database/postgres
database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-04-25 21:42:33 +03:00
Code

Go over all OpenSSL return values and make sure we compare them

Browse Source 
to the documented API value. The previous code got it right as
it's implemented, but accepted too much/too little compared to
the API documentation.

Per comment from Zdenek Kotala.
This commit is contained in:
Magnus Hagander 2009-01-28 15:06:47 +00:00
parent 1ab7dc0630
commit 16c46d5d7a
2 changed files with 12 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
src/backend/libpq/be-secure.c
View File

@ -11,7 +11,7 @@
* *
* *
* IDENTIFICATION * IDENTIFICATION
* $PostgreSQL: pgsql/src/backend/libpq/be-secure.c,v 1.89 2009/01/01 17:23:42 momjian Exp $ * $PostgreSQL: pgsql/src/backend/libpq/be-secure.c,v 1.90 2009/01/28 15:06:47 mha Exp $
* *
* Since the server static private key ($DataDir/server.key) * Since the server static private key ($DataDir/server.key)
* will normally be stored unencrypted so that the database * will normally be stored unencrypted so that the database
@ -729,9 +729,9 @@ initialize_SSL(void)
/* /*
* Load and verify certificate and private key * Load and verify certificate and private key
*/ */
if (!SSL_CTX_use_certificate_file(SSL_context, if (SSL_CTX_use_certificate_file(SSL_context,
SERVER_CERT_FILE, SERVER_CERT_FILE,
SSL_FILETYPE_PEM)) SSL_FILETYPE_PEM) != 1)
ereport(FATAL, ereport(FATAL,
(errcode(ERRCODE_CONFIG_FILE_ERROR), (errcode(ERRCODE_CONFIG_FILE_ERROR),
errmsg("could not load server certificate file \"%s\": %s", errmsg("could not load server certificate file \"%s\": %s",
@ -760,14 +760,14 @@ initialize_SSL(void)
errdetail("Permissions should be u=rw (0600) or less."))); errdetail("Permissions should be u=rw (0600) or less.")));
#endif #endif
if (!SSL_CTX_use_PrivateKey_file(SSL_context, if (SSL_CTX_use_PrivateKey_file(SSL_context,
SERVER_PRIVATE_KEY_FILE, SERVER_PRIVATE_KEY_FILE,
SSL_FILETYPE_PEM)) SSL_FILETYPE_PEM) != 1)
ereport(FATAL, ereport(FATAL,
(errmsg("could not load private key file \"%s\": %s", (errmsg("could not load private key file \"%s\": %s",
SERVER_PRIVATE_KEY_FILE, SSLerrmessage()))); SERVER_PRIVATE_KEY_FILE, SSLerrmessage())));
if (!SSL_CTX_check_private_key(SSL_context)) if (SSL_CTX_check_private_key(SSL_context) != 1)
ereport(FATAL, ereport(FATAL,
(errmsg("check of private key failed: %s", (errmsg("check of private key failed: %s",
SSLerrmessage()))); SSLerrmessage())));
@ -800,7 +800,7 @@ initialize_SSL(void)
ROOT_CERT_FILE))); ROOT_CERT_FILE)));
} }
} }
else if (!SSL_CTX_load_verify_locations(SSL_context, ROOT_CERT_FILE, NULL)) else if (SSL_CTX_load_verify_locations(SSL_context, ROOT_CERT_FILE, NULL) != 1)
{ {
/* /*
* File was there, but we could not load it. This means the file is somehow * File was there, but we could not load it. This means the file is somehow
@ -823,7 +823,7 @@ initialize_SSL(void)
if (cvstore) if (cvstore)
{ {
/* Set the flags to check against the complete CRL chain */ /* Set the flags to check against the complete CRL chain */
if (X509_STORE_load_locations(cvstore, ROOT_CRL_FILE, NULL) != 0) if (X509_STORE_load_locations(cvstore, ROOT_CRL_FILE, NULL) == 1)
/* OpenSSL 0.96 does not support X509_V_FLAG_CRL_CHECK */ /* OpenSSL 0.96 does not support X509_V_FLAG_CRL_CHECK */
#ifdef X509_V_FLAG_CRL_CHECK #ifdef X509_V_FLAG_CRL_CHECK
X509_STORE_set_flags(cvstore, X509_STORE_set_flags(cvstore,

8
src/interfaces/libpq/fe-secure.c
View File

@ -11,7 +11,7 @@
* *
* *
* IDENTIFICATION * IDENTIFICATION
* $PostgreSQL: pgsql/src/interfaces/libpq/fe-secure.c,v 1.118 2009/01/19 17:17:50 tgl Exp $ * $PostgreSQL: pgsql/src/interfaces/libpq/fe-secure.c,v 1.119 2009/01/28 15:06:47 mha Exp $
* *
* NOTES * NOTES
* *
@ -757,7 +757,7 @@ client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
} }
/* verify that the cert and key go together */ /* verify that the cert and key go together */
if (!X509_check_private_key(*x509, *pkey)) if (X509_check_private_key(*x509, *pkey) != 1)
{ {
char *err = SSLerrmessage(); char *err = SSLerrmessage();
@ -1004,7 +1004,7 @@ initialize_SSL(PGconn *conn)
{ {
X509_STORE *cvstore; X509_STORE *cvstore;
if (!SSL_CTX_load_verify_locations(SSL_context, fnbuf, NULL)) if (SSL_CTX_load_verify_locations(SSL_context, fnbuf, NULL) != 1)
{ {
char *err = SSLerrmessage(); char *err = SSLerrmessage();
@ -1023,7 +1023,7 @@ initialize_SSL(PGconn *conn)
snprintf(fnbuf, sizeof(fnbuf), "%s/%s", homedir, ROOT_CRL_FILE); snprintf(fnbuf, sizeof(fnbuf), "%s/%s", homedir, ROOT_CRL_FILE);
/* setting the flags to check against the complete CRL chain */ /* setting the flags to check against the complete CRL chain */
if (X509_STORE_load_locations(cvstore, fnbuf, NULL) != 0) if (X509_STORE_load_locations(cvstore, fnbuf, NULL) == 1)
/* OpenSSL 0.96 does not support X509_V_FLAG_CRL_CHECK */ /* OpenSSL 0.96 does not support X509_V_FLAG_CRL_CHECK */
#ifdef X509_V_FLAG_CRL_CHECK #ifdef X509_V_FLAG_CRL_CHECK
X509_STORE_set_flags(cvstore, X509_STORE_set_flags(cvstore,