Content-Type: text/plain;
	charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3774.500.171.1.1\))
Subject: Re: pgsql: Fix compilation on OpenSSL 1.0.2 and LibreSSL
From: Daniel Gustafsson <daniel@yesql.se>
In-Reply-To: <5f162ff7-02f0-42f4-9473-53cfb7393bc3@iki.fi>
Date: Thu, 2 May 2024 12:24:03 +0200
Cc: Heikki Linnakangas <heikki.linnakangas@iki.fi>,
 pgsql-committers@lists.postgresql.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <5EACEB09-BCBC-432A-A5B0-E8FD73808276@yesql.se>
References: <E1s1g0Z-000jeC-OR@gemulon.postgresql.org>
 <1C71E5C4-46BE-46B7-9884-310B25280B49@yesql.se>
 <5f162ff7-02f0-42f4-9473-53cfb7393bc3@iki.fi>
To: Heikki Linnakangas <hlinnaka@iki.fi>
Archived-At: 
 <https://www.postgresql.org/message-id/5EACEB09-BCBC-432A-A5B0-E8FD73808276%40yesql.se>
Precedence: bulk

> On 2 May 2024, at 11:30, Heikki Linnakangas <hlinnaka@iki.fi> wrote:
>=20
> On 02/05/2024 12:09, Daniel Gustafsson wrote:
>>> On 30 Apr 2024, at 07:26, Heikki Linnakangas =
<heikki.linnakangas@iki.fi> wrote:
>>> Fix compilation on OpenSSL 1.0.2 and LibreSSL
>>>=20
>>> SSL_AD_NO_APPLICATION_PROTOCOL was introduced in OpenSSL 1.1.0.
>> +        * https://github.com/openssl/openssl/issues/24300.  This is =
available in
>> +        * OpenSSL 1.1.0 and later, but as of this writing not in =
LibreSSL.
>> I'm a bit confused, as far as I can tell this has been in LibreSSL =
since the
>> OpenBSD 6.9 release.
>> =
https://github.com/openbsd/src/blob/master/lib/libssl/ssl_tlsext.c#L130
>> Or am I missing something?
>=20
> Hmm, I'm not sure how exactly LibreSSL is versioned. But morepork runs =
OpenBSD 6.9, and it was one of the failing buildfarm members: =
https://buildfarm.postgresql.org/cgi-bin/show_log.pl?nm=3Dmorepork&dt=3D20=
24-04-30%2004%3A30%3A28.

Turns out I fat-fingered my grep, it's available starting with OpenBSD =
7.0 so
the morepork failure makes sense.

> And I don't see the symbol in a fresh checkout of the portable =
libressl repository at https://github.com/libressl/portable.

The portable repo only contains the portable parts, did you pull the =
libssl
code with ./autogen?  If so you should be able to see it, like below:

:~/dev/tls/libressl $ git clone git@github.com:libressl/portable.git
:~/dev/tls/libressl $ cd portable/
:~/dev/tls/libressl/portable (master) $ git checkout OPENBSD_7_0
branch 'OPENBSD_7_0' set up to track 'origin/OPENBSD_7_0'.
Switched to a new branch 'OPENBSD_7_0'
:~/dev/tls/libressl/portable (OPENBSD_7_0) $ ./autogen.sh
	...
:~/dev/tls/libressl/portable (OPENBSD_7_0) $ cd openbsd/
:~/dev/tls/libressl/portable/openbsd (OPENBSD_7_0) $ git grep =
SSL_AD_NO_APPLICATION_PROTOCOL
src/lib/libssl/ssl.h:#define SSL_AD_NO_APPLICATION_PROTOCOL             =
120
src/lib/libssl/ssl_tlsext.c:    *alert =3D =
SSL_AD_NO_APPLICATION_PROTOCOL;

This makes targeting 7.0 as the lowest LibreSSL version appealing in my
patchset for removing support for old OpenSSL and LibreSSL versions.

--
Daniel Gustafsson