Allow SSL to work withouth client-side certificate infrastructure.

diff --git a/doc/src/sgml/runtime.sgml b/doc/src/sgml/runtime.sgml
index 753d084b355083db4a6a9be1a0fd84faf156f32d..703d2ddc95721474578bce919f43247692eba732 100644 (file)
--- a/doc/src/sgml/runtime.sgml
+++ b/doc/src/sgml/runtime.sgml
@@ -1,5 +1,5 @@
 <!--
-$Header: /cvsroot/pgsql/doc/src/sgml/runtime.sgml,v 1.139 2002/09/25 21:16:10 petere Exp $
+$Header: /cvsroot/pgsql/doc/src/sgml/runtime.sgml,v 1.140 2002/09/26 04:41:54 momjian Exp $
 -->
 
 <Chapter Id="runtime">
@@ -2876,6 +2876,7 @@ openssl rsa -in privkey.pem -out cert.pem
    Enter the old passphrase to unlock the existing key. Now do
 <programlisting>
 openssl req -x509 -in cert.req -text -key cert.pem -out cert.cert
+chmod og-rwx cert.pem
 cp cert.pem <replaceable>$PGDATA</replaceable>/server.key
 cp cert.cert <replaceable>$PGDATA</replaceable>/server.crt
 </programlisting>

diff --git a/src/backend/libpq/be-secure.c b/src/backend/libpq/be-secure.c
index 6baf568eea53a7b2619b33eb769ccd997b58d582..7288a2bec5c804b3eda4b7fa4d063e14e8fbe485 100644 (file)
--- a/src/backend/libpq/be-secure.c
+++ b/src/backend/libpq/be-secure.c
@@ -11,7 +11,7 @@
  *
  *
  * IDENTIFICATION
- *       $Header: /cvsroot/pgsql/src/backend/libpq/be-secure.c,v 1.14 2002/09/04 23:31:34 tgl Exp $
+ *       $Header: /cvsroot/pgsql/src/backend/libpq/be-secure.c,v 1.15 2002/09/26 04:41:54 momjian Exp $
  *
  *       Since the server static private key ($DataDir/server.key)
  *       will normally be stored unencrypted so that the database
@@ -642,9 +642,13 @@ initialize_SSL(void)
        snprintf(fnbuf, sizeof fnbuf, "%s/root.crt", DataDir);
        if (!SSL_CTX_load_verify_locations(SSL_context, fnbuf, CA_PATH))
        {
+               return 0;
+#ifdef NOT_USED
+               /* CLIENT CERTIFICATES NOT REQUIRED  bjm 2002-09-26 */
                postmaster_error("could not read root cert file (%s): %s",
                                                 fnbuf, SSLerrmessage());
                ExitPostmaster(1);
+#endif
        }
        SSL_CTX_set_verify(SSL_context,
                                        SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, verify_cb);

diff --git a/src/interfaces/libpq/fe-secure.c b/src/interfaces/libpq/fe-secure.c
index f702cb05b98b359ba326ba600c5474285c03fe0e..545a19ca3c8861425fea0dd0bcd1707da93b7160 100644 (file)
--- a/src/interfaces/libpq/fe-secure.c
+++ b/src/interfaces/libpq/fe-secure.c
@@ -11,7 +11,7 @@
  *
  *
  * IDENTIFICATION
- *       $Header: /cvsroot/pgsql/src/interfaces/libpq/fe-secure.c,v 1.13 2002/09/22 20:57:21 petere Exp $
+ *       $Header: /cvsroot/pgsql/src/interfaces/libpq/fe-secure.c,v 1.14 2002/09/26 04:41:55 momjian Exp $
  *
  * NOTES
  *       The client *requires* a valid server certificate.  Since
@@ -726,10 +726,14 @@ initialize_SSL(PGconn *conn)
                                 pwd->pw_dir);
                if (stat(fnbuf, &buf) == -1)
                {
+                       return 0;
+#ifdef NOT_USED
+                       /* CLIENT CERTIFICATES NOT REQUIRED  bjm 2002-09-26 */
                        printfPQExpBuffer(&conn->errorMessage,
                                 libpq_gettext("could not read root certificate list (%s): %s\n"),
                                                          fnbuf, strerror(errno));
                        return -1;
+#endif
                }
                if (!SSL_CTX_load_verify_locations(SSL_context, fnbuf, 0))
                {
@@ -789,6 +793,8 @@ open_client_SSL(PGconn *conn)
 
        /* check the certificate chain of the server */
 
+#ifdef NOT_USED
+       /* CLIENT CERTIFICATES NOT REQUIRED  bjm 2002-09-26 */
        /*
         * this eliminates simple man-in-the-middle attacks and simple
         * impersonations
@@ -802,6 +808,7 @@ open_client_SSL(PGconn *conn)
                close_SSL(conn);
                return -1;
        }
+#endif
 
        /* pull out server distinguished and common names */
        conn->peer = SSL_get_peer_certificate(conn->ssl);
@@ -824,6 +831,8 @@ open_client_SSL(PGconn *conn)
 
        /* verify that the common name resolves to peer */
 
+#ifdef NOT_USED
+       /* CLIENT CERTIFICATES NOT REQUIRED  bjm 2002-09-26 */
        /*
         * this is necessary to eliminate man-in-the-middle attacks and
         * impersonations where the attacker somehow learned the server's
@@ -834,6 +843,7 @@ open_client_SSL(PGconn *conn)
                close_SSL(conn);
                return -1;
        }
+#endif
 
        return 0;
 }