database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-28 23:42:10 +03:00
Code Activity

pgcrypto: Make it possible to disable built-in crypto

Browse Source 
When using OpenSSL and/or the underlying operating system in FIPS
mode no non-FIPS certified crypto implementations should be used.
While that is already possible by just not invoking the built-in
crypto in pgcrypto, this adds a GUC which prohibit the code from
being called.  This doesn't change the FIPS status of PostgreSQL
but can make it easier for sites which target FIPS compliance to
ensure that violations cannot occur.

Author: Daniel Gustafsson <daniel@yesql.se>
Author: Joe Conway <mail@joeconway.com>
Reviewed-by: Joe Conway <mail@joeconway.com>
Reviewed-by: Peter Eisentraut <peter@eisentraut.org>
Reviewed-by: Hayato Kuroda <kuroda.hayato@fujitsu.com>
Discussion: https://postgr.es/m/16b4a157-9ea1-44d0-b7b3-4c85df5de97b@joeconway.com
This commit is contained in:
Daniel Gustafsson
2025-01-24 14:25:08 +01:00
parent 924d89a354
commit 035f99cbeb
7 changed files with 121 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
contrib/pgcrypto/openssl.c
View File

@ -31,6 +31,7 @@
#include "postgres.h"
#include <openssl/crypto.h>
#include <openssl/evp.h>
#include <openssl/err.h>
#include <openssl/rand.h>
@ -821,3 +822,28 @@ CheckFIPSMode(void)
return (fips_enabled == 1);
}
/*
* CheckBuiltinCryptoMode
*
* Function for erroring out in case built-in crypto is executed when the user
* has disabled it. If builtin_crypto_enabled is set to BC_OFF or BC_FIPS and
* OpenSSL is operating in FIPS mode the function will error out, else the
* query executing built-in crypto can proceed.
*/
void
CheckBuiltinCryptoMode(void)
{
if (builtin_crypto_enabled == BC_ON)
return;
if (builtin_crypto_enabled == BC_OFF)
ereport(ERROR,
errmsg("use of built-in crypto functions is disabled"));
Assert(builtin_crypto_enabled == BC_FIPS);
if (CheckFIPSMode() == true)
ereport(ERROR,
errmsg("use of non-FIPS validated crypto not allowed when OpenSSL is in FIPS mode"));
}