Skip to content

Commit fe61df7

Browse files
michaelpqmichaelpq
committed
Introduce --with-ssl={openssl} as a configure option
This is a replacement for the existing --with-openssl, extending the logic to make easier the addition of new SSL libraries. The grammar is chosen to be similar to --with-uuid, where multiple values can be chosen, with "openssl" as the only supported value for now. The original switch, --with-openssl, is kept for compatibility. Author: Daniel Gustafsson, Michael Paquier Reviewed-by: Jacob Champion Discussion: https://postgr.es/m/FAB21FC8-0F62-434F-AA78-6BD9336D630A@yesql.se
1 parent 7c5d57c commit fe61df7

File tree

22 files changed

+137
-82
lines changed

22 files changed

+137
-82
lines changed

‎configure

Lines changed: 70 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -653,6 +653,7 @@ LIBOBJS
653653
UUID_LIBS
654654
LDAP_LIBS_BE
655655
LDAP_LIBS_FE
656+
with_ssl
656657
PTHREAD_CFLAGS
657658
PTHREAD_LIBS
658659
PTHREAD_CC
@@ -709,7 +710,6 @@ with_uuid
709710
with_readline
710711
with_systemd
711712
with_selinux
712-
with_openssl
713713
with_ldap
714714
with_krb_srvnam
715715
krb_srvtab
@@ -854,7 +854,6 @@ with_pam
854854
with_bsd_auth
855855
with_ldap
856856
with_bonjour
857-
with_openssl
858857
with_selinux
859858
with_systemd
860859
with_readline
@@ -866,6 +865,8 @@ with_libxslt
866865
with_system_tzdata
867866
with_zlib
868867
with_gnu_ld
868+
with_ssl
869+
with_openssl
869870
enable_largefile
870871
'
871872
ac_precious_vars='build_alias
@@ -1556,7 +1557,6 @@ Optional Packages:
15561557
--with-bsd-auth build with BSD Authentication support
15571558
--with-ldap build with LDAP support
15581559
--with-bonjour build with Bonjour support
1559-
--with-openssl build with OpenSSL support
15601560
--with-selinux build with SELinux support
15611561
--with-systemd build with systemd support
15621562
--without-readline do not use GNU Readline nor BSD Libedit for editing
@@ -1570,6 +1570,8 @@ Optional Packages:
15701570
use system time zone data in DIR
15711571
--without-zlib do not use Zlib
15721572
--with-gnu-ld assume the C compiler uses GNU ld [default=no]
1573+
--with-ssl=LIB use LIB for SSL/TLS support (openssl)
1574+
--with-openssl obsolete spelling of --with-ssl=openssl
15731575

15741576
Some influential environment variables:
15751577
CC C compiler command
@@ -8070,41 +8072,6 @@ fi
80708072
$as_echo "$with_bonjour" >&6; }
80718073

80728074

8073-
#
8074-
# OpenSSL
8075-
#
8076-
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether to build with OpenSSL support" >&5
8077-
$as_echo_n "checking whether to build with OpenSSL support... " >&6; }
8078-
8079-
8080-
8081-
# Check whether --with-openssl was given.
8082-
if test "${with_openssl+set}" = set; then :
8083-
withval=$with_openssl;
8084-
case $withval in
8085-
yes)
8086-
8087-
$as_echo "#define USE_OPENSSL 1" >>confdefs.h
8088-
8089-
;;
8090-
no)
8091-
:
8092-
;;
8093-
*)
8094-
as_fn_error $? "no argument expected for --with-openssl option" "$LINENO" 5
8095-
;;
8096-
esac
8097-
8098-
else
8099-
with_openssl=no
8100-
8101-
fi
8102-
8103-
8104-
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $with_openssl" >&5
8105-
$as_echo "$with_openssl" >&6; }
8106-
8107-
81088075
#
81098076
# SELinux
81108077
#
@@ -12174,7 +12141,64 @@ fi
1217412141
fi
1217512142
fi
1217612143

12144+
#
12145+
# SSL Library
12146+
#
12147+
# There is currently only one supported SSL/TLS library: OpenSSL.
12148+
#
12149+
12150+
12151+
12152+
# Check whether --with-ssl was given.
12153+
if test "${with_ssl+set}" = set; then :
12154+
withval=$with_ssl;
12155+
case $withval in
12156+
yes)
12157+
as_fn_error $? "argument required for --with-ssl option" "$LINENO" 5
12158+
;;
12159+
no)
12160+
as_fn_error $? "argument required for --with-ssl option" "$LINENO" 5
12161+
;;
12162+
*)
12163+
12164+
;;
12165+
esac
12166+
12167+
fi
12168+
12169+
12170+
if test x"$with_ssl" = x"" ; then
12171+
with_ssl=no
12172+
fi
12173+
12174+
12175+
12176+
# Check whether --with-openssl was given.
12177+
if test "${with_openssl+set}" = set; then :
12178+
withval=$with_openssl;
12179+
case $withval in
12180+
yes)
12181+
:
12182+
;;
12183+
no)
12184+
:
12185+
;;
12186+
*)
12187+
as_fn_error $? "no argument expected for --with-openssl option" "$LINENO" 5
12188+
;;
12189+
esac
12190+
12191+
else
12192+
with_openssl=no
12193+
12194+
fi
12195+
12196+
1217712197
if test "$with_openssl" = yes ; then
12198+
with_ssl=openssl
12199+
fi
12200+
12201+
if test "$with_ssl" = openssl ; then
1217812202
# Minimum required OpenSSL version is 1.0.1
1217912203

1218012204
$as_echo "#define OPENSSL_API_COMPAT 0x10001000L" >>confdefs.h
@@ -12435,8 +12459,14 @@ _ACEOF
1243512459
fi
1243612460
done
1243712461

12462+
12463+
$as_echo "#define USE_OPENSSL 1" >>confdefs.h
12464+
12465+
elif test "$with_ssl" != no ; then
12466+
as_fn_error $? "--with-ssl must specify openssl" "$LINENO" 5
1243812467
fi
1243912468

12469+
1244012470
if test "$with_pam" = yes ; then
1244112471
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for pam_start in -lpam" >&5
1244212472
$as_echo_n "checking for pam_start in -lpam... " >&6; }
@@ -13322,7 +13352,7 @@ done
1332213352

1332313353
fi
1332413354

13325-
if test "$with_openssl" = yes ; then
13355+
if test "$with_ssl" = openssl ; then
1332613356
ac_fn_c_check_header_mongrel "$LINENO" "openssl/ssl.h" "ac_cv_header_openssl_ssl_h" "$ac_includes_default"
1332713357
if test "x$ac_cv_header_openssl_ssl_h" = xyes; then :
1332813358

@@ -18098,7 +18128,7 @@ fi
1809818128
# will be used.
1809918129
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking which random number source to use" >&5
1810018130
$as_echo_n "checking which random number source to use... " >&6; }
18101-
if test x"$with_openssl" = x"yes" ; then
18131+
if test x"$with_ssl" = x"openssl" ; then
1810218132
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: OpenSSL" >&5
1810318133
$as_echo "OpenSSL" >&6; }
1810418134
elif test x"$PORTNAME" = x"win32" ; then

‎configure.ac

Lines changed: 20 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -852,15 +852,6 @@ PGAC_ARG_BOOL(with, bonjour, no,
852852
AC_MSG_RESULT([$with_bonjour])
853853

854854

855-
#
856-
# OpenSSL
857-
#
858-
AC_MSG_CHECKING([whether to build with OpenSSL support])
859-
PGAC_ARG_BOOL(with, openssl, no, [build with OpenSSL support],
860-
[AC_DEFINE([USE_OPENSSL], 1, [Define to build with OpenSSL support. (--with-openssl)])])
861-
AC_MSG_RESULT([$with_openssl])
862-
AC_SUBST(with_openssl)
863-
864855
#
865856
# SELinux
866857
#
@@ -1205,7 +1196,21 @@ if test "$with_gssapi" = yes ; then
12051196
fi
12061197
fi
12071198

1199+
#
1200+
# SSL Library
1201+
#
1202+
# There is currently only one supported SSL/TLS library: OpenSSL.
1203+
#
1204+
PGAC_ARG_REQ(with, ssl, [LIB], [use LIB for SSL/TLS support (openssl)])
1205+
if test x"$with_ssl" = x"" ; then
1206+
with_ssl=no
1207+
fi
1208+
PGAC_ARG_BOOL(with, openssl, no, [obsolete spelling of --with-ssl=openssl])
12081209
if test "$with_openssl" = yes ; then
1210+
with_ssl=openssl
1211+
fi
1212+
1213+
if test "$with_ssl" = openssl ; then
12091214
dnl Order matters!
12101215
# Minimum required OpenSSL version is 1.0.1
12111216
AC_DEFINE(OPENSSL_API_COMPAT, [0x10001000L],
@@ -1229,7 +1234,11 @@ if test "$with_openssl" = yes ; then
12291234
# thread-safety. In 1.1.0, it's no longer required, and CRYPTO_lock()
12301235
# function was removed.
12311236
AC_CHECK_FUNCS([CRYPTO_lock])
1237+
AC_DEFINE([USE_OPENSSL], 1, [Define to 1 if you have OpenSSL support.])
1238+
elif test "$with_ssl" != no ; then
1239+
AC_MSG_ERROR([--with-ssl must specify openssl])
12321240
fi
1241+
AC_SUBST(with_ssl)
12331242

12341243
if test "$with_pam" = yes ; then
12351244
AC_CHECK_LIB(pam, pam_start, [], [AC_MSG_ERROR([library 'pam' is required for PAM])])
@@ -1402,7 +1411,7 @@ if test "$with_gssapi" = yes ; then
14021411
[AC_CHECK_HEADERS(gssapi.h, [], [AC_MSG_ERROR([gssapi.h header file is required for GSSAPI])])])
14031412
fi
14041413

1405-
if test "$with_openssl" = yes ; then
1414+
if test "$with_ssl" = openssl ; then
14061415
AC_CHECK_HEADER(openssl/ssl.h, [], [AC_MSG_ERROR([header file <openssl/ssl.h> is required for OpenSSL])])
14071416
AC_CHECK_HEADER(openssl/err.h, [], [AC_MSG_ERROR([header file <openssl/err.h> is required for OpenSSL])])
14081417
fi
@@ -2159,7 +2168,7 @@ fi
21592168
# first choice, else the native platform sources (Windows API or /dev/urandom)
21602169
# will be used.
21612170
AC_MSG_CHECKING([which random number source to use])
2162-
if test x"$with_openssl" = x"yes" ; then
2171+
if test x"$with_ssl" = x"openssl" ; then
21632172
AC_MSG_RESULT([OpenSSL])
21642173
elif test x"$PORTNAME" = x"win32" ; then
21652174
AC_MSG_RESULT([Windows native])

‎contrib/Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ SUBDIRS = \
5151
unaccent \
5252
vacuumlo
5353

54-
ifeq ($(with_openssl),yes)
54+
ifeq ($(with_ssl),openssl)
5555
SUBDIRS += sslinfo
5656
else
5757
ALWAYS_SUBDIRS += sslinfo

‎contrib/pgcrypto/Makefile

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,8 @@ OSSL_TESTS = sha2 des 3des cast5
1010
ZLIB_TST = pgp-compression
1111
ZLIB_OFF_TST = pgp-zlib-DISABLED
1212

13-
CF_SRCS = $(if $(subst no,,$(with_openssl)), $(OSSL_SRCS), $(INT_SRCS))
14-
CF_TESTS = $(if $(subst no,,$(with_openssl)), $(OSSL_TESTS), $(INT_TESTS))
13+
CF_SRCS = $(if $(subst openssl,,$(with_ssl)), $(INT_SRCS), $(OSSL_SRCS))
14+
CF_TESTS = $(if $(subst openssl,,$(with_ssl)), $(INT_TESTS), $(OSSL_TESTS))
1515
CF_PGP_TESTS = $(if $(subst no,,$(with_zlib)), $(ZLIB_TST), $(ZLIB_OFF_TST))
1616

1717
SRCS = \

‎doc/src/sgml/installation.sgml

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -967,7 +967,7 @@ build-postgresql:
967967
</varlistentry>
968968

969969
<varlistentry>
970-
<term><option>--with-openssl</option>
970+
<term><option>--with-ssl=<replaceable>LIBRARY</replaceable></option>
971971
<indexterm>
972972
<primary>OpenSSL</primary>
973973
<seealso>SSL</seealso>
@@ -976,11 +976,22 @@ build-postgresql:
976976
<listitem>
977977
<para>
978978
Build with support for <acronym>SSL</acronym> (encrypted)
979-
connections. This requires the <productname>OpenSSL</productname>
980-
package to be installed. <filename>configure</filename> will check
981-
for the required header files and libraries to make sure that
982-
your <productname>OpenSSL</productname> installation is sufficient
983-
before proceeding.
979+
connections. The only <replaceable>LIBRARY</replaceable>
980+
supported is <option>openssl</option>. This requires the
981+
<productname>OpenSSL</productname> package to be installed.
982+
<filename>configure</filename> will check for the required
983+
header files and libraries to make sure that your
984+
<productname>OpenSSL</productname> installation is sufficient
985+
before proceeding.
986+
</para>
987+
</listitem>
988+
</varlistentry>
989+
990+
<varlistentry>
991+
<term><option>--with-openssl</option></term>
992+
<listitem>
993+
<para>
994+
Obsolete equivalent of <literal>--with-ssl=openssl</literal>.
984995
</para>
985996
</listitem>
986997
</varlistentry>

‎doc/src/sgml/pgcrypto.sgml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1154,7 +1154,7 @@ gen_random_uuid() returns uuid
11541154
<filename>pgcrypto</filename> configures itself according to the findings of the
11551155
main PostgreSQL <literal>configure</literal> script. The options that
11561156
affect it are <literal>--with-zlib</literal> and
1157-
<literal>--with-openssl</literal>.
1157+
<literal>--with-ssl=openssl</literal>.
11581158
</para>
11591159

11601160
<para>

‎doc/src/sgml/sslinfo.sgml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222

2323
<para>
2424
This extension won't build at all unless the installation was
25-
configured with <literal>--with-openssl</literal>.
25+
configured with <literal>--with-ssl=openssl</literal>.
2626
</para>
2727

2828
<sect2>

‎src/Makefile.global.in

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -183,7 +183,7 @@ with_icu = @with_icu@
183183
with_perl = @with_perl@
184184
with_python = @with_python@
185185
with_tcl = @with_tcl@
186-
with_openssl = @with_openssl@
186+
with_ssl = @with_ssl@
187187
with_readline = @with_readline@
188188
with_selinux = @with_selinux@
189189
with_systemd = @with_systemd@

‎src/backend/libpq/Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ OBJS = \
2828
pqmq.o \
2929
pqsignal.o
3030

31-
ifeq ($(with_openssl),yes)
31+
ifeq ($(with_ssl),openssl)
3232
OBJS += be-secure-openssl.o
3333
endif
3434

‎src/backend/libpq/hba.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1041,7 +1041,7 @@ parse_hba_line(TokenizedLine *tok_line, int elevel)
10411041
ereport(elevel,
10421042
(errcode(ERRCODE_CONFIG_FILE_ERROR),
10431043
errmsg("hostssl record cannot match because SSL is not supported by this build"),
1044-
errhint("Compile with --with-openssl to use SSL connections."),
1044+
errhint("Compile with --with-ssl=openssl to use SSL connections."),
10451045
errcontext("line %d of configuration file \"%s\"",
10461046
line_num, HbaFileName)));
10471047
*err_msg = "hostssl record cannot match because SSL is not supported by this build";

‎src/common/Makefile

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ OBJS_COMMON = \
8080
wait_error.o \
8181
wchar.o
8282

83-
ifeq ($(with_openssl),yes)
83+
ifeq ($(with_ssl),openssl)
8484
OBJS_COMMON += \
8585
protocol_openssl.o \
8686
cryptohash_openssl.o

‎src/include/pg_config.h.in

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -899,7 +899,7 @@
899899
/* Define to select named POSIX semaphores. */
900900
#undef USE_NAMED_POSIX_SEMAPHORES
901901

902-
/* Define to build with OpenSSL support. (--with-openssl) */
902+
/* Define to build with OpenSSL support. (--with-ssl=openssl) */
903903
#undef USE_OPENSSL
904904

905905
/* Define to 1 to build with PAM support. (--with-pam) */

‎src/interfaces/libpq/Makefile

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,9 +45,14 @@ OBJS = \
4545
pqexpbuffer.o \
4646
fe-auth.o
4747

48-
ifeq ($(with_openssl),yes)
48+
# File shared across all SSL implementations supported.
49+
ifneq ($(with_ssl),no)
50+
OBJS += \
51+
fe-secure-common.o
52+
endif
53+
54+
ifeq ($(with_ssl),openssl)
4955
OBJS += \
50-
fe-secure-common.o \
5156
fe-secure-openssl.o
5257
endif
5358

0 commit comments

Comments
 (0)