Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit5f3724d

Browse files
committed
Support specifying filename for SSL certificate, key, root certificate store
and certificate revokation list by using connection parameters or environmentvariables.Original patch by Mark Woodward, heavily reworked by Alvaro Herrera andMagnus Hagander.
1 parenta9d5f30 commit5f3724d

File tree

4 files changed

+204
-71
lines changed

4 files changed

+204
-71
lines changed

‎doc/src/sgml/libpq.sgml‎

Lines changed: 89 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
<!-- $PostgreSQL: pgsql/doc/src/sgml/libpq.sgml,v 1.273 2008/12/07 23:46:39 alvherre Exp $ -->
1+
<!-- $PostgreSQL: pgsql/doc/src/sgml/libpq.sgml,v 1.274 2008/12/15 10:28:21 mha Exp $ -->
22

33
<chapter id="libpq">
44
<title><application>libpq</application> - C Library</title>
@@ -317,6 +317,50 @@
317317
</listitem>
318318
</varlistentry>
319319

320+
<varlistentry>
321+
<term><literal>sslcert</literal></term>
322+
<listitem>
323+
<para>
324+
This parameter specifies the file name of the client SSL
325+
certificate.
326+
</para>
327+
</listitem>
328+
</varlistentry>
329+
330+
<varlistentry>
331+
<term><literal>sslkey</literal></term>
332+
<listitem>
333+
<para>
334+
This parameter specifies the location for the secret key
335+
used for the client certificate. It can either specify a filename
336+
that will be used instead of the default
337+
<filename>~/.postgresql/postgresql.key</>, or can specify an external
338+
engine (engines are <productname>OpenSSL</> loadable modules). The
339+
external engine specification should consist of a colon-separated
340+
engine name and an engine-specific key identifier.
341+
</para>
342+
</listitem>
343+
</varlistentry>
344+
345+
<varlistentry>
346+
<term><literal>sslrootcert</literal></term>
347+
<listitem>
348+
<para>
349+
This parameter specifies the file name of the root SSL certificate.
350+
</para>
351+
</listitem>
352+
</varlistentry>
353+
354+
<varlistentry>
355+
<term><literal>sslcrl</literal></term>
356+
<listitem>
357+
<para>
358+
This parameter specifies the file name of the SSL certificate
359+
revocation list (CRL).
360+
</para>
361+
</listitem>
362+
</varlistentry>
363+
320364
<varlistentry>
321365
<term><literal>krbsrvname</literal></term>
322366
<listitem>
@@ -5761,17 +5805,48 @@ myEventProc(PGEventId evtId, void *evtInfo, void *passThrough)
57615805
</para>
57625806
</listitem>
57635807

5808+
<listitem>
5809+
<para>
5810+
<indexterm>
5811+
<primary><envar>PGSSLCERT</envar></primary>
5812+
</indexterm>
5813+
<envar>PGSSLCERT</envar> specifies the location for the client
5814+
certificate to use if the server requests one.
5815+
</para>
5816+
</listitem>
5817+
57645818
<listitem>
57655819
<para>
57665820
<indexterm>
57675821
<primary><envar>PGSSLKEY</envar></primary>
57685822
</indexterm>
5769-
<envar>PGSSLKEY</envar> specifies the hardware token that stores the
5770-
secret key for the client certificate. The value of this variable
5771-
should consist of a colon-separated engine name (engines are
5772-
<productname>OpenSSL</> loadable modules) and an engine-specific key
5773-
identifier. If this is not set, the secret key must be kept in a
5774-
file.
5823+
<envar>PGSSLKEY</envar> specifies the location for the secret key
5824+
used for the client certificate. It can either specify a filename
5825+
that will be used instead of the default
5826+
<filename>~/.postgresql/postgresql.key</>, or can specify an external
5827+
engine (engines are <productname>OpenSSL</> loadable modules). The
5828+
external engine specification should consist of a colon-separated
5829+
engine name and an engine-specific key identifier.
5830+
</para>
5831+
</listitem>
5832+
5833+
<listitem>
5834+
<para>
5835+
<indexterm>
5836+
<primary><envar>PGSSLROOTCERT</envar></primary>
5837+
</indexterm>
5838+
<envar>PGSSLROOTCERT</envar> specifies the file name where the SSL
5839+
root certificate is stored.
5840+
</para>
5841+
</listitem>
5842+
5843+
<listitem>
5844+
<para>
5845+
<indexterm>
5846+
<primary><envar>PGSSLCRL</envar></primary>
5847+
</indexterm>
5848+
<envar>PGSSLCRL</envar> specifies the file name where the SSL certificate
5849+
revocation list is stored.
57755850
</para>
57765851
</listitem>
57775852

@@ -6096,6 +6171,9 @@ myEventProc(PGEventId evtId, void *evtInfo, void *passThrough)
60966171
if the file <filename>~/.postgresql/root.crl</filename> exists
60976172
(<filename>%APPDATA%\postgresql\root.crl</filename> on Microsoft
60986173
Windows).
6174+
The location of the root certificate store and the CRL can be overridden
6175+
by the connection parameters <literal>sslrootcert</> and <literal>sslcrl</>
6176+
or the environment variables <envar>PGSSLROOTCERT</> and <envar>PGSSLCRL</>.
60996177
</para>
61006178

61016179
<para>
@@ -6105,26 +6183,16 @@ myEventProc(PGEventId evtId, void *evtInfo, void *passThrough)
61056183
directory. The certificate must be signed by one of the certificate
61066184
authorities (<acronym>CA</acronym>) trusted by the server. A matching
61076185
private key file <filename>~/.postgresql/postgresql.key</> must also
6108-
be present, unless the secret key for the certificate is stored in a
6109-
hardware token, as specified by <envar>PGSSLKEY</envar>. The private
6186+
be present. The private
61106187
key file must not allow any access to world or group; achieve this by the
61116188
command <command>chmod 0600 ~/.postgresql/postgresql.key</command>.
61126189
On Microsoft Windows these files are named
61136190
<filename>%APPDATA%\postgresql\postgresql.crt</filename> and
61146191
<filename>%APPDATA%\postgresql\postgresql.key</filename>, and there
61156192
is no special permissions check since the directory is presumed secure.
6116-
</para>
6117-
6118-
<para>
6119-
If the environment variable <envar>PGSSLKEY</envar> is set, its value
6120-
should consist of a colon-separated engine name and key identifier. In
6121-
this case, <application>libpq</application> will load the specified
6122-
engine, i.e. the <productname>OpenSSL</> module which supports special
6123-
hardware, and reference the key with the specified identifier.
6124-
Identifiers are engine-specific. Typically, cryptography hardware tokens
6125-
do not reveal secret keys to the application. Instead, applications
6126-
delegate all cryptography operations which require the secret key to
6127-
the hardware token.
6193+
The location of the certificate and key files can be overridden by the
6194+
connection parameters <literal>sslcert</> and <literal>sslkey</> or the
6195+
environment variables <envar>PGSSLCERT</> and <envar>PGSSLKEY</>.
61286196
</para>
61296197

61306198
<para>

‎src/interfaces/libpq/fe-connect.c‎

Lines changed: 33 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
*
99
*
1010
* IDENTIFICATION
11-
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-connect.c,v 1.370 2008/11/26 00:26:23 tgl Exp $
11+
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-connect.c,v 1.371 2008/12/15 10:28:21 mha Exp $
1212
*
1313
*-------------------------------------------------------------------------
1414
*/
@@ -177,15 +177,29 @@ static const PQconninfoOption PQconninfoOptions[] = {
177177
#endif
178178

179179
/*
180-
* "sslmode" option is allowed even without client SSL support because the
181-
* client can still handle SSL modes "disable" and "allow".
180+
* ssl options are allowed even without client SSL support because the
181+
* client can still handle SSL modes "disable" and "allow". Other parameters
182+
* have no effect on non-SSL connections, so there is no reason to exclude them
183+
* since none of them are mandatory.
182184
*/
183185
{"sslmode","PGSSLMODE",DefaultSSLMode,NULL,
184186
"SSL-Mode","",8},/* sizeof("disable") == 8 */
185187

186188
{"sslverify","PGSSLVERIFY",DefaultSSLVerify,NULL,
187189
"SSL-Verify","",5},/* sizeof("chain") == 5 */
188190

191+
{"sslcert","PGSSLCERT",NULL,NULL,
192+
"SSL-Client-Cert","",64},
193+
194+
{"sslkey","PGSSLKEY",NULL,NULL,
195+
"SSL-Client-Key","",64},
196+
197+
{"sslrootcert","PGSSLROOTCERT",NULL,NULL,
198+
"SSL-Root-Certificate","",64},
199+
200+
{"sslcrl","PGSSLCRL",NULL,NULL,
201+
"SSL-Revocation-List","",64},
202+
189203
#if defined(KRB5)||defined(ENABLE_GSS)||defined(ENABLE_SSPI)
190204
/* Kerberos and GSSAPI authentication support specifying the service name */
191205
{"krbsrvname","PGKRBSRVNAME",PG_KRB_SRVNAM,NULL,
@@ -419,6 +433,14 @@ connectOptions1(PGconn *conn, const char *conninfo)
419433
conn->sslmode=tmp ?strdup(tmp) :NULL;
420434
tmp=conninfo_getval(connOptions,"sslverify");
421435
conn->sslverify=tmp ?strdup(tmp) :NULL;
436+
tmp=conninfo_getval(connOptions,"sslkey");
437+
conn->sslkey=tmp ?strdup(tmp) :NULL;
438+
tmp=conninfo_getval(connOptions,"sslcert");
439+
conn->sslcert=tmp ?strdup(tmp) :NULL;
440+
tmp=conninfo_getval(connOptions,"sslrootcert");
441+
conn->sslrootcert=tmp ?strdup(tmp) :NULL;
442+
tmp=conninfo_getval(connOptions,"sslcrl");
443+
conn->sslcrl=tmp ?strdup(tmp) :NULL;
422444
#ifdefUSE_SSL
423445
tmp=conninfo_getval(connOptions,"requiressl");
424446
if (tmp&&tmp[0]=='1')
@@ -2032,6 +2054,14 @@ freePGconn(PGconn *conn)
20322054
free(conn->sslmode);
20332055
if (conn->sslverify)
20342056
free(conn->sslverify);
2057+
if (conn->sslcert)
2058+
free(conn->sslcert);
2059+
if (conn->sslkey)
2060+
free(conn->sslkey);
2061+
if (conn->sslrootcert)
2062+
free(conn->sslrootcert);
2063+
if (conn->sslcrl)
2064+
free(conn->sslcrl);
20352065
#if defined(KRB5)|| defined(ENABLE_GSS)|| defined(ENABLE_SSPI)
20362066
if (conn->krbsrvname)
20372067
free(conn->krbsrvname);

‎src/interfaces/libpq/fe-secure.c‎

Lines changed: 76 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
*
1212
*
1313
* IDENTIFICATION
14-
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-secure.c,v 1.113 2008/12/04 14:07:42 mha Exp $
14+
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-secure.c,v 1.114 2008/12/15 10:28:22 mha Exp $
1515
*
1616
* NOTES
1717
*
@@ -568,7 +568,10 @@ client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
568568
}
569569

570570
/* read the user certificate */
571-
snprintf(fnbuf,sizeof(fnbuf),"%s/%s",homedir,USER_CERT_FILE);
571+
if (conn->sslcert)
572+
strncpy(fnbuf,conn->sslcert,sizeof(fnbuf));
573+
else
574+
snprintf(fnbuf,sizeof(fnbuf),"%s/%s",homedir,USER_CERT_FILE);
572575

573576
/*
574577
* OpenSSL <= 0.9.8 lacks error stack handling, which means it's likely to
@@ -618,60 +621,78 @@ client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
618621

619622
BIO_free(bio);
620623

621-
#if (SSLEAY_VERSION_NUMBER >=0x00907000L)&& !defined(OPENSSL_NO_ENGINE)
622-
if (getenv("PGSSLKEY"))
624+
/*
625+
* Read the SSL key. If a key is specified, treat it as an engine:key combination
626+
* if there is colon present - we don't support files with colon in the name. The
627+
* exception is if the second character is a colon, in which case it can be a Windows
628+
* filename with drive specification.
629+
*/
630+
if (conn->sslkey&&strlen(conn->sslkey)>0)
623631
{
624-
/* read the user key from engine */
625-
char*engine_env=getenv("PGSSLKEY");
626-
char*engine_colon=strchr(engine_env,':');
627-
char*engine_str;
628-
ENGINE*engine_ptr;
629-
630-
if (!engine_colon)
632+
#if (SSLEAY_VERSION_NUMBER >=0x00907000L)&& !defined(OPENSSL_NO_ENGINE)
633+
if (strchr(conn->sslkey,':')
634+
#ifdefWIN32
635+
&&conn->sslkey[1]!=':'
636+
#endif
637+
)
631638
{
632-
printfPQExpBuffer(&conn->errorMessage,
633-
libpq_gettext("invalid value of PGSSLKEY environment variable\n"));
634-
ERR_pop_to_mark();
635-
return0;
636-
}
639+
/* Colon, but not in second character, treat as engine:key */
640+
ENGINE*engine_ptr;
641+
char*engine_str=strdup(conn->sslkey);
642+
char*engine_colon=strchr(engine_str,':');
637643

638-
engine_str=malloc(engine_colon-engine_env+1);
639-
strlcpy(engine_str,engine_env,engine_colon-engine_env+1);
640-
engine_ptr=ENGINE_by_id(engine_str);
641-
if (engine_ptr==NULL)
642-
{
643-
char*err=SSLerrmessage();
644+
*engine_colon='\0';/* engine_str now has engine name */
645+
engine_colon++;/* engine_colon now has key name */
644646

645-
printfPQExpBuffer(&conn->errorMessage,
646-
libpq_gettext("could not load SSL engine \"%s\": %s\n"),
647-
engine_str,err);
648-
SSLerrfree(err);
649-
free(engine_str);
650-
ERR_pop_to_mark();
651-
return0;
652-
}
647+
engine_ptr=ENGINE_by_id(engine_str);
648+
if (engine_ptr==NULL)
649+
{
650+
char*err=SSLerrmessage();
653651

654-
*pkey=ENGINE_load_private_key(engine_ptr,engine_colon+1,
655-
NULL,NULL);
656-
if (*pkey==NULL)
657-
{
658-
char*err=SSLerrmessage();
652+
printfPQExpBuffer(&conn->errorMessage,
653+
libpq_gettext("could not load SSL engine \"%s\": %s\n"),
654+
engine_str,err);
655+
SSLerrfree(err);
656+
free(engine_str);
657+
ERR_pop_to_mark();
658+
return0;
659+
}
659660

660-
printfPQExpBuffer(&conn->errorMessage,
661-
libpq_gettext("could not read private SSL key \"%s\" from engine \"%s\": %s\n"),
662-
engine_colon+1,engine_str,err);
663-
SSLerrfree(err);
661+
*pkey=ENGINE_load_private_key(engine_ptr,engine_colon,
662+
NULL,NULL);
663+
if (*pkey==NULL)
664+
{
665+
char*err=SSLerrmessage();
666+
667+
printfPQExpBuffer(&conn->errorMessage,
668+
libpq_gettext("could not read private SSL key \"%s\" from engine \"%s\": %s\n"),
669+
engine_colon,engine_str,err);
670+
SSLerrfree(err);
671+
free(engine_str);
672+
ERR_pop_to_mark();
673+
return0;
674+
}
664675
free(engine_str);
665-
ERR_pop_to_mark();
666-
return0;
676+
677+
fnbuf[0]='\0';/* indicate we're not going to load from a file */
678+
}
679+
else
680+
#endif/* support for SSL engines */
681+
{
682+
/* PGSSLKEY is not an engine, treat it as a filename */
683+
strncpy(fnbuf,conn->sslkey,sizeof(fnbuf));
667684
}
668-
free(engine_str);
669685
}
670686
else
671-
#endif/* use PGSSLKEY */
672687
{
673-
/*read the user key from file */
688+
/*No PGSSLKEY specified, load default file */
674689
snprintf(fnbuf,sizeof(fnbuf),"%s/%s",homedir,USER_KEY_FILE);
690+
}
691+
692+
if (fnbuf[0]!='\0')
693+
{
694+
/* read the user key from file */
695+
675696
if (stat(fnbuf,&buf)!=0)
676697
{
677698
printfPQExpBuffer(&conn->errorMessage,
@@ -948,7 +969,11 @@ initialize_SSL(PGconn *conn)
948969
/* Set up to verify server cert, if root.crt is present */
949970
if (pqGetHomeDirectory(homedir,sizeof(homedir)))
950971
{
951-
snprintf(fnbuf,sizeof(fnbuf),"%s/%s",homedir,ROOT_CERT_FILE);
972+
if (conn->sslrootcert)
973+
strncpy(fnbuf,conn->sslrootcert,sizeof(fnbuf));
974+
else
975+
snprintf(fnbuf,sizeof(fnbuf),"%s/%s",homedir,ROOT_CERT_FILE);
976+
952977
if (stat(fnbuf,&buf)==0)
953978
{
954979
X509_STORE*cvstore;
@@ -966,8 +991,13 @@ initialize_SSL(PGconn *conn)
966991

967992
if ((cvstore=SSL_CTX_get_cert_store(SSL_context))!=NULL)
968993
{
994+
if (conn->sslcrl)
995+
strncpy(fnbuf,conn->sslcrl,sizeof(fnbuf));
996+
else
997+
snprintf(fnbuf,sizeof(fnbuf),"%s/%s",homedir,ROOT_CRL_FILE);
998+
969999
/* setting the flags to check against the complete CRL chain */
970-
if (X509_STORE_load_locations(cvstore,ROOT_CRL_FILE,NULL)!=0)
1000+
if (X509_STORE_load_locations(cvstore,fnbuf,NULL)!=0)
9711001
/* OpenSSL 0.96 does not support X509_V_FLAG_CRL_CHECK */
9721002
#ifdefX509_V_FLAG_CRL_CHECK
9731003
X509_STORE_set_flags(cvstore,

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp