pgsql: Allow full SSL certificate verification (wherein libpq checks its

From: tgl(at)postgresql(dot)org (Tom Lane)
To: pgsql-committers(at)postgresql(dot)org
Subject: pgsql: Allow full SSL certificate verification (wherein libpq checks its
Date: 2010-07-14 17:10:03
Message-ID: 20100714171003.2F7DE7541D6@cvs.postgresql.org
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-committers

Log Message:
-----------
Allow full SSL certificate verification (wherein libpq checks its host name
parameter against server cert's CN field) to succeed in the case where
both host and hostaddr are specified. As with the existing precedents
for Kerberos, GSSAPI, SSPI, it is the calling application's responsibility
that host and hostaddr match up --- we just use the host name as given.
Per bug #5559 from Christopher Head.

In passing, make the error handling and messages for the no-host-name-given
failure more consistent among these four cases, and correct a lie in the
documentation: we don't attempt to reverse-lookup host from hostaddr
if host is missing.

Back-patch to 8.4 where SSL cert verification was introduced.

Tags:
----
REL8_4_STABLE

Modified Files:
--------------
pgsql/doc/src/sgml:
libpq.sgml (r1.289.2.2 -> r1.289.2.3)
(http://anoncvs.postgresql.org/cvsweb.cgi/pgsql/doc/src/sgml/libpq.sgml?r1=1.289.2.2&r2=1.289.2.3)
pgsql/src/interfaces/libpq:
fe-auth.c (r1.142.2.1 -> r1.142.2.2)
(http://anoncvs.postgresql.org/cvsweb.cgi/pgsql/src/interfaces/libpq/fe-auth.c?r1=1.142.2.1&r2=1.142.2.2)
fe-secure.c (r1.127.2.2 -> r1.127.2.3)
(http://anoncvs.postgresql.org/cvsweb.cgi/pgsql/src/interfaces/libpq/fe-secure.c?r1=1.127.2.2&r2=1.127.2.3)
libpq-int.h (r1.143 -> r1.143.2.1)
(http://anoncvs.postgresql.org/cvsweb.cgi/pgsql/src/interfaces/libpq/libpq-int.h?r1=1.143&r2=1.143.2.1)

Browse pgsql-committers by date

  From Date Subject
Next Message Tom Lane 2010-07-14 21:21:08 pgsql: Fix several problems in pg_dump's handling of SQL/MED objects,
Previous Message Tom Lane 2010-07-14 17:09:54 pgsql: Allow full SSL certificate verification (wherein libpq checks its