database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-08-30 06:01:21 +03:00
Code Activity

Re-allow SSL passphrase prompt at server start, but not thereafter.

Browse Source 
Leave OpenSSL's default passphrase collection callback in place during
the first call of secure_initialize() in server startup.  Although that
doesn't work terribly well in daemon contexts, some people feel we should
not break it for anyone who was successfully using it before.  We still
block passphrase demands during SIGHUP, meaning that you can't adjust SSL
configuration on-the-fly if you used a passphrase, but this is no worse
than what it was before commit de41869b6.  And we block passphrase demands
during EXEC_BACKEND reloads; that behavior wasn't useful either, but at
least now it's documented.

Tweak some related log messages for more readability, and avoid issuing
essentially duplicate messages about reload failure caused by a passphrase.

Discussion: https://postgr.es/m/29982.1483412575@sss.pgh.pa.us
This commit is contained in:
Tom Lane
2017-01-04 12:43:52 -05:00
parent 0fad355bec
commit 6667d9a6d7
6 changed files with 72 additions and 53 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/backend/postmaster/postmaster.c
View File

@@ -2507,11 +2507,11 @@ SIGHUP_handler(SIGNAL_ARGS)
/* Reload authentication config files too */
if (!load_hba())
ereport(LOG,
(errmsg("pg_hba.conf not reloaded")));
(errmsg("pg_hba.conf was not reloaded")));
if (!load_ident())
ereport(LOG,
(errmsg("pg_ident.conf not reloaded")));
(errmsg("pg_ident.conf was not reloaded")));
#ifdef USE_SSL
/* Reload SSL configuration as well */
@@ -2521,7 +2521,7 @@ SIGHUP_handler(SIGNAL_ARGS)
LoadedSSL = true;
else
ereport(LOG,
(errmsg("SSL context not reloaded")));
(errmsg("SSL configuration was not reloaded")));
}
else
{
@@ -4772,7 +4772,7 @@ SubPostmasterMain(int argc, char *argv[])
LoadedSSL = true;
else
ereport(LOG,
(errmsg("SSL context could not be reloaded in child process")));
(errmsg("SSL configuration could not be loaded in child process")));
}
#endif