mirror/postgresql
2
0
Fork 0
mirror of https://git.postgresql.org/git/postgresql.git synced 2025-01-06 15:24:56 +08:00
Code Issues Packages Projects Releases Wiki Activity

Allow SSL to work withouth client-side certificate infrastructure.

Browse Source
This commit is contained in:
Bruce Momjian 2002-09-26 04:41:55 +00:00
parent c889c9c901
commit 15b95cf872
3 changed files with 18 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
doc/src/sgml/runtime.sgml
View File

@ -1,5 +1,5 @@
<!-- <!--
$Header: /cvsroot/pgsql/doc/src/sgml/runtime.sgml,v 1.139 2002/09/25 21:16:10 petere Exp $ $Header: /cvsroot/pgsql/doc/src/sgml/runtime.sgml,v 1.140 2002/09/26 04:41:54 momjian Exp $
--> -->
<Chapter Id="runtime"> <Chapter Id="runtime">
@ -2876,6 +2876,7 @@ openssl rsa -in privkey.pem -out cert.pem
Enter the old passphrase to unlock the existing key. Now do Enter the old passphrase to unlock the existing key. Now do
<programlisting> <programlisting>
openssl req -x509 -in cert.req -text -key cert.pem -out cert.cert openssl req -x509 -in cert.req -text -key cert.pem -out cert.cert
chmod og-rwx cert.pem
cp cert.pem <replaceable>$PGDATA</replaceable>/server.key cp cert.pem <replaceable>$PGDATA</replaceable>/server.key
cp cert.cert <replaceable>$PGDATA</replaceable>/server.crt cp cert.cert <replaceable>$PGDATA</replaceable>/server.crt
</programlisting> </programlisting>

6
src/backend/libpq/be-secure.c
View File

@ -11,7 +11,7 @@
* *
* *
* IDENTIFICATION * IDENTIFICATION
* $Header: /cvsroot/pgsql/src/backend/libpq/be-secure.c,v 1.14 2002/09/04 23:31:34 tgl Exp $ * $Header: /cvsroot/pgsql/src/backend/libpq/be-secure.c,v 1.15 2002/09/26 04:41:54 momjian Exp $
* *
* Since the server static private key ($DataDir/server.key) * Since the server static private key ($DataDir/server.key)
* will normally be stored unencrypted so that the database * will normally be stored unencrypted so that the database
@ -642,9 +642,13 @@ initialize_SSL(void)
snprintf(fnbuf, sizeof fnbuf, "%s/root.crt", DataDir); snprintf(fnbuf, sizeof fnbuf, "%s/root.crt", DataDir);
if (!SSL_CTX_load_verify_locations(SSL_context, fnbuf, CA_PATH)) if (!SSL_CTX_load_verify_locations(SSL_context, fnbuf, CA_PATH))
{ {
return 0;
#ifdef NOT_USED
/* CLIENT CERTIFICATES NOT REQUIRED bjm 2002-09-26 */
postmaster_error("could not read root cert file (%s): %s", postmaster_error("could not read root cert file (%s): %s",
fnbuf, SSLerrmessage()); fnbuf, SSLerrmessage());
ExitPostmaster(1); ExitPostmaster(1);
#endif
} }
SSL_CTX_set_verify(SSL_context, SSL_CTX_set_verify(SSL_context,
SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, verify_cb); SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, verify_cb);

12
src/interfaces/libpq/fe-secure.c
View File

@ -11,7 +11,7 @@
* *
* *
* IDENTIFICATION * IDENTIFICATION
* $Header: /cvsroot/pgsql/src/interfaces/libpq/fe-secure.c,v 1.13 2002/09/22 20:57:21 petere Exp $ * $Header: /cvsroot/pgsql/src/interfaces/libpq/fe-secure.c,v 1.14 2002/09/26 04:41:55 momjian Exp $
* *
* NOTES * NOTES
* The client *requires* a valid server certificate. Since * The client *requires* a valid server certificate. Since
@ -726,10 +726,14 @@ initialize_SSL(PGconn *conn)
pwd->pw_dir); pwd->pw_dir);
if (stat(fnbuf, &buf) == -1) if (stat(fnbuf, &buf) == -1)
{ {
return 0;
#ifdef NOT_USED
/* CLIENT CERTIFICATES NOT REQUIRED bjm 2002-09-26 */
printfPQExpBuffer(&conn->errorMessage, printfPQExpBuffer(&conn->errorMessage,
libpq_gettext("could not read root certificate list (%s): %s\n"), libpq_gettext("could not read root certificate list (%s): %s\n"),
fnbuf, strerror(errno)); fnbuf, strerror(errno));
return -1; return -1;
#endif
} }
if (!SSL_CTX_load_verify_locations(SSL_context, fnbuf, 0)) if (!SSL_CTX_load_verify_locations(SSL_context, fnbuf, 0))
{ {
@ -789,6 +793,8 @@ open_client_SSL(PGconn *conn)
/* check the certificate chain of the server */ /* check the certificate chain of the server */
#ifdef NOT_USED
/* CLIENT CERTIFICATES NOT REQUIRED bjm 2002-09-26 */
/* /*
* this eliminates simple man-in-the-middle attacks and simple * this eliminates simple man-in-the-middle attacks and simple
* impersonations * impersonations
@ -802,6 +808,7 @@ open_client_SSL(PGconn *conn)
close_SSL(conn); close_SSL(conn);
return -1; return -1;
} }
#endif
/* pull out server distinguished and common names */ /* pull out server distinguished and common names */
conn->peer = SSL_get_peer_certificate(conn->ssl); conn->peer = SSL_get_peer_certificate(conn->ssl);
@ -824,6 +831,8 @@ open_client_SSL(PGconn *conn)
/* verify that the common name resolves to peer */ /* verify that the common name resolves to peer */
#ifdef NOT_USED
/* CLIENT CERTIFICATES NOT REQUIRED bjm 2002-09-26 */
/* /*
* this is necessary to eliminate man-in-the-middle attacks and * this is necessary to eliminate man-in-the-middle attacks and
* impersonations where the attacker somehow learned the server's * impersonations where the attacker somehow learned the server's
@ -834,6 +843,7 @@ open_client_SSL(PGconn *conn)
close_SSL(conn); close_SSL(conn);
return -1; return -1;
} }
#endif
return 0; return 0;
} }