PostgreSQL Source Code: src/backend/libpq/be-secure-openssl.c Source File (original) (raw)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
18
19#include <sys/stat.h>
20#include <signal.h>
21#include <fcntl.h>
22#include <ctype.h>
29
38
39
40
41
42
43
44
46#include <openssl/bn.h>
47#include <openssl/conf.h>
48#include <openssl/dh.h>
49#ifndef OPENSSL_NO_ECDH
50#include <openssl/ec.h>
51#endif
52#include <openssl/x509v3.h>
53
54
55
58
63
68static int verify_cb(int ok, X509_STORE_CTX *ctx);
70static int alpn_cb(SSL *ssl,
71 const unsigned char **out,
72 unsigned char *outlen,
73 const unsigned char *in,
74 unsigned int inlen,
75 void *userdata);
76static bool initialize_dh(SSL_CTX *context, bool isServerStart);
77static bool initialize_ecdh(SSL_CTX *context, bool isServerStart);
78static const char *SSLerrmessageExt(unsigned long ecode, const char *replacement);
79static const char *SSLerrmessage(unsigned long ecode);
80
82
86
89
91{
92
93
94
95
97};
98
99
100
101
102
103int
105{
106 SSL_CTX *context;
107 int ssl_ver_min = -1;
108 int ssl_ver_max = -1;
109
110
111
112
113
114
115
116
117
118
119
120 context = SSL_CTX_new(SSLv23_method());
121 if (!context)
122 {
124 (errmsg("could not create SSL context: %s",
127 }
128
129
130
131
132
133 SSL_CTX_set_mode(context, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
134
135
136
137
138 (*openssl_tls_init_hook) (context, isServerStart);
139
140
142
143
144
145
146 if (SSL_CTX_use_certificate_chain_file(context, ssl_cert_file) != 1)
147 {
149 (errcode(ERRCODE_CONFIG_FILE_ERROR),
150 errmsg("could not load server certificate file \"%s\": %s",
153 }
154
157
158
159
160
162
163 if (SSL_CTX_use_PrivateKey_file(context,
165 SSL_FILETYPE_PEM) != 1)
166 {
169 (errcode(ERRCODE_CONFIG_FILE_ERROR),
170 errmsg("private key file \"%s\" cannot be reloaded because it requires a passphrase",
172 else
174 (errcode(ERRCODE_CONFIG_FILE_ERROR),
175 errmsg("could not load private key file \"%s\": %s",
178 }
179
180 if (SSL_CTX_check_private_key(context) != 1)
181 {
183 (errcode(ERRCODE_CONFIG_FILE_ERROR),
184 errmsg("check of private key failed: %s",
187 }
188
190 {
192
193 if (ssl_ver_min == -1)
194 {
196
197 (errmsg("\"%s\" setting \"%s\" not supported by this build",
198 "ssl_min_protocol_version",
200 false, false))));
202 }
203
204 if (!SSL_CTX_set_min_proto_version(context, ssl_ver_min))
205 {
207 (errmsg("could not set minimum SSL protocol version")));
209 }
210 }
211
213 {
215
216 if (ssl_ver_max == -1)
217 {
219
220 (errmsg("\"%s\" setting \"%s\" not supported by this build",
221 "ssl_max_protocol_version",
223 false, false))));
225 }
226
227 if (!SSL_CTX_set_max_proto_version(context, ssl_ver_max))
228 {
230 (errmsg("could not set maximum SSL protocol version")));
232 }
233 }
234
235
238 {
239
240
241
242
243 if (ssl_ver_min > ssl_ver_max)
244 {
246 (errcode(ERRCODE_CONFIG_FILE_ERROR),
247 errmsg("could not set SSL protocol version range"),
248 errdetail("\"%s\" cannot be higher than \"%s\"",
249 "ssl_min_protocol_version",
250 "ssl_max_protocol_version")));
252 }
253 }
254
255
256
257
258
259
260
261
262
263
264#ifdef HAVE_SSL_CTX_SET_NUM_TICKETS
265 SSL_CTX_set_num_tickets(context, 0);
266#endif
267 SSL_CTX_set_options(context, SSL_OP_NO_TICKET);
268
269
270 SSL_CTX_set_session_cache_mode(context, SSL_SESS_CACHE_OFF);
271
272
273 SSL_CTX_set_options(context, SSL_OP_NO_COMPRESSION);
274
275
276
277
278
279
280
281
282
283#ifdef SSL_OP_NO_RENEGOTIATION
284 SSL_CTX_set_options(context, SSL_OP_NO_RENEGOTIATION);
285#endif
286#ifdef SSL_OP_NO_CLIENT_RENEGOTIATION
287 SSL_CTX_set_options(context, SSL_OP_NO_CLIENT_RENEGOTIATION);
288#endif
289
290
295
296
297 if (SSL_CTX_set_cipher_list(context, SSLCipherList) != 1)
298 {
300 (errcode(ERRCODE_CONFIG_FILE_ERROR),
301 errmsg("could not set the TLSv1.2 cipher list (no valid ciphers available)")));
303 }
304
305
306
307
308
310 {
311
312 if (SSL_CTX_set_ciphersuites(context, SSLCipherSuites) != 1)
313 {
315 (errcode(ERRCODE_CONFIG_FILE_ERROR),
316 errmsg("could not set the TLSv1.3 cipher suites (no valid ciphers available)")));
318 }
319 }
320
321
323 SSL_CTX_set_options(context, SSL_OP_CIPHER_SERVER_PREFERENCE);
324
325
326
327
329 {
330 STACK_OF(X509_NAME) * root_cert_list;
331
332 if (SSL_CTX_load_verify_locations(context, ssl_ca_file, NULL) != 1 ||
333 (root_cert_list = SSL_load_client_CA_file(ssl_ca_file)) == NULL)
334 {
336 (errcode(ERRCODE_CONFIG_FILE_ERROR),
337 errmsg("could not load root certificate file \"%s\": %s",
340 }
341
342
343
344
345
346
347
348
349 SSL_CTX_set_client_CA_list(context, root_cert_list);
350
351
352
353
354
355
356 SSL_CTX_set_verify(context,
357 (SSL_VERIFY_PEER |
358 SSL_VERIFY_CLIENT_ONCE),
360 }
361
362
363
364
365
366
368 {
369 X509_STORE *cvstore = SSL_CTX_get_cert_store(context);
370
371 if (cvstore)
372 {
373
374 if (X509_STORE_load_locations(cvstore,
377 == 1)
378 {
379 X509_STORE_set_flags(cvstore,
380 X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
381 }
383 {
385 (errcode(ERRCODE_CONFIG_FILE_ERROR),
386 errmsg("could not load SSL certificate revocation list file \"%s\": %s",
389 }
391 {
393 (errcode(ERRCODE_CONFIG_FILE_ERROR),
394 errmsg("could not load SSL certificate revocation list directory \"%s\": %s",
397 }
398 else
399 {
401 (errcode(ERRCODE_CONFIG_FILE_ERROR),
402 errmsg("could not load SSL certificate revocation list file \"%s\" or directory \"%s\": %s",
406 }
407 }
408 }
409
410
411
412
415
417
418
419
420
422 ssl_loaded_verify_locations = true;
423 else
424 ssl_loaded_verify_locations = false;
425
426 return 0;
427
428
430 if (context)
431 SSL_CTX_free(context);
432 return -1;
433}
434
435void
437{
441 ssl_loaded_verify_locations = false;
442}
443
444int
446{
447 int r;
449 int waitfor;
450 unsigned long ecode;
451 bool give_proto_hint;
453
456
458 {
460 (errcode(ERRCODE_PROTOCOL_VIOLATION),
461 errmsg("could not initialize SSL connection: SSL context not set up")));
462 return -1;
463 }
464
465
467
468
470
472 {
474 (errcode(ERRCODE_PROTOCOL_VIOLATION),
475 errmsg("could not initialize SSL connection: %s",
477 return -1;
478 }
480 {
482 (errcode(ERRCODE_PROTOCOL_VIOLATION),
483 errmsg("could not set SSL socket: %s",
485 return -1;
486 }
487
489 SSL_set_ex_data(port->ssl, 0, &err_context);
490
491 port->ssl_in_use = true;
492
493aloop:
494
495
496
497
498
499
500
501
502
503 errno = 0;
504 ERR_clear_error();
505 r = SSL_accept(port->ssl);
506 if (r <= 0)
507 {
508 err = SSL_get_error(port->ssl, r);
509
510
511
512
513
514
515
516
517
518 ecode = ERR_get_error();
519 switch (err)
520 {
521 case SSL_ERROR_WANT_READ:
522 case SSL_ERROR_WANT_WRITE:
523
525
526
527
528
529
530
531 if (err == SSL_ERROR_WANT_READ)
533 else
535
537 WAIT_EVENT_SSL_OPEN_SERVER);
538 goto aloop;
539 case SSL_ERROR_SYSCALL:
540 if (r < 0 && errno != 0)
543 errmsg("could not accept SSL connection: %m")));
544 else
546 (errcode(ERRCODE_PROTOCOL_VIOLATION),
547 errmsg("could not accept SSL connection: EOF detected")));
548 break;
549 case SSL_ERROR_SSL:
550 switch (ERR_GET_REASON(ecode))
551 {
552
553
554
555
556
557
558
559
560
561
562
563
564
565 case SSL_R_NO_PROTOCOLS_AVAILABLE:
566 case SSL_R_UNSUPPORTED_PROTOCOL:
567 case SSL_R_BAD_PROTOCOL_VERSION_NUMBER:
568 case SSL_R_UNKNOWN_PROTOCOL:
569 case SSL_R_UNKNOWN_SSL_VERSION:
570 case SSL_R_UNSUPPORTED_SSL_VERSION:
571 case SSL_R_WRONG_SSL_VERSION:
572 case SSL_R_WRONG_VERSION_NUMBER:
573 case SSL_R_TLSV1_ALERT_PROTOCOL_VERSION:
574#ifdef SSL_R_VERSION_TOO_HIGH
575 case SSL_R_VERSION_TOO_HIGH:
576#endif
577#ifdef SSL_R_VERSION_TOO_LOW
578 case SSL_R_VERSION_TOO_LOW:
579#endif
580 give_proto_hint = true;
581 break;
582 default:
583 give_proto_hint = false;
584 break;
585 }
587 (errcode(ERRCODE_PROTOCOL_VIOLATION),
588 errmsg("could not accept SSL connection: %s",
591 give_proto_hint ?
592 errhint("This may indicate that the client does not support any SSL protocol version between %s and %s.",
595 MIN_OPENSSL_TLS_VERSION,
598 MAX_OPENSSL_TLS_VERSION) : 0));
601 break;
602 case SSL_ERROR_ZERO_RETURN:
604 (errcode(ERRCODE_PROTOCOL_VIOLATION),
605 errmsg("could not accept SSL connection: EOF detected")));
606 break;
607 default:
609 (errcode(ERRCODE_PROTOCOL_VIOLATION),
610 errmsg("unrecognized SSL error code: %d",
612 break;
613 }
614 return -1;
615 }
616
617
618 port->alpn_used = false;
619 {
620 const unsigned char *selected;
621 unsigned int len;
622
623 SSL_get0_alpn_selected(port->ssl, &selected, &len);
624
625
626 if (selected != NULL)
627 {
630 {
631 port->alpn_used = true;
632 }
633 else
634 {
635
637 (errcode(ERRCODE_PROTOCOL_VIOLATION),
638 errmsg("received SSL connection request with unexpected ALPN protocol")));
639 }
640 }
641 }
642
643
644 port->peer = SSL_get_peer_certificate(port->ssl);
645
646
647 port->peer_cn = NULL;
648 port->peer_dn = NULL;
649 port->peer_cert_valid = false;
650 if (port->peer != NULL)
651 {
653 X509_NAME *x509name = X509_get_subject_name(port->peer);
654 char *peer_dn;
655 BIO *bio = NULL;
656 BUF_MEM *bio_buf = NULL;
657
658 len = X509_NAME_get_text_by_NID(x509name, NID_commonName, NULL, 0);
659 if (len != -1)
660 {
661 char *peer_cn;
662
664 r = X509_NAME_get_text_by_NID(x509name, NID_commonName, peer_cn,
665 len + 1);
666 peer_cn[len] = '\0';
667 if (r != len)
668 {
669
671 return -1;
672 }
673
674
675
676
677
678 if (len != strlen(peer_cn))
679 {
681 (errcode(ERRCODE_PROTOCOL_VIOLATION),
682 errmsg("SSL certificate's common name contains embedded null")));
684 return -1;
685 }
686
687 port->peer_cn = peer_cn;
688 }
689
690 bio = BIO_new(BIO_s_mem());
691 if (!bio)
692 {
693 if (port->peer_cn != NULL)
694 {
696 port->peer_cn = NULL;
697 }
698 return -1;
699 }
700
701
702
703
704
705
706
707
708 if (X509_NAME_print_ex(bio, x509name, 0, XN_FLAG_RFC2253) == -1 ||
709 BIO_get_mem_ptr(bio, &bio_buf) <= 0)
710 {
711 BIO_free(bio);
712 if (port->peer_cn != NULL)
713 {
715 port->peer_cn = NULL;
716 }
717 return -1;
718 }
720 memcpy(peer_dn, bio_buf->data, bio_buf->length);
721 len = bio_buf->length;
722 BIO_free(bio);
723 peer_dn[len] = '\0';
724 if (len != strlen(peer_dn))
725 {
727 (errcode(ERRCODE_PROTOCOL_VIOLATION),
728 errmsg("SSL certificate's distinguished name contains embedded null")));
730 if (port->peer_cn != NULL)
731 {
733 port->peer_cn = NULL;
734 }
735 return -1;
736 }
737
738 port->peer_dn = peer_dn;
739
740 port->peer_cert_valid = true;
741 }
742
743 return 0;
744}
745
746void
748{
749 if (port->ssl)
750 {
751 SSL_shutdown(port->ssl);
752 SSL_free(port->ssl);
753 port->ssl = NULL;
754 port->ssl_in_use = false;
755 }
756
757 if (port->peer)
758 {
759 X509_free(port->peer);
760 port->peer = NULL;
761 }
762
763 if (port->peer_cn)
764 {
766 port->peer_cn = NULL;
767 }
768
769 if (port->peer_dn)
770 {
772 port->peer_dn = NULL;
773 }
774}
775
776ssize_t
778{
779 ssize_t n;
781 unsigned long ecode;
782
783 errno = 0;
784 ERR_clear_error();
785 n = SSL_read(port->ssl, ptr, len);
786 err = SSL_get_error(port->ssl, n);
787 ecode = (err != SSL_ERROR_NONE || n < 0) ? ERR_get_error() : 0;
788 switch (err)
789 {
790 case SSL_ERROR_NONE:
791
792 break;
793 case SSL_ERROR_WANT_READ:
796 n = -1;
797 break;
798 case SSL_ERROR_WANT_WRITE:
801 n = -1;
802 break;
803 case SSL_ERROR_SYSCALL:
804
805 if (n != -1 || errno == 0)
806 {
808 n = -1;
809 }
810 break;
811 case SSL_ERROR_SSL:
813 (errcode(ERRCODE_PROTOCOL_VIOLATION),
816 n = -1;
817 break;
818 case SSL_ERROR_ZERO_RETURN:
819
820 n = 0;
821 break;
822 default:
824 (errcode(ERRCODE_PROTOCOL_VIOLATION),
825 errmsg("unrecognized SSL error code: %d",
828 n = -1;
829 break;
830 }
831
832 return n;
833}
834
835ssize_t
837{
838 ssize_t n;
840 unsigned long ecode;
841
842 errno = 0;
843 ERR_clear_error();
844 n = SSL_write(port->ssl, ptr, len);
845 err = SSL_get_error(port->ssl, n);
846 ecode = (err != SSL_ERROR_NONE || n < 0) ? ERR_get_error() : 0;
847 switch (err)
848 {
849 case SSL_ERROR_NONE:
850
851 break;
852 case SSL_ERROR_WANT_READ:
855 n = -1;
856 break;
857 case SSL_ERROR_WANT_WRITE:
860 n = -1;
861 break;
862 case SSL_ERROR_SYSCALL:
863
864
865
866
867
868
869
870 if (n != -1 || errno == 0)
871 {
873 n = -1;
874 }
875 break;
876 case SSL_ERROR_SSL:
878 (errcode(ERRCODE_PROTOCOL_VIOLATION),
881 n = -1;
882 break;
883 case SSL_ERROR_ZERO_RETURN:
884
885
886
887
888
890 n = -1;
891 break;
892 default:
894 (errcode(ERRCODE_PROTOCOL_VIOLATION),
895 errmsg("unrecognized SSL error code: %d",
898 n = -1;
899 break;
900 }
901
902 return n;
903}
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
922
923static int
925{
926 int res = 0;
928
929 if (buf != NULL)
930 {
932 BIO_clear_retry_flags(h);
933 port->last_read_was_eof = res == 0;
934 if (res <= 0)
935 {
936
938 {
939 BIO_set_retry_read(h);
940 }
941 }
942 }
943
944 return res;
945}
946
947static int
949{
950 int res = 0;
951
953 BIO_clear_retry_flags(h);
954 if (res <= 0)
955 {
956
958 {
959 BIO_set_retry_write(h);
960 }
961 }
962
963 return res;
964}
965
966static long
968{
969 long res;
971
972 switch (cmd)
973 {
974 case BIO_CTRL_EOF:
975
976
977
978
979
980
981
982 res = port->last_read_was_eof;
983 break;
984 case BIO_CTRL_FLUSH:
985
986 res = 1;
987 break;
988 default:
989 res = 0;
990 break;
991 }
992
993 return res;
994}
995
996static BIO_METHOD *
998{
1000 {
1001 int my_bio_index;
1002
1003 my_bio_index = BIO_get_new_index();
1004 if (my_bio_index == -1)
1005 return NULL;
1006 my_bio_index |= BIO_TYPE_SOURCE_SINK;
1007 port_bio_method_ptr = BIO_meth_new(my_bio_index, "PostgreSQL backend socket");
1009 return NULL;
1013 {
1016 return NULL;
1017 }
1018 }
1020}
1021
1022static int
1024{
1025 BIO *bio;
1026 BIO_METHOD *bio_method;
1027
1029 if (bio_method == NULL)
1030 return 0;
1031
1032 bio = BIO_new(bio_method);
1033 if (bio == NULL)
1034 return 0;
1035
1036 BIO_set_data(bio, port);
1037 BIO_set_init(bio, 1);
1038
1039 SSL_set_bio(port->ssl, bio, bio);
1040 return 1;
1041}
1042
1043
1044
1045
1046
1047
1048
1049
1050static DH *
1052{
1053 FILE *fp;
1054 DH *dh = NULL;
1055 int codes;
1056
1057
1059 {
1062 errmsg("could not open DH parameters file \"%s\": %m",
1064 return NULL;
1065 }
1066
1067 dh = PEM_read_DHparams(fp, NULL, NULL, NULL);
1069
1070 if (dh == NULL)
1071 {
1073 (errcode(ERRCODE_CONFIG_FILE_ERROR),
1074 errmsg("could not load DH parameters file: %s",
1076 return NULL;
1077 }
1078
1079
1080 if (DH_check(dh, &codes) == 0)
1081 {
1083 (errcode(ERRCODE_CONFIG_FILE_ERROR),
1084 errmsg("invalid DH parameters: %s",
1086 DH_free(dh);
1087 return NULL;
1088 }
1089 if (codes & DH_CHECK_P_NOT_PRIME)
1090 {
1092 (errcode(ERRCODE_CONFIG_FILE_ERROR),
1093 errmsg("invalid DH parameters: p is not prime")));
1094 DH_free(dh);
1095 return NULL;
1096 }
1097 if ((codes & DH_NOT_SUITABLE_GENERATOR) &&
1098 (codes & DH_CHECK_P_NOT_SAFE_PRIME))
1099 {
1101 (errcode(ERRCODE_CONFIG_FILE_ERROR),
1102 errmsg("invalid DH parameters: neither suitable generator or safe prime")));
1103 DH_free(dh);
1104 return NULL;
1105 }
1106
1107 return dh;
1108}
1109
1110
1111
1112
1113
1114
1115
1116
1117static DH *
1119{
1120 BIO *bio;
1121 DH *dh = NULL;
1122
1123 bio = BIO_new_mem_buf(buffer, len);
1124 if (bio == NULL)
1125 return NULL;
1126 dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
1127 if (dh == NULL)
1131 BIO_free(bio);
1132
1133 return dh;
1134}
1135
1136
1137
1138
1139static int
1141{
1142
1143 const char *prompt = "Enter PEM pass phrase:";
1144
1145 Assert(rwflag == 0);
1146
1148}
1149
1150
1151
1152
1153
1154
1155
1156
1157
1158
1159static int
1161{
1162
1164
1166 buf[0] = '\0';
1167 return 0;
1168}
1169
1170
1171
1172
1173
1174
1175
1176static char *
1178{
1179 size_t namelen = strlen(name);
1180 char *truncated = name;
1181
1182
1183
1184
1185
1186
1187
1188#define MAXLEN 71
1189
1190 if (namelen > MAXLEN)
1191 {
1192
1193
1194
1195
1196 truncated = name + namelen - MAXLEN;
1197 truncated[0] = truncated[1] = truncated[2] = '.';
1199 }
1200
1201#undef MAXLEN
1202
1204}
1205
1206
1207
1208
1209
1210
1211
1212
1213
1214
1215
1216static int
1218{
1219 int depth;
1221 const char *errstring;
1223 X509 *cert;
1224 SSL *ssl;
1226
1227 if (ok)
1228 {
1229
1230 return ok;
1231 }
1232
1233
1234 depth = X509_STORE_CTX_get_error_depth(ctx);
1235 errcode = X509_STORE_CTX_get_error(ctx);
1236 errstring = X509_verify_cert_error_string(errcode);
1237
1238
1239
1240
1241
1242 ssl = X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx());
1243 cb_err = (struct CallbackErr *) SSL_get_ex_data(ssl, 0);
1244
1247 _("Client certificate verification failed at depth %d: %s."),
1248 depth, errstring);
1249
1250 cert = X509_STORE_CTX_get_current_cert(ctx);
1251 if (cert)
1252 {
1253 char *subject,
1254 *issuer;
1255 char *sub_prepared,
1256 *iss_prepared;
1257 char *serialno;
1258 ASN1_INTEGER *sn;
1259 BIGNUM *b;
1260
1261
1262
1263
1264
1265
1269
1273
1274
1275
1276
1277
1278 sn = X509_get_serialNumber(cert);
1279 b = ASN1_INTEGER_to_BN(sn, NULL);
1280 serialno = BN_bn2dec(b);
1281
1284 _("Failed certificate data (unverified): subject \"%s\", serial number %s, issuer \"%s\"."),
1285 sub_prepared, serialno ? serialno : _("unknown"),
1286 iss_prepared);
1287
1288 BN_free(b);
1289 OPENSSL_free(serialno);
1290 pfree(iss_prepared);
1291 pfree(sub_prepared);
1292 }
1293
1294
1296
1297 return ok;
1298}
1299
1300
1301
1302
1303
1304static void
1306{
1307 const char *desc;
1308
1309 desc = SSL_state_string_long(ssl);
1310
1311 switch (type)
1312 {
1313 case SSL_CB_HANDSHAKE_START:
1315 (errmsg_internal("SSL: handshake start: \"%s\"", desc)));
1316 break;
1317 case SSL_CB_HANDSHAKE_DONE:
1319 (errmsg_internal("SSL: handshake done: \"%s\"", desc)));
1320 break;
1321 case SSL_CB_ACCEPT_LOOP:
1324 break;
1325 case SSL_CB_ACCEPT_EXIT:
1328 break;
1329 case SSL_CB_CONNECT_LOOP:
1332 break;
1333 case SSL_CB_CONNECT_EXIT:
1336 break;
1337 case SSL_CB_READ_ALERT:
1340 break;
1341 case SSL_CB_WRITE_ALERT:
1344 break;
1345 }
1346}
1347
1348
1350
1351
1352
1353
1354
1355static int
1357 const unsigned char **out,
1358 unsigned char *outlen,
1359 const unsigned char *in,
1360 unsigned int inlen,
1361 void *userdata)
1362{
1363
1364
1365
1366
1367
1368 int retval;
1369
1370 Assert(userdata != NULL);
1371 Assert(out != NULL);
1372 Assert(outlen != NULL);
1374
1375 retval = SSL_select_next_proto((unsigned char **) out, outlen,
1377 in, inlen);
1378 if (*out == NULL || *outlen > sizeof(alpn_protos) || *outlen <= 0)
1379 return SSL_TLSEXT_ERR_NOACK;
1380
1381 if (retval == OPENSSL_NPN_NEGOTIATED)
1382 return SSL_TLSEXT_ERR_OK;
1383 else
1384 {
1385
1386
1387
1388
1389 return SSL_TLSEXT_ERR_ALERT_FATAL;
1390 }
1391}
1392
1393
1394
1395
1396
1397
1398
1399
1400
1401
1402
1403
1404
1405
1406
1407static bool
1409{
1410 DH *dh = NULL;
1411
1412 SSL_CTX_set_options(context, SSL_OP_SINGLE_DH_USE);
1413
1416 if (!dh)
1417 dh = load_dh_buffer(FILE_DH2048, sizeof(FILE_DH2048));
1418 if (!dh)
1419 {
1421 (errcode(ERRCODE_CONFIG_FILE_ERROR),
1422 errmsg("DH: could not load DH parameters")));
1423 return false;
1424 }
1425
1426 if (SSL_CTX_set_tmp_dh(context, dh) != 1)
1427 {
1429 (errcode(ERRCODE_CONFIG_FILE_ERROR),
1430 errmsg("DH: could not set DH parameters: %s",
1432 DH_free(dh);
1433 return false;
1434 }
1435
1436 DH_free(dh);
1437 return true;
1438}
1439
1440
1441
1442
1443
1444
1445static bool
1447{
1448#ifndef OPENSSL_NO_ECDH
1449 if (SSL_CTX_set1_groups_list(context, SSLECDHCurve) != 1)
1450 {
1451
1452
1453
1454
1455
1456
1457
1459 errcode(ERRCODE_CONFIG_FILE_ERROR),
1460 errmsg("could not set group names specified in ssl_groups: %s",
1462 _("No valid groups found"))),
1463 errhint("Ensure that each group name is spelled correctly and supported by the installed version of OpenSSL."));
1464 return false;
1465 }
1466#endif
1467
1468 return true;
1469}
1470
1471
1472
1473
1474
1475
1476
1477
1478
1479
1480
1481
1482
1483
1484static const char *
1486{
1487 if (ecode == 0)
1488 return replacement;
1489 else
1491}
1492
1493
1494
1495
1496
1497
1498
1499
1500
1501
1502static const char *
1504{
1505 const char *errreason;
1506 static char errbuf[36];
1507
1508 if (ecode == 0)
1509 return _("no SSL error reported");
1510 errreason = ERR_reason_error_string(ecode);
1511 if (errreason != NULL)
1512 return errreason;
1513
1514
1515
1516
1517
1518
1519
1520
1521#ifdef ERR_SYSTEM_ERROR
1522 if (ERR_SYSTEM_ERROR(ecode))
1523 return strerror(ERR_GET_REASON(ecode));
1524#endif
1525
1526
1527 snprintf(errbuf, sizeof(errbuf), _("SSL error code %lu"), ecode);
1528 return errbuf;
1529}
1530
1531int
1533{
1534 int bits;
1535
1536 if (port->ssl)
1537 {
1538 SSL_get_cipher_bits(port->ssl, &bits);
1539 return bits;
1540 }
1541 else
1542 return 0;
1543}
1544
1545const char *
1547{
1548 if (port->ssl)
1549 return SSL_get_version(port->ssl);
1550 else
1551 return NULL;
1552}
1553
1554const char *
1556{
1557 if (port->ssl)
1558 return SSL_get_cipher(port->ssl);
1559 else
1560 return NULL;
1561}
1562
1563void
1565{
1566 if (port->peer)
1568 else
1569 ptr[0] = '\0';
1570}
1571
1572void
1574{
1575 if (port->peer)
1577 else
1578 ptr[0] = '\0';
1579}
1580
1581void
1583{
1584 if (port->peer)
1585 {
1586 ASN1_INTEGER *serial;
1587 BIGNUM *b;
1589
1590 serial = X509_get_serialNumber(port->peer);
1591 b = ASN1_INTEGER_to_BN(serial, NULL);
1593
1594 BN_free(b);
1597 }
1598 else
1599 ptr[0] = '\0';
1600}
1601
1602char *
1604{
1605 X509 *server_cert;
1606 char *cert_hash;
1607 const EVP_MD *algo_type = NULL;
1608 unsigned char hash[EVP_MAX_MD_SIZE];
1609 unsigned int hash_size;
1610 int algo_nid;
1611
1612 *len = 0;
1613 server_cert = SSL_get_certificate(port->ssl);
1614 if (server_cert == NULL)
1615 return NULL;
1616
1617
1618
1619
1620
1621
1622#if HAVE_X509_GET_SIGNATURE_INFO
1623 if (!X509_get_signature_info(server_cert, &algo_nid, NULL, NULL, NULL))
1624#else
1625 if (!OBJ_find_sigid_algs(X509_get_signature_nid(server_cert),
1626 &algo_nid, NULL))
1627#endif
1628 elog(ERROR, "could not determine server certificate signature algorithm");
1629
1630
1631
1632
1633
1634
1635
1636 switch (algo_nid)
1637 {
1638 case NID_md5:
1639 case NID_sha1:
1640 algo_type = EVP_sha256();
1641 break;
1642 default:
1643 algo_type = EVP_get_digestbynid(algo_nid);
1644 if (algo_type == NULL)
1645 elog(ERROR, "could not find digest for NID %s",
1646 OBJ_nid2sn(algo_nid));
1647 break;
1648 }
1649
1650
1651 if (!X509_digest(server_cert, algo_type, hash, &hash_size))
1652 elog(ERROR, "could not generate server certificate hash");
1653
1654 cert_hash = palloc(hash_size);
1655 memcpy(cert_hash, hash, hash_size);
1656 *len = hash_size;
1657
1658 return cert_hash;
1659}
1660
1661
1662
1663
1664
1665static char *
1667{
1668 BIO *membuf = BIO_new(BIO_s_mem());
1669 int i,
1670 nid,
1671 count = X509_NAME_entry_count(name);
1672 X509_NAME_ENTRY *e;
1673 ASN1_STRING *v;
1674 const char *field_name;
1675 size_t size;
1676 char nullterm;
1677 char *sp;
1678 char *dp;
1679 char *result;
1680
1681 if (membuf == NULL)
1683 (errcode(ERRCODE_OUT_OF_MEMORY),
1684 errmsg("could not create BIO")));
1685
1686 (void) BIO_set_close(membuf, BIO_CLOSE);
1687 for (i = 0; i < count; i++)
1688 {
1689 e = X509_NAME_get_entry(name, i);
1690 nid = OBJ_obj2nid(X509_NAME_ENTRY_get_object(e));
1691 if (nid == NID_undef)
1693 (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
1694 errmsg("could not get NID for ASN1_OBJECT object")));
1695 v = X509_NAME_ENTRY_get_data(e);
1696 field_name = OBJ_nid2sn(nid);
1697 if (field_name == NULL)
1698 field_name = OBJ_nid2ln(nid);
1699 if (field_name == NULL)
1701 (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
1702 errmsg("could not convert NID %d to an ASN1_OBJECT structure", nid)));
1703 BIO_printf(membuf, "/%s=", field_name);
1704 ASN1_STRING_print_ex(membuf, v,
1705 ((ASN1_STRFLGS_RFC2253 & ~ASN1_STRFLGS_ESC_MSB)
1706 | ASN1_STRFLGS_UTF8_CONVERT));
1707 }
1708
1709
1710 nullterm = '\0';
1711 BIO_write(membuf, &nullterm, 1);
1712 size = BIO_get_mem_data(membuf, &sp);
1714
1716 if (dp != sp)
1718 if (BIO_free(membuf) != 1)
1719 elog(ERROR, "could not free OpenSSL BIO structure");
1720
1721 return result;
1722}
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738static int
1740{
1741 switch (v)
1742 {
1744 return 0;
1746 return TLS1_VERSION;
1748#ifdef TLS1_1_VERSION
1749 return TLS1_1_VERSION;
1750#else
1751 break;
1752#endif
1754#ifdef TLS1_2_VERSION
1755 return TLS1_2_VERSION;
1756#else
1757 break;
1758#endif
1760#ifdef TLS1_3_VERSION
1761 return TLS1_3_VERSION;
1762#else
1763 break;
1764#endif
1765 }
1766
1767 return -1;
1768}
1769
1770
1771
1772
1773static const char *
1775{
1776 switch (v)
1777 {
1779 return "any";
1781 return "TLSv1";
1783 return "TLSv1.1";
1785 return "TLSv1.2";
1787 return "TLSv1.3";
1788 }
1789
1790 return "(unrecognized)";
1791}
1792
1793
1794static void
1796{
1797 if (isServerStart)
1798 {
1801 }
1802 else
1803 {
1806 else
1807
1808
1809
1810
1811
1812
1813
1815 }
1816}
bool check_ssl_key_file_permissions(const char *ssl_key_file, bool isServerStart)
int run_ssl_passphrase_command(const char *prompt, bool is_server_start, char *buf, int size)
const char * be_tls_get_version(Port *port)
static const char * ssl_protocol_version_to_string(int v)
static void info_cb(const SSL *ssl, int type, int args)
static const char * SSLerrmessage(unsigned long ecode)
ssize_t be_tls_write(Port *port, const void *ptr, size_t len, int *waitfor)
void be_tls_destroy(void)
int be_tls_init(bool isServerStart)
static long port_bio_ctrl(BIO *h, int cmd, long num, void *ptr)
openssl_tls_init_hook_typ openssl_tls_init_hook
int be_tls_get_cipher_bits(Port *port)
int be_tls_open_server(Port *port)
char * be_tls_get_certificate_hash(Port *port, size_t *len)
static int alpn_cb(SSL *ssl, const unsigned char **out, unsigned char *outlen, const unsigned char *in, unsigned int inlen, void *userdata)
const char * be_tls_get_cipher(Port *port)
static const char * SSLerrmessageExt(unsigned long ecode, const char *replacement)
static DH * load_dh_buffer(const char *buffer, size_t len)
static int dummy_ssl_passwd_cb(char *buf, int size, int rwflag, void *userdata)
static void default_openssl_tls_init(SSL_CTX *context, bool isServerStart)
static int ssl_set_port_bio(Port *port)
void be_tls_get_peer_serial(Port *port, char *ptr, size_t len)
static int ssl_protocol_version_to_openssl(int v)
static bool initialize_dh(SSL_CTX *context, bool isServerStart)
void be_tls_close(Port *port)
void be_tls_get_peer_issuer_name(Port *port, char *ptr, size_t len)
ssize_t be_tls_read(Port *port, void *ptr, size_t len, int *waitfor)
static char * X509_NAME_to_cstring(X509_NAME *name)
static BIO_METHOD * port_bio_method(void)
static int ssl_external_passwd_cb(char *buf, int size, int rwflag, void *userdata)
static char * prepare_cert_name(char *name)
static SSL_CTX * SSL_context
static bool ssl_is_server_start
static int verify_cb(int ok, X509_STORE_CTX *ctx)
static BIO_METHOD * port_bio_method_ptr
static bool initialize_ecdh(SSL_CTX *context, bool isServerStart)
static int port_bio_read(BIO *h, char *buf, int size)
static int port_bio_write(BIO *h, const char *buf, int size)
static bool dummy_ssl_passwd_cb_called
static DH * load_dh_file(char *filename, bool isServerStart)
static const unsigned char alpn_protos[]
void be_tls_get_peer_subject_name(Port *port, char *ptr, size_t len)
char * ssl_dh_params_file
int ssl_min_protocol_version
ssize_t secure_raw_read(Port *port, void *ptr, size_t len)
bool SSLPreferServerCiphers
int ssl_max_protocol_version
char * ssl_passphrase_command
bool ssl_passphrase_command_supports_reload
ssize_t secure_raw_write(Port *port, const void *ptr, size_t len)
int errcode_for_socket_access(void)
int errmsg_internal(const char *fmt,...)
int errdetail_internal(const char *fmt,...)
int errcode_for_file_access(void)
int errdetail(const char *fmt,...)
int errhint(const char *fmt,...)
int errcode(int sqlerrcode)
int errmsg(const char *fmt,...)
#define ereport(elevel,...)
void err(int eval, const char *fmt,...)
FILE * AllocateFile(const char *name, const char *mode)
const char * GetConfigOption(const char *name, bool missing_ok, bool restrict_privileged)
Assert(PointerIsAligned(start, uint64))
int WaitLatchOrSocket(Latch *latch, int wakeEvents, pgsocket sock, long timeout, uint32 wait_event_info)
char * pg_any_to_server(const char *s, int len, int encoding)
void * MemoryContextAlloc(MemoryContext context, Size size)
char * pstrdup(const char *in)
void pfree(void *pointer)
MemoryContext TopMemoryContext
static char buf[DEFAULT_XLOG_SEG_SIZE]
size_t strlcpy(char *dst, const char *src, size_t siz)
#define PG_ALPN_PROTOCOL_VECTOR
static unsigned hash(unsigned *uv, int n)
char * pg_clean_ascii(const char *str, int alloc_flags)
void appendStringInfo(StringInfo str, const char *fmt,...)
void appendStringInfoChar(StringInfo str, char ch)
void initStringInfo(StringInfo str)
#define WL_SOCKET_READABLE
#define WL_EXIT_ON_PM_DEATH
#define WL_SOCKET_WRITEABLE