From: Andreas Karlsson <andreas@proxel.se>
To: Michael Paquier <michael.paquier@gmail.com>
To: Tom Lane <tgl@sss.pgh.pa.us>
Cc: Peter Eisentraut <peter_e@gmx.net>
Cc: PostgreSQL-development <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH] Reload SSL certificates on SIGHUP
Date: Mon, 23 Nov 2015 04:29:13 +0100
Message-ID: <56528809.1060501@proxel.se> (raw)
In-Reply-To: <CAB7nPqQcttyXYuRAyDNqDOjPDKjgOyg4DVvns9cof4MjbxP_-w@mail.gmail.com>
References: <556A6E8A.9030400@proxel.se>
<55956342.9050408@gmx.net>
<55AEE95E.7090304@proxel.se>
<55B82208.4090901@gmx.net>
<8917.1438133076@sss.pgh.pa.us>
<55BAA50E.5040908@proxel.se>
<28784.1440554271@sss.pgh.pa.us>
<CAB7nPqSkP=n-s=EYqnKTRx5MY_KgP8JF-OLpjni+O=xAYVKBhA@mail.gmail.com>
<CAB7nPqQcttyXYuRAyDNqDOjPDKjgOyg4DVvns9cof4MjbxP_-w@mail.gmail.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-hackers>
On 08/26/2015 07:46 AM, Michael Paquier wrote:
> On Wed, Aug 26, 2015 at 12:24 PM, Michael Paquier
> <michael.paquier@gmail.com> wrote:
>> On Wed, Aug 26, 2015 at 10:57 AM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>>> [...]
>>> So I think the way to move this forward is to investigate how to hold
>>> the SSL config constant until SIGHUP in an EXEC_BACKEND build. If we
>>> find out that that's unreasonably difficult, maybe we'll decide that
>>> we can live without it; but I'd like to see the question investigated
>>> rather than ignored.
>>
>> You have a point here.
>>
>> In EXEC_BACKEND, parameter updated via SIGHUP are only taken into
>> account by newly-started backends, right?
>
> Oops. I mistook with PGC_BACKEND here. Sorry for the noise.
>
>> Hence, a way to do what we
>> want is to actually copy the data needed to initialize the SSL context
>> into alternate file(s). When postmaster starts up, or when SIGHUP
>> shows up those alternate files are upserted by the postmaster.
>> be-secure-openssl.c needs also to be changed such as with EXEC_BACKEND
>> the context needs to be loaded from those alternate files. At quick
>> glance this seems doable.
>
> Still, this idea would be to use a set of alternate files in global/
> to set the context, basically something like
> config_exec_ssl_cert_file, config_exec_ssl_key_file and
> config_exec_ssl_ca_file. It does not seem to be necessary to
> manipulate [read|write]_nondefault_variables() as the use of this
> metadata should be made only when SSL context is initialized on
> backend. Other thoughts welcome.
Sorry for dropping this patch, but now I have started looking at it again.
I started implementing your suggested solution, but realized that I do
not like copying of the private key file. The private key might have
been put by the DBA on another file system for security reasons and
having PostgreSQL copy potentially sensitive data to somewhere under
pg_data seems like a surprising behavior. Especially since this only
happens on some platforms.
I guess a possible solution would be to read the files into the
postmaster (where we already have the private key today) and have
OpenSSL read the keys from memory and re-implement something like
SSL_CTX_use_certificate_chain_file() in our code, and similar things for
the other functions which now take a path. This seems like a bit too
much work to burden this patch with (and not obviously something we
would want anyway) since the behavior is already different on Windows in
the current code.
Thoughts?
I have attached a rebased version of the original patch which applies on
current master.
Andreas
--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackersAttachments:reload-ssl-v02.patch (text/x-diff, 19.1K) downloaddiff --git a/src/backend/libpq/be-secure-openssl.c b/src/backend/libpq/be-secure-openssl.cindex e9bc282..7dda4be 100644--- a/src/backend/libpq/be-secure-openssl.c+++ b/src/backend/libpq/be-secure-openssl.c@@ -77,12 +77,14 @@ static DH *load_dh_buffer(const char *, size_t);
static DH *tmp_dh_cb(SSL *s, int is_export, int keylength);
static int verify_cb(int, X509_STORE_CTX *);
static void info_cb(const SSL *ssl, int type, int args);
-static void initialize_ecdh(void);+static SSL_CTX *initialize_context(void);+static bool initialize_ecdh(SSL_CTX *context);
static const char *SSLerrmessage(void);
static char *X509_NAME_to_cstring(X509_NAME *name);
static SSL_CTX *SSL_context = NULL;
+static bool SSL_initialized = false;
/* ------------------------------------------------------------ */
/* Hardcoded values */
@@ -157,168 +159,39 @@ KWbuHn491xNO25CQWMtem80uKw+pTnisBRF/454n1Jnhub144YRBoN8CAQI=\n\
/*
* Initialize global SSL context.
*/
-void+int
be_tls_init(void)
{
- struct stat buf;+ SSL_CTX *context;- STACK_OF(X509_NAME) *root_cert_list = NULL;-- if (!SSL_context)- {+ if (!SSL_initialized) {
#if SSLEAY_VERSION_NUMBER >= 0x0907000L
OPENSSL_config(NULL);
#endif
SSL_library_init();
SSL_load_error_strings();
-- /*- * We use SSLv23_method() because it can negotiate use of the highest- * mutually supported protocol version, while alternatives like- * TLSv1_2_method() permit only one specific version. Note that we- * don't actually allow SSL v2 or v3, only TLS protocols (see below).- */- SSL_context = SSL_CTX_new(SSLv23_method());- if (!SSL_context)- ereport(FATAL,- (errmsg("could not create SSL context: %s",- SSLerrmessage())));-- /*- * Disable OpenSSL's moving-write-buffer sanity check, because it- * causes unnecessary failures in nonblocking send cases.- */- SSL_CTX_set_mode(SSL_context, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);-- /*- * Load and verify server's certificate and private key- */- if (SSL_CTX_use_certificate_chain_file(SSL_context,- ssl_cert_file) != 1)- ereport(FATAL,- (errcode(ERRCODE_CONFIG_FILE_ERROR),- errmsg("could not load server certificate file \"%s\": %s",- ssl_cert_file, SSLerrmessage())));-- if (stat(ssl_key_file, &buf) != 0)- ereport(FATAL,- (errcode_for_file_access(),- errmsg("could not access private key file \"%s\": %m",- ssl_key_file)));-- /*- * Require no public access to key file.- *- * XXX temporarily suppress check when on Windows, because there may- * not be proper support for Unix-y file permissions. Need to think- * of a reasonable check to apply on Windows. (See also the data- * directory permission check in postmaster.c)- */-#if !defined(WIN32) && !defined(__CYGWIN__)- if (!S_ISREG(buf.st_mode) || buf.st_mode & (S_IRWXG | S_IRWXO))- ereport(FATAL,- (errcode(ERRCODE_CONFIG_FILE_ERROR),- errmsg("private key file \"%s\" has group or world access",- ssl_key_file),- errdetail("Permissions should be u=rw (0600) or less.")));-#endif-- if (SSL_CTX_use_PrivateKey_file(SSL_context,- ssl_key_file,- SSL_FILETYPE_PEM) != 1)- ereport(FATAL,- (errmsg("could not load private key file \"%s\": %s",- ssl_key_file, SSLerrmessage())));-- if (SSL_CTX_check_private_key(SSL_context) != 1)- ereport(FATAL,- (errmsg("check of private key failed: %s",- SSLerrmessage())));+ SSL_initialized = true;
}
- /* set up ephemeral DH keys, and disallow SSL v2/v3 while at it */- SSL_CTX_set_tmp_dh_callback(SSL_context, tmp_dh_cb);- SSL_CTX_set_options(SSL_context,- SSL_OP_SINGLE_DH_USE |- SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);-- /* set up ephemeral ECDH keys */- initialize_ecdh();-- /* set up the allowed cipher list */- if (SSL_CTX_set_cipher_list(SSL_context, SSLCipherSuites) != 1)- elog(FATAL, "could not set the cipher list (no valid ciphers available)");-- /* Let server choose order */- if (SSLPreferServerCiphers)- SSL_CTX_set_options(SSL_context, SSL_OP_CIPHER_SERVER_PREFERENCE);-- /*- * Load CA store, so we can verify client certificates if needed.- */- if (ssl_ca_file[0])- {- if (SSL_CTX_load_verify_locations(SSL_context, ssl_ca_file, NULL) != 1 ||- (root_cert_list = SSL_load_client_CA_file(ssl_ca_file)) == NULL)- ereport(FATAL,- (errmsg("could not load root certificate file \"%s\": %s",- ssl_ca_file, SSLerrmessage())));- }-- /*----------- * Load the Certificate Revocation List (CRL).- * http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci803160,00.html- *----------- */- if (ssl_crl_file[0])+ if ((context = initialize_context()) != NULL)
{
- X509_STORE *cvstore = SSL_CTX_get_cert_store(SSL_context);-- if (cvstore)- {- /* Set the flags to check against the complete CRL chain */- if (X509_STORE_load_locations(cvstore, ssl_crl_file, NULL) == 1)- {- /* OpenSSL 0.96 does not support X509_V_FLAG_CRL_CHECK */-#ifdef X509_V_FLAG_CRL_CHECK- X509_STORE_set_flags(cvstore,- X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);-#else- ereport(LOG,- (errmsg("SSL certificate revocation list file \"%s\" ignored",- ssl_crl_file),- errdetail("SSL library does not support certificate revocation lists.")));-#endif- }- else- ereport(FATAL,- (errmsg("could not load SSL certificate revocation list file \"%s\": %s",- ssl_crl_file, SSLerrmessage())));- }+ be_tls_destroy();+ SSL_context = context;+ /* Remember if we would have loaded the CA store */+ ssl_loaded_verify_locations = !!ssl_ca_file[0];+ return 0;
}
- if (ssl_ca_file[0])- {- /*- * Always ask for SSL client cert, but don't fail if it's not- * presented. We might fail such connections later, depending on what- * we find in pg_hba.conf.- */- SSL_CTX_set_verify(SSL_context,- (SSL_VERIFY_PEER |- SSL_VERIFY_CLIENT_ONCE),- verify_cb);-- /* Set flag to remember CA store is successfully loaded */- ssl_loaded_verify_locations = true;+ return -1;+}- /*- * Tell OpenSSL to send the list of root certs we trust to clients in- * CertificateRequests. This lets a client with a keystore select the- * appropriate client certificate to send to us.- */- SSL_CTX_set_client_CA_list(SSL_context, root_cert_list);- }+/*+ * Destroy global SSL context.+ */+void+be_tls_destroy(void)+{+ SSL_CTX_free(SSL_context);
}
/*
@@ -924,27 +797,196 @@ info_cb(const SSL *ssl, int type, int args)
}
}
-static void-initialize_ecdh(void)+#define INIT_CONTEXT_ERROR(error) do { \+ ereport(LOG, error); \+ SSL_CTX_free(context); \+ return NULL; \+} while (0);++static SSL_CTX *+initialize_context(void)+{+ struct stat buf;++ STACK_OF(X509_NAME) *root_cert_list = NULL;++ SSL_CTX *context;++ /*+ * We use SSLv23_method() because it can negotiate use of the highest+ * mutually supported protocol version, while alternatives like+ * TLSv1_2_method() permit only one specific version. Note that we don't+ * actually allow SSL v2 or v3, only TLS protocols (see below).+ */+ context = SSL_CTX_new(SSLv23_method());+ if (!context)+ INIT_CONTEXT_ERROR(+ (errmsg("could not create SSL context: %s", SSLerrmessage())));++ /*+ * Disable OpenSSL's moving-write-buffer sanity check, because it causes+ * unnecessary failures in nonblocking send cases.+ */+ SSL_CTX_set_mode(context, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);++ /*+ * Load and verify server's certificate and private key+ */+ if (SSL_CTX_use_certificate_chain_file(context, ssl_cert_file) != 1)+ INIT_CONTEXT_ERROR(+ (errcode(ERRCODE_CONFIG_FILE_ERROR),+ errmsg("could not load server certificate file \"%s\": %s",+ ssl_cert_file, SSLerrmessage())));++ if (stat(ssl_key_file, &buf) != 0)+ INIT_CONTEXT_ERROR(+ (errcode_for_file_access(),+ errmsg("could not access private key file \"%s\": %m",+ ssl_key_file)));++ /*+ * Require no public access to key file.+ *+ * XXX temporarily suppress check when on Windows, because there may not+ * be proper support for Unix-y file permissions. Need to think of a+ * reasonable check to apply on Windows. (See also the data directory+ * permission check in postmaster.c)+ */+#if !defined(WIN32) && !defined(__CYGWIN__)+ if (!S_ISREG(buf.st_mode) || buf.st_mode & (S_IRWXG | S_IRWXO))+ INIT_CONTEXT_ERROR(+ (errcode(ERRCODE_CONFIG_FILE_ERROR),+ errmsg("private key file \"%s\" has group or world access",+ ssl_key_file),+ errdetail("Permissions should be u=rw (0600) or less.")));+#endif++ if (SSL_CTX_use_PrivateKey_file(context,+ ssl_key_file,+ SSL_FILETYPE_PEM) != 1)+ INIT_CONTEXT_ERROR(+ (errmsg("could not load private key file \"%s\": %s",+ ssl_key_file, SSLerrmessage())));++ if (SSL_CTX_check_private_key(context) != 1)+ INIT_CONTEXT_ERROR(+ (errmsg("check of private key failed: %s", SSLerrmessage())));++ /* set up ephemeral DH keys, and disallow SSL v2/v3 while at it */+ SSL_CTX_set_tmp_dh_callback(context, tmp_dh_cb);+ SSL_CTX_set_options(context,+ SSL_OP_SINGLE_DH_USE |+ SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);++ /* set up ephemeral ECDH keys */+ if (!initialize_ecdh(context))+ {+ SSL_CTX_free(context);+ return NULL;+ }++ /* set up the allowed cipher list */+ if (SSL_CTX_set_cipher_list(context, SSLCipherSuites) != 1)+ INIT_CONTEXT_ERROR((errmsg("could not set the cipher list (no valid ciphers available)")));++ /* Let server choose order */+ if (SSLPreferServerCiphers)+ SSL_CTX_set_options(context, SSL_OP_CIPHER_SERVER_PREFERENCE);++ /*+ * Load CA store, so we can verify client certificates if needed.+ */+ if (ssl_ca_file[0])+ {+ if (SSL_CTX_load_verify_locations(context, ssl_ca_file, NULL) != 1 ||+ (root_cert_list = SSL_load_client_CA_file(ssl_ca_file)) == NULL)+ INIT_CONTEXT_ERROR(+ (errmsg("could not load root certificate file \"%s\": %s",+ ssl_ca_file, SSLerrmessage())));+ }++ /*----------+ * Load the Certificate Revocation List (CRL).+ * http://searchsecurity.techtarget.com/sDefinition/0,,sid14_gci803160,00.html+ *----------+ */+ if (ssl_crl_file[0])+ {+ X509_STORE *cvstore = SSL_CTX_get_cert_store(context);++ if (cvstore)+ {+ /* Set the flags to check against the complete CRL chain */+ if (X509_STORE_load_locations(cvstore, ssl_crl_file, NULL) == 1)+ {+ /* OpenSSL 0.96 does not support X509_V_FLAG_CRL_CHECK */+#ifdef X509_V_FLAG_CRL_CHECK+ X509_STORE_set_flags(cvstore,+ X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);+#else+ ereport(LOG,+ (errmsg("SSL certificate revocation list file \"%s\" ignored",+ ssl_crl_file),+ errdetail("SSL library does not support certificate revocation lists.")));+#endif+ }+ else+ INIT_CONTEXT_ERROR(+ (errmsg("could not load SSL certificate revocation list file \"%s\": %s",+ ssl_crl_file, SSLerrmessage())));+ }+ }++ if (ssl_ca_file[0])+ {+ /*+ * Always ask for SSL client cert, but don't fail if it's not+ * presented. We might fail such connections later, depending on what+ * we find in pg_hba.conf.+ */+ SSL_CTX_set_verify(context,+ (SSL_VERIFY_PEER |+ SSL_VERIFY_CLIENT_ONCE),+ verify_cb);++ /*+ * Tell OpenSSL to send the list of root certs we trust to clients in+ * CertificateRequests. This lets a client with a keystore select the+ * appropriate client certificate to send to us.+ */+ SSL_CTX_set_client_CA_list(context, root_cert_list);+ }++ return context;+}++static bool+initialize_ecdh(SSL_CTX *context)
{
#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_ECDH)
EC_KEY *ecdh;
int nid;
nid = OBJ_sn2nid(SSLECDHCurve);
- if (!nid)- ereport(FATAL,+ if (!nid) {+ ereport(LOG,
(errmsg("ECDH: unrecognized curve name: %s", SSLECDHCurve)));
+ return false;+ }
ecdh = EC_KEY_new_by_curve_name(nid);
- if (!ecdh)- ereport(FATAL,+ if (!ecdh) {+ ereport(LOG,
(errmsg("ECDH: could not create key")));
+ return false;+ }- SSL_CTX_set_options(SSL_context, SSL_OP_SINGLE_ECDH_USE);- SSL_CTX_set_tmp_ecdh(SSL_context, ecdh);+ SSL_CTX_set_options(context, SSL_OP_SINGLE_ECDH_USE);+ SSL_CTX_set_tmp_ecdh(context, ecdh);
EC_KEY_free(ecdh);
#endif
++ return true;
}
/*
diff --git a/src/backend/libpq/be-secure.c b/src/backend/libpq/be-secure.cindex 2ddcf42..e23cd00 100644--- a/src/backend/libpq/be-secure.c+++ b/src/backend/libpq/be-secure.c@@ -63,15 +63,28 @@ bool SSLPreferServerCiphers;
/*
* Initialize global context
+ *+ * Returns 0 if OK, -1 on failure.
*/
int
secure_initialize(void)
{
#ifdef USE_SSL
- be_tls_init();+ return be_tls_init();+#else+ return 0;
#endif
+}- return 0;+/*+ * Destroy global context+ */+void+secure_destroy(void)+{+#ifdef USE_SSL+ be_tls_destroy();+#endif
}
/*
diff --git a/src/backend/postmaster/postmaster.c b/src/backend/postmaster/postmaster.cindex 3cba0e5..d644c60 100644--- a/src/backend/postmaster/postmaster.c+++ b/src/backend/postmaster/postmaster.c@@ -237,6 +237,8 @@ bool enable_bonjour = false;
char *bonjour_name;
bool restart_after_crash = true;
+static bool LoadedSSL = false;+
/* PIDs of special child processes; 0 when not running */
static pid_t StartupPID = 0,
BgWriterPID = 0,
@@ -911,7 +913,12 @@ PostmasterMain(int argc, char *argv[])
*/
#ifdef USE_SSL
if (EnableSSL)
- secure_initialize();+ {+ if (secure_initialize() != 0)+ ereport(FATAL,+ (errmsg("could not load ssl context")));+ LoadedSSL = true;+ }
#endif
/*
@@ -1940,7 +1947,7 @@ ProcessStartupPacket(Port *port, bool SSLdone)
#ifdef USE_SSL
/* No SSL when disabled or on Unix sockets */
- if (!EnableSSL || IS_AF_UNIX(port->laddr.addr.ss_family))+ if (!LoadedSSL || IS_AF_UNIX(port->laddr.addr.ss_family))
SSLok = 'N';
else
SSLok = 'S'; /* Support for SSL */
@@ -2493,6 +2500,22 @@ SIGHUP_handler(SIGNAL_ARGS)
ereport(WARNING,
(errmsg("pg_ident.conf not reloaded")));
+#ifdef USE_SSL+ if (EnableSSL)+ {+ if (secure_initialize() != 0)+ ereport(WARNING,+ (errmsg("ssl context not reloaded")));+ else+ LoadedSSL = true;+ }+ else+ {+ secure_destroy();+ LoadedSSL = false;+ }+#endif+
#ifdef EXEC_BACKEND
/* Update the starting-point file for future children */
write_nondefault_variables(PGC_SIGHUP);
@@ -4690,7 +4713,12 @@ SubPostmasterMain(int argc, char *argv[])
*/
#ifdef USE_SSL
if (EnableSSL)
- secure_initialize();+ {+ if (secure_initialize() != 0)+ ereport(FATAL,+ (errmsg("could not load ssl context")));+ LoadedSSL = true;+ }
#endif
/*
diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.cindex a185749..4992606 100644--- a/src/backend/utils/misc/guc.c+++ b/src/backend/utils/misc/guc.c@@ -903,7 +903,7 @@ static struct config_bool ConfigureNamesBool[] =
NULL, NULL, NULL
},
{
- {"ssl", PGC_POSTMASTER, CONN_AUTH_SECURITY,+ {"ssl", PGC_SIGHUP, CONN_AUTH_SECURITY,
gettext_noop("Enables SSL connections."),
NULL
},
@@ -912,7 +912,7 @@ static struct config_bool ConfigureNamesBool[] =
check_ssl, NULL, NULL
},
{
- {"ssl_prefer_server_ciphers", PGC_POSTMASTER, CONN_AUTH_SECURITY,+ {"ssl_prefer_server_ciphers", PGC_SIGHUP, CONN_AUTH_SECURITY,
gettext_noop("Give priority to server ciphersuite order."),
NULL
},
@@ -3303,7 +3303,7 @@ static struct config_string ConfigureNamesString[] =
},
{
- {"ssl_cert_file", PGC_POSTMASTER, CONN_AUTH_SECURITY,+ {"ssl_cert_file", PGC_SIGHUP, CONN_AUTH_SECURITY,
gettext_noop("Location of the SSL server certificate file."),
NULL
},
@@ -3313,7 +3313,7 @@ static struct config_string ConfigureNamesString[] =
},
{
- {"ssl_key_file", PGC_POSTMASTER, CONN_AUTH_SECURITY,+ {"ssl_key_file", PGC_SIGHUP, CONN_AUTH_SECURITY,
gettext_noop("Location of the SSL server private key file."),
NULL
},
@@ -3323,7 +3323,7 @@ static struct config_string ConfigureNamesString[] =
},
{
- {"ssl_ca_file", PGC_POSTMASTER, CONN_AUTH_SECURITY,+ {"ssl_ca_file", PGC_SIGHUP, CONN_AUTH_SECURITY,
gettext_noop("Location of the SSL certificate authority file."),
NULL
},
@@ -3333,7 +3333,7 @@ static struct config_string ConfigureNamesString[] =
},
{
- {"ssl_crl_file", PGC_POSTMASTER, CONN_AUTH_SECURITY,+ {"ssl_crl_file", PGC_SIGHUP, CONN_AUTH_SECURITY,
gettext_noop("Location of the SSL certificate revocation list file."),
NULL
},
@@ -3375,7 +3375,7 @@ static struct config_string ConfigureNamesString[] =
},
{
- {"ssl_ciphers", PGC_POSTMASTER, CONN_AUTH_SECURITY,+ {"ssl_ciphers", PGC_SIGHUP, CONN_AUTH_SECURITY,
gettext_noop("Sets the list of allowed SSL ciphers."),
NULL,
GUC_SUPERUSER_ONLY
@@ -3390,7 +3390,7 @@ static struct config_string ConfigureNamesString[] =
},
{
- {"ssl_ecdh_curve", PGC_POSTMASTER, CONN_AUTH_SECURITY,+ {"ssl_ecdh_curve", PGC_SIGHUP, CONN_AUTH_SECURITY,
gettext_noop("Sets the curve to use for ECDH."),
NULL,
GUC_SUPERUSER_ONLY
diff --git a/src/backend/utils/misc/postgresql.conf.sample b/src/backend/utils/misc/postgresql.conf.sampleindex 029114f..a5b64d0 100644--- a/src/backend/utils/misc/postgresql.conf.sample+++ b/src/backend/utils/misc/postgresql.conf.sample@@ -78,15 +78,14 @@
# - Security and Authentication -
#authentication_timeout = 1min # 1s-600s
-#ssl = off # (change requires restart)+#ssl = off
#ssl_ciphers = 'HIGH:MEDIUM:+3DES:!aNULL' # allowed SSL ciphers
- # (change requires restart)-#ssl_prefer_server_ciphers = on # (change requires restart)-#ssl_ecdh_curve = 'prime256v1' # (change requires restart)-#ssl_cert_file = 'server.crt' # (change requires restart)-#ssl_key_file = 'server.key' # (change requires restart)-#ssl_ca_file = '' # (change requires restart)-#ssl_crl_file = '' # (change requires restart)+#ssl_prefer_server_ciphers = on+#ssl_ecdh_curve = 'prime256v1'+#ssl_cert_file = 'server.crt'+#ssl_key_file = 'server.key'+#ssl_ca_file = ''+#ssl_crl_file = ''
#password_encryption = on
#db_user_namespace = off
#row_security = on
diff --git a/src/include/libpq/libpq-be.h b/src/include/libpq/libpq-be.hindex caaa8b5..1c058dd 100644--- a/src/include/libpq/libpq-be.h+++ b/src/include/libpq/libpq-be.h@@ -201,7 +201,8 @@ typedef struct Port
* These functions are implemented by the glue code specific to each
* SSL implementation (e.g. be-secure-openssl.c)
*/
-extern void be_tls_init(void);+extern int be_tls_init(void);+extern void be_tls_destroy(void);
extern int be_tls_open_server(Port *port);
extern void be_tls_close(Port *port);
extern ssize_t be_tls_read(Port *port, void *ptr, size_t len, int *waitfor);
diff --git a/src/include/libpq/libpq.h b/src/include/libpq/libpq.hindex efb2dac..1730067 100644--- a/src/include/libpq/libpq.h+++ b/src/include/libpq/libpq.h@@ -84,6 +84,7 @@ extern int (*pq_putmessage_hook) (char msgtype, const char *s, size_t len);
extern int (*pq_flush_hook) (void);
extern int secure_initialize(void);
+extern void secure_destroy(void);
extern bool secure_loaded_verify_locations(void);
extern void secure_destroy(void);
extern int secure_open_server(Port *port);
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: andreas@proxel.se, michael.paquier@gmail.com, tgl@sss.pgh.pa.us, peter_e@gmx.net
Subject: Re: [PATCH] Reload SSL certificates on SIGHUP
In-Reply-To: <56528809.1060501@proxel.se>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox