Skip to content

Commit 8e278b6

Browse files
michaelpqmichaelpq
committed
Remove support for OpenSSL 1.0.1
Here are some notes about this change: - As X509_get_signature_nid() should always exist (OpenSSL and LibreSSL), hence HAVE_X509_GET_SIGNATURE_NID is now gone. - OPENSSL_API_COMPAT is bumped to 0x10002000L. - One comment related to 1.0.1e introduced by 74242c2 is removed. Upstream OpenSSL still provides long-term support for 1.0.2 in a closed fashion, so removing it is out of scope for a few years, at least. Reviewed-by: Jacob Champion, Daniel Gustafsson Discussion: https://postgr.es/m/ZG3JNursG69dz1lr@paquier.xyz
1 parent 2aeaf80 commit 8e278b6

File tree

14 files changed

+37
-100
lines changed

14 files changed

+37
-100
lines changed

‎configure

+7-9
Original file line numberDiff line numberDiff line change
@@ -12744,9 +12744,9 @@ if test "$with_openssl" = yes ; then
1274412744
fi
1274512745

1274612746
if test "$with_ssl" = openssl ; then
12747-
# Minimum required OpenSSL version is 1.0.1
12747+
# Minimum required OpenSSL version is 1.0.2
1274812748

12749-
$as_echo "#define OPENSSL_API_COMPAT 0x10001000L" >>confdefs.h
12749+
$as_echo "#define OPENSSL_API_COMPAT 0x10002000L" >>confdefs.h
1275012750

1275112751
if test "$PORTNAME" != "win32"; then
1275212752
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for CRYPTO_new_ex_data in -lcrypto" >&5
@@ -12961,15 +12961,13 @@ else
1296112961
fi
1296212962

1296312963
fi
12964-
# Functions introduced in OpenSSL 1.0.2. LibreSSL does not have
12965-
# SSL_CTX_set_cert_cb().
12966-
for ac_func in X509_get_signature_nid SSL_CTX_set_cert_cb
12964+
# LibreSSL does not have SSL_CTX_set_cert_cb().
12965+
for ac_func in SSL_CTX_set_cert_cb
1296712966
do :
12968-
as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
12969-
ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
12970-
if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
12967+
ac_fn_c_check_func "$LINENO" "SSL_CTX_set_cert_cb" "ac_cv_func_SSL_CTX_set_cert_cb"
12968+
if test "x$ac_cv_func_SSL_CTX_set_cert_cb" = xyes; then :
1297112969
cat >>confdefs.h <<_ACEOF
12972-
#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
12970+
#define HAVE_SSL_CTX_SET_CERT_CB 1
1297312971
_ACEOF
1297412972

1297512973
fi

‎configure.ac

+4-4
Original file line numberDiff line numberDiff line change
@@ -1367,8 +1367,8 @@ fi
13671367

13681368
if test "$with_ssl" = openssl ; then
13691369
dnl Order matters!
1370-
# Minimum required OpenSSL version is 1.0.1
1371-
AC_DEFINE(OPENSSL_API_COMPAT, [0x10001000L],
1370+
# Minimum required OpenSSL version is 1.0.2
1371+
AC_DEFINE(OPENSSL_API_COMPAT, [0x10002000L],
13721372
[Define to the OpenSSL API version in use. This avoids deprecation warnings from newer OpenSSL versions.])
13731373
if test "$PORTNAME" != "win32"; then
13741374
AC_CHECK_LIB(crypto, CRYPTO_new_ex_data, [], [AC_MSG_ERROR([library 'crypto' is required for OpenSSL])])
@@ -1377,9 +1377,9 @@ if test "$with_ssl" = openssl ; then
13771377
AC_SEARCH_LIBS(CRYPTO_new_ex_data, [eay32 crypto], [], [AC_MSG_ERROR([library 'eay32' or 'crypto' is required for OpenSSL])])
13781378
AC_SEARCH_LIBS(SSL_new, [ssleay32 ssl], [], [AC_MSG_ERROR([library 'ssleay32' or 'ssl' is required for OpenSSL])])
13791379
fi
1380-
# Functions introduced in OpenSSL 1.0.2. LibreSSL does not have
1380+
# Function introduced in OpenSSL 1.0.2. LibreSSL does not have
13811381
# SSL_CTX_set_cert_cb().
1382-
AC_CHECK_FUNCS([X509_get_signature_nid SSL_CTX_set_cert_cb])
1382+
AC_CHECK_FUNCS([SSL_CTX_set_cert_cb])
13831383
# Functions introduced in OpenSSL 1.1.0. We used to check for
13841384
# OPENSSL_VERSION_NUMBER, but that didn't work with 1.1.0, because LibreSSL
13851385
# defines OPENSSL_VERSION_NUMBER to claim version 2.0.0, even though it

‎doc/src/sgml/installation.sgml

+1-1
Original file line numberDiff line numberDiff line change
@@ -275,7 +275,7 @@ documentation. See standalone-profile.xsl for details.
275275
encrypted client connections. <productname>OpenSSL</productname> is
276276
also required for random number generation on platforms that do not
277277
have <filename>/dev/urandom</filename> (except Windows). The minimum
278-
required version is 1.0.1.
278+
required version is 1.0.2.
279279
</para>
280280
</listitem>
281281

‎meson.build

+3-4
Original file line numberDiff line numberDiff line change
@@ -1266,9 +1266,8 @@ if sslopt in ['auto', 'openssl']
12661266
['CRYPTO_new_ex_data', {'required': true}],
12671267
['SSL_new', {'required': true}],
12681268

1269-
# Functions introduced in OpenSSL 1.0.2.
1270-
['X509_get_signature_nid'],
1271-
['SSL_CTX_set_cert_cb'], # not in LibreSSL
1269+
# Functions introduced in OpenSSL 1.0.2, not in LibreSSL.
1270+
['SSL_CTX_set_cert_cb'],
12721271

12731272
# Functions introduced in OpenSSL 1.1.0. We used to check for
12741273
# OPENSSL_VERSION_NUMBER, but that didn't work with 1.1.0, because LibreSSL
@@ -1310,7 +1309,7 @@ if sslopt in ['auto', 'openssl']
13101309
if are_openssl_funcs_complete
13111310
cdata.set('USE_OPENSSL', 1,
13121311
description: 'Define to 1 to build with OpenSSL support. (-Dssl=openssl)')
1313-
cdata.set('OPENSSL_API_COMPAT', '0x10001000L',
1312+
cdata.set('OPENSSL_API_COMPAT', '0x10002000L',
13141313
description: 'Define to the OpenSSL API version in use. This avoids deprecation warnings from newer OpenSSL versions.')
13151314
ssl_library = 'openssl'
13161315
else

‎src/backend/libpq/auth-scram.c

+9-11
Original file line numberDiff line numberDiff line change
@@ -209,10 +209,9 @@ scram_get_mechanisms(Port *port, StringInfo buf)
209209
/*
210210
* Advertise the mechanisms in decreasing order of importance. So the
211211
* channel-binding variants go first, if they are supported. Channel
212-
* binding is only supported with SSL, and only if the SSL implementation
213-
* has a function to get the certificate's hash.
212+
* binding is only supported with SSL.
214213
*/
215-
#ifdef HAVE_BE_TLS_GET_CERTIFICATE_HASH
214+
#ifdef USE_SSL
216215
if (port->ssl_in_use)
217216
{
218217
appendStringInfoString(buf, SCRAM_SHA_256_PLUS_NAME);
@@ -251,13 +250,12 @@ scram_init(Port *port, const char *selected_mech, const char *shadow_pass)
251250
/*
252251
* Parse the selected mechanism.
253252
*
254-
* Note that if we don't support channel binding, either because the SSL
255-
* implementation doesn't support it or we're not using SSL at all, we
256-
* would not have advertised the PLUS variant in the first place. If the
257-
* client nevertheless tries to select it, it's a protocol violation like
258-
* selecting any other SASL mechanism we don't support.
253+
* Note that if we don't support channel binding, or if we're not using
254+
* SSL at all, we would not have advertised the PLUS variant in the first
255+
* place. If the client nevertheless tries to select it, it's a protocol
256+
* violation like selecting any other SASL mechanism we don't support.
259257
*/
260-
#ifdef HAVE_BE_TLS_GET_CERTIFICATE_HASH
258+
#ifdef USE_SSL
261259
if (strcmp(selected_mech, SCRAM_SHA_256_PLUS_NAME) == 0 && port->ssl_in_use)
262260
state->channel_binding_in_use = true;
263261
else
@@ -1010,7 +1008,7 @@ read_client_first_message(scram_state *state, const char *input)
10101008
errmsg("malformed SCRAM message"),
10111009
errdetail("The client selected SCRAM-SHA-256-PLUS, but the SCRAM message does not include channel binding data.")));
10121010

1013-
#ifdef HAVE_BE_TLS_GET_CERTIFICATE_HASH
1011+
#ifdef USE_SSL
10141012
if (state->port->ssl_in_use)
10151013
ereport(ERROR,
10161014
(errcode(ERRCODE_INVALID_AUTHORIZATION_SPECIFICATION),
@@ -1306,7 +1304,7 @@ read_client_final_message(scram_state *state, const char *input)
13061304
channel_binding = read_attr_value(&p, 'c');
13071305
if (state->channel_binding_in_use)
13081306
{
1309-
#ifdef HAVE_BE_TLS_GET_CERTIFICATE_HASH
1307+
#ifdef USE_SSL
13101308
const char *cbind_data = NULL;
13111309
size_t cbind_data_len = 0;
13121310
size_t cbind_header_len;

‎src/backend/libpq/be-secure-openssl.c

-4
Original file line numberDiff line numberDiff line change
@@ -831,8 +831,6 @@ be_tls_write(Port *port, void *ptr, size_t len, int *waitfor)
831831
*
832832
* These functions are closely modelled on the standard socket BIO in OpenSSL;
833833
* see sock_read() and sock_write() in OpenSSL's crypto/bio/bss_sock.c.
834-
* XXX OpenSSL 1.0.1e considers many more errcodes than just EINTR as reasons
835-
* to retry; do we need to adopt their logic for that?
836834
*/
837835

838836
#ifndef HAVE_BIO_GET_DATA
@@ -1429,7 +1427,6 @@ be_tls_get_peer_serial(Port *port, char *ptr, size_t len)
14291427
ptr[0] = '\0';
14301428
}
14311429

1432-
#if defined(HAVE_X509_GET_SIGNATURE_NID) || defined(HAVE_X509_GET_SIGNATURE_INFO)
14331430
char *
14341431
be_tls_get_certificate_hash(Port *port, size_t *len)
14351432
{
@@ -1488,7 +1485,6 @@ be_tls_get_certificate_hash(Port *port, size_t *len)
14881485

14891486
return cert_hash;
14901487
}
1491-
#endif
14921488

14931489
/*
14941490
* Convert an X509 subject name to a cstring.

‎src/include/libpq/libpq-be.h

-6
Original file line numberDiff line numberDiff line change
@@ -305,14 +305,8 @@ extern void be_tls_get_peer_serial(Port *port, char *ptr, size_t len);
305305
*
306306
* The result is a palloc'd hash of the server certificate with its
307307
* size, and NULL if there is no certificate available.
308-
*
309-
* This is not supported with old versions of OpenSSL that don't have
310-
* the X509_get_signature_nid() function.
311308
*/
312-
#if defined(USE_OPENSSL) && (defined(HAVE_X509_GET_SIGNATURE_NID) || defined(HAVE_X509_GET_SIGNATURE_INFO))
313-
#define HAVE_BE_TLS_GET_CERTIFICATE_HASH
314309
extern char *be_tls_get_certificate_hash(Port *port, size_t *len);
315-
#endif
316310

317311
/* init hook for SSL, the default sets the password callback if appropriate */
318312
#ifdef USE_OPENSSL

‎src/include/pg_config.h.in

-3
Original file line numberDiff line numberDiff line change
@@ -529,9 +529,6 @@
529529
/* Define to 1 if you have the `X509_get_signature_info' function. */
530530
#undef HAVE_X509_GET_SIGNATURE_INFO
531531

532-
/* Define to 1 if you have the `X509_get_signature_nid' function. */
533-
#undef HAVE_X509_GET_SIGNATURE_NID
534-
535532
/* Define to 1 if the assembler supports X86_64's POPCNTQ instruction. */
536533
#undef HAVE_X86_64_POPCNTQ
537534

‎src/interfaces/libpq/fe-auth-scram.c

+4-4
Original file line numberDiff line numberDiff line change
@@ -401,7 +401,7 @@ build_client_first_message(fe_scram_state *state)
401401
Assert(conn->ssl_in_use);
402402
appendPQExpBufferStr(&buf, "p=tls-server-end-point");
403403
}
404-
#ifdef HAVE_PGTLS_GET_PEER_CERTIFICATE_HASH
404+
#ifdef USE_SSL
405405
else if (conn->channel_binding[0] != 'd' && /* disable */
406406
conn->ssl_in_use)
407407
{
@@ -474,7 +474,7 @@ build_client_final_message(fe_scram_state *state)
474474
*/
475475
if (strcmp(state->sasl_mechanism, SCRAM_SHA_256_PLUS_NAME) == 0)
476476
{
477-
#ifdef HAVE_PGTLS_GET_PEER_CERTIFICATE_HASH
477+
#ifdef USE_SSL
478478
char *cbind_data = NULL;
479479
size_t cbind_data_len = 0;
480480
size_t cbind_header_len;
@@ -540,9 +540,9 @@ build_client_final_message(fe_scram_state *state)
540540
appendPQExpBufferStr(&conn->errorMessage,
541541
"channel binding not supported by this build\n");
542542
return NULL;
543-
#endif /* HAVE_PGTLS_GET_PEER_CERTIFICATE_HASH */
543+
#endif /* USE_SSL */
544544
}
545-
#ifdef HAVE_PGTLS_GET_PEER_CERTIFICATE_HASH
545+
#ifdef USE_SSL
546546
else if (conn->channel_binding[0] != 'd' && /* disable */
547547
conn->ssl_in_use)
548548
appendPQExpBufferStr(&buf, "c=eSws"); /* base64 of "y,," */

‎src/interfaces/libpq/fe-auth.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -478,7 +478,7 @@ pg_SASL_init(PGconn *conn, int payloadlen)
478478
{
479479
/* The server has offered SCRAM-SHA-256-PLUS. */
480480

481-
#ifdef HAVE_PGTLS_GET_PEER_CERTIFICATE_HASH
481+
#ifdef USE_SSL
482482
/*
483483
* The client supports channel binding, which is chosen if
484484
* channel_binding is not disabled.

‎src/interfaces/libpq/fe-secure-openssl.c

-4
Original file line numberDiff line numberDiff line change
@@ -364,7 +364,6 @@ pgtls_write(PGconn *conn, const void *ptr, size_t len)
364364
return n;
365365
}
366366

367-
#if defined(HAVE_X509_GET_SIGNATURE_NID) || defined(HAVE_X509_GET_SIGNATURE_INFO)
368367
char *
369368
pgtls_get_peer_certificate_hash(PGconn *conn, size_t *len)
370369
{
@@ -439,7 +438,6 @@ pgtls_get_peer_certificate_hash(PGconn *conn, size_t *len)
439438

440439
return cert_hash;
441440
}
442-
#endif /* HAVE_X509_GET_SIGNATURE_NID */
443441

444442
/* ------------------------------------------------------------ */
445443
/* OpenSSL specific code */
@@ -1826,8 +1824,6 @@ PQsslAttribute(PGconn *conn, const char *attribute_name)
18261824
*
18271825
* These functions are closely modelled on the standard socket BIO in OpenSSL;
18281826
* see sock_read() and sock_write() in OpenSSL's crypto/bio/bss_sock.c.
1829-
* XXX OpenSSL 1.0.1e considers many more errcodes than just EINTR as reasons
1830-
* to retry; do we need to adopt their logic for that?
18311827
*/
18321828

18331829
#ifndef HAVE_BIO_GET_DATA

‎src/interfaces/libpq/libpq-int.h

-6
Original file line numberDiff line numberDiff line change
@@ -833,14 +833,8 @@ extern ssize_t pgtls_write(PGconn *conn, const void *ptr, size_t len);
833833
*
834834
* NULL is sent back to the caller in the event of an error, with an
835835
* error message for the caller to consume.
836-
*
837-
* This is not supported with old versions of OpenSSL that don't have
838-
* the X509_get_signature_nid() function.
839836
*/
840-
#if defined(USE_OPENSSL) && (defined(HAVE_X509_GET_SIGNATURE_NID) || defined(HAVE_X509_GET_SIGNATURE_INFO))
841-
#define HAVE_PGTLS_GET_PEER_CERTIFICATE_HASH
842837
extern char *pgtls_get_peer_certificate_hash(PGconn *conn, size_t *len);
843-
#endif
844838

845839
/*
846840
* Verify that the server certificate matches the host name we connected to.

‎src/test/ssl/t/002_scram.pl

+7-34
Original file line numberDiff line numberDiff line change
@@ -44,9 +44,6 @@ sub switch_server_cert
4444
# This is the pattern to use in pg_hba.conf to match incoming connections.
4545
my $SERVERHOSTCIDR = '127.0.0.1/32';
4646

47-
# Determine whether build supports tls-server-end-point.
48-
my $supports_tls_server_end_point =
49-
check_pg_config("#define HAVE_X509_GET_SIGNATURE_NID 1");
5047
# Determine whether build supports detection of hash algorithms for
5148
# RSA-PSS certificates.
5249
my $supports_rsapss_certs =
@@ -90,21 +87,9 @@ sub switch_server_cert
9087
expected_stderr => qr/invalid channel_binding value: "invalid_value"/);
9188
$node->connect_ok("$common_connstr user=ssltestuser channel_binding=disable",
9289
"SCRAM with SSL and channel_binding=disable");
93-
if ($supports_tls_server_end_point)
94-
{
95-
$node->connect_ok(
96-
"$common_connstr user=ssltestuser channel_binding=require",
97-
"SCRAM with SSL and channel_binding=require");
98-
}
99-
else
100-
{
101-
$node->connect_fails(
102-
"$common_connstr user=ssltestuser channel_binding=require",
103-
"SCRAM with SSL and channel_binding=require",
104-
expected_stderr =>
105-
qr/channel binding is required, but server did not offer an authentication method that supports channel binding/
106-
);
107-
}
90+
$node->connect_ok(
91+
"$common_connstr user=ssltestuser channel_binding=require",
92+
"SCRAM with SSL and channel_binding=require");
10893

10994
# Now test when the user has an MD5-encrypted password; should fail
11095
$node->connect_fails(
@@ -152,22 +137,10 @@ sub switch_server_cert
152137
expected_stderr =>
153138
qr/channel binding required but not supported by server's authentication request/
154139
);
155-
if ($supports_tls_server_end_point)
156-
{
157-
$node->connect_ok(
158-
"$common_connstr user=ssltestuser channel_binding=require require_auth=scram-sha-256",
159-
"SCRAM with SSL, channel_binding=require, and require_auth=scram-sha-256"
160-
);
161-
}
162-
else
163-
{
164-
$node->connect_fails(
165-
"$common_connstr user=ssltestuser channel_binding=require require_auth=scram-sha-256",
166-
"SCRAM with SSL, channel_binding=require, and require_auth=scram-sha-256",
167-
expected_stderr =>
168-
qr/channel binding is required, but server did not offer an authentication method that supports channel binding/
169-
);
170-
}
140+
$node->connect_ok(
141+
"$common_connstr user=ssltestuser channel_binding=require require_auth=scram-sha-256",
142+
"SCRAM with SSL, channel_binding=require, and require_auth=scram-sha-256"
143+
);
171144

172145
# Now test with a server certificate that uses the RSA-PSS algorithm.
173146
# This checks that the certificate can be loaded and that channel binding

‎src/tools/msvc/Solution.pm

+1-9
Original file line numberDiff line numberDiff line change
@@ -371,7 +371,6 @@ sub GenerateFiles
371371
HAVE_UUID_UUID_H => undef,
372372
HAVE_WCSTOMBS_L => 1,
373373
HAVE_VISIBILITY_ATTRIBUTE => undef,
374-
HAVE_X509_GET_SIGNATURE_NID => 1,
375374
HAVE_X509_GET_SIGNATURE_INFO => undef,
376375
HAVE_X86_64_POPCNTQ => undef,
377376
HAVE__BOOL => undef,
@@ -488,6 +487,7 @@ sub GenerateFiles
488487
if ($self->{options}->{openssl})
489488
{
490489
$define{USE_OPENSSL} = 1;
490+
$define{HAVE_SSL_CTX_SET_CERT_CB} = 1;
491491

492492
my ($digit1, $digit2, $digit3) = $self->GetOpenSSLVersion();
493493

@@ -509,14 +509,6 @@ sub GenerateFiles
509509
$define{HAVE_HMAC_CTX_NEW} = 1;
510510
$define{HAVE_OPENSSL_INIT_SSL} = 1;
511511
}
512-
513-
# Symbols needed with OpenSSL 1.0.2 and above.
514-
if ( ($digit1 >= '3' && $digit2 >= '0' && $digit3 >= '0')
515-
|| ($digit1 >= '1' && $digit2 >= '1' && $digit3 >= '0')
516-
|| ($digit1 >= '1' && $digit2 >= '0' && $digit3 >= '2'))
517-
{
518-
$define{HAVE_SSL_CTX_SET_CERT_CB} = 1;
519-
}
520512
}
521513

522514
$self->GenerateConfigHeader('src/include/pg_config.h', \%define, 1);

0 commit comments

Comments
 (0)