Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitf9264d1

Browse files
committed
Remove support for SSL compression
PostgreSQL disabled compression as ofe3bdb2d and the documentationrecommends against using it since. Additionally, SSL compression hasbeen disabled in OpenSSL since version 1.1.0, and was disabled in manydistributions long before that. The most recent TLS version, TLSv1.3,disallows compression at the protocol level.This commit removes the feature itself, removing support for the libpqparameter sslcompression (parameter still listed for compatibilityreasons with existing connection strings, just ignored), and removesthe equivalent field in pg_stat_ssl and de facto PgBackendSSLStatus.Note that, on top of removing the ability to activate compression byconfiguration, compression is actively disabled in both frontend andbackend to avoid overrides from local configurations.A TAP test is added for deprecated SSL parameters to check afterbackwards compatibility.Bump catalog version.Author: Daniel GustafssonReviewed-by: Peter Eisentraut, Magnus Hagander, Michael PaquierDiscussion:https://postgr.es/m/7E384D48-11C5-441B-9EC3-F7DB1F8518F6@yesql.se
1 parentd4545dc commitf9264d1

File tree

19 files changed

+60
-112
lines changed

19 files changed

+60
-112
lines changed

‎contrib/postgres_fdw/expected/postgres_fdw.out

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -163,7 +163,6 @@ ALTER SERVER testserver1 OPTIONS (
163163
keepalives_interval 'value',
164164
tcp_user_timeout 'value',
165165
-- requiressl 'value',
166-
sslcompression 'value',
167166
sslmode 'value',
168167
sslcert 'value',
169168
sslkey 'value',
@@ -8946,7 +8945,7 @@ DO $d$
89468945
END;
89478946
$d$;
89488947
ERROR: invalid option "password"
8949-
HINT: Valid options in this context are: service, passfile, channel_binding, connect_timeout, dbname, host, hostaddr, port, options, application_name, keepalives, keepalives_idle, keepalives_interval, keepalives_count, tcp_user_timeout, sslmode,sslcompression,sslcert, sslkey, sslrootcert, sslcrl, sslcrldir, requirepeer, ssl_min_protocol_version, ssl_max_protocol_version, gssencmode, krbsrvname, gsslib, target_session_attrs, use_remote_estimate, fdw_startup_cost, fdw_tuple_cost, extensions, updatable, fetch_size, batch_size
8948+
HINT: Valid options in this context are: service, passfile, channel_binding, connect_timeout, dbname, host, hostaddr, port, options, application_name, keepalives, keepalives_idle, keepalives_interval, keepalives_count, tcp_user_timeout, sslmode, sslcert, sslkey, sslrootcert, sslcrl, sslcrldir, requirepeer, ssl_min_protocol_version, ssl_max_protocol_version, gssencmode, krbsrvname, gsslib, target_session_attrs, use_remote_estimate, fdw_startup_cost, fdw_tuple_cost, extensions, updatable, fetch_size, batch_size
89508949
CONTEXT: SQL statement "ALTER SERVER loopback_nopw OPTIONS (ADD password 'dummypw')"
89518950
PL/pgSQL function inline_code_block line 3 at EXECUTE
89528951
-- If we add a password for our user mapping instead, we should get a different

‎contrib/postgres_fdw/sql/postgres_fdw.sql

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -177,7 +177,6 @@ ALTER SERVER testserver1 OPTIONS (
177177
keepalives_interval'value',
178178
tcp_user_timeout'value',
179179
-- requiressl 'value',
180-
sslcompression'value',
181180
sslmode'value',
182181
sslcert'value',
183182
sslkey'value',

‎doc/src/sgml/libpq.sgml

Lines changed: 2 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -1635,24 +1635,7 @@ postgresql://%2Fvar%2Flib%2Fpostgresql/dbname
16351635
<term><literal>sslcompression</literal></term>
16361636
<listitem>
16371637
<para>
1638-
If set to 1, data sent over SSL connections will be compressed. If
1639-
set to 0, compression will be disabled. The default is 0. This
1640-
parameter is ignored if a connection without SSL is made.
1641-
</para>
1642-
1643-
<para>
1644-
SSL compression is nowadays considered insecure and its use is no
1645-
longer recommended. <productname>OpenSSL</productname> 1.1.0 disables
1646-
compression by default, and many operating system distributions
1647-
disable it in prior versions as well, so setting this parameter to on
1648-
will not have any effect if the server does not accept compression.
1649-
</para>
1650-
1651-
<para>
1652-
If security is not a primary concern, compression can improve
1653-
throughput if the network is the bottleneck. Disabling compression
1654-
can improve response time and throughput if CPU performance is the
1655-
limiting factor.
1638+
Ignored (formerly, this specified whether to attempt SSL compression).
16561639
</para>
16571640
</listitem>
16581641
</varlistentry>
@@ -2545,9 +2528,7 @@ const char *PQsslAttribute(const PGconn *conn, const char *attribute_name);
25452528
<term><literal>compression</literal></term>
25462529
<listitem>
25472530
<para>
2548-
If SSL compression is in use, returns the name of the compression
2549-
algorithm, or "on" if compression is used but the algorithm is
2550-
not known. If compression is not in use, returns "off".
2531+
SSL compression is no longer supported, always returns "off".
25512532
</para>
25522533
</listitem>
25532534
</varlistentry>
@@ -7182,16 +7163,6 @@ myEventProc(PGEventId evtId, void *evtInfo, void *passThrough)
71827163
</para>
71837164
</listitem>
71847165

7185-
<listitem>
7186-
<para>
7187-
<indexterm>
7188-
<primary><envar>PGSSLCOMPRESSION</envar></primary>
7189-
</indexterm>
7190-
<envar>PGSSLCOMPRESSION</envar> behaves the same as the <xref
7191-
linkend="libpq-connect-sslcompression"/> connection parameter.
7192-
</para>
7193-
</listitem>
7194-
71957166
<listitem>
71967167
<para>
71977168
<indexterm>

‎doc/src/sgml/monitoring.sgml

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3065,16 +3065,6 @@ SELECT pid, wait_event_type, wait_event FROM pg_stat_activity WHERE wait_event i
30653065
</para></entry>
30663066
</row>
30673067

3068-
<row>
3069-
<entry role="catalog_table_entry"><para role="column_definition">
3070-
<structfield>compression</structfield> <type>boolean</type>
3071-
</para>
3072-
<para>
3073-
True if SSL compression is in use, false if not,
3074-
or NULL if SSL is not in use on this connection
3075-
</para></entry>
3076-
</row>
3077-
30783068
<row>
30793069
<entry role="catalog_table_entry"><para role="column_definition">
30803070
<structfield>client_dn</structfield> <type>text</type>

‎src/backend/catalog/system_views.sql

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -863,7 +863,6 @@ CREATE VIEW pg_stat_ssl AS
863863
S.sslversionAS version,
864864
S.sslcipherAS cipher,
865865
S.sslbitsAS bits,
866-
S.sslcompressionAS compression,
867866
S.ssl_client_dnAS client_dn,
868867
S.ssl_client_serialAS client_serial,
869868
S.ssl_issuer_dnAS issuer_dn

‎src/backend/libpq/be-secure-openssl.c

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -245,6 +245,9 @@ be_tls_init(bool isServerStart)
245245
/* disallow SSL session caching, too */
246246
SSL_CTX_set_session_cache_mode(context,SSL_SESS_CACHE_OFF);
247247

248+
/* disallow SSL compression */
249+
SSL_CTX_set_options(context,SSL_OP_NO_COMPRESSION);
250+
248251
/* set up ephemeral DH and ECDH keys */
249252
if (!initialize_dh(context,isServerStart))
250253
gotoerror;
@@ -1182,15 +1185,6 @@ be_tls_get_cipher_bits(Port *port)
11821185
return0;
11831186
}
11841187

1185-
bool
1186-
be_tls_get_compression(Port*port)
1187-
{
1188-
if (port->ssl)
1189-
return (SSL_get_current_compression(port->ssl)!=NULL);
1190-
else
1191-
return false;
1192-
}
1193-
11941188
constchar*
11951189
be_tls_get_version(Port*port)
11961190
{

‎src/backend/postmaster/pgstat.c

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3215,7 +3215,6 @@ pgstat_bestart(void)
32153215
{
32163216
lbeentry.st_ssl= true;
32173217
lsslstatus.ssl_bits=be_tls_get_cipher_bits(MyProcPort);
3218-
lsslstatus.ssl_compression=be_tls_get_compression(MyProcPort);
32193218
strlcpy(lsslstatus.ssl_version,be_tls_get_version(MyProcPort),NAMEDATALEN);
32203219
strlcpy(lsslstatus.ssl_cipher,be_tls_get_cipher(MyProcPort),NAMEDATALEN);
32213220
be_tls_get_peer_subject_name(MyProcPort,lsslstatus.ssl_client_dn,NAMEDATALEN);

‎src/backend/utils/adt/pgstatfuncs.c

Lines changed: 17 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -569,7 +569,7 @@ pg_stat_get_progress_info(PG_FUNCTION_ARGS)
569569
Datum
570570
pg_stat_get_activity(PG_FUNCTION_ARGS)
571571
{
572-
#definePG_STAT_GET_ACTIVITY_COLS30
572+
#definePG_STAT_GET_ACTIVITY_COLS29
573573
intnum_backends=pgstat_fetch_stat_numbackends();
574574
intcurr_backend;
575575
intpid=PG_ARGISNULL(0) ?-1 :PG_GETARG_INT32(0);
@@ -708,7 +708,7 @@ pg_stat_get_activity(PG_FUNCTION_ARGS)
708708
pfree(clipped_activity);
709709

710710
/* leader_pid */
711-
nulls[29]= true;
711+
nulls[28]= true;
712712

713713
proc=BackendPidGetProc(beentry->st_procpid);
714714

@@ -745,8 +745,8 @@ pg_stat_get_activity(PG_FUNCTION_ARGS)
745745
*/
746746
if (leader&&leader->pid!=beentry->st_procpid)
747747
{
748-
values[29]=Int32GetDatum(leader->pid);
749-
nulls[29]= false;
748+
values[28]=Int32GetDatum(leader->pid);
749+
nulls[28]= false;
750750
}
751751
}
752752

@@ -875,44 +875,43 @@ pg_stat_get_activity(PG_FUNCTION_ARGS)
875875
values[19]=CStringGetTextDatum(beentry->st_sslstatus->ssl_version);
876876
values[20]=CStringGetTextDatum(beentry->st_sslstatus->ssl_cipher);
877877
values[21]=Int32GetDatum(beentry->st_sslstatus->ssl_bits);
878-
values[22]=BoolGetDatum(beentry->st_sslstatus->ssl_compression);
879878

880879
if (beentry->st_sslstatus->ssl_client_dn[0])
881-
values[23]=CStringGetTextDatum(beentry->st_sslstatus->ssl_client_dn);
880+
values[22]=CStringGetTextDatum(beentry->st_sslstatus->ssl_client_dn);
882881
else
883-
nulls[23]= true;
882+
nulls[22]= true;
884883

885884
if (beentry->st_sslstatus->ssl_client_serial[0])
886-
values[24]=DirectFunctionCall3(numeric_in,
885+
values[23]=DirectFunctionCall3(numeric_in,
887886
CStringGetDatum(beentry->st_sslstatus->ssl_client_serial),
888887
ObjectIdGetDatum(InvalidOid),
889888
Int32GetDatum(-1));
890889
else
891-
nulls[24]= true;
890+
nulls[23]= true;
892891

893892
if (beentry->st_sslstatus->ssl_issuer_dn[0])
894-
values[25]=CStringGetTextDatum(beentry->st_sslstatus->ssl_issuer_dn);
893+
values[24]=CStringGetTextDatum(beentry->st_sslstatus->ssl_issuer_dn);
895894
else
896-
nulls[25]= true;
895+
nulls[24]= true;
897896
}
898897
else
899898
{
900899
values[18]=BoolGetDatum(false);/* ssl */
901-
nulls[19]=nulls[20]=nulls[21]=nulls[22]=nulls[23]=nulls[24]=nulls[25]=true;
900+
nulls[19]=nulls[20]=nulls[21]=nulls[22]=nulls[23]=nulls[24]= true;
902901
}
903902

904903
/* GSSAPI information */
905904
if (beentry->st_gss)
906905
{
907-
values[26]=BoolGetDatum(beentry->st_gssstatus->gss_auth);/* gss_auth */
908-
values[27]=CStringGetTextDatum(beentry->st_gssstatus->gss_princ);
909-
values[28]=BoolGetDatum(beentry->st_gssstatus->gss_enc);/* GSS Encryption in use */
906+
values[25]=BoolGetDatum(beentry->st_gssstatus->gss_auth);/* gss_auth */
907+
values[26]=CStringGetTextDatum(beentry->st_gssstatus->gss_princ);
908+
values[27]=BoolGetDatum(beentry->st_gssstatus->gss_enc);/* GSS Encryption in use */
910909
}
911910
else
912911
{
913-
values[26]=BoolGetDatum(false);/* gss_auth */
914-
nulls[27]= true;/* No GSS principal */
915-
values[28]=BoolGetDatum(false);/* GSS Encryption not in
912+
values[25]=BoolGetDatum(false);/* gss_auth */
913+
nulls[26]= true;/* No GSS principal */
914+
values[27]=BoolGetDatum(false);/* GSS Encryption not in
916915
* use */
917916
}
918917
}
@@ -942,7 +941,6 @@ pg_stat_get_activity(PG_FUNCTION_ARGS)
942941
nulls[26]= true;
943942
nulls[27]= true;
944943
nulls[28]= true;
945-
nulls[29]= true;
946944
}
947945

948946
tuplestore_putvalues(tupstore,tupdesc,values,nulls);

‎src/backend/utils/init/postinit.c

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -264,11 +264,10 @@ PerformAuthentication(Port *port)
264264

265265
#ifdefUSE_SSL
266266
if (port->ssl_in_use)
267-
appendStringInfo(&logmsg,_(" SSL enabled (protocol=%s, cipher=%s, bits=%d, compression=%s)"),
267+
appendStringInfo(&logmsg,_(" SSL enabled (protocol=%s, cipher=%s, bits=%d)"),
268268
be_tls_get_version(port),
269269
be_tls_get_cipher(port),
270-
be_tls_get_cipher_bits(port),
271-
be_tls_get_compression(port) ?_("on") :_("off"));
270+
be_tls_get_cipher_bits(port));
272271
#endif
273272
#ifdefENABLE_GSS
274273
if (port->gss)

‎src/bin/psql/command.c

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3509,21 +3509,18 @@ printSSLInfo(void)
35093509
constchar*protocol;
35103510
constchar*cipher;
35113511
constchar*bits;
3512-
constchar*compression;
35133512

35143513
if (!PQsslInUse(pset.db))
35153514
return;/* no SSL */
35163515

35173516
protocol=PQsslAttribute(pset.db,"protocol");
35183517
cipher=PQsslAttribute(pset.db,"cipher");
35193518
bits=PQsslAttribute(pset.db,"key_bits");
3520-
compression=PQsslAttribute(pset.db,"compression");
35213519

3522-
printf(_("SSL connection (protocol: %s, cipher: %s, bits: %s, compression: %s)\n"),
3520+
printf(_("SSL connection (protocol: %s, cipher: %s, bits: %s)\n"),
35233521
protocol ?protocol :_("unknown"),
35243522
cipher ?cipher :_("unknown"),
3525-
bits ?bits :_("unknown"),
3526-
(compression&&strcmp(compression,"off")!=0) ?_("on") :_("off"));
3523+
bits ?bits :_("unknown"));
35273524
}
35283525

35293526
/*

‎src/include/catalog/catversion.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,6 @@
5353
*/
5454

5555
/*yyyymmddN */
56-
#defineCATALOG_VERSION_NO202103081
56+
#defineCATALOG_VERSION_NO202103091
5757

5858
#endif

‎src/include/catalog/pg_proc.dat

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5249,9 +5249,9 @@
52495249
proname => 'pg_stat_get_activity', prorows => '100', proisstrict => 'f',
52505250
proretset => 't', provolatile => 's', proparallel => 'r',
52515251
prorettype => 'record', proargtypes => 'int4',
5252-
proallargtypes => '{int4,oid,int4,oid,text,text,text,text,text,timestamptz,timestamptz,timestamptz,timestamptz,inet,text,int4,xid,xid,text,bool,text,text,int4,bool,text,numeric,text,bool,text,bool,int4}',
5253-
proargmodes => '{i,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o}',
5254-
proargnames => '{pid,datid,pid,usesysid,application_name,state,query,wait_event_type,wait_event,xact_start,query_start,backend_start,state_change,client_addr,client_hostname,client_port,backend_xid,backend_xmin,backend_type,ssl,sslversion,sslcipher,sslbits,sslcompression,ssl_client_dn,ssl_client_serial,ssl_issuer_dn,gss_auth,gss_princ,gss_enc,leader_pid}',
5252+
proallargtypes => '{int4,oid,int4,oid,text,text,text,text,text,timestamptz,timestamptz,timestamptz,timestamptz,inet,text,int4,xid,xid,text,bool,text,text,int4,text,numeric,text,bool,text,bool,int4}',
5253+
proargmodes => '{i,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o}',
5254+
proargnames => '{pid,datid,pid,usesysid,application_name,state,query,wait_event_type,wait_event,xact_start,query_start,backend_start,state_change,client_addr,client_hostname,client_port,backend_xid,backend_xmin,backend_type,ssl,sslversion,sslcipher,sslbits,ssl_client_dn,ssl_client_serial,ssl_issuer_dn,gss_auth,gss_princ,gss_enc,leader_pid}',
52555255
prosrc => 'pg_stat_get_activity' },
52565256
{ oid => '3318',
52575257
descr => 'statistics: information about progress of backends running maintenance command',

‎src/include/libpq/libpq-be.h

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -266,7 +266,6 @@ extern ssize_t be_tls_write(Port *port, void *ptr, size_t len, int *waitfor);
266266
* Return information about the SSL connection.
267267
*/
268268
externintbe_tls_get_cipher_bits(Port*port);
269-
externboolbe_tls_get_compression(Port*port);
270269
externconstchar*be_tls_get_version(Port*port);
271270
externconstchar*be_tls_get_cipher(Port*port);
272271
externvoidbe_tls_get_peer_subject_name(Port*port,char*ptr,size_tlen);

‎src/include/pgstat.h

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1135,7 +1135,6 @@ typedef struct PgBackendSSLStatus
11351135
{
11361136
/* Information about SSL connection */
11371137
intssl_bits;
1138-
boolssl_compression;
11391138
charssl_version[NAMEDATALEN];
11401139
charssl_cipher[NAMEDATALEN];
11411140
charssl_client_dn[NAMEDATALEN];

‎src/interfaces/libpq/fe-connect.c

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -293,9 +293,12 @@ static const internalPQconninfoOption PQconninfoOptions[] = {
293293
"SSL-Mode","",12,/* sizeof("verify-full") == 12 */
294294
offsetof(structpg_conn,sslmode)},
295295

296-
{"sslcompression","PGSSLCOMPRESSION","0",NULL,
297-
"SSL-Compression","",1,
298-
offsetof(structpg_conn,sslcompression)},
296+
/*
297+
* "sslcompression" is no longer used, but keep it present for backwards
298+
* compatibility.
299+
*/
300+
{"sslcompression",NULL,NULL,NULL,
301+
"SSL-Compression","D",1,-1},
299302

300303
{"sslcert","PGSSLCERT",NULL,NULL,
301304
"SSL-Client-Cert","",64,
@@ -4080,8 +4083,6 @@ freePGconn(PGconn *conn)
40804083
free(conn->sslcrl);
40814084
if (conn->sslcrldir)
40824085
free(conn->sslcrldir);
4083-
if (conn->sslcompression)
4084-
free(conn->sslcompression);
40854086
if (conn->requirepeer)
40864087
free(conn->requirepeer);
40874088
if (conn->ssl_min_protocol_version)

‎src/interfaces/libpq/fe-secure-openssl.c

Lines changed: 7 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1257,13 +1257,8 @@ initialize_SSL(PGconn *conn)
12571257
if (have_rootcert)
12581258
SSL_set_verify(conn->ssl,SSL_VERIFY_PEER,verify_cb);
12591259

1260-
/*
1261-
* Set compression option if necessary.
1262-
*/
1263-
if (conn->sslcompression&&conn->sslcompression[0]=='0')
1264-
SSL_set_options(conn->ssl,SSL_OP_NO_COMPRESSION);
1265-
else
1266-
SSL_clear_options(conn->ssl,SSL_OP_NO_COMPRESSION);
1260+
/* disable SSL compression */
1261+
SSL_set_options(conn->ssl,SSL_OP_NO_COMPRESSION);
12671262

12681263
return0;
12691264
}
@@ -1553,8 +1548,12 @@ PQsslAttribute(PGconn *conn, const char *attribute_name)
15531548
if (strcmp(attribute_name,"cipher")==0)
15541549
returnSSL_get_cipher(conn->ssl);
15551550

1551+
/*
1552+
* SSL compression is disabled, so even if connecting to an older server
1553+
* which still supports it, it will not be active.
1554+
*/
15561555
if (strcmp(attribute_name,"compression")==0)
1557-
returnSSL_get_current_compression(conn->ssl) ?"on" :"off";
1556+
return"off";
15581557

15591558
if (strcmp(attribute_name,"protocol")==0)
15601559
returnSSL_get_version(conn->ssl);

‎src/interfaces/libpq/libpq-int.h

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -360,7 +360,6 @@ struct pg_conn
360360
char*keepalives_count;/* maximum number of TCP keepalive
361361
* retransmits */
362362
char*sslmode;/* SSL mode (require,prefer,allow,disable) */
363-
char*sslcompression;/* SSL compression (0 or 1) */
364363
char*sslkey;/* client key filename */
365364
char*sslcert;/* client certificate filename */
366365
char*sslpassword;/* client key file password */

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp