--- a/src/backend/libpq/be-secure-openssl.c +++ b/src/backend/libpq/be-secure-openssl.c @@ -973,61 +973,11 @@ static DH * load_dh_file(char *filename, bool isServerStart) { - FILE *fp; - DH *dh = NULL; - int codes; - - /* attempt to open file. It's not an error if it doesn't exist. */ - if ((fp = AllocateFile(filename, "r")) == NULL) - { - ereport(isServerStart ? FATAL : LOG, - (errcode_for_file_access(), - errmsg("could not open DH parameters file \"%s\": %m", - filename))); - return NULL; - } - - dh = PEM_read_DHparams(fp, NULL, NULL, NULL); - FreeFile(fp); - - if (dh == NULL) - { ereport(isServerStart ? FATAL : LOG, (errcode(ERRCODE_CONFIG_FILE_ERROR), errmsg("could not load DH parameters file: %s", SSLerrmessage(ERR_get_error())))); return NULL; - } - - /* make sure the DH parameters are usable */ - if (DH_check(dh, &codes) == 0) - { - ereport(isServerStart ? FATAL : LOG, - (errcode(ERRCODE_CONFIG_FILE_ERROR), - errmsg("invalid DH parameters: %s", - SSLerrmessage(ERR_get_error())))); - DH_free(dh); - return NULL; - } - if (codes & DH_CHECK_P_NOT_PRIME) - { - ereport(isServerStart ? FATAL : LOG, - (errcode(ERRCODE_CONFIG_FILE_ERROR), - errmsg("invalid DH parameters: p is not prime"))); - DH_free(dh); - return NULL; - } - if ((codes & DH_NOT_SUITABLE_GENERATOR) && - (codes & DH_CHECK_P_NOT_SAFE_PRIME)) - { - ereport(isServerStart ? FATAL : LOG, - (errcode(ERRCODE_CONFIG_FILE_ERROR), - errmsg("invalid DH parameters: neither suitable generator or safe prime"))); - DH_free(dh); - return NULL; - } - - return dh; } /*