diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/backend/libpq/be-secure.c | 6 | ||||
| -rw-r--r-- | src/interfaces/libpq/fe-secure.c | 12 |
2 files changed, 16 insertions, 2 deletions
diff --git a/src/backend/libpq/be-secure.c b/src/backend/libpq/be-secure.c index 6baf568eea5..7288a2bec5c 100644 --- a/src/backend/libpq/be-secure.c +++ b/src/backend/libpq/be-secure.c @@ -11,7 +11,7 @@ * * * IDENTIFICATION - * $Header: /cvsroot/pgsql/src/backend/libpq/be-secure.c,v 1.14 2002/09/04 23:31:34 tgl Exp $ + * $Header: /cvsroot/pgsql/src/backend/libpq/be-secure.c,v 1.15 2002/09/26 04:41:54 momjian Exp $ * * Since the server static private key ($DataDir/server.key) * will normally be stored unencrypted so that the database @@ -642,9 +642,13 @@ initialize_SSL(void) snprintf(fnbuf, sizeof fnbuf, "%s/root.crt", DataDir); if (!SSL_CTX_load_verify_locations(SSL_context, fnbuf, CA_PATH)) { + return 0; +#ifdef NOT_USED + /* CLIENT CERTIFICATES NOT REQUIRED bjm 2002-09-26 */ postmaster_error("could not read root cert file (%s): %s", fnbuf, SSLerrmessage()); ExitPostmaster(1); +#endif } SSL_CTX_set_verify(SSL_context, SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, verify_cb); diff --git a/src/interfaces/libpq/fe-secure.c b/src/interfaces/libpq/fe-secure.c index f702cb05b98..545a19ca3c8 100644 --- a/src/interfaces/libpq/fe-secure.c +++ b/src/interfaces/libpq/fe-secure.c @@ -11,7 +11,7 @@ * * * IDENTIFICATION - * $Header: /cvsroot/pgsql/src/interfaces/libpq/fe-secure.c,v 1.13 2002/09/22 20:57:21 petere Exp $ + * $Header: /cvsroot/pgsql/src/interfaces/libpq/fe-secure.c,v 1.14 2002/09/26 04:41:55 momjian Exp $ * * NOTES * The client *requires* a valid server certificate. Since @@ -726,10 +726,14 @@ initialize_SSL(PGconn *conn) pwd->pw_dir); if (stat(fnbuf, &buf) == -1) { + return 0; +#ifdef NOT_USED + /* CLIENT CERTIFICATES NOT REQUIRED bjm 2002-09-26 */ printfPQExpBuffer(&conn->errorMessage, libpq_gettext("could not read root certificate list (%s): %s\n"), fnbuf, strerror(errno)); return -1; +#endif } if (!SSL_CTX_load_verify_locations(SSL_context, fnbuf, 0)) { @@ -789,6 +793,8 @@ open_client_SSL(PGconn *conn) /* check the certificate chain of the server */ +#ifdef NOT_USED + /* CLIENT CERTIFICATES NOT REQUIRED bjm 2002-09-26 */ /* * this eliminates simple man-in-the-middle attacks and simple * impersonations @@ -802,6 +808,7 @@ open_client_SSL(PGconn *conn) close_SSL(conn); return -1; } +#endif /* pull out server distinguished and common names */ conn->peer = SSL_get_peer_certificate(conn->ssl); @@ -824,6 +831,8 @@ open_client_SSL(PGconn *conn) /* verify that the common name resolves to peer */ +#ifdef NOT_USED + /* CLIENT CERTIFICATES NOT REQUIRED bjm 2002-09-26 */ /* * this is necessary to eliminate man-in-the-middle attacks and * impersonations where the attacker somehow learned the server's @@ -834,6 +843,7 @@ open_client_SSL(PGconn *conn) close_SSL(conn); return -1; } +#endif return 0; } |