Skip to content

Commit f5465fa

Browse files
peterepetere
committed
Allow specifying CRL directory
Add another method to specify CRLs, hashed directory method, for both server and client side. This offers a means for server or libpq to load only CRLs that are required to verify a certificate. The CRL directory is specifed by separate GUC variables or connection options ssl_crl_dir and sslcrldir, alongside the existing ssl_crl_file and sslcrl, so both methods can be used at the same time. Author: Kyotaro Horiguchi <horikyota.ntt@gmail.com> Discussion: https://www.postgresql.org/message-id/flat/20200731.173911.904649928639357911.horikyota.ntt@gmail.com
1 parent 128dd90 commit f5465fa

File tree

20 files changed

+255
-17
lines changed

20 files changed

+255
-17
lines changed

‎contrib/postgres_fdw/expected/postgres_fdw.out‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8946,7 +8946,7 @@ DO $d$
89468946
END;
89478947
$d$;
89488948
ERROR: invalid option "password"
8949-
HINT: Valid options in this context are: service, passfile, channel_binding, connect_timeout, dbname, host, hostaddr, port, options, application_name, keepalives, keepalives_idle, keepalives_interval, keepalives_count, tcp_user_timeout, sslmode, sslcompression, sslcert, sslkey, sslrootcert, sslcrl, requirepeer, ssl_min_protocol_version, ssl_max_protocol_version, gssencmode, krbsrvname, gsslib, target_session_attrs, use_remote_estimate, fdw_startup_cost, fdw_tuple_cost, extensions, updatable, fetch_size, batch_size
8949+
HINT: Valid options in this context are: service, passfile, channel_binding, connect_timeout, dbname, host, hostaddr, port, options, application_name, keepalives, keepalives_idle, keepalives_interval, keepalives_count, tcp_user_timeout, sslmode, sslcompression, sslcert, sslkey, sslrootcert, sslcrl, sslcrldir, requirepeer, ssl_min_protocol_version, ssl_max_protocol_version, gssencmode, krbsrvname, gsslib, target_session_attrs, use_remote_estimate, fdw_startup_cost, fdw_tuple_cost, extensions, updatable, fetch_size, batch_size
89508950
CONTEXT: SQL statement "ALTER SERVER loopback_nopw OPTIONS (ADD password 'dummypw')"
89518951
PL/pgSQL function inline_code_block line 3 at EXECUTE
89528952
-- If we add a password for our user mapping instead, we should get a different

‎doc/src/sgml/config.sgml‎

Lines changed: 35 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1216,7 +1216,41 @@ include_dir 'conf.d'
12161216
Relative paths are relative to the data directory.
12171217
This parameter can only be set in the <filename>postgresql.conf</filename>
12181218
file or on the server command line.
1219-
The default is empty, meaning no CRL file is loaded.
1219+
The default is empty, meaning no CRL file is loaded (unless
1220+
<xref linkend="guc-ssl-crl-dir"/> is set).
1221+
</para>
1222+
</listitem>
1223+
</varlistentry>
1224+
1225+
<varlistentry id="guc-ssl-crl-dir" xreflabel="ssl_crl_dir">
1226+
<term><varname>ssl_crl_dir</varname> (<type>string</type>)
1227+
<indexterm>
1228+
<primary><varname>ssl_crl_dir</varname> configuration parameter</primary>
1229+
</indexterm>
1230+
</term>
1231+
<listitem>
1232+
<para>
1233+
Specifies the name of the directory containing the SSL server
1234+
certificate revocation list (CRL). Relative paths are relative to the
1235+
data directory. This parameter can only be set in
1236+
the <filename>postgresql.conf</filename> file or on the server command
1237+
line. The default is empty, meaning no CRLs are used (unless
1238+
<xref linkend="guc-ssl-crl-file"/> is set).
1239+
</para>
1240+
1241+
<para>
1242+
The directory needs to be prepared with the OpenSSL command
1243+
<literal>openssl rehash</literal> or <literal>c_rehash</literal>. See
1244+
its documentation for details.
1245+
</para>
1246+
1247+
<para>
1248+
When using this setting, CRLs in the specified directory are loaded
1249+
on-demand at connection time. New CRLs can be added to the directory
1250+
and will be used immediately. This is unlike <xref
1251+
linkend="guc-ssl-crl-file"/>, which causes the CRL in the file to be
1252+
loaded at server start time or when the configuration is reloaded.
1253+
Both settings can be used together.
12201254
</para>
12211255
</listitem>
12221256
</varlistentry>

‎doc/src/sgml/libpq.sgml‎

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1723,12 +1723,38 @@ postgresql://%2Fvar%2Flib%2Fpostgresql/dbname
17231723
This parameter specifies the file name of the SSL certificate
17241724
revocation list (CRL). Certificates listed in this file, if it
17251725
exists, will be rejected while attempting to authenticate the
1726-
server's certificate. The default is
1726+
server's certificate. If neither
1727+
<xref linkend='libpq-connect-sslcrl'/> nor
1728+
<xref linkend='libpq-connect-sslcrldir'/> is set, this setting is
1729+
taken as
17271730
<filename>~/.postgresql/root.crl</filename>.
17281731
</para>
17291732
</listitem>
17301733
</varlistentry>
17311734

1735+
<varlistentry id="libpq-connect-sslcrldir" xreflabel="sslcrldir">
1736+
<term><literal>sslcrldir</literal></term>
1737+
<listitem>
1738+
<para>
1739+
This parameter specifies the directory name of the SSL certificate
1740+
revocation list (CRL). Certificates listed in the files in this
1741+
directory, if it exists, will be rejected while attempting to
1742+
authenticate the server's certificate.
1743+
</para>
1744+
1745+
<para>
1746+
The directory needs to be prepared with the OpenSSL command
1747+
<literal>openssl rehash</literal> or <literal>c_rehash</literal>. See
1748+
its documentation for details.
1749+
</para>
1750+
1751+
<para>
1752+
Both <literal>sslcrl</literal> and <literal>sslcrldir</literal> can be
1753+
specified together.
1754+
</para>
1755+
</listitem>
1756+
</varlistentry>
1757+
17321758
<varlistentry id="libpq-connect-requirepeer" xreflabel="requirepeer">
17331759
<term><literal>requirepeer</literal></term>
17341760
<listitem>

‎src/backend/libpq/be-secure-openssl.c‎

Lines changed: 23 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -285,26 +285,46 @@ be_tls_init(bool isServerStart)
285285
* http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci803160,00.html
286286
*----------
287287
*/
288-
if (ssl_crl_file[0])
288+
if (ssl_crl_file[0] || ssl_crl_dir[0])
289289
{
290290
X509_STORE *cvstore = SSL_CTX_get_cert_store(context);
291291

292292
if (cvstore)
293293
{
294294
/* Set the flags to check against the complete CRL chain */
295-
if (X509_STORE_load_locations(cvstore, ssl_crl_file, NULL) == 1)
295+
if (X509_STORE_load_locations(cvstore,
296+
ssl_crl_file[0] ? ssl_crl_file : NULL,
297+
ssl_crl_dir[0] ? ssl_crl_dir : NULL)
298+
== 1)
296299
{
297300
X509_STORE_set_flags(cvstore,
298301
X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
299302
}
300-
else
303+
else if (ssl_crl_dir[0] == 0)
301304
{
302305
ereport(isServerStart ? FATAL : LOG,
303306
(errcode(ERRCODE_CONFIG_FILE_ERROR),
304307
errmsg("could not load SSL certificate revocation list file \"%s\": %s",
305308
ssl_crl_file, SSLerrmessage(ERR_get_error()))));
306309
goto error;
307310
}
311+
else if (ssl_crl_file[0] == 0)
312+
{
313+
ereport(isServerStart ? FATAL : LOG,
314+
(errcode(ERRCODE_CONFIG_FILE_ERROR),
315+
errmsg("could not load SSL certificate revocation list directory \"%s\": %s",
316+
ssl_crl_dir, SSLerrmessage(ERR_get_error()))));
317+
goto error;
318+
}
319+
else
320+
{
321+
ereport(isServerStart ? FATAL : LOG,
322+
(errcode(ERRCODE_CONFIG_FILE_ERROR),
323+
errmsg("could not load SSL certificate revocation list file \"%s\" or directory \"%s\": %s",
324+
ssl_crl_file, ssl_crl_dir,
325+
SSLerrmessage(ERR_get_error()))));
326+
goto error;
327+
}
308328
}
309329
}
310330

‎src/backend/libpq/be-secure.c‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ char *ssl_cert_file;
4242
char *ssl_key_file;
4343
char *ssl_ca_file;
4444
char *ssl_crl_file;
45+
char *ssl_crl_dir;
4546
char *ssl_dh_params_file;
4647
char *ssl_passphrase_command;
4748
bool ssl_passphrase_command_supports_reload;

‎src/backend/utils/misc/guc.c‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4355,6 +4355,16 @@ static struct config_string ConfigureNamesString[] =
43554355
NULL, NULL, NULL
43564356
},
43574357

4358+
{
4359+
{"ssl_crl_dir", PGC_SIGHUP, CONN_AUTH_SSL,
4360+
gettext_noop("Location of the SSL certificate revocation list directory."),
4361+
NULL
4362+
},
4363+
&ssl_crl_dir,
4364+
"",
4365+
NULL, NULL, NULL
4366+
},
4367+
43584368
{
43594369
{"stats_temp_directory", PGC_SIGHUP, STATS_COLLECTOR,
43604370
gettext_noop("Writes temporary statistics files to the specified directory."),

‎src/backend/utils/misc/postgresql.conf.sample‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,7 @@
101101
#ssl_ca_file = ''
102102
#ssl_cert_file = 'server.crt'
103103
#ssl_crl_file = ''
104+
#ssl_crl_dir = ''
104105
#ssl_key_file = 'server.key'
105106
#ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL' # allowed SSL ciphers
106107
#ssl_prefer_server_ciphers = on

‎src/include/libpq/libpq.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,7 @@ extern char *ssl_cert_file;
8282
extern char *ssl_key_file;
8383
extern char *ssl_ca_file;
8484
extern char *ssl_crl_file;
85+
extern char *ssl_crl_dir;
8586
extern char *ssl_dh_params_file;
8687
extern PGDLLIMPORT char *ssl_passphrase_command;
8788
extern PGDLLIMPORT bool ssl_passphrase_command_supports_reload;

‎src/interfaces/libpq/fe-connect.c‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -317,6 +317,10 @@ static const internalPQconninfoOption PQconninfoOptions[] = {
317317
"SSL-Revocation-List", "", 64,
318318
offsetof(struct pg_conn, sslcrl)},
319319

320+
{"sslcrldir", "PGSSLCRLDIR", NULL, NULL,
321+
"SSL-Revocation-List-Dir", "", 64,
322+
offsetof(struct pg_conn, sslcrldir)},
323+
320324
{"requirepeer", "PGREQUIREPEER", NULL, NULL,
321325
"Require-Peer", "", 10,
322326
offsetof(struct pg_conn, requirepeer)},
@@ -3998,6 +4002,8 @@ freePGconn(PGconn *conn)
39984002
free(conn->sslrootcert);
39994003
if (conn->sslcrl)
40004004
free(conn->sslcrl);
4005+
if (conn->sslcrldir)
4006+
free(conn->sslcrldir);
40014007
if (conn->sslcompression)
40024008
free(conn->sslcompression);
40034009
if (conn->requirepeer)

‎src/interfaces/libpq/fe-secure-openssl.c‎

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -794,7 +794,8 @@ initialize_SSL(PGconn *conn)
794794
if (!(conn->sslcert && strlen(conn->sslcert) > 0) ||
795795
!(conn->sslkey && strlen(conn->sslkey) > 0) ||
796796
!(conn->sslrootcert && strlen(conn->sslrootcert) > 0) ||
797-
!(conn->sslcrl && strlen(conn->sslcrl) > 0))
797+
!((conn->sslcrl && strlen(conn->sslcrl) > 0) ||
798+
(conn->sslcrldir && strlen(conn->sslcrldir) > 0)))
798799
have_homedir = pqGetHomeDirectory(homedir, sizeof(homedir));
799800
else /* won't need it */
800801
have_homedir = false;
@@ -936,20 +937,29 @@ initialize_SSL(PGconn *conn)
936937

937938
if ((cvstore = SSL_CTX_get_cert_store(SSL_context)) != NULL)
938939
{
940+
char *fname = NULL;
941+
char *dname = NULL;
942+
939943
if (conn->sslcrl && strlen(conn->sslcrl) > 0)
940-
strlcpy(fnbuf, conn->sslcrl, sizeof(fnbuf));
941-
else if (have_homedir)
944+
fname = conn->sslcrl;
945+
if (conn->sslcrldir && strlen(conn->sslcrldir) > 0)
946+
dname = conn->sslcrldir;
947+
948+
/* defaults to use the default CRL file */
949+
if (!fname && !dname && have_homedir)
950+
{
942951
snprintf(fnbuf, sizeof(fnbuf), "%s/%s", homedir, ROOT_CRL_FILE);
943-
else
944-
fnbuf[0] = '\0';
952+
fname = fnbuf;
953+
}
945954

946955
/* Set the flags to check against the complete CRL chain */
947-
if (fnbuf[0] != '\0' &&
948-
X509_STORE_load_locations(cvstore, fnbuf, NULL) == 1)
956+
if ((fname || dname) &&
957+
X509_STORE_load_locations(cvstore, fname, dname) == 1)
949958
{
950959
X509_STORE_set_flags(cvstore,
951960
X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
952961
}
962+
953963
/* if not found, silently ignore; we do not require CRL */
954964
ERR_clear_error();
955965
}

0 commit comments

Comments
 (0)