From: Tom Lane <tgl@sss.pgh.pa.us>
To: Andreas Karlsson <andreas@proxel.se>
cc: Alvaro Herrera <alvherre@2ndquadrant.com>,
        Christoph Berg <myon@debian.org>,
 Heikki Linnakangas <hlinnaka@iki.fi>,
        Michael Paquier <michael.paquier@gmail.com>,
        Victor Wagner <vitus@wagner.pp.ru>, pgsql-hackers@postgresql.org
Subject: Re: OpenSSL 1.1 breaks configure and more
In-reply-to: <20047.1492305247@sss.pgh.pa.us>
References: <20160915153835.GA507447@alvherre.pgsql>
 <0c817abb-3f7d-20fb-583a-58f7593a0bea@proxel.se>
 <20047.1492305247@sss.pgh.pa.us>
Comments: In-reply-to Tom Lane <tgl@sss.pgh.pa.us>
	message dated "Sat, 15 Apr 2017 21:14:07 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <22215.1492309249.1@sss.pgh.pa.us>
Content-Transfer-Encoding: quoted-printable
Date: Sat, 15 Apr 2017 22:20:49 -0400
Message-ID: <22216.1492309249@sss.pgh.pa.us>
Precedence: bulk
Sender: pgsql-hackers-owner@postgresql.org

I wrote:
> If we want to go any further back with 1.1 support, we have a range
> of options:
> 1. Back-patch that patch, probably also including the followup adjustments
>   in 86029b31e and 36a3be654.
> 2. Add #if's to use 31cf1a1a4's coding with OpenSSL >=3D 1.1, while keepi=
ng
>    the older code for use when built against older OpenSSLs.
> 3. Conditionally disable renegotiation altogether with OpenSSL >=3D 1.1,
>    thus adopting 9.5 not 9.4 behavior when using newer OpenSSL.

> I think #3 would be fairly weird unless we also changed 9.4 similarly.
> But there's some argument for doing that: we don't really have any field
> experience with using renegotiation with OpenSSL 1.1, so we don't know
> that what is in the 9.4 branch right now actually works with 1.1.
> On the other hand, it would also be the most work of these options,
> since we'd have to do things like adding conditional behavior in guc.c.


I did some simple testing and can say that at least the successful path
in the 9.4 code seems to be fine with 1.1; in particular I see no sign
of the misbehavior discussed in
https://www.postgresql.org/message-id/flat/20150126101405.GA31719%40awork2.=
anarazel.de
Given Heikki's opinion that that was an OpenSSL bug, perhaps they
fixed the bug.  Certainly we don't seem to have committed any of
the workaround patches discussed in that thread.

At this point I'd be inclined to reject option #3: aside from being
more work, it'd be a pain to document, and confusing for users.
I have a slight preference for #1 over #2 --- we'd intended to back-patch
Alvaro's fixes once they had survived some field use, and I know of no
evidence that 9.4 is worse than the older branches.

			regards, tom lane


--=20
Sent via pgsql-hackers mailing list (pgsql-hackers@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-hackers