Skip to content

Commit 5c6df67

Browse files
hlinnakahlinnaka
committed
Fix building with LibreSSL.
LibreSSL defines OPENSSL_VERSION_NUMBER to claim that it is version 2.0.0, but it doesn't have the functions added in OpenSSL 1.1.0. Add autoconf checks for the individual functions we need, and stop relying on OPENSSL_VERSION_NUMBER. Backport to 9.5 and 9.6, like the patch that broke this. In the back-branches, there are still a few OPENSSL_VERSION_NUMBER checks left, to check for OpenSSL 0.9.8 or 0.9.7. I left them as they were - LibreSSL has all those functions, so they work as intended. Per buildfarm member curculio. Discussion: <2442.1473957669@sss.pgh.pa.us>
1 parent ffccee4 commit 5c6df67

File tree

6 files changed

+85
-21
lines changed

6 files changed

+85
-21
lines changed

‎configure

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9711,6 +9711,37 @@ if test "x$ac_cv_func_SSL_get_current_compression" = xyes; then :
97119711
#define HAVE_SSL_GET_CURRENT_COMPRESSION 1
97129712
_ACEOF
97139713

9714+
fi
9715+
done
9716+
9717+
# Functions introduced in OpenSSL 1.1.0. We used to check for
9718+
# OPENSSL_VERSION_NUMBER, but that didn't work with 1.1.0, because LibreSSL
9719+
# defines OPENSSL_VERSION_NUMBER to claim version 2.0.0, even though it
9720+
# doesn't have these OpenSSL 1.1.0 functions. So check for individual
9721+
# functions.
9722+
for ac_func in OPENSSL_init_ssl BIO_get_data BIO_meth_new ASN1_STRING_get0_data RAND_OpenSSL
9723+
do :
9724+
as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
9725+
ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
9726+
if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
9727+
cat >>confdefs.h <<_ACEOF
9728+
#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
9729+
_ACEOF
9730+
9731+
fi
9732+
done
9733+
9734+
# OpenSSL versions before 1.1.0 required setting callback functions, for
9735+
# thread-safety. In 1.1.0, it's no longer required, and CRYPTO_lock()
9736+
# function was removed.
9737+
for ac_func in CRYPTO_lock
9738+
do :
9739+
ac_fn_c_check_func "$LINENO" "CRYPTO_lock" "ac_cv_func_CRYPTO_lock"
9740+
if test "x$ac_cv_func_CRYPTO_lock" = xyes; then :
9741+
cat >>confdefs.h <<_ACEOF
9742+
#define HAVE_CRYPTO_LOCK 1
9743+
_ACEOF
9744+
97149745
fi
97159746
done
97169747

‎configure.in

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1118,6 +1118,16 @@ if test "$with_openssl" = yes ; then
11181118
AC_SEARCH_LIBS(SSL_new, ssleay32 ssl, [], [AC_MSG_ERROR([library 'ssleay32' or 'ssl' is required for OpenSSL])])
11191119
fi
11201120
AC_CHECK_FUNCS([SSL_get_current_compression])
1121+
# Functions introduced in OpenSSL 1.1.0. We used to check for
1122+
# OPENSSL_VERSION_NUMBER, but that didn't work with 1.1.0, because LibreSSL
1123+
# defines OPENSSL_VERSION_NUMBER to claim version 2.0.0, even though it
1124+
# doesn't have these OpenSSL 1.1.0 functions. So check for individual
1125+
# functions.
1126+
AC_CHECK_FUNCS([OPENSSL_init_ssl BIO_get_data BIO_meth_new ASN1_STRING_get0_data RAND_OpenSSL])
1127+
# OpenSSL versions before 1.1.0 required setting callback functions, for
1128+
# thread-safety. In 1.1.0, it's no longer required, and CRYPTO_lock()
1129+
# function was removed.
1130+
AC_CHECK_FUNCS([CRYPTO_lock])
11211131
fi
11221132

11231133
if test "$with_pam" = yes ; then

‎contrib/pgcrypto/openssl.c

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -914,10 +914,6 @@ px_find_cipher(const char *name, PX_Cipher **res)
914914

915915
static int openssl_random_init = 0;
916916

917-
#if OPENSSL_VERSION_NUMBER < 0x10100000L
918-
#define RAND_OpenSSL RAND_SSLeay
919-
#endif
920-
921917
/*
922918
* OpenSSL random should re-feeded occasionally. From /dev/urandom
923919
* preferably.
@@ -926,7 +922,13 @@ static void
926922
init_openssl_rand(void)
927923
{
928924
if (RAND_get_rand_method() == NULL)
925+
{
926+
#ifdef HAVE_RAND_OPENSSL
929927
RAND_set_rand_method(RAND_OpenSSL());
928+
#else
929+
RAND_set_rand_method(RAND_SSLeay());
930+
#endif
931+
}
930932
openssl_random_init = 1;
931933
}
932934

‎src/backend/libpq/be-secure-openssl.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -165,7 +165,7 @@ be_tls_init(void)
165165

166166
if (!SSL_context)
167167
{
168-
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
168+
#ifdef HAVE_OPENSSL_INIT_SSL
169169
OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG, NULL);
170170
#else
171171
OPENSSL_config(NULL);
@@ -672,7 +672,7 @@ be_tls_write(Port *port, void *ptr, size_t len, int *waitfor)
672672
* to retry; do we need to adopt their logic for that?
673673
*/
674674

675-
#if OPENSSL_VERSION_NUMBER < 0x10100000L
675+
#ifndef HAVE_BIO_GET_DATA
676676
#define BIO_get_data(bio) (bio->ptr)
677677
#define BIO_set_data(bio, data) (bio->ptr = data)
678678
#endif
@@ -726,7 +726,7 @@ my_BIO_s_socket(void)
726726
if (!my_bio_methods)
727727
{
728728
BIO_METHOD *biom = (BIO_METHOD *) BIO_s_socket();
729-
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
729+
#ifdef HAVE_BIO_METH_NEW
730730
int my_bio_index;
731731

732732
my_bio_index = BIO_get_new_index();

‎src/include/pg_config.h.in

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,12 +84,21 @@
8484
/* Define to 1 if you have the `append_history' function. */
8585
#undef HAVE_APPEND_HISTORY
8686

87+
/* Define to 1 if you have the `ASN1_STRING_get0_data' function. */
88+
#undef HAVE_ASN1_STRING_GET0_DATA
89+
8790
/* Define to 1 if you want to use atomics if available. */
8891
#undef HAVE_ATOMICS
8992

9093
/* Define to 1 if you have the <atomic.h> header file. */
9194
#undef HAVE_ATOMIC_H
9295

96+
/* Define to 1 if you have the `BIO_get_data' function. */
97+
#undef HAVE_BIO_GET_DATA
98+
99+
/* Define to 1 if you have the `BIO_meth_new' function. */
100+
#undef HAVE_BIO_METH_NEW
101+
93102
/* Define to 1 if you have the `cbrt' function. */
94103
#undef HAVE_CBRT
95104

@@ -102,6 +111,9 @@
102111
/* Define to 1 if you have the `crypt' function. */
103112
#undef HAVE_CRYPT
104113

114+
/* Define to 1 if you have the `CRYPTO_lock' function. */
115+
#undef HAVE_CRYPTO_LOCK
116+
105117
/* Define to 1 if you have the <crypt.h> header file. */
106118
#undef HAVE_CRYPT_H
107119

@@ -364,6 +376,9 @@
364376
/* Define to 1 if you have the <net/if.h> header file. */
365377
#undef HAVE_NET_IF_H
366378

379+
/* Define to 1 if you have the `OPENSSL_init_ssl' function. */
380+
#undef HAVE_OPENSSL_INIT_SSL
381+
367382
/* Define to 1 if you have the <ossp/uuid.h> header file. */
368383
#undef HAVE_OSSP_UUID_H
369384

@@ -403,6 +418,9 @@
403418
/* Define to 1 if you have the `random' function. */
404419
#undef HAVE_RANDOM
405420

421+
/* Define to 1 if you have the `RAND_OpenSSL' function. */
422+
#undef HAVE_RAND_OPENSSL
423+
406424
/* Define to 1 if you have the <readline.h> header file. */
407425
#undef HAVE_READLINE_H
408426

‎src/interfaces/libpq/fe-secure-openssl.c

Lines changed: 17 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -506,10 +506,6 @@ wildcard_certificate_match(const char *pattern, const char *string)
506506
return 1;
507507
}
508508

509-
#if OPENSSL_VERSION_NUMBER < 0x10100000L
510-
#define ASN1_STRING_get0_data ASN1_STRING_data
511-
#endif
512-
513509
/*
514510
* Check if a name from a server's certificate matches the peer's hostname.
515511
*
@@ -544,7 +540,11 @@ verify_peer_name_matches_certificate_name(PGconn *conn, ASN1_STRING *name_entry,
544540
* There is no guarantee the string returned from the certificate is
545541
* NULL-terminated, so make a copy that is.
546542
*/
543+
#ifdef HAVE_ASN1_STRING_GET0_DATA
547544
namedata = ASN1_STRING_get0_data(name_entry);
545+
#else
546+
namedata = ASN1_STRING_data(name_entry);
547+
#endif
548548
len = ASN1_STRING_length(name_entry);
549549
name = malloc(len + 1);
550550
if (name == NULL)
@@ -732,10 +732,13 @@ verify_peer_name_matches_certificate(PGconn *conn)
732732
return found_match && !got_error;
733733
}
734734

735-
#if defined(ENABLE_THREAD_SAFETY) && OPENSSL_VERSION_NUMBER < 0x10100000L
735+
#if defined(ENABLE_THREAD_SAFETY) && defined(HAVE_CRYPTO_LOCK)
736736
/*
737-
* Callback functions for OpenSSL internal locking. (OpenSSL 1.1.0
738-
* does its own locking, and doesn't need these anymore.)
737+
* Callback functions for OpenSSL internal locking. (OpenSSL 1.1.0
738+
* does its own locking, and doesn't need these anymore. The
739+
* CRYPTO_lock() function was removed in 1.1.0, when the callbacks
740+
* were made obsolete, so we assume that if CRYPTO_lock() exists,
741+
* the callbacks are still required.)
739742
*/
740743

741744
static unsigned long
@@ -765,7 +768,7 @@ pq_lockingcallback(int mode, int n, const char *file, int line)
765768
PGTHREAD_ERROR("failed to unlock mutex");
766769
}
767770
}
768-
#endif /* ENABLE_THREAD_SAFETY && OPENSSL_VERSION_NUMBER < 0x10100000L */
771+
#endif /* ENABLE_THREAD_SAFETY && HAVE_CRYPTO_LOCK */
769772

770773
/*
771774
* Initialize SSL system, in particular creating the SSL_context object
@@ -804,7 +807,7 @@ pgtls_init(PGconn *conn)
804807
if (pthread_mutex_lock(&ssl_config_mutex))
805808
return -1;
806809

807-
#if OPENSSL_VERSION_NUMBER < 0x10100000L
810+
#ifdef HAVE_CRYPTO_LOCK
808811
if (pq_init_crypto_lib)
809812
{
810813
/*
@@ -845,14 +848,14 @@ pgtls_init(PGconn *conn)
845848
CRYPTO_set_locking_callback(pq_lockingcallback);
846849
}
847850
}
848-
#endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */
851+
#endif /* HAVE_CRYPTO_LOCK */
849852
#endif /* ENABLE_THREAD_SAFETY */
850853

851854
if (!SSL_context)
852855
{
853856
if (pq_init_ssl_lib)
854857
{
855-
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
858+
#ifdef HAVE_OPENSSL_INIT_SSL
856859
OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG, NULL);
857860
#else
858861
OPENSSL_config(NULL);
@@ -913,7 +916,7 @@ pgtls_init(PGconn *conn)
913916
static void
914917
destroy_ssl_system(void)
915918
{
916-
#if defined(ENABLE_THREAD_SAFETY) && OPENSSL_VERSION_NUMBER < 0x10100000L
919+
#if defined(ENABLE_THREAD_SAFETY) && defined(HAVE_CRYPTO_LOCK)
917920
/* Mutex is created in initialize_ssl_system() */
918921
if (pthread_mutex_lock(&ssl_config_mutex))
919922
return;
@@ -1628,7 +1631,7 @@ PQsslAttribute(PGconn *conn, const char *attribute_name)
16281631
* to retry; do we need to adopt their logic for that?
16291632
*/
16301633

1631-
#if OPENSSL_VERSION_NUMBER < 0x10100000L
1634+
#ifndef HAVE_BIO_GET_DATA
16321635
#define BIO_get_data(bio) (bio->ptr)
16331636
#define BIO_set_data(bio, data) (bio->ptr = data)
16341637
#endif
@@ -1701,7 +1704,7 @@ my_BIO_s_socket(void)
17011704
if (!my_bio_methods)
17021705
{
17031706
BIO_METHOD *biom = (BIO_METHOD *) BIO_s_socket();
1704-
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
1707+
#ifdef HAVE_BIO_METH_NEW
17051708
int my_bio_index;
17061709

17071710
my_bio_index = BIO_get_new_index();

0 commit comments

Comments
 (0)