Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit48e5ba6

Browse files
committed
Fix building with LibreSSL.
LibreSSL defines OPENSSL_VERSION_NUMBER to claim that it is version 2.0.0,but it doesn't have the functions added in OpenSSL 1.1.0. Add autoconfchecks for the individual functions we need, and stop relying onOPENSSL_VERSION_NUMBER.Backport to 9.5 and 9.6, like the patch that broke this. In theback-branches, there are still a few OPENSSL_VERSION_NUMBER checks left,to check for OpenSSL 0.9.8 or 0.9.7. I left them as they were - LibreSSLhas all those functions, so they work as intended.Per buildfarm member curculio.Discussion: <2442.1473957669@sss.pgh.pa.us>
1 parent60b6d99 commit48e5ba6

File tree

6 files changed

+85
-21
lines changed

6 files changed

+85
-21
lines changed

‎configure

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8877,6 +8877,37 @@ if test "x$ac_cv_func_SSL_get_current_compression" = xyes; then :
88778877
#define HAVE_SSL_GET_CURRENT_COMPRESSION 1
88788878
_ACEOF
88798879

8880+
fi
8881+
done
8882+
8883+
# Functions introduced in OpenSSL 1.1.0. We used to check for
8884+
# OPENSSL_VERSION_NUMBER, but that didn't work with 1.1.0, because LibreSSL
8885+
# defines OPENSSL_VERSION_NUMBER to claim version 2.0.0, even though it
8886+
# doesn't have these OpenSSL 1.1.0 functions. So check for individual
8887+
# functions.
8888+
forac_funcin OPENSSL_init_ssl BIO_get_data BIO_meth_new ASN1_STRING_get0_data RAND_OpenSSL
8889+
do:
8890+
as_ac_var=`$as_echo"ac_cv_func_$ac_func"|$as_tr_sh`
8891+
ac_fn_c_check_func"$LINENO""$ac_func""$as_ac_var"
8892+
ifevaltest\"x\$"$as_ac_var"\" = x"yes";then:
8893+
cat>>confdefs.h<<_ACEOF
8894+
#define`$as_echo"HAVE_$ac_func"|$as_tr_cpp` 1
8895+
_ACEOF
8896+
8897+
fi
8898+
done
8899+
8900+
# OpenSSL versions before 1.1.0 required setting callback functions, for
8901+
# thread-safety. In 1.1.0, it's no longer required, and CRYPTO_lock()
8902+
# function was removed.
8903+
forac_funcin CRYPTO_lock
8904+
do:
8905+
ac_fn_c_check_func"$LINENO""CRYPTO_lock""ac_cv_func_CRYPTO_lock"
8906+
iftest"x$ac_cv_func_CRYPTO_lock" = xyes;then:
8907+
cat>>confdefs.h<<_ACEOF
8908+
#define HAVE_CRYPTO_LOCK 1
8909+
_ACEOF
8910+
88808911
fi
88818912
done
88828913

‎configure.in

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1034,6 +1034,16 @@ if test "$with_openssl" = yes ; then
10341034
AC_SEARCH_LIBS(SSL_new, ssleay32 ssl, [], [AC_MSG_ERROR([library 'ssleay32' or 'ssl' is required for OpenSSL])])
10351035
fi
10361036
AC_CHECK_FUNCS([SSL_get_current_compression])
1037+
# Functions introduced in OpenSSL 1.1.0. We used to check for
1038+
# OPENSSL_VERSION_NUMBER, but that didn't work with 1.1.0, because LibreSSL
1039+
# defines OPENSSL_VERSION_NUMBER to claim version 2.0.0, even though it
1040+
# doesn't have these OpenSSL 1.1.0 functions. So check for individual
1041+
# functions.
1042+
AC_CHECK_FUNCS([OPENSSL_init_ssl BIO_get_data BIO_meth_new ASN1_STRING_get0_data RAND_OpenSSL])
1043+
# OpenSSL versions before 1.1.0 required setting callback functions, for
1044+
# thread-safety. In 1.1.0, it's no longer required, and CRYPTO_lock()
1045+
# function was removed.
1046+
AC_CHECK_FUNCS([CRYPTO_lock])
10371047
fi
10381048

10391049
if test "$with_pam" = yes ; then

‎contrib/pgcrypto/openssl.c

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1062,10 +1062,6 @@ px_find_cipher(const char *name, PX_Cipher **res)
10621062

10631063
staticintopenssl_random_init=0;
10641064

1065-
#ifOPENSSL_VERSION_NUMBER<0x10100000L
1066-
#defineRAND_OpenSSL RAND_SSLeay
1067-
#endif
1068-
10691065
/*
10701066
* OpenSSL random should re-feeded occasionally. From /dev/urandom
10711067
* preferably.
@@ -1074,7 +1070,13 @@ static void
10741070
init_openssl_rand(void)
10751071
{
10761072
if (RAND_get_rand_method()==NULL)
1073+
{
1074+
#ifdefHAVE_RAND_OPENSSL
10771075
RAND_set_rand_method(RAND_OpenSSL());
1076+
#else
1077+
RAND_set_rand_method(RAND_SSLeay());
1078+
#endif
1079+
}
10781080
openssl_random_init=1;
10791081
}
10801082

‎src/backend/libpq/be-secure-openssl.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -167,7 +167,7 @@ be_tls_init(void)
167167

168168
if (!SSL_context)
169169
{
170-
#ifOPENSSL_VERSION_NUMBER >=0x10100000L
170+
#ifdefHAVE_OPENSSL_INIT_SSL
171171
OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG,NULL);
172172
#else
173173
#ifOPENSSL_VERSION_NUMBER >=0x0907000L
@@ -655,7 +655,7 @@ be_tls_write(Port *port, void *ptr, size_t len, int *waitfor)
655655
* to retry; do we need to adopt their logic for that?
656656
*/
657657

658-
#ifOPENSSL_VERSION_NUMBER<0x10100000L
658+
#ifndefHAVE_BIO_GET_DATA
659659
#defineBIO_get_data(bio) (bio->ptr)
660660
#defineBIO_set_data(bio,data) (bio->ptr = data)
661661
#endif
@@ -709,7 +709,7 @@ my_BIO_s_socket(void)
709709
if (!my_bio_methods)
710710
{
711711
BIO_METHOD*biom= (BIO_METHOD*)BIO_s_socket();
712-
#ifOPENSSL_VERSION_NUMBER >=0x10100000L
712+
#ifdefHAVE_BIO_METH_NEW
713713
intmy_bio_index;
714714

715715
my_bio_index=BIO_get_new_index();

‎src/include/pg_config.h.in

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,12 +84,21 @@
8484
/* Define to 1 if you have the `append_history' function. */
8585
#undef HAVE_APPEND_HISTORY
8686

87+
/* Define to 1 if you have the `ASN1_STRING_get0_data' function. */
88+
#undef HAVE_ASN1_STRING_GET0_DATA
89+
8790
/* Define to 1 if you want to use atomics if available. */
8891
#undef HAVE_ATOMICS
8992

9093
/* Define to 1 if you have the <atomic.h> header file. */
9194
#undef HAVE_ATOMIC_H
9295

96+
/* Define to 1 if you have the `BIO_get_data' function. */
97+
#undef HAVE_BIO_GET_DATA
98+
99+
/* Define to 1 if you have the `BIO_meth_new' function. */
100+
#undef HAVE_BIO_METH_NEW
101+
93102
/* Define to 1 if you have the `cbrt' function. */
94103
#undef HAVE_CBRT
95104

@@ -102,6 +111,9 @@
102111
/* Define to 1 if you have the `crypt' function. */
103112
#undef HAVE_CRYPT
104113

114+
/* Define to 1 if you have the `CRYPTO_lock' function. */
115+
#undef HAVE_CRYPTO_LOCK
116+
105117
/* Define to 1 if you have the <crypt.h> header file. */
106118
#undef HAVE_CRYPT_H
107119

@@ -364,6 +376,9 @@
364376
/* Define to 1 if you have the <net/if.h> header file. */
365377
#undef HAVE_NET_IF_H
366378

379+
/* Define to 1 if you have the `OPENSSL_init_ssl' function. */
380+
#undef HAVE_OPENSSL_INIT_SSL
381+
367382
/* Define to 1 if you have the <ossp/uuid.h> header file. */
368383
#undef HAVE_OSSP_UUID_H
369384

@@ -400,6 +415,9 @@
400415
/* Define to 1 if you have the `random' function. */
401416
#undef HAVE_RANDOM
402417

418+
/* Define to 1 if you have the `RAND_OpenSSL' function. */
419+
#undef HAVE_RAND_OPENSSL
420+
403421
/* Define to 1 if you have the <readline.h> header file. */
404422
#undef HAVE_READLINE_H
405423

‎src/interfaces/libpq/fe-secure-openssl.c

Lines changed: 17 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -507,10 +507,6 @@ wildcard_certificate_match(const char *pattern, const char *string)
507507
return1;
508508
}
509509

510-
#ifOPENSSL_VERSION_NUMBER<0x10100000L
511-
#defineASN1_STRING_get0_data ASN1_STRING_data
512-
#endif
513-
514510
/*
515511
* Check if a name from a server's certificate matches the peer's hostname.
516512
*
@@ -545,7 +541,11 @@ verify_peer_name_matches_certificate_name(PGconn *conn, ASN1_STRING *name_entry,
545541
* There is no guarantee the string returned from the certificate is
546542
* NULL-terminated, so make a copy that is.
547543
*/
544+
#ifdefHAVE_ASN1_STRING_GET0_DATA
548545
namedata=ASN1_STRING_get0_data(name_entry);
546+
#else
547+
namedata=ASN1_STRING_data(name_entry);
548+
#endif
549549
len=ASN1_STRING_length(name_entry);
550550
name=malloc(len+1);
551551
if (name==NULL)
@@ -733,10 +733,13 @@ verify_peer_name_matches_certificate(PGconn *conn)
733733
returnfound_match&& !got_error;
734734
}
735735

736-
#if defined(ENABLE_THREAD_SAFETY)&&OPENSSL_VERSION_NUMBER<0x10100000L
736+
#if defined(ENABLE_THREAD_SAFETY)&&defined(HAVE_CRYPTO_LOCK)
737737
/*
738-
*Callback functions for OpenSSL internal locking. (OpenSSL 1.1.0
739-
*does its own locking, and doesn't need these anymore.)
738+
*Callback functions for OpenSSL internal locking. (OpenSSL 1.1.0
739+
*does its own locking, and doesn't need these anymore. The
740+
*CRYPTO_lock() function was removed in 1.1.0, when the callbacks
741+
*were made obsolete, so we assume that if CRYPTO_lock() exists,
742+
*the callbacks are still required.)
740743
*/
741744

742745
staticunsigned long
@@ -766,7 +769,7 @@ pq_lockingcallback(int mode, int n, const char *file, int line)
766769
PGTHREAD_ERROR("failed to unlock mutex");
767770
}
768771
}
769-
#endif/* ENABLE_THREAD_SAFETY &&OPENSSL_VERSION_NUMBER < 0x10100000L */
772+
#endif/* ENABLE_THREAD_SAFETY &&HAVE_CRYPTO_LOCK */
770773

771774
/*
772775
* Initialize SSL system, in particular creating the SSL_context object
@@ -805,7 +808,7 @@ pgtls_init(PGconn *conn)
805808
if (pthread_mutex_lock(&ssl_config_mutex))
806809
return-1;
807810

808-
#ifOPENSSL_VERSION_NUMBER<0x10100000L
811+
#ifdefHAVE_CRYPTO_LOCK
809812
if (pq_init_crypto_lib)
810813
{
811814
/*
@@ -846,14 +849,14 @@ pgtls_init(PGconn *conn)
846849
CRYPTO_set_locking_callback(pq_lockingcallback);
847850
}
848851
}
849-
#endif/*OPENSSL_VERSION_NUMBER < 0x10100000L */
852+
#endif/*HAVE_CRYPTO_LOCK */
850853
#endif/* ENABLE_THREAD_SAFETY */
851854

852855
if (!SSL_context)
853856
{
854857
if (pq_init_ssl_lib)
855858
{
856-
#ifOPENSSL_VERSION_NUMBER >=0x10100000L
859+
#ifdefHAVE_OPENSSL_INIT_SSL
857860
OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG,NULL);
858861
#else
859862
#ifOPENSSL_VERSION_NUMBER >=0x00907000L
@@ -916,7 +919,7 @@ pgtls_init(PGconn *conn)
916919
staticvoid
917920
destroy_ssl_system(void)
918921
{
919-
#if defined(ENABLE_THREAD_SAFETY)&&OPENSSL_VERSION_NUMBER<0x10100000L
922+
#if defined(ENABLE_THREAD_SAFETY)&&defined(HAVE_CRYPTO_LOCK)
920923
/* Mutex is created in initialize_ssl_system() */
921924
if (pthread_mutex_lock(&ssl_config_mutex))
922925
return;
@@ -1631,7 +1634,7 @@ PQsslAttribute(PGconn *conn, const char *attribute_name)
16311634
* to retry; do we need to adopt their logic for that?
16321635
*/
16331636

1634-
#ifOPENSSL_VERSION_NUMBER<0x10100000L
1637+
#ifndefHAVE_BIO_GET_DATA
16351638
#defineBIO_get_data(bio) (bio->ptr)
16361639
#defineBIO_set_data(bio,data) (bio->ptr = data)
16371640
#endif
@@ -1704,7 +1707,7 @@ my_BIO_s_socket(void)
17041707
if (!my_bio_methods)
17051708
{
17061709
BIO_METHOD*biom= (BIO_METHOD*)BIO_s_socket();
1707-
#ifOPENSSL_VERSION_NUMBER >=0x10100000L
1710+
#ifdefHAVE_BIO_METH_NEW
17081711
intmy_bio_index;
17091712

17101713
my_bio_index=BIO_get_new_index();

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp