1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
|
--- a/src/backend/libpq/be-secure-openssl.c
+++ b/src/backend/libpq/be-secure-openssl.c
@@ -973,61 +973,11 @@
static DH *
load_dh_file(char *filename, bool isServerStart)
{
- FILE *fp;
- DH *dh = NULL;
- int codes;
-
- /* attempt to open file. It's not an error if it doesn't exist. */
- if ((fp = AllocateFile(filename, "r")) == NULL)
- {
- ereport(isServerStart ? FATAL : LOG,
- (errcode_for_file_access(),
- errmsg("could not open DH parameters file \"%s\": %m",
- filename)));
- return NULL;
- }
-
- dh = PEM_read_DHparams(fp, NULL, NULL, NULL);
- FreeFile(fp);
-
- if (dh == NULL)
- {
ereport(isServerStart ? FATAL : LOG,
(errcode(ERRCODE_CONFIG_FILE_ERROR),
errmsg("could not load DH parameters file: %s",
SSLerrmessage(ERR_get_error()))));
return NULL;
- }
-
- /* make sure the DH parameters are usable */
- if (DH_check(dh, &codes) == 0)
- {
- ereport(isServerStart ? FATAL : LOG,
- (errcode(ERRCODE_CONFIG_FILE_ERROR),
- errmsg("invalid DH parameters: %s",
- SSLerrmessage(ERR_get_error()))));
- DH_free(dh);
- return NULL;
- }
- if (codes & DH_CHECK_P_NOT_PRIME)
- {
- ereport(isServerStart ? FATAL : LOG,
- (errcode(ERRCODE_CONFIG_FILE_ERROR),
- errmsg("invalid DH parameters: p is not prime")));
- DH_free(dh);
- return NULL;
- }
- if ((codes & DH_NOT_SUITABLE_GENERATOR) &&
- (codes & DH_CHECK_P_NOT_SAFE_PRIME))
- {
- ereport(isServerStart ? FATAL : LOG,
- (errcode(ERRCODE_CONFIG_FILE_ERROR),
- errmsg("invalid DH parameters: neither suitable generator or safe prime")));
- DH_free(dh);
- return NULL;
- }
-
- return dh;
}
/*
|