8000 Rearrange libpq's SSL initialization to simplify it and make it handl… · postgres/postgres@4ed4b6c · GitHub
[go: up one dir, main page]
Skip to content

Commit 4ed4b6c

Browse files
tglsfdctglsfdc
committed
Rearrange libpq's SSL initialization to simplify it and make it handle some
additional cases correctly. The original coding failed to load additional (chain) certificates from the client cert file, meaning that indirectly signed client certificates didn't work unless one hacked the server's root.crt file to include intermediate CAs (not the desired approach). Another problem was that everything got loaded into the shared SSL_context object, which meant that concurrent connections trying to use different sslcert settings could well fail due to conflicting over the single available slot for a keyed certificate. To fix, get rid of the use of SSL_CTX_set_client_cert_cb(), which is deprecated anyway in the OpenSSL documentation, and instead just unconditionally load the client cert and private key during connection initialization. This lets us use SSL_CTX_use_certificate_chain_file(), which does the right thing with additional certs, and is lots simpler than the previous hacking about with BIO-level access. A small disadvantage is that we have to load the primary client cert a second time with SSL_use_certificate_file, so that that one ends up in the correct slot within the connection's SSL object where it can get paired with the key. Given the other overhead of making an SSL connection, that doesn't seem worth worrying about. Per discussion ensuing from bug #5468.
1 parent 0d046a4 commit 4ed4b6c

File tree

2 files changed

+275
< 8000 div class="ml-1 text-small text-bold fgColor-danger">-329
lines changed

2 files changed

+275
-329
lines changed

‎src/interfaces/libpq/fe-connect.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
*
99
*
1010
* IDENTIFICATION
11-
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-connect.c,v 1.392 2010/04/30 17:09:13 tgl Exp $
11+
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-connect.c,v 1.393 2010/05/26 21:39:27 tgl Exp $
1212
*
1313
*-------------------------------------------------------------------------
1414
*/
@@ -1623,7 +1623,7 @@ PQconnectPoll(PGconn *conn)
16231623
if (SSLok == 'S')
16241624
{
16251625
/* Set up global SSL state if required */
1626-
if (pqsecure_initialize(conn) == -1)
1626+
if (pqsecure_initialize(conn) != 0)
16271627
goto error_return;
16281628
}
16291629
else if (SSLok == 'N')

0 commit comments

Comments
 (0)
0