Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit035f99c

Browse files
pgcrypto: Make it possible to disable built-in crypto
When using OpenSSL and/or the underlying operating system in FIPSmode no non-FIPS certified crypto implementations should be used.While that is already possible by just not invoking the built-incrypto in pgcrypto, this adds a GUC which prohibit the code frombeing called. This doesn't change the FIPS status of PostgreSQLbut can make it easier for sites which target FIPS compliance toensure that violations cannot occur.Author: Daniel Gustafsson <daniel@yesql.se>Author: Joe Conway <mail@joeconway.com>Reviewed-by: Joe Conway <mail@joeconway.com>Reviewed-by: Peter Eisentraut <peter@eisentraut.org>Reviewed-by: Hayato Kuroda <kuroda.hayato@fujitsu.com>Discussion:https://postgr.es/m/16b4a157-9ea1-44d0-b7b3-4c85df5de97b@joeconway.com
1 parent924d89a commit035f99c

File tree

7 files changed

+121
-0
lines changed

7 files changed

+121
-0
lines changed

‎contrib/pgcrypto/expected/crypt-des.out‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,4 +28,11 @@ FROM ctest;
2828
t
2929
(1 row)
3030

31+
-- check disabling of built in crypto functions
32+
SET pgcrypto.builtin_crypto_enabled = off;
33+
UPDATE ctest SET salt = gen_salt('des');
34+
ERROR: use of built-in crypto functions is disabled
35+
UPDATE ctest SET res = crypt(data, salt);
36+
ERROR: use of built-in crypto functions is disabled
37+
RESET pgcrypto.builtin_crypto_enabled;
3138
DROP TABLE ctest;

‎contrib/pgcrypto/openssl.c‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131

3232
#include"postgres.h"
3333

34+
#include<openssl/crypto.h>
3435
#include<openssl/evp.h>
3536
#include<openssl/err.h>
3637
#include<openssl/rand.h>
@@ -821,3 +822,28 @@ CheckFIPSMode(void)
821822

822823
return (fips_enabled==1);
823824
}
825+
826+
/*
827+
* CheckBuiltinCryptoMode
828+
*
829+
* Function for erroring out in case built-in crypto is executed when the user
830+
* has disabled it. If builtin_crypto_enabled is set to BC_OFF or BC_FIPS and
831+
* OpenSSL is operating in FIPS mode the function will error out, else the
832+
* query executing built-in crypto can proceed.
833+
*/
834+
void
835+
CheckBuiltinCryptoMode(void)
836+
{
837+
if (builtin_crypto_enabled==BC_ON)
838+
return;
839+
840+
if (builtin_crypto_enabled==BC_OFF)
841+
ereport(ERROR,
842+
errmsg("use of built-in crypto functions is disabled"));
843+
844+
Assert(builtin_crypto_enabled==BC_FIPS);
845+
846+
if (CheckFIPSMode()== true)
847+
ereport(ERROR,
848+
errmsg("use of non-FIPS validated crypto not allowed when OpenSSL is in FIPS mode"));
849+
}

‎contrib/pgcrypto/pgcrypto.c‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,16 +38,47 @@
3838
#include"px-crypt.h"
3939
#include"px.h"
4040
#include"utils/builtins.h"
41+
#include"utils/guc.h"
4142
#include"varatt.h"
4243

4344
PG_MODULE_MAGIC;
4445

4546
/* private stuff */
4647

48+
staticconststructconfig_enum_entrybuiltin_crypto_options[]= {
49+
{"on",BC_ON, false},
50+
{"off",BC_OFF, false},
51+
{"fips",BC_FIPS, false},
52+
{NULL,0, false}
53+
};
54+
4755
typedefint (*PFN) (constchar*name,void**res);
4856
staticvoid*find_provider(text*name,PFNprovider_lookup,constchar*desc,
4957
intsilent);
5058

59+
intbuiltin_crypto_enabled=BC_ON;
60+
61+
/*
62+
* Entrypoint of this module.
63+
*/
64+
void
65+
_PG_init(void)
66+
{
67+
DefineCustomEnumVariable("pgcrypto.builtin_crypto_enabled",
68+
"Sets if builtin crypto functions are enabled.",
69+
"\"on\" enables builtin crypto, \"off\" unconditionally disables and \"fips\" "
70+
"will disable builtin crypto if OpenSSL is in FIPS mode",
71+
&builtin_crypto_enabled,
72+
BC_ON,
73+
builtin_crypto_options,
74+
PGC_SUSET,
75+
0,
76+
NULL,
77+
NULL,
78+
NULL);
79+
MarkGUCPrefixReserved("pgcrypto");
80+
}
81+
5182
/* SQL function: hash(bytea, text) returns bytea */
5283
PG_FUNCTION_INFO_V1(pg_digest);
5384

‎contrib/pgcrypto/px-crypt.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,8 @@ px_crypt(const char *psw, const char *salt, char *buf, unsigned len)
9191
{
9292
conststructpx_crypt_algo*c;
9393

94+
CheckBuiltinCryptoMode();
95+
9496
for (c=px_crypt_list;c->id;c++)
9597
{
9698
if (!c->id_len)
@@ -135,6 +137,8 @@ px_gen_salt(const char *salt_type, char *buf, int rounds)
135137
char*p;
136138
charrbuf[16];
137139

140+
CheckBuiltinCryptoMode();
141+
138142
for (g=gen_list;g->name;g++)
139143
if (pg_strcasecmp(g->name,salt_type)==0)
140144
break;

‎contrib/pgcrypto/px.h‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,13 +89,21 @@
8989
#definePXE_PGP_UNSUPPORTED_PUBALGO -122
9090
#definePXE_PGP_MULTIPLE_SUBKEYS-123
9191

92+
typedefenumBuiltinCryptoOptions
93+
{
94+
BC_ON,
95+
BC_OFF,
96+
BC_FIPS,
97+
}BuiltinCryptoOptions;
9298

9399
typedefstructpx_digestPX_MD;
94100
typedefstructpx_aliasPX_Alias;
95101
typedefstructpx_hmacPX_HMAC;
96102
typedefstructpx_cipherPX_Cipher;
97103
typedefstructpx_comboPX_Combo;
98104

105+
externintbuiltin_crypto_enabled;
106+
99107
structpx_digest
100108
{
101109
unsigned(*result_size) (PX_MD*h);
@@ -183,6 +191,7 @@ voidpx_set_debug_handler(void (*handler) (const char *));
183191
voidpx_memset(void*ptr,intc,size_tlen);
184192

185193
boolCheckFIPSMode(void);
194+
voidCheckBuiltinCryptoMode(void);
186195

187196
#ifdefPX_DEBUG
188197
voidpx_debug(constchar*fmt,...)pg_attribute_printf(1,2);

‎contrib/pgcrypto/sql/crypt-des.sql‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,4 +18,10 @@ UPDATE ctest SET res = crypt(data, salt);
1818
SELECT res= crypt(data, res)AS"worked"
1919
FROM ctest;
2020

21+
-- check disabling of built in crypto functions
22+
SETpgcrypto.builtin_crypto_enabled= off;
23+
UPDATE ctestSET salt= gen_salt('des');
24+
UPDATE ctestSET res= crypt(data, salt);
25+
RESETpgcrypto.builtin_crypto_enabled;
26+
2127
DROPTABLE ctest;

‎doc/src/sgml/pgcrypto.sgml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1165,6 +1165,44 @@ fips_mode() returns boolean
11651165
</para>
11661166
</sect2>
11671167

1168+
<sect2 id="pgcrypto-configuration-parameters">
1169+
<title>Configuration Parameters</title>
1170+
1171+
<para>
1172+
There is one configuration parameter that controls the behavior of
1173+
<filename>pgcrypto</filename>.
1174+
</para>
1175+
1176+
<variablelist>
1177+
<varlistentry id="pgcrypto-configuration-parameters-builtin_crypto_enabled">
1178+
<term>
1179+
<varname>pgcrypto.builtin_crypto_enabled</varname> (<type>enum</type>)
1180+
<indexterm>
1181+
<primary><varname>pgcrypto.builtin_crypto_enabled</varname> configuration
1182+
parameter</primary>
1183+
</indexterm>
1184+
</term>
1185+
<listitem>
1186+
<para>
1187+
<varname>pgcrypto.builtin_crypto_enabled</varname> determines if the
1188+
built in crypto functions <function>gen_salt()</function>, and
1189+
<function>crypt()</function> are available for use. Setting this to
1190+
<literal>off</literal> disables these functions. <literal>on</literal>
1191+
(the default) enables these functions to work normally.
1192+
<literal>fips</literal> disables these functions if
1193+
<productname>OpenSSL</productname> is detected to operate in FIPS mode.
1194+
</para>
1195+
</listitem>
1196+
</varlistentry>
1197+
</variablelist>
1198+
1199+
<para>
1200+
In ordinary usage, this parameter is set
1201+
in <filename>postgresql.conf</filename>, although superusers can alter it
1202+
on-the-fly within their own sessions.
1203+
</para>
1204+
</sect2>
1205+
11681206
<sect2 id="pgcrypto-notes">
11691207
<title>Notes</title>
11701208

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp