=== Applying patches on top of PostgreSQL commit ID 79e872fedb4d2f73baa0a80ba572480774edc61b === /etc/rc.d/jail: WARNING: Per-jail configuration via jail_* variables is obsolete. Please consider migrating to /etc/jail.conf. Sat Feb 1 07:54:30 UTC 2025 On branch cf/5332 nothing to commit, working tree clean === applying patch ./v10-0001-pgcrypto-Add-function-to-check-FIPS-mode.patch Applied patch to 'contrib/pgcrypto/Makefile' cleanly. Applied patch to 'contrib/pgcrypto/meson.build' cleanly. Applied patch to 'contrib/pgcrypto/openssl.c' with conflicts. Performing three-way merge... Applied patch to 'contrib/pgcrypto/pgcrypto--1.3--1.4.sql' cleanly. Applied patch to 'contrib/pgcrypto/pgcrypto.c' cleanly. Applied patch to 'contrib/pgcrypto/pgcrypto.control' cleanly. Applied patch to 'contrib/pgcrypto/px.h' with conflicts. Applied patch to 'doc/src/sgml/pgcrypto.sgml' with conflicts. U contrib/pgcrypto/openssl.c U contrib/pgcrypto/px.h U doc/src/sgml/pgcrypto.sgml diff --cc contrib/pgcrypto/openssl.c index 75f40a2d03,b298404598..0000000000 --- a/contrib/pgcrypto/openssl.c +++ b/contrib/pgcrypto/openssl.c @@@ -805,12 -804,11 +805,19 @@@ boo CheckFIPSMode(void) { int fips_enabled = 0; ++<<<<<<< ours + ++======= ++>>>>>>> theirs /* * EVP_default_properties_is_fips_enabled was added in OpenSSL 3.0, before * that FIPS_mode() was used to test for FIPS being enabled. The last * upstream OpenSSL version before 3.0 which supported FIPS was 1.0.2, but ++<<<<<<< ours + * there are forks of 1.1.1 which are FIPS validated so we still need to ++======= + * there are forks of 1.1.1 which are FIPS certified so we still need to ++>>>>>>> theirs * test with FIPS_mode() even though we don't support 1.0.2. */ fips_enabled = @@@ -822,28 -820,3 +829,31 @@@ return (fips_enabled == 1); } ++<<<<<<< ours + +/* + * CheckBuiltinCryptoMode + * + * Function for erroring out in case built-in crypto is executed when the user + * has disabled it. If builtin_crypto_enabled is set to BC_OFF or BC_FIPS and + * OpenSSL is operating in FIPS mode the function will error out, else the + * query executing built-in crypto can proceed. + */ +void +CheckBuiltinCryptoMode(void) +{ + if (builtin_crypto_enabled == BC_ON) + return; + + if (builtin_crypto_enabled == BC_OFF) + ereport(ERROR, + errmsg("use of built-in crypto functions is disabled")); + + Assert(builtin_crypto_enabled == BC_FIPS); + + if (CheckFIPSMode() == true) + ereport(ERROR, + errmsg("use of non-FIPS validated crypto not allowed when OpenSSL is in FIPS mode")); +} ++======= ++>>>>>>> theirs diff --cc contrib/pgcrypto/px.h index 37013cd9f8,c2c2fc3124..0000000000 --- a/contrib/pgcrypto/px.h +++ b/contrib/pgcrypto/px.h @@@ -191,7 -183,6 +191,10 @@@ void px_set_debug_handler(void (*handl void px_memset(void *ptr, int c, size_t len); bool CheckFIPSMode(void); ++<<<<<<< ours +void CheckBuiltinCryptoMode(void); ++======= ++>>>>>>> theirs #ifdef PX_DEBUG void px_debug(const char *fmt,...) pg_attribute_printf(1, 2); diff --cc doc/src/sgml/pgcrypto.sgml index a4d035eabd,838d7532a5..0000000000 --- a/doc/src/sgml/pgcrypto.sgml +++ b/doc/src/sgml/pgcrypto.sgml @@@ -1165,44 -1165,6 +1165,47 @@@ fips_mode() returns boolea ++<<<<<<< ours + + Configuration Parameters + + + There is one configuration parameter that controls the behavior of + pgcrypto. + + + + + + pgcrypto.builtin_crypto_enabled (enum) + + pgcrypto.builtin_crypto_enabled configuration + parameter + + + + + pgcrypto.builtin_crypto_enabled determines if the + built in crypto functions gen_salt(), and + crypt() are available for use. Setting this to + off disables these functions. on + (the default) enables these functions to work normally. + fips disables these functions if + OpenSSL is detected to operate in FIPS mode. + + + + + + + In ordinary usage, this parameter is set + in postgresql.conf, although superusers can alter it + on-the-fly within their own sessions. + + + ++======= ++>>>>>>> theirs Notes