Feedback-ID: i0fe9450f:Fastmail
Date: Wed, 1 May 2024 13:21:32 +0900
From: Michael Paquier <michael@paquier.xyz>
To: Daniel Gustafsson <daniel@yesql.se>
Cc: Peter Eisentraut <peter@eisentraut.org>,
	Jacob Champion <jacob.champion@enterprisedb.com>,
	Thomas Munro <thomas.munro@gmail.com>,
	Postgres hackers <pgsql-hackers@lists.postgresql.org>,
	mikael.kjellstrom@gmail.com, Tom Lane <tgl@sss.pgh.pa.us>
Subject: Re: Cutting support for OpenSSL 1.0.1 and 1.0.2 in 17~?
Message-ID: <ZjHDTGKUM_TK1PDn@paquier.xyz>
References: <885D539C-6711-470A-8CD7-44D55E8E5183@yesql.se>
 <5f746aeb-105e-4a29-babf-54ee0d6e4f6f@eisentraut.org>
 <ZiIDH74oDzN1x6hc@paquier.xyz>
 <a1790e25-d88c-4492-aa0f-f0aeb6b05698@eisentraut.org>
 <C6987F7E-7B5B-4E52-9CA8-F1F1724E6DE3@yesql.se>
 <Zig0KxDdU7a5GbN7@paquier.xyz>
 <1D766D04-0B6C-4DB2-91B7-836B0C9A146E@yesql.se>
 <ZinSvMZ0mQSNBZEs@paquier.xyz>
 <56D38F23-11BB-4A30-866F-9D6EA21ABA25@yesql.se>
 <A191B62D-68D6-49FD-93C6-810BD83BE28C@yesql.se>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="6cJ6hj6+MufV+J2l"
Content-Disposition: inline
In-Reply-To: <A191B62D-68D6-49FD-93C6-810BD83BE28C@yesql.se>
Archived-At: <https://www.postgresql.org/message-id/ZjHDTGKUM_TK1PDn%40paquier.xyz>
Precedence: bulk


--6cJ6hj6+MufV+J2l
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Sat, Apr 27, 2024 at 08:33:55PM +0200, Daniel Gustafsson wrote:
> > On 27 Apr 2024, at 20:32, Daniel Gustafsson <daniel@yesql.se> wrote:
>=20
> > That's a good point, there is potential for more code removal here.  The
> > attached 0001 takes a stab at it while it's fresh in mind, I'll revisit=
 before
> > the July CF to see if there is more that can be done.
>=20
> ..and again with the attachment. Not enough coffee.

My remark was originally about pq_init_crypto_lib that does the
locking initialization, and your new patch a bit more, as of:

-    /* This stuff need be done only once. */
-    if (!SSL_initialized)
-    {
-#ifdef HAVE_OPENSSL_INIT_SSL
-        OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG, NULL);
-#else
-        OPENSSL_config(NULL);
-        SSL_library_init();
-        SSL_load_error_strings();
-#endif
-        SSL_initialized =3D true;
-    }

OPENSSL_init_ssl() has replaced SSL_library_init(), marked as
deprecated, and even this step is mentioned as not required anymore
with 1.1.0~:
https://www.openssl.org/docs/man1.1.1/man3/OPENSSL_init_ssl.html

Same with OPENSSL_init_crypto(), replacing OPENSSL_config(), again not
required in 1.1.0~:
https://www.openssl.org/docs/man1.1.1/man3/OPENSSL_init_crypto.html

SSL_load_error_strings() is recommended as not to use in 1.1.0,
replaced by the others:
https://www.openssl.org/docs/man3.2/man3/SSL_load_error_strings.html

While OpenSSL will be able to cope with that, how much of that applies
to LibreSSL?  SSL_load_error_strings(), OPENSSL_init_ssl(),
OPENSSL_CONFIG() are OK based on the docs:
https://man.archlinux.org/man/extra/libressl/libressl-OPENSSL_config.3.en
https://man.archlinux.org/man/extra/libressl/libressl-OPENSSL_init_ssl.3.en
https://man.archlinux.org/man/extra/libressl/libressl-ERR_load_crypto_strin=
gs.3.en

So +1 to remove all this code after a closer lookup.  I would
recommend to update the documentation of PQinitSSL and PQinitOpenSSL
to tell that these become useless and are deprecated.

    ERR_clear_error();
-
#ifdef USE_RESOWNER_FOR_HMAC

Some noise diff.
--
Michael

--6cJ6hj6+MufV+J2l
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEEG72nH6vTowiyblFKnvQgOdbyQH0FAmYxw0wACgkQnvQgOdby
QH3+QQ//ZeYrXuQDoUCaqUwNz10QYadmVxOr9BkYJwjhdB72l8CkXU+9p3h26YDq
IWda4/7v8UNO2ncFwO4WKPHGX0cQPOeisMK8BUaRM7JHFcL5nwBxGHM3zZYDFG6t
GQlip4xARYv2zC6A52gARvXVxuKs4ml8xh4cwkTAMcQnMQl7c0pIw91gPxHwEJRp
MCHtBc/g3a8SVwGukxrbpexXiDNXscAgq+AIsUYcxJQSAUjvGXgLpOZGgjU79mQ8
CejhS6tYv3ERl4t0FtTyA0eRJfYhGPRpv1bSsiCxakhzAZMOB3GCt8JKc3JSg0zq
29ge/0tWigCh0fqok/Obn4S2HaLXZk0HcPcA4jBg+pVWywTg2QlfuO0gTl5ggvUd
JRw3HxrCjz64l26gya3DPWHpMkRWDPLeTFsskLlsVSWkL2AlCxt2iGF5QsH36zos
5F+6TnjVET/KT9K5vvl8Ko2jl+dxOwJpohxTQdxg+chbTMEThZXJmDYNRVm6bLP1
A0ZNjDE5c4wgnk2twAAUyQLQsc4/KD09924HaiaIhVdb/h71W3If8+xVLmpWhW/f
OohgwVS/dXP/jNlOAxxkRcwhfrn5iU0AZ+zq0As0nHrIrVyKrXsajNzAyEeXKVu5
QtSs8x5Br7T0ZdhO01KHgIwWhCGKLgYMjrV11zpO4DgbzvTk+Kc=
=slra
-----END PGP SIGNATURE-----

--6cJ6hj6+MufV+J2l--