This patch adds the ability to specify client certification and keys as
well as root certificates and revocation lists for the client as
parameters in PQconnectdb()

sslkey=fullepath_to_file
sslcert=fullpath_to_cert
ssltrustcrt=fullpath_to_trusted_cert_file
sslcrl=fullpath_to_revocation_list

Also, it fixes a but in client revocation lists that were never looking in
the application directory.
diff -u -r postgresql-8.2.7/src/interfaces/libpq/fe-connect.c postgresql-8.2.7-ssl/src/interfaces/libpq/fe-connect.c
--- postgresql-8.2.7/src/interfaces/libpq/fe-connect.c	2007-10-09 11:03:31.000000000 -0400
+++ postgresql-8.2.7-ssl/src/interfaces/libpq/fe-connect.c	2008-05-15 14:38:00.550668436 -0400
@@ -181,6 +181,18 @@
 	{"sslmode", "PGSSLMODE", DefaultSSLMode, NULL,
 	"SSL-Mode", "", 8},			/* sizeof("disable") == 8 */
 
+	{"sslcert", "PGSSLCERT", NULL, NULL,
+	"SSL-Client-Cert", "", 64},
+
+	{"sslkey", "PGSSLKEY", NULL, NULL,
+	"SSL-Client-Key", "", 64},
+
+	{"ssltrustcrt", "PGSSLKEY", NULL, NULL,
+	"SSL-Trusted-Keys", "", 64},
+
+	{"sslcrl", "PGSSLKEY", NULL, NULL,
+	"SSL-Revocation-List", "", 64},
+
 #ifdef KRB5
 	/* Kerberos authentication supports specifying the service name */
 	{"krbsrvname", "PGKRBSRVNAME", PG_KRB_SRVNAM, NULL,
@@ -402,7 +414,17 @@
 	conn->connect_timeout = tmp ? strdup(tmp) : NULL;
 	tmp = conninfo_getval(connOptions, "sslmode");
 	conn->sslmode = tmp ? strdup(tmp) : NULL;
+	tmp = conninfo_getval(connOptions, "sslkey");
+	conn->sslkey = tmp ? strdup(tmp) : NULL;
+	tmp = conninfo_getval(connOptions, "sslcert");
+	conn->sslcert = tmp ? strdup(tmp) : NULL;
+	tmp = conninfo_getval(connOptions, "ssltrustcrt");
+	conn->ssltrustcrt = tmp ? strdup(tmp) : NULL;
+	tmp = conninfo_getval(connOptions, "sslcrl");
+	conn->sslcrl = tmp ? strdup(tmp) : NULL;
+	
 #ifdef USE_SSL
+
 	tmp = conninfo_getval(connOptions, "requiressl");
 	if (tmp && tmp[0] == '1')
 	{
diff -u -r postgresql-8.2.7/src/interfaces/libpq/fe-secure.c postgresql-8.2.7-ssl/src/interfaces/libpq/fe-secure.c
--- postgresql-8.2.7/src/interfaces/libpq/fe-secure.c	2006-10-06 13:14:01.000000000 -0400
+++ postgresql-8.2.7-ssl/src/interfaces/libpq/fe-secure.c	2008-05-15 14:48:56.244034272 -0400
@@ -586,7 +586,10 @@
 	}
 
 	/* read the user certificate */
-	snprintf(fnbuf, sizeof(fnbuf), "%s/%s", homedir, USER_CERT_FILE);
+	if(conn->sslcert)
+		strncpy(fnbuf, conn->sslcert, sizeof(fnbuf));
+	else
+		snprintf(fnbuf, sizeof(fnbuf), "%s/%s", homedir, USER_CERT_FILE);
 	if ((fp = fopen(fnbuf, "r")) == NULL)
 	{
 		printfPQExpBuffer(&conn->errorMessage,
@@ -608,7 +611,10 @@
 	fclose(fp);
 
 	/* read the user key */
-	snprintf(fnbuf, sizeof(fnbuf), "%s/%s", homedir, USER_KEY_FILE);
+	if(conn->sslcert)
+		strncpy(fnbuf, conn->sslkey, sizeof(fnbuf));
+	else
+		snprintf(fnbuf, sizeof(fnbuf), "%s/%s", homedir, USER_KEY_FILE);
 	if (stat(fnbuf, &buf) == -1)
 	{
 		printfPQExpBuffer(&conn->errorMessage,
@@ -740,6 +746,9 @@
 		{
 			SSL_library_init();
 			SSL_load_error_strings();
+                	ERR_load_BIO_strings ();
+                	ERR_load_SSL_strings();
+			OpenSSL_add_all_algorithms ();
 		}
 		SSL_context = SSL_CTX_new(TLSv1_method());
 		if (!SSL_context)
@@ -778,7 +787,10 @@
 	/* Set up to verify server cert, if root.crt is present */
 	if (pqGetHomeDirectory(homedir, sizeof(homedir)))
 	{
-		snprintf(fnbuf, sizeof(fnbuf), "%s/%s", homedir, ROOT_CERT_FILE);
+		if(conn->ssltrustcrt)
+			strncpy(fnbuf, conn->ssltrustcrt, sizeof(fnbuf));
+		else
+			snprintf(fnbuf, sizeof(fnbuf), "%s/%s", homedir, ROOT_CERT_FILE);
 		if (stat(fnbuf, &buf) == 0)
 		{
 			X509_STORE *cvstore;
@@ -796,8 +808,12 @@
 
 			if ((cvstore = SSL_CTX_get_cert_store(SSL_context)) != NULL)
 			{
+				if(conn->sslcrl)
+					strncpy(fnbuf, conn->sslcrl, sizeof(fnbuf));
+				else
+					snprintf(fnbuf, sizeof(fnbuf), "%s/%s", homedir, ROOT_CRL_FILE);
 				/* setting the flags to check against the complete CRL chain */
-				if (X509_STORE_load_locations(cvstore, ROOT_CRL_FILE, NULL) != 0)
+				if (X509_STORE_load_locations(cvstore, fnbuf, NULL) != 0)
 /* OpenSSL 0.96 does not support X509_V_FLAG_CRL_CHECK */
 #ifdef X509_V_FLAG_CRL_CHECK
 					X509_STORE_set_flags(cvstore,
diff -u -r postgresql-8.2.7/src/interfaces/libpq/libpq-int.h postgresql-8.2.7-ssl/src/interfaces/libpq/libpq-int.h
--- postgresql-8.2.7/src/interfaces/libpq/libpq-int.h	2007-07-23 14:13:10.000000000 -0400
+++ postgresql-8.2.7-ssl/src/interfaces/libpq/libpq-int.h	2008-05-15 14:05:07.614237197 -0400
@@ -271,6 +271,10 @@
 	char	   *pguser;			/* Postgres username and password, if any */
 	char	   *pgpass;
 	char	   *sslmode;		/* SSL mode (require,prefer,allow,disable) */
+	char       *sslkey;	/* ssl key file filename for call back */
+	char	   *sslcert;	/* ssl certificate filename for call back */
+	char	   *ssltrustcrt; /* Trusted certificuits */
+	char 	   *sslcrl;	/* certificates revoked by certificate authorities */
 #ifdef KRB5
 	char	   *krbsrvname;		/* Kerberos service name */
 #endif
diff -u -r postgresql-8.2.7/src/interfaces/libpq/libpq.rc postgresql-8.2.7-ssl/src/interfaces/libpq/libpq.rc
--- postgresql-8.2.7/src/interfaces/libpq/libpq.rc	2008-03-14 22:52:42.000000000 -0400
+++ postgresql-8.2.7-ssl/src/interfaces/libpq/libpq.rc	2008-05-15 14:51:41.529453351 -0400
@@ -1,8 +1,8 @@
 #include <winver.h>
 
 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 8,2,7,8074
- PRODUCTVERSION 8,2,7,8074
+ FILEVERSION 8,2,7,8136
+ PRODUCTVERSION 8,2,7,8136
  FILEFLAGSMASK 0x3fL
  FILEFLAGS 0
  FILEOS VOS__WINDOWS32
-- 
Sent via pgsql-patches mailing list (pgsql-patches@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-patches

Reply via email to