mirror of https://github.com/postgres/postgres
This allows specifying an external command for prompting for or otherwise obtaining passphrases for SSL key files. This is useful because in many cases there is no TTY easily available during service startup. Also add a setting ssl_passphrase_command_supports_reload, which allows supporting SSL configuration reload even if SSL files need passphrases. Reviewed-by: Daniel Gustafsson <daniel@yesql.se>pull/31/merge
Peter Eisentraut
8 years ago
parent
7a50bb690b
commit
8a3d942529
@ -0,0 +1,120 @@ |
||||
/*-------------------------------------------------------------------------
|
||||
* |
||||
* be-secure-common.c |
||||
* |
||||
* common implementation-independent SSL support code |
||||
* |
||||
* While be-secure.c contains the interfaces that the rest of the |
||||
* communications code calls, this file contains support routines that are |
||||
* used by the library-specific implementations such as be-secure-openssl.c. |
||||
* |
||||
* Portions Copyright (c) 1996-2018, PostgreSQL Global Development Group |
||||
* Portions Copyright (c) 1994, Regents of the University of California |
||||
* |
||||
* IDENTIFICATION |
||||
* src/backend/libpq/be-secure-common.c |
||||
* |
||||
*------------------------------------------------------------------------- |
||||
*/ |
||||
|
||||
#include "postgres.h" |
||||
|
||||
#include "libpq/libpq.h" |
||||
#include "storage/fd.h" |
||||
|
||||
/*
|
||||
* Run ssl_passphrase_command |
||||
* |
||||
* prompt will be substituted for %p. is_server_start determines the loglevel |
||||
* of error messages. |
||||
* |
||||
* The result will be put in buffer buf, which is of size size. The return |
||||
* value is the length of the actual result. |
||||
*/ |
||||
int |
||||
run_ssl_passphrase_command(const char *prompt, bool is_server_start, char *buf, int size) |
||||
{ |
||||
int loglevel = is_server_start ? ERROR : LOG; |
||||
StringInfoData command; |
||||
char *p; |
||||
FILE *fh; |
||||
int pclose_rc; |
||||
size_t len = 0; |
||||
|
||||
Assert(prompt); |
||||
Assert(size > 0); |
||||
buf[0] = '\0'; |
||||
|
||||
initStringInfo(&command); |
||||
|
||||
for (p = ssl_passphrase_command; *p; p++) |
||||
{ |
||||
if (p[0] == '%') |
||||
{ |
||||
switch (p[1]) |
||||
{ |
||||
case 'p': |
||||
appendStringInfoString(&command, prompt); |
||||
p++; |
||||
break; |
||||
case '%': |
||||
appendStringInfoChar(&command, '%'); |
||||
p++; |
||||
break; |
||||
default: |
||||
appendStringInfoChar(&command, p[0]); |
||||
} |
||||
} |
||||
else |
||||
appendStringInfoChar(&command, p[0]); |
||||
} |
||||
|
||||
fh = OpenPipeStream(command.data, "r"); |
||||
if (fh == NULL) |
||||
{ |
||||
ereport(loglevel, |
||||
(errcode_for_file_access(), |
||||
errmsg("could not execute command \"%s\": %m", |
||||
command.data))); |
||||
goto error; |
||||
} |
||||
|
||||
if (!fgets(buf, size, fh)) |
||||
{ |
||||
if (ferror(fh)) |
||||
{ |
||||
ereport(loglevel, |
||||
(errcode_for_file_access(), |
||||
errmsg("could not read from command \"%s\": %m", |
||||
command.data))); |
||||
goto error; |
||||
} |
||||
} |
||||
|
||||
pclose_rc = ClosePipeStream(fh); |
||||
if (pclose_rc == -1) |
||||
{ |
||||
ereport(loglevel, |
||||
(errcode_for_file_access(), |
||||
errmsg("could not close pipe to external command: %m"))); |
||||
goto error; |
||||
} |
||||
else if (pclose_rc != 0) |
||||
{ |
||||
ereport(loglevel, |
||||
(errcode_for_file_access(), |
||||
errmsg("command \"%s\" failed", |
||||
command.data), |
||||
errdetail_internal("%s", wait_result_to_str(pclose_rc)))); |
||||
goto error; |
||||
} |
||||
|
||||
/* strip trailing newline */ |
||||
len = strlen(buf); |
||||
if (buf[len - 1] == '\n') |
||||
buf[len-- -1] = '\0'; |
||||
|
||||
error: |
||||
pfree(command.data); |
||||
return len; |
||||
} |
||||
@ -0,0 +1,18 @@ |
||||
-----BEGIN RSA PRIVATE KEY----- |
||||
Proc-Type: 4,ENCRYPTED |
||||
DEK-Info: DES-CBC,2FAEFD1C1B2C881C |
||||
|
||||
PGi9r3pm05iUwz5QbZik+ZNu0fHNaX8LJFZqpOhg0TV38csLtQ2PRjZ0Q/diBlVT |
||||
SD8JJnIvwPoIWXyMMTax/krFL0CpbFqgAzD4CEgfWxGNhwnMD1DkNaYp/UF/NfuF |
||||
7TqXomUlcH/pVaZlu7G0wrIo5rnjef70I7GEY2vwT5adSLsUBAgrs/u3MAAx/Wh4 |
||||
PkVxZELmyiH/8MdIevodjRcJrgIzRheEph39eHrWKgWeSbO0DEQK91vv3prICwo2 |
||||
w2iU0Zohf92QuquA2MKZWruCHb4A4HusUZf3Zc14Yueu/HyztSrHmFeBp0amlWep |
||||
/o6mx274XVj7IpanOPPM4qEhrF97LHdaSEPn9HwxvvV4GFJDNCVEBl4zuaHo0N8C |
||||
85GPazIxUWB3CB9PrtXduxeI22lwrIiUdmzA68EXHD7Wg8R90397MNMOomLgfNcu |
||||
rXarrTXmTNgOa20hc1Ue5AXg9fVS9V/5GP4Dn9SX/CdaE1rz0b73N/ViQzVrS9Ne |
||||
n04qYPbnf+MQmFWnzMXctZbYG6jDCbuGFIGP4i/LG+wOE8Rntu8Re9re+HANu5VJ |
||||
Ht20wYOGZIpNwo4YenxvPeTTlbB0Qcma2lnw2bt19owpNQVIeTnRQXxZs3/Y3a+A |
||||
+/B8VvIkQ0u0EpnSVLBetEmJqtOQvBz7c4Z+0Cl+DL1bTqrDn54MxUBap6dgU+/1 |
||||
R6pxx1F0ZTtQauVmO8n3rWKwOGG5NeMhf4iId2JWpw39VtRk8LNtnGUbUAbL5znY |
||||
rkUVyJstQg6U6kNTgDWQ1nBxCzlRz2xpHyghnyxLkMpW5ECpmwwLDQ== |
||||
-----END RSA PRIVATE KEY----- |
||||
Loading…
Reference in new issue