Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitb6c9165

Browse files
committed
Code review for SSLKEY patch.
1 parent5ce7599 commitb6c9165

File tree

6 files changed

+38
-28
lines changed

6 files changed

+38
-28
lines changed

‎src/backend/libpq/be-secure.c

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
*
1212
*
1313
* IDENTIFICATION
14-
* $PostgreSQL: pgsql/src/backend/libpq/be-secure.c,v 1.78 2007/02/1602:59:40 momjian Exp $
14+
* $PostgreSQL: pgsql/src/backend/libpq/be-secure.c,v 1.79 2007/02/1617:06:59 tgl Exp $
1515
*
1616
* Since the server static private key ($DataDir/server.key)
1717
* will normally be stored unencrypted so that the database
@@ -95,8 +95,7 @@
9595
#ifSSLEAY_VERSION_NUMBER >=0x0907000L
9696
#include<openssl/conf.h>
9797
#endif
98-
99-
#endif
98+
#endif/* USE_SSL */
10099

101100
#include"libpq/libpq.h"
102101
#include"tcop/tcopprot.h"
@@ -130,8 +129,8 @@ static const char *SSLerrmessage(void);
130129

131130
staticSSL_CTX*SSL_context=NULL;
132131

133-
/* GUC variable controlling SSL cipher list*/
134-
externchar*SSLCipherSuites;
132+
/* GUC variable controlling SSL cipher list*/
133+
char*SSLCipherSuites=NULL;
135134

136135
#endif
137136

‎src/backend/postmaster/postmaster.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@
3737
*
3838
*
3939
* IDENTIFICATION
40-
* $PostgreSQL: pgsql/src/backend/postmaster/postmaster.c,v 1.524 2007/02/1602:59:41 momjian Exp $
40+
* $PostgreSQL: pgsql/src/backend/postmaster/postmaster.c,v 1.525 2007/02/1617:06:59 tgl Exp $
4141
*
4242
* NOTES
4343
*
@@ -187,7 +187,6 @@ static intSendStop = false;
187187

188188
/* still more option variables */
189189
boolEnableSSL= false;
190-
char*SSLCipherSuites;
191190
boolSilentMode= false;/* silent mode (-S) */
192191

193192
intPreAuthDelay=0;

‎src/backend/utils/misc/guc.c

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
* Written by Peter Eisentraut <peter_e@gmx.net>.
1111
*
1212
* IDENTIFICATION
13-
* $PostgreSQL: pgsql/src/backend/utils/misc/guc.c,v 1.375 2007/02/1602:59:41 momjian Exp $
13+
* $PostgreSQL: pgsql/src/backend/utils/misc/guc.c,v 1.376 2007/02/1617:07:00 tgl Exp $
1414
*
1515
*--------------------------------------------------------------------
1616
*/
@@ -106,6 +106,11 @@ extern bool fullPageWrites;
106106
externbooltrace_sort;
107107
#endif
108108

109+
#ifdefUSE_SSL
110+
externchar*SSLCipherSuites;
111+
#endif
112+
113+
109114
staticconstchar*assign_log_destination(constchar*value,
110115
booldoit,GucSourcesource);
111116

@@ -2314,6 +2319,7 @@ static struct config_string ConfigureNamesString[] =
23142319
NULL,assign_temp_tablespaces,NULL
23152320
},
23162321

2322+
#ifdefUSE_SSL
23172323
{
23182324
{"ssl_ciphers",PGC_POSTMASTER,CONN_AUTH_SECURITY,
23192325
gettext_noop("Sets the list of allowed SSL ciphers."),
@@ -2323,7 +2329,8 @@ static struct config_string ConfigureNamesString[] =
23232329
&SSLCipherSuites,
23242330
"ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH",NULL,NULL
23252331
},
2326-
2332+
#endif/* USE_SSL */
2333+
23272334
/* End-of-list marker */
23282335
{
23292336
{NULL,0,0,NULL,NULL},NULL,NULL,NULL,NULL

‎src/backend/utils/misc/postgresql.conf.sample

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,8 @@
7474

7575
#authentication_timeout = 1min# 1s-600s
7676
#ssl = off# (change requires restart)
77-
#ssl_ciphers = 'ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH' # List of ciphers to use
77+
#ssl_ciphers = 'ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH'# Allowed SSL ciphers
78+
# (change requires restart)
7879
#password_encryption = on
7980
#db_user_namespace = off
8081

‎src/include/postmaster/postmaster.h

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
* Portions Copyright (c) 1996-2007, PostgreSQL Global Development Group
77
* Portions Copyright (c) 1994, Regents of the University of California
88
*
9-
* $PostgreSQL: pgsql/src/include/postmaster/postmaster.h,v 1.16 2007/02/1602:59:41 momjian Exp $
9+
* $PostgreSQL: pgsql/src/include/postmaster/postmaster.h,v 1.17 2007/02/1617:07:00 tgl Exp $
1010
*
1111
*-------------------------------------------------------------------------
1212
*/
@@ -15,7 +15,6 @@
1515

1616
/* GUC options */
1717
externboolEnableSSL;
18-
externchar*SSLCipherSuites;
1918
externboolSilentMode;
2019
externintReservedBackends;
2120
externintPostPortNumber;

‎src/interfaces/libpq/fe-secure.c

Lines changed: 21 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
*
1212
*
1313
* IDENTIFICATION
14-
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-secure.c,v 1.93 2007/02/1602:59:41 momjian Exp $
14+
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-secure.c,v 1.94 2007/02/1617:07:00 tgl Exp $
1515
*
1616
* NOTES
1717
* [ Most of these notes are wrong/obsolete, but perhaps not all ]
@@ -619,7 +619,7 @@ client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
619619
char*engine_env=getenv("PGSSLKEY");
620620
char*engine_colon=strchr(engine_env,':');
621621
char*engine_str;
622-
ENGINE*engine_ptr=NULL;
622+
ENGINE*engine_ptr;
623623

624624
if (!engine_colon)
625625
{
@@ -630,34 +630,38 @@ client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
630630

631631
engine_str=malloc(engine_colon-engine_env+1);
632632
strlcpy(engine_str,engine_env,engine_colon-engine_env+1);
633-
if ((engine_ptr=ENGINE_by_id(engine_str))==NULL)
633+
engine_ptr=ENGINE_by_id(engine_str);
634+
if (engine_ptr==NULL)
634635
{
635636
char*err=SSLerrmessage();
636637

637638
printfPQExpBuffer(&conn->errorMessage,
638-
libpq_gettext("could not load SSL engine \"%s\":%s\n"),engine_str,err);
639-
free(engine_str);
639+
libpq_gettext("could not load SSL engine \"%s\":%s\n"),
640+
engine_str,err);
640641
SSLerrfree(err);
642+
free(engine_str);
641643
return0;
642644
}
643-
if ((*pkey=ENGINE_load_private_key(engine_ptr,
644-
engine_colon+1,NULL,NULL))==NULL)
645+
646+
*pkey=ENGINE_load_private_key(engine_ptr,engine_colon+1,
647+
NULL,NULL);
648+
if (*pkey==NULL)
645649
{
646650
char*err=SSLerrmessage();
647651

648652
printfPQExpBuffer(&conn->errorMessage,
649-
libpq_gettext("could not read private SSL key%s from engine \"%s\": %s\n"),
650-
engine_colon+1,engine_str,err);
653+
libpq_gettext("could not read private SSL key\"%s\" from engine \"%s\": %s\n"),
654+
engine_colon+1,engine_str,err);
651655
SSLerrfree(err);
652656
free(engine_str);
653657
return0;
654658
}
655659
free(engine_str);
656660
}
657661
else
658-
#endif
662+
#endif/* use PGSSLKEY */
659663
{
660-
/* read the user key from file*/
664+
/* read the user key from file*/
661665
snprintf(fnbuf,sizeof(fnbuf),"%s/%s",homedir,USER_KEY_FILE);
662666
if (stat(fnbuf,&buf)==-1)
663667
{
@@ -666,7 +670,7 @@ client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
666670
fnbuf);
667671
return0;
668672
}
669-
#ifndefWIN32
673+
#ifndefWIN32
670674
if (!S_ISREG(buf.st_mode)|| (buf.st_mode&0077)||
671675
buf.st_uid!=geteuid())
672676
{
@@ -675,23 +679,23 @@ client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
675679
fnbuf);
676680
return0;
677681
}
678-
#endif
682+
#endif
679683
if ((fp=fopen(fnbuf,"r"))==NULL)
680684
{
681685
printfPQExpBuffer(&conn->errorMessage,
682686
libpq_gettext("could not open private key file \"%s\": %s\n"),
683687
fnbuf,pqStrerror(errno,sebuf,sizeof(sebuf)));
684688
return0;
685689
}
686-
#ifndefWIN32
690+
#ifndefWIN32
687691
if (fstat(fileno(fp),&buf2)==-1||
688692
buf.st_dev!=buf2.st_dev||buf.st_ino!=buf2.st_ino)
689693
{
690694
printfPQExpBuffer(&conn->errorMessage,
691695
libpq_gettext("private key file \"%s\" changed during execution\n"),fnbuf);
692696
return0;
693697
}
694-
#endif
698+
#endif
695699
if (PEM_read_PrivateKey(fp,pkey,NULL,NULL)==NULL)
696700
{
697701
char*err=SSLerrmessage();
@@ -705,6 +709,7 @@ client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
705709
}
706710
fclose(fp);
707711
}
712+
708713
/* verify that the cert and key go together */
709714
if (!X509_check_private_key(*x509,*pkey))
710715
{
@@ -788,7 +793,7 @@ init_ssl_system(PGconn *conn)
788793
{
789794
if (pq_initssllib)
790795
{
791-
#if(SSLEAY_VERSION_NUMBER >=0x00907000L)
796+
#ifSSLEAY_VERSION_NUMBER >=0x00907000L
792797
OPENSSL_config(NULL);
793798
#endif
794799
SSL_library_init();

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp