Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit0ba7110

Browse files
committed
Revert changes for SSL compression in libpq
This partially reverts096bbf7 and9d2d457, undoing the libpq changes asit could cause breakages in distributions that share one single libpqversion across multiple major versions of Postgres for extensions andapplications linking to that.Note that the backend is unchanged here, and it still disables SSLcompression while simplifying the underlying catalogs that tracked ifcompression was enabled or not for a SSL connection.Per discussion with Tom Lane and Daniel Gustafsson.Discussion:https://postgr.es/m/YEbq15JKJwIX+S6m@paquier.xyz
1 parent6540cc5 commit0ba7110

File tree

8 files changed

+55
-27
lines changed

8 files changed

+55
-27
lines changed

‎contrib/postgres_fdw/expected/postgres_fdw.out

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -163,11 +163,11 @@ ALTER SERVER testserver1 OPTIONS (
163163
keepalives_interval 'value',
164164
tcp_user_timeout 'value',
165165
-- requiressl 'value',
166+
sslcompression 'value',
166167
sslmode 'value',
167168
sslcert 'value',
168169
sslkey 'value',
169170
sslrootcert 'value',
170-
sslcompression 'value',
171171
sslcrl 'value',
172172
--requirepeer 'value',
173173
krbsrvname 'value',

‎contrib/postgres_fdw/sql/postgres_fdw.sql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -177,11 +177,11 @@ ALTER SERVER testserver1 OPTIONS (
177177
keepalives_interval'value',
178178
tcp_user_timeout'value',
179179
-- requiressl 'value',
180+
sslcompression'value',
180181
sslmode'value',
181182
sslcert'value',
182183
sslkey'value',
183184
sslrootcert'value',
184-
sslcompression'value',
185185
sslcrl'value',
186186
--requirepeer 'value',
187187
krbsrvname'value',

‎doc/src/sgml/libpq.sgml

Lines changed: 33 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1640,7 +1640,26 @@ postgresql://%2Fvar%2Flib%2Fpostgresql/dbname
16401640
<term><literal>sslcompression</literal></term>
16411641
<listitem>
16421642
<para>
1643-
Ignored (formerly, this specified whether to attempt SSL compression).
1643+
If set to 1, data sent over SSL connections will be compressed. If
1644+
set to 0, compression will be disabled. The default is 0. This
1645+
parameter is ignored if a connection without SSL is made.
1646+
</para>
1647+
1648+
<para>
1649+
SSL compression is nowadays considered insecure and its use is no
1650+
longer recommended. <productname>OpenSSL</productname> 1.1.0 disables
1651+
compression by default, and many operating system distributions
1652+
disable it in prior versions as well, so setting this parameter to on
1653+
will not have any effect if the server does not accept compression.
1654+
<productname>PostgreSQL</productname> 14 disables compression
1655+
completely in the backend.
1656+
</para>
1657+
1658+
<para>
1659+
If security is not a primary concern, compression can improve
1660+
throughput if the network is the bottleneck. Disabling compression
1661+
can improve response time and throughput if CPU performance is the
1662+
limiting factor.
16441663
</para>
16451664
</listitem>
16461665
</varlistentry>
@@ -2533,7 +2552,9 @@ const char *PQsslAttribute(const PGconn *conn, const char *attribute_name);
25332552
<term><literal>compression</literal></term>
25342553
<listitem>
25352554
<para>
2536-
SSL compression is no longer supported, always returns "off".
2555+
If SSL compression is in use, returns the name of the compression
2556+
algorithm, or "on" if compression is used but the algorithm is
2557+
not known. If compression is not in use, returns "off".
25372558
</para>
25382559
</listitem>
25392560
</varlistentry>
@@ -7168,6 +7189,16 @@ myEventProc(PGEventId evtId, void *evtInfo, void *passThrough)
71687189
</para>
71697190
</listitem>
71707191

7192+
<listitem>
7193+
<para>
7194+
<indexterm>
7195+
<primary><envar>PGSSLCOMPRESSION</envar></primary>
7196+
</indexterm>
7197+
<envar>PGSSLCOMPRESSION</envar> behaves the same as the <xref
7198+
linkend="libpq-connect-sslcompression"/> connection parameter.
7199+
</para>
7200+
</listitem>
7201+
71717202
<listitem>
71727203
<para>
71737204
<indexterm>

‎src/bin/psql/command.c

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3509,18 +3509,21 @@ printSSLInfo(void)
35093509
constchar*protocol;
35103510
constchar*cipher;
35113511
constchar*bits;
3512+
constchar*compression;
35123513

35133514
if (!PQsslInUse(pset.db))
35143515
return;/* no SSL */
35153516

35163517
protocol=PQsslAttribute(pset.db,"protocol");
35173518
cipher=PQsslAttribute(pset.db,"cipher");
35183519
bits=PQsslAttribute(pset.db,"key_bits");
3520+
compression=PQsslAttribute(pset.db,"compression");
35193521

3520-
printf(_("SSL connection (protocol: %s, cipher: %s, bits: %s)\n"),
3522+
printf(_("SSL connection (protocol: %s, cipher: %s, bits: %s, compression: %s)\n"),
35213523
protocol ?protocol :_("unknown"),
35223524
cipher ?cipher :_("unknown"),
3523-
bits ?bits :_("unknown"));
3525+
bits ?bits :_("unknown"),
3526+
(compression&&strcmp(compression,"off")!=0) ?_("on") :_("off"));
35243527
}
35253528

35263529
/*

‎src/interfaces/libpq/fe-connect.c

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -275,12 +275,9 @@ static const internalPQconninfoOption PQconninfoOptions[] = {
275275
"SSL-Mode","",12,/* sizeof("verify-full") == 12 */
276276
offsetof(structpg_conn,sslmode)},
277277

278-
/*
279-
* "sslcompression" is no longer used, but keep it present for backwards
280-
* compatibility.
281-
*/
282-
{"sslcompression",NULL,NULL,NULL,
283-
"SSL-Compression","",1,-1},
278+
{"sslcompression","PGSSLCOMPRESSION","0",NULL,
279+
"SSL-Compression","",1,
280+
offsetof(structpg_conn,sslcompression)},
284281

285282
{"sslcert","PGSSLCERT",NULL,NULL,
286283
"SSL-Client-Cert","",64,
@@ -4054,6 +4051,8 @@ freePGconn(PGconn *conn)
40544051
free(conn->sslcrl);
40554052
if (conn->sslcrldir)
40564053
free(conn->sslcrldir);
4054+
if (conn->sslcompression)
4055+
free(conn->sslcompression);
40574056
if (conn->requirepeer)
40584057
free(conn->requirepeer);
40594058
if (conn->ssl_min_protocol_version)

‎src/interfaces/libpq/fe-secure-openssl.c

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1257,8 +1257,13 @@ initialize_SSL(PGconn *conn)
12571257
if (have_rootcert)
12581258
SSL_set_verify(conn->ssl,SSL_VERIFY_PEER,verify_cb);
12591259

1260-
/* disable SSL compression */
1261-
SSL_set_options(conn->ssl,SSL_OP_NO_COMPRESSION);
1260+
/*
1261+
* Set compression option if necessary.
1262+
*/
1263+
if (conn->sslcompression&&conn->sslcompression[0]=='0')
1264+
SSL_set_options(conn->ssl,SSL_OP_NO_COMPRESSION);
1265+
else
1266+
SSL_clear_options(conn->ssl,SSL_OP_NO_COMPRESSION);
12621267

12631268
return0;
12641269
}
@@ -1548,12 +1553,8 @@ PQsslAttribute(PGconn *conn, const char *attribute_name)
15481553
if (strcmp(attribute_name,"cipher")==0)
15491554
returnSSL_get_cipher(conn->ssl);
15501555

1551-
/*
1552-
* SSL compression is disabled, so even if connecting to an older server
1553-
* which still supports it, it will not be active.
1554-
*/
15551556
if (strcmp(attribute_name,"compression")==0)
1556-
return"off";
1557+
returnSSL_get_current_compression(conn->ssl) ?"on" :"off";
15571558

15581559
if (strcmp(attribute_name,"protocol")==0)
15591560
returnSSL_get_version(conn->ssl);

‎src/interfaces/libpq/libpq-int.h

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -358,6 +358,7 @@ struct pg_conn
358358
char*keepalives_count;/* maximum number of TCP keepalive
359359
* retransmits */
360360
char*sslmode;/* SSL mode (require,prefer,allow,disable) */
361+
char*sslcompression;/* SSL compression (0 or 1) */
361362
char*sslkey;/* client key filename */
362363
char*sslcert;/* client certificate filename */
363364
char*sslpassword;/* client key file password */

‎src/test/ssl/t/001_ssltests.pl

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,7 @@
1717
}
1818
else
1919
{
20-
plantests=>101;
20+
plantests=>100;
2121
}
2222

2323
#### Some configuration
@@ -157,13 +157,6 @@
157157
qr/root certificate file "invalid" does not exist/,
158158
"connect without server root cert sslmode=verify-full");
159159

160-
# Test deprecated SSL parameters, still accepted for backwards
161-
# compatibility.
162-
test_connect_ok(
163-
$common_connstr,
164-
"sslrootcert=invalid sslmode=require sslcompression=1 requiressl=1",
165-
"connect with deprecated connection parameters");
166-
167160
# Try with wrong root cert, should fail. (We're using the client CA as the
168161
# root, but the server's key is signed by the server CA.)
169162
test_connect_fails($common_connstr,

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp