← Back to branch summary

~ubuntu-branches/ubuntu/trusty/postgresql-9.3/trusty-updates

« back to all changes in this revision

Viewing changes to src/interfaces/libpq/fe-secure.c

  • Committer: Package Import Robot
  • Author(s): Martin Pitt
  • Date: 2016-05-12 16:06:03 UTC
  • mfrom: (1.1.16) (19.1.4 trusty-proposed)
  • Revision ID: package-import@ubuntu.com-20160512160603-8h0t7au3bkfjuiv4
Tags: 9.3.13-0ubuntu0.14.04
https://launchpad.net/bugs/1581016
* New upstream bug fix release. (LP: #1581016)
  - See http://www.postgresql.org/docs/9.3/static/release-9-3-13.html for
    details.

Show diffs side-by-side

added added

removed removed

Lines of Context:
src/interfaces/libpq/fe-secure.c
87
87
static void destroySSL(void);
88
88
static PostgresPollingStatusType open_client_SSL(PGconn *);
89
89
static void close_SSL(PGconn *);
90
 
static char *SSLerrmessage(void);
 
90
static char *SSLerrmessage(unsigned long ecode);
91
91
static void SSLerrfree(char *buf);
92
92
 
93
93
static bool pq_init_ssl_lib = true;
276
276
                        !SSL_set_app_data(conn->ssl, conn) ||
277
277
                        !SSL_set_fd(conn->ssl, conn->sock))
278
278
                {
279
 
                        char       *err = SSLerrmessage();
 
279
                        char       *err = SSLerrmessage(ERR_get_error());
280
280
 
281
281
                        printfPQExpBuffer(&conn->errorMessage,
282
282
                                   libpq_gettext("could not establish SSL connection: %s\n"),
341
341
        if (conn->ssl)
342
342
        {
343
343
                int                     err;
 
344
                unsigned long ecode;
344
345
 
345
346
                DECLARE_SIGPIPE_INFO(spinfo);
346
347
 
348
349
                DISABLE_SIGPIPE(conn, spinfo, return -1);
349
350
 
350
351
rloop:
 
352
                /*
 
353
                 * Prepare to call SSL_get_error() by clearing thread's OpenSSL
 
354
                 * error queue.  In general, the current thread's error queue must
 
355
                 * be empty before the TLS/SSL I/O operation is attempted, or
 
356
                 * SSL_get_error() will not work reliably.  Since the possibility
 
357
                 * exists that other OpenSSL clients running in the same thread but
 
358
                 * not under our control will fail to call ERR_get_error()
 
359
                 * themselves (after their own I/O operations), pro-actively clear
 
360
                 * the per-thread error queue now.
 
361
                 */
351
362
                SOCK_ERRNO_SET(0);
 
363
                ERR_clear_error();
352
364
                n = SSL_read(conn->ssl, ptr, len);
353
365
                err = SSL_get_error(conn->ssl, n);
 
366
 
 
367
                /*
 
368
                 * Other clients of OpenSSL may fail to call ERR_get_error(), but
 
369
                 * we always do, so as to not cause problems for OpenSSL clients
 
370
                 * that don't call ERR_clear_error() defensively.  Be sure that
 
371
                 * this happens by calling now.  SSL_get_error() relies on the
 
372
                 * OpenSSL per-thread error queue being intact, so this is the
 
373
                 * earliest possible point ERR_get_error() may be called.
 
374
                 */
 
375
                ecode = (err != SSL_ERROR_NONE || n < 0) ? ERR_get_error() : 0;
354
376
                switch (err)
355
377
                {
356
378
                        case SSL_ERROR_NONE:
404
426
                                break;
405
427
                        case SSL_ERROR_SSL:
406
428
                                {
407
 
                                        char       *errm = SSLerrmessage();
 
429
                                        char       *errm = SSLerrmessage(ecode);
408
430
 
409
431
                                        printfPQExpBuffer(&conn->errorMessage,
410
432
                                                                          libpq_gettext("SSL error: %s\n"), errm);
506
528
        if (conn->ssl)
507
529
        {
508
530
                int                     err;
 
531
                unsigned long ecode;
509
532
 
510
533
                DISABLE_SIGPIPE(conn, spinfo, return -1);
511
534
 
512
535
                SOCK_ERRNO_SET(0);
 
536
                ERR_clear_error();
513
537
                n = SSL_write(conn->ssl, ptr, len);
514
538
                err = SSL_get_error(conn->ssl, n);
 
539
                ecode = (err != SSL_ERROR_NONE || n < 0) ? ERR_get_error() : 0;
515
540
                switch (err)
516
541
                {
517
542
                        case SSL_ERROR_NONE:
565
590
                                break;
566
591
                        case SSL_ERROR_SSL:
567
592
                                {
568
 
                                        char       *errm = SSLerrmessage();
 
593
                                        char       *errm = SSLerrmessage(ecode);
569
594
 
570
595
                                        printfPQExpBuffer(&conn->errorMessage,
571
596
                                                                          libpq_gettext("SSL error: %s\n"), errm);
975
1000
                SSL_context = SSL_CTX_new(SSLv23_method());
976
1001
                if (!SSL_context)
977
1002
                {
978
 
                        char       *err = SSLerrmessage();
 
1003
                        char       *err = SSLerrmessage(ERR_get_error());
979
1004
 
980
1005
                        printfPQExpBuffer(&conn->errorMessage,
981
1006
                                                 libpq_gettext("could not create SSL context: %s\n"),
1140
1165
#endif
1141
1166
                if (SSL_CTX_use_certificate_chain_file(SSL_context, fnbuf) != 1)
1142
1167
                {
1143
 
                        char       *err = SSLerrmessage();
 
1168
                        char       *err = SSLerrmessage(ERR_get_error());
1144
1169
 
1145
1170
                        printfPQExpBuffer(&conn->errorMessage,
1146
1171
                           libpq_gettext("could not read certificate file \"%s\": %s\n"),
1155
1180
 
1156
1181
                if (SSL_use_certificate_file(conn->ssl, fnbuf, SSL_FILETYPE_PEM) != 1)
1157
1182
                {
1158
 
                        char       *err = SSLerrmessage();
 
1183
                        char       *err = SSLerrmessage(ERR_get_error());
1159
1184
 
1160
1185
                        printfPQExpBuffer(&conn->errorMessage,
1161
1186
                           libpq_gettext("could not read certificate file \"%s\": %s\n"),
1210
1235
                        conn->engine = ENGINE_by_id(engine_str);
1211
1236
                        if (conn->engine == NULL)
1212
1237
                        {
1213
 
                                char       *err = SSLerrmessage();
 
1238
                                char       *err = SSLerrmessage(ERR_get_error());
1214
1239
 
1215
1240
                                printfPQExpBuffer(&conn->errorMessage,
1216
1241
                                         libpq_gettext("could not load SSL engine \"%s\": %s\n"),
1222
1247
 
1223
1248
                        if (ENGINE_init(conn->engine) == 0)
1224
1249
                        {
1225
 
                                char       *err = SSLerrmessage();
 
1250
                                char       *err = SSLerrmessage(ERR_get_error());
1226
1251
 
1227
1252
                                printfPQExpBuffer(&conn->errorMessage,
1228
1253
                                libpq_gettext("could not initialize SSL engine \"%s\": %s\n"),
1238
1263
                                                                                   NULL, NULL);
1239
1264
                        if (pkey == NULL)
1240
1265
                        {
1241
 
                                char       *err = SSLerrmessage();
 
1266
                                char       *err = SSLerrmessage(ERR_get_error());
1242
1267
 
1243
1268
                                printfPQExpBuffer(&conn->errorMessage,
1244
1269
                                                                  libpq_gettext("could not read private SSL key \"%s\" from engine \"%s\": %s\n"),
1252
1277
                        }
1253
1278
                        if (SSL_use_PrivateKey(conn->ssl, pkey) != 1)
1254
1279
                        {
1255
 
                                char       *err = SSLerrmessage();
 
1280
                                char       *err = SSLerrmessage(ERR_get_error());
1256
1281
 
1257
1282
                                printfPQExpBuffer(&conn->errorMessage,
1258
1283
                                                                  libpq_gettext("could not load private SSL key \"%s\" from engine \"%s\": %s\n"),
1308
1333
 
1309
1334
                if (SSL_use_PrivateKey_file(conn->ssl, fnbuf, SSL_FILETYPE_PEM) != 1)
1310
1335
                {
1311
 
                        char       *err = SSLerrmessage();
 
1336
                        char       *err = SSLerrmessage(ERR_get_error());
1312
1337
 
1313
1338
                        printfPQExpBuffer(&conn->errorMessage,
1314
1339
                           libpq_gettext("could not load private key file \"%s\": %s\n"),
1322
1347
        if (have_cert &&
1323
1348
                SSL_check_private_key(conn->ssl) != 1)
1324
1349
        {
1325
 
                char       *err = SSLerrmessage();
 
1350
                char       *err = SSLerrmessage(ERR_get_error());
1326
1351
 
1327
1352
                printfPQExpBuffer(&conn->errorMessage,
1328
1353
                                                  libpq_gettext("certificate does not match private key file \"%s\": %s\n"),
1360
1385
#endif
1361
1386
                if (SSL_CTX_load_verify_locations(SSL_context, fnbuf, NULL) != 1)
1362
1387
                {
1363
 
                        char       *err = SSLerrmessage();
 
1388
                        char       *err = SSLerrmessage(ERR_get_error());
1364
1389
 
1365
1390
                        printfPQExpBuffer(&conn->errorMessage,
1366
1391
                                                          libpq_gettext("could not read root certificate file \"%s\": %s\n"),
1390
1415
                                X509_STORE_set_flags(cvstore,
1391
1416
                                                  X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
1392
1417
#else
1393
 
                                char       *err = SSLerrmessage();
 
1418
                                char       *err = SSLerrmessage(ERR_get_error());
1394
1419
 
1395
1420
                                printfPQExpBuffer(&conn->errorMessage,
1396
1421
                                                                  libpq_gettext("SSL library does not support CRL certificates (file \"%s\")\n"),
1464
1489
{
1465
1490
        int                     r;
1466
1491
 
 
1492
        ERR_clear_error();
1467
1493
        r = SSL_connect(conn->ssl);
1468
1494
        if (r <= 0)
1469
1495
        {
1470
1496
                int                     err = SSL_get_error(conn->ssl, r);
 
1497
                unsigned long ecode;
1471
1498
 
 
1499
                ecode = ERR_get_error();
1472
1500
                switch (err)
1473
1501
                {
1474
1502
                        case SSL_ERROR_WANT_READ:
1493
1521
                                }
1494
1522
                        case SSL_ERROR_SSL:
1495
1523
                                {
1496
 
                                        char       *err = SSLerrmessage();
 
1524
                                        char       *err = SSLerrmessage(ecode);
1497
1525
 
1498
1526
                                        printfPQExpBuffer(&conn->errorMessage,
1499
1527
                                                                          libpq_gettext("SSL error: %s\n"),
1521
1549
        conn->peer = SSL_get_peer_certificate(conn->ssl);
1522
1550
        if (conn->peer == NULL)
1523
1551
        {
1524
 
                char       *err = SSLerrmessage();
 
1552
                char       *err;
 
1553
 
 
1554
                err = SSLerrmessage(ERR_get_error());
1525
1555
 
1526
1556
                printfPQExpBuffer(&conn->errorMessage,
1527
1557
                                        libpq_gettext("certificate could not be obtained: %s\n"),
1597
1627
}
1598
1628
 
1599
1629
/*
1600
 
 * Obtain reason string for last SSL error
 
1630
 * Obtain reason string for passed SSL errcode
 
1631
 *
 
1632
 * ERR_get_error() is used by caller to get errcode to pass here.
1601
1633
 *
1602
1634
 * Some caution is needed here since ERR_reason_error_string will
1603
1635
 * return NULL if it doesn't recognize the error code.  We don't
1608
1640
#define SSL_ERR_LEN 128
1609
1641
 
1610
1642
static char *
1611
 
SSLerrmessage(void)
 
1643
SSLerrmessage(unsigned long ecode)
1612
1644
{
1613
 
        unsigned long errcode;
1614
1645
        const char *errreason;
1615
1646
        char       *errbuf;
1616
1647
 
1617
1648
        errbuf = malloc(SSL_ERR_LEN);
1618
1649
        if (!errbuf)
1619
1650
                return ssl_nomem;
1620
 
        errcode = ERR_get_error();
1621
 
        if (errcode == 0)
 
1651
        if (ecode == 0)
1622
1652
        {
1623
1653
                snprintf(errbuf, SSL_ERR_LEN, libpq_gettext("no SSL error reported"));
1624
1654
                return errbuf;
1625
1655
        }
1626
 
        errreason = ERR_reason_error_string(errcode);
 
1656
        errreason = ERR_reason_error_string(ecode);
1627
1657
        if (errreason != NULL)
1628
1658
        {
1629
1659
                strlcpy(errbuf, errreason, SSL_ERR_LEN);
1630
1660
                return errbuf;
1631
1661
        }
1632
 
        snprintf(errbuf, SSL_ERR_LEN, libpq_gettext("SSL error code %lu"), errcode);
 
1662
        snprintf(errbuf, SSL_ERR_LEN, libpq_gettext("SSL error code %lu"), ecode);
1633
1663
        return errbuf;
1634
1664
}
1635
1665