diff options
| author | Magnus Hagander <magnus@hagander.net> | 2009-01-28 15:06:57 +0000 |
|---|---|---|
| committer | Magnus Hagander <magnus@hagander.net> | 2009-01-28 15:06:57 +0000 |
| commit | 20632d57f1b3476668e1bf6a4667b9533949d9f4 (patch) | |
| tree | 5a78f0bcc95e51984695d20150ffa6bdf4a60080 /src/backend | |
| parent | 5b82d268e4406cb0581bfe0c9fa8e39dd35142c4 (diff) | |
| download | postgresql-20632d57f1b3476668e1bf6a4667b9533949d9f4.tar.gz postgresql-20632d57f1b3476668e1bf6a4667b9533949d9f4.zip | |
Go over all OpenSSL return values and make sure we compare them
to the documented API value. The previous code got it right as
it's implemented, but accepted too much/too little compared to
the API documentation.
Per comment from Zdenek Kotala.
Diffstat (limited to 'src/backend')
| -rw-r--r-- | src/backend/libpq/be-secure.c | 16 |
1 files changed, 8 insertions, 8 deletions
diff --git a/src/backend/libpq/be-secure.c b/src/backend/libpq/be-secure.c index 923ad6bcb3d..b3d00746eb9 100644 --- a/src/backend/libpq/be-secure.c +++ b/src/backend/libpq/be-secure.c @@ -11,7 +11,7 @@ * * * IDENTIFICATION - * $PostgreSQL: pgsql/src/backend/libpq/be-secure.c,v 1.83 2008/01/01 19:45:49 momjian Exp $ + * $PostgreSQL: pgsql/src/backend/libpq/be-secure.c,v 1.83.2.1 2009/01/28 15:06:57 mha Exp $ * * Since the server static private key ($DataDir/server.key) * will normally be stored unencrypted so that the database @@ -727,9 +727,9 @@ initialize_SSL(void) /* * Load and verify certificate and private key */ - if (!SSL_CTX_use_certificate_file(SSL_context, + if (SSL_CTX_use_certificate_file(SSL_context, SERVER_CERT_FILE, - SSL_FILETYPE_PEM)) + SSL_FILETYPE_PEM) != 1) ereport(FATAL, (errcode(ERRCODE_CONFIG_FILE_ERROR), errmsg("could not load server certificate file \"%s\": %s", @@ -759,14 +759,14 @@ initialize_SSL(void) errdetail("File must be owned by the database user and must have no permissions for \"group\" or \"other\"."))); #endif - if (!SSL_CTX_use_PrivateKey_file(SSL_context, + if (SSL_CTX_use_PrivateKey_file(SSL_context, SERVER_PRIVATE_KEY_FILE, - SSL_FILETYPE_PEM)) + SSL_FILETYPE_PEM) != 1) ereport(FATAL, (errmsg("could not load private key file \"%s\": %s", SERVER_PRIVATE_KEY_FILE, SSLerrmessage()))); - if (!SSL_CTX_check_private_key(SSL_context)) + if (SSL_CTX_check_private_key(SSL_context) != 1) ereport(FATAL, (errmsg("check of private key failed: %s", SSLerrmessage()))); @@ -783,7 +783,7 @@ initialize_SSL(void) /* * Require and check client certificates only if we have a root.crt file. */ - if (!SSL_CTX_load_verify_locations(SSL_context, ROOT_CERT_FILE, NULL)) + if (SSL_CTX_load_verify_locations(SSL_context, ROOT_CERT_FILE, NULL) != 1) { /* Not fatal - we do not require client certificates */ ereport(LOG, @@ -803,7 +803,7 @@ initialize_SSL(void) if (cvstore) { /* Set the flags to check against the complete CRL chain */ - if (X509_STORE_load_locations(cvstore, ROOT_CRL_FILE, NULL) != 0) + if (X509_STORE_load_locations(cvstore, ROOT_CRL_FILE, NULL) == 1) /* OpenSSL 0.96 does not support X509_V_FLAG_CRL_CHECK */ #ifdef X509_V_FLAG_CRL_CHECK X509_STORE_set_flags(cvstore, |