pg.ddx.io pgsql-committers@postgresql.org mailing list archive
help / color / mirror / Atom feedpgsql: Remove support for OpenSSL older than 1.1.0
3+ messages / 3 participants
[nested] [flat]
* pgsql: Remove support for OpenSSL older than 1.1.0
@ 2024-09-02 12:24 Daniel Gustafsson <dgustafsson@postgresql.org>
2024-09-03 10:36 ` Re: pgsql: Remove support for OpenSSL older than 1.1.0 Robins Tharakan <tharakan@gmail.com>
0 siblings, 1 reply; 3+ messages in thread
From: Daniel Gustafsson @ 2024-09-02 12:24 UTC (permalink / raw)
To: pgsql-committers@lists.postgresql.org
Remove support for OpenSSL older than 1.1.0
OpenSSL 1.0.2 has been EOL from the upstream OpenSSL project for
some time, and is no longer the default OpenSSL version with any
vendor which package PostgreSQL. By retiring support for OpenSSL
1.0.2 we can remove a lot of no longer required complexity for
managing state within libcrypto which is now handled by OpenSSL.
Reviewed-by: Jacob Champion <jacob.champion@enterprisedb.com>
Reviewed-by: Peter Eisentraut <peter@eisentraut.org>
Reviewed-by: Michael Paquier <michael@paquier.xyz>
Discussion: https://postgr.es/m/ZG3JNursG69dz1lr@paquier.xyz
Discussion: https://postgr.es/m/CA+hUKGKh7QrYzu=8yWEUJvXtMVm_CNWH1L_TLWCbZMwbi1XP2Q@mail.gmail.com
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/a70e01d4306fdbcd5fbedb4ca97e5c21c995da60
Modified Files
--------------
configure | 31 ++--
configure.ac | 12 +-
contrib/pgcrypto/openssl.c | 8 -
doc/src/sgml/installation.sgml | 2 +-
doc/src/sgml/libpq.sgml | 36 ++---
meson.build | 23 +--
src/backend/libpq/be-secure-openssl.c | 24 +--
src/common/Makefile | 3 +-
src/common/hmac_openssl.c | 20 +--
src/common/meson.build | 1 -
src/common/protocol_openssl.c | 117 ---------------
src/include/common/openssl.h | 14 +-
src/include/pg_config.h.in | 15 --
src/interfaces/libpq/fe-connect.c | 18 ---
src/interfaces/libpq/fe-secure-openssl.c | 246 -------------------------------
src/interfaces/libpq/fe-secure.c | 35 ++---
src/interfaces/libpq/libpq-int.h | 23 ---
src/test/ssl/t/001_ssltests.pl | 3 +-
18 files changed, 55 insertions(+), 576 deletions(-)
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: pgsql: Remove support for OpenSSL older than 1.1.0
2024-09-02 12:24 pgsql: Remove support for OpenSSL older than 1.1.0 Daniel Gustafsson <dgustafsson@postgresql.org>
@ 2024-09-03 10:36 ` Robins Tharakan <tharakan@gmail.com>
2024-09-03 11:36 ` Re: pgsql: Remove support for OpenSSL older than 1.1.0 Daniel Gustafsson <daniel@yesql.se>
0 siblings, 1 reply; 3+ messages in thread
From: Robins Tharakan @ 2024-09-03 10:36 UTC (permalink / raw)
To: Daniel Gustafsson <dgustafsson@postgresql.org>; +Cc: pgsql-committers@lists.postgresql.org
Hi Daniel,
On Mon, 2 Sept 2024 at 21:54, Daniel Gustafsson <dgustafsson@postgresql.org>
wrote:
>
> Remove support for OpenSSL older than 1.1.0
>
I am trying to update my buildfarm animals for this, and although I fixed
massasauga (essentially by skipping the test for now), I am unclear why
snakefly still fails (now, much later into the cycle).
Could you point me on how to fix snakefly?
(I've tried to disable SSL tests, but that doesn't seem to be helping).
https://buildfarm.postgresql.org/cgi-bin/show_log.pl?nm=snakefly&dt=2024-09-03%2009%3A56%3A46
-
Thanks
Robins
^ permalink raw reply [nested|flat] 3+ messages in thread
* Re: pgsql: Remove support for OpenSSL older than 1.1.0
2024-09-02 12:24 pgsql: Remove support for OpenSSL older than 1.1.0 Daniel Gustafsson <dgustafsson@postgresql.org>
2024-09-03 10:36 ` Re: pgsql: Remove support for OpenSSL older than 1.1.0 Robins Tharakan <tharakan@gmail.com>
@ 2024-09-03 11:36 ` Daniel Gustafsson <daniel@yesql.se>
0 siblings, 0 replies; 3+ messages in thread
From: Daniel Gustafsson @ 2024-09-03 11:36 UTC (permalink / raw)
To: Robins Tharakan <tharakan@gmail.com>; +Cc: pgsql-committers@lists.postgresql.org
> On 3 Sep 2024, at 12:36, Robins Tharakan <tharakan@gmail.com> wrote:
> I am trying to update my buildfarm animals for this, and although I fixed massasauga (essentially by skipping the test for now), I am unclear why snakefly still fails (now, much later into the cycle).
>
> Could you point me on how to fix snakefly?
> (I've tried to disable SSL tests, but that doesn't seem to be helping).
>
> https://buildfarm.postgresql.org/cgi-bin/show_log.pl?nm=snakefly&dt=2024-09-03%2009%3A56%3A46
The BF run entry claims it's failing in the ssl_passphrase_callbackCheck stage
which is odd, since without SSL it shouldn't recurse into that test module at
all.
Looking at massasauga it did recurse into there but then subsequently skipped
the test due to OpenSSL being missing. However, it would first need to compile
the test module in order to reach the SKIP statement in the TAP test, and I
believe that's where snakefly is failing. If I recompile postgres without SSL
and ensure that it cannot see any OpenSSL headers via standard includes I can
reproduce the error, the excerpt from install.log being the expected
compilation failure:
ssl_passphrase_func.c:29:23: error: unknown type name 'SSL_CTX'
static void set_rot13(SSL_CTX *context, bool isServerStart);
^
ssl_passphrase_func.c:52:3: error: use of undeclared identifier 'openssl_tls_init_hook'
openssl_tls_init_hook = set_rot13;
^
ssl_passphrase_func.c:56:11: error: unknown type name 'SSL_CTX'
set_rot13(SSL_CTX *context, bool isServerStart)
^
ssl_passphrase_func.c:63:2: error: call to undeclared function 'SSL_CTX_set_default_passwd_cb'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
SSL_CTX_set_default_passwd_cb(context, rot13_passphrase);
^
4 errors generated.
Does massasauga have OpenSSL headers such that the compiler can find them via
standard includes, and snakefly doesn't?
The buildfarm client should honor the rules in the src/test/modules Makefile
which skips the subdirectory when OpenSSL isn't present, but since the TAP test
have a SKIP clause I guess we should support it. The attached diff fixes it
for me, are you able to test that on snakefly?
--
Daniel Gustafsson
Attachments:
ssl_passphrase_skip.diff (application/octet-stream, 1.1K) download
diff --git a/src/test/modules/ssl_passphrase_callback/ssl_passphrase_func.c b/src/test/modules/ssl_passphrase_callback/ssl_passphrase_func.c
index d599214982..b0d1fd2f70 100644
--- a/src/test/modules/ssl_passphrase_callback/ssl_passphrase_func.c
+++ b/src/test/modules/ssl_passphrase_callback/ssl_passphrase_func.c
@@ -25,8 +25,10 @@ static char *ssl_passphrase = NULL;
/* callback function */
static int rot13_passphrase(char *buf, int size, int rwflag, void *userdata);
+#ifdef USE_SSL
/* hook function to set the callback */
static void set_rot13(SSL_CTX *context, bool isServerStart);
+#endif
/*
* Module load callback
@@ -48,10 +50,13 @@ _PG_init(void)
MarkGUCPrefixReserved("ssl_passphrase");
+#ifdef USE_SSL
if (ssl_passphrase)
openssl_tls_init_hook = set_rot13;
+#endif
}
+#ifdef USE_SSL
static void
set_rot13(SSL_CTX *context, bool isServerStart)
{
@@ -62,6 +67,7 @@ set_rot13(SSL_CTX *context, bool isServerStart)
SSL_CTX_set_default_passwd_cb(context, rot13_passphrase);
}
+#endif
static int
rot13_passphrase(char *buf, int size, int rwflag, void *userdata)
end of thread, other threads:[~2024-09-03 11:36 UTC | newest]
Thread overview: 3+ messages (download: mbox mbox.gz follow: Atom feed)
-- links below jump to the message on this page --
2024-09-02 12:24 pgsql: Remove support for OpenSSL older than 1.1.0 Daniel Gustafsson <dgustafsson@postgresql.org>
2024-09-03 10:36 ` Robins Tharakan <tharakan@gmail.com>
2024-09-03 11:36 ` Daniel Gustafsson <daniel@yesql.se>
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox