summaryrefslogtreecommitdiff
path: root/src/interfaces/libpq
diff options
context:
space:
mode:
authorBruce Momjian <bruce@momjian.us>2002-09-04 20:31:48 +0000
committerBruce Momjian <bruce@momjian.us>2002-09-04 20:31:48 +0000
commite50f52a074bdf0d6a9dc384840e641c4c0b0bb1a (patch)
treeab73e8c8ec94a6ddc774c1f9c49b87aa6b93fd13 /src/interfaces/libpq
parentc91ceec21d357d6d857163d897ac75a79c883dee (diff)
downloadpostgresql-e50f52a074bdf0d6a9dc384840e641c4c0b0bb1a.tar.gz
pgindent run.
Diffstat (limited to 'src/interfaces/libpq')
-rw-r--r--src/interfaces/libpq/fe-auth.c6
-rw-r--r--src/interfaces/libpq/fe-connect.c72
-rw-r--r--src/interfaces/libpq/fe-exec.c89
-rw-r--r--src/interfaces/libpq/fe-misc.c92
-rw-r--r--src/interfaces/libpq/fe-secure.c483
-rw-r--r--src/interfaces/libpq/libpq-fe.h6
-rw-r--r--src/interfaces/libpq/libpq-int.h19
-rw-r--r--src/interfaces/libpq/win32.c402
8 files changed, 664 insertions, 505 deletions
diff --git a/src/interfaces/libpq/fe-auth.c b/src/interfaces/libpq/fe-auth.c
index dbca53c585..5a6e492b64 100644
--- a/src/interfaces/libpq/fe-auth.c
+++ b/src/interfaces/libpq/fe-auth.c
@@ -10,7 +10,7 @@
* exceed INITIAL_EXPBUFFER_SIZE (currently 256 bytes).
*
* IDENTIFICATION
- * $Header: /cvsroot/pgsql/src/interfaces/libpq/fe-auth.c,v 1.70 2002/09/02 06:11:43 momjian Exp $
+ * $Header: /cvsroot/pgsql/src/interfaces/libpq/fe-auth.c,v 1.71 2002/09/04 20:31:46 momjian Exp $
*
*-------------------------------------------------------------------------
*/
@@ -415,7 +415,7 @@ pg_krb5_sendauth(char *PQerrormsg, int sock,
snprintf(PQerrormsg, PQERRORMSG_LENGTH,
libpq_gettext("Kerberos 5 authentication rejected: %*s\n"),
err_ret->e_data->length,
- (const char *)err_ret->e_data->data);
+ (const char *) err_ret->e_data->data);
#else
#error "bogus configuration"
#endif
@@ -619,7 +619,7 @@ fe_sendauth(AuthRequest areq, PGconn *conn, const char *hostname,
if (password == NULL || *password == '\0')
{
(void) snprintf(PQerrormsg, PQERRORMSG_LENGTH,
- "fe_sendauth: no password supplied\n");
+ "fe_sendauth: no password supplied\n");
return STATUS_ERROR;
}
if (pg_password_sendauth(conn, password, areq) != STATUS_OK)
diff --git a/src/interfaces/libpq/fe-connect.c b/src/interfaces/libpq/fe-connect.c
index f7fd94f877..c875ce7a60 100644
--- a/src/interfaces/libpq/fe-connect.c
+++ b/src/interfaces/libpq/fe-connect.c
@@ -8,7 +8,7 @@
*
*
* IDENTIFICATION
- * $Header: /cvsroot/pgsql/src/interfaces/libpq/fe-connect.c,v 1.200 2002/08/30 05:28:50 tgl Exp $
+ * $Header: /cvsroot/pgsql/src/interfaces/libpq/fe-connect.c,v 1.201 2002/09/04 20:31:46 momjian Exp $
*
*-------------------------------------------------------------------------
*/
@@ -184,9 +184,9 @@ static char *conninfo_getval(PQconninfoOption *connOptions,
static void defaultNoticeProcessor(void *arg, const char *message);
static int parseServiceInfo(PQconninfoOption *options,
PQExpBuffer errorMessage);
-char *pwdfMatchesString(char *buf, char *token);
+char *pwdfMatchesString(char *buf, char *token);
char *PasswordFromFile(char *hostname, char *port, char *dbname,
- char *username, char *pwdfile);
+ char *username, char *pwdfile);
/*
* Connecting to a Database
@@ -396,8 +396,8 @@ PQconndefaults(void)
* PGPASSWORD The user's password.
*
* PGPASSWORDFILE
- * A file that contains host:port:database:user:password
- * for authentication
+ * A file that contains host:port:database:user:password
+ * for authentication
*
* PGDATABASE name of database to which to connect if <pgdatabase>
* argument is NULL or a null string
@@ -497,14 +497,17 @@ PQsetdbLogin(const char *pghost, const char *pgport, const char *pgoptions,
else
conn->dbName = strdup(dbName);
- /* getPasswordFromFile mallocs its result, so we don't need strdup here */
+ /*
+ * getPasswordFromFile mallocs its result, so we don't need strdup
+ * here
+ */
if (pwd)
conn->pgpass = strdup(pwd);
else if ((tmp = getenv("PGPASSWORD")) != NULL)
conn->pgpass = strdup(tmp);
else if ((tmp = PasswordFromFile(conn->pghost, conn->pgport,
- conn->dbName, conn->pguser,
- getenv("PGPASSWORDFILE"))) != NULL)
+ conn->dbName, conn->pguser,
+ getenv("PGPASSWORDFILE"))) != NULL)
conn->pgpass = tmp;
else
conn->pgpass = strdup(DefaultPassword);
@@ -978,9 +981,7 @@ retry2:
{
if (pqsecure_initialize(conn) == -1 ||
pqsecure_open_client(conn) == -1)
- {
goto connect_errReturn;
- }
/* SSL connection finished. Continue to send startup packet */
}
else if (SSLok == 'E')
@@ -1056,15 +1057,18 @@ connectDBComplete(PGconn *conn)
{
PostgresPollingStatusType flag = PGRES_POLLING_WRITING;
- struct timeval remains, *rp = NULL, finish_time, start_time;
+ struct timeval remains,
+ *rp = NULL,
+ finish_time,
+ start_time;
if (conn == NULL || conn->status == CONNECTION_BAD)
return 0;
- /*
- * Prepare to time calculations, if connect_timeout isn't zero.
- */
- if (conn->connect_timeout != NULL)
+ /*
+ * Prepare to time calculations, if connect_timeout isn't zero.
+ */
+ if (conn->connect_timeout != NULL)
{
remains.tv_sec = atoi(conn->connect_timeout);
if (!remains.tv_sec)
@@ -1137,12 +1141,12 @@ connectDBComplete(PGconn *conn)
conn->status = CONNECTION_BAD;
return 0;
}
- if ((finish_time.tv_usec -= start_time.tv_usec) < 0 )
+ if ((finish_time.tv_usec -= start_time.tv_usec) < 0)
{
remains.tv_sec++;
finish_time.tv_usec += 1000000;
}
- if ((remains.tv_usec -= finish_time.tv_usec) < 0 )
+ if ((remains.tv_usec -= finish_time.tv_usec) < 0)
{
remains.tv_sec--;
remains.tv_usec += 1000000;
@@ -1971,8 +1975,8 @@ freePGconn(PGconn *conn)
free(conn->pguser);
if (conn->pgpass)
free(conn->pgpass);
- if (conn->connect_timeout)
- free(conn->connect_timeout);
+ if (conn->connect_timeout)
+ free(conn->connect_timeout);
/* Note that conn->Pfdebug is not ours to close or free */
if (conn->notifyList)
DLFreeList(conn->notifyList);
@@ -2866,9 +2870,10 @@ defaultNoticeProcessor(void *arg, const char *message)
char *
pwdfMatchesString(char *buf, char *token)
{
- char *tbuf,
- *ttok;
- bool bslash = false;
+ char *tbuf,
+ *ttok;
+ bool bslash = false;
+
if (buf == NULL || token == NULL)
return NULL;
tbuf = buf;
@@ -2883,7 +2888,7 @@ pwdfMatchesString(char *buf, char *token)
bslash = true;
}
if (*tbuf == ':' && *ttok == 0 && !bslash)
- return tbuf+1;
+ return tbuf + 1;
bslash = false;
if (*ttok == 0)
return NULL;
@@ -2901,11 +2906,12 @@ pwdfMatchesString(char *buf, char *token)
/* get a password from the password file. */
char *
PasswordFromFile(char *hostname, char *port, char *dbname,
- char *username, char *pwdfile)
+ char *username, char *pwdfile)
{
- FILE *fp;
+ FILE *fp;
+
#define LINELEN NAMEDATALEN*5
- char buf[LINELEN];
+ char buf[LINELEN];
struct stat stat_buf;
if (pwdfile == NULL || strcmp(pwdfile, "") == 0)
@@ -2940,18 +2946,20 @@ PasswordFromFile(char *hostname, char *port, char *dbname,
if (fp == NULL)
return NULL;
- while (!feof(fp)) {
- char *t = buf,
- *ret;
+ while (!feof(fp))
+ {
+ char *t = buf,
+ *ret;
+
fgets(buf, LINELEN - 1, fp);
if (strlen(buf) == 0)
continue;
buf[strlen(buf) - 1] = 0;
if ((t = pwdfMatchesString(t, hostname)) == NULL ||
- (t = pwdfMatchesString(t, port)) == NULL ||
- (t = pwdfMatchesString(t, dbname)) == NULL ||
- (t = pwdfMatchesString(t, username)) == NULL)
+ (t = pwdfMatchesString(t, port)) == NULL ||
+ (t = pwdfMatchesString(t, dbname)) == NULL ||
+ (t = pwdfMatchesString(t, username)) == NULL)
continue;
ret = strdup(t);
fclose(fp);
diff --git a/src/interfaces/libpq/fe-exec.c b/src/interfaces/libpq/fe-exec.c
index 0d1b7ad05b..214f2929fd 100644
--- a/src/interfaces/libpq/fe-exec.c
+++ b/src/interfaces/libpq/fe-exec.c
@@ -8,7 +8,7 @@
*
*
* IDENTIFICATION
- * $Header: /cvsroot/pgsql/src/interfaces/libpq/fe-exec.c,v 1.121 2002/08/24 15:00:47 tgl Exp $
+ * $Header: /cvsroot/pgsql/src/interfaces/libpq/fe-exec.c,v 1.122 2002/09/04 20:31:47 momjian Exp $
*
*-------------------------------------------------------------------------
*/
@@ -135,7 +135,7 @@ PQescapeBytea(unsigned char *bintext, size_t binlen, size_t *bytealen)
for (i = binlen; i > 0; i--, vp++)
{
if (*vp == 0 || *vp >= 0x80)
- len += 5; /* '5' is for '\\ooo' */
+ len += 5; /* '5' is for '\\ooo' */
else if (*vp == '\'')
len += 2;
else if (*vp == '\\')
@@ -155,7 +155,7 @@ PQescapeBytea(unsigned char *bintext, size_t binlen, size_t *bytealen)
{
if (*vp == 0 || *vp >= 0x80)
{
- (void)sprintf(rp,"\\\\%03o",*vp);
+ (void) sprintf(rp, "\\\\%03o", *vp);
rp += 5;
}
else if (*vp == '\'')
@@ -181,7 +181,7 @@ PQescapeBytea(unsigned char *bintext, size_t binlen, size_t *bytealen)
}
/*
- * PQunescapeBytea - converts the null terminated string representation
+ * PQunescapeBytea - converts the null terminated string representation
* of a bytea, strtext, into binary, filling a buffer. It returns a
* pointer to the buffer which is NULL on error, and the size of the
* buffer in retbuflen. The pointer may subsequently be used as an
@@ -204,72 +204,83 @@ PQescapeBytea(unsigned char *bintext, size_t binlen, size_t *bytealen)
unsigned char *
PQunescapeBytea(unsigned char *strtext, size_t *retbuflen)
{
- size_t buflen;
- unsigned char *buffer, *sp, *bp;
- unsigned int state=0;
-
- if(strtext == NULL)return NULL;
- buflen = strlen(strtext); /* will shrink, also we discover if strtext */
- buffer = (unsigned char *) malloc(buflen); /* isn't NULL terminated */
- if(buffer == NULL)return NULL;
- for(bp = buffer, sp = strtext; *sp != '\0'; bp++, sp++)
+ size_t buflen;
+ unsigned char *buffer,
+ *sp,
+ *bp;
+ unsigned int state = 0;
+
+ if (strtext == NULL)
+ return NULL;
+ buflen = strlen(strtext); /* will shrink, also we discover if
+ * strtext */
+ buffer = (unsigned char *) malloc(buflen); /* isn't NULL terminated */
+ if (buffer == NULL)
+ return NULL;
+ for (bp = buffer, sp = strtext; *sp != '\0'; bp++, sp++)
{
- switch(state)
+ switch (state)
{
case 0:
- if(*sp == '\\')state=1;
+ if (*sp == '\\')
+ state = 1;
*bp = *sp;
break;
case 1:
- if(*sp == '\'') /* state=5 */
- { /* replace \' with 39 */
+ if (*sp == '\'') /* state=5 */
+ { /* replace \' with 39 */
bp--;
*bp = '\'';
buflen--;
- state=0;
+ state = 0;
}
- else if(*sp == '\\') /* state=6 */
- { /* replace \\ with 92 */
+ else if (*sp == '\\') /* state=6 */
+ { /* replace \\ with 92 */
bp--;
*bp = '\\';
buflen--;
- state=0;
+ state = 0;
}
else
{
- if(isdigit(*sp))state=2;
- else state=0;
+ if (isdigit(*sp))
+ state = 2;
+ else
+ state = 0;
*bp = *sp;
}
break;
case 2:
- if(isdigit(*sp))state=3;
- else state=0;
+ if (isdigit(*sp))
+ state = 3;
+ else
+ state = 0;
*bp = *sp;
break;
case 3:
- if(isdigit(*sp)) /* state=4 */
+ if (isdigit(*sp)) /* state=4 */
{
- int v;
+ int v;
+
bp -= 3;
- sscanf(sp-2, "%03o", &v);
+ sscanf(sp - 2, "%03o", &v);
*bp = v;
buflen -= 3;
- state=0;
+ state = 0;
}
else
{
*bp = *sp;
- state=0;
+ state = 0;
}
break;
}
}
- buffer = realloc(buffer,buflen);
+ buffer = realloc(buffer, buflen);
if (buffer == NULL)
return NULL;
- *retbuflen=buflen;
+ *retbuflen = buflen;
return buffer;
}
@@ -894,8 +905,8 @@ parseInput(PGconn *conn)
return;
/*
- * NOTIFY and WARNING messages can happen in any state besides COPY
- * OUT; always process them right away.
+ * NOTIFY and WARNING messages can happen in any state besides
+ * COPY OUT; always process them right away.
*
* Most other messages should only be processed while in BUSY state.
* (In particular, in READY state we hold off further parsing
@@ -1508,13 +1519,13 @@ getNotify(PGconn *conn)
return EOF;
/*
- * Store the relation name right after the PQnotify structure so it can
- * all be freed at once. We don't use NAMEDATALEN because we don't
- * want to tie this interface to a specific server name length.
+ * Store the relation name right after the PQnotify structure so it
+ * can all be freed at once. We don't use NAMEDATALEN because we
+ * don't want to tie this interface to a specific server name length.
*/
newNotify = (PGnotify *) malloc(sizeof(PGnotify) +
- strlen(conn->workBuffer.data) + 1);
- newNotify->relname = (char *)newNotify + sizeof(PGnotify);
+ strlen(conn->workBuffer.data) +1);
+ newNotify->relname = (char *) newNotify + sizeof(PGnotify);
strcpy(newNotify->relname, conn->workBuffer.data);
newNotify->be_pid = be_pid;
DLAddTail(conn->notifyList, DLNewElem(newNotify));
diff --git a/src/interfaces/libpq/fe-misc.c b/src/interfaces/libpq/fe-misc.c
index 8e40a531c2..794e757d56 100644
--- a/src/interfaces/libpq/fe-misc.c
+++ b/src/interfaces/libpq/fe-misc.c
@@ -25,7 +25,7 @@
*
*
* IDENTIFICATION
- * $Header: /cvsroot/pgsql/src/interfaces/libpq/fe-misc.c,v 1.78 2002/08/29 07:22:30 ishii Exp $
+ * $Header: /cvsroot/pgsql/src/interfaces/libpq/fe-misc.c,v 1.79 2002/09/04 20:31:47 momjian Exp $
*
*-------------------------------------------------------------------------
*/
@@ -104,18 +104,20 @@ pqPutc(char c, PGconn *conn)
static int
pqPutBytes(const char *s, size_t nbytes, PGconn *conn)
{
- /* Strategy to handle blocking and non-blocking connections: Fill
- * the output buffer and flush it repeatedly until either all data
- * has been sent or is at least queued in the buffer.
+ /*
+ * Strategy to handle blocking and non-blocking connections: Fill the
+ * output buffer and flush it repeatedly until either all data has
+ * been sent or is at least queued in the buffer.
*
- * For non-blocking connections, grow the buffer if not all data
- * fits into it and the buffer can't be sent because the socket
- * would block.
+ * For non-blocking connections, grow the buffer if not all data fits
+ * into it and the buffer can't be sent because the socket would
+ * block.
*/
while (nbytes)
{
- size_t avail, remaining;
+ size_t avail,
+ remaining;
/* fill the output buffer */
avail = Max(conn->outBufSize - conn->outCount, 0);
@@ -125,36 +127,40 @@ pqPutBytes(const char *s, size_t nbytes, PGconn *conn)
s += remaining;
nbytes -= remaining;
- /* if the data didn't fit completely into the buffer, try to
- * flush the buffer */
+ /*
+ * if the data didn't fit completely into the buffer, try to flush
+ * the buffer
+ */
if (nbytes)
{
- int send_result = pqSendSome(conn);
+ int send_result = pqSendSome(conn);
/* if there were errors, report them */
if (send_result < 0)
return EOF;
- /* if not all data could be sent, increase the output
- * buffer, put the rest of s into it and return
- * successfully. This case will only happen in a
- * non-blocking connection
+ /*
+ * if not all data could be sent, increase the output buffer,
+ * put the rest of s into it and return successfully. This
+ * case will only happen in a non-blocking connection
*/
if (send_result > 0)
{
- /* try to grow the buffer.
- * FIXME: The new size could be chosen more
- * intelligently.
+ /*
+ * try to grow the buffer. FIXME: The new size could be
+ * chosen more intelligently.
*/
- size_t buflen = conn->outCount + nbytes;
+ size_t buflen = conn->outCount + nbytes;
+
if (buflen > conn->outBufSize)
{
- char * newbuf = realloc(conn->outBuffer, buflen);
+ char *newbuf = realloc(conn->outBuffer, buflen);
+
if (!newbuf)
{
/* realloc failed. Probably out of memory */
printfPQExpBuffer(&conn->errorMessage,
- "cannot allocate memory for output buffer\n");
+ "cannot allocate memory for output buffer\n");
return EOF;
}
conn->outBuffer = newbuf;
@@ -169,9 +175,11 @@ pqPutBytes(const char *s, size_t nbytes, PGconn *conn)
}
}
- /* pqSendSome was able to send all data. Continue with the next
- * chunk of s. */
- } /* while */
+ /*
+ * pqSendSome was able to send all data. Continue with the next
+ * chunk of s.
+ */
+ } /* while */
return 0;
}
@@ -484,7 +492,7 @@ pqReadData(PGconn *conn)
/* OK, try to read some data */
retry3:
nread = pqsecure_read(conn, conn->inBuffer + conn->inEnd,
- conn->inBufSize - conn->inEnd);
+ conn->inBufSize - conn->inEnd);
if (nread < 0)
{
if (SOCK_ERRNO == EINTR)
@@ -676,7 +684,7 @@ pqSendSome(PGconn *conn)
printfPQExpBuffer(&conn->errorMessage,
libpq_gettext(
"server closed the connection unexpectedly\n"
- "\tThis probably means the server terminated abnormally\n"
+ "\tThis probably means the server terminated abnormally\n"
"\tbefore or while processing the request.\n"));
/*
@@ -754,9 +762,7 @@ int
pqFlush(PGconn *conn)
{
if (pqSendSome(conn))
- {
return EOF;
- }
return 0;
}
@@ -773,18 +779,18 @@ pqFlush(PGconn *conn)
int
pqWait(int forRead, int forWrite, PGconn *conn)
{
- return pqWaitTimed( forRead, forWrite, conn, (const struct timeval *) NULL);
+ return pqWaitTimed(forRead, forWrite, conn, (const struct timeval *) NULL);
}
int
-pqWaitTimed(int forRead, int forWrite, PGconn *conn, const struct timeval *timeout)
+pqWaitTimed(int forRead, int forWrite, PGconn *conn, const struct timeval * timeout)
{
fd_set input_mask;
fd_set output_mask;
fd_set except_mask;
- struct timeval tmp_timeout;
- struct timeval *ptmp_timeout = NULL;
+ struct timeval tmp_timeout;
+ struct timeval *ptmp_timeout = NULL;
if (conn->sock < 0)
{
@@ -814,17 +820,18 @@ retry5:
FD_SET(conn->sock, &output_mask);
FD_SET(conn->sock, &except_mask);
- if (NULL != timeout)
+ if (NULL != timeout)
+ {
+ /*
+ * select may modify timeout argument on some platforms use
+ * copy
+ */
+ tmp_timeout = *timeout;
+ ptmp_timeout = &tmp_timeout;
+ }
+ if (select(conn->sock + 1, &input_mask, &output_mask,
+ &except_mask, ptmp_timeout) < 0)
{
- /*
- * select may modify timeout argument on some platforms use copy
- */
- tmp_timeout = *timeout;
- ptmp_timeout = &tmp_timeout;
- }
- if (select(conn->sock + 1, &input_mask, &output_mask,
- &except_mask, ptmp_timeout) < 0)
- {
if (SOCK_ERRNO == EINTR)
goto retry5;
printfPQExpBuffer(&conn->errorMessage,
@@ -884,4 +891,5 @@ libpq_gettext(const char *msgid)
return dgettext("libpq", msgid);
}
+
#endif /* ENABLE_NLS */
diff --git a/src/interfaces/libpq/fe-secure.c b/src/interfaces/libpq/fe-secure.c
index 1ef5d62e1b..8a17c1aa14 100644
--- a/src/interfaces/libpq/fe-secure.c
+++ b/src/interfaces/libpq/fe-secure.c
@@ -11,8 +11,8 @@
*
*
* IDENTIFICATION
- * $Header: /cvsroot/pgsql/src/interfaces/libpq/fe-secure.c,v 1.10 2002/07/20 05:43:31 momjian Exp $
- *
+ * $Header: /cvsroot/pgsql/src/interfaces/libpq/fe-secure.c,v 1.11 2002/09/04 20:31:47 momjian Exp $
+ *
* NOTES
* The client *requires* a valid server certificate. Since
* SSH tunnels provide anonymous confidentiality, the presumption
@@ -21,27 +21,27 @@
* anonymous connections will use SSH tunnels.
*
* This code verifies the server certificate, to detect simple
- * "man-in-the-middle" and "impersonation" attacks. The
+ * "man-in-the-middle" and "impersonation" attacks. The
* server certificate, or better yet the CA certificate used
* to sign the server certificate, should be present in the
* "$HOME/.postgresql/root.crt" file. If this file isn't
- * readable, or the server certificate can't be validated,
+ * readable, or the server certificate can't be validated,
* pqsecure_open_client() will return an error code.
*
* Additionally, the server certificate's "common name" must
* resolve to the other end of the socket. This makes it
* substantially harder to pull off a "man-in-the-middle" or
* "impersonation" attack even if the server's private key
- * has been stolen. This check limits acceptable network
+ * has been stolen. This check limits acceptable network
* layers to Unix sockets (weird, but legal), TCPv4 and TCPv6.
*
* Unfortunately neither the current front- or back-end handle
* failure gracefully, resulting in the backend hiccupping.
* This points out problems in each (the frontend shouldn't even
* try to do SSL if pqsecure_initialize() fails, and the backend
- * shouldn't crash/recover if an SSH negotiation fails. The
+ * shouldn't crash/recover if an SSH negotiation fails. The
* backend definitely needs to be fixed, to prevent a "denial
- * of service" attack, but I don't know enough about how the
+ * of service" attack, but I don't know enough about how the
* backend works (especially that pre-SSL negotiation) to identify
* a fix.
*
@@ -49,7 +49,7 @@
*
* Unlike the server's static private key, the client's
* static private key ($HOME/.postgresql/postgresql.key)
- * should normally be stored encrypted. However we still
+ * should normally be stored encrypted. However we still
* support EPH since it's useful for other reasons.
*
* ...
@@ -61,9 +61,9 @@
* keeping it closed to everyone else.
*
* The user's certificate and private key are located in
- * $HOME/.postgresql/postgresql.crt
+ * $HOME/.postgresql/postgresql.crt
* and
- * $HOME/.postgresql/postgresql.key
+ * $HOME/.postgresql/postgresql.key
* respectively.
*
* ...
@@ -118,19 +118,19 @@
#ifdef USE_SSL
#include <openssl/ssl.h>
#include <openssl/e_os.h>
-#endif /* USE_SSL */
+#endif /* USE_SSL */
#ifdef USE_SSL
-static int verify_cb(int ok, X509_STORE_CTX *ctx);
-static int verify_peer(PGconn *);
-static DH *load_dh_file(int keylength);
-static DH *load_dh_buffer(const char *, size_t);
-static DH *tmp_dh_cb(SSL *s, int is_export, int keylength);
-static int client_cert_cb(SSL *, X509 **, EVP_PKEY **);
-static int initialize_SSL(PGconn *);
+static int verify_cb(int ok, X509_STORE_CTX *ctx);
+static int verify_peer(PGconn *);
+static DH *load_dh_file(int keylength);
+static DH *load_dh_buffer(const char *, size_t);
+static DH *tmp_dh_cb(SSL *s, int is_export, int keylength);
+static int client_cert_cb(SSL *, X509 **, EVP_PKEY **);
+static int initialize_SSL(PGconn *);
static void destroy_SSL(void);
-static int open_client_SSL(PGconn *);
+static int open_client_SSL(PGconn *);
static void close_SSL(PGconn *);
static const char *SSLerrmessage(void);
#endif
@@ -140,7 +140,7 @@ static SSL_CTX *SSL_context = NULL;
#endif
/* ------------------------------------------------------------ */
-/* Hardcoded values */
+/* Hardcoded values */
/* ------------------------------------------------------------ */
/*
@@ -148,7 +148,7 @@ static SSL_CTX *SSL_context = NULL;
* As discussed above, EDH protects the confidentiality of
* sessions even if the static private key is compromised,
* so we are *highly* motivated to ensure that we can use
- * EDH even if the user... or an attacker... deletes the
+ * EDH even if the user... or an attacker... deletes the
* $HOME/.postgresql/dh*.pem files.
*
* It's not critical that users have EPH keys, but it doesn't
@@ -193,16 +193,16 @@ KWbuHn491xNO25CQWMtem80uKw+pTnisBRF/454n1Jnhub144YRBoN8CAQI=\n\
-----END DH PARAMETERS-----\n";
/* ------------------------------------------------------------ */
-/* Procedures common to all secure sessions */
+/* Procedures common to all secure sessions */
/* ------------------------------------------------------------ */
/*
* Initialize global context
*/
int
-pqsecure_initialize (PGconn *conn)
+pqsecure_initialize(PGconn *conn)
{
- int r = 0;
+ int r = 0;
#ifdef USE_SSL
r = initialize_SSL(conn);
@@ -215,7 +215,7 @@ pqsecure_initialize (PGconn *conn)
* Destroy global context
*/
void
-pqsecure_destroy (void)
+pqsecure_destroy(void)
{
#ifdef USE_SSL
destroy_SSL();
@@ -225,10 +225,10 @@ pqsecure_destroy (void)
/*
* Attempt to negotiate secure session.
*/
-int
-pqsecure_open_client (PGconn *conn)
+int
+pqsecure_open_client(PGconn *conn)
{
- int r = 0;
+ int r = 0;
#ifdef USE_SSL
r = open_client_SSL(conn);
@@ -241,7 +241,7 @@ pqsecure_open_client (PGconn *conn)
* Close secure session.
*/
void
-pqsecure_close (PGconn *conn)
+pqsecure_close(PGconn *conn)
{
#ifdef USE_SSL
if (conn->ssl)
@@ -253,9 +253,9 @@ pqsecure_close (PGconn *conn)
* Read data from a secure connection.
*/
ssize_t
-pqsecure_read (PGconn *conn, void *ptr, size_t len)
+pqsecure_read(PGconn *conn, void *ptr, size_t len)
{
- ssize_t n;
+ ssize_t n;
#ifdef USE_SSL
if (conn->ssl)
@@ -263,30 +263,30 @@ pqsecure_read (PGconn *conn, void *ptr, size_t len)
n = SSL_read(conn->ssl, ptr, len);
switch (SSL_get_error(conn->ssl, n))
{
- case SSL_ERROR_NONE:
- break;
- case SSL_ERROR_WANT_READ:
- break;
- case SSL_ERROR_SYSCALL:
- SOCK_ERRNO = get_last_socket_error();
- printfPQExpBuffer(&conn->errorMessage,
- libpq_gettext("SSL SYSCALL error: %s\n"),
- SOCK_STRERROR(SOCK_ERRNO));
- break;
- case SSL_ERROR_SSL:
- printfPQExpBuffer(&conn->errorMessage,
- libpq_gettext("SSL error: %s\n"), SSLerrmessage());
- /* fall through */
- case SSL_ERROR_ZERO_RETURN:
- pqsecure_close(conn);
- SOCK_ERRNO = ECONNRESET;
- n = -1;
- break;
+ case SSL_ERROR_NONE:
+ break;
+ case SSL_ERROR_WANT_READ:
+ break;
+ case SSL_ERROR_SYSCALL:
+ SOCK_ERRNO = get_last_socket_error();
+ printfPQExpBuffer(&conn->errorMessage,
+ libpq_gettext("SSL SYSCALL error: %s\n"),
+ SOCK_STRERROR(SOCK_ERRNO));
+ break;
+ case SSL_ERROR_SSL:
+ printfPQExpBuffer(&conn->errorMessage,
+ libpq_gettext("SSL error: %s\n"), SSLerrmessage());
+ /* fall through */
+ case SSL_ERROR_ZERO_RETURN:
+ pqsecure_close(conn);
+ SOCK_ERRNO = ECONNRESET;
+ n = -1;
+ break;
}
}
else
#endif
- n = recv(conn->sock, ptr, len, 0);
+ n = recv(conn->sock, ptr, len, 0);
return n;
}
@@ -295,12 +295,12 @@ pqsecure_read (PGconn *conn, void *ptr, size_t len)
* Write data to a secure connection.
*/
ssize_t
-pqsecure_write (PGconn *conn, const void *ptr, size_t len)
+pqsecure_write(PGconn *conn, const void *ptr, size_t len)
{
- ssize_t n;
+ ssize_t n;
#ifndef WIN32
- pqsigfunc oldsighandler = pqsignal(SIGPIPE, SIG_IGN);
+ pqsigfunc oldsighandler = pqsignal(SIGPIPE, SIG_IGN);
#endif
#ifdef USE_SSL
@@ -309,30 +309,30 @@ pqsecure_write (PGconn *conn, const void *ptr, size_t len)
n = SSL_write(conn->ssl, ptr, len);
switch (SSL_get_error(conn->ssl, n))
{
- case SSL_ERROR_NONE:
- break;
- case SSL_ERROR_WANT_WRITE:
- break;
- case SSL_ERROR_SYSCALL:
- SOCK_ERRNO = get_last_socket_error();
- printfPQExpBuffer(&conn->errorMessage,
- libpq_gettext("SSL SYSCALL error: %s\n"),
- SOCK_STRERROR(SOCK_ERRNO));
- break;
- case SSL_ERROR_SSL:
- printfPQExpBuffer(&conn->errorMessage,
- libpq_gettext("SSL error: %s\n"), SSLerrmessage());
- /* fall through */
- case SSL_ERROR_ZERO_RETURN:
- pqsecure_close(conn);
- SOCK_ERRNO = ECONNRESET;
- n = -1;
- break;
+ case SSL_ERROR_NONE:
+ break;
+ case SSL_ERROR_WANT_WRITE:
+ break;
+ case SSL_ERROR_SYSCALL:
+ SOCK_ERRNO = get_last_socket_error();
+ printfPQExpBuffer(&conn->errorMessage,
+ libpq_gettext("SSL SYSCALL error: %s\n"),
+ SOCK_STRERROR(SOCK_ERRNO));
+ break;
+ case SSL_ERROR_SSL:
+ printfPQExpBuffer(&conn->errorMessage,
+ libpq_gettext("SSL error: %s\n"), SSLerrmessage());
+ /* fall through */
+ case SSL_ERROR_ZERO_RETURN:
+ pqsecure_close(conn);
+ SOCK_ERRNO = ECONNRESET;
+ n = -1;
+ break;
}
}
else
#endif
- n = send(conn->sock, ptr, len, 0);
+ n = send(conn->sock, ptr, len, 0);
#ifndef WIN32
pqsignal(SIGPIPE, oldsighandler);
@@ -342,7 +342,7 @@ pqsecure_write (PGconn *conn, const void *ptr, size_t len)
}
/* ------------------------------------------------------------ */
-/* SSL specific code */
+/* SSL specific code */
/* ------------------------------------------------------------ */
#ifdef USE_SSL
/*
@@ -357,7 +357,7 @@ pqsecure_write (PGconn *conn, const void *ptr, size_t len)
* for now we accept the default checks.
*/
static int
-verify_cb (int ok, X509_STORE_CTX *ctx)
+verify_cb(int ok, X509_STORE_CTX *ctx)
{
return ok;
}
@@ -367,13 +367,13 @@ verify_cb (int ok, X509_STORE_CTX *ctx)
* This function is not thread-safe due to gethostbyname2().
*/
static int
-verify_peer (PGconn *conn)
+verify_peer(PGconn *conn)
{
struct hostent *h = NULL;
struct sockaddr addr;
struct sockaddr_in *sin;
- socklen_t len;
- char **s;
+ socklen_t len;
+ char **s;
unsigned long l;
/* get the address on the other side of the socket */
@@ -381,8 +381,8 @@ verify_peer (PGconn *conn)
if (getpeername(conn->sock, &addr, &len) == -1)
{
printfPQExpBuffer(&conn->errorMessage,
- libpq_gettext("error querying socket: %s\n"),
- SOCK_STRERROR(SOCK_ERRNO));
+ libpq_gettext("error querying socket: %s\n"),
+ SOCK_STRERROR(SOCK_ERRNO));
return -1;
}
@@ -394,31 +394,33 @@ verify_peer (PGconn *conn)
if ((h = gethostbyname2(conn->peer_cn, addr.sa_family)) == NULL)
{
printfPQExpBuffer(&conn->errorMessage,
- libpq_gettext("error getting information about host (%s): %s\n"),
- conn->peer_cn, hstrerror(h_errno));
+ libpq_gettext("error getting information about host (%s): %s\n"),
+ conn->peer_cn, hstrerror(h_errno));
return -1;
}
/* does the address match? */
switch (addr.sa_family)
{
- case AF_INET:
- sin = (struct sockaddr_in *) &addr;
- for (s = h->h_addr_list; *s != NULL; s++)
- {
- if (!memcmp(&sin->sin_addr.s_addr, *s, h->h_length))
- return 0;
- }
- break;
+ case AF_INET:
+ sin = (struct sockaddr_in *) & addr;
+ for (s = h->h_addr_list; *s != NULL; s++)
+ {
+ if (!memcmp(&sin->sin_addr.s_addr, *s, h->h_length))
+ return 0;
+ }
+ break;
- default:
- printfPQExpBuffer(&conn->errorMessage,
- libpq_gettext("sorry, this protocol not yet supported\n"));
- return -1;
+ default:
+ printfPQExpBuffer(&conn->errorMessage,
+ libpq_gettext("sorry, this protocol not yet supported\n"));
+ return -1;
}
- /* the prior test should be definitive, but in practice
- * it sometimes fails. So we also check the aliases. */
+ /*
+ * the prior test should be definitive, but in practice it sometimes
+ * fails. So we also check the aliases.
+ */
for (s = h->h_aliases; *s != NULL; s++)
{
if (strcasecmp(conn->peer_cn, *s) == 0)
@@ -428,20 +430,20 @@ verify_peer (PGconn *conn)
/* generate protocol-aware error message */
switch (addr.sa_family)
{
- case AF_INET:
- sin = (struct sockaddr_in *) &addr;
- l = ntohl(sin->sin_addr.s_addr);
- printfPQExpBuffer(&conn->errorMessage,
- libpq_gettext(
- "server common name '%s' does not resolve to %ld.%ld.%ld.%ld\n"),
- conn->peer_cn, (l >> 24) % 0x100, (l >> 16) % 0x100,
- (l >> 8) % 0x100, l % 0x100);
- break;
- default:
- printfPQExpBuffer(&conn->errorMessage,
- libpq_gettext(
- "server common name '%s' does not resolve to peer address\n"),
- conn->peer_cn);
+ case AF_INET:
+ sin = (struct sockaddr_in *) & addr;
+ l = ntohl(sin->sin_addr.s_addr);
+ printfPQExpBuffer(&conn->errorMessage,
+ libpq_gettext(
+ "server common name '%s' does not resolve to %ld.%ld.%ld.%ld\n"),
+ conn->peer_cn, (l >> 24) % 0x100, (l >> 16) % 0x100,
+ (l >> 8) % 0x100, l % 0x100);
+ break;
+ default:
+ printfPQExpBuffer(&conn->errorMessage,
+ libpq_gettext(
+ "server common name '%s' does not resolve to peer address\n"),
+ conn->peer_cn);
}
return -1;
@@ -451,24 +453,24 @@ verify_peer (PGconn *conn)
* Load precomputed DH parameters.
*
* To prevent "downgrade" attacks, we perform a number of checks
- * to verify that the DBA-generated DH parameters file contains
+ * to verify that the DBA-generated DH parameters file contains
* what we expect it to contain.
*/
-static DH *
-load_dh_file (int keylength)
+static DH *
+load_dh_file(int keylength)
{
struct passwd *pwd;
- FILE *fp;
- char fnbuf[2048];
- DH *dh = NULL;
- int codes;
+ FILE *fp;
+ char fnbuf[2048];
+ DH *dh = NULL;
+ int codes;
if ((pwd = getpwuid(getuid())) == NULL)
return NULL;
/* attempt to open file. It's not an error if it doesn't exist. */
snprintf(fnbuf, sizeof fnbuf, "%s/.postgresql/dh%d.pem",
- pwd->pw_dir, keylength);
+ pwd->pw_dir, keylength);
if ((fp = fopen(fnbuf, "r")) == NULL)
return NULL;
@@ -478,27 +480,19 @@ load_dh_file (int keylength)
fclose(fp);
/* is the prime the correct size? */
- if (dh != NULL && 8*DH_size(dh) < keylength)
- {
+ if (dh != NULL && 8 * DH_size(dh) < keylength)
dh = NULL;
- }
/* make sure the DH parameters are usable */
if (dh != NULL)
{
if (DH_check(dh, &codes))
- {
return NULL;
- }
if (codes & DH_CHECK_P_NOT_PRIME)
- {
return NULL;
- }
- if ((codes & DH_NOT_SUITABLE_GENERATOR) &&
+ if ((codes & DH_NOT_SUITABLE_GENERATOR) &&
(codes & DH_CHECK_P_NOT_SAFE_PRIME))
- {
return NULL;
- }
}
return dh;
@@ -510,11 +504,11 @@ load_dh_file (int keylength)
* To prevent problems if the DH parameters files don't even
* exist, we can load DH parameters hardcoded into this file.
*/
-static DH *
-load_dh_buffer (const char *buffer, size_t len)
+static DH *
+load_dh_buffer(const char *buffer, size_t len)
{
- BIO *bio;
- DH *dh = NULL;
+ BIO *bio;
+ DH *dh = NULL;
bio = BIO_new_mem_buf((char *) buffer, len);
if (bio == NULL)
@@ -538,62 +532,60 @@ load_dh_buffer (const char *buffer, size_t len)
* the OpenSSL library can efficiently generate random keys from
* the information provided.
*/
-static DH *
-tmp_dh_cb (SSL *s, int is_export, int keylength)
+static DH *
+tmp_dh_cb(SSL *s, int is_export, int keylength)
{
- DH *r = NULL;
- static DH *dh = NULL;
- static DH *dh512 = NULL;
- static DH *dh1024 = NULL;
- static DH *dh2048 = NULL;
- static DH *dh4096 = NULL;
+ DH *r = NULL;
+ static DH *dh = NULL;
+ static DH *dh512 = NULL;
+ static DH *dh1024 = NULL;
+ static DH *dh2048 = NULL;
+ static DH *dh4096 = NULL;
switch (keylength)
{
- case 512:
- if (dh512 == NULL)
- dh512 = load_dh_file(keylength);
- if (dh512 == NULL)
- dh512 = load_dh_buffer(file_dh512, sizeof file_dh512);
- r = dh512;
- break;
-
- case 1024:
- if (dh1024 == NULL)
- dh1024 = load_dh_file(keylength);
- if (dh1024 == NULL)
- dh1024 = load_dh_buffer(file_dh1024, sizeof file_dh1024);
- r = dh1024;
- break;
-
- case 2048:
- if (dh2048 == NULL)
- dh2048 = load_dh_file(keylength);
- if (dh2048 == NULL)
- dh2048 = load_dh_buffer(file_dh2048, sizeof file_dh2048);
- r = dh2048;
- break;
-
- case 4096:
- if (dh4096 == NULL)
- dh4096 = load_dh_file(keylength);
- if (dh4096 == NULL)
- dh4096 = load_dh_buffer(file_dh4096, sizeof file_dh4096);
- r = dh4096;
- break;
-
- default:
- if (dh == NULL)
- dh = load_dh_file(keylength);
- r = dh;
+ case 512:
+ if (dh512 == NULL)
+ dh512 = load_dh_file(keylength);
+ if (dh512 == NULL)
+ dh512 = load_dh_buffer(file_dh512, sizeof file_dh512);
+ r = dh512;
+ break;
+
+ case 1024:
+ if (dh1024 == NULL)
+ dh1024 = load_dh_file(keylength);
+ if (dh1024 == NULL)
+ dh1024 = load_dh_buffer(file_dh1024, sizeof file_dh1024);
+ r = dh1024;
+ break;
+
+ case 2048:
+ if (dh2048 == NULL)
+ dh2048 = load_dh_file(keylength);
+ if (dh2048 == NULL)
+ dh2048 = load_dh_buffer(file_dh2048, sizeof file_dh2048);
+ r = dh2048;
+ break;
+
+ case 4096:
+ if (dh4096 == NULL)
+ dh4096 = load_dh_file(keylength);
+ if (dh4096 == NULL)
+ dh4096 = load_dh_buffer(file_dh4096, sizeof file_dh4096);
+ r = dh4096;
+ break;
+
+ default:
+ if (dh == NULL)
+ dh = load_dh_file(keylength);
+ r = dh;
}
/* this may take a long time, but it may be necessary... */
- if (r == NULL || 8*DH_size(r) < keylength)
- {
+ if (r == NULL || 8 * DH_size(r) < keylength)
r = DH_generate_parameters(keylength, DH_GENERATOR_2, NULL, NULL);
- }
-
+
return r;
}
@@ -605,39 +597,40 @@ tmp_dh_cb (SSL *s, int is_export, int keylength)
* Returns 1 on success, 0 on no data, -1 on error.
*/
static int
-client_cert_cb (SSL *ssl, X509 **x509, EVP_PKEY **pkey)
+client_cert_cb(SSL *ssl, X509 **x509, EVP_PKEY **pkey)
{
struct passwd *pwd;
- struct stat buf, buf2;
- char fnbuf[2048];
- FILE *fp;
- PGconn *conn = (PGconn *) SSL_get_app_data(ssl);
- int (*cb)() = NULL; /* how to read user password */
+ struct stat buf,
+ buf2;
+ char fnbuf[2048];
+ FILE *fp;
+ PGconn *conn = (PGconn *) SSL_get_app_data(ssl);
+ int (*cb) () = NULL; /* how to read user password */
if ((pwd = getpwuid(getuid())) == NULL)
{
- printfPQExpBuffer(&conn->errorMessage,
- libpq_gettext("unable to get user information\n"));
+ printfPQExpBuffer(&conn->errorMessage,
+ libpq_gettext("unable to get user information\n"));
return -1;
}
/* read the user certificate */
snprintf(fnbuf, sizeof fnbuf, "%s/.postgresql/postgresql.crt",
- pwd->pw_dir);
+ pwd->pw_dir);
if (stat(fnbuf, &buf) == -1)
return 0;
if ((fp = fopen(fnbuf, "r")) == NULL)
{
- printfPQExpBuffer(&conn->errorMessage,
- libpq_gettext("unable to open certificate (%s): %s\n"),
- fnbuf, strerror(errno));
+ printfPQExpBuffer(&conn->errorMessage,
+ libpq_gettext("unable to open certificate (%s): %s\n"),
+ fnbuf, strerror(errno));
return -1;
}
if (PEM_read_X509(fp, x509, NULL, NULL) == NULL)
{
- printfPQExpBuffer(&conn->errorMessage,
- libpq_gettext("unable to read certificate (%s): %s\n"),
- fnbuf, SSLerrmessage());
+ printfPQExpBuffer(&conn->errorMessage,
+ libpq_gettext("unable to read certificate (%s): %s\n"),
+ fnbuf, SSLerrmessage());
fclose(fp);
return -1;
}
@@ -645,44 +638,44 @@ client_cert_cb (SSL *ssl, X509 **x509, EVP_PKEY **pkey)
/* read the user key */
snprintf(fnbuf, sizeof fnbuf, "%s/.postgresql/postgresql.key",
- pwd->pw_dir);
+ pwd->pw_dir);
if (stat(fnbuf, &buf) == -1)
{
- printfPQExpBuffer(&conn->errorMessage,
- libpq_gettext("certificate present, but not private key (%s)\n"),
- fnbuf);
+ printfPQExpBuffer(&conn->errorMessage,
+ libpq_gettext("certificate present, but not private key (%s)\n"),
+ fnbuf);
X509_free(*x509);
return 0;
}
if (!S_ISREG(buf.st_mode) || (buf.st_mode & 0077) ||
buf.st_uid != getuid())
{
- printfPQExpBuffer(&conn->errorMessage,
- libpq_gettext("private key has bad permissions (%s)\n"), fnbuf);
+ printfPQExpBuffer(&conn->errorMessage,
+ libpq_gettext("private key has bad permissions (%s)\n"), fnbuf);
X509_free(*x509);
return -1;
}
if ((fp = fopen(fnbuf, "r")) == NULL)
{
- printfPQExpBuffer(&conn->errorMessage,
- libpq_gettext("unable to open private key file (%s): %s\n"),
- fnbuf, strerror(errno));
+ printfPQExpBuffer(&conn->errorMessage,
+ libpq_gettext("unable to open private key file (%s): %s\n"),
+ fnbuf, strerror(errno));
X509_free(*x509);
return -1;
}
if (fstat(fileno(fp), &buf2) == -1 ||
buf.st_dev != buf2.st_dev || buf.st_ino != buf2.st_ino)
{
- printfPQExpBuffer(&conn->errorMessage,
+ printfPQExpBuffer(&conn->errorMessage,
libpq_gettext("private key changed under us (%s)\n"), fnbuf);
X509_free(*x509);
return -1;
}
if (PEM_read_PrivateKey(fp, pkey, cb, NULL) == NULL)
{
- printfPQExpBuffer(&conn->errorMessage,
- libpq_gettext("unable to read private key (%s): %s\n"),
- fnbuf, SSLerrmessage());
+ printfPQExpBuffer(&conn->errorMessage,
+ libpq_gettext("unable to read private key (%s): %s\n"),
+ fnbuf, SSLerrmessage());
X509_free(*x509);
fclose(fp);
return -1;
@@ -692,9 +685,9 @@ client_cert_cb (SSL *ssl, X509 **x509, EVP_PKEY **pkey)
/* verify that the cert and key go together */
if (!X509_check_private_key(*x509, *pkey))
{
- printfPQExpBuffer(&conn->errorMessage,
+ printfPQExpBuffer(&conn->errorMessage,
libpq_gettext("certificate/private key mismatch (%s): %s\n"),
- fnbuf, SSLerrmessage());
+ fnbuf, SSLerrmessage());
X509_free(*x509);
EVP_PKEY_free(*pkey);
return -1;
@@ -707,11 +700,11 @@ client_cert_cb (SSL *ssl, X509 **x509, EVP_PKEY **pkey)
* Initialize global SSL context.
*/
static int
-initialize_SSL (PGconn *conn)
+initialize_SSL(PGconn *conn)
{
struct stat buf;
struct passwd *pwd;
- char fnbuf[2048];
+ char fnbuf[2048];
if (!SSL_context)
{
@@ -721,7 +714,7 @@ initialize_SSL (PGconn *conn)
if (!SSL_context)
{
printfPQExpBuffer(&conn->errorMessage,
- libpq_gettext("could not create SSL context: %s\n"),
+ libpq_gettext("could not create SSL context: %s\n"),
SSLerrmessage());
return -1;
}
@@ -730,25 +723,25 @@ initialize_SSL (PGconn *conn)
if ((pwd = getpwuid(getuid())) != NULL)
{
snprintf(fnbuf, sizeof fnbuf, "%s/.postgresql/root.crt",
- pwd->pw_dir);
+ pwd->pw_dir);
if (stat(fnbuf, &buf) == -1)
{
printfPQExpBuffer(&conn->errorMessage,
- libpq_gettext("could not read root cert list(%s): %s"),
- fnbuf, strerror(errno));
+ libpq_gettext("could not read root cert list(%s): %s"),
+ fnbuf, strerror(errno));
return -1;
}
if (!SSL_CTX_load_verify_locations(SSL_context, fnbuf, 0))
{
printfPQExpBuffer(&conn->errorMessage,
- libpq_gettext("could not read root cert list (%s): %s"),
- fnbuf, SSLerrmessage());
+ libpq_gettext("could not read root cert list (%s): %s"),
+ fnbuf, SSLerrmessage());
return -1;
}
}
- SSL_CTX_set_verify(SSL_context,
- SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, verify_cb);
+ SSL_CTX_set_verify(SSL_context,
+ SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT, verify_cb);
SSL_CTX_set_verify_depth(SSL_context, 1);
/* set up empheral DH keys */
@@ -765,7 +758,7 @@ initialize_SSL (PGconn *conn)
* Destroy global SSL context.
*/
static void
-destroy_SSL (void)
+destroy_SSL(void)
{
if (SSL_context)
{
@@ -778,9 +771,9 @@ destroy_SSL (void)
* Attempt to negotiate SSL connection.
*/
static int
-open_client_SSL (PGconn *conn)
+open_client_SSL(PGconn *conn)
{
- int r;
+ int r;
if (!(conn->ssl = SSL_new(SSL_context)) ||
!SSL_set_app_data(conn->ssl, conn) ||
@@ -788,21 +781,24 @@ open_client_SSL (PGconn *conn)
SSL_connect(conn->ssl) <= 0)
{
printfPQExpBuffer(&conn->errorMessage,
- libpq_gettext("could not establish SSL connection: %s\n"),
+ libpq_gettext("could not establish SSL connection: %s\n"),
SSLerrmessage());
close_SSL(conn);
return -1;
}
/* check the certificate chain of the server */
- /* this eliminates simple man-in-the-middle attacks and
- * simple impersonations */
+
+ /*
+ * this eliminates simple man-in-the-middle attacks and simple
+ * impersonations
+ */
r = SSL_get_verify_result(conn->ssl);
if (r != X509_V_OK)
{
printfPQExpBuffer(&conn->errorMessage,
- libpq_gettext("certificate could not be validated: %s\n"),
- X509_verify_cert_error_string(r));
+ libpq_gettext("certificate could not be validated: %s\n"),
+ X509_verify_cert_error_string(r));
close_SSL(conn);
return -1;
}
@@ -812,24 +808,27 @@ open_client_SSL (PGconn *conn)
if (conn->peer == NULL)
{
printfPQExpBuffer(&conn->errorMessage,
- libpq_gettext("certificate could not be obtained: %s\n"),
- SSLerrmessage());
+ libpq_gettext("certificate could not be obtained: %s\n"),
+ SSLerrmessage());
close_SSL(conn);
return -1;
}
X509_NAME_oneline(X509_get_subject_name(conn->peer),
- conn->peer_dn, sizeof(conn->peer_dn));
- conn->peer_dn[sizeof(conn->peer_dn)-1] = '\0';
+ conn->peer_dn, sizeof(conn->peer_dn));
+ conn->peer_dn[sizeof(conn->peer_dn) - 1] = '\0';
X509_NAME_get_text_by_NID(X509_get_subject_name(conn->peer),
- NID_commonName, conn->peer_cn, SM_USER);
+ NID_commonName, conn->peer_cn, SM_USER);
conn->peer_cn[SM_USER] = '\0';
/* verify that the common name resolves to peer */
- /* this is necessary to eliminate man-in-the-middle attacks
- * and impersonations where the attacker somehow learned
- * the server's private key */
+
+ /*
+ * this is necessary to eliminate man-in-the-middle attacks and
+ * impersonations where the attacker somehow learned the server's
+ * private key
+ */
if (verify_peer(conn) == -1)
{
close_SSL(conn);
@@ -843,7 +842,7 @@ open_client_SSL (PGconn *conn)
* Close SSL connection.
*/
static void
-close_SSL (PGconn *conn)
+close_SSL(PGconn *conn)
{
if (conn->ssl)
{
@@ -863,9 +862,9 @@ close_SSL (PGconn *conn)
static const char *
SSLerrmessage(void)
{
- unsigned long errcode;
- const char *errreason;
- static char errbuf[32];
+ unsigned long errcode;
+ const char *errreason;
+ static char errbuf[32];
errcode = ERR_get_error();
if (errcode == 0)
@@ -888,4 +887,4 @@ PQgetssl(PGconn *conn)
return conn->ssl;
}
-#endif /* USE_SSL */
+#endif /* USE_SSL */
diff --git a/src/interfaces/libpq/libpq-fe.h b/src/interfaces/libpq/libpq-fe.h
index 47606fc211..49045d37b9 100644
--- a/src/interfaces/libpq/libpq-fe.h
+++ b/src/interfaces/libpq/libpq-fe.h
@@ -7,7 +7,7 @@
* Portions Copyright (c) 1996-2002, PostgreSQL Global Development Group
* Portions Copyright (c) 1994, Regents of the University of California
*
- * $Id: libpq-fe.h,v 1.85 2002/06/20 20:29:54 momjian Exp $
+ * $Id: libpq-fe.h,v 1.86 2002/09/04 20:31:47 momjian Exp $
*
*-------------------------------------------------------------------------
*/
@@ -105,7 +105,7 @@ typedef struct pg_result PGresult;
*/
typedef struct pgNotify
{
- char *relname; /* name of relation containing data */
+ char *relname; /* name of relation containing data */
int be_pid; /* process id of backend */
} PGnotify;
@@ -252,7 +252,7 @@ extern size_t PQescapeString(char *to, const char *from, size_t length);
extern unsigned char *PQescapeBytea(unsigned char *bintext, size_t binlen,
size_t *bytealen);
extern unsigned char *PQunescapeBytea(unsigned char *strtext,
- size_t *retbuflen);
+ size_t *retbuflen);
/* Simple synchronous query */
diff --git a/src/interfaces/libpq/libpq-int.h b/src/interfaces/libpq/libpq-int.h
index 83022f70bf..daf2f9ae0b 100644
--- a/src/interfaces/libpq/libpq-int.h
+++ b/src/interfaces/libpq/libpq-int.h
@@ -12,7 +12,7 @@
* Portions Copyright (c) 1996-2002, PostgreSQL Global Development Group
* Portions Copyright (c) 1994, Regents of the University of California
*
- * $Id: libpq-int.h,v 1.56 2002/09/03 21:45:44 petere Exp $
+ * $Id: libpq-int.h,v 1.57 2002/09/04 20:31:47 momjian Exp $
*
*-------------------------------------------------------------------------
*/
@@ -25,8 +25,9 @@
#include <sys/types.h>
#if defined(WIN32) && (!defined(ssize_t))
- typedef int ssize_t; /* ssize_t doesn't exist in VC (atleast not VC6) */
-#endif
+typedef int ssize_t; /* ssize_t doesn't exist in VC (atleast
+ * not VC6) */
+#endif
/* We assume libpq-fe.h has already been included. */
#include "postgres_fe.h"
@@ -278,8 +279,8 @@ struct pg_conn
bool require_ssl; /* Require SSL to make connection */
SSL *ssl; /* SSL status, if have SSL connection */
X509 *peer; /* X509 cert of server */
- char peer_dn[256+1]; /* peer distinguished name */
- char peer_cn[SM_USER+1]; /* peer common name */
+ char peer_dn[256 + 1]; /* peer distinguished name */
+ char peer_cn[SM_USER + 1]; /* peer common name */
#endif
/* Buffer for current error message */
@@ -290,7 +291,7 @@ struct pg_conn
int client_encoding; /* encoding id */
- char *connect_timeout;
+ char *connect_timeout;
};
/* String descriptions of the ExecStatusTypes.
@@ -337,15 +338,15 @@ extern int pqReadData(PGconn *conn);
extern int pqFlush(PGconn *conn);
extern int pqSendSome(PGconn *conn);
extern int pqWait(int forRead, int forWrite, PGconn *conn);
-extern int pqWaitTimed(int forRead, int forWrite, PGconn *conn, const struct timeval* timeout);
+extern int pqWaitTimed(int forRead, int forWrite, PGconn *conn, const struct timeval * timeout);
extern int pqReadReady(PGconn *conn);
extern int pqWriteReady(PGconn *conn);
/* === in fe-secure.c === */
-extern int pqsecure_initialize(PGconn *);
+extern int pqsecure_initialize(PGconn *);
extern void pqsecure_destroy(void);
-extern int pqsecure_open_client(PGconn *);
+extern int pqsecure_open_client(PGconn *);
extern void pqsecure_close(PGconn *);
extern ssize_t pqsecure_read(PGconn *, void *ptr, size_t len);
extern ssize_t pqsecure_write(PGconn *, const void *ptr, size_t len);
diff --git a/src/interfaces/libpq/win32.c b/src/interfaces/libpq/win32.c
index 4b577e3bfc..17fe9ca93e 100644
--- a/src/interfaces/libpq/win32.c
+++ b/src/interfaces/libpq/win32.c
@@ -9,7 +9,7 @@
* descriptions. But will/may contain other win32 helper functions
* for libpq.
*
- * The error constants are taken from the Frambak Bakfram LGSOCKET
+ * The error constants are taken from the Frambak Bakfram LGSOCKET
* library guys who in turn took them from the Winsock FAQ.
*
* Portions Copyright (c) 1996-2002, PostgreSQL Global Development Group
@@ -30,100 +30,232 @@
#include <stdio.h>
#include "win32.h"
-static struct WSErrorEntry {
- DWORD error;
- const char* description;
-} WSErrors [] = {
- {0, "No error"},
- {WSAEINTR, "Interrupted system call"},
- {WSAEBADF, "Bad file number"},
- {WSAEACCES, "Permission denied"},
- {WSAEFAULT, "Bad address"},
- {WSAEINVAL, "Invalid argument"},
- {WSAEMFILE, "Too many open sockets"},
- {WSAEWOULDBLOCK, "Operation would block"},
- {WSAEINPROGRESS, "Operation now in progress"},
- {WSAEALREADY, "Operation already in progress"},
- {WSAENOTSOCK, "Socket operation on non-socket"},
- {WSAEDESTADDRREQ, "Destination address required"},
- {WSAEMSGSIZE, "Message too long"},
- {WSAEPROTOTYPE, "Protocol wrong type for socket"},
- {WSAENOPROTOOPT, "Bad protocol option"},
- {WSAEPROTONOSUPPORT, "Protocol not supported"},
- {WSAESOCKTNOSUPPORT, "Socket type not supported"},
- {WSAEOPNOTSUPP, "Operation not supported on socket"},
- {WSAEPFNOSUPPORT, "Protocol family not supported"},
- {WSAEAFNOSUPPORT, "Address family not supported"},
- {WSAEADDRINUSE, "Address already in use"},
- {WSAEADDRNOTAVAIL, "Can't assign requested address"},
- {WSAENETDOWN, "Network is down"},
- {WSAENETUNREACH, "Network is unreachable"},
- {WSAENETRESET, "Net connection reset"},
- {WSAECONNABORTED, "Software caused connection abort"},
- {WSAECONNRESET, "Connection reset by peer"},
- {WSAENOBUFS, "No buffer space available"},
- {WSAEISCONN, "Socket is already connected"},
- {WSAENOTCONN, "Socket is not connected"},
- {WSAESHUTDOWN, "Can't send after socket shutdown"},
- {WSAETOOMANYREFS, "Too many references, can't splice"},
- {WSAETIMEDOUT, "Connection timed out"},
- {WSAECONNREFUSED, "Connection refused"},
- {WSAELOOP, "Too many levels of symbolic links"},
- {WSAENAMETOOLONG, "File name too long"},
- {WSAEHOSTDOWN, "Host is down"},
- {WSAEHOSTUNREACH, "No route to host"},
- {WSAENOTEMPTY, "Directory not empty"},
- {WSAEPROCLIM, "Too many processes"},
- {WSAEUSERS, "Too many users"},
- {WSAEDQUOT, "Disc quota exceeded"},
- {WSAESTALE, "Stale NFS file handle"},
- {WSAEREMOTE, "Too many levels of remote in path"},
- {WSASYSNOTREADY, "Network system is unavailable"},
- {WSAVERNOTSUPPORTED, "Winsock version out of range"},
- {WSANOTINITIALISED, "WSAStartup not yet called"},
- {WSAEDISCON, "Graceful shutdown in progress"},
- {WSAHOST_NOT_FOUND, "Host not found"},
- {WSATRY_AGAIN, "NA Host not found / SERVFAIL"},
- {WSANO_RECOVERY, "Non recoverable FORMERR||REFUSED||NOTIMP"},
- {WSANO_DATA, "No host data of that type was found"},
- {0,0} /* End of table */
+static struct WSErrorEntry
+{
+ DWORD error;
+ const char *description;
+} WSErrors[] =
+
+{
+ {
+ 0, "No error"
+ },
+ {
+ WSAEINTR, "Interrupted system call"
+ },
+ {
+ WSAEBADF, "Bad file number"
+ },
+ {
+ WSAEACCES, "Permission denied"
+ },
+ {
+ WSAEFAULT, "Bad address"
+ },
+ {
+ WSAEINVAL, "Invalid argument"
+ },
+ {
+ WSAEMFILE, "Too many open sockets"
+ },
+ {
+ WSAEWOULDBLOCK, "Operation would block"
+ },
+ {
+ WSAEINPROGRESS, "Operation now in progress"
+ },
+ {
+ WSAEALREADY, "Operation already in progress"
+ },
+ {
+ WSAENOTSOCK, "Socket operation on non-socket"
+ },
+ {
+ WSAEDESTADDRREQ, "Destination address required"
+ },
+ {
+ WSAEMSGSIZE, "Message too long"
+ },
+ {
+ WSAEPROTOTYPE, "Protocol wrong type for socket"
+ },
+ {
+ WSAENOPROTOOPT, "Bad protocol option"
+ },
+ {
+ WSAEPROTONOSUPPORT, "Protocol not supported"
+ },
+ {
+ WSAESOCKTNOSUPPORT, "Socket type not supported"
+ },
+ {
+ WSAEOPNOTSUPP, "Operation not supported on socket"
+ },
+ {
+ WSAEPFNOSUPPORT, "Protocol family not supported"
+ },
+ {
+ WSAEAFNOSUPPORT, "Address family not supported"
+ },
+ {
+ WSAEADDRINUSE, "Address already in use"
+ },
+ {
+ WSAEADDRNOTAVAIL, "Can't assign requested address"
+ },
+ {
+ WSAENETDOWN, "Network is down"
+ },
+ {
+ WSAENETUNREACH, "Network is unreachable"
+ },
+ {
+ WSAENETRESET, "Net connection reset"
+ },
+ {
+ WSAECONNABORTED, "Software caused connection abort"
+ },
+ {
+ WSAECONNRESET, "Connection reset by peer"
+ },
+ {
+ WSAENOBUFS, "No buffer space available"
+ },
+ {
+ WSAEISCONN, "Socket is already connected"
+ },
+ {
+ WSAENOTCONN, "Socket is not connected"
+ },
+ {
+ WSAESHUTDOWN, "Can't send after socket shutdown"
+ },
+ {
+ WSAETOOMANYREFS, "Too many references, can't splice"
+ },
+ {
+ WSAETIMEDOUT, "Connection timed out"
+ },
+ {
+ WSAECONNREFUSED, "Connection refused"
+ },
+ {
+ WSAELOOP, "Too many levels of symbolic links"
+ },
+ {
+ WSAENAMETOOLONG, "File name too long"
+ },
+ {
+ WSAEHOSTDOWN, "Host is down"
+ },
+ {
+ WSAEHOSTUNREACH, "No route to host"
+ },
+ {
+ WSAENOTEMPTY, "Directory not empty"
+ },
+ {
+ WSAEPROCLIM, "Too many processes"
+ },
+ {
+ WSAEUSERS, "Too many users"
+ },
+ {
+ WSAEDQUOT, "Disc quota exceeded"
+ },
+ {
+ WSAESTALE, "Stale NFS file handle"
+ },
+ {
+ WSAEREMOTE, "Too many levels of remote in path"
+ },
+ {
+ WSASYSNOTREADY, "Network system is unavailable"
+ },
+ {
+ WSAVERNOTSUPPORTED, "Winsock version out of range"
+ },
+ {
+ WSANOTINITIALISED, "WSAStartup not yet called"
+ },
+ {
+ WSAEDISCON, "Graceful shutdown in progress"
+ },
+ {
+ WSAHOST_NOT_FOUND, "Host not found"
+ },
+ {
+ WSATRY_AGAIN, "NA Host not found / SERVFAIL"
+ },
+ {
+ WSANO_RECOVERY, "Non recoverable FORMERR||REFUSED||NOTIMP"
+ },
+ {
+ WSANO_DATA, "No host data of that type was found"
+ },
+ {
+ 0, 0
+ } /* End of table */
};
-/*
+/*
* Returns 0 if not found, linear but who cares, at this moment
* we're already in pain :)
*/
-static int LookupWSErrorMessage(DWORD err,char*dest)
-{
- struct WSErrorEntry *e;
- for (e = WSErrors;e->description;e++)
- {
- if (e->error == err)
- {
- strcpy(dest,e->description);
- return 1;
- }
- }
- return 0;
+static int
+LookupWSErrorMessage(DWORD err, char *dest)
+{
+ struct WSErrorEntry *e;
+
+ for (e = WSErrors; e->description; e++)
+ {
+ if (e->error == err)
+ {
+ strcpy(dest, e->description);
+ return 1;
+ }
+ }
+ return 0;
}
-struct MessageDLL{
- const char *dll_name;
- void *handle;
- int loaded; /* BOOL */
-}dlls[]={
- {"netmsg.dll",0,0},
- {"winsock.dll",0,0},
- {"wsock32.dll",0,0},
- {"ws2_32.dll",0,0},
- {"wsock32n.dll",0,0},
- {"mswsock.dll",0,0},
- {"ws2help.dll",0,0},
- {"ws2thk.dll",0,0},
- {0,0,1} /* Last one, no dll, always loaded */
+struct MessageDLL
+{
+ const char *dll_name;
+ void *handle;
+ int loaded; /* BOOL */
+} dlls[] =
+
+{
+ {
+ "netmsg.dll", 0, 0
+ },
+ {
+ "winsock.dll", 0, 0
+ },
+ {
+ "wsock32.dll", 0, 0
+ },
+ {
+ "ws2_32.dll", 0, 0
+ },
+ {
+ "wsock32n.dll", 0, 0
+ },
+ {
+ "mswsock.dll", 0, 0
+ },
+ {
+ "ws2help.dll", 0, 0
+ },
+ {
+ "ws2thk.dll", 0, 0
+ },
+ {
+ 0, 0, 1
+ } /* Last one, no dll, always loaded */
};
#define DLLS_SIZE (sizeof(dlls)/sizeof(struct MessageDLL))
@@ -132,58 +264,58 @@ struct MessageDLL{
* Returns a description of the socket error by first trying
* to find it in the lookup table, and if that fails, tries
* to load any of the winsock dlls to find that message.
- * The DLL thing works from Nt4 (spX ?) up, but some special
+ * The DLL thing works from Nt4 (spX ?) up, but some special
* versions of winsock might have this aswell (seen on Win98 SE
- * special install) / Magnus Naeslund (mag@fbab.net)
+ * special install) / Magnus Naeslund (mag@fbab.net)
*
*/
-const char *winsock_strerror(int err){
- static char buf[512]; /* Not threadsafe */
- unsigned long flags;
- int offs,i;
- int success = LookupWSErrorMessage(err,buf);
-
- for (i=0;!success && i<DLLS_SIZE;i++)
- {
-
- if (!dlls[i].loaded)
- {
- dlls[i].loaded = 1; /* Only load once */
- dlls[i].handle = (void*)LoadLibraryEx(
- dlls[i].dll_name,
- 0,
- LOAD_LIBRARY_AS_DATAFILE);
- }
-
- if (dlls[i].dll_name && !dlls[i].handle)
- continue; /* Didn't load */
-
- flags = FORMAT_MESSAGE_FROM_SYSTEM
- | FORMAT_MESSAGE_IGNORE_INSERTS
- | (dlls[i].handle?FORMAT_MESSAGE_FROM_HMODULE:0);
-
- success = 0 != FormatMessage(
- flags,
- dlls[i].handle,err,
- MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
- buf,sizeof(buf)-64,
- 0
- );
- }
-
- if (!success)
- {
- sprintf(buf,"Unknown socket error (0x%08X/%lu)",err,err);
- }
- else
- {
- buf[sizeof(buf)-1]='\0';
- offs = strlen(buf);
- if (offs>sizeof(buf)-64)
- offs = sizeof(buf)-64;
- sprintf(buf+offs," (0x%08X/%lu)",err,err);
- }
- return buf;
-}
+const char *
+winsock_strerror(int err)
+{
+ static char buf[512]; /* Not threadsafe */
+ unsigned long flags;
+ int offs,
+ i;
+ int success = LookupWSErrorMessage(err, buf);
+
+ for (i = 0; !success && i < DLLS_SIZE; i++)
+ {
+ if (!dlls[i].loaded)
+ {
+ dlls[i].loaded = 1; /* Only load once */
+ dlls[i].handle = (void *) LoadLibraryEx(
+ dlls[i].dll_name,
+ 0,
+ LOAD_LIBRARY_AS_DATAFILE);
+ }
+
+ if (dlls[i].dll_name && !dlls[i].handle)
+ continue; /* Didn't load */
+
+ flags = FORMAT_MESSAGE_FROM_SYSTEM
+ | FORMAT_MESSAGE_IGNORE_INSERTS
+ | (dlls[i].handle ? FORMAT_MESSAGE_FROM_HMODULE : 0);
+
+ success = 0 != FormatMessage(
+ flags,
+ dlls[i].handle, err,
+ MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
+ buf, sizeof(buf) - 64,
+ 0
+ );
+ }
+
+ if (!success)
+ sprintf(buf, "Unknown socket error (0x%08X/%lu)", err, err);
+ else
+ {
+ buf[sizeof(buf) - 1] = '\0';
+ offs = strlen(buf);
+ if (offs > sizeof(buf) - 64)
+ offs = sizeof(buf) - 64;
+ sprintf(buf + offs, " (0x%08X/%lu)", err, err);
+ }
+ return buf;
+}