Skip to content

Commit 9b7cd59

Browse files
hlinnakahlinnaka
committed
Remove support for OpenSSL versions older than 0.9.8.
OpenSSL officially only supports 1.0.1 and newer. Some OS distributions still provide patches for 0.9.8, but anything older than that is not interesting anymore. Let's simplify things by removing compatibility code. Andreas Karlsson, with small changes by me.
1 parent cf34fdb commit 9b7cd59

File tree

7 files changed

+20
-206
lines changed

7 files changed

+20
-206
lines changed

‎contrib/pgcrypto/openssl.c

Lines changed: 2 additions & 150 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@
3737
#include <openssl/blowfish.h>
3838
#include <openssl/cast.h>
3939
#include <openssl/des.h>
40+
#include <openssl/aes.h>
4041
#include <openssl/rand.h>
4142
#include <openssl/err.h>
4243

@@ -46,155 +47,6 @@
4647
#define MAX_KEY (512/8)
4748
#define MAX_IV (128/8)
4849

49-
/*
50-
* Compatibility with OpenSSL 0.9.6
51-
*
52-
* It needs AES and newer DES and digest API.
53-
*/
54-
#if OPENSSL_VERSION_NUMBER >= 0x00907000L
55-
56-
/*
57-
* Nothing needed for OpenSSL 0.9.7+
58-
*/
59-
60-
#include <openssl/aes.h>
61-
#else /* old OPENSSL */
62-
63-
/*
64-
* Emulate OpenSSL AES.
65-
*/
66-
67-
#include "rijndael.c"
68-
69-
#define AES_ENCRYPT 1
70-
#define AES_DECRYPT 0
71-
#define AES_KEY rijndael_ctx
72-
73-
static int
74-
AES_set_encrypt_key(const uint8 *key, int kbits, AES_KEY *ctx)
75-
{
76-
aes_set_key(ctx, key, kbits, 1);
77-
return 0;
78-
}
79-
80-
static int
81-
AES_set_decrypt_key(const uint8 *key, int kbits, AES_KEY *ctx)
82-
{
83-
aes_set_key(ctx, key, kbits, 0);
84-
return 0;
85-
}
86-
87-
static void
88-
AES_ecb_encrypt(const uint8 *src, uint8 *dst, AES_KEY *ctx, int enc)
89-
{
90-
memcpy(dst, src, 16);
91-
if (enc)
92-
aes_ecb_encrypt(ctx, dst, 16);
93-
else
94-
aes_ecb_decrypt(ctx, dst, 16);
95-
}
96-
97-
static void
98-
AES_cbc_encrypt(const uint8 *src, uint8 *dst, int len, AES_KEY *ctx, uint8 *iv, int enc)
99-
{
100-
memcpy(dst, src, len);
101-
if (enc)
102-
{
103-
aes_cbc_encrypt(ctx, iv, dst, len);
104-
memcpy(iv, dst + len - 16, 16);
105-
}
106-
else
107-
{
108-
aes_cbc_decrypt(ctx, iv, dst, len);
109-
memcpy(iv, src + len - 16, 16);
110-
}
111-
}
112-
113-
/*
114-
* Emulate DES_* API
115-
*/
116-
117-
#define DES_key_schedule des_key_schedule
118-
#define DES_cblock des_cblock
119-
#define DES_set_key(k, ks) \
120-
des_set_key((k), *(ks))
121-
#define DES_ecb_encrypt(i, o, k, e) \
122-
des_ecb_encrypt((i), (o), *(k), (e))
123-
#define DES_ncbc_encrypt(i, o, l, k, iv, e) \
124-
des_ncbc_encrypt((i), (o), (l), *(k), (iv), (e))
125-
#define DES_ecb3_encrypt(i, o, k1, k2, k3, e) \
126-
des_ecb3_encrypt((des_cblock *)(i), (des_cblock *)(o), \
127-
*(k1), *(k2), *(k3), (e))
128-
#define DES_ede3_cbc_encrypt(i, o, l, k1, k2, k3, iv, e) \
129-
des_ede3_cbc_encrypt((i), (o), \
130-
(l), *(k1), *(k2), *(k3), (iv), (e))
131-
132-
/*
133-
* Emulate newer digest API.
134-
*/
135-
136-
static void
137-
EVP_MD_CTX_init(EVP_MD_CTX *ctx)
138-
{
139-
memset(ctx, 0, sizeof(*ctx));
140-
}
141-
142-
static int
143-
EVP_MD_CTX_cleanup(EVP_MD_CTX *ctx)
144-
{
145-
px_memset(ctx, 0, sizeof(*ctx));
146-
return 1;
147-
}
148-
149-
static int
150-
EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *md, void *engine)
151-
{
152-
EVP_DigestInit(ctx, md);
153-
return 1;
154-
}
155-
156-
static int
157-
EVP_DigestFinal_ex(EVP_MD_CTX *ctx, unsigned char *res, unsigned int *len)
158-
{
159-
EVP_DigestFinal(ctx, res, len);
160-
return 1;
161-
}
162-
#endif /* old OpenSSL */
163-
164-
/*
165-
* Provide SHA2 for older OpenSSL < 0.9.8
166-
*/
167-
#if OPENSSL_VERSION_NUMBER < 0x00908000L
168-
169-
#include "sha2.c"
170-
#include "internal-sha2.c"
171-
172-
typedef void (*init_f) (PX_MD *md);
173-
174-
static int
175-
compat_find_digest(const char *name, PX_MD **res)
176-
{
177-
init_f init = NULL;
178-
179-
if (pg_strcasecmp(name, "sha224") == 0)
180-
init = init_sha224;
181-
else if (pg_strcasecmp(name, "sha256") == 0)
182-
init = init_sha256;
183-
else if (pg_strcasecmp(name, "sha384") == 0)
184-
init = init_sha384;
185-
else if (pg_strcasecmp(name, "sha512") == 0)
186-
init = init_sha512;
187-
else
188-
return PXE_NO_HASH;
189-
190-
*res = px_alloc(sizeof(PX_MD));
191-
init(*res);
192-
return 0;
193-
}
194-
#else
195-
#define compat_find_digest(name, res) (PXE_NO_HASH)
196-
#endif
197-
19850
/*
19951
* Hashes
20052
*/
@@ -275,7 +127,7 @@ px_find_digest(const char *name, PX_MD **res)
275127

276128
md = EVP_get_digestbyname(name);
277129
if (md == NULL)
278-
return compat_find_digest(name, res);
130+
return PXE_NO_HASH;
279131

280132
digest = px_alloc(sizeof(*digest));
281133
digest->algo = md;

‎doc/src/sgml/installation.sgml

Lines changed: 11 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -252,10 +252,17 @@ su - postgres
252252

253253
<listitem>
254254
<para>
255-
You need <application>Kerberos</>, <productname>OpenSSL</>,
256-
<productname>OpenLDAP</>, and/or
257-
<application>PAM</>, if you want to support authentication or
258-
encryption using those services.
255+
You need <productname>OpenSSL</>, if you want to support
256+
encrypted client connections. The minimum required version is
257+
0.9.8.
258+
</para>
259+
</listitem>
260+
261+
<listitem>
262+
<para>
263+
You need <application>Kerberos</>, <productname>OpenLDAP</>,
264+
and/or <application>PAM</>, if you want to support authentication
265+
using those services.
259266
</para>
260267
</listitem>
261268

@@ -2826,30 +2833,6 @@ MANPATH=/usr/lib/scohelp/%L/man:/usr/dt/man:/usr/man:/usr/share/man:scohelp:/usr
28262833
</para>
28272834
</sect3>
28282835

2829-
<sect3>
2830-
<title>Problems with OpenSSL</title>
2831-
2832-
<para>
2833-
When you build PostgreSQL with OpenSSL support you might get
2834-
compilation errors in the following files:
2835-
<itemizedlist>
2836-
<listitem><para><filename>src/backend/libpq/crypt.c</filename></para></listitem>
2837-
<listitem><para><filename>src/backend/libpq/password.c</filename></para></listitem>
2838-
<listitem><para><filename>src/interfaces/libpq/fe-auth.c</filename></para></listitem>
2839-
<listitem><para><filename>src/interfaces/libpq/fe-connect.c</filename></para></listitem>
2840-
</itemizedlist>
2841-
2842-
This is because of a namespace conflict between the standard
2843-
<filename>/usr/include/crypt.h</filename> header and the header
2844-
files provided by OpenSSL.
2845-
</para>
2846-
2847-
<para>
2848-
Upgrading your OpenSSL installation to version 0.9.6a fixes this
2849-
problem. Solaris 9 and above has a newer version of OpenSSL.
2850-
</para>
2851-
</sect3>
2852-
28532836
<sect3>
28542837
<title>configure Complains About a Failed Test Program</title>
28552838

‎doc/src/sgml/libpq.sgml

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1238,8 +1238,7 @@ postgresql://%2Fvar%2Flib%2Fpostgresql/dbname
12381238
<listitem>
12391239
<para>
12401240
If set to 1 (default), data sent over SSL connections will be
1241-
compressed (this requires <productname>OpenSSL</> version
1242-
0.9.8 or later).
1241+
compressed.
12431242
If set to 0, compression will be disabled (this requires
12441243
<productname>OpenSSL</> 1.0.0 or later).
12451244
This parameter is ignored if a connection without SSL is made,

‎doc/src/sgml/pgcrypto.sgml

Lines changed: 3 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1184,12 +1184,12 @@ gen_random_uuid() returns uuid
11841184
<row>
11851185
<entry>SHA224/256/384/512</entry>
11861186
<entry>yes</entry>
1187-
<entry>yes (Note 1)</entry>
1187+
<entry>yes</entry>
11881188
</row>
11891189
<row>
11901190
<entry>Other digest algorithms</entry>
11911191
<entry>no</entry>
1192-
<entry>yes (Note 2)</entry>
1192+
<entry>yes (Note 1)</entry>
11931193
</row>
11941194
<row>
11951195
<entry>Blowfish</entry>
@@ -1199,7 +1199,7 @@ gen_random_uuid() returns uuid
11991199
<row>
12001200
<entry>AES</entry>
12011201
<entry>yes</entry>
1202-
<entry>yes (Note 3)</entry>
1202+
<entry>yes</entry>
12031203
</row>
12041204
<row>
12051205
<entry>DES/3DES/CAST5</entry>
@@ -1230,25 +1230,13 @@ gen_random_uuid() returns uuid
12301230
</para>
12311231

12321232
<orderedlist>
1233-
<listitem>
1234-
<para>
1235-
SHA2 algorithms were added to OpenSSL in version 0.9.8. For
1236-
older versions, <filename>pgcrypto</> will use built-in code.
1237-
</para>
1238-
</listitem>
12391233
<listitem>
12401234
<para>
12411235
Any digest algorithm OpenSSL supports is automatically picked up.
12421236
This is not possible with ciphers, which need to be supported
12431237
explicitly.
12441238
</para>
12451239
</listitem>
1246-
<listitem>
1247-
<para>
1248-
AES is included in OpenSSL since version 0.9.7. For
1249-
older versions, <filename>pgcrypto</> will use built-in code.
1250-
</para>
1251-
</listitem>
12521240
</orderedlist>
12531241
</sect3>
12541242

‎src/backend/libpq/be-secure-openssl.c

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -53,10 +53,8 @@
5353

5454
#include <openssl/ssl.h>
5555
#include <openssl/dh.h>
56-
#if SSLEAY_VERSION_NUMBER >= 0x0907000L
5756
#include <openssl/conf.h>
58-
#endif
59-
#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_ECDH)
57+
#ifndef OPENSSL_NO_ECDH
6058
#include <openssl/ec.h>
6159
#endif
6260

@@ -166,9 +164,7 @@ be_tls_init(void)
166164

167165
if (!SSL_context)
168166
{
169-
#if SSLEAY_VERSION_NUMBER >= 0x0907000L
170167
OPENSSL_config(NULL);
171-
#endif
172168
SSL_library_init();
173169
SSL_load_error_strings();
174170

@@ -978,7 +974,7 @@ info_cb(const SSL *ssl, int type, int args)
978974
static void
979975
initialize_ecdh(void)
980976
{
981-
#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_ECDH)
977+
#ifndef OPENSSL_NO_ECDH
982978
EC_KEY *ecdh;
983979
int nid;
984980

‎src/interfaces/libpq/fe-secure-openssl.c

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -54,9 +54,7 @@
5454
#endif
5555

5656
#include <openssl/ssl.h>
57-
#if (SSLEAY_VERSION_NUMBER >= 0x00907000L)
5857
#include <openssl/conf.h>
59-
#endif
6058
#ifdef USE_SSL_ENGINE
6159
#include <openssl/engine.h>
6260
#endif
@@ -848,9 +846,7 @@ pgtls_init(PGconn *conn)
848846
{
849847
if (pq_init_ssl_lib)
850848
{
851-
#if SSLEAY_VERSION_NUMBER >= 0x00907000L
852849
OPENSSL_config(NULL);
853-
#endif
854850
SSL_library_init();
855851
SSL_load_error_strings();
856852
}

‎src/interfaces/libpq/libpq-int.h

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,7 @@ typedef struct
7777
#include <openssl/ssl.h>
7878
#include <openssl/err.h>
7979

80-
#if (SSLEAY_VERSION_NUMBER >= 0x00907000L) && !defined(OPENSSL_NO_ENGINE)
80+
#ifndef OPENSSL_NO_ENGINE
8181
#define USE_SSL_ENGINE
8282
#endif
8383
#endif /* USE_OPENSSL */

0 commit comments

Comments
 (0)