Line data Source code
1 : /*-------------------------------------------------------------------------
2 : *
3 : * be-secure-openssl.c
4 : * functions for OpenSSL support in the backend.
5 : *
6 : *
7 : * Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
8 : * Portions Copyright (c) 1994, Regents of the University of California
9 : *
10 : *
11 : * IDENTIFICATION
12 : * src/backend/libpq/be-secure-openssl.c
13 : *
14 : *-------------------------------------------------------------------------
15 : */
16 :
17 : #include "postgres.h"
18 :
19 : #include <sys/stat.h>
20 : #include <signal.h>
21 : #include <fcntl.h>
22 : #include <ctype.h>
23 : #include <sys/socket.h>
24 : #include <unistd.h>
25 : #include <netdb.h>
26 : #include <netinet/in.h>
27 : #include <netinet/tcp.h>
28 : #include <arpa/inet.h>
29 :
30 : #include "common/string.h"
31 : #include "libpq/libpq.h"
32 : #include "miscadmin.h"
33 : #include "pgstat.h"
34 : #include "storage/fd.h"
35 : #include "storage/latch.h"
36 : #include "utils/guc.h"
37 : #include "utils/memutils.h"
38 : #include "utils/wait_event.h"
39 :
40 : /*
41 : * These SSL-related #includes must come after all system-provided headers.
42 : * This ensures that OpenSSL can take care of conflicts with Windows'
43 : * <wincrypt.h> by #undef'ing the conflicting macros. (We don't directly
44 : * include <wincrypt.h>, but some other Windows headers do.)
45 : */
46 : #include "common/openssl.h"
47 : #include <openssl/bn.h>
48 : #include <openssl/conf.h>
49 : #include <openssl/dh.h>
50 : #ifndef OPENSSL_NO_ECDH
51 : #include <openssl/ec.h>
52 : #endif
53 : #include <openssl/x509v3.h>
54 :
55 :
56 : /* default init hook can be overridden by a shared library */
57 : static void default_openssl_tls_init(SSL_CTX *context, bool isServerStart);
58 : openssl_tls_init_hook_typ openssl_tls_init_hook = default_openssl_tls_init;
59 :
60 : static int port_bio_read(BIO *h, char *buf, int size);
61 : static int port_bio_write(BIO *h, const char *buf, int size);
62 : static BIO_METHOD *port_bio_method(void);
63 : static int ssl_set_port_bio(Port *port);
64 :
65 : static DH *load_dh_file(char *filename, bool isServerStart);
66 : static DH *load_dh_buffer(const char *buffer, size_t len);
67 : static int ssl_external_passwd_cb(char *buf, int size, int rwflag, void *userdata);
68 : static int dummy_ssl_passwd_cb(char *buf, int size, int rwflag, void *userdata);
69 : static int verify_cb(int ok, X509_STORE_CTX *ctx);
70 : static void info_cb(const SSL *ssl, int type, int args);
71 : static int alpn_cb(SSL *ssl,
72 : const unsigned char **out,
73 : unsigned char *outlen,
74 : const unsigned char *in,
75 : unsigned int inlen,
76 : void *userdata);
77 : static bool initialize_dh(SSL_CTX *context, bool isServerStart);
78 : static bool initialize_ecdh(SSL_CTX *context, bool isServerStart);
79 : static const char *SSLerrmessageExt(unsigned long ecode, const char *replacement);
80 : static const char *SSLerrmessage(unsigned long ecode);
81 :
82 : static char *X509_NAME_to_cstring(X509_NAME *name);
83 :
84 : static SSL_CTX *SSL_context = NULL;
85 : static bool dummy_ssl_passwd_cb_called = false;
86 : static bool ssl_is_server_start;
87 :
88 : static int ssl_protocol_version_to_openssl(int v);
89 : static const char *ssl_protocol_version_to_string(int v);
90 :
91 : struct CallbackErr
92 : {
93 : /*
94 : * Storage for passing certificate verification error logging from the
95 : * callback.
96 : */
97 : char *cert_errdetail;
98 : };
99 :
100 : /* ------------------------------------------------------------ */
101 : /* Public interface */
102 : /* ------------------------------------------------------------ */
103 :
104 : int
105 35 : be_tls_init(bool isServerStart)
106 : {
107 : SSL_CTX *context;
108 35 : int ssl_ver_min = -1;
109 35 : int ssl_ver_max = -1;
110 :
111 : /*
112 : * Create a new SSL context into which we'll load all the configuration
113 : * settings. If we fail partway through, we can avoid memory leakage by
114 : * freeing this context; we don't install it as active until the end.
115 : *
116 : * We use SSLv23_method() because it can negotiate use of the highest
117 : * mutually supported protocol version, while alternatives like
118 : * TLSv1_2_method() permit only one specific version. Note that we don't
119 : * actually allow SSL v2 or v3, only TLS protocols (see below).
120 : */
121 35 : context = SSL_CTX_new(SSLv23_method());
122 35 : if (!context)
123 : {
124 0 : ereport(isServerStart ? FATAL : LOG,
125 : (errmsg("could not create SSL context: %s",
126 : SSLerrmessage(ERR_get_error()))));
127 0 : goto error;
128 : }
129 :
130 : /*
131 : * Disable OpenSSL's moving-write-buffer sanity check, because it causes
132 : * unnecessary failures in nonblocking send cases.
133 : */
134 35 : SSL_CTX_set_mode(context, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
135 :
136 : /*
137 : * Call init hook (usually to set password callback)
138 : */
139 35 : (*openssl_tls_init_hook) (context, isServerStart);
140 :
141 : /* used by the callback */
142 35 : ssl_is_server_start = isServerStart;
143 :
144 : /*
145 : * Load and verify server's certificate and private key
146 : */
147 35 : if (SSL_CTX_use_certificate_chain_file(context, ssl_cert_file) != 1)
148 : {
149 0 : ereport(isServerStart ? FATAL : LOG,
150 : (errcode(ERRCODE_CONFIG_FILE_ERROR),
151 : errmsg("could not load server certificate file \"%s\": %s",
152 : ssl_cert_file, SSLerrmessage(ERR_get_error()))));
153 0 : goto error;
154 : }
155 :
156 35 : if (!check_ssl_key_file_permissions(ssl_key_file, isServerStart))
157 0 : goto error;
158 :
159 : /*
160 : * OK, try to load the private key file.
161 : */
162 35 : dummy_ssl_passwd_cb_called = false;
163 :
164 35 : if (SSL_CTX_use_PrivateKey_file(context,
165 : ssl_key_file,
166 : SSL_FILETYPE_PEM) != 1)
167 : {
168 3 : if (dummy_ssl_passwd_cb_called)
169 1 : ereport(isServerStart ? FATAL : LOG,
170 : (errcode(ERRCODE_CONFIG_FILE_ERROR),
171 : errmsg("private key file \"%s\" cannot be reloaded because it requires a passphrase",
172 : ssl_key_file)));
173 : else
174 2 : ereport(isServerStart ? FATAL : LOG,
175 : (errcode(ERRCODE_CONFIG_FILE_ERROR),
176 : errmsg("could not load private key file \"%s\": %s",
177 : ssl_key_file, SSLerrmessage(ERR_get_error()))));
178 1 : goto error;
179 : }
180 :
181 32 : if (SSL_CTX_check_private_key(context) != 1)
182 : {
183 0 : ereport(isServerStart ? FATAL : LOG,
184 : (errcode(ERRCODE_CONFIG_FILE_ERROR),
185 : errmsg("check of private key failed: %s",
186 : SSLerrmessage(ERR_get_error()))));
187 0 : goto error;
188 : }
189 :
190 32 : if (ssl_min_protocol_version)
191 : {
192 32 : ssl_ver_min = ssl_protocol_version_to_openssl(ssl_min_protocol_version);
193 :
194 32 : if (ssl_ver_min == -1)
195 : {
196 0 : ereport(isServerStart ? FATAL : LOG,
197 : /*- translator: first %s is a GUC option name, second %s is its value */
198 : (errmsg("\"%s\" setting \"%s\" not supported by this build",
199 : "ssl_min_protocol_version",
200 : GetConfigOption("ssl_min_protocol_version",
201 : false, false))));
202 0 : goto error;
203 : }
204 :
205 32 : if (!SSL_CTX_set_min_proto_version(context, ssl_ver_min))
206 : {
207 0 : ereport(isServerStart ? FATAL : LOG,
208 : (errmsg("could not set minimum SSL protocol version")));
209 0 : goto error;
210 : }
211 : }
212 :
213 32 : if (ssl_max_protocol_version)
214 : {
215 1 : ssl_ver_max = ssl_protocol_version_to_openssl(ssl_max_protocol_version);
216 :
217 1 : if (ssl_ver_max == -1)
218 : {
219 0 : ereport(isServerStart ? FATAL : LOG,
220 : /*- translator: first %s is a GUC option name, second %s is its value */
221 : (errmsg("\"%s\" setting \"%s\" not supported by this build",
222 : "ssl_max_protocol_version",
223 : GetConfigOption("ssl_max_protocol_version",
224 : false, false))));
225 0 : goto error;
226 : }
227 :
228 1 : if (!SSL_CTX_set_max_proto_version(context, ssl_ver_max))
229 : {
230 0 : ereport(isServerStart ? FATAL : LOG,
231 : (errmsg("could not set maximum SSL protocol version")));
232 0 : goto error;
233 : }
234 : }
235 :
236 : /* Check compatibility of min/max protocols */
237 32 : if (ssl_min_protocol_version &&
238 : ssl_max_protocol_version)
239 : {
240 : /*
241 : * No need to check for invalid values (-1) for each protocol number
242 : * as the code above would have already generated an error.
243 : */
244 1 : if (ssl_ver_min > ssl_ver_max)
245 : {
246 1 : ereport(isServerStart ? FATAL : LOG,
247 : (errcode(ERRCODE_CONFIG_FILE_ERROR),
248 : errmsg("could not set SSL protocol version range"),
249 : errdetail("\"%s\" cannot be higher than \"%s\"",
250 : "ssl_min_protocol_version",
251 : "ssl_max_protocol_version")));
252 0 : goto error;
253 : }
254 : }
255 :
256 : /*
257 : * Disallow SSL session tickets. OpenSSL use both stateful and stateless
258 : * tickets for TLSv1.3, and stateless ticket for TLSv1.2. SSL_OP_NO_TICKET
259 : * is available since 0.9.8f but only turns off stateless tickets. In
260 : * order to turn off stateful tickets we need SSL_CTX_set_num_tickets,
261 : * which is available since OpenSSL 1.1.1. LibreSSL 3.5.4 (from OpenBSD
262 : * 7.1) introduced this API for compatibility, but doesn't support session
263 : * tickets at all so it's a no-op there.
264 : */
265 : #ifdef HAVE_SSL_CTX_SET_NUM_TICKETS
266 31 : SSL_CTX_set_num_tickets(context, 0);
267 : #endif
268 31 : SSL_CTX_set_options(context, SSL_OP_NO_TICKET);
269 :
270 : /* disallow SSL session caching, too */
271 31 : SSL_CTX_set_session_cache_mode(context, SSL_SESS_CACHE_OFF);
272 :
273 : /* disallow SSL compression */
274 31 : SSL_CTX_set_options(context, SSL_OP_NO_COMPRESSION);
275 :
276 : /*
277 : * Disallow SSL renegotiation. This concerns only TLSv1.2 and older
278 : * protocol versions, as TLSv1.3 has no support for renegotiation.
279 : * SSL_OP_NO_RENEGOTIATION is available in OpenSSL since 1.1.0h (via a
280 : * backport from 1.1.1). SSL_OP_NO_CLIENT_RENEGOTIATION is available in
281 : * LibreSSL since 2.5.1 disallowing all client-initiated renegotiation
282 : * (this is usually on by default).
283 : */
284 : #ifdef SSL_OP_NO_RENEGOTIATION
285 31 : SSL_CTX_set_options(context, SSL_OP_NO_RENEGOTIATION);
286 : #endif
287 : #ifdef SSL_OP_NO_CLIENT_RENEGOTIATION
288 : SSL_CTX_set_options(context, SSL_OP_NO_CLIENT_RENEGOTIATION);
289 : #endif
290 :
291 : /* set up ephemeral DH and ECDH keys */
292 31 : if (!initialize_dh(context, isServerStart))
293 0 : goto error;
294 31 : if (!initialize_ecdh(context, isServerStart))
295 0 : goto error;
296 :
297 : /* set up the allowed cipher list for TLSv1.2 and below */
298 29 : if (SSL_CTX_set_cipher_list(context, SSLCipherList) != 1)
299 : {
300 0 : ereport(isServerStart ? FATAL : LOG,
301 : (errcode(ERRCODE_CONFIG_FILE_ERROR),
302 : errmsg("could not set the TLSv1.2 cipher list (no valid ciphers available)")));
303 0 : goto error;
304 : }
305 :
306 : /*
307 : * Set up the allowed cipher suites for TLSv1.3. If the GUC is an empty
308 : * string we leave the allowed suites to be the OpenSSL default value.
309 : */
310 29 : if (SSLCipherSuites[0])
311 : {
312 : /* set up the allowed cipher suites */
313 23 : if (SSL_CTX_set_ciphersuites(context, SSLCipherSuites) != 1)
314 : {
315 0 : ereport(isServerStart ? FATAL : LOG,
316 : (errcode(ERRCODE_CONFIG_FILE_ERROR),
317 : errmsg("could not set the TLSv1.3 cipher suites (no valid ciphers available)")));
318 0 : goto error;
319 : }
320 : }
321 :
322 : /* Let server choose order */
323 29 : if (SSLPreferServerCiphers)
324 29 : SSL_CTX_set_options(context, SSL_OP_CIPHER_SERVER_PREFERENCE);
325 :
326 : /*
327 : * Load CA store, so we can verify client certificates if needed.
328 : */
329 29 : if (ssl_ca_file[0])
330 : {
331 : STACK_OF(X509_NAME) * root_cert_list;
332 :
333 46 : if (SSL_CTX_load_verify_locations(context, ssl_ca_file, NULL) != 1 ||
334 23 : (root_cert_list = SSL_load_client_CA_file(ssl_ca_file)) == NULL)
335 : {
336 0 : ereport(isServerStart ? FATAL : LOG,
337 : (errcode(ERRCODE_CONFIG_FILE_ERROR),
338 : errmsg("could not load root certificate file \"%s\": %s",
339 : ssl_ca_file, SSLerrmessage(ERR_get_error()))));
340 0 : goto error;
341 : }
342 :
343 : /*
344 : * Tell OpenSSL to send the list of root certs we trust to clients in
345 : * CertificateRequests. This lets a client with a keystore select the
346 : * appropriate client certificate to send to us. Also, this ensures
347 : * that the SSL context will "own" the root_cert_list and remember to
348 : * free it when no longer needed.
349 : */
350 23 : SSL_CTX_set_client_CA_list(context, root_cert_list);
351 :
352 : /*
353 : * Always ask for SSL client cert, but don't fail if it's not
354 : * presented. We might fail such connections later, depending on what
355 : * we find in pg_hba.conf.
356 : */
357 23 : SSL_CTX_set_verify(context,
358 : (SSL_VERIFY_PEER |
359 : SSL_VERIFY_CLIENT_ONCE),
360 : verify_cb);
361 : }
362 :
363 : /*----------
364 : * Load the Certificate Revocation List (CRL).
365 : * http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci803160,00.html
366 : *----------
367 : */
368 29 : if (ssl_crl_file[0] || ssl_crl_dir[0])
369 : {
370 23 : X509_STORE *cvstore = SSL_CTX_get_cert_store(context);
371 :
372 23 : if (cvstore)
373 : {
374 : /* Set the flags to check against the complete CRL chain */
375 46 : if (X509_STORE_load_locations(cvstore,
376 23 : ssl_crl_file[0] ? ssl_crl_file : NULL,
377 23 : ssl_crl_dir[0] ? ssl_crl_dir : NULL)
378 : == 1)
379 : {
380 23 : X509_STORE_set_flags(cvstore,
381 : X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
382 : }
383 0 : else if (ssl_crl_dir[0] == 0)
384 : {
385 0 : ereport(isServerStart ? FATAL : LOG,
386 : (errcode(ERRCODE_CONFIG_FILE_ERROR),
387 : errmsg("could not load SSL certificate revocation list file \"%s\": %s",
388 : ssl_crl_file, SSLerrmessage(ERR_get_error()))));
389 0 : goto error;
390 : }
391 0 : else if (ssl_crl_file[0] == 0)
392 : {
393 0 : ereport(isServerStart ? FATAL : LOG,
394 : (errcode(ERRCODE_CONFIG_FILE_ERROR),
395 : errmsg("could not load SSL certificate revocation list directory \"%s\": %s",
396 : ssl_crl_dir, SSLerrmessage(ERR_get_error()))));
397 0 : goto error;
398 : }
399 : else
400 : {
401 0 : ereport(isServerStart ? FATAL : LOG,
402 : (errcode(ERRCODE_CONFIG_FILE_ERROR),
403 : errmsg("could not load SSL certificate revocation list file \"%s\" or directory \"%s\": %s",
404 : ssl_crl_file, ssl_crl_dir,
405 : SSLerrmessage(ERR_get_error()))));
406 0 : goto error;
407 : }
408 : }
409 : }
410 :
411 : /*
412 : * Success! Replace any existing SSL_context.
413 : */
414 29 : if (SSL_context)
415 1 : SSL_CTX_free(SSL_context);
416 :
417 29 : SSL_context = context;
418 :
419 : /*
420 : * Set flag to remember whether CA store has been loaded into SSL_context.
421 : */
422 29 : if (ssl_ca_file[0])
423 23 : ssl_loaded_verify_locations = true;
424 : else
425 6 : ssl_loaded_verify_locations = false;
426 :
427 29 : return 0;
428 :
429 : /* Clean up by releasing working context. */
430 1 : error:
431 1 : if (context)
432 1 : SSL_CTX_free(context);
433 1 : return -1;
434 : }
435 :
436 : void
437 147 : be_tls_destroy(void)
438 : {
439 147 : if (SSL_context)
440 1 : SSL_CTX_free(SSL_context);
441 147 : SSL_context = NULL;
442 147 : ssl_loaded_verify_locations = false;
443 147 : }
444 :
445 : int
446 129 : be_tls_open_server(Port *port)
447 : {
448 : int r;
449 : int err;
450 : int waitfor;
451 : unsigned long ecode;
452 : bool give_proto_hint;
453 : static struct CallbackErr err_context;
454 :
455 : Assert(!port->ssl);
456 : Assert(!port->peer);
457 :
458 129 : if (!SSL_context)
459 : {
460 0 : ereport(COMMERROR,
461 : (errcode(ERRCODE_PROTOCOL_VIOLATION),
462 : errmsg("could not initialize SSL connection: SSL context not set up")));
463 0 : return -1;
464 : }
465 :
466 : /* set up debugging/info callback */
467 129 : SSL_CTX_set_info_callback(SSL_context, info_cb);
468 :
469 : /* enable ALPN */
470 129 : SSL_CTX_set_alpn_select_cb(SSL_context, alpn_cb, port);
471 :
472 129 : if (!(port->ssl = SSL_new(SSL_context)))
473 : {
474 0 : ereport(COMMERROR,
475 : (errcode(ERRCODE_PROTOCOL_VIOLATION),
476 : errmsg("could not initialize SSL connection: %s",
477 : SSLerrmessage(ERR_get_error()))));
478 0 : return -1;
479 : }
480 129 : if (!ssl_set_port_bio(port))
481 : {
482 0 : ereport(COMMERROR,
483 : (errcode(ERRCODE_PROTOCOL_VIOLATION),
484 : errmsg("could not set SSL socket: %s",
485 : SSLerrmessage(ERR_get_error()))));
486 0 : return -1;
487 : }
488 :
489 129 : err_context.cert_errdetail = NULL;
490 129 : SSL_set_ex_data(port->ssl, 0, &err_context);
491 :
492 129 : port->ssl_in_use = true;
493 :
494 489 : aloop:
495 :
496 : /*
497 : * Prepare to call SSL_get_error() by clearing thread's OpenSSL error
498 : * queue. In general, the current thread's error queue must be empty
499 : * before the TLS/SSL I/O operation is attempted, or SSL_get_error() will
500 : * not work reliably. An extension may have failed to clear the
501 : * per-thread error queue following another call to an OpenSSL I/O
502 : * routine.
503 : */
504 489 : errno = 0;
505 489 : ERR_clear_error();
506 489 : r = SSL_accept(port->ssl);
507 489 : if (r <= 0)
508 : {
509 379 : err = SSL_get_error(port->ssl, r);
510 :
511 : /*
512 : * Other clients of OpenSSL in the backend may fail to call
513 : * ERR_get_error(), but we always do, so as to not cause problems for
514 : * OpenSSL clients that don't call ERR_clear_error() defensively. Be
515 : * sure that this happens by calling now. SSL_get_error() relies on
516 : * the OpenSSL per-thread error queue being intact, so this is the
517 : * earliest possible point ERR_get_error() may be called.
518 : */
519 379 : ecode = ERR_get_error();
520 379 : switch (err)
521 : {
522 360 : case SSL_ERROR_WANT_READ:
523 : case SSL_ERROR_WANT_WRITE:
524 : /* not allowed during connection establishment */
525 : Assert(!port->noblock);
526 :
527 : /*
528 : * No need to care about timeouts/interrupts here. At this
529 : * point authentication_timeout still employs
530 : * StartupPacketTimeoutHandler() which directly exits.
531 : */
532 360 : if (err == SSL_ERROR_WANT_READ)
533 360 : waitfor = WL_SOCKET_READABLE | WL_EXIT_ON_PM_DEATH;
534 : else
535 0 : waitfor = WL_SOCKET_WRITEABLE | WL_EXIT_ON_PM_DEATH;
536 :
537 360 : (void) WaitLatchOrSocket(NULL, waitfor, port->sock, 0,
538 : WAIT_EVENT_SSL_OPEN_SERVER);
539 360 : goto aloop;
540 0 : case SSL_ERROR_SYSCALL:
541 0 : if (r < 0 && errno != 0)
542 0 : ereport(COMMERROR,
543 : (errcode_for_socket_access(),
544 : errmsg("could not accept SSL connection: %m")));
545 : else
546 0 : ereport(COMMERROR,
547 : (errcode(ERRCODE_PROTOCOL_VIOLATION),
548 : errmsg("could not accept SSL connection: EOF detected")));
549 0 : break;
550 19 : case SSL_ERROR_SSL:
551 19 : switch (ERR_GET_REASON(ecode))
552 : {
553 : /*
554 : * UNSUPPORTED_PROTOCOL, WRONG_VERSION_NUMBER, and
555 : * TLSV1_ALERT_PROTOCOL_VERSION have been observed
556 : * when trying to communicate with an old OpenSSL
557 : * library, or when the client and server specify
558 : * disjoint protocol ranges. NO_PROTOCOLS_AVAILABLE
559 : * occurs if there's a local misconfiguration (which
560 : * can happen despite our checks, if openssl.cnf
561 : * injects a limit we didn't account for). It's not
562 : * very clear what would make OpenSSL return the other
563 : * codes listed here, but a hint about protocol
564 : * versions seems like it's appropriate for all.
565 : */
566 0 : case SSL_R_NO_PROTOCOLS_AVAILABLE:
567 : case SSL_R_UNSUPPORTED_PROTOCOL:
568 : case SSL_R_BAD_PROTOCOL_VERSION_NUMBER:
569 : case SSL_R_UNKNOWN_PROTOCOL:
570 : case SSL_R_UNKNOWN_SSL_VERSION:
571 : case SSL_R_UNSUPPORTED_SSL_VERSION:
572 : case SSL_R_WRONG_SSL_VERSION:
573 : case SSL_R_WRONG_VERSION_NUMBER:
574 : case SSL_R_TLSV1_ALERT_PROTOCOL_VERSION:
575 : #ifdef SSL_R_VERSION_TOO_HIGH
576 : case SSL_R_VERSION_TOO_HIGH:
577 : #endif
578 : #ifdef SSL_R_VERSION_TOO_LOW
579 : case SSL_R_VERSION_TOO_LOW:
580 : #endif
581 0 : give_proto_hint = true;
582 0 : break;
583 19 : default:
584 19 : give_proto_hint = false;
585 19 : break;
586 : }
587 19 : ereport(COMMERROR,
588 : (errcode(ERRCODE_PROTOCOL_VIOLATION),
589 : errmsg("could not accept SSL connection: %s",
590 : SSLerrmessage(ecode)),
591 : err_context.cert_errdetail ? errdetail_internal("%s", err_context.cert_errdetail) : 0,
592 : give_proto_hint ?
593 : errhint("This may indicate that the client does not support any SSL protocol version between %s and %s.",
594 : ssl_min_protocol_version ?
595 : ssl_protocol_version_to_string(ssl_min_protocol_version) :
596 : MIN_OPENSSL_TLS_VERSION,
597 : ssl_max_protocol_version ?
598 : ssl_protocol_version_to_string(ssl_max_protocol_version) :
599 : MAX_OPENSSL_TLS_VERSION) : 0));
600 19 : if (err_context.cert_errdetail)
601 6 : pfree(err_context.cert_errdetail);
602 19 : break;
603 0 : case SSL_ERROR_ZERO_RETURN:
604 0 : ereport(COMMERROR,
605 : (errcode(ERRCODE_PROTOCOL_VIOLATION),
606 : errmsg("could not accept SSL connection: EOF detected")));
607 0 : break;
608 0 : default:
609 0 : ereport(COMMERROR,
610 : (errcode(ERRCODE_PROTOCOL_VIOLATION),
611 : errmsg("unrecognized SSL error code: %d",
612 : err)));
613 0 : break;
614 : }
615 19 : return -1;
616 : }
617 :
618 : /* Get the protocol selected by ALPN */
619 110 : port->alpn_used = false;
620 : {
621 : const unsigned char *selected;
622 : unsigned int len;
623 :
624 110 : SSL_get0_alpn_selected(port->ssl, &selected, &len);
625 :
626 : /* If ALPN is used, check that we negotiated the expected protocol */
627 110 : if (selected != NULL)
628 : {
629 110 : if (len == strlen(PG_ALPN_PROTOCOL) &&
630 110 : memcmp(selected, PG_ALPN_PROTOCOL, strlen(PG_ALPN_PROTOCOL)) == 0)
631 : {
632 110 : port->alpn_used = true;
633 : }
634 : else
635 : {
636 : /* shouldn't happen */
637 0 : ereport(COMMERROR,
638 : (errcode(ERRCODE_PROTOCOL_VIOLATION),
639 : errmsg("received SSL connection request with unexpected ALPN protocol")));
640 : }
641 : }
642 : }
643 :
644 : /* Get client certificate, if available. */
645 110 : port->peer = SSL_get_peer_certificate(port->ssl);
646 :
647 : /* and extract the Common Name and Distinguished Name from it. */
648 110 : port->peer_cn = NULL;
649 110 : port->peer_dn = NULL;
650 110 : port->peer_cert_valid = false;
651 110 : if (port->peer != NULL)
652 : {
653 : int len;
654 29 : X509_NAME *x509name = X509_get_subject_name(port->peer);
655 : char *peer_dn;
656 29 : BIO *bio = NULL;
657 29 : BUF_MEM *bio_buf = NULL;
658 :
659 29 : len = X509_NAME_get_text_by_NID(x509name, NID_commonName, NULL, 0);
660 29 : if (len != -1)
661 : {
662 : char *peer_cn;
663 :
664 29 : peer_cn = MemoryContextAlloc(TopMemoryContext, len + 1);
665 29 : r = X509_NAME_get_text_by_NID(x509name, NID_commonName, peer_cn,
666 : len + 1);
667 29 : peer_cn[len] = '\0';
668 29 : if (r != len)
669 : {
670 : /* shouldn't happen */
671 0 : pfree(peer_cn);
672 0 : return -1;
673 : }
674 :
675 : /*
676 : * Reject embedded NULLs in certificate common name to prevent
677 : * attacks like CVE-2009-4034.
678 : */
679 29 : if (len != strlen(peer_cn))
680 : {
681 0 : ereport(COMMERROR,
682 : (errcode(ERRCODE_PROTOCOL_VIOLATION),
683 : errmsg("SSL certificate's common name contains embedded null")));
684 0 : pfree(peer_cn);
685 0 : return -1;
686 : }
687 :
688 29 : port->peer_cn = peer_cn;
689 : }
690 :
691 29 : bio = BIO_new(BIO_s_mem());
692 29 : if (!bio)
693 : {
694 0 : if (port->peer_cn != NULL)
695 : {
696 0 : pfree(port->peer_cn);
697 0 : port->peer_cn = NULL;
698 : }
699 0 : return -1;
700 : }
701 :
702 : /*
703 : * RFC2253 is the closest thing to an accepted standard format for
704 : * DNs. We have documented how to produce this format from a
705 : * certificate. It uses commas instead of slashes for delimiters,
706 : * which make regular expression matching a bit easier. Also note that
707 : * it prints the Subject fields in reverse order.
708 : */
709 58 : if (X509_NAME_print_ex(bio, x509name, 0, XN_FLAG_RFC2253) == -1 ||
710 29 : BIO_get_mem_ptr(bio, &bio_buf) <= 0)
711 : {
712 0 : BIO_free(bio);
713 0 : if (port->peer_cn != NULL)
714 : {
715 0 : pfree(port->peer_cn);
716 0 : port->peer_cn = NULL;
717 : }
718 0 : return -1;
719 : }
720 29 : peer_dn = MemoryContextAlloc(TopMemoryContext, bio_buf->length + 1);
721 29 : memcpy(peer_dn, bio_buf->data, bio_buf->length);
722 29 : len = bio_buf->length;
723 29 : BIO_free(bio);
724 29 : peer_dn[len] = '\0';
725 29 : if (len != strlen(peer_dn))
726 : {
727 0 : ereport(COMMERROR,
728 : (errcode(ERRCODE_PROTOCOL_VIOLATION),
729 : errmsg("SSL certificate's distinguished name contains embedded null")));
730 0 : pfree(peer_dn);
731 0 : if (port->peer_cn != NULL)
732 : {
733 0 : pfree(port->peer_cn);
734 0 : port->peer_cn = NULL;
735 : }
736 0 : return -1;
737 : }
738 :
739 29 : port->peer_dn = peer_dn;
740 :
741 29 : port->peer_cert_valid = true;
742 : }
743 :
744 110 : return 0;
745 : }
746 :
747 : void
748 129 : be_tls_close(Port *port)
749 : {
750 129 : if (port->ssl)
751 : {
752 129 : SSL_shutdown(port->ssl);
753 129 : SSL_free(port->ssl);
754 129 : port->ssl = NULL;
755 129 : port->ssl_in_use = false;
756 : }
757 :
758 129 : if (port->peer)
759 : {
760 29 : X509_free(port->peer);
761 29 : port->peer = NULL;
762 : }
763 :
764 129 : if (port->peer_cn)
765 : {
766 29 : pfree(port->peer_cn);
767 29 : port->peer_cn = NULL;
768 : }
769 :
770 129 : if (port->peer_dn)
771 : {
772 29 : pfree(port->peer_dn);
773 29 : port->peer_dn = NULL;
774 : }
775 129 : }
776 :
777 : ssize_t
778 552 : be_tls_read(Port *port, void *ptr, size_t len, int *waitfor)
779 : {
780 : ssize_t n;
781 : int err;
782 : unsigned long ecode;
783 :
784 552 : errno = 0;
785 552 : ERR_clear_error();
786 552 : n = SSL_read(port->ssl, ptr, len);
787 552 : err = SSL_get_error(port->ssl, n);
788 552 : ecode = (err != SSL_ERROR_NONE || n < 0) ? ERR_get_error() : 0;
789 552 : switch (err)
790 : {
791 281 : case SSL_ERROR_NONE:
792 : /* a-ok */
793 281 : break;
794 254 : case SSL_ERROR_WANT_READ:
795 254 : *waitfor = WL_SOCKET_READABLE;
796 254 : errno = EWOULDBLOCK;
797 254 : n = -1;
798 254 : break;
799 0 : case SSL_ERROR_WANT_WRITE:
800 0 : *waitfor = WL_SOCKET_WRITEABLE;
801 0 : errno = EWOULDBLOCK;
802 0 : n = -1;
803 0 : break;
804 0 : case SSL_ERROR_SYSCALL:
805 : /* leave it to caller to ereport the value of errno */
806 0 : if (n != -1 || errno == 0)
807 : {
808 0 : errno = ECONNRESET;
809 0 : n = -1;
810 : }
811 0 : break;
812 0 : case SSL_ERROR_SSL:
813 0 : ereport(COMMERROR,
814 : (errcode(ERRCODE_PROTOCOL_VIOLATION),
815 : errmsg("SSL error: %s", SSLerrmessage(ecode))));
816 0 : errno = ECONNRESET;
817 0 : n = -1;
818 0 : break;
819 17 : case SSL_ERROR_ZERO_RETURN:
820 : /* connection was cleanly shut down by peer */
821 17 : n = 0;
822 17 : break;
823 0 : default:
824 0 : ereport(COMMERROR,
825 : (errcode(ERRCODE_PROTOCOL_VIOLATION),
826 : errmsg("unrecognized SSL error code: %d",
827 : err)));
828 0 : errno = ECONNRESET;
829 0 : n = -1;
830 0 : break;
831 : }
832 :
833 552 : return n;
834 : }
835 :
836 : ssize_t
837 196 : be_tls_write(Port *port, const void *ptr, size_t len, int *waitfor)
838 : {
839 : ssize_t n;
840 : int err;
841 : unsigned long ecode;
842 :
843 196 : errno = 0;
844 196 : ERR_clear_error();
845 196 : n = SSL_write(port->ssl, ptr, len);
846 196 : err = SSL_get_error(port->ssl, n);
847 196 : ecode = (err != SSL_ERROR_NONE || n < 0) ? ERR_get_error() : 0;
848 196 : switch (err)
849 : {
850 196 : case SSL_ERROR_NONE:
851 : /* a-ok */
852 196 : break;
853 0 : case SSL_ERROR_WANT_READ:
854 0 : *waitfor = WL_SOCKET_READABLE;
855 0 : errno = EWOULDBLOCK;
856 0 : n = -1;
857 0 : break;
858 0 : case SSL_ERROR_WANT_WRITE:
859 0 : *waitfor = WL_SOCKET_WRITEABLE;
860 0 : errno = EWOULDBLOCK;
861 0 : n = -1;
862 0 : break;
863 0 : case SSL_ERROR_SYSCALL:
864 :
865 : /*
866 : * Leave it to caller to ereport the value of errno. However, if
867 : * errno is still zero then assume it's a read EOF situation, and
868 : * report ECONNRESET. (This seems possible because SSL_write can
869 : * also do reads.)
870 : */
871 0 : if (n != -1 || errno == 0)
872 : {
873 0 : errno = ECONNRESET;
874 0 : n = -1;
875 : }
876 0 : break;
877 0 : case SSL_ERROR_SSL:
878 0 : ereport(COMMERROR,
879 : (errcode(ERRCODE_PROTOCOL_VIOLATION),
880 : errmsg("SSL error: %s", SSLerrmessage(ecode))));
881 0 : errno = ECONNRESET;
882 0 : n = -1;
883 0 : break;
884 0 : case SSL_ERROR_ZERO_RETURN:
885 :
886 : /*
887 : * the SSL connection was closed, leave it to the caller to
888 : * ereport it
889 : */
890 0 : errno = ECONNRESET;
891 0 : n = -1;
892 0 : break;
893 0 : default:
894 0 : ereport(COMMERROR,
895 : (errcode(ERRCODE_PROTOCOL_VIOLATION),
896 : errmsg("unrecognized SSL error code: %d",
897 : err)));
898 0 : errno = ECONNRESET;
899 0 : n = -1;
900 0 : break;
901 : }
902 :
903 196 : return n;
904 : }
905 :
906 : /* ------------------------------------------------------------ */
907 : /* Internal functions */
908 : /* ------------------------------------------------------------ */
909 :
910 : /*
911 : * Private substitute BIO: this does the sending and receiving using send() and
912 : * recv() instead. This is so that we can enable and disable interrupts
913 : * just while calling recv(). We cannot have interrupts occurring while
914 : * the bulk of OpenSSL runs, because it uses malloc() and possibly other
915 : * non-reentrant libc facilities. We also need to call send() and recv()
916 : * directly so it gets passed through the socket/signals layer on Win32.
917 : *
918 : * These functions are closely modelled on the standard socket BIO in OpenSSL;
919 : * see sock_read() and sock_write() in OpenSSL's crypto/bio/bss_sock.c.
920 : */
921 :
922 : static BIO_METHOD *port_bio_method_ptr = NULL;
923 :
924 : static int
925 2452 : port_bio_read(BIO *h, char *buf, int size)
926 : {
927 2452 : int res = 0;
928 2452 : Port *port = (Port *) BIO_get_data(h);
929 :
930 2452 : if (buf != NULL)
931 : {
932 2452 : res = secure_raw_read(port, buf, size);
933 2452 : BIO_clear_retry_flags(h);
934 2452 : port->last_read_was_eof = res == 0;
935 2452 : if (res <= 0)
936 : {
937 : /* If we were interrupted, tell caller to retry */
938 618 : if (errno == EINTR || errno == EWOULDBLOCK || errno == EAGAIN)
939 : {
940 614 : BIO_set_retry_read(h);
941 : }
942 : }
943 : }
944 :
945 2452 : return res;
946 : }
947 :
948 : static int
949 556 : port_bio_write(BIO *h, const char *buf, int size)
950 : {
951 556 : int res = 0;
952 :
953 556 : res = secure_raw_write(((Port *) BIO_get_data(h)), buf, size);
954 556 : BIO_clear_retry_flags(h);
955 556 : if (res <= 0)
956 : {
957 : /* If we were interrupted, tell caller to retry */
958 0 : if (errno == EINTR || errno == EWOULDBLOCK || errno == EAGAIN)
959 : {
960 0 : BIO_set_retry_write(h);
961 : }
962 : }
963 :
964 556 : return res;
965 : }
966 :
967 : static long
968 622 : port_bio_ctrl(BIO *h, int cmd, long num, void *ptr)
969 : {
970 : long res;
971 622 : Port *port = (Port *) BIO_get_data(h);
972 :
973 622 : switch (cmd)
974 : {
975 4 : case BIO_CTRL_EOF:
976 :
977 : /*
978 : * This should not be needed. port_bio_read already has a way to
979 : * signal EOF to OpenSSL. However, OpenSSL made an undocumented,
980 : * backwards-incompatible change and now expects EOF via BIO_ctrl.
981 : * See https://github.com/openssl/openssl/issues/8208
982 : */
983 4 : res = port->last_read_was_eof;
984 4 : break;
985 360 : case BIO_CTRL_FLUSH:
986 : /* libssl expects all BIOs to support BIO_flush. */
987 360 : res = 1;
988 360 : break;
989 258 : default:
990 258 : res = 0;
991 258 : break;
992 : }
993 :
994 622 : return res;
995 : }
996 :
997 : static BIO_METHOD *
998 129 : port_bio_method(void)
999 : {
1000 129 : if (!port_bio_method_ptr)
1001 : {
1002 : int my_bio_index;
1003 :
1004 129 : my_bio_index = BIO_get_new_index();
1005 129 : if (my_bio_index == -1)
1006 0 : return NULL;
1007 129 : my_bio_index |= BIO_TYPE_SOURCE_SINK;
1008 129 : port_bio_method_ptr = BIO_meth_new(my_bio_index, "PostgreSQL backend socket");
1009 129 : if (!port_bio_method_ptr)
1010 0 : return NULL;
1011 258 : if (!BIO_meth_set_write(port_bio_method_ptr, port_bio_write) ||
1012 258 : !BIO_meth_set_read(port_bio_method_ptr, port_bio_read) ||
1013 129 : !BIO_meth_set_ctrl(port_bio_method_ptr, port_bio_ctrl))
1014 : {
1015 0 : BIO_meth_free(port_bio_method_ptr);
1016 0 : port_bio_method_ptr = NULL;
1017 0 : return NULL;
1018 : }
1019 : }
1020 129 : return port_bio_method_ptr;
1021 : }
1022 :
1023 : static int
1024 129 : ssl_set_port_bio(Port *port)
1025 : {
1026 : BIO *bio;
1027 : BIO_METHOD *bio_method;
1028 :
1029 129 : bio_method = port_bio_method();
1030 129 : if (bio_method == NULL)
1031 0 : return 0;
1032 :
1033 129 : bio = BIO_new(bio_method);
1034 129 : if (bio == NULL)
1035 0 : return 0;
1036 :
1037 129 : BIO_set_data(bio, port);
1038 129 : BIO_set_init(bio, 1);
1039 :
1040 129 : SSL_set_bio(port->ssl, bio, bio);
1041 129 : return 1;
1042 : }
1043 :
1044 : /*
1045 : * Load precomputed DH parameters.
1046 : *
1047 : * To prevent "downgrade" attacks, we perform a number of checks
1048 : * to verify that the DBA-generated DH parameters file contains
1049 : * what we expect it to contain.
1050 : */
1051 : static DH *
1052 0 : load_dh_file(char *filename, bool isServerStart)
1053 : {
1054 : FILE *fp;
1055 0 : DH *dh = NULL;
1056 : int codes;
1057 :
1058 : /* attempt to open file. It's not an error if it doesn't exist. */
1059 0 : if ((fp = AllocateFile(filename, "r")) == NULL)
1060 : {
1061 0 : ereport(isServerStart ? FATAL : LOG,
1062 : (errcode_for_file_access(),
1063 : errmsg("could not open DH parameters file \"%s\": %m",
1064 : filename)));
1065 0 : return NULL;
1066 : }
1067 :
1068 0 : dh = PEM_read_DHparams(fp, NULL, NULL, NULL);
1069 0 : FreeFile(fp);
1070 :
1071 0 : if (dh == NULL)
1072 : {
1073 0 : ereport(isServerStart ? FATAL : LOG,
1074 : (errcode(ERRCODE_CONFIG_FILE_ERROR),
1075 : errmsg("could not load DH parameters file: %s",
1076 : SSLerrmessage(ERR_get_error()))));
1077 0 : return NULL;
1078 : }
1079 :
1080 : /* make sure the DH parameters are usable */
1081 0 : if (DH_check(dh, &codes) == 0)
1082 : {
1083 0 : ereport(isServerStart ? FATAL : LOG,
1084 : (errcode(ERRCODE_CONFIG_FILE_ERROR),
1085 : errmsg("invalid DH parameters: %s",
1086 : SSLerrmessage(ERR_get_error()))));
1087 0 : DH_free(dh);
1088 0 : return NULL;
1089 : }
1090 0 : if (codes & DH_CHECK_P_NOT_PRIME)
1091 : {
1092 0 : ereport(isServerStart ? FATAL : LOG,
1093 : (errcode(ERRCODE_CONFIG_FILE_ERROR),
1094 : errmsg("invalid DH parameters: p is not prime")));
1095 0 : DH_free(dh);
1096 0 : return NULL;
1097 : }
1098 0 : if ((codes & DH_NOT_SUITABLE_GENERATOR) &&
1099 0 : (codes & DH_CHECK_P_NOT_SAFE_PRIME))
1100 : {
1101 0 : ereport(isServerStart ? FATAL : LOG,
1102 : (errcode(ERRCODE_CONFIG_FILE_ERROR),
1103 : errmsg("invalid DH parameters: neither suitable generator or safe prime")));
1104 0 : DH_free(dh);
1105 0 : return NULL;
1106 : }
1107 :
1108 0 : return dh;
1109 : }
1110 :
1111 : /*
1112 : * Load hardcoded DH parameters.
1113 : *
1114 : * If DH parameters cannot be loaded from a specified file, we can load
1115 : * the hardcoded DH parameters supplied with the backend to prevent
1116 : * problems.
1117 : */
1118 : static DH *
1119 31 : load_dh_buffer(const char *buffer, size_t len)
1120 : {
1121 : BIO *bio;
1122 31 : DH *dh = NULL;
1123 :
1124 31 : bio = BIO_new_mem_buf(buffer, len);
1125 31 : if (bio == NULL)
1126 0 : return NULL;
1127 31 : dh = PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
1128 31 : if (dh == NULL)
1129 0 : ereport(DEBUG2,
1130 : (errmsg_internal("DH load buffer: %s",
1131 : SSLerrmessage(ERR_get_error()))));
1132 31 : BIO_free(bio);
1133 :
1134 31 : return dh;
1135 : }
1136 :
1137 : /*
1138 : * Passphrase collection callback using ssl_passphrase_command
1139 : */
1140 : static int
1141 8 : ssl_external_passwd_cb(char *buf, int size, int rwflag, void *userdata)
1142 : {
1143 : /* same prompt as OpenSSL uses internally */
1144 8 : const char *prompt = "Enter PEM pass phrase:";
1145 :
1146 : Assert(rwflag == 0);
1147 :
1148 8 : return run_ssl_passphrase_command(prompt, ssl_is_server_start, buf, size);
1149 : }
1150 :
1151 : /*
1152 : * Dummy passphrase callback
1153 : *
1154 : * If OpenSSL is told to use a passphrase-protected server key, by default
1155 : * it will issue a prompt on /dev/tty and try to read a key from there.
1156 : * That's no good during a postmaster SIGHUP cycle, not to mention SSL context
1157 : * reload in an EXEC_BACKEND postmaster child. So override it with this dummy
1158 : * function that just returns an empty passphrase, guaranteeing failure.
1159 : */
1160 : static int
1161 1 : dummy_ssl_passwd_cb(char *buf, int size, int rwflag, void *userdata)
1162 : {
1163 : /* Set flag to change the error message we'll report */
1164 1 : dummy_ssl_passwd_cb_called = true;
1165 : /* And return empty string */
1166 : Assert(size > 0);
1167 1 : buf[0] = '\0';
1168 1 : return 0;
1169 : }
1170 :
1171 : /*
1172 : * Examines the provided certificate name, and if it's too long to log or
1173 : * contains unprintable ASCII, escapes and truncates it. The return value is
1174 : * always a new palloc'd string. (The input string is still modified in place,
1175 : * for ease of implementation.)
1176 : */
1177 : static char *
1178 12 : prepare_cert_name(char *name)
1179 : {
1180 12 : size_t namelen = strlen(name);
1181 12 : char *truncated = name;
1182 :
1183 : /*
1184 : * Common Names are 64 chars max, so for a common case where the CN is the
1185 : * last field, we can still print the longest possible CN with a
1186 : * 7-character prefix (".../CN=[64 chars]"), for a reasonable limit of 71
1187 : * characters.
1188 : */
1189 : #define MAXLEN 71
1190 :
1191 12 : if (namelen > MAXLEN)
1192 : {
1193 : /*
1194 : * Keep the end of the name, not the beginning, since the most
1195 : * specific field is likely to give users the most information.
1196 : */
1197 1 : truncated = name + namelen - MAXLEN;
1198 1 : truncated[0] = truncated[1] = truncated[2] = '.';
1199 1 : namelen = MAXLEN;
1200 : }
1201 :
1202 : #undef MAXLEN
1203 :
1204 12 : return pg_clean_ascii(truncated, 0);
1205 : }
1206 :
1207 : /*
1208 : * Certificate verification callback
1209 : *
1210 : * This callback allows us to examine intermediate problems during
1211 : * verification, for later logging.
1212 : *
1213 : * This callback also allows us to override the default acceptance
1214 : * criteria (e.g., accepting self-signed or expired certs), but
1215 : * for now we accept the default checks.
1216 : */
1217 : static int
1218 93 : verify_cb(int ok, X509_STORE_CTX *ctx)
1219 : {
1220 : int depth;
1221 : int errcode;
1222 : const char *errstring;
1223 : StringInfoData str;
1224 : X509 *cert;
1225 : SSL *ssl;
1226 : struct CallbackErr *cb_err;
1227 :
1228 93 : if (ok)
1229 : {
1230 : /* Nothing to do for the successful case. */
1231 87 : return ok;
1232 : }
1233 :
1234 : /* Pull all the information we have on the verification failure. */
1235 6 : depth = X509_STORE_CTX_get_error_depth(ctx);
1236 6 : errcode = X509_STORE_CTX_get_error(ctx);
1237 6 : errstring = X509_verify_cert_error_string(errcode);
1238 :
1239 : /*
1240 : * Extract the current SSL and CallbackErr object to use for passing error
1241 : * detail back from the callback.
1242 : */
1243 6 : ssl = X509_STORE_CTX_get_ex_data(ctx, SSL_get_ex_data_X509_STORE_CTX_idx());
1244 6 : cb_err = (struct CallbackErr *) SSL_get_ex_data(ssl, 0);
1245 :
1246 6 : initStringInfo(&str);
1247 6 : appendStringInfo(&str,
1248 6 : _("Client certificate verification failed at depth %d: %s."),
1249 : depth, errstring);
1250 :
1251 6 : cert = X509_STORE_CTX_get_current_cert(ctx);
1252 6 : if (cert)
1253 : {
1254 : char *subject,
1255 : *issuer;
1256 : char *sub_prepared,
1257 : *iss_prepared;
1258 : char *serialno;
1259 : ASN1_INTEGER *sn;
1260 : BIGNUM *b;
1261 :
1262 : /*
1263 : * Get the Subject and Issuer for logging, but don't let maliciously
1264 : * huge certs flood the logs, and don't reflect non-ASCII bytes into
1265 : * it either.
1266 : */
1267 6 : subject = X509_NAME_to_cstring(X509_get_subject_name(cert));
1268 6 : sub_prepared = prepare_cert_name(subject);
1269 6 : pfree(subject);
1270 :
1271 6 : issuer = X509_NAME_to_cstring(X509_get_issuer_name(cert));
1272 6 : iss_prepared = prepare_cert_name(issuer);
1273 6 : pfree(issuer);
1274 :
1275 : /*
1276 : * Pull the serial number, too, in case a Subject is still ambiguous.
1277 : * This mirrors be_tls_get_peer_serial().
1278 : */
1279 6 : sn = X509_get_serialNumber(cert);
1280 6 : b = ASN1_INTEGER_to_BN(sn, NULL);
1281 6 : serialno = BN_bn2dec(b);
1282 :
1283 6 : appendStringInfoChar(&str, '\n');
1284 6 : appendStringInfo(&str,
1285 6 : _("Failed certificate data (unverified): subject \"%s\", serial number %s, issuer \"%s\"."),
1286 0 : sub_prepared, serialno ? serialno : _("unknown"),
1287 : iss_prepared);
1288 :
1289 6 : BN_free(b);
1290 6 : OPENSSL_free(serialno);
1291 6 : pfree(iss_prepared);
1292 6 : pfree(sub_prepared);
1293 : }
1294 :
1295 : /* Store our detail message to be logged later. */
1296 6 : cb_err->cert_errdetail = str.data;
1297 :
1298 6 : return ok;
1299 : }
1300 :
1301 : /*
1302 : * This callback is used to copy SSL information messages
1303 : * into the PostgreSQL log.
1304 : */
1305 : static void
1306 3052 : info_cb(const SSL *ssl, int type, int args)
1307 : {
1308 : const char *desc;
1309 :
1310 3052 : desc = SSL_state_string_long(ssl);
1311 :
1312 3052 : switch (type)
1313 : {
1314 129 : case SSL_CB_HANDSHAKE_START:
1315 129 : ereport(DEBUG4,
1316 : (errmsg_internal("SSL: handshake start: \"%s\"", desc)));
1317 129 : break;
1318 110 : case SSL_CB_HANDSHAKE_DONE:
1319 110 : ereport(DEBUG4,
1320 : (errmsg_internal("SSL: handshake done: \"%s\"", desc)));
1321 110 : break;
1322 2178 : case SSL_CB_ACCEPT_LOOP:
1323 2178 : ereport(DEBUG4,
1324 : (errmsg_internal("SSL: accept loop: \"%s\"", desc)));
1325 2178 : break;
1326 489 : case SSL_CB_ACCEPT_EXIT:
1327 489 : ereport(DEBUG4,
1328 : (errmsg_internal("SSL: accept exit (%d): \"%s\"", args, desc)));
1329 489 : break;
1330 0 : case SSL_CB_CONNECT_LOOP:
1331 0 : ereport(DEBUG4,
1332 : (errmsg_internal("SSL: connect loop: \"%s\"", desc)));
1333 0 : break;
1334 0 : case SSL_CB_CONNECT_EXIT:
1335 0 : ereport(DEBUG4,
1336 : (errmsg_internal("SSL: connect exit (%d): \"%s\"", args, desc)));
1337 0 : break;
1338 26 : case SSL_CB_READ_ALERT:
1339 26 : ereport(DEBUG4,
1340 : (errmsg_internal("SSL: read alert (0x%04x): \"%s\"", args, desc)));
1341 26 : break;
1342 120 : case SSL_CB_WRITE_ALERT:
1343 120 : ereport(DEBUG4,
1344 : (errmsg_internal("SSL: write alert (0x%04x): \"%s\"", args, desc)));
1345 120 : break;
1346 : }
1347 3052 : }
1348 :
1349 : /* See pqcomm.h comments on OpenSSL implementation of ALPN (RFC 7301) */
1350 : static const unsigned char alpn_protos[] = PG_ALPN_PROTOCOL_VECTOR;
1351 :
1352 : /*
1353 : * Server callback for ALPN negotiation. We use the standard "helper" function
1354 : * even though currently we only accept one value.
1355 : */
1356 : static int
1357 238 : alpn_cb(SSL *ssl,
1358 : const unsigned char **out,
1359 : unsigned char *outlen,
1360 : const unsigned char *in,
1361 : unsigned int inlen,
1362 : void *userdata)
1363 : {
1364 : /*
1365 : * Why does OpenSSL provide a helper function that requires a nonconst
1366 : * vector when the callback is declared to take a const vector? What are
1367 : * we to do with that?
1368 : */
1369 : int retval;
1370 :
1371 : Assert(userdata != NULL);
1372 : Assert(out != NULL);
1373 : Assert(outlen != NULL);
1374 : Assert(in != NULL);
1375 :
1376 238 : retval = SSL_select_next_proto((unsigned char **) out, outlen,
1377 : alpn_protos, sizeof(alpn_protos),
1378 : in, inlen);
1379 238 : if (*out == NULL || *outlen > sizeof(alpn_protos) || *outlen <= 0)
1380 0 : return SSL_TLSEXT_ERR_NOACK; /* can't happen */
1381 :
1382 238 : if (retval == OPENSSL_NPN_NEGOTIATED)
1383 238 : return SSL_TLSEXT_ERR_OK;
1384 : else
1385 : {
1386 : /*
1387 : * The client doesn't support our protocol. Reject the connection
1388 : * with TLS "no_application_protocol" alert, per RFC 7301.
1389 : */
1390 0 : return SSL_TLSEXT_ERR_ALERT_FATAL;
1391 : }
1392 : }
1393 :
1394 :
1395 : /*
1396 : * Set DH parameters for generating ephemeral DH keys. The
1397 : * DH parameters can take a long time to compute, so they must be
1398 : * precomputed.
1399 : *
1400 : * Since few sites will bother to create a parameter file, we also
1401 : * provide a fallback to the parameters provided by the OpenSSL
1402 : * project.
1403 : *
1404 : * These values can be static (once loaded or computed) since the
1405 : * OpenSSL library can efficiently generate random keys from the
1406 : * information provided.
1407 : */
1408 : static bool
1409 31 : initialize_dh(SSL_CTX *context, bool isServerStart)
1410 : {
1411 31 : DH *dh = NULL;
1412 :
1413 31 : SSL_CTX_set_options(context, SSL_OP_SINGLE_DH_USE);
1414 :
1415 31 : if (ssl_dh_params_file[0])
1416 0 : dh = load_dh_file(ssl_dh_params_file, isServerStart);
1417 31 : if (!dh)
1418 31 : dh = load_dh_buffer(FILE_DH2048, sizeof(FILE_DH2048));
1419 31 : if (!dh)
1420 : {
1421 0 : ereport(isServerStart ? FATAL : LOG,
1422 : (errcode(ERRCODE_CONFIG_FILE_ERROR),
1423 : errmsg("DH: could not load DH parameters")));
1424 0 : return false;
1425 : }
1426 :
1427 31 : if (SSL_CTX_set_tmp_dh(context, dh) != 1)
1428 : {
1429 0 : ereport(isServerStart ? FATAL : LOG,
1430 : (errcode(ERRCODE_CONFIG_FILE_ERROR),
1431 : errmsg("DH: could not set DH parameters: %s",
1432 : SSLerrmessage(ERR_get_error()))));
1433 0 : DH_free(dh);
1434 0 : return false;
1435 : }
1436 :
1437 31 : DH_free(dh);
1438 31 : return true;
1439 : }
1440 :
1441 : /*
1442 : * Set ECDH parameters for generating ephemeral Elliptic Curve DH
1443 : * keys. This is much simpler than the DH parameters, as we just
1444 : * need to provide the name of the curve to OpenSSL.
1445 : */
1446 : static bool
1447 31 : initialize_ecdh(SSL_CTX *context, bool isServerStart)
1448 : {
1449 : #ifndef OPENSSL_NO_ECDH
1450 31 : if (SSL_CTX_set1_groups_list(context, SSLECDHCurve) != 1)
1451 : {
1452 : /*
1453 : * OpenSSL 3.3.0 introduced proper error messages for group parsing
1454 : * errors, earlier versions returns "no SSL error reported" which is
1455 : * far from helpful. For older versions, we replace with a better
1456 : * error message. Injecting the error into the OpenSSL error queue
1457 : * need APIs from OpenSSL 3.0.
1458 : */
1459 2 : ereport(isServerStart ? FATAL : LOG,
1460 : errcode(ERRCODE_CONFIG_FILE_ERROR),
1461 : errmsg("could not set group names specified in ssl_groups: %s",
1462 : SSLerrmessageExt(ERR_get_error(),
1463 : _("No valid groups found"))),
1464 : errhint("Ensure that each group name is spelled correctly and supported by the installed version of OpenSSL."));
1465 0 : return false;
1466 : }
1467 : #endif
1468 :
1469 29 : return true;
1470 : }
1471 :
1472 : /*
1473 : * Obtain reason string for passed SSL errcode with replacement
1474 : *
1475 : * The error message supplied in replacement will be used in case the error
1476 : * code from OpenSSL is 0, else the error message from SSLerrmessage() will
1477 : * be returned.
1478 : *
1479 : * Not all versions of OpenSSL place an error on the queue even for failing
1480 : * operations, which will yield "no SSL error reported" by SSLerrmessage. This
1481 : * function can be used to ensure that a proper error message is displayed for
1482 : * versions reporting no error, while using the OpenSSL error via SSLerrmessage
1483 : * for versions where there is one.
1484 : */
1485 : static const char *
1486 2 : SSLerrmessageExt(unsigned long ecode, const char *replacement)
1487 : {
1488 2 : if (ecode == 0)
1489 2 : return replacement;
1490 : else
1491 0 : return SSLerrmessage(ecode);
1492 : }
1493 :
1494 : /*
1495 : * Obtain reason string for passed SSL errcode
1496 : *
1497 : * ERR_get_error() is used by caller to get errcode to pass here.
1498 : *
1499 : * Some caution is needed here since ERR_reason_error_string will return NULL
1500 : * if it doesn't recognize the error code, or (in OpenSSL >= 3) if the code
1501 : * represents a system errno value. We don't want to return NULL ever.
1502 : */
1503 : static const char *
1504 21 : SSLerrmessage(unsigned long ecode)
1505 : {
1506 : const char *errreason;
1507 : static char errbuf[36];
1508 :
1509 21 : if (ecode == 0)
1510 0 : return _("no SSL error reported");
1511 21 : errreason = ERR_reason_error_string(ecode);
1512 21 : if (errreason != NULL)
1513 21 : return errreason;
1514 :
1515 : /*
1516 : * In OpenSSL 3.0.0 and later, ERR_reason_error_string does not map system
1517 : * errno values anymore. (See OpenSSL source code for the explanation.)
1518 : * We can cover that shortcoming with this bit of code. Older OpenSSL
1519 : * versions don't have the ERR_SYSTEM_ERROR macro, but that's okay because
1520 : * they don't have the shortcoming either.
1521 : */
1522 : #ifdef ERR_SYSTEM_ERROR
1523 0 : if (ERR_SYSTEM_ERROR(ecode))
1524 0 : return strerror(ERR_GET_REASON(ecode));
1525 : #endif
1526 :
1527 : /* No choice but to report the numeric ecode */
1528 0 : snprintf(errbuf, sizeof(errbuf), _("SSL error code %lu"), ecode);
1529 0 : return errbuf;
1530 : }
1531 :
1532 : int
1533 176 : be_tls_get_cipher_bits(Port *port)
1534 : {
1535 : int bits;
1536 :
1537 176 : if (port->ssl)
1538 : {
1539 176 : SSL_get_cipher_bits(port->ssl, &bits);
1540 176 : return bits;
1541 : }
1542 : else
1543 0 : return 0;
1544 : }
1545 :
1546 : const char *
1547 177 : be_tls_get_version(Port *port)
1548 : {
1549 177 : if (port->ssl)
1550 177 : return SSL_get_version(port->ssl);
1551 : else
1552 0 : return NULL;
1553 : }
1554 :
1555 : const char *
1556 177 : be_tls_get_cipher(Port *port)
1557 : {
1558 177 : if (port->ssl)
1559 177 : return SSL_get_cipher(port->ssl);
1560 : else
1561 0 : return NULL;
1562 : }
1563 :
1564 : void
1565 88 : be_tls_get_peer_subject_name(Port *port, char *ptr, size_t len)
1566 : {
1567 88 : if (port->peer)
1568 27 : strlcpy(ptr, X509_NAME_to_cstring(X509_get_subject_name(port->peer)), len);
1569 : else
1570 61 : ptr[0] = '\0';
1571 88 : }
1572 :
1573 : void
1574 89 : be_tls_get_peer_issuer_name(Port *port, char *ptr, size_t len)
1575 : {
1576 89 : if (port->peer)
1577 28 : strlcpy(ptr, X509_NAME_to_cstring(X509_get_issuer_name(port->peer)), len);
1578 : else
1579 61 : ptr[0] = '\0';
1580 89 : }
1581 :
1582 : void
1583 89 : be_tls_get_peer_serial(Port *port, char *ptr, size_t len)
1584 : {
1585 89 : if (port->peer)
1586 : {
1587 : ASN1_INTEGER *serial;
1588 : BIGNUM *b;
1589 : char *decimal;
1590 :
1591 28 : serial = X509_get_serialNumber(port->peer);
1592 28 : b = ASN1_INTEGER_to_BN(serial, NULL);
1593 28 : decimal = BN_bn2dec(b);
1594 :
1595 28 : BN_free(b);
1596 28 : strlcpy(ptr, decimal, len);
1597 28 : OPENSSL_free(decimal);
1598 : }
1599 : else
1600 61 : ptr[0] = '\0';
1601 89 : }
1602 :
1603 : char *
1604 4 : be_tls_get_certificate_hash(Port *port, size_t *len)
1605 : {
1606 : X509 *server_cert;
1607 : char *cert_hash;
1608 4 : const EVP_MD *algo_type = NULL;
1609 : unsigned char hash[EVP_MAX_MD_SIZE]; /* size for SHA-512 */
1610 : unsigned int hash_size;
1611 : int algo_nid;
1612 :
1613 4 : *len = 0;
1614 4 : server_cert = SSL_get_certificate(port->ssl);
1615 4 : if (server_cert == NULL)
1616 0 : return NULL;
1617 :
1618 : /*
1619 : * Get the signature algorithm of the certificate to determine the hash
1620 : * algorithm to use for the result. Prefer X509_get_signature_info(),
1621 : * introduced in OpenSSL 1.1.1, which can handle RSA-PSS signatures.
1622 : */
1623 : #if HAVE_X509_GET_SIGNATURE_INFO
1624 4 : if (!X509_get_signature_info(server_cert, &algo_nid, NULL, NULL, NULL))
1625 : #else
1626 : if (!OBJ_find_sigid_algs(X509_get_signature_nid(server_cert),
1627 : &algo_nid, NULL))
1628 : #endif
1629 0 : elog(ERROR, "could not determine server certificate signature algorithm");
1630 :
1631 : /*
1632 : * The TLS server's certificate bytes need to be hashed with SHA-256 if
1633 : * its signature algorithm is MD5 or SHA-1 as per RFC 5929
1634 : * (https://tools.ietf.org/html/rfc5929#section-4.1). If something else
1635 : * is used, the same hash as the signature algorithm is used.
1636 : */
1637 4 : switch (algo_nid)
1638 : {
1639 0 : case NID_md5:
1640 : case NID_sha1:
1641 0 : algo_type = EVP_sha256();
1642 0 : break;
1643 4 : default:
1644 4 : algo_type = EVP_get_digestbynid(algo_nid);
1645 4 : if (algo_type == NULL)
1646 0 : elog(ERROR, "could not find digest for NID %s",
1647 : OBJ_nid2sn(algo_nid));
1648 4 : break;
1649 : }
1650 :
1651 : /* generate and save the certificate hash */
1652 4 : if (!X509_digest(server_cert, algo_type, hash, &hash_size))
1653 0 : elog(ERROR, "could not generate server certificate hash");
1654 :
1655 4 : cert_hash = palloc(hash_size);
1656 4 : memcpy(cert_hash, hash, hash_size);
1657 4 : *len = hash_size;
1658 :
1659 4 : return cert_hash;
1660 : }
1661 :
1662 : /*
1663 : * Convert an X509 subject name to a cstring.
1664 : *
1665 : */
1666 : static char *
1667 67 : X509_NAME_to_cstring(X509_NAME *name)
1668 : {
1669 67 : BIO *membuf = BIO_new(BIO_s_mem());
1670 : int i,
1671 : nid,
1672 67 : count = X509_NAME_entry_count(name);
1673 : X509_NAME_ENTRY *e;
1674 : ASN1_STRING *v;
1675 : const char *field_name;
1676 : size_t size;
1677 : char nullterm;
1678 : char *sp;
1679 : char *dp;
1680 : char *result;
1681 :
1682 67 : if (membuf == NULL)
1683 0 : ereport(ERROR,
1684 : (errcode(ERRCODE_OUT_OF_MEMORY),
1685 : errmsg("could not create BIO")));
1686 :
1687 67 : (void) BIO_set_close(membuf, BIO_CLOSE);
1688 145 : for (i = 0; i < count; i++)
1689 : {
1690 78 : e = X509_NAME_get_entry(name, i);
1691 78 : nid = OBJ_obj2nid(X509_NAME_ENTRY_get_object(e));
1692 78 : if (nid == NID_undef)
1693 0 : ereport(ERROR,
1694 : (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
1695 : errmsg("could not get NID for ASN1_OBJECT object")));
1696 78 : v = X509_NAME_ENTRY_get_data(e);
1697 78 : field_name = OBJ_nid2sn(nid);
1698 78 : if (field_name == NULL)
1699 0 : field_name = OBJ_nid2ln(nid);
1700 78 : if (field_name == NULL)
1701 0 : ereport(ERROR,
1702 : (errcode(ERRCODE_INVALID_PARAMETER_VALUE),
1703 : errmsg("could not convert NID %d to an ASN1_OBJECT structure", nid)));
1704 78 : BIO_printf(membuf, "/%s=", field_name);
1705 78 : ASN1_STRING_print_ex(membuf, v,
1706 : ((ASN1_STRFLGS_RFC2253 & ~ASN1_STRFLGS_ESC_MSB)
1707 : | ASN1_STRFLGS_UTF8_CONVERT));
1708 : }
1709 :
1710 : /* ensure null termination of the BIO's content */
1711 67 : nullterm = '\0';
1712 67 : BIO_write(membuf, &nullterm, 1);
1713 67 : size = BIO_get_mem_data(membuf, &sp);
1714 67 : dp = pg_any_to_server(sp, size - 1, PG_UTF8);
1715 :
1716 67 : result = pstrdup(dp);
1717 67 : if (dp != sp)
1718 0 : pfree(dp);
1719 67 : if (BIO_free(membuf) != 1)
1720 0 : elog(ERROR, "could not free OpenSSL BIO structure");
1721 :
1722 67 : return result;
1723 : }
1724 :
1725 : /*
1726 : * Convert TLS protocol version GUC enum to OpenSSL values
1727 : *
1728 : * This is a straightforward one-to-one mapping, but doing it this way makes
1729 : * the definitions of ssl_min_protocol_version and ssl_max_protocol_version
1730 : * independent of OpenSSL availability and version.
1731 : *
1732 : * If a version is passed that is not supported by the current OpenSSL
1733 : * version, then we return -1. If a nonnegative value is returned,
1734 : * subsequent code can assume it's working with a supported version.
1735 : *
1736 : * Note: this is rather similar to libpq's routine in fe-secure-openssl.c,
1737 : * so make sure to update both routines if changing this one.
1738 : */
1739 : static int
1740 33 : ssl_protocol_version_to_openssl(int v)
1741 : {
1742 33 : switch (v)
1743 : {
1744 0 : case PG_TLS_ANY:
1745 0 : return 0;
1746 0 : case PG_TLS1_VERSION:
1747 0 : return TLS1_VERSION;
1748 1 : case PG_TLS1_1_VERSION:
1749 : #ifdef TLS1_1_VERSION
1750 1 : return TLS1_1_VERSION;
1751 : #else
1752 : break;
1753 : #endif
1754 32 : case PG_TLS1_2_VERSION:
1755 : #ifdef TLS1_2_VERSION
1756 32 : return TLS1_2_VERSION;
1757 : #else
1758 : break;
1759 : #endif
1760 0 : case PG_TLS1_3_VERSION:
1761 : #ifdef TLS1_3_VERSION
1762 0 : return TLS1_3_VERSION;
1763 : #else
1764 : break;
1765 : #endif
1766 : }
1767 :
1768 0 : return -1;
1769 : }
1770 :
1771 : /*
1772 : * Likewise provide a mapping to strings.
1773 : */
1774 : static const char *
1775 0 : ssl_protocol_version_to_string(int v)
1776 : {
1777 0 : switch (v)
1778 : {
1779 0 : case PG_TLS_ANY:
1780 0 : return "any";
1781 0 : case PG_TLS1_VERSION:
1782 0 : return "TLSv1";
1783 0 : case PG_TLS1_1_VERSION:
1784 0 : return "TLSv1.1";
1785 0 : case PG_TLS1_2_VERSION:
1786 0 : return "TLSv1.2";
1787 0 : case PG_TLS1_3_VERSION:
1788 0 : return "TLSv1.3";
1789 : }
1790 :
1791 0 : return "(unrecognized)";
1792 : }
1793 :
1794 :
1795 : static void
1796 32 : default_openssl_tls_init(SSL_CTX *context, bool isServerStart)
1797 : {
1798 32 : if (isServerStart)
1799 : {
1800 29 : if (ssl_passphrase_command[0])
1801 7 : SSL_CTX_set_default_passwd_cb(context, ssl_external_passwd_cb);
1802 : }
1803 : else
1804 : {
1805 3 : if (ssl_passphrase_command[0] && ssl_passphrase_command_supports_reload)
1806 1 : SSL_CTX_set_default_passwd_cb(context, ssl_external_passwd_cb);
1807 : else
1808 :
1809 : /*
1810 : * If reloading and no external command is configured, override
1811 : * OpenSSL's default handling of passphrase-protected files,
1812 : * because we don't want to prompt for a passphrase in an
1813 : * already-running server.
1814 : */
1815 2 : SSL_CTX_set_default_passwd_cb(context, dummy_ssl_passwd_cb);
1816 : }
1817 32 : }
|
