Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit896fcdb

Browse files
committed
Provide a TLS init hook
The default hook function sets the default password callback function.In order to allow preloaded libraries to have an opportunity to overridethe default, TLS initialization if now delayed slightly until aftershared preloaded libraries have been loaded.A test module is provided which contains a trivial example that decodesan obfuscated password for an SSL certificate.Author: Andrew DunstanReviewed By: Andreas Karlsson, Asaba TakanoriDiscussion:https://postgr.es/m/04116472-818b-5859-1d74-3d995aab2252@2ndQuadrant.com
1 parentffd3980 commit896fcdb

File tree

11 files changed

+292
-31
lines changed

11 files changed

+292
-31
lines changed

‎src/backend/libpq/be-secure-openssl.c

Lines changed: 29 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,9 @@
4545
#include"tcop/tcopprot.h"
4646
#include"utils/memutils.h"
4747

48+
/* default init hook can be overridden by a shared library */
49+
staticvoiddefault_openssl_tls_init(SSL_CTX*context,boolisServerStart);
50+
openssl_tls_init_hook_typopenssl_tls_init_hook=default_openssl_tls_init;
4851

4952
staticintmy_sock_read(BIO*h,char*buf,intsize);
5053
staticintmy_sock_write(BIO*h,constchar*buf,intsize);
@@ -117,27 +120,10 @@ be_tls_init(bool isServerStart)
117120
SSL_CTX_set_mode(context,SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
118121

119122
/*
120-
*Setpassword callback
123+
*Call init hook (usually to setpassword callback)
121124
*/
122-
if (isServerStart)
123-
{
124-
if (ssl_passphrase_command[0])
125-
SSL_CTX_set_default_passwd_cb(context,ssl_external_passwd_cb);
126-
}
127-
else
128-
{
129-
if (ssl_passphrase_command[0]&&ssl_passphrase_command_supports_reload)
130-
SSL_CTX_set_default_passwd_cb(context,ssl_external_passwd_cb);
131-
else
125+
(*openssl_tls_init_hook)(context,isServerStart);
132126

133-
/*
134-
* If reloading and no external command is configured, override
135-
* OpenSSL's default handling of passphrase-protected files,
136-
* because we don't want to prompt for a passphrase in an
137-
* already-running server.
138-
*/
139-
SSL_CTX_set_default_passwd_cb(context,dummy_ssl_passwd_cb);
140-
}
141127
/* used by the callback */
142128
ssl_is_server_start=isServerStart;
143129

@@ -1338,3 +1324,27 @@ ssl_protocol_version_to_openssl(int v)
13381324

13391325
return-1;
13401326
}
1327+
1328+
1329+
staticvoid
1330+
default_openssl_tls_init(SSL_CTX*context,boolisServerStart)
1331+
{
1332+
if (isServerStart)
1333+
{
1334+
if (ssl_passphrase_command[0])
1335+
SSL_CTX_set_default_passwd_cb(context,ssl_external_passwd_cb);
1336+
}
1337+
else
1338+
{
1339+
if (ssl_passphrase_command[0]&&ssl_passphrase_command_supports_reload)
1340+
SSL_CTX_set_default_passwd_cb(context,ssl_external_passwd_cb);
1341+
else
1342+
/*
1343+
* If reloading and no external command is configured, override
1344+
* OpenSSL's default handling of passphrase-protected files,
1345+
* because we don't want to prompt for a passphrase in an
1346+
* already-running server.
1347+
*/
1348+
SSL_CTX_set_default_passwd_cb(context,dummy_ssl_passwd_cb);
1349+
}
1350+
}

‎src/backend/postmaster/postmaster.c

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -972,17 +972,6 @@ PostmasterMain(int argc, char *argv[])
972972
*/
973973
LocalProcessControlFile(false);
974974

975-
/*
976-
* Initialize SSL library, if specified.
977-
*/
978-
#ifdefUSE_SSL
979-
if (EnableSSL)
980-
{
981-
(void)secure_initialize(true);
982-
LoadedSSL= true;
983-
}
984-
#endif
985-
986975
/*
987976
* Register the apply launcher. Since it registers a background worker,
988977
* it needs to be called before InitializeMaxBackends(), and it's probably
@@ -996,6 +985,17 @@ PostmasterMain(int argc, char *argv[])
996985
*/
997986
process_shared_preload_libraries();
998987

988+
/*
989+
* Initialize SSL library, if specified.
990+
*/
991+
#ifdefUSE_SSL
992+
if (EnableSSL)
993+
{
994+
(void)secure_initialize(true);
995+
LoadedSSL= true;
996+
}
997+
#endif
998+
999999
/*
10001000
* Now that loadable modules have had their chance to register background
10011001
* workers, calculate MaxBackends.

‎src/include/libpq/libpq-be.h

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -287,6 +287,10 @@ extern void be_tls_get_peer_serial(Port *port, char *ptr, size_t len);
287287
externchar*be_tls_get_certificate_hash(Port*port,size_t*len);
288288
#endif
289289

290+
/* init hook for SSL, the default sets the password callback if appropriate */
291+
typedefvoid(*openssl_tls_init_hook_typ)(SSL_CTX*context,boolisServerStart);
292+
externopenssl_tls_init_hook_typopenssl_tls_init_hook;
293+
290294
#endif/* USE_SSL */
291295

292296
#ifdefENABLE_GSS

‎src/test/modules/Makefile

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,4 +25,9 @@ SUBDIRS = \
2525
unsafe_tests\
2626
worker_spi
2727

28+
ifeq ($(with_openssl),yes)
29+
SUBDIRS += ssl_passphrase_callback
30+
endif
31+
32+
2833
$(recurse)
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
tmp_check
Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# ssl_passphrase Makefile
2+
3+
exportwith_openssl
4+
5+
MODULE_big = ssl_passphrase_func
6+
OBJS = ssl_passphrase_func.o$(WIN32RES)
7+
PGFILEDESC = "callback function to provide a passphrase"
8+
9+
ifdefUSE_PGXS
10+
PG_CONFIG = pg_config
11+
PGXS :=$(shell$(PG_CONFIG) --pgxs)
12+
include$(PGXS)
13+
else
14+
subdir = src/test/modules/ssl_passphrase_callback
15+
top_builddir = ../../../..
16+
include$(top_builddir)/src/Makefile.global
17+
include$(top_srcdir)/contrib/contrib-global.mk
18+
endif
19+
20+
check: prove-check
21+
22+
prove-check: ssl_passphrase_func$(DLSUFFIX) | temp-install
23+
@echo running prove ...
24+
$(prove_check)
Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDCTCCAfGgAwIBAgIUfHgPLNys4V0d0cWrzRHqfs91LFMwDQYJKoZIhvcNAQEL
3+
BQAwFDESMBAGA1UEAwwJbG9jYWxob3N0MB4XDTIwMDMyMTE0MDM1OVoXDTQ3MDgw
4+
NzE0MDM1OVowFDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEF
5+
AAOCAQ8AMIIBCgKCAQEA2j0PZwmeahBC7QpG7i9/VUVJrLzy+b8oVaqZUO6nlPbY
6+
wuPISYTO/jqc0XDfs/Gb0kccDJ6bPfNfvSnRTG1omE6OO9YjR0u3296l4bWAmYVq
7+
q4SesgQmm1Wy8ODNpeGaoBUwR51OB/gFHFjUlqAjRwOmrTCbDiAsLt7e+cx+W26r
8+
2SrJIweiSJsqaQsMMaqlY2qpHnYgWfqRUTqwXqlno0dXuqBt+KKgqeHMY3w3XS51
9+
8roOI0+Q9KWsexL/aYnLwMRsHRMZcthhzTK6HD/OrLh9CxURImr4ed9TtsNiZltA
10+
KqLTeGbtS1D2AvFqJU8n5DvtU+26wDrHu6pEM3kSJQIDAQABo1MwUTAdBgNVHQ4E
11+
FgQUkkfa08hDnxYs1UjG2ydCBJs1b2AwHwYDVR0jBBgwFoAUkkfa08hDnxYs1UjG
12+
2ydCBJs1b2AwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAjsJh
13+
p4tCopCA/Pvxupv3VEwGJ+nbH7Zg/hp+o2IWuHBOK1qrkyXBv34h/69bRnWZ5UFV
14+
HxQwL7CjNtjZu9SbpKkaHbZXPWANC9fbPKdBz9fAEwunf33KbZe3dPv/7xbJirMz
15+
e+j5V0LE0Spkr/p89LipXfjGw0jLC8VRTx/vKPnmbiBsCKw5SQKh3w7CcBx84Y6q
16+
Nc27WQ8ReR4W4X1zHGN6kEV4H+yPN2Z9OlSixTiSNvr2mtJQsZa7gK7Wwfm79RN7
17+
5Kf3l8b6e2BToJwLorpK9mvu41NtwRzl4UoJ1BFJDyhMplFMd8RcwTW6yT2biOFC
18+
lYCajcBoms3IiyqBog==
19+
-----END CERTIFICATE-----
Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
-----BEGIN RSA PRIVATE KEY-----
2+
Proc-Type: 4,ENCRYPTED
3+
DEK-Info: AES-256-CBC,DB0E7068D4DCE79FFE63C95B8D8F7CEA
4+
5+
Y4uvnlWX/kyulqsmt8aWI55vKFdfJL4wEZItL8ZKlQFuZuxC9w0OworyjTdqO38R
6+
v9hwnetZBDgK8kEv6U7wR58mTfwHHCGuxYgSiPZtiW7btS4zu16ePdh8oBEzCxjW
7+
ALrCFt7uvRu5h2AWy/4BgV4gLNVPNB+lJFABtUoiSnUDr7+bcx7UjZ4An6HriGxC
8+
Kg/N1pKjT/xiKOy+yHtrp1Jih5HYDE4i99jPtMuTROf8Uyz7ibyrdd/E7QNvANQN
9+
Cmw4I4Xk4hZ68F0iGU0C0wLND3pWbeYPKorpo3PkI4Du+Aqlg15ae5u8CtU3fXGJ
10+
mq4/qLGAi1sr/45f5P5a3Q8BQpKkCmGopXMaFYOOiaf3YYgD1eVOxLhsCWqUB+O8
11+
ygcTNRCoKhzY+ULComXp880J3fFk5b92g4Hm1PAO42uDKzhWSnrmCBJ7ynXvnEc+
12+
JqhiE8Obrp6FBIHvfN26JtHcXTd/bgUMXSh7AXjsotfvPPV0URve9JJG+RnwckeT
13+
K3AYDOQK/lbqDGliNqHg1WiMSA2oHSqDhUMB0Sm0jh6+jxCQlsmSDvPvJfWRo5wY
14+
zbZZZARQnFUaHa9CZVdFxbaPGhYU6vAwxDqi42osSJEdf68Gy2KVXcelqpU/2dKk
15+
aHfTgAWOsajbgt9p+0369TeZb39+zLODdDJnvZYiu1pTASHP5VrJ2xHhu5zOdjXm
16+
GafYiPwYBM280wkIVQ0HsTX7BViU2R/7W3FqflXgQvBiraVQVwHyaX4bOU1a3rzg
17+
emHNLTCpRamT0i/D0tkEPgS42bWSVi9ko5Mn9yb+qToBjAOLVUOAOs9Bv3qxawhI
18+
XFbBDZ7DS59l2yV6eQkrG7DUCLDf4dv4WZeBnhrPe/Jg8HKcsKcJYV3cejZh8sgu
19+
XHeCU50+jpJDfTZVPW3TjZWmrTqStGwF1UFpj+tTsTcX+OHAY/shFs3bBZulAsMy
20+
5UWZWzyWHMWr/wbxW7dbhTb1gNmOgpQQz9dunSgcZ8umzSGLa0ZGmnQj9P/kZkQA
21+
RenuswH5O7CK/MDmf3J6svwyLt/jULmH26MZTcNu7igT6dj3VMSwkoQQaaQdtmzb
22+
glzN3uqf8qM+CEjV8dxlt8fv6KJV7gvoYfPAz+1pp5DVJBmRo/+b4e/d4QTV9iWS
23+
ScBYdonc9WXcrjmExX9+Wf/K/IKfLnKLIi2MZ3pwr1n7yY+dMeF6iREYSjFVIpZd
24+
MH3G9/SxTrqR7X/eHjwdv1UupYYyaDag8wpVn1RMCb0xYqh2/QP1k0pQycckL0WQ
25+
lieXibEuQhV/heXcqt83G6pGqLImc6YPYU46jdGpPIMyOK+ZSqJTHUWHfRMQTIMz
26+
varR2M3uhHvwUFzmvjLh/o6I3r0a0Rl1MztpYfjBV6MS4BKYfraWZ0kxCyV+e6tz
27+
O7vD0P5W2qm6b89Md3nqjUcbOM8AojcfBl3xpQrpSdgJ25YJBoJ9L2I2pIMNCK/x
28+
yDNEJl7yP87fdHfXZm2VoUXclDUYHyNys9Rtv9NSr+VNkIMcqrCHEgpAxwQQ5NsO
29+
/vOZe3wjhXXLyRO7Nh5W8jojw3xcb9c9avFUWUvM2BaS4vEYcItUoF4QuHohrCwk
30+
-----END RSA PRIVATE KEY-----
Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
/*-------------------------------------------------------------------------
2+
*
3+
* ssl_passphrase_func.c
4+
*
5+
* Loadable PostgreSQL module fetch an ssl passphrase for the server cert.
6+
* instead of calling an external program. This implementation just hands
7+
* back the configured password rot13'd.
8+
*
9+
*-------------------------------------------------------------------------
10+
*/
11+
12+
#include"postgres.h"
13+
14+
#include<float.h>
15+
#include<stdio.h>
16+
17+
#include"libpq/libpq.h"
18+
#include"libpq/libpq-be.h"
19+
#include"utils/guc.h"
20+
21+
PG_MODULE_MAGIC;
22+
23+
void_PG_init(void);
24+
void_PG_fini(void);
25+
26+
staticchar*ssl_passphrase=NULL;
27+
28+
/* callback function */
29+
staticintrot13_passphrase(char*buf,intsize,intrwflag,void*userdata);
30+
/* hook function to set the callback */
31+
staticvoidset_rot13(SSL_CTX*context,boolisServerStart);
32+
/*
33+
* Module load callback
34+
*/
35+
void
36+
_PG_init(void)
37+
{
38+
/* Define custom GUC variable. */
39+
DefineCustomStringVariable("ssl_passphrase.passphrase",
40+
"passphrase before transformation",
41+
NULL,
42+
&ssl_passphrase,
43+
NULL,
44+
PGC_SIGHUP,
45+
0,/* no flags required */
46+
NULL,
47+
NULL,
48+
NULL);
49+
if (ssl_passphrase)
50+
openssl_tls_init_hook=set_rot13;
51+
}
52+
53+
void
54+
_PG_fini(void)
55+
{
56+
/* do nothing yet */
57+
}
58+
59+
staticvoid
60+
set_rot13(SSL_CTX*context,boolisServerStart)
61+
{
62+
/* warn if the user has set ssl_passphrase_command */
63+
if(ssl_passphrase_command[0])
64+
ereport(WARNING,
65+
(errmsg("ssl_passphrase_command setting ignored by ssl_passphrase_func module")));
66+
67+
SSL_CTX_set_default_passwd_cb(context,rot13_passphrase);
68+
}
69+
70+
staticint
71+
rot13_passphrase(char*buf,intsize,intrwflag,void*userdata)
72+
{
73+
74+
Assert(ssl_passphrase!=NULL);
75+
StrNCpy(buf,ssl_passphrase,size);
76+
for (char*p=buf;*p;p++)
77+
{
78+
charc=*p;
79+
80+
if ((c >='a'&&c <='m')|| (c >='A'&&c <='M'))
81+
*p=c+13;
82+
elseif ((c >='n'&&c <='z')|| (c >='N'&&c <='Z'))
83+
*p=c-13;
84+
}
85+
86+
returnstrlen(buf);
87+
88+
}
Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
use strict;
2+
use warnings;
3+
4+
use File::Copy;
5+
6+
use TestLib;
7+
use Test::More;
8+
use PostgresNode;
9+
10+
unless (($ENV{with_openssl} ||'no')eq'yes')
11+
{
12+
planskip_all=>'SSL not supported by this build';
13+
}
14+
15+
my$clearpass ="FooBaR1";
16+
my$rot13pass ="SbbOnE1";
17+
18+
# self-signed cert was generated like this:
19+
# system('openssl req -new -x509 -days 10000 -nodes -out server.crt -keyout server.ckey -subj "/CN=localhost"');
20+
# add the cleartext passphrase to the key, remove the unprotected key
21+
# system("openssl rsa -aes256 -in server.ckey -out server.key -passout pass:$clearpass");
22+
# unlink "server.ckey";
23+
24+
25+
my$node = get_new_node('main');
26+
$node->init;
27+
$node->append_conf('postgresql.conf',
28+
"ssl_passphrase.passphrase = '$rot13pass'");
29+
$node->append_conf('postgresql.conf',
30+
"shared_preload_libraries = 'ssl_passphrase_func'");
31+
$node->append_conf('postgresql.conf',"listen_addresses = 'localhost'");
32+
$node->append_conf('postgresql.conf',"ssl = 'on'");
33+
34+
my$ddir =$node->data_dir;
35+
36+
# install certificate and protected key
37+
copy("server.crt",$ddir);
38+
copy("server.key",$ddir);
39+
chmod 0600,"$ddir/server.key";
40+
41+
$node->start;
42+
43+
# if the server is running we must have successfully transformed the passphrase
44+
ok(-e"$ddir/postmaster.pid","postgres started");
45+
46+
$node->stop('fast');
47+
48+
# should get a warning if ssl_passphrase_command is set
49+
my$log =$node->rotate_logfile();
50+
51+
$node->append_conf('postgresql.conf',
52+
"ssl_passphrase_command = 'echo spl0tz'");
53+
54+
$node->start;
55+
56+
$node->stop('fast');
57+
58+
my$log_contents = slurp_file($log);
59+
60+
like(
61+
$log_contents,
62+
qr/WARNING.*ssl_passphrase_command setting ignored by ssl_passphrase_func module/,
63+
"ssl_passphrase_command set warning");
64+
65+
# set the wrong passphrase
66+
$node->append_conf('postgresql.conf',"ssl_passphrase.passphrase = 'blurfl'");
67+
68+
# try to start the server again
69+
my$ret = TestLib::system_log('pg_ctl','-D',$node->data_dir,'-l',
70+
$node->logfile,'start');
71+
72+
73+
# with a bad passphrase the server should not start
74+
ok($ret,"pg_ctl fails with bad passphrase");
75+
ok(!-e"$ddir/postmaster.pid","postgres not started with bad passphrase");
76+
77+
# just in case
78+
$node->stop('fast');
79+
80+
done_testing();

‎src/tools/msvc/Mkvcbuild.pm

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -430,7 +430,7 @@ sub mkvcbuild
430430

431431
if (!$solution->{options}->{openssl})
432432
{
433-
push@contrib_excludes,'sslinfo';
433+
push@contrib_excludes,'sslinfo','ssl_passphrase_callback';
434434
}
435435

436436
if (!$solution->{options}->{uuid})

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp