Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitc82207a

Browse files
committed
Use BIO_{get,set}_app_data instead of BIO_{get,set}_data.
We should have done it this way all along, but we accidentally gotaway with using the wrong BIO field up until OpenSSL 3.2. There,the library's BIO routines that we rely on use the "data" fieldfor their own purposes, and our conflicting use causes assortedweird behaviors up to and including core dumps when SSL connectionsare attempted. Switch to using the approved field for the purpose,i.e. app_data.While at it, remove our configure probes for BIO_get_data as wellas the fallback implementation. BIO_{get,set}_app_data have beenthere since long before any OpenSSL version that we still support,even in the back branches.Also, update src/test/ssl/t/001_ssltests.pl to allow for a minorchange in an error message spelling that evidently came in with 3.2.Tristan Partin and Bo Andreson. Back-patch to all supported branches.Discussion:https://postgr.es/m/CAN55FZ1eDDYsYaL7mv+oSLUij2h_u6hvD4Qmv-7PK7jkji0uyQ@mail.gmail.com
1 parent10a5992 commitc82207a

File tree

8 files changed

+11
-27
lines changed

8 files changed

+11
-27
lines changed

‎configure

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12836,7 +12836,7 @@ done
1283612836
# defines OPENSSL_VERSION_NUMBER to claim version 2.0.0, even though it
1283712837
# doesn't have these OpenSSL 1.1.0 functions. So check for individual
1283812838
# functions.
12839-
for ac_func in OPENSSL_init_sslBIO_get_dataBIO_meth_new ASN1_STRING_get0_data HMAC_CTX_new HMAC_CTX_free
12839+
for ac_func in OPENSSL_init_ssl BIO_meth_new ASN1_STRING_get0_data HMAC_CTX_new HMAC_CTX_free
1284012840
do :
1284112841
as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
1284212842
ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"

‎configure.ac

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1367,7 +1367,7 @@ if test "$with_ssl" = openssl ; then
13671367
# defines OPENSSL_VERSION_NUMBER to claim version 2.0.0, even though it
13681368
# doesn't have these OpenSSL 1.1.0 functions. So check for individual
13691369
# functions.
1370-
AC_CHECK_FUNCS([OPENSSL_init_sslBIO_get_dataBIO_meth_new ASN1_STRING_get0_data HMAC_CTX_new HMAC_CTX_free])
1370+
AC_CHECK_FUNCS([OPENSSL_init_ssl BIO_meth_new ASN1_STRING_get0_data HMAC_CTX_new HMAC_CTX_free])
13711371
# OpenSSL versions before 1.1.0 required setting callback functions, for
13721372
# thread-safety. In 1.1.0, it's no longer required, and CRYPTO_lock()
13731373
# function was removed.

‎meson.build

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1285,7 +1285,6 @@ if sslopt in ['auto', 'openssl']
12851285
# doesn't have these OpenSSL 1.1.0 functions. So check for individual
12861286
# functions.
12871287
['OPENSSL_init_ssl'],
1288-
['BIO_get_data'],
12891288
['BIO_meth_new'],
12901289
['ASN1_STRING_get0_data'],
12911290
['HMAC_CTX_new'],

‎src/backend/libpq/be-secure-openssl.c

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -842,11 +842,6 @@ be_tls_write(Port *port, void *ptr, size_t len, int *waitfor)
842842
* see sock_read() and sock_write() in OpenSSL's crypto/bio/bss_sock.c.
843843
*/
844844

845-
#ifndefHAVE_BIO_GET_DATA
846-
#defineBIO_get_data(bio) (bio->ptr)
847-
#defineBIO_set_data(bio,data) (bio->ptr = data)
848-
#endif
849-
850845
staticBIO_METHOD*my_bio_methods=NULL;
851846

852847
staticint
@@ -856,7 +851,7 @@ my_sock_read(BIO *h, char *buf, int size)
856851

857852
if (buf!=NULL)
858853
{
859-
res=secure_raw_read(((Port*)BIO_get_data(h)),buf,size);
854+
res=secure_raw_read(((Port*)BIO_get_app_data(h)),buf,size);
860855
BIO_clear_retry_flags(h);
861856
if (res <=0)
862857
{
@@ -876,7 +871,7 @@ my_sock_write(BIO *h, const char *buf, int size)
876871
{
877872
intres=0;
878873

879-
res=secure_raw_write(((Port*)BIO_get_data(h)),buf,size);
874+
res=secure_raw_write(((Port*)BIO_get_app_data(h)),buf,size);
880875
BIO_clear_retry_flags(h);
881876
if (res <=0)
882877
{
@@ -952,7 +947,7 @@ my_SSL_set_fd(Port *port, int fd)
952947
SSLerr(SSL_F_SSL_SET_FD,ERR_R_BUF_LIB);
953948
gotoerr;
954949
}
955-
BIO_set_data(bio,port);
950+
BIO_set_app_data(bio,port);
956951

957952
BIO_set_fd(bio,fd,BIO_NOCLOSE);
958953
SSL_set_bio(port->ssl,bio,bio);

‎src/include/pg_config.h.in

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -66,9 +66,6 @@
6666
/* Define to 1 if you have the `backtrace_symbols' function. */
6767
#undef HAVE_BACKTRACE_SYMBOLS
6868

69-
/* Define to 1 if you have the `BIO_get_data' function. */
70-
#undef HAVE_BIO_GET_DATA
71-
7269
/* Define to 1 if you have the `BIO_meth_new' function. */
7370
#undef HAVE_BIO_METH_NEW
7471

‎src/interfaces/libpq/fe-secure-openssl.c

Lines changed: 3 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1815,11 +1815,6 @@ PQsslAttribute(PGconn *conn, const char *attribute_name)
18151815
* see sock_read() and sock_write() in OpenSSL's crypto/bio/bss_sock.c.
18161816
*/
18171817

1818-
#ifndefHAVE_BIO_GET_DATA
1819-
#defineBIO_get_data(bio) (bio->ptr)
1820-
#defineBIO_set_data(bio,data) (bio->ptr = data)
1821-
#endif
1822-
18231818
/* protected by ssl_config_mutex */
18241819
staticBIO_METHOD*my_bio_methods;
18251820

@@ -1828,7 +1823,7 @@ my_sock_read(BIO *h, char *buf, int size)
18281823
{
18291824
intres;
18301825

1831-
res=pqsecure_raw_read((PGconn*)BIO_get_data(h),buf,size);
1826+
res=pqsecure_raw_read((PGconn*)BIO_get_app_data(h),buf,size);
18321827
BIO_clear_retry_flags(h);
18331828
if (res<0)
18341829
{
@@ -1858,7 +1853,7 @@ my_sock_write(BIO *h, const char *buf, int size)
18581853
{
18591854
intres;
18601855

1861-
res=pqsecure_raw_write((PGconn*)BIO_get_data(h),buf,size);
1856+
res=pqsecure_raw_write((PGconn*)BIO_get_app_data(h),buf,size);
18621857
BIO_clear_retry_flags(h);
18631858
if (res<0)
18641859
{
@@ -1968,7 +1963,7 @@ my_SSL_set_fd(PGconn *conn, int fd)
19681963
SSLerr(SSL_F_SSL_SET_FD,ERR_R_BUF_LIB);
19691964
gotoerr;
19701965
}
1971-
BIO_set_data(bio,conn);
1966+
BIO_set_app_data(bio,conn);
19721967

19731968
SSL_set_bio(conn->ssl,bio,bio);
19741969
BIO_set_fd(bio,fd,BIO_NOCLOSE);

‎src/test/ssl/t/001_ssltests.pl

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -776,7 +776,7 @@ sub switch_server_cert
776776
"$common_connstr user=ssltestuser sslcert=ssl/client-revoked.crt"
777777
. sslkey('client-revoked.key'),
778778
"certificate authorization fails with revoked client cert",
779-
expected_stderr=>qr/SSL error:sslv3 alert certificate revoked/,
779+
expected_stderr=>qr|SSL error:ssl[a-z0-9/]* alert certificate revoked|,
780780
# temporarily(?) skip this check due to timing issue
781781
#log_like => [
782782
#qr{Client certificate verification failed at depth 0: certificate revoked},
@@ -881,7 +881,7 @@ sub switch_server_cert
881881
"$common_connstr user=ssltestuser sslcert=ssl/client-revoked.crt"
882882
. sslkey('client-revoked.key'),
883883
"certificate authorization fails with revoked client cert with server-side CRL directory",
884-
expected_stderr=>qr/SSL error:sslv3 alert certificate revoked/,
884+
expected_stderr=>qr|SSL error:ssl[a-z0-9/]* alert certificate revoked|,
885885
# temporarily(?) skip this check due to timing issue
886886
#log_like => [
887887
#qr{Client certificate verification failed at depth 0: certificate revoked},
@@ -894,7 +894,7 @@ sub switch_server_cert
894894
"$common_connstr user=ssltestuser sslcert=ssl/client-revoked-utf8.crt"
895895
. sslkey('client-revoked-utf8.key'),
896896
"certificate authorization fails with revoked UTF-8 client cert with server-side CRL directory",
897-
expected_stderr=>qr/SSL error:sslv3 alert certificate revoked/,
897+
expected_stderr=>qr|SSL error:ssl[a-z0-9/]* alert certificate revoked|,
898898
# temporarily(?) skip this check due to timing issue
899899
#log_like => [
900900
#qr{Client certificate verification failed at depth 0: certificate revoked},

‎src/tools/msvc/Solution.pm

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -224,7 +224,6 @@ sub GenerateFiles
224224
HAVE_ATOMICS=> 1,
225225
HAVE_ATOMIC_H=>undef,
226226
HAVE_BACKTRACE_SYMBOLS=>undef,
227-
HAVE_BIO_GET_DATA=>undef,
228227
HAVE_BIO_METH_NEW=>undef,
229228
HAVE_COMPUTED_GOTO=>undef,
230229
HAVE_COPYFILE=>undef,
@@ -502,7 +501,6 @@ sub GenerateFiles
502501
|| ($digit1 >='1' &&$digit2 >='1' &&$digit3 >='0'))
503502
{
504503
$define{HAVE_ASN1_STRING_GET0_DATA} = 1;
505-
$define{HAVE_BIO_GET_DATA} = 1;
506504
$define{HAVE_BIO_METH_NEW} = 1;
507505
$define{HAVE_HMAC_CTX_FREE} = 1;
508506
$define{HAVE_HMAC_CTX_NEW} = 1;

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp