database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-09 22:41:56 +03:00
Code Activity

Change SHA2 implementation based on OpenSSL to use EVP digest routines

Browse Source 
The use of low-level hash routines is not recommended by upstream
OpenSSL since 2000, and pgcrypto already switched to EVP as of 5ff4a67.
This takes advantage of the refactoring done in 87ae969 that has
introduced the allocation and free routines for cryptographic hashes.

Since 1.1.0, OpenSSL does not publish the contents of the cryptohash
contexts, forcing any consumers to rely on OpenSSL for all allocations.
Hence, the resource owner callback mechanism gains a new set of routines
to track and free cryptohash contexts when using OpenSSL, preventing any
risks of leaks in the backend.  Nothing is needed in the frontend thanks
to the refactoring of 87ae969, and the resowner knowledge is isolated
into cryptohash_openssl.c.

Note that this also fixes a failure with SCRAM authentication when using
FIPS in OpenSSL, but as there have been few complaints about this
problem and as this causes an ABI breakage, no backpatch is done.

Author: Michael Paquier
Reviewed-by: Daniel Gustafsson, Heikki Linnakangas
Discussion: https://postgr.es/m/20200924025314.GE7405@paquier.xyz
Discussion: https://postgr.es/m/20180911030250.GA27115@paquier.xyz
This commit is contained in:
Michael Paquier
2020-12-04 10:49:23 +09:00
parent 3f8971d92e
commit 4f48a6fbe2
5 changed files with 160 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/backend/replication/basebackup.c
View File

@ -729,11 +729,17 @@ perform_base_backup(basebackup_options *opt)
errmsg("checksum verification failure during base backup")));
}
/*
* Make sure to free the manifest before the resource owners as manifests
* use cryptohash contexts that may depend on resource owners (like
* OpenSSL).
*/
FreeBackupManifest(&manifest);
/* clean up the resource owner we created */
WalSndResourceCleanup(true);
pgstat_progress_end_command();
FreeBackupManifest(&manifest);
}
/*