Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commite883d0b

Browse files
committed
Remove sslverify parameter again, replacing it with two new sslmode values:
"verify-ca" and "verify-full".Since "prefer" remains the default, this will make certificate validationoff by default, which should lead to less upgrade issues.
1 parent420ea68 commite883d0b

File tree

5 files changed

+89
-102
lines changed

5 files changed

+89
-102
lines changed

‎doc/src/sgml/libpq.sgml

Lines changed: 68 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
<!-- $PostgreSQL: pgsql/doc/src/sgml/libpq.sgml,v 1.285 2009/04/15 13:03:11 momjian Exp $ -->
1+
<!-- $PostgreSQL: pgsql/doc/src/sgml/libpq.sgml,v 1.286 2009/04/24 09:43:09 mha Exp $ -->
22

33
<chapter id="libpq">
44
<title><application>libpq</application> - C Library</title>
@@ -292,7 +292,21 @@
292292
<entry><literal>require</></entry>
293293
<entry>only try an <acronym>SSL</> connection</entry>
294294
</row>
295-
295+
296+
<row>
297+
<entry><literal>verify-ca</></entry>
298+
<entry>only try an <acronym>SSL</> connection, and verify that
299+
the server certificate is issued by a trusted <acronym>CA</>.
300+
</entry>
301+
</row>
302+
303+
<row>
304+
<entry><literal>verify-full</></entry>
305+
<entry>only try an <acronym>SSL</> connection, verify that
306+
the server certificate is issued by a trusted <acronym>CA</> and
307+
that the server hostname matches that in the certificate.</entry>
308+
</row>
309+
296310
</tbody>
297311
</tgroup>
298312
</table>
@@ -311,43 +325,6 @@
311325
</listitem>
312326
</varlistentry>
313327

314-
<varlistentry id="libpq-connect-sslverify" xreflabel="sslverify">
315-
<term><literal>sslverify</literal></term>
316-
<listitem>
317-
<para>
318-
This option controls how libpq verifies the certificate on the
319-
server when performing an <acronym>SSL</> connection. There are
320-
three options: <literal>none</> disables verification completely
321-
(not recommended); <literal>cert</> enables verification that
322-
the server certificate chains to a known certificate
323-
authority (CA); <literal>cn</> will both verify that the
324-
certificate chains to a known CA and that the <literal>cn</>
325-
attribute of the server certificate matches the server's
326-
hostname (default).
327-
</para>
328-
329-
<para>
330-
It is always recommended to use the <literal>cn</> value for
331-
this parameter, since this is the only option that prevents
332-
man-in-the-middle attacks. Note that this requires the server
333-
name on the certificate to match exactly with the host name
334-
used for the connection, and therefore does not support connections
335-
to aliased names. It can be used with pure IP address connections
336-
only if the certificate also has just the IP address in the
337-
<literal>cn</> field.
338-
</para>
339-
340-
<para>
341-
If the <literal>cn</> attribute in the certificate sent by the
342-
server starts with an asterisk (<literal>*</>), it will be treated
343-
as a wildcard. This wildcard can only be present at the start of
344-
the value, and will match all characters <emphasis>except</> a
345-
dot (<literal>.</>). This means the certificate will not match
346-
subdomains.
347-
</para>
348-
</listitem>
349-
</varlistentry>
350-
351328
<varlistentry id="libpq-connect-requiressl" xreflabel="requiressl">
352329
<term><literal>requiressl</literal></term>
353330
<listitem>
@@ -5800,16 +5777,6 @@ myEventProc(PGEventId evtId, void *evtInfo, void *passThrough)
58005777
</para>
58015778
</listitem>
58025779

5803-
<listitem>
5804-
<para>
5805-
<indexterm>
5806-
<primary><envar>PGSSLVERIFY</envar></primary>
5807-
</indexterm>
5808-
<envar>PGSSLVERIFY</envar> behaves the same as <xref
5809-
linkend="libpq-connect-sslverify"> connection parameter.
5810-
</para>
5811-
</listitem>
5812-
58135780
<listitem>
58145781
<para>
58155782
<indexterm>
@@ -6162,25 +6129,60 @@ myEventProc(PGEventId evtId, void *evtInfo, void *passThrough)
61626129
file.
61636130
</para>
61646131

6132+
<sect2 id="libq-ssl-certificates">
6133+
<title>Certificate verification</title>
6134+
6135+
<para>
6136+
By default, <productname>PostgreSQL</> will not perform any validation of
6137+
the server certificate. This means that it is possible to spoof the server
6138+
identity (for example by modifying a DNS record or by taking over the server
6139+
IP address) without the client knowing. In order to prevent this,
6140+
<acronym>SSL</> certificate validation must be used.
6141+
</para>
6142+
6143+
<para>
6144+
If the parameter <literal>sslmode</> is set to <literal>verify-ca</>
6145+
libpq will verify that the server is trustworthy by checking the certificate
6146+
chain up to a trusted <acronym>CA</>. If <literal>sslmode</> is set to
6147+
<literal>verify-full</>, libpq will <emphasis>also</> verify that the server
6148+
hostname matches that of the certificate. The SSL connection will fail if
6149+
the server certificate cannot be verified. <literal>verify-full</> is
6150+
recommended in most security sensitive environments.
6151+
</para>
6152+
61656153
<para>
6166-
When the <literal>sslverify</> parameter is set to <literal>cn</> or
6167-
<literal>cert</>, libpq requires a trustworthy server certificate by
6168-
checking the certificate chain up to a <acronym>CA</>.
6169-
To allow verification, place the certificate of a trusted <acronym>CA</>
6170-
in the file <filename>~/.postgresql/root.crt</> in the user's home directory.
6171-
(On Microsoft Windows the file is named
6154+
In <literal>verify-full</> mode, the <literal>cn</> attribute of the
6155+
certificate is matched against the hostname. If the <literal>cn</>
6156+
attribute starts with an asterisk (<literal>*</>), it will be treated as
6157+
a wildcard, and will match all characters <emphasis>except</> a dot
6158+
(<literal>.</>). This means the certificate will not match subdomains.
6159+
If the connection is made using an IP address instead of a hostname, the
6160+
IP address will be matched (without doing any DNS lookups).
6161+
</para>
6162+
6163+
<para>
6164+
To allow verification, the certificate of a trusted <acronym>CA</> must be
6165+
placed in the file <filename>~/.postgresql/root.crt</> in the user's home
6166+
directory. (On Microsoft Windows the file is named
61726167
<filename>%APPDATA%\postgresql\root.crt</filename>.)
6173-
<application>libpq</application> will then verify that the server's
6174-
certificate is signed by one of the trusted certificate authorities.
6175-
The SSL connection will fail if the server certificate cannot be verified.
6168+
</para>
6169+
6170+
<para>
61766171
Certificate Revocation List (CRL) entries are also checked
61776172
if the file <filename>~/.postgresql/root.crl</filename> exists
61786173
(<filename>%APPDATA%\postgresql\root.crl</filename> on Microsoft
61796174
Windows).
6175+
</para>
6176+
6177+
<para>
61806178
The location of the root certificate store and the CRL can be overridden
61816179
by the connection parameters <literal>sslrootcert</> and <literal>sslcrl</>
61826180
or the environment variables <envar>PGSSLROOTCERT</> and <envar>PGSSLCRL</>.
61836181
</para>
6182+
</sect2>
6183+
6184+
<sect2 id="libpq-ssl-clientcert">
6185+
<title>Client certificates</title>
61846186

61856187
<para>
61866188
If the server requests a trusted client certificate,
@@ -6201,6 +6203,9 @@ myEventProc(PGEventId evtId, void *evtInfo, void *passThrough)
62016203
environment variables <envar>PGSSLCERT</> and <envar>PGSSLKEY</>.
62026204
</para>
62036205

6206+
</sect2>
6207+
<sect2 id="libpq-ssl-fileusage">
6208+
<title>SSL File Usage</title>
62046209
<table id="libpq-ssl-file-usage">
62056210
<title>Libpq/Client SSL File Usage</title>
62066211
<tgroup cols="3">
@@ -6243,6 +6248,10 @@ myEventProc(PGEventId evtId, void *evtInfo, void *passThrough)
62436248
</tbody>
62446249
</tgroup>
62456250
</table>
6251+
</sect2>
6252+
6253+
<sect2 id="libpq-ssl-initialize">
6254+
<title>SSL library initialization</title>
62466255

62476256
<para>
62486257
If your application initializes <literal>libssl</> and/or
@@ -6330,6 +6339,7 @@ myEventProc(PGEventId evtId, void *evtInfo, void *passThrough)
63306339
</varlistentry>
63316340
</variablelist>
63326341
</para>
6342+
</sect2>
63336343

63346344
</sect1>
63356345

‎doc/src/sgml/runtime.sgml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
<!-- $PostgreSQL: pgsql/doc/src/sgml/runtime.sgml,v 1.425 2009/01/09 13:37:18 petere Exp $ -->
1+
<!-- $PostgreSQL: pgsql/doc/src/sgml/runtime.sgml,v 1.426 2009/04/24 09:43:09 mha Exp $ -->
22

33
<chapter Id="runtime">
44
<title>Server Setup and Operation</title>
@@ -1422,8 +1422,8 @@ $ <userinput>kill -INT `head -1 /usr/local/pgsql/data/postmaster.pid`</userinput
14221422
<filename>server.key</filename> (key) and
14231423
<filename>server.crt</filename> (certificate) files (<xref
14241424
linkend="ssl-tcp">). The TCP client must connect using
1425-
<literal>sslmode='require'</>, specify <literal>sslverify='cn'</>
1426-
or<literal>sslverify='cert'</> and have the required certificate
1425+
<literal>sslmode='verify-ca'</> or
1426+
<literal>'verify-full'</> and have the required certificate
14271427
files present (<xref linkend="libpq-connect">).
14281428
</para>
14291429
</sect1>

‎src/interfaces/libpq/fe-connect.c

Lines changed: 10 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
*
99
*
1010
* IDENTIFICATION
11-
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-connect.c,v 1.372 2009/01/01 17:24:03 momjian Exp $
11+
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-connect.c,v 1.373 2009/04/24 09:43:10 mha Exp $
1212
*
1313
*-------------------------------------------------------------------------
1414
*/
@@ -91,11 +91,9 @@ static int ldapServiceLookup(const char *purl, PQconninfoOption *options,
9191
#defineDefaultAuthtype ""
9292
#defineDefaultPassword ""
9393
#ifdefUSE_SSL
94-
#defineDefaultSSLMode"prefer"
95-
#defineDefaultSSLVerify "cn"
94+
#defineDefaultSSLMode "prefer"
9695
#else
9796
#defineDefaultSSLMode"disable"
98-
#defineDefaultSSLVerify "none"
9997
#endif
10098

10199
/* ----------
@@ -185,9 +183,6 @@ static const PQconninfoOption PQconninfoOptions[] = {
185183
{"sslmode","PGSSLMODE",DefaultSSLMode,NULL,
186184
"SSL-Mode","",8},/* sizeof("disable") == 8 */
187185

188-
{"sslverify","PGSSLVERIFY",DefaultSSLVerify,NULL,
189-
"SSL-Verify","",5},/* sizeof("chain") == 5 */
190-
191186
{"sslcert","PGSSLCERT",NULL,NULL,
192187
"SSL-Client-Cert","",64},
193188

@@ -431,8 +426,6 @@ connectOptions1(PGconn *conn, const char *conninfo)
431426
conn->connect_timeout=tmp ?strdup(tmp) :NULL;
432427
tmp=conninfo_getval(connOptions,"sslmode");
433428
conn->sslmode=tmp ?strdup(tmp) :NULL;
434-
tmp=conninfo_getval(connOptions,"sslverify");
435-
conn->sslverify=tmp ?strdup(tmp) :NULL;
436429
tmp=conninfo_getval(connOptions,"sslkey");
437430
conn->sslkey=tmp ?strdup(tmp) :NULL;
438431
tmp=conninfo_getval(connOptions,"sslcert");
@@ -522,7 +515,9 @@ connectOptions2(PGconn *conn)
522515
if (strcmp(conn->sslmode,"disable")!=0
523516
&&strcmp(conn->sslmode,"allow")!=0
524517
&&strcmp(conn->sslmode,"prefer")!=0
525-
&&strcmp(conn->sslmode,"require")!=0)
518+
&&strcmp(conn->sslmode,"require")!=0
519+
&&strcmp(conn->sslmode,"verify-ca")!=0
520+
&&strcmp(conn->sslmode,"verify-full")!=0)
526521
{
527522
conn->status=CONNECTION_BAD;
528523
printfPQExpBuffer(&conn->errorMessage,
@@ -544,6 +539,7 @@ connectOptions2(PGconn *conn)
544539
break;
545540

546541
case'r':/* "require" */
542+
case'v':/* "verify-ca" or "verify-full" */
547543
conn->status=CONNECTION_BAD;
548544
printfPQExpBuffer(&conn->errorMessage,
549545
libpq_gettext("sslmode value \"%s\" invalid when SSL support is not compiled in\n"),
@@ -555,24 +551,6 @@ connectOptions2(PGconn *conn)
555551
else
556552
conn->sslmode=strdup(DefaultSSLMode);
557553

558-
/*
559-
* Validate sslverify option
560-
*/
561-
if (conn->sslverify)
562-
{
563-
if (strcmp(conn->sslverify,"none")!=0
564-
&&strcmp(conn->sslverify,"cert")!=0
565-
&&strcmp(conn->sslverify,"cn")!=0)
566-
{
567-
conn->status=CONNECTION_BAD;
568-
printfPQExpBuffer(&conn->errorMessage,
569-
libpq_gettext("invalid sslverify value: \"%s\"\n"),
570-
conn->sslverify);
571-
return false;
572-
}
573-
}
574-
575-
576554
/*
577555
* Only if we get this far is it appropriate to try to connect. (We need a
578556
* state flag, rather than just the boolean result of this function, in
@@ -1428,7 +1406,8 @@ PQconnectPoll(PGconn *conn)
14281406
}
14291407
elseif (SSLok=='N')
14301408
{
1431-
if (conn->sslmode[0]=='r')/* "require" */
1409+
if (conn->sslmode[0]=='r'||/* "require" */
1410+
conn->sslmode[0]=='v')/* "verify-ca" or "verify-full" */
14321411
{
14331412
/* Require SSL, but server does not want it */
14341413
appendPQExpBuffer(&conn->errorMessage,
@@ -1445,7 +1424,8 @@ PQconnectPoll(PGconn *conn)
14451424
/* Received error - probably protocol mismatch */
14461425
if (conn->Pfdebug)
14471426
fprintf(conn->Pfdebug,"received error from server, attempting fallback to pre-7.0\n");
1448-
if (conn->sslmode[0]=='r')/* "require" */
1427+
if (conn->sslmode[0]=='r'||/* "require" */
1428+
conn->sslmode[0]=='v')/* "verify-ca" or "verify-full" */
14491429
{
14501430
/* Require SSL, but server is too old */
14511431
appendPQExpBuffer(&conn->errorMessage,
@@ -2052,8 +2032,6 @@ freePGconn(PGconn *conn)
20522032
free(conn->pgpass);
20532033
if (conn->sslmode)
20542034
free(conn->sslmode);
2055-
if (conn->sslverify)
2056-
free(conn->sslverify);
20572035
if (conn->sslcert)
20582036
free(conn->sslcert);
20592037
if (conn->sslkey)

‎src/interfaces/libpq/fe-secure.c

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
*
1212
*
1313
* IDENTIFICATION
14-
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-secure.c,v 1.123 2009/04/14 17:30:16 momjian Exp $
14+
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-secure.c,v 1.124 2009/04/24 09:43:10 mha Exp $
1515
*
1616
* NOTES
1717
*
@@ -523,7 +523,7 @@ verify_peer_name_matches_certificate(PGconn *conn)
523523
* If told not to verify the peer name, don't do it. Return
524524
* 0 indicating that the verification was successful.
525525
*/
526-
if(strcmp(conn->sslverify,"cn")!=0)
526+
if(strcmp(conn->sslmode,"verify-full")!=0)
527527
return true;
528528

529529
if (conn->pghostaddr)
@@ -987,9 +987,9 @@ initialize_SSL(PGconn *conn)
987987
return-1;
988988

989989
/*
990-
* Ifsslverify is set toanything other than "none", perform certificate
991-
* verification. If set to "cn" we will also do further verifications after
992-
* the connection has been completed.
990+
* Ifsslmode is set toone of the verify options, perform certificate
991+
* verification. If set to "verify-full" we will also do further
992+
*verification afterthe connection has been completed.
993993
*
994994
* If we are going to look for either root certificate or CRL in the home directory,
995995
* we need pqGetHomeDirectory() to succeed. In other cases, we don't need to
@@ -999,7 +999,7 @@ initialize_SSL(PGconn *conn)
999999
{
10001000
if (!pqGetHomeDirectory(homedir,sizeof(homedir)))
10011001
{
1002-
if (strcmp(conn->sslverify,"none")!=0)
1002+
if (conn->sslmode[0]=='v')/* "verify-ca" or "verify-full" */
10031003
{
10041004
printfPQExpBuffer(&conn->errorMessage,
10051005
libpq_gettext("could not get home directory to locate root certificate file"));
@@ -1064,7 +1064,7 @@ initialize_SSL(PGconn *conn)
10641064
else
10651065
{
10661066
/* stat() failed; assume cert file doesn't exist */
1067-
if (strcmp(conn->sslverify,"none")!=0)
1067+
if (conn->sslmode[0]=='v')/* "verify-ca" or "verify-full" */
10681068
{
10691069
printfPQExpBuffer(&conn->errorMessage,
10701070
libpq_gettext("root certificate file \"%s\" does not exist\n"

‎src/interfaces/libpq/libpq-int.h

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
* Portions Copyright (c) 1996-2009, PostgreSQL Global Development Group
1313
* Portions Copyright (c) 1994, Regents of the University of California
1414
*
15-
* $PostgreSQL: pgsql/src/interfaces/libpq/libpq-int.h,v 1.140 2009/04/19 22:37:13 tgl Exp $
15+
* $PostgreSQL: pgsql/src/interfaces/libpq/libpq-int.h,v 1.141 2009/04/24 09:43:10 mha Exp $
1616
*
1717
*-------------------------------------------------------------------------
1818
*/
@@ -294,7 +294,6 @@ struct pg_conn
294294
char*pguser;/* Postgres username and password, if any */
295295
char*pgpass;
296296
char*sslmode;/* SSL mode (require,prefer,allow,disable) */
297-
char*sslverify;/* Verify server SSL certificate (none,chain,cn) */
298297
char*sslkey;/* client key filename */
299298
char*sslcert;/* client certificate filename */
300299
char*sslrootcert;/* root certificate filename */

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp