database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-28 23:42:10 +03:00
Code Activity

Revert "Add notBefore and notAfter to SSL cert info display"

Browse Source 
This reverts commit 6acb0a628e since
LibreSSL didn't support ASN1_TIME_diff until OpenBSD 7.1, leaving
the older OpenBSD animals in the buildfarm complaining.

Per plover in the buildfarm.

Discussion: https://postgr.es/m/F0DF7102-192D-4C21-96AE-9A01AE153AD1@yesql.se
This commit is contained in:
Daniel Gustafsson
2024-03-22 22:58:41 +01:00
parent 473182c952
commit 697f8d266c
19 changed files with 34 additions and 308 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
contrib/sslinfo/Makefile
View File

@ -6,7 +6,7 @@ OBJS = \
sslinfo.o
EXTENSION = sslinfo
DATA = sslinfo--1.2--1.3.sql sslinfo--1.2.sql sslinfo--1.1--1.2.sql sslinfo--1.0--1.1.sql
DATA = sslinfo--1.2.sql sslinfo--1.1--1.2.sql sslinfo--1.0--1.1.sql
PGFILEDESC = "sslinfo - information about client SSL certificate"
ifdef USE_PGXS

1
contrib/sslinfo/meson.build
View File

@ -26,7 +26,6 @@ install_data(
'sslinfo--1.0--1.1.sql',
'sslinfo--1.1--1.2.sql',
'sslinfo--1.2.sql',
'sslinfo--1.2--1.3.sql',
'sslinfo.control',
kwargs: contrib_data_args,
)

12
contrib/sslinfo/sslinfo--1.2--1.3.sql
View File

@ -1,12 +0,0 @@
/* contrib/sslinfo/sslinfo--1.2--1.3.sql */
-- complain if script is sourced in psql, rather than via CREATE EXTENSION
\echo Use "CREATE EXTENSION sslinfo" to load this file. \quit
CREATE FUNCTION ssl_client_get_notbefore() RETURNS timestamptz
AS 'MODULE_PATHNAME', 'ssl_client_get_notbefore'
LANGUAGE C STRICT PARALLEL RESTRICTED;
CREATE FUNCTION ssl_client_get_notafter() RETURNS timestamptz
AS 'MODULE_PATHNAME', 'ssl_client_get_notafter'
LANGUAGE C STRICT PARALLEL RESTRICTED;

95
contrib/sslinfo/sslinfo.c
View File

@ -14,12 +14,10 @@
#include <openssl/asn1.h>
#include "access/htup_details.h"
#include "common/int.h"
#include "funcapi.h"
#include "libpq/libpq-be.h"
#include "miscadmin.h"
#include "utils/builtins.h"
#include "utils/timestamp.h"
/*
* On Windows, <wincrypt.h> includes a #define for X509_NAME, which breaks our
@ -36,7 +34,6 @@ PG_MODULE_MAGIC;
static Datum X509_NAME_field_to_text(X509_NAME *name, text *fieldName);
static Datum ASN1_STRING_to_text(ASN1_STRING *str);
static Datum ASN1_TIME_to_timestamptz(ASN1_TIME *time);
/*
* Function context for data persisting over repeated calls.
@ -228,66 +225,6 @@ X509_NAME_field_to_text(X509_NAME *name, text *fieldName)
}
/*
* Converts OpenSSL ASN1_TIME structure into timestamptz
*
* OpenSSL 1.0.2 doesn't expose a function to convert an ASN1_TIME to a tm
* struct, it's only available in 1.1.1 and onwards. Instead we can ask for the
* difference between the ASN1_TIME and a known timestamp and get the actual
* timestamp that way. Until support for OpenSSL 1.0.2 is retired we have to do
* it this way.
*
* Parameter: time - OpenSSL ASN1_TIME structure.
* Returns Datum, which can be directly returned from a C language SQL
* function.
*/
static Datum
ASN1_TIME_to_timestamptz(ASN1_TIME *ASN1_cert_ts)
{
int days;
int seconds;
const char postgres_epoch[] = "20000101000000Z";
ASN1_TIME *ASN1_epoch;
int64 result_days;
int64 result_secs;
int64 result;
/* Create an epoch to compare against */
ASN1_epoch = ASN1_TIME_new();
if (!ASN1_epoch)
ereport(ERROR,
(errcode(ERRCODE_OUT_OF_MEMORY),
errmsg("could not allocate memory for ASN1 TIME structure")));
/* Calculate the diff from the epoch to the certificate timestamp */
if (!ASN1_TIME_set_string(ASN1_epoch, postgres_epoch) ||
!ASN1_TIME_diff(&days, &seconds, ASN1_epoch, ASN1_cert_ts))
ereport(ERROR,
(errcode(ERRCODE_INVALID_PARAMETER_VALUE),
errmsg("failed to read certificate validity")));
/*
* Unlike when freeing other OpenSSL memory structures, there is no error
* return on freeing ASN1 strings.
*/
ASN1_TIME_free(ASN1_epoch);
/*
* Convert the reported date into usecs to be used as a TimestampTz. The
* date should really not overflow an int64 but rather than trusting the
* certificate we take overflow into consideration.
*/
if (pg_mul_s64_overflow(days, USECS_PER_DAY, &result_days) ||
pg_mul_s64_overflow(seconds, USECS_PER_SEC, &result_secs) ||
pg_add_s64_overflow(result_days, result_secs, &result))
{
return TimestampTzGetDatum(0);
}
return TimestampTzGetDatum(result);
}
/*
* Returns specified field of client certificate distinguished name
*
@ -545,35 +482,3 @@ ssl_extension_info(PG_FUNCTION_ARGS)
/* All done */
SRF_RETURN_DONE(funcctx);
}
/*
* Returns current client certificate notBefore timestamp in
* timestamptz data type
*/
PG_FUNCTION_INFO_V1(ssl_client_get_notbefore);
Datum
ssl_client_get_notbefore(PG_FUNCTION_ARGS)
{
X509 *cert = MyProcPort->peer;
if (!MyProcPort->ssl_in_use || !MyProcPort->peer_cert_valid)
PG_RETURN_NULL();
return ASN1_TIME_to_timestamptz(X509_get_notBefore(cert));
}
/*
* Returns current client certificate notAfter timestamp in
* timestamptz data type
*/
PG_FUNCTION_INFO_V1(ssl_client_get_notafter);
Datum
ssl_client_get_notafter(PG_FUNCTION_ARGS)
{
X509 *cert = MyProcPort->peer;
if (!MyProcPort->ssl_in_use || !MyProcPort->peer_cert_valid)
PG_RETURN_NULL();
return ASN1_TIME_to_timestamptz(X509_get_notAfter(cert));
}

2
contrib/sslinfo/sslinfo.control
View File

@ -1,5 +1,5 @@
# sslinfo extension
comment = 'information about SSL certificates'
default_version = '1.3'
default_version = '1.2'
module_pathname = '$libdir/sslinfo'
relocatable = true