diff options
| author | Tom Lane | 2017-01-04 17:43:52 +0000 |
|---|---|---|
| committer | Tom Lane | 2017-01-04 17:44:03 +0000 |
| commit | 6667d9a6d77b9a6eac89638ac363b6d03da253c1 (patch) | |
| tree | 5a2e47b21b2c58095514d8048df5c84435dc5832 /src/include | |
| parent | 0fad355beca9f73687c0b27647ea570ce10c7ae3 (diff) | |
Re-allow SSL passphrase prompt at server start, but not thereafter.
Leave OpenSSL's default passphrase collection callback in place during
the first call of secure_initialize() in server startup. Although that
doesn't work terribly well in daemon contexts, some people feel we should
not break it for anyone who was successfully using it before. We still
block passphrase demands during SIGHUP, meaning that you can't adjust SSL
configuration on-the-fly if you used a passphrase, but this is no worse
than what it was before commit de41869b6. And we block passphrase demands
during EXEC_BACKEND reloads; that behavior wasn't useful either, but at
least now it's documented.
Tweak some related log messages for more readability, and avoid issuing
essentially duplicate messages about reload failure caused by a passphrase.
Discussion: https://postgr.es/m/29982.1483412575@sss.pgh.pa.us
Diffstat (limited to 'src/include')
| -rw-r--r-- | src/include/libpq/libpq-be.h | 2 | ||||
| -rw-r--r-- | src/include/libpq/libpq.h | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/src/include/libpq/libpq-be.h b/src/include/libpq/libpq-be.h index b7582d6126..79d38cedd7 100644 --- a/src/include/libpq/libpq-be.h +++ b/src/include/libpq/libpq-be.h @@ -199,7 +199,7 @@ typedef struct Port * These functions are implemented by the glue code specific to each * SSL implementation (e.g. be-secure-openssl.c) */ -extern int be_tls_init(bool failOnError); +extern int be_tls_init(bool isServerStart); extern void be_tls_destroy(void); extern int be_tls_open_server(Port *port); extern void be_tls_close(Port *port); diff --git a/src/include/libpq/libpq.h b/src/include/libpq/libpq.h index 46c5b726ba..538066e106 100644 --- a/src/include/libpq/libpq.h +++ b/src/include/libpq/libpq.h @@ -81,7 +81,7 @@ extern char *ssl_key_file; extern char *ssl_ca_file; extern char *ssl_crl_file; -extern int secure_initialize(bool failOnError); +extern int secure_initialize(bool isServerStart); extern bool secure_loaded_verify_locations(void); extern void secure_destroy(void); extern int secure_open_server(Port *port); |