Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit7ac258c

Browse files
committed
Fix multiple breakages in our support for SSL certificates.
1 parent9236c79 commit7ac258c

File tree

4 files changed

+112
-85
lines changed

4 files changed

+112
-85
lines changed

‎doc/src/sgml/libpq.sgml‎

Lines changed: 37 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<!--
2-
$PostgreSQL: pgsql/doc/src/sgml/libpq.sgml,v 1.163 2004/09/23 13:31:09 momjian Exp $
2+
$PostgreSQL: pgsql/doc/src/sgml/libpq.sgml,v 1.164 2004/09/26 22:51:49 tgl Exp $
33
-->
44

55
<chapter id="libpq">
@@ -233,22 +233,13 @@ PGconn *PQconnectdb(const char *conninfo);
233233

234234
<para>
235235
If <productname>PostgreSQL</> is compiled without SSL support,
236-
using option <literal>require</> will cause an error,and
236+
using option <literal>require</> will cause an error,while
237237
options <literal>allow</> and <literal>prefer</> will be
238238
tolerated but <application>libpq</> will be unable to negotiate
239239
an <acronym>SSL</>
240240
connection.<indexterm><primary>SSL</><secondary
241241
sortas="libpq">with libpq</></indexterm>
242242
</para>
243-
244-
<para>
245-
Please note that <acronym>SSL</> support in libpq covers
246-
encryption only. It will not verify the validity of the
247-
certificate presented by the server that you are connecting to,
248-
nor verify that the hostname matches that of the server's
249-
certificate. Additionally, there is no support for client
250-
certificates.
251-
</para>
252243
</listitem>
253244
</varlistentry>
254245

@@ -3688,6 +3679,41 @@ If the permissions are less strict than this, the file will be ignored.
36883679
</para>
36893680
</sect1>
36903681

3682+
3683+
<sect1 id="libpq-ssl">
3684+
<title>SSL Support</title>
3685+
3686+
<indexterm zone="libpq-ssl">
3687+
<primary>SSL</primary>
3688+
</indexterm>
3689+
3690+
<para>
3691+
<productname>PostgreSQL</> has native support for using
3692+
<acronym>SSL</> connections to encrypt client/server communications
3693+
for increased security. See <xref linkend="ssl-tcp"> for details
3694+
about the server-side <acronym>SSL</> functionality.
3695+
</para>
3696+
3697+
<para>
3698+
If the server demands a client certificate,
3699+
<application>libpq</application>
3700+
will send the certificate stored in file
3701+
<filename>.postgresql/postgresql.crt</> within the user's home directory.
3702+
A matching private key file <filename>.postgresql/postgresql.key</>
3703+
must also be present, and must not be world-readable.
3704+
</para>
3705+
3706+
<para>
3707+
If the file <filename>.postgresql/root.crt</> is present in the user's
3708+
home directory,
3709+
<application>libpq</application> will use the certificate list stored
3710+
therein to verify the server's certificate. The SSL connection will
3711+
fail if the server does not present a certificate; therefore, to
3712+
use this feature the server must also have a <filename>root.crt</> file.
3713+
</para>
3714+
</sect1>
3715+
3716+
36913717
<sect1 id="libpq-threading">
36923718
<title>Behavior in Threaded Programs</title>
36933719

‎doc/src/sgml/runtime.sgml‎

Lines changed: 17 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
<!--
2-
$PostgreSQL: pgsql/doc/src/sgml/runtime.sgml,v 1.283 2004/09/23 13:15:57 momjian Exp $
2+
$PostgreSQL: pgsql/doc/src/sgml/runtime.sgml,v 1.284 2004/09/26 22:51:49 tgl Exp $
33
-->
44

55
<Chapter Id="runtime">
@@ -804,7 +804,7 @@ SET ENABLE_SEQSCAN TO OFF;
804804
<para>
805805
Enables <acronym>SSL</> connections. Please read
806806
<xref linkend="ssl-tcp"> before using this. The default
807-
is off.
807+
is off. This parameter can only be set at server start.
808808
</para>
809809
</listitem>
810810
</varlistentry>
@@ -4324,8 +4324,8 @@ $ <userinput>kill -INT `head -1 /usr/local/pgsql/data/postmaster.pid`</userinput
43244324
The server will listen for both standard and <acronym>SSL</>
43254325
connections on the same TCP port, and will negotiate with any
43264326
connecting client on whether to use <acronym>SSL</>. See <xref
4327-
linkend="auth-pg-hba-conf"> about how toforce the server to
4328-
require use of <acronym>SSL</> forcertain connections.
4327+
linkend="auth-pg-hba-conf"> about how toset up the server to
4328+
require use of <acronym>SSL</> forsome or all connections.
43294329
</para>
43304330

43314331
<para>
@@ -4361,20 +4361,24 @@ chmod og-rwx server.key
43614361

43624362
<para>
43634363
If verification of client certificates is required, place the
4364-
certificates of the <acronym>CA</acronym> you wish to check for in
4364+
certificates of the <acronym>CA</acronym>(s) you wish to check for in
43654365
the file <filename>root.crt</filename> in the data directory. When
43664366
present, a client certificate will be requested from the client
4367-
making the connection and it must have been signed by one of the
4368-
certificates present in <filename>root.crt</filename>. If no
4369-
certificate is presented, the connection will be allowed to proceed
4370-
anway.
4367+
during SSL connection startup, and it must have been signed by one of the
4368+
certificates present in <filename>root.crt</filename>.
43714369
</para>
43724370

43734371
<para>
4374-
The <filename>root.crt</filename> file is always checked for, and
4375-
its absence will be noted through a message in the log. This is
4376-
merely an informative message that client certificates will not be
4377-
requested.
4372+
When the <filename>root.crt</filename> file is not present, client
4373+
certificates will not be requested or checked. In this mode, SSL
4374+
provides communication security but not authentication.
4375+
</para>
4376+
4377+
<para>
4378+
The files <filename>server.key</>, <filename>server.crt</>,
4379+
and <filename>root.crt</filename> are only examined during server
4380+
start; so you must restart the server to make changes in them take
4381+
effect.
43784382
</para>
43794383
</sect1>
43804384

‎src/backend/libpq/be-secure.c‎

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
*
1212
*
1313
* IDENTIFICATION
14-
* $PostgreSQL: pgsql/src/backend/libpq/be-secure.c,v 1.50 2004/09/23 20:27:50 tgl Exp $
14+
* $PostgreSQL: pgsql/src/backend/libpq/be-secure.c,v 1.51 2004/09/26 22:51:49 tgl Exp $
1515
*
1616
* Since the server static private key ($DataDir/server.key)
1717
* will normally be stored unencrypted so that the database
@@ -117,7 +117,6 @@ static const char *SSLerrmessage(void);
117117
*(total in both directions) before we require renegotiation.
118118
*/
119119
#defineRENEGOTIATION_LIMIT (512 * 1024 * 1024)
120-
#defineCA_PATH NULL
121120

122121
staticSSL_CTX*SSL_context=NULL;
123122
#endif
@@ -412,12 +411,12 @@ static DH *
412411
load_dh_file(intkeylength)
413412
{
414413
FILE*fp;
415-
charfnbuf[2048];
414+
charfnbuf[MAXPGPATH];
416415
DH*dh=NULL;
417416
intcodes;
418417

419418
/* attempt to open file. It's not an error if it doesn't exist. */
420-
snprintf(fnbuf,sizeoffnbuf,"%s/dh%d.pem",DataDir,keylength);
419+
snprintf(fnbuf,sizeof(fnbuf),"%s/dh%d.pem",DataDir,keylength);
421420
if ((fp=fopen(fnbuf,"r"))==NULL)
422421
returnNULL;
423422

@@ -694,20 +693,26 @@ initialize_SSL(void)
694693
if (SSL_CTX_set_cipher_list(SSL_context,"ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH")!=1)
695694
elog(FATAL,"could not set the cipher list (no valid ciphers available)");
696695

697-
/* accept client certificates, but don't require them. */
696+
/*
697+
* Require and check client certificates only if we have a root.crt file.
698+
*/
698699
snprintf(fnbuf,sizeof(fnbuf),"%s/root.crt",DataDir);
699-
if (!SSL_CTX_load_verify_locations(SSL_context,fnbuf,CA_PATH))
700+
if (!SSL_CTX_load_verify_locations(SSL_context,fnbuf,NULL))
700701
{
701702
/* Not fatal - we do not require client certificates */
702703
ereport(LOG,
703704
(errmsg("could not load root certificate file \"%s\": %s",
704705
fnbuf,SSLerrmessage()),
705706
errdetail("Will not verify client certificates.")));
706-
return0;
707707
}
708-
SSL_CTX_set_verify(SSL_context,
709-
SSL_VERIFY_PEER |SSL_VERIFY_CLIENT_ONCE,
710-
verify_cb);
708+
else
709+
{
710+
SSL_CTX_set_verify(SSL_context,
711+
(SSL_VERIFY_PEER |
712+
SSL_VERIFY_FAIL_IF_NO_PEER_CERT |
713+
SSL_VERIFY_CLIENT_ONCE),
714+
verify_cb);
715+
}
711716

712717
return0;
713718
}

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp