*
*
* IDENTIFICATION
- * $PostgreSQL: pgsql/src/backend/libpq/be-secure.c,v 1.83 2008/01/01 19:45:49 momjian Exp $
+ * $PostgreSQL: pgsql/src/backend/libpq/be-secure.c,v 1.83.2.1 2009/01/28 15:06:57 mha Exp $
*
* Since the server static private key ($DataDir/server.key)
* will normally be stored unencrypted so that the database
/*
* Load and verify certificate and private key
*/
- if (!SSL_CTX_use_certificate_file(SSL_context,
+ if (SSL_CTX_use_certificate_file(SSL_context,
SERVER_CERT_FILE,
- SSL_FILETYPE_PEM))
+ SSL_FILETYPE_PEM) != 1)
ereport(FATAL,
(errcode(ERRCODE_CONFIG_FILE_ERROR),
errmsg("could not load server certificate file \"%s\": %s",
errdetail("File must be owned by the database user and must have no permissions for \"group\" or \"other\".")));
#endif
- if (!SSL_CTX_use_PrivateKey_file(SSL_context,
+ if (SSL_CTX_use_PrivateKey_file(SSL_context,
SERVER_PRIVATE_KEY_FILE,
- SSL_FILETYPE_PEM))
+ SSL_FILETYPE_PEM) != 1)
ereport(FATAL,
(errmsg("could not load private key file \"%s\": %s",
SERVER_PRIVATE_KEY_FILE, SSLerrmessage())));
- if (!SSL_CTX_check_private_key(SSL_context))
+ if (SSL_CTX_check_private_key(SSL_context) != 1)
ereport(FATAL,
(errmsg("check of private key failed: %s",
SSLerrmessage())));
/*
* Require and check client certificates only if we have a root.crt file.
*/
- if (!SSL_CTX_load_verify_locations(SSL_context, ROOT_CERT_FILE, NULL))
+ if (SSL_CTX_load_verify_locations(SSL_context, ROOT_CERT_FILE, NULL) != 1)
{
/* Not fatal - we do not require client certificates */
ereport(LOG,
if (cvstore)
{
/* Set the flags to check against the complete CRL chain */
- if (X509_STORE_load_locations(cvstore, ROOT_CRL_FILE, NULL) != 0)
+ if (X509_STORE_load_locations(cvstore, ROOT_CRL_FILE, NULL) == 1)
/* OpenSSL 0.96 does not support X509_V_FLAG_CRL_CHECK */
#ifdef X509_V_FLAG_CRL_CHECK
X509_STORE_set_flags(cvstore,
*
*
* IDENTIFICATION
- * $PostgreSQL: pgsql/src/interfaces/libpq/fe-secure.c,v 1.102 2008/01/29 02:03:39 tgl Exp $
+ * $PostgreSQL: pgsql/src/interfaces/libpq/fe-secure.c,v 1.102.2.1 2009/01/28 15:06:57 mha Exp $
*
* NOTES
* [ Most of these notes are wrong/obsolete, but perhaps not all ]
}
/* verify that the cert and key go together */
- if (!X509_check_private_key(*x509, *pkey))
+ if (X509_check_private_key(*x509, *pkey) != 1)
{
char *err = SSLerrmessage();
{
X509_STORE *cvstore;
- if (!SSL_CTX_load_verify_locations(SSL_context, fnbuf, NULL))
+ if (SSL_CTX_load_verify_locations(SSL_context, fnbuf, NULL) != 1)
{
char *err = SSLerrmessage();
if ((cvstore = SSL_CTX_get_cert_store(SSL_context)) != NULL)
{
/* setting the flags to check against the complete CRL chain */
- if (X509_STORE_load_locations(cvstore, ROOT_CRL_FILE, NULL) != 0)
+ if (X509_STORE_load_locations(cvstore, ROOT_CRL_FILE, NULL) == 1)
/* OpenSSL 0.96 does not support X509_V_FLAG_CRL_CHECK */
#ifdef X509_V_FLAG_CRL_CHECK
X509_STORE_set_flags(cvstore,