Fix handling of SCRAM-SHA-256's channel binding with RSA-PSS certificates

OpenSSL 1.1.1 and newer versions have added support for RSA-PSS
certificates, which requires the use of a specific routine in OpenSSL to
determine which hash function to use when compiling it when using
channel binding in SCRAM-SHA-256.  X509_get_signature_nid(), that is the
original routine the channel binding code has relied on, is not able to
determine which hash algorithm to use for such certificates.  However,
X509_get_signature_info(), new to OpenSSL 1.1.1, is able to do it.  This
commit switches the channel binding logic to rely on
X509_get_signature_info() over X509_get_signature_nid(), which would be
the choice when building with 1.1.1 or newer.

The error could have been triggered on the client or the server, hence
libpq and the backend need to have their related code paths patched.
Note that attempting to load an RSA-PSS certificate with OpenSSL 1.1.0
or older leads to a failure due to an unsupported algorithm.

The discovery of relying on X509_get_signature_info() comes from Jacob,
the tests have been written by Heikki (with few tweaks from me), while I
have bundled the whole together while adding the bits needed for MSVC
and meson.

This issue exists since channel binding exists, so backpatch all the way
down.  Some tests are added in 15~, triggered if compiling with OpenSSL
1.1.1 or newer, where the certificate and key files can easily be
generated for RSA-PSS.

Reported-by: Gunnar "Nick" Bluth
Author: Jacob Champion, Heikki Linnakangas
Discussion: https://postgr.es/m/17760-b6c61e752ec07060@postgresql.org
Backpatch-through: 11

diff --git a/configure b/configure
index be4bd3869ff9f26473304a83269080874967a46f..99b639b2add69c487b1f17ca8e67a393aa1b20e6 100755 (executable)
--- a/configure
+++ b/configure
@@ -12316,6 +12316,18 @@ if test "x$ac_cv_func_CRYPTO_lock" = xyes; then :
 #define HAVE_CRYPTO_LOCK 1
 _ACEOF
 
+fi
+done
+
+  # Function introduced in OpenSSL 1.1.1.
+  for ac_func in X509_get_signature_info
+do :
+  ac_fn_c_check_func "$LINENO" "X509_get_signature_info" "ac_cv_func_X509_get_signature_info"
+if test "x$ac_cv_func_X509_get_signature_info" = xyes; then :
+  cat >>confdefs.h <<_ACEOF
+#define HAVE_X509_GET_SIGNATURE_INFO 1
+_ACEOF
+
 fi
 done
 

diff --git a/configure.in b/configure.in
index 1cfca8562a6a07b330dbbbfdb0730c4b31289b71..d1a638cea407685da1882a0d793b0341854df6d7 100644 (file)
--- a/configure.in
+++ b/configure.in
@@ -1287,6 +1287,8 @@ if test "$with_openssl" = yes ; then
   # thread-safety. In 1.1.0, it's no longer required, and CRYPTO_lock()
   # function was removed.
   AC_CHECK_FUNCS([CRYPTO_lock])
+  # Function introduced in OpenSSL 1.1.1.
+  AC_CHECK_FUNCS([X509_get_signature_info])
   # SSL_clear_options is a macro in OpenSSL from 0.9.8 to 1.0.2, and
   # a function from 1.1.0 onwards so we cannot use AC_CHECK_FUNCS.
   AC_CACHE_CHECK([for SSL_clear_options], ac_cv_func_ssl_clear_options,

diff --git a/src/backend/libpq/be-secure-openssl.c b/src/backend/libpq/be-secure-openssl.c
index 795c2198a316e10cb2d5c71120eac730299fd075..e307bfea823e4c347c8a63a5f52ee10b27ddb7c9 100644 (file)
--- a/src/backend/libpq/be-secure-openssl.c
+++ b/src/backend/libpq/be-secure-openssl.c
@@ -1127,7 +1127,7 @@ be_tls_get_peerdn_name(Port *port, char *ptr, size_t len)
                ptr[0] = '\0';
 }
 
-#ifdef HAVE_X509_GET_SIGNATURE_NID
+#if defined(HAVE_X509_GET_SIGNATURE_NID) || defined(HAVE_X509_GET_SIGNATURE_INFO)
 char *
 be_tls_get_certificate_hash(Port *port, size_t *len)
 {
@@ -1145,10 +1145,15 @@ be_tls_get_certificate_hash(Port *port, size_t *len)
 
        /*
         * Get the signature algorithm of the certificate to determine the hash
-        * algorithm to use for the result.
+        * algorithm to use for the result.  Prefer X509_get_signature_info(),
+        * introduced in OpenSSL 1.1.1, which can handle RSA-PSS signatures.
         */
+#if HAVE_X509_GET_SIGNATURE_INFO
+       if (!X509_get_signature_info(server_cert, &algo_nid, NULL, NULL, NULL))
+#else
        if (!OBJ_find_sigid_algs(X509_get_signature_nid(server_cert),
                                                         &algo_nid, NULL))
+#endif
                elog(ERROR, "could not determine server certificate signature algorithm");
 
        /*

diff --git a/src/include/libpq/libpq-be.h b/src/include/libpq/libpq-be.h
index 20b9342808edbd27bf44bd663e79f26a1e209cd2..4562163d2814caaf66565a633040fac90c764373 100644 (file)
--- a/src/include/libpq/libpq-be.h
+++ b/src/include/libpq/libpq-be.h
@@ -270,7 +270,7 @@ extern void be_tls_get_peerdn_name(Port *port, char *ptr, size_t len);
  * This is not supported with old versions of OpenSSL that don't have
  * the X509_get_signature_nid() function.
  */
-#if defined(USE_OPENSSL) && defined(HAVE_X509_GET_SIGNATURE_NID)
+#if defined(USE_OPENSSL) && (defined(HAVE_X509_GET_SIGNATURE_NID) || defined(HAVE_X509_GET_SIGNATURE_INFO))
 #define HAVE_BE_TLS_GET_CERTIFICATE_HASH
 extern char *be_tls_get_certificate_hash(Port *port, size_t *len);
 #endif

diff --git a/src/include/pg_config.h.in b/src/include/pg_config.h.in
index 39bf3afca1991ffa8f790d1b51f33663e2dc5a06..912132dbc5b76bca466729784eedcdf67ac99cc6 100644 (file)
--- a/src/include/pg_config.h.in
+++ b/src/include/pg_config.h.in
@@ -715,6 +715,9 @@
 /* Define to 1 if you have the <winldap.h> header file. */
 #undef HAVE_WINLDAP_H
 
+/* Define to 1 if you have the `X509_get_signature_info' function. */
+#undef HAVE_X509_GET_SIGNATURE_INFO
+
 /* Define to 1 if you have the `X509_get_signature_nid' function. */
 #undef HAVE_X509_GET_SIGNATURE_NID
 

diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c
index d81cb25a0cfec04f98ebf470050cabac1740f582..55e231e84937455aec79bd25388575e1e402b8c5 100644 (file)
--- a/src/interfaces/libpq/fe-secure-openssl.c
+++ b/src/interfaces/libpq/fe-secure-openssl.c
@@ -369,7 +369,7 @@ pgtls_write(PGconn *conn, const void *ptr, size_t len)
        return n;
 }
 
-#ifdef HAVE_X509_GET_SIGNATURE_NID
+#if defined(HAVE_X509_GET_SIGNATURE_NID) || defined(HAVE_X509_GET_SIGNATURE_INFO)
 char *
 pgtls_get_peer_certificate_hash(PGconn *conn, size_t *len)
 {
@@ -389,10 +389,15 @@ pgtls_get_peer_certificate_hash(PGconn *conn, size_t *len)
 
        /*
         * Get the signature algorithm of the certificate to determine the hash
-        * algorithm to use for the result.
+        * algorithm to use for the result.  Prefer X509_get_signature_info(),
+        * introduced in OpenSSL 1.1.1, which can handle RSA-PSS signatures.
         */
+#if HAVE_X509_GET_SIGNATURE_INFO
+       if (!X509_get_signature_info(peer_cert, &algo_nid, NULL, NULL, NULL))
+#else
        if (!OBJ_find_sigid_algs(X509_get_signature_nid(peer_cert),
                                                         &algo_nid, NULL))
+#endif
        {
                printfPQExpBuffer(&conn->errorMessage,
                                                  libpq_gettext("could not determine server certificate signature algorithm\n"));

diff --git a/src/interfaces/libpq/libpq-int.h b/src/interfaces/libpq/libpq-int.h
index 9af7b6e68ce26fcd28ae45cc6ca9f8335191c313..632bc09e5fd656bdb320605a15dc294716fae022 100644 (file)
--- a/src/interfaces/libpq/libpq-int.h
+++ b/src/interfaces/libpq/libpq-int.h
@@ -725,7 +725,7 @@ extern ssize_t pgtls_write(PGconn *conn, const void *ptr, size_t len);
  * This is not supported with old versions of OpenSSL that don't have
  * the X509_get_signature_nid() function.
  */
-#if defined(USE_OPENSSL) && defined(HAVE_X509_GET_SIGNATURE_NID)
+#if defined(USE_OPENSSL) && (defined(HAVE_X509_GET_SIGNATURE_NID) || defined(HAVE_X509_GET_SIGNATURE_INFO))
 #define HAVE_PGTLS_GET_PEER_CERTIFICATE_HASH
 extern char *pgtls_get_peer_certificate_hash(PGconn *conn, size_t *len);
 #endif

diff --git a/src/tools/msvc/Solution.pm b/src/tools/msvc/Solution.pm
index 60293c7a88f586f871531de6611a870e6ce19fa7..984d63f5d770e5f066ed282a9d96fe1fb323c1e1 100644 (file)
--- a/src/tools/msvc/Solution.pm
+++ b/src/tools/msvc/Solution.pm
@@ -257,7 +257,14 @@ sub GenerateFiles
 
                        my ($digit1, $digit2, $digit3) = $self->GetOpenSSLVersion();
 
-                       # More symbols are needed with OpenSSL 1.1.0 and above.
+                       # Symbols needed with OpenSSL 1.1.1 and above.
+                       if (   ($digit1 >= '3' && $digit2 >= '0' && $digit3 >= '0')
+                               || ($digit1 >= '1' && $digit2 >= '1' && $digit3 >= '1'))
+                       {
+                               print $o "#define HAVE_X509_GET_SIGNATURE_INFO 1\n";
+                       }
+
+                       # Symbols needed with OpenSSL 1.1.0 and above.
                        if (   ($digit1 >= '3' && $digit2 >= '0' && $digit3 >= '0')
                                || ($digit1 >= '1' && $digit2 >= '1' && $digit3 >= '0'))
                        {