Skip to content

Commit 48e5ba6

Browse files
hlinnakahlinnaka
committed
Fix building with LibreSSL.
LibreSSL defines OPENSSL_VERSION_NUMBER to claim that it is version 2.0.0, but it doesn't have the functions added in OpenSSL 1.1.0. Add autoconf checks for the individual functions we need, and stop relying on OPENSSL_VERSION_NUMBER. Backport to 9.5 and 9.6, like the patch that broke this. In the back-branches, there are still a few OPENSSL_VERSION_NUMBER checks left, to check for OpenSSL 0.9.8 or 0.9.7. I left them as they were - LibreSSL has all those functions, so they work as intended. Per buildfarm member curculio. Discussion: <2442.1473957669@sss.pgh.pa.us>
1 parent 60b6d99 commit 48e5ba6

File tree

6 files changed

+85
-21
lines changed

6 files changed

+85
-21
lines changed

‎configure

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8877,6 +8877,37 @@ if test "x$ac_cv_func_SSL_get_current_compression" = xyes; then :
88778877
#define HAVE_SSL_GET_CURRENT_COMPRESSION 1
88788878
_ACEOF
88798879

8880+
fi
8881+
done
8882+
8883+
# Functions introduced in OpenSSL 1.1.0. We used to check for
8884+
# OPENSSL_VERSION_NUMBER, but that didn't work with 1.1.0, because LibreSSL
8885+
# defines OPENSSL_VERSION_NUMBER to claim version 2.0.0, even though it
8886+
# doesn't have these OpenSSL 1.1.0 functions. So check for individual
8887+
# functions.
8888+
for ac_func in OPENSSL_init_ssl BIO_get_data BIO_meth_new ASN1_STRING_get0_data RAND_OpenSSL
8889+
do :
8890+
as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
8891+
ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
8892+
if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
8893+
cat >>confdefs.h <<_ACEOF
8894+
#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
8895+
_ACEOF
8896+
8897+
fi
8898+
done
8899+
8900+
# OpenSSL versions before 1.1.0 required setting callback functions, for
8901+
# thread-safety. In 1.1.0, it's no longer required, and CRYPTO_lock()
8902+
# function was removed.
8903+
for ac_func in CRYPTO_lock
8904+
do :
8905+
ac_fn_c_check_func "$LINENO" "CRYPTO_lock" "ac_cv_func_CRYPTO_lock"
8906+
if test "x$ac_cv_func_CRYPTO_lock" = xyes; then :
8907+
cat >>confdefs.h <<_ACEOF
8908+
#define HAVE_CRYPTO_LOCK 1
8909+
_ACEOF
8910+
88808911
fi
88818912
done
88828913

‎configure.in

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1034,6 +1034,16 @@ if test "$with_openssl" = yes ; then
10341034
AC_SEARCH_LIBS(SSL_new, ssleay32 ssl, [], [AC_MSG_ERROR([library 'ssleay32' or 'ssl' is required for OpenSSL])])
10351035
fi
10361036
AC_CHECK_FUNCS([SSL_get_current_compression])
1037+
# Functions introduced in OpenSSL 1.1.0. We used to check for
1038+
# OPENSSL_VERSION_NUMBER, but that didn't work with 1.1.0, because LibreSSL
1039+
# defines OPENSSL_VERSION_NUMBER to claim version 2.0.0, even though it
1040+
# doesn't have these OpenSSL 1.1.0 functions. So check for individual
1041+
# functions.
1042+
AC_CHECK_FUNCS([OPENSSL_init_ssl BIO_get_data BIO_meth_new ASN1_STRING_get0_data RAND_OpenSSL])
1043+
# OpenSSL versions before 1.1.0 required setting callback functions, for
1044+
# thread-safety. In 1.1.0, it's no longer required, and CRYPTO_lock()
1045+
# function was removed.
1046+
AC_CHECK_FUNCS([CRYPTO_lock])
10371047
fi
10381048

10391049
if test "$with_pam" = yes ; then

‎contrib/pgcrypto/openssl.c

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1062,10 +1062,6 @@ px_find_cipher(const char *name, PX_Cipher **res)
10621062

10631063
static int openssl_random_init = 0;
10641064

1065-
#if OPENSSL_VERSION_NUMBER < 0x10100000L
1066-
#define RAND_OpenSSL RAND_SSLeay
1067-
#endif
1068-
10691065
/*
10701066
* OpenSSL random should re-feeded occasionally. From /dev/urandom
10711067
* preferably.
@@ -1074,7 +1070,13 @@ static void
10741070
init_openssl_rand(void)
10751071
{
10761072
if (RAND_get_rand_method() == NULL)
1073+
{
1074+
#ifdef HAVE_RAND_OPENSSL
10771075
RAND_set_rand_method(RAND_OpenSSL());
1076+
#else
1077+
RAND_set_rand_method(RAND_SSLeay());
1078+
#endif
1079+
}
10781080
openssl_random_init = 1;
10791081
}
10801082

‎src/backend/libpq/be-secure-openssl.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -167,7 +167,7 @@ be_tls_init(void)
167167

168168
if (!SSL_context)
169169
{
170-
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
170+
#ifdef HAVE_OPENSSL_INIT_SSL
171171
OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG, NULL);
172172
#else
173173
#if OPENSSL_VERSION_NUMBER >= 0x0907000L
@@ -655,7 +655,7 @@ be_tls_write(Port *port, void *ptr, size_t len, int *waitfor)
655655
* to retry; do we need to adopt their logic for that?
656656
*/
657657

658-
#if OPENSSL_VERSION_NUMBER < 0x10100000L
658+
#ifndef HAVE_BIO_GET_DATA
659659
#define BIO_get_data(bio) (bio->ptr)
660660
#define BIO_set_data(bio, data) (bio->ptr = data)
661661
#endif
@@ -709,7 +709,7 @@ my_BIO_s_socket(void)
709709
if (!my_bio_methods)
710710
{
711711
BIO_METHOD *biom = (BIO_METHOD *) BIO_s_socket();
712-
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
712+
#ifdef HAVE_BIO_METH_NEW
713713
int my_bio_index;
714714

715715
my_bio_index = BIO_get_new_index();

‎src/include/pg_config.h.in

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,12 +84,21 @@
8484
/* Define to 1 if you have the `append_history' function. */
8585
#undef HAVE_APPEND_HISTORY
8686

87+
/* Define to 1 if you have the `ASN1_STRING_get0_data' function. */
88+
#undef HAVE_ASN1_STRING_GET0_DATA
89+
8790
/* Define to 1 if you want to use atomics if available. */
8891
#undef HAVE_ATOMICS
8992

9093
/* Define to 1 if you have the <atomic.h> header file. */
9194
#undef HAVE_ATOMIC_H
9295

96+
/* Define to 1 if you have the `BIO_get_data' function. */
97+
#undef HAVE_BIO_GET_DATA
98+
99+
/* Define to 1 if you have the `BIO_meth_new' function. */
100+
#undef HAVE_BIO_METH_NEW
101+
93102
/* Define to 1 if you have the `cbrt' function. */
94103
#undef HAVE_CBRT
95104

@@ -102,6 +111,9 @@
102111
/* Define to 1 if you have the `crypt' function. */
103112
#undef HAVE_CRYPT
104113

114+
/* Define to 1 if you have the `CRYPTO_lock' function. */
115+
#undef HAVE_CRYPTO_LOCK
116+
105117
/* Define to 1 if you have the <crypt.h> header file. */
106118
#undef HAVE_CRYPT_H
107119

@@ -364,6 +376,9 @@
364376
/* Define to 1 if you have the <net/if.h> header file. */
365377
#undef HAVE_NET_IF_H
366378

379+
/* Define to 1 if you have the `OPENSSL_init_ssl' function. */
380+
#undef HAVE_OPENSSL_INIT_SSL
381+
367382
/* Define to 1 if you have the <ossp/uuid.h> header file. */
368383
#undef HAVE_OSSP_UUID_H
369384

@@ -400,6 +415,9 @@
400415
/* Define to 1 if you have the `random' function. */
401416
#undef HAVE_RANDOM
402417

418+
/* Define to 1 if you have the `RAND_OpenSSL' function. */
419+
#undef HAVE_RAND_OPENSSL
420+
403421
/* Define to 1 if you have the <readline.h> header file. */
404422
#undef HAVE_READLINE_H
405423

‎src/interfaces/libpq/fe-secure-openssl.c

Lines changed: 17 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -507,10 +507,6 @@ wildcard_certificate_match(const char *pattern, const char *string)
507507
return 1;
508508
}
509509

510-
#if OPENSSL_VERSION_NUMBER < 0x10100000L
511-
#define ASN1_STRING_get0_data ASN1_STRING_data
512-
#endif
513-
514510
/*
515511
* Check if a name from a server's certificate matches the peer's hostname.
516512
*
@@ -545,7 +541,11 @@ verify_peer_name_matches_certificate_name(PGconn *conn, ASN1_STRING *name_entry,
545541
* There is no guarantee the string returned from the certificate is
546542
* NULL-terminated, so make a copy that is.
547543
*/
544+
#ifdef HAVE_ASN1_STRING_GET0_DATA
548545
namedata = ASN1_STRING_get0_data(name_entry);
546+
#else
547+
namedata = ASN1_STRING_data(name_entry);
548+
#endif
549549
len = ASN1_STRING_length(name_entry);
550550
name = malloc(len + 1);
551551
if (name == NULL)
@@ -733,10 +733,13 @@ verify_peer_name_matches_certificate(PGconn *conn)
733733
return found_match && !got_error;
734734
}
735735

736-
#if defined(ENABLE_THREAD_SAFETY) && OPENSSL_VERSION_NUMBER < 0x10100000L
736+
#if defined(ENABLE_THREAD_SAFETY) && defined(HAVE_CRYPTO_LOCK)
737737
/*
738-
* Callback functions for OpenSSL internal locking. (OpenSSL 1.1.0
739-
* does its own locking, and doesn't need these anymore.)
738+
* Callback functions for OpenSSL internal locking. (OpenSSL 1.1.0
739+
* does its own locking, and doesn't need these anymore. The
740+
* CRYPTO_lock() function was removed in 1.1.0, when the callbacks
741+
* were made obsolete, so we assume that if CRYPTO_lock() exists,
742+
* the callbacks are still required.)
740743
*/
741744

742745
static unsigned long
@@ -766,7 +769,7 @@ pq_lockingcallback(int mode, int n, const char *file, int line)
766769
PGTHREAD_ERROR("failed to unlock mutex");
767770
}
768771
}
769-
#endif /* ENABLE_THREAD_SAFETY && OPENSSL_VERSION_NUMBER < 0x10100000L */
772+
#endif /* ENABLE_THREAD_SAFETY && HAVE_CRYPTO_LOCK */
770773

771774
/*
772775
* Initialize SSL system, in particular creating the SSL_context object
@@ -805,7 +808,7 @@ pgtls_init(PGconn *conn)
805808
if (pthread_mutex_lock(&ssl_config_mutex))
806809
return -1;
807810

808-
#if OPENSSL_VERSION_NUMBER < 0x10100000L
811+
#ifdef HAVE_CRYPTO_LOCK
809812
if (pq_init_crypto_lib)
810813
{
811814
/*
@@ -846,14 +849,14 @@ pgtls_init(PGconn *conn)
846849
CRYPTO_set_locking_callback(pq_lockingcallback);
847850
}
848851
}
849-
#endif /* OPENSSL_VERSION_NUMBER < 0x10100000L */
852+
#endif /* HAVE_CRYPTO_LOCK */
850853
#endif /* ENABLE_THREAD_SAFETY */
851854

852855
if (!SSL_context)
853856
{
854857
if (pq_init_ssl_lib)
855858
{
856-
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
859+
#ifdef HAVE_OPENSSL_INIT_SSL
857860
OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG, NULL);
858861
#else
859862
#if OPENSSL_VERSION_NUMBER >= 0x00907000L
@@ -916,7 +919,7 @@ pgtls_init(PGconn *conn)
916919
static void
917920
destroy_ssl_system(void)
918921
{
919-
#if defined(ENABLE_THREAD_SAFETY) && OPENSSL_VERSION_NUMBER < 0x10100000L
922+
#if defined(ENABLE_THREAD_SAFETY) && defined(HAVE_CRYPTO_LOCK)
920923
/* Mutex is created in initialize_ssl_system() */
921924
if (pthread_mutex_lock(&ssl_config_mutex))
922925
return;
@@ -1631,7 +1634,7 @@ PQsslAttribute(PGconn *conn, const char *attribute_name)
16311634
* to retry; do we need to adopt their logic for that?
16321635
*/
16331636

1634-
#if OPENSSL_VERSION_NUMBER < 0x10100000L
1637+
#ifndef HAVE_BIO_GET_DATA
16351638
#define BIO_get_data(bio) (bio->ptr)
16361639
#define BIO_set_data(bio, data) (bio->ptr = data)
16371640
#endif
@@ -1704,7 +1707,7 @@ my_BIO_s_socket(void)
17041707
if (!my_bio_methods)
17051708
{
17061709
BIO_METHOD *biom = (BIO_METHOD *) BIO_s_socket();
1707-
#if OPENSSL_VERSION_NUMBER >= 0x10100000L
1710+
#ifdef HAVE_BIO_METH_NEW
17081711
int my_bio_index;
17091712

17101713
my_bio_index = BIO_get_new_index();

0 commit comments

Comments
 (0)