Set type identifier on BIO

In OpenSSL there are two types of BIO's (I/O abstractions):
source/sink and filters. A source/sink BIO is a source and/or
sink of data, ie one acting on a socket or a file. A filter
BIO takes a stream of input from another BIO and transforms it.
In order for BIO_find_type() to be able to traverse the chain
of BIO's and correctly find all BIO's of a certain type they
shall have the type bit set accordingly, source/sink BIO's
(what PostgreSQL implements) use BIO_TYPE_SOURCE_SINK and
filter BIO's use BIO_TYPE_FILTER. In addition to these, file
descriptor based BIO's should have the descriptor bit set,
BIO_TYPE_DESCRIPTOR.

The PostgreSQL implementation didn't set the type bits, which
went unnoticed for a long time as it's only really relevant
for code auditing the OpenSSL installation, or doing similar
tasks. It is required by the API though, so this fixes it.

Backpatch through 9.6 as this has been wrong for a long time.

Author: Itamar Gafni
Discussion: https://postgr.es/m/SN6PR06MB39665EC10C34BB20956AE4578AF39@SN6PR06MB3966.namprd06.prod.outlook.com
Backpatch-through: 9.6

diff --git a/src/backend/libpq/be-secure-openssl.c b/src/backend/libpq/be-secure-openssl.c
index db9580c20df7c9f5272ac5f4799aaae1fdc0d3d6..deedac29d74acd8eac6e6cc477bd59944e4200f6 100644 (file)
--- a/src/backend/libpq/be-secure-openssl.c
+++ b/src/backend/libpq/be-secure-openssl.c
@@ -883,6 +883,7 @@ my_BIO_s_socket(void)
                my_bio_index = BIO_get_new_index();
                if (my_bio_index == -1)
                        return NULL;
+               my_bio_index |= (BIO_TYPE_DESCRIPTOR | BIO_TYPE_SOURCE_SINK);
                my_bio_methods = BIO_meth_new(my_bio_index, "PostgreSQL backend socket");
                if (!my_bio_methods)
                        return NULL;

diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c
index e3b43c8723386bea5312b9eb224a5f3aa62e47a6..3a7cc8f774f99fe4afd35311d4b2e7488113f478 100644 (file)
--- a/src/interfaces/libpq/fe-secure-openssl.c
+++ b/src/interfaces/libpq/fe-secure-openssl.c
@@ -1706,6 +1706,7 @@ my_BIO_s_socket(void)
                my_bio_index = BIO_get_new_index();
                if (my_bio_index == -1)
                        return NULL;
+               my_bio_index |= (BIO_TYPE_DESCRIPTOR | BIO_TYPE_SOURCE_SINK);
                my_bio_methods = BIO_meth_new(my_bio_index, "libpq socket");
                if (!my_bio_methods)
                        return NULL;