Skip to content

Commit b6c9165

Browse files
tglsfdctglsfdc
committed
Code review for SSLKEY patch.
1 parent 5ce7599 commit b6c9165

File tree

6 files changed

+38
-28
lines changed

6 files changed

+38
-28
lines changed

‎src/backend/libpq/be-secure.c

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
*
1212
*
1313
* IDENTIFICATION
14-
* $PostgreSQL: pgsql/src/backend/libpq/be-secure.c,v 1.78 2007/02/16 02:59:40 momjian Exp $
14+
* $PostgreSQL: pgsql/src/backend/libpq/be-secure.c,v 1.79 2007/02/16 17:06:59 tgl Exp $
1515
*
1616
* Since the server static private key ($DataDir/server.key)
1717
* will normally be stored unencrypted so that the database
@@ -95,8 +95,7 @@
9595
#if SSLEAY_VERSION_NUMBER >= 0x0907000L
9696
#include <openssl/conf.h>
9797
#endif
98-
99-
#endif
98+
#endif /* USE_SSL */
10099

101100
#include "libpq/libpq.h"
102101
#include "tcop/tcopprot.h"
@@ -130,8 +129,8 @@ static const char *SSLerrmessage(void);
130129

131130
static SSL_CTX *SSL_context = NULL;
132131

133-
/* GUC variable controlling SSL cipher list*/
134-
extern char *SSLCipherSuites;
132+
/* GUC variable controlling SSL cipher list */
133+
char *SSLCipherSuites = NULL;
135134

136135
#endif
137136

‎src/backend/postmaster/postmaster.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@
3737
*
3838
*
3939
* IDENTIFICATION
40-
* $PostgreSQL: pgsql/src/backend/postmaster/postmaster.c,v 1.524 2007/02/16 02:59:41 momjian Exp $
40+
* $PostgreSQL: pgsql/src/backend/postmaster/postmaster.c,v 1.525 2007/02/16 17:06:59 tgl Exp $
4141
*
4242
* NOTES
4343
*
@@ -187,7 +187,6 @@ static int SendStop = false;
187187

188188
/* still more option variables */
189189
bool EnableSSL = false;
190-
char *SSLCipherSuites;
191190
bool SilentMode = false; /* silent mode (-S) */
192191

193192
int PreAuthDelay = 0;

‎src/backend/utils/misc/guc.c

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
* Written by Peter Eisentraut <peter_e@gmx.net>.
1111
*
1212
* IDENTIFICATION
13-
* $PostgreSQL: pgsql/src/backend/utils/misc/guc.c,v 1.375 2007/02/16 02:59:41 momjian Exp $
13+
* $PostgreSQL: pgsql/src/backend/utils/misc/guc.c,v 1.376 2007/02/16 17:07:00 tgl Exp $
1414
*
1515
*--------------------------------------------------------------------
1616
*/
@@ -106,6 +106,11 @@ extern bool fullPageWrites;
106106
extern bool trace_sort;
107107
#endif
108108

109+
#ifdef USE_SSL
110+
extern char *SSLCipherSuites;
111+
#endif
112+
113+
109114
static const char *assign_log_destination(const char *value,
110115
bool doit, GucSource source);
111116

@@ -2314,6 +2319,7 @@ static struct config_string ConfigureNamesString[] =
23142319
NULL, assign_temp_tablespaces, NULL
23152320
},
23162321

2322+
#ifdef USE_SSL
23172323
{
23182324
{"ssl_ciphers", PGC_POSTMASTER, CONN_AUTH_SECURITY,
23192325
gettext_noop("Sets the list of allowed SSL ciphers."),
@@ -2323,7 +2329,8 @@ static struct config_string ConfigureNamesString[] =
23232329
&SSLCipherSuites,
23242330
"ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH", NULL, NULL
23252331
},
2326-
2332+
#endif /* USE_SSL */
2333+
23272334
/* End-of-list marker */
23282335
{
23292336
{NULL, 0, 0, NULL, NULL}, NULL, NULL, NULL, NULL

‎src/backend/utils/misc/postgresql.conf.sample

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,8 @@
7474

7575
#authentication_timeout = 1min # 1s-600s
7676
#ssl = off # (change requires restart)
77-
#ssl_ciphers = 'ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH' # List of ciphers to use
77+
#ssl_ciphers = 'ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH' # Allowed SSL ciphers
78+
# (change requires restart)
7879
#password_encryption = on
7980
#db_user_namespace = off
8081

‎src/include/postmaster/postmaster.h

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
* Portions Copyright (c) 1996-2007, PostgreSQL Global Development Group
77
* Portions Copyright (c) 1994, Regents of the University of California
88
*
9-
* $PostgreSQL: pgsql/src/include/postmaster/postmaster.h,v 1.16 2007/02/16 02:59:41 momjian Exp $
9+
* $PostgreSQL: pgsql/src/include/postmaster/postmaster.h,v 1.17 2007/02/16 17:07:00 tgl Exp $
1010
*
1111
*-------------------------------------------------------------------------
1212
*/
@@ -15,7 +15,6 @@
1515

1616
/* GUC options */
1717
extern bool EnableSSL;
18-
extern char *SSLCipherSuites;
1918
extern bool SilentMode;
2019
extern int ReservedBackends;
2120
extern int PostPortNumber;

‎src/interfaces/libpq/fe-secure.c

Lines changed: 21 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
*
1212
*
1313
* IDENTIFICATION
14-
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-secure.c,v 1.93 2007/02/16 02:59:41 momjian Exp $
14+
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-secure.c,v 1.94 2007/02/16 17:07:00 tgl Exp $
1515
*
1616
* NOTES
1717
* [ Most of these notes are wrong/obsolete, but perhaps not all ]
@@ -619,7 +619,7 @@ client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
619619
char *engine_env = getenv("PGSSLKEY");
620620
char *engine_colon = strchr(engine_env, ':');
621621
char *engine_str;
622-
ENGINE *engine_ptr = NULL;
622+
ENGINE *engine_ptr;
623623

624624
if (!engine_colon)
625625
{
@@ -630,34 +630,38 @@ client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
630630

631631
engine_str = malloc(engine_colon - engine_env + 1);
632632
strlcpy(engine_str, engine_env, engine_colon - engine_env + 1);
633-
if ((engine_ptr = ENGINE_by_id(engine_str)) == NULL)
633+
engine_ptr = ENGINE_by_id(engine_str);
634+
if (engine_ptr == NULL)
634635
{
635636
char *err = SSLerrmessage();
636637

637638
printfPQExpBuffer(&conn->errorMessage,
638-
libpq_gettext("could not load SSL engine \"%s\":%s\n"), engine_str, err);
639-
free(engine_str);
639+
libpq_gettext("could not load SSL engine \"%s\": %s\n"),
640+
engine_str, err);
640641
SSLerrfree(err);
642+
free(engine_str);
641643
return 0;
642644
}
643-
if ((*pkey = ENGINE_load_private_key(engine_ptr,
644-
engine_colon + 1, NULL, NULL)) == NULL)
645+
646+
*pkey = ENGINE_load_private_key(engine_ptr, engine_colon + 1,
647+
NULL, NULL);
648+
if (*pkey == NULL)
645649
{
646650
char *err = SSLerrmessage();
647651

648652
printfPQExpBuffer(&conn->errorMessage,
649-
libpq_gettext("could not read private SSL key %s from engine \"%s\": %s\n"),
650-
engine_colon + 1, engine_str, err);
653+
libpq_gettext("could not read private SSL key \"%s\" from engine \"%s\": %s\n"),
654+
engine_colon + 1, engine_str, err);
651655
SSLerrfree(err);
652656
free(engine_str);
653657
return 0;
654658
}
655659
free(engine_str);
656660
}
657661
else
658-
#endif
662+
#endif /* use PGSSLKEY */
659663
{
660-
/* read the user key from file*/
664+
/* read the user key from file */
661665
snprintf(fnbuf, sizeof(fnbuf), "%s/%s", homedir, USER_KEY_FILE);
662666
if (stat(fnbuf, &buf) == -1)
663667
{
@@ -666,7 +670,7 @@ client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
666670
fnbuf);
667671
return 0;
668672
}
669-
#ifndef WIN32
673+
#ifndef WIN32
670674
if (!S_ISREG(buf.st_mode) || (buf.st_mode & 0077) ||
671675
buf.st_uid != geteuid())
672676
{
@@ -675,23 +679,23 @@ client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
675679
fnbuf);
676680
return 0;
677681
}
678-
#endif
682+
#endif
679683
if ((fp = fopen(fnbuf, "r")) == NULL)
680684
{
681685
printfPQExpBuffer(&conn->errorMessage,
682686
libpq_gettext("could not open private key file \"%s\": %s\n"),
683687
fnbuf, pqStrerror(errno, sebuf, sizeof(sebuf)));
684688
return 0;
685689
}
686-
#ifndef WIN32
690+
#ifndef WIN32
687691
if (fstat(fileno(fp), &buf2) == -1 ||
688692
buf.st_dev != buf2.st_dev || buf.st_ino != buf2.st_ino)
689693
{
690694
printfPQExpBuffer(&conn->errorMessage,
691695
libpq_gettext("private key file \"%s\" changed during execution\n"), fnbuf);
692696
return 0;
693697
}
694-
#endif
698+
#endif
695699
if (PEM_read_PrivateKey(fp, pkey, NULL, NULL) == NULL)
696700
{
697701
char *err = SSLerrmessage();
@@ -705,6 +709,7 @@ client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
705709
}
706710
fclose(fp);
707711
}
712+
708713
/* verify that the cert and key go together */
709714
if (!X509_check_private_key(*x509, *pkey))
710715
{
@@ -788,7 +793,7 @@ init_ssl_system(PGconn *conn)
788793
{
789794
if (pq_initssllib)
790795
{
791-
#if (SSLEAY_VERSION_NUMBER >= 0x00907000L)
796+
#if SSLEAY_VERSION_NUMBER >= 0x00907000L
792797
OPENSSL_config(NULL);
793798
#endif
794799
SSL_library_init();

0 commit comments

Comments
 (0)