PG_TLS1_1_VERSION,
    PG_TLS1_2_VERSION,
    PG_TLS1_3_VERSION,
};

Function Documentation

check_ssl_key_file_permissions()

bool check_ssl_key_file_permissions	(	const char *	ssl_key_file,
		bool	isServerStart
	)

Definition at line 110 of file be-secure-common.c.

{
    int         loglevel = isServerStart ? FATAL : LOG;
    struct stat buf;
 
    if (stat(ssl_key_file, &buf) != 0)
    {
        ereport(loglevel,
                (errcode_for_file_access(),
                 errmsg("could not access private key file \"%s\": %m",
                        ssl_key_file)));
        return false;
    }
 
    /* Key file must be a regular file */
    if (!S_ISREG(buf.st_mode))
    {
        ereport(loglevel,
                (errcode(ERRCODE_CONFIG_FILE_ERROR),
                 errmsg("private key file \"%s\" is not a regular file",
                        ssl_key_file)));
        return false;
    }
 
    /*
     * Refuse to load key files owned by users other than us or root, and
     * require no public access to the key file.  If the file is owned by us,
     * require mode 0600 or less.  If owned by root, require 0640 or less to
     * allow read access through either our gid or a supplementary gid that
     * allows us to read system-wide certificates.
     *
     * Note that roughly similar checks are performed in
     * src/interfaces/libpq/fe-secure-openssl.c so any changes here may need
     * to be made there as well.  The environment is different though; this
     * code can assume that we're not running as root.
     *
     * Ideally we would do similar permissions checks on Windows, but it is
     * not clear how that would work since Unix-style permissions may not be
     * available.
     */
#if !defined(WIN32) && !defined(__CYGWIN__)
    if (buf.st_uid != geteuid() && buf.st_uid != 0)
    {
        ereport(loglevel,
                (errcode(ERRCODE_CONFIG_FILE_ERROR),
                 errmsg("private key file \"%s\" must be owned by the database user or root",
                        ssl_key_file)));
        return false;
    }
 
    if ((buf.st_uid == geteuid() && buf.st_mode & (S_IRWXG | S_IRWXO)) ||
        (buf.st_uid == 0 && buf.st_mode & (S_IWGRP | S_IXGRP | S_IRWXO)))
    {
        ereport(loglevel,
                (errcode(ERRCODE_CONFIG_FILE_ERROR),
                 errmsg("private key file \"%s\" has group or world access",
                        ssl_key_file),
                 errdetail("File must have permissions u=rw (0600) or less if owned by the database user, or permissions u=rw,g=r (0640) or less if owned by root.")));
        return false;
    }
#endif
 
    return true;
}

References buf, ereport, errcode(), errcode_for_file_access(), errdetail(), errmsg(), FATAL, LOG, S_IRWXG, S_IRWXO, S_ISREG, S_IWGRP, S_IXGRP, ssl_key_file, and stat.

Referenced by be_tls_init().

pq_buffer_has_data()

bool pq_buffer_has_data

(

void

)

Definition at line 1133 of file pqcomm.c.

{
    return (PqRecvPointer < PqRecvLength);
}

References PqRecvLength, and PqRecvPointer.

Referenced by ProcessStartupPacket().

pq_check_connection()

bool pq_check_connection

(

void

)

Definition at line 2029 of file pqcomm.c.

{
    WaitEvent   events[FeBeWaitSetNEvents];
    int         rc;
 
    /*
     * It's OK to modify the socket event filter without restoring, because
     * all FeBeWaitSet socket wait sites do the same.
     */
    ModifyWaitEvent(FeBeWaitSet, FeBeWaitSetSocketPos, WL_SOCKET_CLOSED, NULL);
 
retry:
    rc = WaitEventSetWait(FeBeWaitSet, 0, events, lengthof(events), 0);
    for (int i = 0; i < rc; ++i)
    {
        if (events[i].events & WL_SOCKET_CLOSED)
            return false;
        if (events[i].events & WL_LATCH_SET)
        {
            /*
             * A latch event might be preventing other events from being
             * reported.  Reset it and poll again.  No need to restore it
             * because no code should expect latches to survive across
             * CHECK_FOR_INTERRUPTS().
             */
            ResetLatch(MyLatch);
            goto retry;
        }
    }
 
    return true;
}

References FeBeWaitSet, FeBeWaitSetNEvents, FeBeWaitSetSocketPos, i, lengthof, ModifyWaitEvent(), MyLatch, ResetLatch(), WaitEventSetWait(), WL_LATCH_SET, and WL_SOCKET_CLOSED.

Referenced by ProcessInterrupts().

pq_endmsgread()

void pq_endmsgread

(

void

)

Definition at line 1170 of file pqcomm.c.

{
    Assert(PqCommReadingMsg);
 
    PqCommReadingMsg = false;
}

References Assert(), and PqCommReadingMsg.

Referenced by ProcessRepliesIfAny(), and ProcessStartupPacket().

pq_getbyte()

int pq_getbyte

(

void

)

Definition at line 976 of file pqcomm.c.

{
    Assert(PqCommReadingMsg);
 
    while (PqRecvPointer >= PqRecvLength)
    {
        if (pq_recvbuf())       /* If nothing in buffer, then recv some */
            return EOF;         /* Failed to recv data */
    }
    return (unsigned char) PqRecvBuffer[PqRecvPointer++];
}

References Assert(), pq_recvbuf(), PqCommReadingMsg, PqRecvBuffer, PqRecvLength, and PqRecvPointer.

Referenced by CheckSASLAuth(), CopyGetData(), recv_password_packet(), and SocketBackend().

pq_getbyte_if_available()

int pq_getbyte_if_available

(

unsigned char *

c

)

Definition at line 1016 of file pqcomm.c.

{
    int         r;
 
    Assert(PqCommReadingMsg);
 
    if (PqRecvPointer < PqRecvLength)
    {
        *c = PqRecvBuffer[PqRecvPointer++];
        return 1;
    }
 
    /* Put the socket into non-blocking mode */
    socket_set_nonblocking(true);
 
    r = secure_read(MyProcPort, c, 1);
    if (r < 0)
    {
        /*
         * Ok if no data available without blocking or interrupted (though
         * EINTR really shouldn't happen with a non-blocking socket). Report
         * other errors.
         */
        if (errno == EAGAIN || errno == EWOULDBLOCK || errno == EINTR)
            r = 0;
        else
        {
            /*
             * Careful: an ereport() that tries to write to the client would
             * cause recursion to here, leading to stack overflow and core
             * dump!  This message must go *only* to the postmaster log.
             */
            ereport(COMMERROR,
                    (errcode_for_socket_access(),
                     errmsg("could not receive data from client: %m")));
            r = EOF;
        }
    }
    else if (r == 0)
    {
        /* EOF detected */
        r = EOF;
    }
 
    return r;
}

References Assert(), COMMERROR, EAGAIN, EINTR, ereport, errcode_for_socket_access(), errmsg(), EWOULDBLOCK, MyProcPort, PqCommReadingMsg, PqRecvBuffer, PqRecvLength, PqRecvPointer, secure_read(), and socket_set_nonblocking().

Referenced by ProcessRepliesIfAny().

pq_getbytes()

int pq_getbytes	(	char *	s,
		size_t	len
	)

Definition at line 1070 of file pqcomm.c.

{
    size_t      amount;
 
    Assert(PqCommReadingMsg);
 
    while (len > 0)
    {
        while (PqRecvPointer >= PqRecvLength)
        {
            if (pq_recvbuf())   /* If nothing in buffer, then recv some */
                return EOF;     /* Failed to recv data */
        }
        amount = PqRecvLength - PqRecvPointer;
        if (amount > len)
            amount = len;
        memcpy(s, PqRecvBuffer + PqRecvPointer, amount);
        PqRecvPointer += amount;
        s += amount;
        len -= amount;
    }
    return 0;
}

References Assert(), len, pq_recvbuf(), PqCommReadingMsg, PqRecvBuffer, PqRecvLength, and PqRecvPointer.

Referenced by pq_getmessage(), and ProcessStartupPacket().

pq_getmessage()

int pq_getmessage	(	StringInfo	s,
		int	maxlen
	)

Definition at line 1208 of file pqcomm.c.

{
    int32       len;
 
    Assert(PqCommReadingMsg);
 
    resetStringInfo(s);
 
    /* Read message length word */
    if (pq_getbytes((char *) &len, 4) == EOF)
    {
        ereport(COMMERROR,
                (errcode(ERRCODE_PROTOCOL_VIOLATION),
                 errmsg("unexpected EOF within message length word")));
        return EOF;
    }
 
    len = pg_ntoh32(len);
 
    if (len < 4 || len > maxlen)
    {
        ereport(COMMERROR,
                (errcode(ERRCODE_PROTOCOL_VIOLATION),
                 errmsg("invalid message length")));
        return EOF;
    }
 
    len -= 4;                   /* discount length itself */
 
    if (len > 0)
    {
        /*
         * Allocate space for message.  If we run out of room (ridiculously
         * large message), we will elog(ERROR), but we want to discard the
         * message body so as not to lose communication sync.
         */
        PG_TRY();
        {
            enlargeStringInfo(s, len);
        }
        PG_CATCH();
        {
            if (pq_discardbytes(len) == EOF)
                ereport(COMMERROR,
                        (errcode(ERRCODE_PROTOCOL_VIOLATION),
                         errmsg("incomplete message from client")));
 
            /* we discarded the rest of the message so we're back in sync. */
            PqCommReadingMsg = false;
            PG_RE_THROW();
        }
        PG_END_TRY();
 
        /* And grab the message */
        if (pq_getbytes(s->data, len) == EOF)
        {
            ereport(COMMERROR,
                    (errcode(ERRCODE_PROTOCOL_VIOLATION),
                     errmsg("incomplete message from client")));
            return EOF;
        }
        s->len = len;
        /* Place a trailing null per StringInfo convention */
        s->data[len] = '\0';
    }
 
    /* finished reading the message. */
    PqCommReadingMsg = false;
 
    return 0;
}

References Assert(), COMMERROR, StringInfoData::data, enlargeStringInfo(), ereport, errcode(), errmsg(), StringInfoData::len, len, PG_CATCH, PG_END_TRY, pg_ntoh32, PG_RE_THROW, PG_TRY, pq_discardbytes(), pq_getbytes(), PqCommReadingMsg, and resetStringInfo().

Referenced by CheckSASLAuth(), CopyGetData(), ProcessRepliesIfAny(), recv_password_packet(), and SocketBackend().

pq_init()

void pq_init

(

void

)

Definition at line 172 of file pqcomm.c.

{
    int         socket_pos PG_USED_FOR_ASSERTS_ONLY;
    int         latch_pos PG_USED_FOR_ASSERTS_ONLY;
 
    /* initialize state variables */
    PqSendBufferSize = PQ_SEND_BUFFER_SIZE;
    PqSendBuffer = MemoryContextAlloc(TopMemoryContext, PqSendBufferSize);
    PqSendPointer = PqSendStart = PqRecvPointer = PqRecvLength = 0;
    PqCommBusy = false;
    PqCommReadingMsg = false;
 
    /* set up process-exit hook to close the socket */
    on_proc_exit(socket_close, 0);
 
    /*
     * In backends (as soon as forked) we operate the underlying socket in
     * nonblocking mode and use latches to implement blocking semantics if
     * needed. That allows us to provide safely interruptible reads and
     * writes.
     *
     * Use COMMERROR on failure, because ERROR would try to send the error to
     * the client, which might require changing the mode again, leading to
     * infinite recursion.
     */
#ifndef WIN32
    if (!pg_set_noblock(MyProcPort->sock))
        ereport(COMMERROR,
                (errmsg("could not set socket to nonblocking mode: %m")));
#endif
 
#ifndef WIN32
 
    /* Don't give the socket to any subprograms we execute. */
    if (fcntl(MyProcPort->sock, F_SETFD, FD_CLOEXEC) < 0)
        elog(FATAL, "fcntl(F_SETFD) failed on socket: %m");
#endif
 
    FeBeWaitSet = CreateWaitEventSet(TopMemoryContext, FeBeWaitSetNEvents);
    socket_pos = AddWaitEventToSet(FeBeWaitSet, WL_SOCKET_WRITEABLE,
                                   MyProcPort->sock, NULL, NULL);
    latch_pos = AddWaitEventToSet(FeBeWaitSet, WL_LATCH_SET, PGINVALID_SOCKET,
                                  MyLatch, NULL);
    AddWaitEventToSet(FeBeWaitSet, WL_POSTMASTER_DEATH, PGINVALID_SOCKET,
                      NULL, NULL);
 
    /*
     * The event positions match the order we added them, but let's sanity
     * check them to be sure.
     */
    Assert(socket_pos == FeBeWaitSetSocketPos);
    Assert(latch_pos == FeBeWaitSetLatchPos);
}

References AddWaitEventToSet(), Assert(), COMMERROR, CreateWaitEventSet(), elog(), ereport, errmsg(), FATAL, FeBeWaitSet, FeBeWaitSetLatchPos, FeBeWaitSetNEvents, FeBeWaitSetSocketPos, MemoryContextAlloc(), MyLatch, MyProcPort, on_proc_exit(), pg_set_noblock(), PG_USED_FOR_ASSERTS_ONLY, PGINVALID_SOCKET, PQ_SEND_BUFFER_SIZE, PqCommBusy, PqCommReadingMsg, PqRecvLength, PqRecvPointer, PqSendBuffer, PqSendBufferSize, PqSendPointer, PqSendStart, Port::sock, socket_close(), TopMemoryContext, WL_LATCH_SET, WL_POSTMASTER_DEATH, and WL_SOCKET_WRITEABLE.

Referenced by BackendInitialize().

pq_is_reading_msg()

bool pq_is_reading_msg

(

void

)

Definition at line 1186 of file pqcomm.c.

{
    return PqCommReadingMsg;
}

References PqCommReadingMsg.

Referenced by PostgresMain().

pq_peekbyte()

int pq_peekbyte

(

void

)

Definition at line 995 of file pqcomm.c.

{
    Assert(PqCommReadingMsg);
 
    while (PqRecvPointer >= PqRecvLength)
    {
        if (pq_recvbuf())       /* If nothing in buffer, then recv some */
            return EOF;         /* Failed to recv data */
    }
    return (unsigned char) PqRecvBuffer[PqRecvPointer];
}

References Assert(), pq_recvbuf(), PqCommReadingMsg, PqRecvBuffer, PqRecvLength, and PqRecvPointer.

pq_putmessage_v2()

int pq_putmessage_v2	(	char	msgtype,
		const char *	s,
		size_t	len
	)

Definition at line 1534 of file pqcomm.c.

{
    Assert(msgtype != 0);
 
    if (PqCommBusy)
        return 0;
    PqCommBusy = true;
    if (internal_putbytes(&msgtype, 1))
        goto fail;
 
    if (internal_putbytes(s, len))
        goto fail;
    PqCommBusy = false;
    return 0;
 
fail:
    PqCommBusy = false;
    return EOF;
}

References Assert(), internal_putbytes(), len, and PqCommBusy.

Referenced by send_message_to_frontend().

pq_startmsgread()

void pq_startmsgread

(

void

)

Definition at line 1146 of file pqcomm.c.

{
    /*
     * There shouldn't be a read active already, but let's check just to be
     * sure.
     */
    if (PqCommReadingMsg)
        ereport(FATAL,
                (errcode(ERRCODE_PROTOCOL_VIOLATION),
                 errmsg("terminating connection because protocol synchronization was lost")));
 
    PqCommReadingMsg = true;
}

References ereport, errcode(), errmsg(), FATAL, and PqCommReadingMsg.

Referenced by CheckSASLAuth(), CopyGetData(), ProcessRepliesIfAny(), ProcessStartupPacket(), recv_password_packet(), and SocketBackend().

RemoveSocketFiles()

void RemoveSocketFiles

(

void

)

Definition at line 865 of file pqcomm.c.

{
    ListCell   *l;
 
    /* Loop through all created sockets... */
    foreach(l, sock_paths)
    {
        char       *sock_path = (char *) lfirst(l);
 
        /* Ignore any error. */
        (void) unlink(sock_path);
    }
    /* Since we're about to exit, no need to reclaim storage */
    sock_paths = NIL;
}

References lfirst, NIL, and sock_paths.

Referenced by CloseServerPorts().

run_ssl_passphrase_command()

int run_ssl_passphrase_command	(	const char *	prompt,
		bool	is_server_start,
		char *	buf,
		int	size
	)

Definition at line 40 of file be-secure-common.c.

{
    int         loglevel = is_server_start ? ERROR : LOG;
    char       *command;
    FILE       *fh;
    int         pclose_rc;
    size_t      len = 0;
 
    Assert(prompt);
    Assert(size > 0);
    buf[0] = '\0';
 
    command = replace_percent_placeholders(ssl_passphrase_command, "ssl_passphrase_command", "p", prompt);
 
    fh = OpenPipeStream(command, "r");
    if (fh == NULL)
    {
        ereport(loglevel,
                (errcode_for_file_access(),
                 errmsg("could not execute command \"%s\": %m",
                        command)));
        goto error;
    }
 
    if (!fgets(buf, size, fh))
    {
        if (ferror(fh))
        {
            explicit_bzero(buf, size);
            ereport(loglevel,
                    (errcode_for_file_access(),
                     errmsg("could not read from command \"%s\": %m",
                            command)));
            goto error;
        }
    }
 
    pclose_rc = ClosePipeStream(fh);
    if (pclose_rc == -1)
    {
        explicit_bzero(buf, size);
        ereport(loglevel,
                (errcode_for_file_access(),
                 errmsg("could not close pipe to external command: %m")));
        goto error;
    }
    else if (pclose_rc != 0)
    {
        explicit_bzero(buf, size);
        ereport(loglevel,
                (errcode_for_file_access(),
                 errmsg("command \"%s\" failed",
                        command),
                 errdetail_internal("%s", wait_result_to_str(pclose_rc))));
        goto error;
    }
 
    /* strip trailing newline and carriage return */
    len = pg_strip_crlf(buf);
 
error:
    pfree(command);
    return len;
}

References Assert(), buf, ClosePipeStream(), ereport, errcode_for_file_access(), errdetail_internal(), errmsg(), ERROR, error(), explicit_bzero(), len, LOG, OpenPipeStream(), pfree(), pg_strip_crlf(), replace_percent_placeholders(), ssl_passphrase_command, and wait_result_to_str().

Referenced by ssl_external_passwd_cb().

secure_close()

void secure_close

(

Port *

port

)

Definition at line 133 of file be-secure.c.

{
#ifdef USE_SSL
    if (port->ssl_in_use)
        be_tls_close(port);
#endif
}

References be_tls_close(), and port.

Referenced by socket_close().

secure_destroy()

void secure_destroy

(

void

)

Definition at line 89 of file be-secure.c.

{
#ifdef USE_SSL
    be_tls_destroy();
#endif
}

References be_tls_destroy().

Referenced by process_pm_reload_request().

secure_initialize()

int secure_initialize

(

bool

isServerStart

)

Definition at line 76 of file be-secure.c.

{
#ifdef USE_SSL
    return be_tls_init(isServerStart);
#else
    return 0;
#endif
}

References be_tls_init().

Referenced by PostmasterMain(), and process_pm_reload_request().

secure_loaded_verify_locations()

bool secure_loaded_verify_locations

(

void

)

Definition at line 100 of file be-secure.c.

{
#ifdef USE_SSL
    return ssl_loaded_verify_locations;
#else
    return false;
#endif
}

Referenced by ClientAuthentication().

secure_open_server()

int secure_open_server

(

Port *

port

)

Definition at line 113 of file be-secure.c.

{
    int         r = 0;
 
#ifdef USE_SSL
    r = be_tls_open_server(port);
 
    ereport(DEBUG2,
            (errmsg_internal("SSL connection from DN:\"%s\" CN:\"%s\"",
                             port->peer_dn ? port->peer_dn : "(anonymous)",
                             port->peer_cn ? port->peer_cn : "(anonymous)")));
#endif
 
    return r;
}

References be_tls_open_server(), DEBUG2, ereport, errmsg_internal(), and port.

Referenced by ProcessStartupPacket().

secure_raw_read()

ssize_t secure_raw_read	(	Port *	port,
		void *	ptr,
		size_t	len
	)

Definition at line 234 of file be-secure.c.

{
    ssize_t     n;
 
    /*
     * Try to read from the socket without blocking. If it succeeds we're
     * done, otherwise we'll wait for the socket using the latch mechanism.
     */
#ifdef WIN32
    pgwin32_noblock = true;
#endif
    n = recv(port->sock, ptr, len, 0);
#ifdef WIN32
    pgwin32_noblock = false;
#endif
 
    return n;
}

References len, pgwin32_noblock, port, and recv.

Referenced by be_gssapi_read(), my_sock_read(), read_or_wait(), and secure_read().

secure_raw_write()

ssize_t secure_raw_write	(	Port *	port,
		const void *	ptr,
		size_t	len
	)

Definition at line 330 of file be-secure.c.

{
    ssize_t     n;
 
#ifdef WIN32
    pgwin32_noblock = true;
#endif
    n = send(port->sock, ptr, len, 0);
#ifdef WIN32
    pgwin32_noblock = false;
#endif
 
    return n;
}

References len, pgwin32_noblock, port, and send.

Referenced by be_gssapi_write(), my_sock_write(), secure_open_gssapi(), and secure_write().

secure_read()

ssize_t secure_read	(	Port *	port,
		void *	ptr,
		size_t	len
	)

Definition at line 145 of file be-secure.c.

{
    ssize_t     n;
    int         waitfor;
 
    /* Deal with any already-pending interrupt condition. */
    ProcessClientReadInterrupt(false);
 
retry:
#ifdef USE_SSL
    waitfor = 0;
    if (port->ssl_in_use)
    {
        n = be_tls_read(port, ptr, len, &waitfor);
    }
    else
#endif
#ifdef ENABLE_GSS
    if (port->gss && port->gss->enc)
    {
        n = be_gssapi_read(port, ptr, len);
        waitfor = WL_SOCKET_READABLE;
    }
    else
#endif
    {
        n = secure_raw_read(port, ptr, len);
        waitfor = WL_SOCKET_READABLE;
    }
 
    /* In blocking mode, wait until the socket is ready */
    if (n < 0 && !port->noblock && (errno == EWOULDBLOCK || errno == EAGAIN))
    {
        WaitEvent   event;
 
        Assert(waitfor);
 
        ModifyWaitEvent(FeBeWaitSet, FeBeWaitSetSocketPos, waitfor, NULL);
 
        WaitEventSetWait(FeBeWaitSet, -1 /* no timeout */ , &event, 1,
                         WAIT_EVENT_CLIENT_READ);
 
        /*
         * If the postmaster has died, it's not safe to continue running,
         * because it is the postmaster's job to kill us if some other backend
         * exits uncleanly.  Moreover, we won't run very well in this state;
         * helper processes like walwriter and the bgwriter will exit, so
         * performance may be poor.  Finally, if we don't exit, pg_ctl will be
         * unable to restart the postmaster without manual intervention, so no
         * new connections can be accepted.  Exiting clears the deck for a
         * postmaster restart.
         *
         * (Note that we only make this check when we would otherwise sleep on
         * our latch.  We might still continue running for a while if the
         * postmaster is killed in mid-query, or even through multiple queries
         * if we never have to wait for read.  We don't want to burn too many
         * cycles checking for this very rare condition, and this should cause
         * us to exit quickly in most cases.)
         */
        if (event.events & WL_POSTMASTER_DEATH)
            ereport(FATAL,
                    (errcode(ERRCODE_ADMIN_SHUTDOWN),
                     errmsg("terminating connection due to unexpected postmaster exit")));
 
        /* Handle interrupt. */
        if (event.events & WL_LATCH_SET)
        {
            ResetLatch(MyLatch);
            ProcessClientReadInterrupt(true);
 
            /*
             * We'll retry the read. Most likely it will return immediately
             * because there's still no data available, and we'll wait for the
             * socket to become ready again.
             */
        }
        goto retry;
    }
 
    /*
     * Process interrupts that happened during a successful (or non-blocking,
     * or hard-failed) read.
     */
    ProcessClientReadInterrupt(false);
 
    return n;
}

References Assert(), be_gssapi_read(), be_tls_read(), EAGAIN, ereport, errcode(), errmsg(), WaitEvent::events, EWOULDBLOCK, FATAL, FeBeWaitSet, FeBeWaitSetSocketPos, len, ModifyWaitEvent(), MyLatch, port, ProcessClientReadInterrupt(), ResetLatch(), secure_raw_read(), WAIT_EVENT_CLIENT_READ, WaitEventSetWait(), WL_LATCH_SET, WL_POSTMASTER_DEATH, and WL_SOCKET_READABLE.

Referenced by pq_getbyte_if_available(), and pq_recvbuf().

secure_write()

ssize_t secure_write	(	Port *	port,
		void *	ptr,
		size_t	len
	)

Definition at line 258 of file be-secure.c.

{
    ssize_t     n;
    int         waitfor;
 
    /* Deal with any already-pending interrupt condition. */
    ProcessClientWriteInterrupt(false);
 
retry:
    waitfor = 0;
#ifdef USE_SSL
    if (port->ssl_in_use)
    {
        n = be_tls_write(port, ptr, len, &waitfor);
    }
    else
#endif
#ifdef ENABLE_GSS
    if (port->gss && port->gss->enc)
    {
        n = be_gssapi_write(port, ptr, len);
        waitfor = WL_SOCKET_WRITEABLE;
    }
    else
#endif
    {
        n = secure_raw_write(port, ptr, len);
        waitfor = WL_SOCKET_WRITEABLE;
    }
 
    if (n < 0 && !port->noblock && (errno == EWOULDBLOCK || errno == EAGAIN))
    {
        WaitEvent   event;
 
        Assert(waitfor);
 
        ModifyWaitEvent(FeBeWaitSet, FeBeWaitSetSocketPos, waitfor, NULL);
 
        WaitEventSetWait(FeBeWaitSet, -1 /* no timeout */ , &event, 1,
                         WAIT_EVENT_CLIENT_WRITE);
 
        /* See comments in secure_read. */
        if (event.events & WL_POSTMASTER_DEATH)
            ereport(FATAL,
                    (errcode(ERRCODE_ADMIN_SHUTDOWN),
                     errmsg("terminating connection due to unexpected postmaster exit")));
 
        /* Handle interrupt. */
        if (event.events & WL_LATCH_SET)
        {
            ResetLatch(MyLatch);
            ProcessClientWriteInterrupt(true);
 
            /*
             * We'll retry the write. Most likely it will return immediately
             * because there's still no buffer space available, and we'll wait
             * for the socket to become ready again.
             */
        }
        goto retry;
    }
 
    /*
     * Process interrupts that happened during a successful (or non-blocking,
     * or hard-failed) write.
     */
    ProcessClientWriteInterrupt(false);
 
    return n;
}

References Assert(), be_gssapi_write(), be_tls_write(), EAGAIN, ereport, errcode(), errmsg(), WaitEvent::events, EWOULDBLOCK, FATAL, FeBeWaitSet, FeBeWaitSetSocketPos, len, ModifyWaitEvent(), MyLatch, port, ProcessClientWriteInterrupt(), ResetLatch(), secure_raw_write(), WAIT_EVENT_CLIENT_WRITE, WaitEventSetWait(), WL_LATCH_SET, WL_POSTMASTER_DEATH, and WL_SOCKET_WRITEABLE.

Referenced by internal_flush().

StreamClose()

void StreamClose

(

pgsocket

sock

)

Definition at line 832 of file pqcomm.c.

{
    closesocket(sock);
}

References closesocket.

Referenced by ClosePostmasterPorts(), CloseServerPorts(), ConnCreate(), and ServerLoop().

StreamConnection()

int StreamConnection	(	pgsocket	server_fd,
		Port *	port
	)

Definition at line 698 of file pqcomm.c.

{
    /* accept connection and fill in the client (remote) address */
    port->raddr.salen = sizeof(port->raddr.addr);
    if ((port->sock = accept(server_fd,
                             (struct sockaddr *) &port->raddr.addr,
                             &port->raddr.salen)) == PGINVALID_SOCKET)
    {
        ereport(LOG,
                (errcode_for_socket_access(),
                 errmsg("could not accept new connection: %m")));
 
        /*
         * If accept() fails then postmaster.c will still see the server
         * socket as read-ready, and will immediately try again.  To avoid
         * uselessly sucking lots of CPU, delay a bit before trying again.
         * (The most likely reason for failure is being out of kernel file
         * table slots; we can do little except hope some will get freed up.)
         */
        pg_usleep(100000L);     /* wait 0.1 sec */
        return STATUS_ERROR;
    }
 
    /* fill in the server (local) address */
    port->laddr.salen = sizeof(port->laddr.addr);
    if (getsockname(port->sock,
                    (struct sockaddr *) &port->laddr.addr,
                    &port->laddr.salen) < 0)
    {
        ereport(LOG,
                (errmsg("%s() failed: %m", "getsockname")));
        return STATUS_ERROR;
    }
 
    /* select NODELAY and KEEPALIVE options if it's a TCP connection */
    if (port->laddr.addr.ss_family != AF_UNIX)
    {
        int         on;
#ifdef WIN32
        int         oldopt;
        int         optlen;
        int         newopt;
#endif
 
#ifdef  TCP_NODELAY
        on = 1;
        if (setsockopt(port->sock, IPPROTO_TCP, TCP_NODELAY,
                       (char *) &on, sizeof(on)) < 0)
        {
            ereport(LOG,
                    (errmsg("%s(%s) failed: %m", "setsockopt", "TCP_NODELAY")));
            return STATUS_ERROR;
        }
#endif
        on = 1;
        if (setsockopt(port->sock, SOL_SOCKET, SO_KEEPALIVE,
                       (char *) &on, sizeof(on)) < 0)
        {
            ereport(LOG,
                    (errmsg("%s(%s) failed: %m", "setsockopt", "SO_KEEPALIVE")));
            return STATUS_ERROR;
        }
 
#ifdef WIN32
 
        /*
         * This is a Win32 socket optimization.  The OS send buffer should be
         * large enough to send the whole Postgres send buffer in one go, or
         * performance suffers.  The Postgres send buffer can be enlarged if a
         * very large message needs to be sent, but we won't attempt to
         * enlarge the OS buffer if that happens, so somewhat arbitrarily
         * ensure that the OS buffer is at least PQ_SEND_BUFFER_SIZE * 4.
         * (That's 32kB with the current default).
         *
         * The default OS buffer size used to be 8kB in earlier Windows
         * versions, but was raised to 64kB in Windows 2012.  So it shouldn't
         * be necessary to change it in later versions anymore.  Changing it
         * unnecessarily can even reduce performance, because setting
         * SO_SNDBUF in the application disables the "dynamic send buffering"
         * feature that was introduced in Windows 7.  So before fiddling with
         * SO_SNDBUF, check if the current buffer size is already large enough
         * and only increase it if necessary.
         *
         * See https://support.microsoft.com/kb/823764/EN-US/ and
         * https://msdn.microsoft.com/en-us/library/bb736549%28v=vs.85%29.aspx
         */
        optlen = sizeof(oldopt);
        if (getsockopt(port->sock, SOL_SOCKET, SO_SNDBUF, (char *) &oldopt,
                       &optlen) < 0)
        {
            ereport(LOG,
                    (errmsg("%s(%s) failed: %m", "getsockopt", "SO_SNDBUF")));
            return STATUS_ERROR;
        }
        newopt = PQ_SEND_BUFFER_SIZE * 4;
        if (oldopt < newopt)
        {
            if (setsockopt(port->sock, SOL_SOCKET, SO_SNDBUF, (char *) &newopt,
                           sizeof(newopt)) < 0)
            {
                ereport(LOG,
                        (errmsg("%s(%s) failed: %m", "setsockopt", "SO_SNDBUF")));
                return STATUS_ERROR;
            }
        }
#endif
 
        /*
         * Also apply the current keepalive parameters.  If we fail to set a
         * parameter, don't error out, because these aren't universally
         * supported.  (Note: you might think we need to reset the GUC
         * variables to 0 in such a case, but it's not necessary because the
         * show hooks for these variables report the truth anyway.)
         */
        (void) pq_setkeepalivesidle(tcp_keepalives_idle, port);
        (void) pq_setkeepalivesinterval(tcp_keepalives_interval, port);
        (void) pq_setkeepalivescount(tcp_keepalives_count, port);
        (void) pq_settcpusertimeout(tcp_user_timeout, port);
    }
 
    return STATUS_OK;
}

References accept, ereport, errcode_for_socket_access(), errmsg(), LOG, pg_usleep(), PGINVALID_SOCKET, port, PQ_SEND_BUFFER_SIZE, pq_setkeepalivescount(), pq_setkeepalivesidle(), pq_setkeepalivesinterval(), pq_settcpusertimeout(), STATUS_ERROR, STATUS_OK, tcp_keepalives_count, tcp_keepalives_idle, tcp_keepalives_interval, and tcp_user_timeout.

Referenced by ConnCreate().

StreamServerPort()

int StreamServerPort	(	int	family,
		const char *	hostName,
		unsigned short	portNumber,
		const char *	unixSocketDir,
		pgsocket	ListenSocket[],
		int	MaxListen
	)

Definition at line 321 of file pqcomm.c.

{
    pgsocket    fd;
    int         err;
    int         maxconn;
    int         ret;
    char        portNumberStr[32];
    const char *familyDesc;
    char        familyDescBuf[64];
    const char *addrDesc;
    char        addrBuf[NI_MAXHOST];
    char       *service;
    struct addrinfo *addrs = NULL,
               *addr;
    struct addrinfo hint;
    int         listen_index = 0;
    int         added = 0;
    char        unixSocketPath[MAXPGPATH];
#if !defined(WIN32) || defined(IPV6_V6ONLY)
    int         one = 1;
#endif
 
    /* Initialize hint structure */
    MemSet(&hint, 0, sizeof(hint));
    hint.ai_family = family;
    hint.ai_flags = AI_PASSIVE;
    hint.ai_socktype = SOCK_STREAM;
 
    if (family == AF_UNIX)
    {
        /*
         * Create unixSocketPath from portNumber and unixSocketDir and lock
         * that file path
         */
        UNIXSOCK_PATH(unixSocketPath, portNumber, unixSocketDir);
        if (strlen(unixSocketPath) >= UNIXSOCK_PATH_BUFLEN)
        {
            ereport(LOG,
                    (errmsg("Unix-domain socket path \"%s\" is too long (maximum %d bytes)",
                            unixSocketPath,
                            (int) (UNIXSOCK_PATH_BUFLEN - 1))));
            return STATUS_ERROR;
        }
        if (Lock_AF_UNIX(unixSocketDir, unixSocketPath) != STATUS_OK)
            return STATUS_ERROR;
        service = unixSocketPath;
    }
    else
    {
        snprintf(portNumberStr, sizeof(portNumberStr), "%d", portNumber);
        service = portNumberStr;
    }
 
    ret = pg_getaddrinfo_all(hostName, service, &hint, &addrs);
    if (ret || !addrs)
    {
        if (hostName)
            ereport(LOG,
                    (errmsg("could not translate host name \"%s\", service \"%s\" to address: %s",
                            hostName, service, gai_strerror(ret))));
        else
            ereport(LOG,
                    (errmsg("could not translate service \"%s\" to address: %s",
                            service, gai_strerror(ret))));
        if (addrs)
            pg_freeaddrinfo_all(hint.ai_family, addrs);
        return STATUS_ERROR;
    }
 
    for (addr = addrs; addr; addr = addr->ai_next)
    {
        if (family != AF_UNIX && addr->ai_family == AF_UNIX)
        {
            /*
             * Only set up a unix domain socket when they really asked for it.
             * The service/port is different in that case.
             */
            continue;
        }
 
        /* See if there is still room to add 1 more socket. */
        for (; listen_index < MaxListen; listen_index++)
        {
            if (ListenSocket[listen_index] == PGINVALID_SOCKET)
                break;
        }
        if (listen_index >= MaxListen)
        {
            ereport(LOG,
                    (errmsg("could not bind to all requested addresses: MAXLISTEN (%d) exceeded",
                            MaxListen)));
            break;
        }
 
        /* set up address family name for log messages */
        switch (addr->ai_family)
        {
            case AF_INET:
                familyDesc = _("IPv4");
                break;
            case AF_INET6:
                familyDesc = _("IPv6");
                break;
            case AF_UNIX:
                familyDesc = _("Unix");
                break;
            default:
                snprintf(familyDescBuf, sizeof(familyDescBuf),
                         _("unrecognized address family %d"),
                         addr->ai_family);
                familyDesc = familyDescBuf;
                break;
        }
 
        /* set up text form of address for log messages */
        if (addr->ai_family == AF_UNIX)
            addrDesc = unixSocketPath;
        else
        {
            pg_getnameinfo_all((const struct sockaddr_storage *) addr->ai_addr,
                               addr->ai_addrlen,
                               addrBuf, sizeof(addrBuf),
                               NULL, 0,
                               NI_NUMERICHOST);
            addrDesc = addrBuf;
        }
 
        if ((fd = socket(addr->ai_family, SOCK_STREAM, 0)) == PGINVALID_SOCKET)
        {
            ereport(LOG,
                    (errcode_for_socket_access(),
            /* translator: first %s is IPv4, IPv6, or Unix */
                     errmsg("could not create %s socket for address \"%s\": %m",
                            familyDesc, addrDesc)));
            continue;
        }
 
#ifndef WIN32
 
        /*
         * Without the SO_REUSEADDR flag, a new postmaster can't be started
         * right away after a stop or crash, giving "address already in use"
         * error on TCP ports.
         *
         * On win32, however, this behavior only happens if the
         * SO_EXCLUSIVEADDRUSE is set. With SO_REUSEADDR, win32 allows
         * multiple servers to listen on the same address, resulting in
         * unpredictable behavior. With no flags at all, win32 behaves as Unix
         * with SO_REUSEADDR.
         */
        if (addr->ai_family != AF_UNIX)
        {
            if ((setsockopt(fd, SOL_SOCKET, SO_REUSEADDR,
                            (char *) &one, sizeof(one))) == -1)
            {
                ereport(LOG,
                        (errcode_for_socket_access(),
                /* translator: third %s is IPv4, IPv6, or Unix */
                         errmsg("%s(%s) failed for %s address \"%s\": %m",
                                "setsockopt", "SO_REUSEADDR",
                                familyDesc, addrDesc)));
                closesocket(fd);
                continue;
            }
        }
#endif
 
#ifdef IPV6_V6ONLY
        if (addr->ai_family == AF_INET6)
        {
            if (setsockopt(fd, IPPROTO_IPV6, IPV6_V6ONLY,
                           (char *) &one, sizeof(one)) == -1)
            {
                ereport(LOG,
                        (errcode_for_socket_access(),
                /* translator: third %s is IPv4, IPv6, or Unix */
                         errmsg("%s(%s) failed for %s address \"%s\": %m",
                                "setsockopt", "IPV6_V6ONLY",
                                familyDesc, addrDesc)));
                closesocket(fd);
                continue;
            }
        }
#endif
 
        /*
         * Note: This might fail on some OS's, like Linux older than
         * 2.4.21-pre3, that don't have the IPV6_V6ONLY socket option, and map
         * ipv4 addresses to ipv6.  It will show ::ffff:ipv4 for all ipv4
         * connections.
         */
        err = bind(fd, addr->ai_addr, addr->ai_addrlen);
        if (err < 0)
        {
            int         saved_errno = errno;
 
            ereport(LOG,
                    (errcode_for_socket_access(),
            /* translator: first %s is IPv4, IPv6, or Unix */
                     errmsg("could not bind %s address \"%s\": %m",
                            familyDesc, addrDesc),
                     saved_errno == EADDRINUSE ?
                     (addr->ai_family == AF_UNIX ?
                      errhint("Is another postmaster already running on port %d?",
                              (int) portNumber) :
                      errhint("Is another postmaster already running on port %d?"
                              " If not, wait a few seconds and retry.",
                              (int) portNumber)) : 0));
            closesocket(fd);
            continue;
        }
 
        if (addr->ai_family == AF_UNIX)
        {
            if (Setup_AF_UNIX(service) != STATUS_OK)
            {
                closesocket(fd);
                break;
            }
        }
 
        /*
         * Select appropriate accept-queue length limit.  It seems reasonable
         * to use a value similar to the maximum number of child processes
         * that the postmaster will permit.
         */
        maxconn = MaxConnections * 2;
 
        err = listen(fd, maxconn);
        if (err < 0)
        {
            ereport(LOG,
                    (errcode_for_socket_access(),
            /* translator: first %s is IPv4, IPv6, or Unix */
                     errmsg("could not listen on %s address \"%s\": %m",
                            familyDesc, addrDesc)));
            closesocket(fd);
            continue;
        }
 
        if (addr->ai_family == AF_UNIX)
            ereport(LOG,
                    (errmsg("listening on Unix socket \"%s\"",
                            addrDesc)));
        else
            ereport(LOG,
            /* translator: first %s is IPv4 or IPv6 */
                    (errmsg("listening on %s address \"%s\", port %d",
                            familyDesc, addrDesc, (int) portNumber)));
 
        ListenSocket[listen_index] = fd;
        added++;
    }
 
    pg_freeaddrinfo_all(hint.ai_family, addrs);
 
    if (!added)
        return STATUS_ERROR;
 
    return STATUS_OK;
}

References _, bind, closesocket, EADDRINUSE, ereport, err(), errcode_for_socket_access(), errhint(), errmsg(), fd(), listen, ListenSocket, Lock_AF_UNIX(), LOG, MaxConnections, MAXPGPATH, MemSet, pg_freeaddrinfo_all(), pg_getaddrinfo_all(), pg_getnameinfo_all(), PGINVALID_SOCKET, Setup_AF_UNIX(), snprintf, socket, STATUS_ERROR, STATUS_OK, UNIXSOCK_PATH, and UNIXSOCK_PATH_BUFLEN.

Referenced by PostmasterMain().

TouchSocketFiles()

void TouchSocketFiles

(

void

)

Definition at line 847 of file pqcomm.c.

{
    ListCell   *l;
 
    /* Loop through all created sockets... */
    foreach(l, sock_paths)
    {
        char       *sock_path = (char *) lfirst(l);
 
        /* Ignore errors; there's no point in complaining */
        (void) utime(sock_path, NULL);
    }
}

References lfirst, and sock_paths.

Referenced by ServerLoop().

Variable Documentation

FeBeWaitSet

PGDLLIMPORT WaitEventSet* FeBeWaitSet

extern

Definition at line 164 of file pqcomm.c.

Referenced by pq_check_connection(), pq_init(), secure_read(), secure_write(), SwitchBackToLocalLatch(), SwitchToSharedLatch(), and WalSndWait().

PqCommMethods

const PGDLLIMPORT PQcommMethods* PqCommMethods

extern

Definition at line 162 of file pqcomm.c.

Referenced by pq_redirect_to_shm_mq(), and pq_set_parallel_leader().

ssl_ca_file

PGDLLIMPORT char* ssl_ca_file

extern

Definition at line 41 of file be-secure.c.

Referenced by be_tls_init().

ssl_cert_file

PGDLLIMPORT char* ssl_cert_file

extern

Definition at line 39 of file be-secure.c.

Referenced by be_tls_init().

ssl_crl_dir

PGDLLIMPORT char* ssl_crl_dir

extern

Definition at line 43 of file be-secure.c.

Referenced by be_tls_init().

ssl_crl_file

PGDLLIMPORT char* ssl_crl_file

extern

Definition at line 42 of file be-secure.c.

Referenced by be_tls_init().

ssl_dh_params_file

PGDLLIMPORT char* ssl_dh_params_file

extern

Definition at line 44 of file be-secure.c.

Referenced by initialize_dh().

ssl_key_file

PGDLLIMPORT char* ssl_key_file

extern

Definition at line 40 of file be-secure.c.

Referenced by be_tls_init(), and check_ssl_key_file_permissions().

ssl_library

PGDLLIMPORT char* ssl_library

extern

Definition at line 38 of file be-secure.c.

ssl_max_protocol_version

PGDLLIMPORT int ssl_max_protocol_version

extern

Definition at line 62 of file be-secure.c.

Referenced by be_tls_init(), and be_tls_open_server().

ssl_min_protocol_version

PGDLLIMPORT int ssl_min_protocol_version

extern

Definition at line 61 of file be-secure.c.

Referenced by be_tls_init(), and be_tls_open_server().

ssl_passphrase_command

PGDLLIMPORT char* ssl_passphrase_command

extern

Definition at line 45 of file be-secure.c.

Referenced by default_openssl_tls_init(), run_ssl_passphrase_command(), and set_rot13().

ssl_passphrase_command_supports_reload

PGDLLIMPORT bool ssl_passphrase_command_supports_reload

extern

Definition at line 46 of file be-secure.c.

Referenced by default_openssl_tls_init().

SSLCipherSuites

PGDLLIMPORT char* SSLCipherSuites

extern

Definition at line 53 of file be-secure.c.

Referenced by be_tls_init().

SSLECDHCurve

PGDLLIMPORT char* SSLECDHCurve

extern

Definition at line 56 of file be-secure.c.

Referenced by initialize_ecdh().

SSLPreferServerCiphers

PGDLLIMPORT bool SSLPreferServerCiphers

extern

Definition at line 59 of file be-secure.c.

Referenced by be_tls_init().