Allow SSL to work withouth client-side certificate infrastructure.

diff --git a/doc/src/sgml/runtime.sgml b/doc/src/sgml/runtime.sgml
index 753d084b355083db4a6a9be1a0fd84faf156f32d..703d2ddc95721474578bce919f43247692eba732 100644 (file)
--- a/doc/src/sgml/runtime.sgml
+++ b/doc/src/sgml/runtime.sgml
@@ -1,5 +1,5 @@
 
 
 
@@ -2876,6 +2876,7 @@ openssl rsa -in privkey.pem -out cert.pem
    Enter the old passphrase to unlock the existing key. Now do
 
 openssl req -x509 -in cert.req -text -key cert.pem -out cert.cert
+chmod og-rwx cert.pem
 cp cert.pem $PGDATA/server.key
 cp cert.cert $PGDATA/server.crt
 

diff --git a/src/backend/libpq/be-secure.c b/src/backend/libpq/be-secure.c
index 6baf568eea53a7b2619b33eb769ccd997b58d582..7288a2bec5c804b3eda4b7fa4d063e14e8fbe485 100644 (file)
--- a/src/backend/libpq/be-secure.c
+++ b/src/backend/libpq/be-secure.c
@@ -11,7 +11,7 @@
  *
  *
  * IDENTIFICATION
- *   $Header: /cvsroot/pgsql/src/backend/libpq/be-secure.c,v 1.14 2002/09/04 23:31:34 tgl Exp $
+ *   $Header: /cvsroot/pgsql/src/backend/libpq/be-secure.c,v 1.15 2002/09/26 04:41:54 momjian Exp $
  *
  *   Since the server static private key ($DataDir/server.key)
  *   will normally be stored unencrypted so that the database
@@ -642,9 +642,13 @@ initialize_SSL(void)
    snprintf(fnbuf, sizeof fnbuf, "%s/root.crt", DataDir);
    if (!SSL_CTX_load_verify_locations(SSL_context, fnbuf, CA_PATH))
    {
+       return 0;
+#ifdef NOT_USED
+       /* CLIENT CERTIFICATES NOT REQUIRED  bjm 2002-09-26 */
        postmaster_error("could not read root cert file (%s): %s",
                         fnbuf, SSLerrmessage());
        ExitPostmaster(1);
+#endif
    }
    SSL_CTX_set_verify(SSL_context,
                    SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE, verify_cb);

diff --git a/src/interfaces/libpq/fe-secure.c b/src/interfaces/libpq/fe-secure.c
index f702cb05b98b359ba326ba600c5474285c03fe0e..545a19ca3c8861425fea0dd0bcd1707da93b7160 100644 (file)
--- a/src/interfaces/libpq/fe-secure.c
+++ b/src/interfaces/libpq/fe-secure.c
@@ -11,7 +11,7 @@
  *
  *
  * IDENTIFICATION
- *   $Header: /cvsroot/pgsql/src/interfaces/libpq/fe-secure.c,v 1.13 2002/09/22 20:57:21 petere Exp $
+ *   $Header: /cvsroot/pgsql/src/interfaces/libpq/fe-secure.c,v 1.14 2002/09/26 04:41:55 momjian Exp $
  *
  * NOTES
  *   The client *requires* a valid server certificate.  Since
@@ -726,10 +726,14 @@ initialize_SSL(PGconn *conn)
                 pwd->pw_dir);
        if (stat(fnbuf, &buf) == -1)
        {
+           return 0;
+#ifdef NOT_USED
+           /* CLIENT CERTIFICATES NOT REQUIRED  bjm 2002-09-26 */
            printfPQExpBuffer(&conn->errorMessage,
                 libpq_gettext("could not read root certificate list (%s): %s\n"),
                              fnbuf, strerror(errno));
            return -1;
+#endif
        }
        if (!SSL_CTX_load_verify_locations(SSL_context, fnbuf, 0))
        {
@@ -789,6 +793,8 @@ open_client_SSL(PGconn *conn)
 
    /* check the certificate chain of the server */
 
+#ifdef NOT_USED
+   /* CLIENT CERTIFICATES NOT REQUIRED  bjm 2002-09-26 */
    /*
     * this eliminates simple man-in-the-middle attacks and simple
     * impersonations
@@ -802,6 +808,7 @@ open_client_SSL(PGconn *conn)
        close_SSL(conn);
        return -1;
    }
+#endif
 
    /* pull out server distinguished and common names */
    conn->peer = SSL_get_peer_certificate(conn->ssl);
@@ -824,6 +831,8 @@ open_client_SSL(PGconn *conn)
 
    /* verify that the common name resolves to peer */
 
+#ifdef NOT_USED
+   /* CLIENT CERTIFICATES NOT REQUIRED  bjm 2002-09-26 */
    /*
     * this is necessary to eliminate man-in-the-middle attacks and
     * impersonations where the attacker somehow learned the server's
@@ -834,6 +843,7 @@ open_client_SSL(PGconn *conn)
        close_SSL(conn);
        return -1;
    }
+#endif
 
    return 0;
 }