Received: from malur.postgresql.org ([217.196.149.56]) by arkaria.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1l4fR9-0006H3-6U for pgsql-hackers@arkaria.postgresql.org; Wed, 27 Jan 2021 07:40:24 +0000 Received: from localhost ([127.0.0.1] helo=malur.postgresql.org) by malur.postgresql.org with esmtp (Exim 4.92) (envelope-from ) id 1l4fQc-0003Fg-FX for pgsql-hackers@arkaria.postgresql.org; Wed, 27 Jan 2021 07:39:50 +0000 Received: from magus.postgresql.org ([2a02:c0:301:0:ffff::29]) by malur.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1l4fQb-0003FZ-8f for pgsql-hackers@lists.postgresql.org; Wed, 27 Jan 2021 07:39:50 +0000 Received: from [66.111.4.28] (helo=out4-smtp.messagingengine.com) by magus.postgresql.org with esmtps (TLS1.3:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.92) (envelope-from ) id 1l4fQW-00063y-2B for pgsql-hackers@lists.postgresql.org; Wed, 27 Jan 2021 07:39:48 +0000 Received: from compute1.internal (compute1.nyi.internal [10.202.2.41]) by mailout.nyi.internal (Postfix) with ESMTP id 2B6E15C01BF; Wed, 27 Jan 2021 02:39:32 -0500 (EST) Received: from mailfrontend1 ([10.202.2.162]) by compute1.internal (MEProxy); Wed, 27 Jan 2021 02:39:32 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=paquier.xyz; h= date:from:to:cc:subject:message-id:references:mime-version :content-type:in-reply-to; s=fm3; bh=6Td2BEkrGFv1pwRtyXOtFg73BV/ aiBgCrspCYIjiD18=; b=ZiWRbaR56DTKSPiHqrgnCYCLXD2Egs3LxXWdP31tAdO Cf7VIZUJeantQI0UyFdOqcCiAFX9BR9HWcQJ3UoTXVEGG41NlnbQnmbyMCv9MvcA cDON1JHnXI2Cqn0w+JsQD9zxVkFLemlGYaxRa1issd8cqTIGMyr6kwh3woOO1wvg OAgbC54+tvSCGcHJN3PNRcsUNDSX1TN/zlJKdWOm48nwvg9kknJqKSGB3OV/UHsc S+kl7RGdjgypGlBXT23zlLEuqeWy/tO35DblleUmJUhhWKg50nrM3CV0N0jm6YNX dL4K386dzKR40T7CXG41BqodCbX7OG4w/quH3dMZBiQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm1; bh=6Td2BE krGFv1pwRtyXOtFg73BV/aiBgCrspCYIjiD18=; b=dnkrI7/VfmepRx8vOB44ab 8bXuXCx+xuhwGy0lkX7zjRhIxGDb3H4yipcCdA5cTSi8zz8xC8GGyc3PAQCh2OyB DpSrAkm67m5LWiiqo+Fw6rFrKXqjswJlpY/CaSuH1h9f4Q8hAo3uy52SYhykt5kL J0VBlur0mgpA0zi65e9OnURMS9u7kHxKDdNUzX0eKnnqAGw+gkVEFhYuKxeP4dW7 WireiuePq0tzDewbR0v/+5EPGbk3umB6YMCPRv99RGr4IJIkIcbVAmxIetJhQ6pZ hl0Ih2X3cOENT9gkgVPaDMn9g+bv0vaLSR3NnpeX0ii5jQ+8eUGj2XkvLTunrl4g == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeduledrvdejgdduudduucetufdoteggodetrfdotf fvucfrrhhofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgen uceurghilhhouhhtmecufedttdenucesvcftvggtihhpihgvnhhtshculddquddttddmne gfrhhlucfvnfffucdljedtmdenucfjughrpeffhffvuffkfhggtggujgesghdtreertddt vdenucfhrhhomhepofhitghhrggvlhcurfgrqhhuihgvrhcuoehmihgthhgrvghlsehprg hquhhivghrrdighiiiqeenucggtffrrghtthgvrhhnpedvgeduuefhtdeuleettdevjeeh heeiveeuieegleetgeeljeelieeuieehgeevhfenucfkphepudduuddruddtvddrudektd drudekheenucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhm pehmihgthhgrvghlsehprghquhhivghrrdighiii X-ME-Proxy: Received: from paquier.xyz (ee0822lan1.rev.em-net.ne.jp [111.102.180.185]) by mail.messagingengine.com (Postfix) with ESMTPA id B200A24005D; Wed, 27 Jan 2021 02:39:28 -0500 (EST) Date: Wed, 27 Jan 2021 16:39:23 +0900 From: Michael Paquier To: Jacob Champion Cc: "daniel@yesql.se" , "hlinnaka@iki.fi" , "pgsql-hackers@lists.postgresql.org" , "andrew.dunstan@2ndquadrant.com" , "sfrost@snowman.net" , "thomas.munro@gmail.com" , "andres@anarazel.de" Subject: Re: Support for NSS as a libpq TLS backend Message-ID: References: <7B5A88DF-863A-4B00-B841-0285C1FF70DF@yesql.se> <5F24348B-10BA-4AA1-999B-1E2AB22B4997@vmware.com> <94E22878-6289-43D5-A674-804F6CB23782@yesql.se> <8D7F95DB-8F8A-4300-BFDA-656FBAB30FE2@yesql.se> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="Th+OLmLwNcOEeXYh" Content-Disposition: inline In-Reply-To: X-Host-Lookup-Failed: Reverse DNS lookup failed for 66.111.4.28 (deferred) List-Id: List-Help: List-Subscribe: List-Post: List-Owner: List-Archive: Precedence: bulk --Th+OLmLwNcOEeXYh Content-Type: multipart/mixed; boundary="15/bOGxK/F+5cBNK" Content-Disposition: inline --15/bOGxK/F+5cBNK Content-Type: text/plain; charset=us-ascii Content-Disposition: inline On Wed, Jan 20, 2021 at 05:07:08PM +0000, Jacob Champion wrote: > Lovely. I didn't expect *removing* an extension to effectively *add* > more, but I'm glad it works now. My apologies for chiming in. I was looking at your patch set here, and while reviewing the strong random and cryptohash parts I have found a couple of mistakes in the ./configure part. I think that the switch from --with-openssl to --with-ssl={openssl} could just be done independently as a building piece of the rest, then the first portion based on NSS could just add the minimum set in configure.ac. Please note that the patch set has been using autoconf from Debian, or something forked from upstream. There were also missing updates in several parts of the code base, and a lack of docs for the new switch. I have spent time checking that with --with-openssl to make sure that the obsolete grammar is still compatible, --with-ssl=openssl and also without it. Thoughts? -- Michael --15/bOGxK/F+5cBNK Content-Type: text/x-diff; charset=us-ascii Content-Disposition: attachment; filename="0001-Introduce-with-ssl-openssl-in-configure-options.patch" Content-Transfer-Encoding: quoted-printable =46rom b3e18564697bdb36a8eba4afe6434294676b528b Mon Sep 17 00:00:00 2001 =46rom: Michael Paquier Date: Wed, 27 Jan 2021 16:36:45 +0900 Subject: [PATCH] Introduce --with-ssl=3D{openssl} in configure options --- src/include/pg_config.h.in | 2 +- src/backend/libpq/Makefile | 2 +- src/backend/libpq/hba.c | 2 +- src/common/Makefile | 2 +- src/interfaces/libpq/Makefile | 2 +- src/test/Makefile | 2 +- src/test/modules/Makefile | 2 +- .../modules/ssl_passphrase_callback/Makefile | 2 +- .../ssl_passphrase_callback/t/001_testfunc.pl | 2 +- src/test/ssl/Makefile | 2 +- src/test/ssl/t/001_ssltests.pl | 2 +- src/test/ssl/t/002_scram.pl | 2 +- doc/src/sgml/installation.sgml | 5 +- doc/src/sgml/pgcrypto.sgml | 2 +- doc/src/sgml/sslinfo.sgml | 2 +- contrib/Makefile | 2 +- contrib/pgcrypto/Makefile | 4 +- configure | 110 +++++++++++------- configure.ac | 31 +++-- src/Makefile.global.in | 2 +- src/tools/msvc/Solution.pm | 2 +- src/tools/msvc/config_default.pl | 2 +- 22 files changed, 113 insertions(+), 73 deletions(-) diff --git a/src/include/pg_config.h.in b/src/include/pg_config.h.in index f4d9f3b408..55cab4d2bf 100644 --- a/src/include/pg_config.h.in +++ b/src/include/pg_config.h.in @@ -899,7 +899,7 @@ /* Define to select named POSIX semaphores. */ #undef USE_NAMED_POSIX_SEMAPHORES =20 -/* Define to build with OpenSSL support. (--with-openssl) */ +/* Define to build with OpenSSL support. (--with-ssl=3Dopenssl) */ #undef USE_OPENSSL =20 /* Define to 1 to build with PAM support. (--with-pam) */ diff --git a/src/backend/libpq/Makefile b/src/backend/libpq/Makefile index efc5ef760a..8d1d16b0fc 100644 --- a/src/backend/libpq/Makefile +++ b/src/backend/libpq/Makefile @@ -28,7 +28,7 @@ OBJS =3D \ pqmq.o \ pqsignal.o =20 -ifeq ($(with_openssl),yes) +ifeq ($(with_ssl),openssl) OBJS +=3D be-secure-openssl.o endif =20 diff --git a/src/backend/libpq/hba.c b/src/backend/libpq/hba.c index 371dccb852..20bf1461ce 100644 --- a/src/backend/libpq/hba.c +++ b/src/backend/libpq/hba.c @@ -1041,7 +1041,7 @@ parse_hba_line(TokenizedLine *tok_line, int elevel) ereport(elevel, (errcode(ERRCODE_CONFIG_FILE_ERROR), errmsg("hostssl record cannot match because SSL is not supported by = this build"), - errhint("Compile with --with-openssl to use SSL connections."), + errhint("Compile with --with-ssl=3Dopenssl to use SSL connections."), errcontext("line %d of configuration file \"%s\"", line_num, HbaFileName))); *err_msg =3D "hostssl record cannot match because SSL is not supported = by this build"; diff --git a/src/common/Makefile b/src/common/Makefile index 1a1d0d3406..5422579a6a 100644 --- a/src/common/Makefile +++ b/src/common/Makefile @@ -80,7 +80,7 @@ OBJS_COMMON =3D \ wait_error.o \ wchar.o =20 -ifeq ($(with_openssl),yes) +ifeq ($(with_ssl),openssl) OBJS_COMMON +=3D \ protocol_openssl.o \ cryptohash_openssl.o diff --git a/src/interfaces/libpq/Makefile b/src/interfaces/libpq/Makefile index c4fde3f93d..2b7ace52e4 100644 --- a/src/interfaces/libpq/Makefile +++ b/src/interfaces/libpq/Makefile @@ -45,7 +45,7 @@ OBJS =3D \ pqexpbuffer.o \ fe-auth.o =20 -ifeq ($(with_openssl),yes) +ifeq ($(with_ssl),openssl) OBJS +=3D \ fe-secure-common.o \ fe-secure-openssl.o diff --git a/src/test/Makefile b/src/test/Makefile index ab1ef9a475..f7859c2fd5 100644 --- a/src/test/Makefile +++ b/src/test/Makefile @@ -28,7 +28,7 @@ ifneq (,$(filter ldap,$(PG_TEST_EXTRA))) SUBDIRS +=3D ldap endif endif -ifeq ($(with_openssl),yes) +ifeq ($(with_ssl),openssl) ifneq (,$(filter ssl,$(PG_TEST_EXTRA))) SUBDIRS +=3D ssl endif diff --git a/src/test/modules/Makefile b/src/test/modules/Makefile index 59921b46cf..5391f461a2 100644 --- a/src/test/modules/Makefile +++ b/src/test/modules/Makefile @@ -28,7 +28,7 @@ SUBDIRS =3D \ unsafe_tests \ worker_spi =20 -ifeq ($(with_openssl),yes) +ifeq ($(with_ssl),openssl) SUBDIRS +=3D ssl_passphrase_callback else ALWAYS_SUBDIRS +=3D ssl_passphrase_callback diff --git a/src/test/modules/ssl_passphrase_callback/Makefile b/src/test/m= odules/ssl_passphrase_callback/Makefile index f81265c296..a34d7ea46a 100644 --- a/src/test/modules/ssl_passphrase_callback/Makefile +++ b/src/test/modules/ssl_passphrase_callback/Makefile @@ -1,6 +1,6 @@ # ssl_passphrase_callback Makefile =20 -export with_openssl +export with_ssl =20 MODULE_big =3D ssl_passphrase_func OBJS =3D ssl_passphrase_func.o $(WIN32RES) diff --git a/src/test/modules/ssl_passphrase_callback/t/001_testfunc.pl b/s= rc/test/modules/ssl_passphrase_callback/t/001_testfunc.pl index dbc084f870..d9838a5d5a 100644 --- a/src/test/modules/ssl_passphrase_callback/t/001_testfunc.pl +++ b/src/test/modules/ssl_passphrase_callback/t/001_testfunc.pl @@ -7,7 +7,7 @@ use TestLib; use Test::More; use PostgresNode; =20 -unless (($ENV{with_openssl} || 'no') eq 'yes') +unless ($ENV{with_ssl} eq 'openssl') { plan skip_all =3D> 'SSL not supported by this build'; } diff --git a/src/test/ssl/Makefile b/src/test/ssl/Makefile index 93335b1ea2..d545382eea 100644 --- a/src/test/ssl/Makefile +++ b/src/test/ssl/Makefile @@ -13,7 +13,7 @@ subdir =3D src/test/ssl top_builddir =3D ../../.. include $(top_builddir)/src/Makefile.global =20 -export with_openssl +export with_ssl =20 CERTIFICATES :=3D server_ca server-cn-and-alt-names \ server-cn-only server-single-alt-name server-multiple-alt-names \ diff --git a/src/test/ssl/t/001_ssltests.pl b/src/test/ssl/t/001_ssltests.pl index fd2727b568..9cf4ee24cb 100644 --- a/src/test/ssl/t/001_ssltests.pl +++ b/src/test/ssl/t/001_ssltests.pl @@ -11,7 +11,7 @@ use lib $FindBin::RealBin; =20 use SSLServer; =20 -if ($ENV{with_openssl} eq 'yes') +if ($ENV{with_ssl} eq 'openssl') { plan tests =3D> 93; } diff --git a/src/test/ssl/t/002_scram.pl b/src/test/ssl/t/002_scram.pl index a088f71a1a..2bdd638115 100644 --- a/src/test/ssl/t/002_scram.pl +++ b/src/test/ssl/t/002_scram.pl @@ -13,7 +13,7 @@ use lib $FindBin::RealBin; =20 use SSLServer; =20 -if ($ENV{with_openssl} ne 'yes') +if ($ENV{with_ssl} ne 'openssl') { plan skip_all =3D> 'SSL not supported by this build'; } diff --git a/doc/src/sgml/installation.sgml b/doc/src/sgml/installation.sgml index a53389b728..2d52068310 100644 --- a/doc/src/sgml/installation.sgml +++ b/doc/src/sgml/installation.sgml @@ -967,7 +967,7 @@ build-postgresql: =20 - + diff --git a/doc/src/sgml/pgcrypto.sgml b/doc/src/sgml/pgcrypto.sgml index 3d74e15ec9..b6bb23de0f 100644 --- a/doc/src/sgml/pgcrypto.sgml +++ b/doc/src/sgml/pgcrypto.sgml @@ -1154,7 +1154,7 @@ gen_random_uuid() returns uuid pgcrypto configures itself according to the findi= ngs of the main PostgreSQL configure script. The options that affect it are --with-zlib and - --with-openssl. + --with-ssl=3Dopenssl. =20 diff --git a/doc/src/sgml/sslinfo.sgml b/doc/src/sgml/sslinfo.sgml index 3213c039ca..2a9c45a111 100644 --- a/doc/src/sgml/sslinfo.sgml +++ b/doc/src/sgml/sslinfo.sgml @@ -22,7 +22,7 @@ =20 This extension won't build at all unless the installation was - configured with --with-openssl. + configured with --with-ssl=3Dopenssl. =20 diff --git a/contrib/Makefile b/contrib/Makefile index 7a4866e338..ae1fd64028 100644 --- a/contrib/Makefile +++ b/contrib/Makefile @@ -52,7 +52,7 @@ SUBDIRS =3D \ unaccent \ vacuumlo =20 -ifeq ($(with_openssl),yes) +ifeq ($(with_ssl),openssl) SUBDIRS +=3D sslinfo else ALWAYS_SUBDIRS +=3D sslinfo diff --git a/contrib/pgcrypto/Makefile b/contrib/pgcrypto/Makefile index 316a26e58d..c0b4f1fcf6 100644 --- a/contrib/pgcrypto/Makefile +++ b/contrib/pgcrypto/Makefile @@ -10,8 +10,8 @@ OSSL_TESTS =3D sha2 des 3des cast5 ZLIB_TST =3D pgp-compression ZLIB_OFF_TST =3D pgp-zlib-DISABLED =20 -CF_SRCS =3D $(if $(subst no,,$(with_openssl)), $(OSSL_SRCS), $(INT_SRCS)) -CF_TESTS =3D $(if $(subst no,,$(with_openssl)), $(OSSL_TESTS), $(INT_TESTS= )) +CF_SRCS =3D $(if $(subst openssl,,$(with_ssl)), $(INT_SRCS), $(OSSL_SRCS)) +CF_TESTS =3D $(if $(subst openssl,,$(with_ssl)), $(INT_TESTS), $(OSSL_TEST= S)) CF_PGP_TESTS =3D $(if $(subst no,,$(with_zlib)), $(ZLIB_TST), $(ZLIB_OFF_T= ST)) =20 SRCS =3D \ diff --git a/configure b/configure index e202697bbf..092e03e8ed 100755 --- a/configure +++ b/configure @@ -653,6 +653,7 @@ LIBOBJS UUID_LIBS LDAP_LIBS_BE LDAP_LIBS_FE +with_ssl PTHREAD_CFLAGS PTHREAD_LIBS PTHREAD_CC @@ -709,7 +710,6 @@ with_uuid with_readline with_systemd with_selinux -with_openssl with_ldap with_krb_srvnam krb_srvtab @@ -854,7 +854,6 @@ with_pam with_bsd_auth with_ldap with_bonjour -with_openssl with_selinux with_systemd with_readline @@ -866,6 +865,8 @@ with_libxslt with_system_tzdata with_zlib with_gnu_ld +with_ssl +with_openssl enable_largefile ' ac_precious_vars=3D'build_alias @@ -1556,7 +1557,6 @@ Optional Packages: --with-bsd-auth build with BSD Authentication support --with-ldap build with LDAP support --with-bonjour build with Bonjour support - --with-openssl build with OpenSSL support --with-selinux build with SELinux support --with-systemd build with systemd support --without-readline do not use GNU Readline nor BSD Libedit for edit= ing @@ -1570,6 +1570,8 @@ Optional Packages: use system time zone data in DIR --without-zlib do not use Zlib --with-gnu-ld assume the C compiler uses GNU ld [default=3Dno] + --with-ssl=3DLIB use LIB for SSL/TLS support (openssl) + --with-openssl obsolete spelling of --with-ssl=3Dopenssl =20 Some influential environment variables: CC C compiler command @@ -8070,41 +8072,6 @@ fi $as_echo "$with_bonjour" >&6; } =20 =20 -# -# OpenSSL -# -{ $as_echo "$as_me:${as_lineno-$LINENO}: checking whether to build with Op= enSSL support" >&5 -$as_echo_n "checking whether to build with OpenSSL support... " >&6; } - - - -# Check whether --with-openssl was given. -if test "${with_openssl+set}" =3D set; then : - withval=3D$with_openssl; - case $withval in - yes) - -$as_echo "#define USE_OPENSSL 1" >>confdefs.h - - ;; - no) - : - ;; - *) - as_fn_error $? "no argument expected for --with-openssl option" "$LI= NENO" 5 - ;; - esac - -else - with_openssl=3Dno - -fi - - -{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $with_openssl" >&5 -$as_echo "$with_openssl" >&6; } - - # # SELinux # @@ -12174,7 +12141,64 @@ fi fi fi =20 +# +# SSL Library +# +# There is currently one supported SSL/TLS libraries: OpenSSL. +# + + + +# Check whether --with-ssl was given. +if test "${with_ssl+set}" =3D set; then : + withval=3D$with_ssl; + case $withval in + yes) + as_fn_error $? "argument required for --with-ssl option" "$LINENO" 5 + ;; + no) + as_fn_error $? "argument required for --with-ssl option" "$LINENO" 5 + ;; + *) + + ;; + esac + +fi + + +if test x"$with_ssl" =3D x"" ; then + with_ssl=3Dno +fi + + + +# Check whether --with-openssl was given. +if test "${with_openssl+set}" =3D set; then : + withval=3D$with_openssl; + case $withval in + yes) + : + ;; + no) + : + ;; + *) + as_fn_error $? "no argument expected for --with-openssl option" "$LI= NENO" 5 + ;; + esac + +else + with_openssl=3Dno + +fi + + if test "$with_openssl" =3D yes ; then + with_ssl=3Dopenssl +fi + +if test "$with_ssl" =3D openssl ; then # Minimum required OpenSSL version is 1.0.1 =20 $as_echo "#define OPENSSL_API_COMPAT 0x10001000L" >>confdefs.h @@ -12435,8 +12459,14 @@ _ACEOF fi done =20 + +$as_echo "#define USE_OPENSSL 1" >>confdefs.h + +elif test "$with_ssl" !=3D no ; then + as_fn_error $? "--with-ssl must specify openssl" "$LINENO" 5 fi =20 + if test "$with_pam" =3D yes ; then { $as_echo "$as_me:${as_lineno-$LINENO}: checking for pam_start in -lpam= " >&5 $as_echo_n "checking for pam_start in -lpam... " >&6; } @@ -13322,7 +13352,7 @@ done =20 fi =20 -if test "$with_openssl" =3D yes ; then +if test "$with_ssl" =3D openssl ; then ac_fn_c_check_header_mongrel "$LINENO" "openssl/ssl.h" "ac_cv_header_ope= nssl_ssl_h" "$ac_includes_default" if test "x$ac_cv_header_openssl_ssl_h" =3D xyes; then : =20 @@ -18098,7 +18128,7 @@ fi # will be used. { $as_echo "$as_me:${as_lineno-$LINENO}: checking which random number sour= ce to use" >&5 $as_echo_n "checking which random number source to use... " >&6; } -if test x"$with_openssl" =3D x"yes" ; then +if test x"$with_ssl" =3D x"openssl" ; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: OpenSSL" >&5 $as_echo "OpenSSL" >&6; } elif test x"$PORTNAME" =3D x"win32" ; then diff --git a/configure.ac b/configure.ac index a5ad072ee4..f7a2db2574 100644 --- a/configure.ac +++ b/configure.ac @@ -852,15 +852,6 @@ PGAC_ARG_BOOL(with, bonjour, no, AC_MSG_RESULT([$with_bonjour]) =20 =20 -# -# OpenSSL -# -AC_MSG_CHECKING([whether to build with OpenSSL support]) -PGAC_ARG_BOOL(with, openssl, no, [build with OpenSSL support], - [AC_DEFINE([USE_OPENSSL], 1, [Define to build with OpenSSL s= upport. (--with-openssl)])]) -AC_MSG_RESULT([$with_openssl]) -AC_SUBST(with_openssl) - # # SELinux # @@ -1205,7 +1196,21 @@ if test "$with_gssapi" =3D yes ; then fi fi =20 +# +# SSL Library +# +# There is currently one supported SSL/TLS libraries: OpenSSL. +# +PGAC_ARG_REQ(with, ssl, [LIB], [use LIB for SSL/TLS support (openssl)]) +if test x"$with_ssl" =3D x"" ; then + with_ssl=3Dno +fi +PGAC_ARG_BOOL(with, openssl, no, [obsolete spelling of --with-ssl=3Dopenss= l]) if test "$with_openssl" =3D yes ; then + with_ssl=3Dopenssl +fi + +if test "$with_ssl" =3D openssl ; then dnl Order matters! # Minimum required OpenSSL version is 1.0.1 AC_DEFINE(OPENSSL_API_COMPAT, [0x10001000L], @@ -1229,7 +1234,11 @@ if test "$with_openssl" =3D yes ; then # thread-safety. In 1.1.0, it's no longer required, and CRYPTO_lock() # function was removed. AC_CHECK_FUNCS([CRYPTO_lock]) + AC_DEFINE([USE_OPENSSL], 1, [Define to 1 if you have OpenSSL support.]) +elif test "$with_ssl" !=3D no ; then + AC_MSG_ERROR([--with-ssl must specify openssl]) fi +AC_SUBST(with_ssl) =20 if test "$with_pam" =3D yes ; then AC_CHECK_LIB(pam, pam_start, [], [AC_MSG_ERROR([library 'pam' is requ= ired for PAM])]) @@ -1402,7 +1411,7 @@ if test "$with_gssapi" =3D yes ; then [AC_CHECK_HEADERS(gssapi.h, [], [AC_MSG_ERROR([gssapi.h header file is re= quired for GSSAPI])])]) fi =20 -if test "$with_openssl" =3D yes ; then +if test "$with_ssl" =3D openssl ; then AC_CHECK_HEADER(openssl/ssl.h, [], [AC_MSG_ERROR([header file is required for OpenSSL])]) AC_CHECK_HEADER(openssl/err.h, [], [AC_MSG_ERROR([header file is required for OpenSSL])]) fi @@ -2159,7 +2168,7 @@ fi # first choice, else the native platform sources (Windows API or /dev/uran= dom) # will be used. AC_MSG_CHECKING([which random number source to use]) -if test x"$with_openssl" =3D x"yes" ; then +if test x"$with_ssl" =3D x"openssl" ; then AC_MSG_RESULT([OpenSSL]) elif test x"$PORTNAME" =3D x"win32" ; then AC_MSG_RESULT([Windows native]) diff --git a/src/Makefile.global.in b/src/Makefile.global.in index 9a1688c97c..74b3a6acd2 100644 --- a/src/Makefile.global.in +++ b/src/Makefile.global.in @@ -183,7 +183,7 @@ with_icu =3D @with_icu@ with_perl =3D @with_perl@ with_python =3D @with_python@ with_tcl =3D @with_tcl@ -with_openssl =3D @with_openssl@ +with_ssl =3D @with_ssl@ with_readline =3D @with_readline@ with_selinux =3D @with_selinux@ with_systemd =3D @with_systemd@ diff --git a/src/tools/msvc/Solution.pm b/src/tools/msvc/Solution.pm index 2f28de0355..1c0c92fcd2 100644 --- a/src/tools/msvc/Solution.pm +++ b/src/tools/msvc/Solution.pm @@ -1156,7 +1156,7 @@ sub GetFakeConfigure $cfg .=3D ' --with-ldap' if ($self->{options}->{ldap}); $cfg .=3D ' --without-zlib' unless ($self->{options}->{zlib}); $cfg .=3D ' --with-extra-version' if ($self->{options}->{extraver}); - $cfg .=3D ' --with-openssl' if ($self->{options}->{openssl}); + $cfg .=3D ' --with-ssl=3Dopenssl' if ($self->{options}->{openssl}); $cfg .=3D ' --with-uuid' if ($self->{options}->{uuid}); $cfg .=3D ' --with-libxml' if ($self->{options}->{xml}); $cfg .=3D ' --with-libxslt' if ($self->{options}->{xslt}); diff --git a/src/tools/msvc/config_default.pl b/src/tools/msvc/config_defau= lt.pl index 2ef2cfc4e9..5395e211eb 100644 --- a/src/tools/msvc/config_default.pl +++ b/src/tools/msvc/config_default.pl @@ -16,7 +16,7 @@ our $config =3D { tcl =3D> undef, # --with-tcl=3D perl =3D> undef, # --with-perl=3D python =3D> undef, # --with-python=3D - openssl =3D> undef, # --with-openssl=3D + openssl =3D> undef, # --with-ssl=3Dopenssl with uuid =3D> undef, # --with-uuid=3D xml =3D> undef, # --with-libxml=3D xslt =3D> undef, # --with-libxslt=3D --=20 2.30.0 --15/bOGxK/F+5cBNK-- --Th+OLmLwNcOEeXYh Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAmARGKsACgkQnvQgOdby QH3a3w/+NKtmVvK6CurfN8stWjBNzcToB9EmsyXxyjbdDDlhssMW0tRe+h+Mt8+q xo1Pq0O6UTgUoWvR3fWuFGAqx7CK0G2pfYW8c1k7itYvd4lh/tZ4hxvD5Gh/PMPg PA5mIGrTDpBvxaUfZUhK0+3FojXYynY3x67oYdPZaORUciiBTmWV3EprgMi1q7NA Bf3fwhN0wIjQHsWGjtYmGfJxpT3a/8sOsyKEtx6PPCpdp6iJH2sqUe6cOt2u5uwl AMxRdOvljcXm7+JAAoafOG8ECE71Mr4C/qbJjXb6L2I9PKQQl/fdbxo3pd82doyY +Y6Tz+eCTk8H7LIfHGXx8wiEwQjTL0cfbwOgDyuuOofkJy8B5zSJHkDJNtiHFmVK g/GSNwxLvIux67qbf8DCsquhJE0zXHU9tEA6ULIih4zMkwuCQyDg9mLR0MB5Od+2 2wP8TDI9MmAkbfq8KKSxRb+VlstfpoEB2Pyi0laz8fjS16k8dsVr5Otjq3gf1OBW /hGC0X3vrFnJCRKLRsJK7PUQO+kn/a8PpAEiVqm+CVz3IqxWUtrbagCrZaKK7D9a to5upQ4oyHl1wxl1+srFwDcyHEsmXMmXW3fwxvaGjoK6LRfI6AAk1va1phXpSQBJ 2qZ4TtGYQbsyZbZUt1BAozIjwm4xFgQK36zcFNJah6Kto6Wi/E8= =6IHi -----END PGP SIGNATURE----- --Th+OLmLwNcOEeXYh--