1berry/postgres
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Go over all OpenSSL return values and make sure we compare them

Browse Source 
to the documented API value. The previous code got it right as
it's implemented, but accepted too much/too little compared to
the API documentation.

Per comment from Zdenek Kotala.
This commit is contained in:
Magnus Hagander 2009-01-28 15:06:48 +00:00
parent d01bcba483
commit d8b324ebd8
2 changed files with 8 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/backend/libpq/be-secure.c
View File

@ -11,7 +11,7 @@
* *
* *
* IDENTIFICATION * IDENTIFICATION
* $Header: /cvsroot/pgsql/src/backend/libpq/be-secure.c,v 1.43.2.4 2007/05/18 01:20:48 tgl Exp $ * $Header: /cvsroot/pgsql/src/backend/libpq/be-secure.c,v 1.43.2.5 2009/01/28 15:06:48 mha Exp $
* *
* Since the server static private key ($DataDir/server.key) * Since the server static private key ($DataDir/server.key)
* will normally be stored unencrypted so that the database * will normally be stored unencrypted so that the database
@ -700,7 +700,7 @@ initialize_SSL(void)
* Load and verify certificate and private key * Load and verify certificate and private key
*/ */
snprintf(fnbuf, sizeof(fnbuf), "%s/server.crt", DataDir); snprintf(fnbuf, sizeof(fnbuf), "%s/server.crt", DataDir);
if (!SSL_CTX_use_certificate_file(SSL_context, fnbuf, SSL_FILETYPE_PEM)) if (SSL_CTX_use_certificate_file(SSL_context, fnbuf, SSL_FILETYPE_PEM) != 1)
ereport(FATAL, ereport(FATAL,
(errcode(ERRCODE_CONFIG_FILE_ERROR), (errcode(ERRCODE_CONFIG_FILE_ERROR),
errmsg("could not load server certificate file \"%s\": %s", errmsg("could not load server certificate file \"%s\": %s",
@ -720,12 +720,12 @@ initialize_SSL(void)
fnbuf), fnbuf),
errdetail("File must be owned by the database user and must have no permissions for \"group\" or \"other\"."))); errdetail("File must be owned by the database user and must have no permissions for \"group\" or \"other\".")));
if (!SSL_CTX_use_PrivateKey_file(SSL_context, fnbuf, SSL_FILETYPE_PEM)) if (SSL_CTX_use_PrivateKey_file(SSL_context, fnbuf, SSL_FILETYPE_PEM) != 1)
ereport(FATAL, ereport(FATAL,
(errmsg("could not load private key file \"%s\": %s", (errmsg("could not load private key file \"%s\": %s",
fnbuf, SSLerrmessage()))); fnbuf, SSLerrmessage())));
if (!SSL_CTX_check_private_key(SSL_context)) if (SSL_CTX_check_private_key(SSL_context) != 1)
ereport(FATAL, ereport(FATAL,
(errmsg("check of private key failed: %s", (errmsg("check of private key failed: %s",
SSLerrmessage()))); SSLerrmessage())));
@ -741,7 +741,7 @@ initialize_SSL(void)
/* accept client certificates, but don't require them. */ /* accept client certificates, but don't require them. */
snprintf(fnbuf, sizeof(fnbuf), "%s/root.crt", DataDir); snprintf(fnbuf, sizeof(fnbuf), "%s/root.crt", DataDir);
if (!SSL_CTX_load_verify_locations(SSL_context, fnbuf, CA_PATH)) if (SSL_CTX_load_verify_locations(SSL_context, fnbuf, CA_PATH) != 1)
{ {
/* Not fatal - we do not require client certificates */ /* Not fatal - we do not require client certificates */
ereport(LOG, ereport(LOG,

6
src/interfaces/libpq/fe-secure.c
View File

@ -11,7 +11,7 @@
* *
* *
* IDENTIFICATION * IDENTIFICATION
* $Header: /cvsroot/pgsql/src/interfaces/libpq/fe-secure.c,v 1.32.2.1 2003/12/18 22:49:34 tgl Exp $ * $Header: /cvsroot/pgsql/src/interfaces/libpq/fe-secure.c,v 1.32.2.2 2009/01/28 15:06:48 mha Exp $
* *
* NOTES * NOTES
* The client *requires* a valid server certificate. Since * The client *requires* a valid server certificate. Since
@ -788,7 +788,7 @@ client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
fclose(fp); fclose(fp);
/* verify that the cert and key go together */ /* verify that the cert and key go together */
if (!X509_check_private_key(*x509, *pkey)) if (X509_check_private_key(*x509, *pkey) != 1)
{ {
printfPQExpBuffer(&conn->errorMessage, printfPQExpBuffer(&conn->errorMessage,
libpq_gettext("certificate/private key mismatch (%s): %s\n"), libpq_gettext("certificate/private key mismatch (%s): %s\n"),
@ -848,7 +848,7 @@ initialize_SSL(PGconn *conn)
return -1; return -1;
#endif #endif
} }
if (!SSL_CTX_load_verify_locations(SSL_context, fnbuf, 0)) if (SSL_CTX_load_verify_locations(SSL_context, fnbuf, 0) != 1)
{ {
printfPQExpBuffer(&conn->errorMessage, printfPQExpBuffer(&conn->errorMessage,
libpq_gettext("could not read root certificate list (%s): %s\n"), libpq_gettext("could not read root certificate list (%s): %s\n"),