11/*-------------------------------------------------------------------------
22 *
3- * fe-connect .c
3+ * fe-secure .c
44 * functions related to setting up a secure connection to the backend.
55 * Secure connections are expected to provide confidentiality,
66 * message integrity and endpoint authentication.
1111 *
1212 *
1313 * IDENTIFICATION
14- * $Header: /cvsroot/pgsql/src/interfaces/libpq/fe-secure.c,v 1.4 2002/06/14 04:38:04 momjian Exp $
14+ * $Header: /cvsroot/pgsql/src/interfaces/libpq/fe-secure.c,v 1.5 2002/06/15 22:06:09 tgl Exp $
1515 *
1616 * NOTES
1717 * The client *requires* a valid server certificate. Since
2626 * to sign the server certificate, should be present in the
2727 * "$HOME/.postgresql/root.crt" file. If this file isn't
2828 * readable, or the server certificate can't be validated,
29- *secure_open_client () will return an error code.
29+ *pqsecure_open_client () will return an error code.
3030 *
3131 * Additionally, the server certificate's "common name" must
3232 * resolve to the other end of the socket. This makes it
3838 * Unfortunately neither the current front- or back-end handle
3939 * failure gracefully, resulting in the backend hiccupping.
4040 * This points out problems in each (the frontend shouldn't even
41- * try to do SSL ifsecure_initialize () fails, and the backend
41+ * try to do SSL ifpqsecure_initialize () fails, and the backend
4242 * shouldn't crash/recover if an SSH negotiation fails. The
4343 * backend definitely needs to be fixed, to prevent a "denial
4444 * of service" attack, but I don't know enough about how the
7676 * The code currently assumes a POSIX password entry. How should
7777 * Windows and Mac users be handled?
7878 *
79- * PATCH LEVEL
80- * milestone 1: fix basic coding errors
81- * [*] existing SSL code pulled out of existing files.
82- * [*] SSL_get_error() after SSL_read() and SSL_write(),
83- * SSL_shutdown(), default to TLSv1.
84- *
85- * milestone 2: provide endpoint authentication (server)
86- * [*] client verifies server cert
87- * [*] client verifies server hostname
88- *
89- * milestone 3: improve confidentially, support perfect forward secrecy
90- * [ ] use 'random' file, read from '/dev/urandom?'
91- * [*] emphermal DH keys, default values
92- *
93- * milestone 4: provide endpoint authentication (client)
94- * [*] server verifies client certificates
95- *
96- * milestone 5: provide informational callbacks
97- * [*] provide informational callbacks
98- *
99- * other changes
100- * [ ] tcp-wrappers
101- * [ ] more informative psql
102- *
10379 *-------------------------------------------------------------------------
10480 */
10581
142118#include <openssl/e_os.h>
143119#endif /* USE_SSL */
144120
145- int secure_initialize (PGconn * );
146- void secure_destroy (void );
147- int secure_open_client (PGconn * );
148- void secure_close (PGconn * );
149- ssize_t secure_read (PGconn * ,void * ptr ,size_t len );
150- ssize_t secure_write (PGconn * ,const void * ptr ,size_t len );
151121
152122#ifdef USE_SSL
153123static int verify_cb (int ok ,X509_STORE_CTX * ctx );
@@ -228,7 +198,7 @@ KWbuHn491xNO25CQWMtem80uKw+pTnisBRF/454n1Jnhub144YRBoN8CAQI=\n\
228198 *Initialize global context
229199 */
230200int
231- secure_initialize (PGconn * conn )
201+ pqsecure_initialize (PGconn * conn )
232202{
233203int r = 0 ;
234204
@@ -243,7 +213,7 @@ secure_initialize (PGconn *conn)
243213 *Destroy global context
244214 */
245215void
246- secure_destroy (void )
216+ pqsecure_destroy (void )
247217{
248218#ifdef USE_SSL
249219destroy_SSL ();
@@ -254,7 +224,7 @@ secure_destroy (void)
254224 *Attempt to negotiate secure session.
255225 */
256226int
257- secure_open_client (PGconn * conn )
227+ pqsecure_open_client (PGconn * conn )
258228{
259229int r = 0 ;
260230
@@ -269,7 +239,7 @@ secure_open_client (PGconn *conn)
269239 *Close secure session.
270240 */
271241void
272- secure_close (PGconn * conn )
242+ pqsecure_close (PGconn * conn )
273243{
274244#ifdef USE_SSL
275245if (conn -> ssl )
@@ -281,7 +251,7 @@ secure_close (PGconn *conn)
281251 *Read data from a secure connection.
282252 */
283253ssize_t
284- secure_read (PGconn * conn ,void * ptr ,size_t len )
254+ pqsecure_read (PGconn * conn ,void * ptr ,size_t len )
285255{
286256ssize_t n ;
287257
@@ -306,7 +276,7 @@ secure_read (PGconn *conn, void *ptr, size_t len)
306276libpq_gettext ("SSL error: %s\n" ),SSLerrmessage ());
307277/* fall through */
308278case SSL_ERROR_ZERO_RETURN :
309- secure_close (conn );
279+ pqsecure_close (conn );
310280SOCK_ERRNO = ECONNRESET ;
311281n = -1 ;
312282break ;
@@ -323,7 +293,7 @@ secure_read (PGconn *conn, void *ptr, size_t len)
323293 *Write data to a secure connection.
324294 */
325295ssize_t
326- secure_write (PGconn * conn ,const void * ptr ,size_t len )
296+ pqsecure_write (PGconn * conn ,const void * ptr ,size_t len )
327297{
328298ssize_t n ;
329299
@@ -352,7 +322,7 @@ secure_write (PGconn *conn, const void *ptr, size_t len)
352322libpq_gettext ("SSL error: %s\n" ),SSLerrmessage ());
353323/* fall through */
354324case SSL_ERROR_ZERO_RETURN :
355- secure_close (conn );
325+ pqsecure_close (conn );
356326SOCK_ERRNO = ECONNRESET ;
357327n = -1 ;
358328break ;
@@ -925,4 +895,5 @@ PQgetssl(PGconn *conn)
925895return NULL ;
926896return conn -> ssl ;
927897}
898+
928899#endif /* USE_SSL */