Folks, At long last I put together a patch to support 4 client SSL negotiation modes (and replace the requiressl boolean). The four options were first spelled out by Magnus Hagander <[EMAIL PROTECTED]> on 2000-08-23 in email to pgsql-hackers, archived here:
http://archives.postgresql.org/pgsql-hackers/2000-08/msg00639.php My original less-flexible patch and the ensuing thread are archived at: http://dbforums.com/t623845.html Attached is a new patch, including documentation. To sum up, there's a new client parameter "sslmode" and environment variable "PGSSLMODE", with these options: sslmode description ------- ----------- prevent Unencrypted non-SSL only allow Negotiate, prefer non-SSL prefer Negotiate, prefer SSL (default) require Require SSL The only change to the server is a new pg_hba.conf line type, "hostnossl", for specifying connections that are not allowed to use SSL (for example, to prevent servers on a local network from accidentally using SSL and wasting cycles). Thus the 3 pg_hba.conf line types are: pg_hba.conf line types ---------------------- host applies to either SSL or regular connections hostssl applies only to SSL connections hostnossl applies only to regular connections These client and server options, the postgresql.conf ssl = false option, and finally the possibility of compiling with no SSL support at all, make quite a range of combinations to test. I threw together a test script to try many of them out. It's in a separate tarball with its config files, a patch to psql so it'll announce SSL connections even in absence of a tty, and the test output. The test is especially informative when run on the same tty the postmaster was started on, so the FATAL: errors during negotiation are interleaved with the psql client output. I saw Tom write that new submissions for 7.4 have to be in before midnight local time, and since I'm on the east coast in the US, this just makes it in before the bell. :) Jon
sslmode.tar.gz
Description: Binary data
Index: doc/FAQ
===================================================================
RCS file: /projects/cvsroot/pgsql-server/doc/FAQ,v
retrieving revision 1.221
diff -c -r1.221 FAQ
*** doc/FAQ 6 Jun 2003 22:20:40 -0000 1.221
--- doc/FAQ 1 Jul 2003 02:33:19 -0000
***************
*** 1111,1118 ****
* contrib/pgcrypto contains many encryption functions for use in SQL
queries.
! * The only way to encrypt transmission from the client to the server
! is by using hostssl in pg_hba.conf.
* Database user passwords are automatically encrypted when stored in
version 7.3. In previous versions, you must enable the option
PASSWORD_ENCRYPTION in postgresql.conf.
--- 1111,1122 ----
* contrib/pgcrypto contains many encryption functions for use in SQL
queries.
! * To encrypt transmission from the client to the server, the server
! must have the "ssl" option set to true in postgresql.conf, and an
! applicable host or hostssl record must exist in pg_hba.conf, and the
! client "sslmode" must not be "prevent". (Note that it is also
! possible to use a third-party encrypted transport, such as stunnel
! or ssh, rather than PostgreSQL's native SSL connections.)
* Database user passwords are automatically encrypted when stored in
version 7.3. In previous versions, you must enable the option
PASSWORD_ENCRYPTION in postgresql.conf.
Index: doc/src/sgml/client-auth.sgml
===================================================================
RCS file: /projects/cvsroot/pgsql-server/doc/src/sgml/client-auth.sgml,v
retrieving revision 1.52
diff -c -r1.52 client-auth.sgml
*** doc/src/sgml/client-auth.sgml 25 Jun 2003 01:20:50 -0000 1.52
--- doc/src/sgml/client-auth.sgml 1 Jul 2003 02:33:20 -0000
***************
*** 83,95 ****
</para>
<para>
! A record may have one of the five formats
<synopsis>
local <replaceable>database</replaceable> <replaceable>user</replaceable>
<replaceable>authentication-method</replaceable>
<optional><replaceable>authentication-option</replaceable></optional>
host <replaceable>database</replaceable> <replaceable>user</replaceable>
<replaceable>IP-address</replaceable> <replaceable>IP-mask</replaceable>
<replaceable>authentication-method</replaceable>
<optional><replaceable>authentication-option</replaceable></optional>
hostssl <replaceable>database</replaceable> <replaceable>user</replaceable>
<replaceable>IP-address</replaceable> <replaceable>IP-mask</replaceable>
<replaceable>authentication-method</replaceable>
<optional><replaceable>authentication-option</replaceable></optional>
host <replaceable>database</replaceable> <replaceable>user</replaceable>
<replaceable>IP-address</replaceable>/<replaceable>CIDR-mask</replaceable>
<replaceable>authentication-method</replaceable>
<optional><replaceable>authentication-option</replaceable></optional>
hostssl <replaceable>database</replaceable> <replaceable>user</replaceable>
<replaceable>IP-address</replaceable>/<replaceable>CIDR-mask</replaceable>
<replaceable>authentication-method</replaceable>
<optional><replaceable>authentication-option</replaceable></optional>
</synopsis>
The meaning of the fields is as follows:
--- 83,97 ----
</para>
<para>
! A record may have one of the seven formats
<synopsis>
local <replaceable>database</replaceable> <replaceable>user</replaceable>
<replaceable>authentication-method</replaceable>
<optional><replaceable>authentication-option</replaceable></optional>
host <replaceable>database</replaceable> <replaceable>user</replaceable>
<replaceable>IP-address</replaceable> <replaceable>IP-mask</replaceable>
<replaceable>authentication-method</replaceable>
<optional><replaceable>authentication-option</replaceable></optional>
hostssl <replaceable>database</replaceable> <replaceable>user</replaceable>
<replaceable>IP-address</replaceable> <replaceable>IP-mask</replaceable>
<replaceable>authentication-method</replaceable>
<optional><replaceable>authentication-option</replaceable></optional>
+ hostnossl <replaceable>database</replaceable> <replaceable>user</replaceable>
<replaceable>IP-address</replaceable> <replaceable>IP-mask</replaceable>
<replaceable>authentication-method</replaceable>
<optional><replaceable>authentication-option</replaceable></optional>
host <replaceable>database</replaceable> <replaceable>user</replaceable>
<replaceable>IP-address</replaceable>/<replaceable>CIDR-mask</replaceable>
<replaceable>authentication-method</replaceable>
<optional><replaceable>authentication-option</replaceable></optional>
hostssl <replaceable>database</replaceable> <replaceable>user</replaceable>
<replaceable>IP-address</replaceable>/<replaceable>CIDR-mask</replaceable>
<replaceable>authentication-method</replaceable>
<optional><replaceable>authentication-option</replaceable></optional>
+ hostnossl <replaceable>database</replaceable> <replaceable>user</replaceable>
<replaceable>IP-address</replaceable>/<replaceable>CIDR-mask</replaceable>
<replaceable>authentication-method</replaceable>
<optional><replaceable>authentication-option</replaceable></optional>
</synopsis>
The meaning of the fields is as follows:
***************
*** 137,142 ****
--- 139,155 ----
</varlistentry>
<varlistentry>
+ <term><literal>hostnossl</literal></term>
+ <listitem>
+ <para>
+ This record is similar to <literal>hostssl</> but with the
+ opposite logic: it matches only regular connection attempts not
+ using SSL.
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
<term><replaceable>database</replaceable></term>
<listitem>
<para>
***************
*** 196,203 ****
</para>
<para>
! These fields only apply to <literal>host</literal> and
! <literal>hostssl</literal> records.
</para>
</listitem>
</varlistentry>
--- 209,216 ----
</para>
<para>
! These fields only apply to <literal>host</literal>,
! <literal>hostssl</literal>, and <literal>hostnossl</> records.
</para>
</listitem>
</varlistentry>
***************
*** 224,231 ****
</para>
<para>
! This field only applies to <literal>host</literal> and
! <literal>hostssl</literal> records.
</para>
</listitem>
</varlistentry>
--- 237,244 ----
</para>
<para>
! This field only applies to <literal>host</literal>,
! <literal>hostssl</literal>, and <literal>hostnossl</> records.
</para>
</listitem>
</varlistentry>
Index: doc/src/sgml/libpq.sgml
===================================================================
RCS file: /projects/cvsroot/pgsql-server/doc/src/sgml/libpq.sgml,v
retrieving revision 1.127
diff -c -r1.127 libpq.sgml
*** doc/src/sgml/libpq.sgml 27 Jun 2003 19:08:37 -0000 1.127
--- doc/src/sgml/libpq.sgml 1 Jul 2003 02:33:21 -0000
***************
*** 207,219 ****
</varlistentry>
<varlistentry>
<term><literal>requiressl</literal></term>
<listitem>
<para>
! If set to 1, an <acronym>SSL</acronym> connection to the server is required.
<application>libpq</> will then refuse to connect if the server does not
accept an <acronym>SSL</acronym> connection.
! If set to 0 (default), <application>libpq</> will negotiate the connection
type with server.
This option is only available if
<productname>PostgreSQL</> is compiled with SSL support.
</para>
--- 207,249 ----
</varlistentry>
<varlistentry>
+ <term><literal>sslmode</literal></term>
+ <listitem>
+ <para>
+ This option determines whether or with what priority an <acronym>SSL</>
+ connection will be negotiated with the server. There are four
+ modes: <term><literal>prevent</></> will attempt only an unencrypted
+ <acronym>SSL</> connection; <term><literal>allow</></> will negotiate,
+ trying first a non-<acronym>SSL</> connection, then if that fails,
+ then trying an <acronym>SSL</> connection; <term><literal>prefer</></>
+ (the default) will negotiate, trying first an <acronym>SSL</> connection,
+ then if that fails, trying a regular non-<acronym>SSL</> connection;
+ <term><literal>require</></> will try only an <acronym>SSL</> connection.
+ </para>
+ <para>
+ Option <term><literal>require</></> is only available if
+ <productname>PostgreSQL</> is compiled with SSL support. If it is not,
+ options <term><literal>allow</></> and <term><literal>prefer</></> will
+ not be able to try to negotiate an <acronym>SSL</> connection.
+ </para>
+ </listitem>
+ </varlistentry>
+
+ <varlistentry>
<term><literal>requiressl</literal></term>
<listitem>
<para>
! This option is deprecated in favor of the <term><literal>sslmode</></>
! setting.
! </para>
! <para>
! If set to 1, an <acronym>SSL</acronym> connection to the server is required
! (this is equivalent to <term><literal>sslmode</></>
<term><literal>require</></>).
<application>libpq</> will then refuse to connect if the server does not
accept an <acronym>SSL</acronym> connection.
! If set to 0 (default), <application>libpq</> will negotiate the connection
! type with server (equivalent to <term><literal>sslmode</></>
! <term><literal>prefer</></>).
This option is only available if
<productname>PostgreSQL</> is compiled with SSL support.
</para>
***************
*** 3141,3153 ****
<listitem>
<para>
<indexterm>
<primary><envar>PGREQUIRESSL</envar></primary>
</indexterm>
<envar>PGREQUIRESSL</envar> sets whether or not the connection must be
made over <acronym>SSL</acronym>. If set to
<quote>1</quote>, <application>libpq</>
will refuse to connect if the server does not accept
! an <acronym>SSL</acronym> connection.
This option is only available if
<productname>PostgreSQL</> is compiled with SSL support.
</para>
--- 3171,3207 ----
<listitem>
<para>
<indexterm>
+ <primary><envar>PGSSLMODE</envar></primary>
+ </indexterm>
+ <envar>PGSSLMODE</envar> determines whether and with what priority an
+ <acronym>SSL</> connection will be negotiated with the server. There are
+ four modes: <term><literal>prevent</></> will attempt only an unencrypted
+ <acronym>SSL</> connection; <term><literal>allow</></> will negotiate,
+ trying first a non-<acronym>SSL</> connection, then if that fails,
+ then trying an <acronym>SSL</> connection; <term><literal>prefer</></>
+ (the default) will negotiate, trying first an <acronym>SSL</>
+ connection, then if that fails, trying a regular non-<acronym>SSL</>
+ connection; <term><literal>require</></> will try only an <acronym>SSL</>
+ connection. Option <term><literal>require</></> is only available if
+ <productname>PostgreSQL</> is compiled with SSL support. If it is not,
+ options <term><literal>allow</></> and <term><literal>prefer</></>
+ will not be able to try to negotiate an <acronym>SSL</> connection.
+ </para>
+ </listitem>
+ <listitem>
+ <listitem>
+ <para>
+ <indexterm>
<primary><envar>PGREQUIRESSL</envar></primary>
</indexterm>
+ This option is deprecated in favor of the <term><literal>sslmode</></>
+ setting.
<envar>PGREQUIRESSL</envar> sets whether or not the connection must be
made over <acronym>SSL</acronym>. If set to
<quote>1</quote>, <application>libpq</>
will refuse to connect if the server does not accept
! an <acronym>SSL</acronym> connection (equivalent to <term><literal>sslmode</></>
! <term><literal>prefer</></>).
This option is only available if
<productname>PostgreSQL</> is compiled with SSL support.
</para>
Index: src/backend/libpq/auth.c
===================================================================
RCS file: /projects/cvsroot/pgsql-server/src/backend/libpq/auth.c,v
retrieving revision 1.103
diff -c -r1.103 auth.c
*** src/backend/libpq/auth.c 25 Jun 2003 01:19:47 -0000 1.103
--- src/backend/libpq/auth.c 1 Jul 2003 02:33:22 -0000
***************
*** 424,431 ****
NULL, 0, NI_NUMERICHOST);
elog(FATAL,
! "No pg_hba.conf entry for host %s, user %s,
database %s",
! hostinfo, port->user_name,
port->database_name);
break;
}
--- 424,432 ----
NULL, 0, NI_NUMERICHOST);
elog(FATAL,
! "No pg_hba.conf entry for host %s, user %s,
database %s, SSL %s",
! hostinfo, port->user_name, port->database_name,
! port->ssl ? "on" : "off");
break;
}
Index: src/backend/libpq/be-secure.c
===================================================================
RCS file: /projects/cvsroot/pgsql-server/src/backend/libpq/be-secure.c,v
retrieving revision 1.34
diff -c -r1.34 be-secure.c
*** src/backend/libpq/be-secure.c 11 Jun 2003 15:05:50 -0000 1.34
--- src/backend/libpq/be-secure.c 1 Jul 2003 02:33:22 -0000
***************
*** 643,649 ****
SSL_CTX_set_options(SSL_context, SSL_OP_SINGLE_DH_USE | SSL_OP_NO_SSLv2);
/* setup the allowed cipher list */
! if (SSL_CTX_set_cipher_list(SSL_context, "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGH")
!= 1)
{
postmaster_error("unable to set the cipher list (no valid ciphers
available)");
ExitPostmaster(1);
--- 643,649 ----
SSL_CTX_set_options(SSL_context, SSL_OP_SINGLE_DH_USE | SSL_OP_NO_SSLv2);
/* setup the allowed cipher list */
! if (SSL_CTX_set_cipher_list(SSL_context, "ALL:!ADH:!LOW:!EXP:!MD5:@STRENGTH")
!= 1)
{
postmaster_error("unable to set the cipher list (no valid ciphers
available)");
ExitPostmaster(1);
Index: src/backend/libpq/hba.c
===================================================================
RCS file: /projects/cvsroot/pgsql-server/src/backend/libpq/hba.c,v
retrieving revision 1.104
diff -c -r1.104 hba.c
*** src/backend/libpq/hba.c 15 Jun 2003 16:21:39 -0000 1.104
--- src/backend/libpq/hba.c 1 Jul 2003 02:33:22 -0000
***************
*** 590,596 ****
if (port->raddr.addr.ss_family != AF_UNIX)
return;
}
! else if (strcmp(token, "host") == 0 || strcmp(token, "hostssl") == 0)
{
if (strcmp(token, "hostssl") == 0)
--- 590,598 ----
if (port->raddr.addr.ss_family != AF_UNIX)
return;
}
! else if (strcmp(token, "host") == 0
! || strcmp(token, "hostssl") == 0
! || strcmp(token, "hostnossl") == 0)
{
if (strcmp(token, "hostssl") == 0)
***************
*** 608,613 ****
--- 610,621 ----
/* We don't accept this keyword at all if no SSL support */
goto hba_syntax;
#endif
+ }
+ else if (strcmp(token, "hostnossl") == 0)
+ {
+ /* Record does not match if we are on an SSL connection */
+ if (port->ssl)
+ return;
}
/* Get the database. */
Index: src/interfaces/libpq/fe-connect.c
===================================================================
RCS file: /projects/cvsroot/pgsql-server/src/interfaces/libpq/fe-connect.c,v
retrieving revision 1.252
diff -c -r1.252 fe-connect.c
*** src/interfaces/libpq/fe-connect.c 23 Jun 2003 19:20:24 -0000 1.252
--- src/interfaces/libpq/fe-connect.c 1 Jul 2003 02:33:28 -0000
***************
*** 60,65 ****
--- 60,70 ----
#define DefaultOption ""
#define DefaultAuthtype ""
#define DefaultPassword ""
+ #ifdef USE_SSL
+ #define DefaultSSLMode "prefer"
+ #else
+ #define DefaultSSLMode "prevent"
+ #endif
/* ----------
***************
*** 131,140 ****
"Backend-Debug-Options", "D", 40},
#ifdef USE_SSL
{"requiressl", "PGREQUIRESSL", "0", NULL,
! "Require-SSL", "", 1},
#endif
/* Terminating entry --- MUST BE LAST */
{NULL, NULL, NULL, NULL,
NULL, NULL, 0}
--- 136,157 ----
"Backend-Debug-Options", "D", 40},
#ifdef USE_SSL
+ /*
+ * "requiressl" is deprecated, its purpose having been taken over
+ * by "sslmode". It remains for backwards compatibility.
+ */
{"requiressl", "PGREQUIRESSL", "0", NULL,
! "Require-SSL", "D", 1},
#endif
+ /*
+ * "sslmode" option is allowed even without client SSL support
+ * because the client can still handle SSL modes "prevent" and
+ * "allow".
+ */
+ {"sslmode", "PGSSLMODE", DefaultSSLMode, NULL,
+ "SSL-Mode", "", 8}, /* sizeof("prevent") == 8 */
+
/* Terminating entry --- MUST BE LAST */
{NULL, NULL, NULL, NULL,
NULL, NULL, 0}
***************
*** 340,349 ****
conn->pgpass = tmp ? strdup(tmp) : NULL;
tmp = conninfo_getval(connOptions, "connect_timeout");
conn->connect_timeout = tmp ? strdup(tmp) : NULL;
#ifdef USE_SSL
tmp = conninfo_getval(connOptions, "requiressl");
if (tmp && tmp[0] == '1')
! conn->require_ssl = true;
#endif
/*
--- 357,373 ----
conn->pgpass = tmp ? strdup(tmp) : NULL;
tmp = conninfo_getval(connOptions, "connect_timeout");
conn->connect_timeout = tmp ? strdup(tmp) : NULL;
+ tmp = conninfo_getval(connOptions, "sslmode");
+ conn->sslmode = tmp ? strdup(tmp) : NULL;
#ifdef USE_SSL
tmp = conninfo_getval(connOptions, "requiressl");
if (tmp && tmp[0] == '1')
! {
! /* here warn that the requiressl option is deprecated? */
! if (conn->sslmode)
! free(conn->sslmode);
! conn->sslmode = "require";
! }
#endif
/*
***************
*** 412,417 ****
--- 436,482 ----
}
#endif
+ /*
+ * validate sslmode option
+ */
+ if (conn->sslmode)
+ {
+ if (strcmp(conn->sslmode, "prevent") != 0
+ && strcmp(conn->sslmode, "allow") != 0
+ && strcmp(conn->sslmode, "prefer") != 0
+ && strcmp(conn->sslmode, "require") != 0)
+ {
+ conn->status = CONNECTION_BAD;
+ printfPQExpBuffer(&conn->errorMessage,
+ libpq_gettext("unknown
sslmode \"%s\" requested\n"),
+ conn->sslmode);
+ return false;
+ }
+
+ #ifdef USE_SSL
+ if (strcmp(conn->sslmode, "allow") == 0
+ || strcmp(conn->sslmode, "prefer") == 0)
+ {
+ /*
+ * warn user that an SSL connection will never be
+ * negotiated since SSL was not compiled in?
+ */
+ }
+ #else
+ if (strcmp(conn->sslmode, "require") == 0)
+ {
+ conn->status = CONNECTION_BAD;
+ printfPQExpBuffer(&conn->errorMessage,
+ libpq_gettext("sslmode
\"%s\" invalid when SSL "
+
"support is not compiled in\n"),
+ conn->sslmode);
+ return false;
+ }
+ #endif
+ }
+ else
+ conn->sslmode = DefaultSSLMode;
+
return true;
}
***************
*** 865,870 ****
--- 930,941 ----
goto connect_errReturn;
}
+ /* setup values based on SSL mode */
+ if (strcmp(conn->sslmode, "prevent") == 0)
+ conn->allow_ssl_try = false;
+ else if (strcmp(conn->sslmode, "allow") == 0)
+ conn->wait_ssl_try = true;
+
/*
* Set up to try to connect, with protocol 3.0 as the first attempt.
*/
***************
*** 1269,1278 ****
{
/* Don't bother requesting SSL over a Unix
socket */
conn->allow_ssl_try = false;
- conn->require_ssl = false;
}
#endif
! if (conn->allow_ssl_try && conn->ssl == NULL)
{
ProtocolVersion pv;
--- 1340,1348 ----
{
/* Don't bother requesting SSL over a Unix
socket */
conn->allow_ssl_try = false;
}
#endif
! if (conn->allow_ssl_try && ! conn->wait_ssl_try &&
conn->ssl == NULL)
{
ProtocolVersion pv;
***************
*** 1376,1388 ****
}
else if (SSLok == 'N')
{
! if (conn->require_ssl)
{
/* Require SSL, but server
does not want it */
printfPQExpBuffer(&conn->errorMessage,
libpq_gettext("server does not support SSL, but SSL was required\n"));
goto error_return;
}
/* Otherwise, proceed with normal
startup */
conn->allow_ssl_try = false;
conn->status = CONNECTION_MADE;
--- 1446,1470 ----
}
else if (SSLok == 'N')
{
! if (strcmp(conn->sslmode, "require")
== 0)
{
/* Require SSL, but server
does not want it */
printfPQExpBuffer(&conn->errorMessage,
libpq_gettext("server does not support SSL, but SSL was required\n"));
goto error_return;
}
+ else if (conn->wait_ssl_try)
+ {
+ /*
+ * normal startup already
failed, so SSL failure
+ * means the end
+ */
+
printfPQExpBuffer(&conn->errorMessage,
+
libpq_gettext("server does not support normal or SSL connections\n"));
+ goto error_return;
+ }
+
+
/* Otherwise, proceed with normal
startup */
conn->allow_ssl_try = false;
conn->status = CONNECTION_MADE;
***************
*** 1393,1405 ****
/* Received error - probably protocol
mismatch */
if (conn->Pfdebug)
fprintf(conn->Pfdebug,
"Postmaster reports error, attempting fallback to pre-7.0.\n");
! if (conn->require_ssl)
{
/* Require SSL, but server is
too old */
printfPQExpBuffer(&conn->errorMessage,
libpq_gettext("server does not support SSL, but SSL was required\n"));
goto error_return;
}
/* Otherwise, try again without SSL */
conn->allow_ssl_try = false;
/* Assume it ain't gonna handle
protocol 3, either */
--- 1475,1497 ----
/* Received error - probably protocol
mismatch */
if (conn->Pfdebug)
fprintf(conn->Pfdebug,
"Postmaster reports error, attempting fallback to pre-7.0.\n");
! if (strcmp(conn->sslmode, "require")
== 0)
{
/* Require SSL, but server is
too old */
printfPQExpBuffer(&conn->errorMessage,
libpq_gettext("server does not support SSL, but SSL was required\n"));
goto error_return;
}
+ else if (conn->wait_ssl_try)
+ {
+ /*
+ * normal startup already
failed, so SSL failure
+ * means the end
+ */
+
printfPQExpBuffer(&conn->errorMessage,
+
libpq_gettext("server does not support normal or SSL connections\n"));
+ goto error_return;
+ }
/* Otherwise, try again without SSL */
conn->allow_ssl_try = false;
/* Assume it ain't gonna handle
protocol 3, either */
***************
*** 1586,1591 ****
--- 1678,1722 ----
}
/* OK, we read the message; mark data consumed
*/
conn->inStart = conn->inCursor;
+
+ #ifdef USE_SSL
+ /*
+ * if sslmode is "allow" and we haven't tried
an
+ * SSL connection already, then retry with an
SSL connection
+ */
+ if (conn->wait_ssl_try
+ && conn->ssl == NULL
+ && conn->allow_ssl_try)
+ {
+ conn->wait_ssl_try = false;
+ /* Must drop the old connection */
+ closesocket(conn->sock);
+ conn->sock = -1;
+ conn->status = CONNECTION_NEEDED;
+ goto keep_going;
+ }
+
+ /*
+ * if sslmode is not "require" and we're in an
SSL
+ * connection and we haven't already tried a
non-SSL
+ * for "allow", then do a non-SSL retry
+ */
+ if (! conn->wait_ssl_try
+ && conn->ssl
+ && conn->allow_ssl_try
+ && strcmp(conn->sslmode, "require") != 0
+ && strcmp(conn->sslmode, "allow") != 0)
+ {
+ conn->allow_ssl_try = false;
+ /* Must drop the old connection */
+ closesocket(conn->sock);
+ conn->sock = -1;
+ free(conn->ssl);
+ conn->status = CONNECTION_NEEDED;
+ goto keep_going;
+ }
+ #endif
+
goto error_return;
}
***************
*** 1637,1642 ****
--- 1768,1811 ----
if (fe_sendauth(areq, conn, conn->pghost, conn->pgpass,
conn->errorMessage.data) != STATUS_OK)
{
+ #ifdef USE_SSL
+ /*
+ * if sslmode is "allow" and we haven't tried
an
+ * SSL connection already, then retry with an
SSL connection
+ */
+ if (conn->wait_ssl_try
+ && conn->ssl == NULL
+ && conn->allow_ssl_try)
+ {
+ conn->wait_ssl_try = false;
+ /* Must drop the old connection */
+ closesocket(conn->sock);
+ conn->sock = -1;
+ conn->status = CONNECTION_NEEDED;
+ goto keep_going;
+ }
+
+ /*
+ * if sslmode is not "require" and we're in an
SSL
+ * connection and we haven't already tried a
non-SSL
+ * for "allow", then do a non-SSL retry
+ */
+ if (! conn->wait_ssl_try
+ && conn->ssl
+ && conn->allow_ssl_try
+ && strcmp(conn->sslmode, "require") != 0
+ && strcmp(conn->sslmode, "allow") != 0)
+ {
+ conn->allow_ssl_try = false;
+ /* Must drop the old connection */
+ closesocket(conn->sock);
+ conn->sock = -1;
+ free(conn->ssl);
+ conn->status = CONNECTION_NEEDED;
+ goto keep_going;
+ }
+ #endif
+
conn->errorMessage.len =
strlen(conn->errorMessage.data);
goto error_return;
}
Index: src/interfaces/libpq/libpq-int.h
===================================================================
RCS file: /projects/cvsroot/pgsql-server/src/interfaces/libpq/libpq-int.h,v
retrieving revision 1.76
diff -c -r1.76 libpq-int.h
*** src/interfaces/libpq/libpq-int.h 23 Jun 2003 19:20:25 -0000 1.76
--- src/interfaces/libpq/libpq-int.h 1 Jul 2003 02:33:28 -0000
***************
*** 316,324 ****
PGresult *result; /* result being constructed */
PGresAttValue *curTuple; /* tuple currently being read */
#ifdef USE_SSL
bool allow_ssl_try; /* Allowed to try SSL negotiation */
! bool require_ssl; /* Require SSL to make connection */
SSL *ssl; /* SSL status, if have SSL
connection */
X509 *peer; /* X509 cert of server */
char peer_dn[256 + 1]; /* peer distinguished name */
--- 316,326 ----
PGresult *result; /* result being constructed */
PGresAttValue *curTuple; /* tuple currently being read */
+ char *sslmode; /* SSL mode option string */
#ifdef USE_SSL
bool allow_ssl_try; /* Allowed to try SSL negotiation */
! bool wait_ssl_try; /* Delay SSL negotiation until after
! attempting normal
connection */
SSL *ssl; /* SSL status, if have SSL
connection */
X509 *peer; /* X509 cert of server */
char peer_dn[256 + 1]; /* peer distinguished name */
---------------------------(end of broadcast)---------------------------
TIP 6: Have you searched our list archives?
http://archives.postgresql.org
