diff options
| author | Magnus Hagander <magnus@hagander.net> | 2009-01-28 15:06:53 +0000 |
|---|---|---|
| committer | Magnus Hagander <magnus@hagander.net> | 2009-01-28 15:06:53 +0000 |
| commit | 53759b01ff8746917e6e185de8601154be14c03b (patch) | |
| tree | 8bd5dd145cfbe90d522fecdba9f169b6a0e1abc9 | |
| parent | 74f933a648bf7939799898030bb774059e6e591b (diff) | |
| download | postgresql-53759b01ff8746917e6e185de8601154be14c03b.tar.gz postgresql-53759b01ff8746917e6e185de8601154be14c03b.zip | |
Go over all OpenSSL return values and make sure we compare them
to the documented API value. The previous code got it right as
it's implemented, but accepted too much/too little compared to
the API documentation.
Per comment from Zdenek Kotala.
| -rw-r--r-- | src/backend/libpq/be-secure.c | 14 | ||||
| -rw-r--r-- | src/interfaces/libpq/fe-secure.c | 6 |
2 files changed, 10 insertions, 10 deletions
diff --git a/src/backend/libpq/be-secure.c b/src/backend/libpq/be-secure.c index f0a375165ba..db7dcc668f1 100644 --- a/src/backend/libpq/be-secure.c +++ b/src/backend/libpq/be-secure.c @@ -11,7 +11,7 @@ * * * IDENTIFICATION - * $PostgreSQL: pgsql/src/backend/libpq/be-secure.c,v 1.59.2.3 2007/05/18 01:20:33 tgl Exp $ + * $PostgreSQL: pgsql/src/backend/libpq/be-secure.c,v 1.59.2.4 2009/01/28 15:06:52 mha Exp $ * * Since the server static private key ($DataDir/server.key) * will normally be stored unencrypted so that the database @@ -718,9 +718,9 @@ initialize_SSL(void) /* * Load and verify certificate and private key */ - if (!SSL_CTX_use_certificate_file(SSL_context, + if (SSL_CTX_use_certificate_file(SSL_context, SERVER_CERT_FILE, - SSL_FILETYPE_PEM)) + SSL_FILETYPE_PEM) != 1) ereport(FATAL, (errcode(ERRCODE_CONFIG_FILE_ERROR), errmsg("could not load server certificate file \"%s\": %s", @@ -750,14 +750,14 @@ initialize_SSL(void) errdetail("File must be owned by the database user and must have no permissions for \"group\" or \"other\"."))); #endif - if (!SSL_CTX_use_PrivateKey_file(SSL_context, + if (SSL_CTX_use_PrivateKey_file(SSL_context, SERVER_PRIVATE_KEY_FILE, - SSL_FILETYPE_PEM)) + SSL_FILETYPE_PEM) != 1) ereport(FATAL, (errmsg("could not load private key file \"%s\": %s", SERVER_PRIVATE_KEY_FILE, SSLerrmessage()))); - if (!SSL_CTX_check_private_key(SSL_context)) + if (SSL_CTX_check_private_key(SSL_context) != 1) ereport(FATAL, (errmsg("check of private key failed: %s", SSLerrmessage()))); @@ -774,7 +774,7 @@ initialize_SSL(void) /* * Require and check client certificates only if we have a root.crt file. */ - if (!SSL_CTX_load_verify_locations(SSL_context, ROOT_CERT_FILE, NULL)) + if (SSL_CTX_load_verify_locations(SSL_context, ROOT_CERT_FILE, NULL) != 1) { /* Not fatal - we do not require client certificates */ ereport(LOG, diff --git a/src/interfaces/libpq/fe-secure.c b/src/interfaces/libpq/fe-secure.c index 096457f7010..d0da32fa3a9 100644 --- a/src/interfaces/libpq/fe-secure.c +++ b/src/interfaces/libpq/fe-secure.c @@ -11,7 +11,7 @@ * * * IDENTIFICATION - * $PostgreSQL: pgsql/src/interfaces/libpq/fe-secure.c,v 1.73.2.1 2006/01/24 16:38:50 tgl Exp $ + * $PostgreSQL: pgsql/src/interfaces/libpq/fe-secure.c,v 1.73.2.2 2009/01/28 15:06:53 mha Exp $ * * NOTES * [ Most of these notes are wrong/obsolete, but perhaps not all ] @@ -861,7 +861,7 @@ client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey) fclose(fp); /* verify that the cert and key go together */ - if (!X509_check_private_key(*x509, *pkey)) + if (X509_check_private_key(*x509, *pkey) != 1) { char *err = SSLerrmessage(); @@ -986,7 +986,7 @@ initialize_SSL(PGconn *conn) snprintf(fnbuf, sizeof(fnbuf), "%s/%s", homedir, ROOTCERTFILE); if (stat(fnbuf, &buf) == 0) { - if (!SSL_CTX_load_verify_locations(SSL_context, fnbuf, NULL)) + if (SSL_CTX_load_verify_locations(SSL_context, fnbuf, NULL) != 1) { char *err = SSLerrmessage(); |