postgres.git / summary / log / commit / refs

commit    00c72da4a22d9883b1e511ff140bd47cc75d536d
Author:   Daniel Gustafsson <dgustafsson@postgresql.org>
Date:     Sat Sep 25 09:27:20 2021 +0000
First released in: 10.19, 11.14, 12.9, 13.5, 14.0

    Disable OpenSSL EVP digest padding in pgcrypto
    
    The PX layer in pgcrypto is handling digest padding on its own uniformly
    for all backend implementations. Starting with OpenSSL 3.0.0, DecryptUpdate
    doesn't flush the last block in case padding is enabled so explicitly
    disable it as we don't use it.
    
    This will be backpatched to all supported version once there is sufficient
    testing in the buildfarm of OpenSSL 3.
    
    Reviewed-by: Peter Eisentraut, Michael Paquier
    Discussion: https://postgr.es/m/FEF81714-D479-4512-839B-C769D2605F8A@yesql.se
    Backpatch-through: 9.6


 contrib/pgcrypto/openssl.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/contrib/pgcrypto/openssl.c b/contrib/pgcrypto/openssl.c
index 8cde80fa523..64c443d2470 100644
--- a/contrib/pgcrypto/openssl.c
+++ b/contrib/pgcrypto/openssl.c
@@ -380,6 +380,8 @@ gen_ossl_decrypt(PX_Cipher *c, const uint8 *data, unsigned dlen,
 	{
 		if (!EVP_DecryptInit_ex(od->evp_ctx, od->evp_ciph, NULL, NULL, NULL))
 			return PXE_CIPHER_INIT;
+		if (!EVP_CIPHER_CTX_set_padding(od->evp_ctx, 0))
+			return PXE_CIPHER_INIT;
 		if (!EVP_CIPHER_CTX_set_key_length(od->evp_ctx, od->klen))
 			return PXE_CIPHER_INIT;
 		if (!EVP_DecryptInit_ex(od->evp_ctx, NULL, NULL, od->key, od->iv))
@@ -404,6 +406,8 @@ gen_ossl_encrypt(PX_Cipher *c, const uint8 *data, unsigned dlen,
 	{
 		if (!EVP_EncryptInit_ex(od->evp_ctx, od->evp_ciph, NULL, NULL, NULL))
 			return PXE_CIPHER_INIT;
+		if (!EVP_CIPHER_CTX_set_padding(od->evp_ctx, 0))
+			return PXE_CIPHER_INIT;
 		if (!EVP_CIPHER_CTX_set_key_length(od->evp_ctx, od->klen))
 			return PXE_CIPHER_INIT;
 		if (!EVP_EncryptInit_ex(od->evp_ctx, NULL, NULL, od->key, od->iv))


[parent: 90cfd269f226]