From: | Peter Eisentraut <peter_e(at)gmx(dot)net> |
---|---|
To: | pgsql-committers(at)postgresql(dot)org |
Subject: | pgsql: Refactor client-side SSL certificate checking code |
Date: | 2018-01-31 03:57:01 |
Message-ID: | E1egjW9-0001Mq-OP@gemulon.postgresql.org |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-committers |
Refactor client-side SSL certificate checking code
Separate the parts specific to the SSL library from the general logic.
The previous code structure was
open_client_SSL()
calls verify_peer_name_matches_certificate()
calls verify_peer_name_matches_certificate_name()
calls wildcard_certificate_match()
and was completely in fe-secure-openssl.c. The new structure is
open_client_SSL() [openssl]
calls pq_verify_peer_name_matches_certificate() [generic]
calls pgtls_verify_peer_name_matches_certificate_guts() [openssl]
calls openssl_verify_peer_name_matches_certificate_name() [openssl]
calls pq_verify_peer_name_matches_certificate_name() [generic]
calls wildcard_certificate_match() [generic]
Move the generic functions into a new file fe-secure-common.c, so the
calls generally go fe-connect.c -> fe-secure.c -> fe-secure-${impl}.c ->
fe-secure-common.c, although there is a bit of back-and-forth between
the last two.
Reviewed-by: Michael Paquier <michael(dot)paquier(at)gmail(dot)com>
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/f75a95915528646cbfaf238fb48b3ffa17969383
Modified Files
--------------
src/interfaces/libpq/Makefile | 2 +-
src/interfaces/libpq/fe-secure-common.c | 204 ++++++++++++++++++++++++++++++
src/interfaces/libpq/fe-secure-common.h | 26 ++++
src/interfaces/libpq/fe-secure-openssl.c | 210 ++++---------------------------
src/interfaces/libpq/libpq-int.h | 13 ++
src/interfaces/libpq/nls.mk | 2 +-
src/tools/msvc/Mkvcbuild.pm | 1 +
7 files changed, 271 insertions(+), 187 deletions(-)
From | Date | Subject | |
---|---|---|---|
Next Message | Robert Haas | 2018-01-31 20:18:10 | pgsql: pg_prewarm: Add missing LWLockRegisterTranche call. |
Previous Message | Peter Eisentraut | 2018-01-31 00:25:26 | pgsql: Exclude common/int128.h from cpluspluscheck |