On 08/26/2016 07:04 PM, Heikki Linnakangas wrote:
On 08/26/2016 07:44 PM, Tom Lane wrote:
Peter Eisentraut <peter.eisentr...@2ndquadrant.com> writes:
On 8/26/16 5:31 AM, Heikki Linnakangas wrote:
I think now would be a good time to drop support for OpenSSL versions
older than 0.9.8. OpenSSL don't even support 0.9.8 anymore, although
there are probably distributions out there that still provide patches
for it. But OpenSSL 0.9.7 and older are really not interesting for
PostgreSQL 10 anymore, I think.
CentOS 5 currently ships 0.9.8e. That's usually the oldest OS we want
to support eagerly.
Also, I get this on fully-up-to-date OS X (El Capitan):
$ openssl version
OpenSSL 0.9.8zh 14 Jan 2016
Ok, sold, let's remove support for OpenSSL < 0.9.8.
I have attached a patch which removes the < 0.9.8 compatibility code.
Should we also add a version check to configure? We do not have any such
check currently.
Andreas
diff --git a/contrib/pgcrypto/openssl.c b/contrib/pgcrypto/openssl.c
index 976af70..ffab5d2 100644
--- a/contrib/pgcrypto/openssl.c
+++ b/contrib/pgcrypto/openssl.c
@@ -37,6 +37,7 @@
#include <openssl/blowfish.h>
#include <openssl/cast.h>
#include <openssl/des.h>
+#include <openssl/aes.h>
#include <openssl/rand.h>
#include <openssl/err.h>
@@ -47,155 +48,6 @@
#define MAX_IV (128/8)
/*
- * Compatibility with OpenSSL 0.9.6
- *
- * It needs AES and newer DES and digest API.
- */
-#if OPENSSL_VERSION_NUMBER >= 0x00907000L
-
-/*
- * Nothing needed for OpenSSL 0.9.7+
- */
-
-#include <openssl/aes.h>
-#else /* old OPENSSL */
-
-/*
- * Emulate OpenSSL AES.
- */
-
-#include "rijndael.c"
-
-#define AES_ENCRYPT 1
-#define AES_DECRYPT 0
-#define AES_KEY rijndael_ctx
-
-static int
-AES_set_encrypt_key(const uint8 *key, int kbits, AES_KEY *ctx)
-{
- aes_set_key(ctx, key, kbits, 1);
- return 0;
-}
-
-static int
-AES_set_decrypt_key(const uint8 *key, int kbits, AES_KEY *ctx)
-{
- aes_set_key(ctx, key, kbits, 0);
- return 0;
-}
-
-static void
-AES_ecb_encrypt(const uint8 *src, uint8 *dst, AES_KEY *ctx, int enc)
-{
- memcpy(dst, src, 16);
- if (enc)
- aes_ecb_encrypt(ctx, dst, 16);
- else
- aes_ecb_decrypt(ctx, dst, 16);
-}
-
-static void
-AES_cbc_encrypt(const uint8 *src, uint8 *dst, int len, AES_KEY *ctx, uint8 *iv, int enc)
-{
- memcpy(dst, src, len);
- if (enc)
- {
- aes_cbc_encrypt(ctx, iv, dst, len);
- memcpy(iv, dst + len - 16, 16);
- }
- else
- {
- aes_cbc_decrypt(ctx, iv, dst, len);
- memcpy(iv, src + len - 16, 16);
- }
-}
-
-/*
- * Emulate DES_* API
- */
-
-#define DES_key_schedule des_key_schedule
-#define DES_cblock des_cblock
-#define DES_set_key(k, ks) \
- des_set_key((k), *(ks))
-#define DES_ecb_encrypt(i, o, k, e) \
- des_ecb_encrypt((i), (o), *(k), (e))
-#define DES_ncbc_encrypt(i, o, l, k, iv, e) \
- des_ncbc_encrypt((i), (o), (l), *(k), (iv), (e))
-#define DES_ecb3_encrypt(i, o, k1, k2, k3, e) \
- des_ecb3_encrypt((des_cblock *)(i), (des_cblock *)(o), \
- *(k1), *(k2), *(k3), (e))
-#define DES_ede3_cbc_encrypt(i, o, l, k1, k2, k3, iv, e) \
- des_ede3_cbc_encrypt((i), (o), \
- (l), *(k1), *(k2), *(k3), (iv), (e))
-
-/*
- * Emulate newer digest API.
- */
-
-static void
-EVP_MD_CTX_init(EVP_MD_CTX *ctx)
-{
- memset(ctx, 0, sizeof(*ctx));
-}
-
-static int
-EVP_MD_CTX_cleanup(EVP_MD_CTX *ctx)
-{
- px_memset(ctx, 0, sizeof(*ctx));
- return 1;
-}
-
-static int
-EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *md, void *engine)
-{
- EVP_DigestInit(ctx, md);
- return 1;
-}
-
-static int
-EVP_DigestFinal_ex(EVP_MD_CTX *ctx, unsigned char *res, unsigned int *len)
-{
- EVP_DigestFinal(ctx, res, len);
- return 1;
-}
-#endif /* old OpenSSL */
-
-/*
- * Provide SHA2 for older OpenSSL < 0.9.8
- */
-#if OPENSSL_VERSION_NUMBER < 0x00908000L
-
-#include "sha2.c"
-#include "internal-sha2.c"
-
-typedef void (*init_f) (PX_MD *md);
-
-static int
-compat_find_digest(const char *name, PX_MD **res)
-{
- init_f init = NULL;
-
- if (pg_strcasecmp(name, "sha224") == 0)
- init = init_sha224;
- else if (pg_strcasecmp(name, "sha256") == 0)
- init = init_sha256;
- else if (pg_strcasecmp(name, "sha384") == 0)
- init = init_sha384;
- else if (pg_strcasecmp(name, "sha512") == 0)
- init = init_sha512;
- else
- return PXE_NO_HASH;
-
- *res = px_alloc(sizeof(PX_MD));
- init(*res);
- return 0;
-}
-#else
-#define compat_find_digest(name, res) (PXE_NO_HASH)
-#endif
-
-/*
* Hashes
*/
@@ -275,7 +127,7 @@ px_find_digest(const char *name, PX_MD **res)
md = EVP_get_digestbyname(name);
if (md == NULL)
- return compat_find_digest(name, res);
+ return PXE_NO_HASH;
digest = px_alloc(sizeof(*digest));
digest->algo = md;
diff --git a/doc/src/sgml/installation.sgml b/doc/src/sgml/installation.sgml
index a996875..2420387 100644
--- a/doc/src/sgml/installation.sgml
+++ b/doc/src/sgml/installation.sgml
@@ -2827,30 +2827,6 @@ MANPATH=/usr/lib/scohelp/%L/man:/usr/dt/man:/usr/man:/usr/share/man:scohelp:/usr
</sect3>
<sect3>
- <title>Problems with OpenSSL</title>
-
- <para>
- When you build PostgreSQL with OpenSSL support you might get
- compilation errors in the following files:
- <itemizedlist>
- <listitem><para><filename>src/backend/libpq/crypt.c</filename></para></listitem>
- <listitem><para><filename>src/backend/libpq/password.c</filename></para></listitem>
- <listitem><para><filename>src/interfaces/libpq/fe-auth.c</filename></para></listitem>
- <listitem><para><filename>src/interfaces/libpq/fe-connect.c</filename></para></listitem>
- </itemizedlist>
-
- This is because of a namespace conflict between the standard
- <filename>/usr/include/crypt.h</filename> header and the header
- files provided by OpenSSL.
- </para>
-
- <para>
- Upgrading your OpenSSL installation to version 0.9.6a fixes this
- problem. Solaris 9 and above has a newer version of OpenSSL.
- </para>
- </sect3>
-
- <sect3>
<title>configure Complains About a Failed Test Program</title>
<para>
diff --git a/doc/src/sgml/libpq.sgml b/doc/src/sgml/libpq.sgml
index 2f9350b..4e34f00 100644
--- a/doc/src/sgml/libpq.sgml
+++ b/doc/src/sgml/libpq.sgml
@@ -1238,8 +1238,7 @@ postgresql://%2Fvar%2Flib%2Fpostgresql/dbname
<listitem>
<para>
If set to 1 (default), data sent over SSL connections will be
- compressed (this requires <productname>OpenSSL</> version
- 0.9.8 or later).
+ compressed.
If set to 0, compression will be disabled (this requires
<productname>OpenSSL</> 1.0.0 or later).
This parameter is ignored if a connection without SSL is made,
diff --git a/doc/src/sgml/pgcrypto.sgml b/doc/src/sgml/pgcrypto.sgml
index c4cefde..af17f79 100644
--- a/doc/src/sgml/pgcrypto.sgml
+++ b/doc/src/sgml/pgcrypto.sgml
@@ -1232,23 +1232,11 @@ gen_random_uuid() returns uuid
<orderedlist>
<listitem>
<para>
- SHA2 algorithms were added to OpenSSL in version 0.9.8. For
- older versions, <filename>pgcrypto</> will use built-in code.
- </para>
- </listitem>
- <listitem>
- <para>
Any digest algorithm OpenSSL supports is automatically picked up.
This is not possible with ciphers, which need to be supported
explicitly.
</para>
</listitem>
- <listitem>
- <para>
- AES is included in OpenSSL since version 0.9.7. For
- older versions, <filename>pgcrypto</> will use built-in code.
- </para>
- </listitem>
</orderedlist>
</sect3>
diff --git a/src/backend/libpq/be-secure-openssl.c b/src/backend/libpq/be-secure-openssl.c
index f6adb15..e5f434c 100644
--- a/src/backend/libpq/be-secure-openssl.c
+++ b/src/backend/libpq/be-secure-openssl.c
@@ -53,10 +53,8 @@
#include <openssl/ssl.h>
#include <openssl/dh.h>
-#if SSLEAY_VERSION_NUMBER >= 0x0907000L
#include <openssl/conf.h>
-#endif
-#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_ECDH)
+#ifndef OPENSSL_NO_ECDH
#include <openssl/ec.h>
#endif
@@ -166,9 +164,7 @@ be_tls_init(void)
if (!SSL_context)
{
-#if SSLEAY_VERSION_NUMBER >= 0x0907000L
OPENSSL_config(NULL);
-#endif
SSL_library_init();
SSL_load_error_strings();
@@ -978,7 +974,7 @@ info_cb(const SSL *ssl, int type, int args)
static void
initialize_ecdh(void)
{
-#if (OPENSSL_VERSION_NUMBER >= 0x0090800fL) && !defined(OPENSSL_NO_ECDH)
+#ifndef OPENSSL_NO_ECDH
EC_KEY *ecdh;
int nid;
diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c
index f6ce1c7..d871612 100644
--- a/src/interfaces/libpq/fe-secure-openssl.c
+++ b/src/interfaces/libpq/fe-secure-openssl.c
@@ -54,9 +54,7 @@
#endif
#include <openssl/ssl.h>
-#if (SSLEAY_VERSION_NUMBER >= 0x00907000L)
#include <openssl/conf.h>
-#endif
#ifdef USE_SSL_ENGINE
#include <openssl/engine.h>
#endif
@@ -848,9 +846,7 @@ pgtls_init(PGconn *conn)
{
if (pq_init_ssl_lib)
{
-#if SSLEAY_VERSION_NUMBER >= 0x00907000L
OPENSSL_config(NULL);
-#endif
SSL_library_init();
SSL_load_error_strings();
}
diff --git a/src/interfaces/libpq/libpq-int.h b/src/interfaces/libpq/libpq-int.h
index 1183323..a94ead0 100644
--- a/src/interfaces/libpq/libpq-int.h
+++ b/src/interfaces/libpq/libpq-int.h
@@ -77,7 +77,7 @@ typedef struct
#include <openssl/ssl.h>
#include <openssl/err.h>
-#if (SSLEAY_VERSION_NUMBER >= 0x00907000L) && !defined(OPENSSL_NO_ENGINE)
+#ifndef OPENSSL_NO_ENGINE
#define USE_SSL_ENGINE
#endif
#endif /* USE_OPENSSL */
--
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers
