Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit90b06b5

Browse files
danielgustafssonpull[bot]
authored andcommitted
Remove support for OpenSSL older than 1.1.0
OpenSSL 1.0.2 has been EOL from the upstream OpenSSL project forsome time, and is no longer the default OpenSSL version with anyvendor which package PostgreSQL. By retiring support for OpenSSL1.0.2 we can remove a lot of no longer required complexity formanaging state within libcrypto which is now handled by OpenSSL.Reviewed-by: Jacob Champion <jacob.champion@enterprisedb.com>Reviewed-by: Peter Eisentraut <peter@eisentraut.org>Reviewed-by: Michael Paquier <michael@paquier.xyz>Discussion:https://postgr.es/m/ZG3JNursG69dz1lr@paquier.xyzDiscussion:https://postgr.es/m/CA+hUKGKh7QrYzu=8yWEUJvXtMVm_CNWH1L_TLWCbZMwbi1XP2Q@mail.gmail.com
1 parentb5c2391 commit90b06b5

File tree

18 files changed

+55
-576
lines changed

18 files changed

+55
-576
lines changed

‎configure

Lines changed: 9 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -12313,9 +12313,9 @@ if test "$with_openssl" = yes ; then
1231312313
fi
1231412314

1231512315
if test "$with_ssl" = openssl ; then
12316-
# Minimum required OpenSSL version is 1.0.2
12316+
# Minimum required OpenSSL version is 1.1.0
1231712317

12318-
$as_echo "#define OPENSSL_API_COMPAT0x10002000L" >>confdefs.h
12318+
$as_echo "#define OPENSSL_API_COMPAT0x10100000L" >>confdefs.h
1231912319

1232012320
if test "$PORTNAME" != "win32"; then
1232112321
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for CRYPTO_new_ex_data in -lcrypto" >&5
@@ -12547,33 +12547,20 @@ done
1254712547
# defines OPENSSL_VERSION_NUMBER to claim version 2.0.0, even though it
1254812548
# doesn't have these OpenSSL 1.1.0 functions. So check for individual
1254912549
# functions.
12550-
for ac_func in OPENSSL_init_ssl BIO_meth_new ASN1_STRING_get0_data HMAC_CTX_new HMAC_CTX_free
12550+
for ac_func in OPENSSL_init_ssl
1255112551
do :
12552-
as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
12553-
ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
12554-
if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
12555-
cat >>confdefs.h <<_ACEOF
12556-
#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
12557-
_ACEOF
12558-
12559-
fi
12560-
done
12561-
12562-
# OpenSSL versions before 1.1.0 required setting callback functions, for
12563-
# thread-safety. In 1.1.0, it's no longer required, and CRYPTO_lock()
12564-
# function was removed.
12565-
for ac_func in CRYPTO_lock
12566-
do :
12567-
ac_fn_c_check_func "$LINENO" "CRYPTO_lock" "ac_cv_func_CRYPTO_lock"
12568-
if test "x$ac_cv_func_CRYPTO_lock" = xyes; then :
12552+
ac_fn_c_check_func "$LINENO" "OPENSSL_init_ssl" "ac_cv_func_OPENSSL_init_ssl"
12553+
if test "x$ac_cv_func_OPENSSL_init_ssl" = xyes; then :
1256912554
cat >>confdefs.h <<_ACEOF
12570-
#defineHAVE_CRYPTO_LOCK 1
12555+
#defineHAVE_OPENSSL_INIT_SSL 1
1257112556
_ACEOF
1257212557

12558+
else
12559+
as_fn_error $? "OpenSSL version >= 1.1.0 is required for SSL support" "$LINENO" 5
1257312560
fi
1257412561
done
1257512562

12576-
# Function introduced in OpenSSL 1.1.1.
12563+
# Function introduced in OpenSSL 1.1.1, not in LibreSSL.
1257712564
for ac_func in X509_get_signature_info SSL_CTX_set_num_tickets
1257812565
do :
1257912566
as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`

‎configure.ac

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1314,8 +1314,8 @@ fi
13141314

13151315
if test "$with_ssl" = openssl ; then
13161316
dnl Order matters!
1317-
# Minimum required OpenSSL version is 1.0.2
1318-
AC_DEFINE(OPENSSL_API_COMPAT,[0x10002000L],
1317+
# Minimum required OpenSSL version is 1.1.0
1318+
AC_DEFINE(OPENSSL_API_COMPAT,[0x10100000L],
13191319
[Define to the OpenSSL API version in use. This avoids deprecation warnings from newer OpenSSL versions.])
13201320
if test "$PORTNAME" != "win32"; then
13211321
AC_CHECK_LIB(crypto,CRYPTO_new_ex_data,[],[AC_MSG_ERROR([library 'crypto' is required for OpenSSL])])
@@ -1331,12 +1331,8 @@ if test "$with_ssl" = openssl ; then
13311331
# defines OPENSSL_VERSION_NUMBER to claim version 2.0.0, even though it
13321332
# doesn't have these OpenSSL 1.1.0 functions. So check for individual
13331333
# functions.
1334-
AC_CHECK_FUNCS([OPENSSL_init_ssl BIO_meth_new ASN1_STRING_get0_data HMAC_CTX_new HMAC_CTX_free])
1335-
# OpenSSL versions before 1.1.0 required setting callback functions, for
1336-
# thread-safety. In 1.1.0, it's no longer required, and CRYPTO_lock()
1337-
# function was removed.
1338-
AC_CHECK_FUNCS([CRYPTO_lock])
1339-
# Function introduced in OpenSSL 1.1.1.
1334+
AC_CHECK_FUNCS([OPENSSL_init_ssl],[],[AC_MSG_ERROR([OpenSSL version >= 1.1.0 is required for SSL support])])
1335+
# Function introduced in OpenSSL 1.1.1, not in LibreSSL.
13401336
AC_CHECK_FUNCS([X509_get_signature_info SSL_CTX_set_num_tickets])
13411337
AC_DEFINE([USE_OPENSSL],1,[Define to 1 to build with OpenSSL support. (--with-ssl=openssl)])
13421338
elif test "$with_ssl" != no ; then

‎contrib/pgcrypto/openssl.c

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -154,8 +154,6 @@ digest_free(PX_MD *h)
154154
pfree(h);
155155
}
156156

157-
staticintpx_openssl_initialized=0;
158-
159157
/* PUBLIC functions */
160158

161159
int
@@ -166,12 +164,6 @@ px_find_digest(const char *name, PX_MD **res)
166164
PX_MD*h;
167165
OSSLDigest*digest;
168166

169-
if (!px_openssl_initialized)
170-
{
171-
px_openssl_initialized=1;
172-
OpenSSL_add_all_algorithms();
173-
}
174-
175167
md=EVP_get_digestbyname(name);
176168
if (md==NULL)
177169
returnPXE_NO_HASH;

‎doc/src/sgml/installation.sgml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -293,7 +293,7 @@
293293
encrypted client connections. <productname>OpenSSL</productname> is
294294
also required for random number generation on platforms that do not
295295
have <filename>/dev/urandom</filename> (except Windows). The minimum
296-
required version is 1.0.2.
296+
required version is 1.1.0.
297297
</para>
298298
</listitem>
299299

‎doc/src/sgml/libpq.sgml

Lines changed: 16 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -9865,16 +9865,22 @@ ldap://ldap.acme.com/cn=dbserver,cn=hosts?pgconnectinfo?base?(objectclass=*)
98659865
<title>SSL Library Initialization</title>
98669866

98679867
<para>
9868-
If your application initializes <literal>libssl</literal> and/or
9869-
<literal>libcrypto</literal> libraries and <application>libpq</application>
9870-
is built with <acronym>SSL</acronym> support, you should call
9868+
Applications which need to be compatible with older versions of
9869+
<productname>PostgreSQL</productname>, using <productname>OpenSSL</productname>
9870+
version 1.0.2 or older, need to initialize the SSL library before using it.
9871+
Applications which initialize <literal>libssl</literal> and/or
9872+
<literal>libcrypto</literal> libraries should call
98719873
<xref linkend="libpq-PQinitOpenSSL"/> to tell <application>libpq</application>
98729874
that the <literal>libssl</literal> and/or <literal>libcrypto</literal> libraries
98739875
have been initialized by your application, so that
98749876
<application>libpq</application> will not also initialize those libraries.
98759877
However, this is unnecessary when using <productname>OpenSSL</productname>
98769878
version 1.1.0 or later, as duplicate initializations are no longer problematic.
98779879
</para>
9880+
<para>
9881+
Refer to the documentation for the version of <productname>PostgreSQL</productname>
9882+
that you are targeting for details on their use.
9883+
</para>
98789884

98799885
<para>
98809886
<variablelist>
@@ -9890,21 +9896,8 @@ void PQinitOpenSSL(int do_ssl, int do_crypto);
98909896
</para>
98919897

98929898
<para>
9893-
When <parameter>do_ssl</parameter> is non-zero, <application>libpq</application>
9894-
will initialize the <productname>OpenSSL</productname> library before first
9895-
opening a database connection. When <parameter>do_crypto</parameter> is
9896-
non-zero, the <literal>libcrypto</literal> library will be initialized. By
9897-
default (if <xref linkend="libpq-PQinitOpenSSL"/> is not called), both libraries
9898-
are initialized. When SSL support is not compiled in, this function is
9899-
present but does nothing.
9900-
</para>
9901-
9902-
<para>
9903-
If your application uses and initializes either <productname>OpenSSL</productname>
9904-
or its underlying <literal>libcrypto</literal> library, you <emphasis>must</emphasis>
9905-
call this function with zeroes for the appropriate parameter(s)
9906-
before first opening a database connection. Also be sure that you
9907-
have done that initialization before opening a database connection.
9899+
This function is deprecated and only present for backwards compatibility,
9900+
it does nothing.
99089901
</para>
99099902
</listitem>
99109903
</varlistentry>
@@ -9921,11 +9914,14 @@ void PQinitSSL(int do_ssl);
99219914
<para>
99229915
This function is equivalent to
99239916
<literal>PQinitOpenSSL(do_ssl, do_ssl)</literal>.
9924-
Itissufficient for applications that initialize both or neither
9925-
of <productname>OpenSSL</productname> and <literal>libcrypto</literal>.
9917+
This functionisdeprecated and only present for backwards compatibility,
9918+
it does nothing.
99269919
</para>
99279920

99289921
<para>
9922+
<xref linkend="libpq-PQinitSSL"/> and <xref linkend="libpq-PQinitOpenSSL"/>
9923+
are maintained for backwards compatibility, but are no longer required
9924+
since <productname>PostgreSQL</productname> 18.
99299925
<xref linkend="libpq-PQinitSSL"/> has been present since
99309926
<productname>PostgreSQL</productname> 8.0, while <xref linkend="libpq-PQinitOpenSSL"/>
99319927
was added in <productname>PostgreSQL</productname> 8.4, so <xref linkend="libpq-PQinitSSL"/>

‎meson.build

Lines changed: 7 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1359,26 +1359,17 @@ if sslopt in ['auto', 'openssl']
13591359
['CRYPTO_new_ex_data', {'required':true}],
13601360
['SSL_new', {'required':true}],
13611361

1362-
# Function introduced in OpenSSL 1.0.2, not in LibreSSL.
1363-
['SSL_CTX_set_cert_cb'],
1364-
13651362
# Functions introduced in OpenSSL 1.1.0. We used to check for
13661363
# OPENSSL_VERSION_NUMBER, but that didn't work with 1.1.0, because LibreSSL
13671364
# defines OPENSSL_VERSION_NUMBER to claim version 2.0.0, even though it
13681365
# doesn't have these OpenSSL 1.1.0 functions. So check for individual
13691366
# functions.
1370-
['OPENSSL_init_ssl'],
1371-
['BIO_meth_new'],
1372-
['ASN1_STRING_get0_data'],
1373-
['HMAC_CTX_new'],
1374-
['HMAC_CTX_free'],
1375-
1376-
# OpenSSL versions before 1.1.0 required setting callback functions, for
1377-
# thread-safety. In 1.1.0, it's no longer required, and CRYPTO_lock()
1378-
# function was removed.
1379-
['CRYPTO_lock'],
1380-
1381-
# Function introduced in OpenSSL 1.1.1
1367+
['OPENSSL_init_ssl', {'required':true}],
1368+
1369+
# Function introduced in OpenSSL 1.0.2, not in LibreSSL.
1370+
['SSL_CTX_set_cert_cb'],
1371+
1372+
# Function introduced in OpenSSL 1.1.1, not in LibreSSL.
13821373
['X509_get_signature_info'],
13831374
['SSL_CTX_set_num_tickets'],
13841375
]
@@ -1402,7 +1393,7 @@ if sslopt in ['auto', 'openssl']
14021393
if are_openssl_funcs_complete
14031394
cdata.set('USE_OPENSSL',1,
14041395
description:'Define to 1 to build with OpenSSL support. (-Dssl=openssl)')
1405-
cdata.set('OPENSSL_API_COMPAT','0x10002000L',
1396+
cdata.set('OPENSSL_API_COMPAT','0x10100000L',
14061397
description:'Define to the OpenSSL API version in use. This avoids deprecation warnings from newer OpenSSL versions.')
14071398
ssl_library='openssl'
14081399
else

‎src/backend/libpq/be-secure-openssl.c

Lines changed: 1 addition & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@
4444
* include <wincrypt.h>, but some other Windows headers do.)
4545
*/
4646
#include"common/openssl.h"
47+
#include<openssl/bn.h>
4748
#include<openssl/conf.h>
4849
#include<openssl/dh.h>
4950
#ifndefOPENSSL_NO_ECDH
@@ -80,7 +81,6 @@ static const char *SSLerrmessage(unsigned long ecode);
8081
staticchar*X509_NAME_to_cstring(X509_NAME*name);
8182

8283
staticSSL_CTX*SSL_context=NULL;
83-
staticboolSSL_initialized= false;
8484
staticbooldummy_ssl_passwd_cb_called= false;
8585
staticboolssl_is_server_start;
8686

@@ -101,19 +101,6 @@ be_tls_init(bool isServerStart)
101101
intssl_ver_min=-1;
102102
intssl_ver_max=-1;
103103

104-
/* This stuff need be done only once. */
105-
if (!SSL_initialized)
106-
{
107-
#ifdefHAVE_OPENSSL_INIT_SSL
108-
OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG,NULL);
109-
#else
110-
OPENSSL_config(NULL);
111-
SSL_library_init();
112-
SSL_load_error_strings();
113-
#endif
114-
SSL_initialized= true;
115-
}
116-
117104
/*
118105
* Create a new SSL context into which we'll load all the configuration
119106
* settings. If we fail partway through, we can avoid memory leakage by
@@ -952,7 +939,6 @@ my_BIO_s_socket(void)
952939
if (!my_bio_methods)
953940
{
954941
BIO_METHOD*biom= (BIO_METHOD*)BIO_s_socket();
955-
#ifdefHAVE_BIO_METH_NEW
956942
intmy_bio_index;
957943

958944
my_bio_index=BIO_get_new_index();
@@ -975,14 +961,6 @@ my_BIO_s_socket(void)
975961
my_bio_methods=NULL;
976962
returnNULL;
977963
}
978-
#else
979-
my_bio_methods=malloc(sizeof(BIO_METHOD));
980-
if (!my_bio_methods)
981-
returnNULL;
982-
memcpy(my_bio_methods,biom,sizeof(BIO_METHOD));
983-
my_bio_methods->bread=my_sock_read;
984-
my_bio_methods->bwrite=my_sock_write;
985-
#endif
986964
}
987965
returnmy_bio_methods;
988966
}

‎src/common/Makefile

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -88,8 +88,7 @@ OBJS_COMMON = \
8888
ifeq ($(with_ssl),openssl)
8989
OBJS_COMMON +=\
9090
cryptohash_openssl.o\
91-
hmac_openssl.o\
92-
protocol_openssl.o
91+
hmac_openssl.o
9392
else
9493
OBJS_COMMON +=\
9594
cryptohash.o\

‎src/common/hmac_openssl.c

Lines changed: 1 addition & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -35,17 +35,12 @@
3535

3636
/*
3737
* In backend, use an allocation in TopMemoryContext to count for resowner
38-
* cleanup handling if necessary. For versions of OpenSSL where HMAC_CTX is
39-
* known, just use palloc(). In frontend, use malloc to be able to return
38+
* cleanup handling if necessary. In frontend, use malloc to be able to return
4039
* a failure status back to the caller.
4140
*/
4241
#ifndefFRONTEND
43-
#ifdefHAVE_HMAC_CTX_NEW
4442
#defineUSE_RESOWNER_FOR_HMAC
4543
#defineALLOC(size) MemoryContextAlloc(TopMemoryContext, size)
46-
#else
47-
#defineALLOC(size) palloc(size)
48-
#endif
4944
#defineFREE(ptr) pfree(ptr)
5045
#else/* FRONTEND */
5146
#defineALLOC(size) malloc(size)
@@ -144,11 +139,7 @@ pg_hmac_create(pg_cryptohash_type type)
144139
ResourceOwnerEnlarge(CurrentResourceOwner);
145140
#endif
146141

147-
#ifdefHAVE_HMAC_CTX_NEW
148142
ctx->hmacctx=HMAC_CTX_new();
149-
#else
150-
ctx->hmacctx=ALLOC(sizeof(HMAC_CTX));
151-
#endif
152143

153144
if (ctx->hmacctx==NULL)
154145
{
@@ -162,9 +153,6 @@ pg_hmac_create(pg_cryptohash_type type)
162153
returnNULL;
163154
}
164155

165-
#ifndefHAVE_HMAC_CTX_NEW
166-
memset(ctx->hmacctx,0,sizeof(HMAC_CTX));
167-
#endif
168156

169157
#ifdefUSE_RESOWNER_FOR_HMAC
170158
ctx->resowner=CurrentResourceOwner;
@@ -328,13 +316,7 @@ pg_hmac_free(pg_hmac_ctx *ctx)
328316
if (ctx==NULL)
329317
return;
330318

331-
#ifdefHAVE_HMAC_CTX_FREE
332319
HMAC_CTX_free(ctx->hmacctx);
333-
#else
334-
explicit_bzero(ctx->hmacctx,sizeof(HMAC_CTX));
335-
FREE(ctx->hmacctx);
336-
#endif
337-
338320
#ifdefUSE_RESOWNER_FOR_HMAC
339321
if (ctx->resowner)
340322
ResourceOwnerForgetHMAC(ctx->resowner,ctx);

‎src/common/meson.build

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,6 @@ if ssl.found()
4444
common_sources+=files(
4545
'cryptohash_openssl.c',
4646
'hmac_openssl.c',
47-
'protocol_openssl.c',
4847
)
4948
else
5049
common_sources+=files(

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp