diff options
| author | Magnus Hagander | 2009-01-28 15:06:48 +0000 |
|---|---|---|
| committer | Magnus Hagander | 2009-01-28 15:06:48 +0000 |
| commit | d8b324ebd898c9555a3503f907fc3bbe4ffdd3d8 (patch) | |
| tree | d765666ad5f3ebaed4c741ec8c44847a5f940488 | |
| parent | d01bcba4835cfcb25a711f7f71c161c3f7c7611d (diff) | |
Go over all OpenSSL return values and make sure we compare them
to the documented API value. The previous code got it right as
it's implemented, but accepted too much/too little compared to
the API documentation.
Per comment from Zdenek Kotala.
| -rw-r--r-- | src/backend/libpq/be-secure.c | 10 | ||||
| -rw-r--r-- | src/interfaces/libpq/fe-secure.c | 6 |
2 files changed, 8 insertions, 8 deletions
diff --git a/src/backend/libpq/be-secure.c b/src/backend/libpq/be-secure.c index 2ef6b4ac0b4..b854d4337c7 100644 --- a/src/backend/libpq/be-secure.c +++ b/src/backend/libpq/be-secure.c @@ -11,7 +11,7 @@ * * * IDENTIFICATION - * $Header: /cvsroot/pgsql/src/backend/libpq/be-secure.c,v 1.43.2.4 2007/05/18 01:20:48 tgl Exp $ + * $Header: /cvsroot/pgsql/src/backend/libpq/be-secure.c,v 1.43.2.5 2009/01/28 15:06:48 mha Exp $ * * Since the server static private key ($DataDir/server.key) * will normally be stored unencrypted so that the database @@ -700,7 +700,7 @@ initialize_SSL(void) * Load and verify certificate and private key */ snprintf(fnbuf, sizeof(fnbuf), "%s/server.crt", DataDir); - if (!SSL_CTX_use_certificate_file(SSL_context, fnbuf, SSL_FILETYPE_PEM)) + if (SSL_CTX_use_certificate_file(SSL_context, fnbuf, SSL_FILETYPE_PEM) != 1) ereport(FATAL, (errcode(ERRCODE_CONFIG_FILE_ERROR), errmsg("could not load server certificate file \"%s\": %s", @@ -720,12 +720,12 @@ initialize_SSL(void) fnbuf), errdetail("File must be owned by the database user and must have no permissions for \"group\" or \"other\"."))); - if (!SSL_CTX_use_PrivateKey_file(SSL_context, fnbuf, SSL_FILETYPE_PEM)) + if (SSL_CTX_use_PrivateKey_file(SSL_context, fnbuf, SSL_FILETYPE_PEM) != 1) ereport(FATAL, (errmsg("could not load private key file \"%s\": %s", fnbuf, SSLerrmessage()))); - if (!SSL_CTX_check_private_key(SSL_context)) + if (SSL_CTX_check_private_key(SSL_context) != 1) ereport(FATAL, (errmsg("check of private key failed: %s", SSLerrmessage()))); @@ -741,7 +741,7 @@ initialize_SSL(void) /* accept client certificates, but don't require them. */ snprintf(fnbuf, sizeof(fnbuf), "%s/root.crt", DataDir); - if (!SSL_CTX_load_verify_locations(SSL_context, fnbuf, CA_PATH)) + if (SSL_CTX_load_verify_locations(SSL_context, fnbuf, CA_PATH) != 1) { /* Not fatal - we do not require client certificates */ ereport(LOG, diff --git a/src/interfaces/libpq/fe-secure.c b/src/interfaces/libpq/fe-secure.c index dedf808d027..3a445b780d0 100644 --- a/src/interfaces/libpq/fe-secure.c +++ b/src/interfaces/libpq/fe-secure.c @@ -11,7 +11,7 @@ * * * IDENTIFICATION - * $Header: /cvsroot/pgsql/src/interfaces/libpq/fe-secure.c,v 1.32.2.1 2003/12/18 22:49:34 tgl Exp $ + * $Header: /cvsroot/pgsql/src/interfaces/libpq/fe-secure.c,v 1.32.2.2 2009/01/28 15:06:48 mha Exp $ * * NOTES * The client *requires* a valid server certificate. Since @@ -788,7 +788,7 @@ client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey) fclose(fp); /* verify that the cert and key go together */ - if (!X509_check_private_key(*x509, *pkey)) + if (X509_check_private_key(*x509, *pkey) != 1) { printfPQExpBuffer(&conn->errorMessage, libpq_gettext("certificate/private key mismatch (%s): %s\n"), @@ -848,7 +848,7 @@ initialize_SSL(PGconn *conn) return -1; #endif } - if (!SSL_CTX_load_verify_locations(SSL_context, fnbuf, 0)) + if (SSL_CTX_load_verify_locations(SSL_context, fnbuf, 0) != 1) { printfPQExpBuffer(&conn->errorMessage, libpq_gettext("could not read root certificate list (%s): %s\n"), |