From 93383be85358a1ee03f34f34de45058e238964d1 Mon Sep 17 00:00:00 2001 From: Steven Fackler Date: Mon, 28 May 2018 14:53:38 -0700 Subject: [PATCH] Support tls-server-end-point on old OpenSSL X509_get_signature_nid was added in 1.0.2, but the fields required to get to the signare algorithm are public on versions before that, so we can just shim out the function when missing. OBJ_find_sigid_algs was added in 1.0.0, but (somewhat surprisingly) EVP_get_digestbynid works when given the NID for a signature algorithm so we can use that instead. --- src/backend/libpq/be-secure-openssl.c | 34 ++++++++++---------- src/interfaces/libpq/fe-secure-openssl.c | 40 +++++++++++------------- src/test/ssl/t/002_scram.pl | 24 +++----------- 3 files changed, 39 insertions(+), 59 deletions(-) diff --git a/src/backend/libpq/be-secure-openssl.c b/src/backend/libpq/be-secure-openssl.c index 48b468f62f..53660105ec 100644 --- a/src/backend/libpq/be-secure-openssl.c +++ b/src/backend/libpq/be-secure-openssl.c @@ -1123,16 +1123,26 @@ be_tls_get_peer_finished(Port *port, size_t *len) return result; } +#ifndef HAVE_X509_GET_SIGNATURE_NID +/* + * This function was added in OpenSSL 1.0.2, but all of the fields it accesses + * are public in older versions, so we can just redefine it when missing. + */ +static int +X509_get_signature_nid(const X509 *x) +{ + return OBJ_obj2nid(x->sig_alg->algorithm); +} +#endif + char * be_tls_get_certificate_hash(Port *port, size_t *len) { -#ifdef HAVE_X509_GET_SIGNATURE_NID X509 *server_cert; char *cert_hash; - const EVP_MD *algo_type = NULL; + const EVP_MD *algo_type; unsigned char hash[EVP_MAX_MD_SIZE]; /* size for SHA-512 */ unsigned int hash_size; - int algo_nid; *len = 0; server_cert = SSL_get_certificate(port->ssl); @@ -1143,8 +1153,8 @@ be_tls_get_certificate_hash(Port *port, size_t *len) * Get the signature algorithm of the certificate to determine the hash * algorithm to use for the result. */ - if (!OBJ_find_sigid_algs(X509_get_signature_nid(server_cert), - &algo_nid, NULL)) + algo_type = EVP_get_digestbynid(X509_get_signature_nid(server_cert)); + if (!algo_type) elog(ERROR, "could not determine server certificate signature algorithm"); /* @@ -1153,18 +1163,12 @@ be_tls_get_certificate_hash(Port *port, size_t *len) * (https://tools.ietf.org/html/rfc5929#section-4.1). If something else * is used, the same hash as the signature algorithm is used. */ - switch (algo_nid) + switch (EVP_MD_type(algo_type)) { case NID_md5: case NID_sha1: algo_type = EVP_sha256(); break; - default: - algo_type = EVP_get_digestbynid(algo_nid); - if (algo_type == NULL) - elog(ERROR, "could not find digest for NID %s", - OBJ_nid2sn(algo_nid)); - break; } /* generate and save the certificate hash */ @@ -1176,12 +1180,6 @@ be_tls_get_certificate_hash(Port *port, size_t *len) *len = hash_size; return cert_hash; -#else - ereport(ERROR, - (errcode(ERRCODE_PROTOCOL_VIOLATION), - errmsg("channel binding type \"tls-server-end-point\" is not supported by this build"))); - return NULL; -#endif } /* diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c index 43640e3799..e975115525 100644 --- a/src/interfaces/libpq/fe-secure-openssl.c +++ b/src/interfaces/libpq/fe-secure-openssl.c @@ -389,15 +389,26 @@ pgtls_get_finished(PGconn *conn, size_t *len) return result; } +#ifndef HAVE_X509_GET_SIGNATURE_NID +/* + * This function was added in OpenSSL 1.0.2, but all of the fields it accesses + * are public in older versions, so we can just redefine it when missing. + */ +static int +X509_get_signature_nid(const X509 *x) +{ + return OBJ_obj2nid(x->sig_alg->algorithm); +} +#endif + char * pgtls_get_peer_certificate_hash(PGconn *conn, size_t *len) { -#ifdef HAVE_X509_GET_SIGNATURE_NID X509 *peer_cert; const EVP_MD *algo_type; unsigned char hash[EVP_MAX_MD_SIZE]; /* size for SHA-512 */ unsigned int hash_size; - int algo_nid; + int signature_nid; char *cert_hash; *len = 0; @@ -411,11 +422,13 @@ pgtls_get_peer_certificate_hash(PGconn *conn, size_t *len) * Get the signature algorithm of the certificate to determine the hash * algorithm to use for the result. */ - if (!OBJ_find_sigid_algs(X509_get_signature_nid(peer_cert), - &algo_nid, NULL)) + signature_nid = X509_get_signature_nid(peer_cert); + algo_type = EVP_get_digestbynid(signature_nid); + if (!algo_type) { printfPQExpBuffer(&conn->errorMessage, - libpq_gettext("could not determine server certificate signature algorithm\n")); + libpq_gettext("could not find digest for NID %s\n"), + OBJ_nid2sn(signature_nid)); return NULL; } @@ -425,22 +438,12 @@ pgtls_get_peer_certificate_hash(PGconn *conn, size_t *len) * (https://tools.ietf.org/html/rfc5929#section-4.1). If something else * is used, the same hash as the signature algorithm is used. */ - switch (algo_nid) + switch (EVP_MD_type(algo_type)) { case NID_md5: case NID_sha1: algo_type = EVP_sha256(); break; - default: - algo_type = EVP_get_digestbynid(algo_nid); - if (algo_type == NULL) - { - printfPQExpBuffer(&conn->errorMessage, - libpq_gettext("could not find digest for NID %s\n"), - OBJ_nid2sn(algo_nid)); - return NULL; - } - break; } if (!X509_digest(peer_cert, algo_type, hash, &hash_size)) @@ -462,11 +465,6 @@ pgtls_get_peer_certificate_hash(PGconn *conn, size_t *len) *len = hash_size; return cert_hash; -#else - printfPQExpBuffer(&conn->errorMessage, - libpq_gettext("channel binding type \"tls-server-end-point\" is not supported by this build\n")); - return NULL; -#endif } /* ------------------------------------------------------------ */ diff --git a/src/test/ssl/t/002_scram.pl b/src/test/ssl/t/002_scram.pl index 52a8f458cb..682add4fb7 100644 --- a/src/test/ssl/t/002_scram.pl +++ b/src/test/ssl/t/002_scram.pl @@ -18,10 +18,6 @@ my $number_of_tests = 6; # This is the hostname used to connect to the server. my $SERVERHOSTADDR = '127.0.0.1'; -# Determine whether build supports tls-server-end-point. -my $supports_tls_server_end_point = - check_pg_config("#define HAVE_X509_GET_SIGNATURE_NID 1"); - # Allocation of base connection string shared among multiple tests. my $common_connstr; @@ -56,22 +52,10 @@ test_connect_ok( "SCRAM authentication with tls-unique as channel binding"); test_connect_ok($common_connstr, "scram_channel_binding=''", "SCRAM authentication without channel binding"); -if ($supports_tls_server_end_point) -{ - test_connect_ok( - $common_connstr, - "scram_channel_binding=tls-server-end-point", - "SCRAM authentication with tls-server-end-point as channel binding"); -} -else -{ - test_connect_fails( - $common_connstr, - "scram_channel_binding=tls-server-end-point", - qr/channel binding type "tls-server-end-point" is not supported by this build/, - "SCRAM authentication with tls-server-end-point as channel binding"); - $number_of_tests++; -} +test_connect_ok( + $common_connstr, + "scram_channel_binding=tls-server-end-point", + "SCRAM authentication with tls-server-end-point as channel binding"); test_connect_fails( $common_connstr, "scram_channel_binding=not-exists", -- 2.17.0