diff options
| author | Tom Lane <tgl@sss.pgh.pa.us> | 2010-07-14 17:10:03 +0000 |
|---|---|---|
| committer | Tom Lane <tgl@sss.pgh.pa.us> | 2010-07-14 17:10:03 +0000 |
| commit | ba1dfcec9624d12f008e4e2d27a40a2d18b8479c (patch) | |
| tree | 80acc429cbba50e069e081153cf327f1d255ca8d /src/interfaces/libpq/fe-secure.c | |
| parent | 06e398a50a0a63a1a7cf3b101f680c6c47aaad97 (diff) | |
| download | postgresql-ba1dfcec9624d12f008e4e2d27a40a2d18b8479c.tar.gz postgresql-ba1dfcec9624d12f008e4e2d27a40a2d18b8479c.zip | |
Allow full SSL certificate verification (wherein libpq checks its host name
parameter against server cert's CN field) to succeed in the case where
both host and hostaddr are specified. As with the existing precedents
for Kerberos, GSSAPI, SSPI, it is the calling application's responsibility
that host and hostaddr match up --- we just use the host name as given.
Per bug #5559 from Christopher Head.
In passing, make the error handling and messages for the no-host-name-given
failure more consistent among these four cases, and correct a lie in the
documentation: we don't attempt to reverse-lookup host from hostaddr
if host is missing.
Back-patch to 8.4 where SSL cert verification was introduced.
Diffstat (limited to 'src/interfaces/libpq/fe-secure.c')
| -rw-r--r-- | src/interfaces/libpq/fe-secure.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/src/interfaces/libpq/fe-secure.c b/src/interfaces/libpq/fe-secure.c index 03318424abd..e7cd2a4561e 100644 --- a/src/interfaces/libpq/fe-secure.c +++ b/src/interfaces/libpq/fe-secure.c @@ -11,7 +11,7 @@ * * * IDENTIFICATION - * $PostgreSQL: pgsql/src/interfaces/libpq/fe-secure.c,v 1.127.2.2 2009/12/30 03:45:53 tgl Exp $ + * $PostgreSQL: pgsql/src/interfaces/libpq/fe-secure.c,v 1.127.2.3 2010/07/14 17:10:03 tgl Exp $ * * NOTES * @@ -527,16 +527,16 @@ static bool verify_peer_name_matches_certificate(PGconn *conn) { /* - * If told not to verify the peer name, don't do it. Return 0 indicating + * If told not to verify the peer name, don't do it. Return true indicating * that the verification was successful. */ if (strcmp(conn->sslmode, "verify-full") != 0) return true; - if (conn->pghostaddr) + if (!(conn->pghost && conn->pghost[0] != '\0')) { printfPQExpBuffer(&conn->errorMessage, - libpq_gettext("verified SSL connections are only supported when connecting to a host name")); + libpq_gettext("host name must be specified for a verified SSL connection\n")); return false; } else @@ -555,7 +555,7 @@ verify_peer_name_matches_certificate(PGconn *conn) else { printfPQExpBuffer(&conn->errorMessage, - libpq_gettext("server common name \"%s\" does not match host name \"%s\""), + libpq_gettext("server common name \"%s\" does not match host name \"%s\"\n"), conn->peer_cn, conn->pghost); return false; } |