11
11
*
12
12
*
13
13
* IDENTIFICATION
14
- * $Header: /cvsroot/pgsql/src/backend/libpq/be-secure.c,v 1.36 2003/07/22 19:00:10 tgl Exp $
14
+ * $Header: /cvsroot/pgsql/src/backend/libpq/be-secure.c,v 1.37 2003/07/27 21:49:53 tgl Exp $
15
15
*
16
16
* Since the server static private key ($DataDir/server.key)
17
17
* will normally be stored unencrypted so that the database
81
81
#include <fcntl.h>
82
82
#include <errno.h>
83
83
#include <ctype.h>
84
-
85
- #include "libpq/libpq.h"
86
- #include "miscadmin.h"
87
-
88
84
#include <sys/socket.h>
89
85
#include <unistd.h>
90
86
#include <netdb.h>
94
90
#include <arpa/inet.h>
95
91
#endif
96
92
97
- #ifndef HAVE_STRDUP
98
- #include "strdup.h"
99
- #endif
100
-
101
93
#ifdef USE_SSL
102
94
#include <openssl/ssl.h>
103
95
#include <openssl/dh.h>
104
96
#endif
105
97
106
- extern void ExitPostmaster ( int );
107
- extern void postmaster_error ( const char * fmt ,...);
98
+ #include "libpq/libpq.h"
99
+ #include "miscadmin.h"
108
100
109
101
#ifdef USE_SSL
110
102
static DH * load_dh_file (int keylength );
@@ -126,6 +118,7 @@ static const char *SSLerrmessage(void);
126
118
*/
127
119
#define RENEGOTIATION_LIMIT (512 * 1024 * 1024)
128
120
#define CA_PATH NULL
121
+
129
122
static SSL_CTX * SSL_context = NULL ;
130
123
#endif
131
124
@@ -607,7 +600,7 @@ info_cb(const SSL *ssl, int type, int args)
607
600
static int
608
601
initialize_SSL (void )
609
602
{
610
- char fnbuf [2048 ];
603
+ char fnbuf [MAXPGPATH ];
611
604
struct stat buf ;
612
605
613
606
if (!SSL_context )
@@ -616,50 +609,43 @@ initialize_SSL(void)
616
609
SSL_load_error_strings ();
617
610
SSL_context = SSL_CTX_new (SSLv23_method ());
618
611
if (!SSL_context )
619
- {
620
- postmaster_error ("failed to create SSL context: %s" ,
621
- SSLerrmessage ());
622
- ExitPostmaster (1 );
623
- }
612
+ ereport (FATAL ,
613
+ (errmsg ("could not create SSL context: %s" ,
614
+ SSLerrmessage ())));
624
615
625
616
/*
626
617
* Load and verify certificate and private key
627
618
*/
628
619
snprintf (fnbuf , sizeof (fnbuf ), "%s/server.crt" , DataDir );
629
620
if (!SSL_CTX_use_certificate_file (SSL_context , fnbuf , SSL_FILETYPE_PEM ))
630
- {
631
- postmaster_error ("failed to load server certificate (%s): %s" ,
632
- fnbuf , SSLerrmessage ());
633
- ExitPostmaster (1 );
634
- }
621
+ ereport (FATAL ,
622
+ (errcode (ERRCODE_CONFIG_FILE_ERROR ),
623
+ errmsg ("could not load server certificate file \"%s\": %s" ,
624
+ fnbuf , SSLerrmessage ())));
635
625
636
626
snprintf (fnbuf , sizeof (fnbuf ), "%s/server.key" , DataDir );
637
- if (lstat (fnbuf , & buf ) == -1 )
638
- {
639
- postmaster_error ("failed to stat private key file (%s): %s" ,
640
- fnbuf , strerror (errno ));
641
- ExitPostmaster (1 );
642
- }
643
- if (!S_ISREG (buf .st_mode ) || (buf .st_mode & 0077 ) ||
627
+ if (stat (fnbuf , & buf ) == -1 )
628
+ ereport (FATAL ,
629
+ (errcode_for_file_access (),
630
+ errmsg ("could not access private key file \"%s\": %m" ,
631
+ fnbuf )));
632
+ if (!S_ISREG (buf .st_mode ) || (buf .st_mode & (S_IRWXG | S_IRWXO )) ||
644
633
buf .st_uid != getuid ())
645
- {
646
- postmaster_error ( "bad permissions on private key file (%s)\n"
647
- "File must be owned by the proper user and must have no permissions for\n"
648
- "\"group\" or \"other\"." , fnbuf );
649
- ExitPostmaster ( 1 );
650
- }
634
+ ereport ( FATAL ,
635
+ ( errcode ( ERRCODE_CONFIG_FILE_ERROR ),
636
+ errmsg ( "unsafe permissions on private key file \"%s\"" ,
637
+ fnbuf ),
638
+ errdetail ( "File must be owned by the database user and must have no permissions for \"group\" or \"other\"." )) );
639
+
651
640
if (!SSL_CTX_use_PrivateKey_file (SSL_context , fnbuf , SSL_FILETYPE_PEM ))
652
- {
653
- postmaster_error ("failed to load private key file (%s): %s" ,
654
- fnbuf , SSLerrmessage ());
655
- ExitPostmaster (1 );
656
- }
641
+ ereport (FATAL ,
642
+ (errmsg ("could not load private key file \"%s\": %s" ,
643
+ fnbuf , SSLerrmessage ())));
644
+
657
645
if (!SSL_CTX_check_private_key (SSL_context ))
658
- {
659
- postmaster_error ("check of private key failed: %s" ,
660
- SSLerrmessage ());
661
- ExitPostmaster (1 );
662
- }
646
+ ereport (FATAL ,
647
+ (errmsg ("check of private key failed: %s" ,
648
+ SSLerrmessage ())));
663
649
}
664
650
665
651
/* set up empheral DH keys */
@@ -668,25 +654,22 @@ initialize_SSL(void)
668
654
669
655
/* setup the allowed cipher list */
670
656
if (SSL_CTX_set_cipher_list (SSL_context , "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH" ) != 1 )
671
- {
672
- postmaster_error ("unable to set the cipher list (no valid ciphers available)" );
673
- ExitPostmaster (1 );
674
- }
657
+ elog (FATAL , "could not set the cipher list (no valid ciphers available)" );
675
658
676
659
/* accept client certificates, but don't require them. */
677
- snprintf (fnbuf , sizeof fnbuf , "%s/root.crt" , DataDir );
660
+ snprintf (fnbuf , sizeof ( fnbuf ) , "%s/root.crt" , DataDir );
678
661
if (!SSL_CTX_load_verify_locations (SSL_context , fnbuf , CA_PATH ))
679
662
{
663
+ /* Not fatal - we do not require client certificates */
664
+ ereport (LOG ,
665
+ (errmsg ("could not load root cert file \"%s\": %s" ,
666
+ fnbuf , SSLerrmessage ()),
667
+ errdetail ("Will not verify client certificates." )));
680
668
return 0 ;
681
- #ifdef NOT_USED
682
- /* CLIENT CERTIFICATES NOT REQUIRED bjm 2002-09-26 */
683
- postmaster_error ("could not read root cert file (%s): %s" ,
684
- fnbuf , SSLerrmessage ());
685
- ExitPostmaster (1 );
686
- #endif
687
669
}
688
670
SSL_CTX_set_verify (SSL_context ,
689
- SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE , verify_cb );
671
+ SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE ,
672
+ verify_cb );
690
673
691
674
return 0 ;
692
675
}
@@ -716,7 +699,7 @@ open_server_SSL(Port *port)
716
699
{
717
700
ereport (COMMERROR ,
718
701
(errcode (ERRCODE_PROTOCOL_VIOLATION ),
719
- errmsg ("failed to initialize SSL connection: %s" ,
702
+ errmsg ("could not initialize SSL connection: %s" ,
720
703
SSLerrmessage ())));
721
704
close_SSL (port );
722
705
return -1 ;
@@ -739,7 +722,8 @@ open_server_SSL(Port *port)
739
722
NID_commonName , port -> peer_cn , sizeof (port -> peer_cn ));
740
723
port -> peer_cn [sizeof (port -> peer_cn ) - 1 ] = '\0' ;
741
724
}
742
- elog (DEBUG2 , "secure connection from \"%s\"" , port -> peer_cn );
725
+ ereport (DEBUG2 ,
726
+ (errmsg ("secure connection from \"%s\"" , port -> peer_cn )));
743
727
744
728
/* set up debugging/info callback */
745
729
SSL_CTX_set_info_callback (SSL_context , info_cb );
0 commit comments