database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-09-03 15:22:11 +03:00
Code Activity

Use BIO_{get,set}_app_data instead of BIO_{get,set}_data.

Browse Source 
We should have done it this way all along, but we accidentally got
away with using the wrong BIO field up until OpenSSL 3.2.  There,
the library's BIO routines that we rely on use the "data" field
for their own purposes, and our conflicting use causes assorted
weird behaviors up to and including core dumps when SSL connections
are attempted.  Switch to using the approved field for the purpose,
i.e. app_data.

While at it, remove our configure probes for BIO_get_data as well
as the fallback implementation.  BIO_{get,set}_app_data have been
there since long before any OpenSSL version that we still support,
even in the back branches.

Also, update src/test/ssl/t/001_ssltests.pl to allow for a minor
change in an error message spelling that evidently came in with 3.2.

Tristan Partin and Bo Andreson.  Back-patch to all supported branches.

Discussion: https://postgr.es/m/CAN55FZ1eDDYsYaL7mv+oSLUij2h_u6hvD4Qmv-7PK7jkji0uyQ@mail.gmail.com
This commit is contained in:
Tom Lane
2023-11-28 12:34:03 -05:00
parent 59c62a21f2
commit b2b1f12882
7 changed files with 10 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/test/ssl/t/001_ssltests.pl
View File

@@ -538,7 +538,7 @@ $node->connect_fails(
$node->connect_fails(
"$common_connstr user=ssltestuser sslcert=ssl/client-revoked.crt sslkey=ssl/client-revoked_tmp.key",
"certificate authorization fails with revoked client cert",
expected_stderr => qr/SSL error: sslv3 alert certificate revoked/,
expected_stderr => qr|SSL error: ssl[a-z0-9/]* alert certificate revoked|,
# revoked certificates should not authenticate the user
log_unlike => [qr/connection authenticated:/],);
@@ -591,7 +591,7 @@ switch_server_cert($node, 'server-cn-only', undef, undef,
$node->connect_fails(
"$common_connstr user=ssltestuser sslcert=ssl/client-revoked.crt sslkey=ssl/client-revoked_tmp.key",
"certificate authorization fails with revoked client cert with server-side CRL directory",
expected_stderr => qr/SSL error: sslv3 alert certificate revoked/);
expected_stderr => qr|SSL error: ssl[a-z0-9/]* alert certificate revoked|);
# clean up
foreach my $key (@keys)