database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-30 11:03:19 +03:00
Code Activity

Another attempt at fixing build with various OpenSSL versions

Browse Source 
It seems we can't easily work around the lack of
X509_get_signature_nid(), so revert the previous attempts and just
disable the tls-server-end-point feature if we don't have it.
This commit is contained in:
Peter Eisentraut
2018-01-04 19:09:27 -05:00
parent 1834c1e432
commit 054e8c6cdb
5 changed files with 24 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/backend/libpq/be-secure-openssl.c
View File

@ -57,7 +57,6 @@
#ifndef OPENSSL_NO_ECDH
#include <openssl/ec.h>
#endif
#include <openssl/x509.h>
#include "libpq/libpq.h"
#include "miscadmin.h"
@ -1250,6 +1249,7 @@ be_tls_get_peer_finished(Port *port, size_t *len)
char *
be_tls_get_certificate_hash(Port *port, size_t *len)
{
#ifdef HAVE_X509_GET_SIGNATURE_NID
X509 *server_cert;
char *cert_hash;
const EVP_MD *algo_type = NULL;
@ -1266,7 +1266,7 @@ be_tls_get_certificate_hash(Port *port, size_t *len)
* Get the signature algorithm of the certificate to determine the
* hash algorithm to use for the result.
*/
if (!OBJ_find_sigid_algs(OBJ_obj2nid(server_cert->sig_alg->algorithm),
if (!OBJ_find_sigid_algs(X509_get_signature_nid(server_cert),
&algo_nid, NULL))
elog(ERROR, "could not determine server certificate signature algorithm");
@ -1299,6 +1299,12 @@ be_tls_get_certificate_hash(Port *port, size_t *len)
*len = hash_size;
return cert_hash;
#else
ereport(ERROR,
(errcode(ERRCODE_PROTOCOL_VIOLATION),
errmsg("channel binding type \"tls-server-end-point\" is not supported by this build")));
return NULL;
#endif
}
/*

3
src/include/pg_config.h.in
View File

@ -681,6 +681,9 @@
/* Define to 1 if you have the <winldap.h> header file. */
#undef HAVE_WINLDAP_H
/* Define to 1 if you have the `X509_get_signature_nid' function. */
#undef HAVE_X509_GET_SIGNATURE_NID
/* Define to 1 if your compiler understands __builtin_bswap16. */
#undef HAVE__BUILTIN_BSWAP16

9
src/interfaces/libpq/fe-secure-openssl.c
View File

@ -58,7 +58,6 @@
#ifdef USE_SSL_ENGINE
#include <openssl/engine.h>
#endif
#include <openssl/x509.h>
#include <openssl/x509v3.h>
static bool verify_peer_name_matches_certificate(PGconn *);
@ -430,6 +429,7 @@ pgtls_get_finished(PGconn *conn, size_t *len)
char *
pgtls_get_peer_certificate_hash(PGconn *conn, size_t *len)
{
#ifdef HAVE_X509_GET_SIGNATURE_NID
X509 *peer_cert;
const EVP_MD *algo_type;
unsigned char hash[EVP_MAX_MD_SIZE]; /* size for SHA-512 */
@ -448,7 +448,7 @@ pgtls_get_peer_certificate_hash(PGconn *conn, size_t *len)
* Get the signature algorithm of the certificate to determine the hash
* algorithm to use for the result.
*/
if (!OBJ_find_sigid_algs(OBJ_obj2nid(peer_cert->sig_alg->algorithm),
if (!OBJ_find_sigid_algs(X509_get_signature_nid(peer_cert),
&algo_nid, NULL))
{
printfPQExpBuffer(&conn->errorMessage,
@ -499,6 +499,11 @@ pgtls_get_peer_certificate_hash(PGconn *conn, size_t *len)
*len = hash_size;
return cert_hash;
#else
printfPQExpBuffer(&conn->errorMessage,
libpq_gettext("channel binding type \"tls-server-end-point\" is not supported by this build\n"));
return NULL;
#endif
}
/* ------------------------------------------------------------ */