pgsql: Remove support for OpenSSL older than 1.1.0
Remove support for OpenSSL older than 1.1.0
OpenSSL 1.0.2 has been EOL from the upstream OpenSSL project for
some time, and is no longer the default OpenSSL version with any
vendor which package PostgreSQL. By retiring support for OpenSSL
1.0.2 we can remove a lot of no longer required complexity for
managing state within libcrypto which is now handled by OpenSSL.
Reviewed-by: Jacob Champion <jacob.champion@enterprisedb.com>
Reviewed-by: Peter Eisentraut <peter@eisentraut.org>
Reviewed-by: Michael Paquier <michael@paquier.xyz>
Discussion: /messages/by-id/ZG3JNursG69dz1lr@paquier.xyz
Discussion: /messages/by-id/CA+hUKGKh7QrYzu=8yWEUJvXtMVm_CNWH1L_TLWCbZMwbi1XP2Q@mail.gmail.com
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/a70e01d4306fdbcd5fbedb4ca97e5c21c995da60
Modified Files
--------------
configure | 31 ++--
configure.ac | 12 +-
contrib/pgcrypto/openssl.c | 8 -
doc/src/sgml/installation.sgml | 2 +-
doc/src/sgml/libpq.sgml | 36 ++---
meson.build | 23 +--
src/backend/libpq/be-secure-openssl.c | 24 +--
src/common/Makefile | 3 +-
src/common/hmac_openssl.c | 20 +--
src/common/meson.build | 1 -
src/common/protocol_openssl.c | 117 ---------------
src/include/common/openssl.h | 14 +-
src/include/pg_config.h.in | 15 --
src/interfaces/libpq/fe-connect.c | 18 ---
src/interfaces/libpq/fe-secure-openssl.c | 246 -------------------------------
src/interfaces/libpq/fe-secure.c | 35 ++---
src/interfaces/libpq/libpq-int.h | 23 ---
src/test/ssl/t/001_ssltests.pl | 3 +-
18 files changed, 55 insertions(+), 576 deletions(-)
Hi Daniel,
On Mon, 2 Sept 2024 at 21:54, Daniel Gustafsson <dgustafsson@postgresql.org>
wrote:
Remove support for OpenSSL older than 1.1.0
I am trying to update my buildfarm animals for this, and although I fixed
massasauga (essentially by skipping the test for now), I am unclear why
snakefly still fails (now, much later into the cycle).
Could you point me on how to fix snakefly?
(I've tried to disable SSL tests, but that doesn't seem to be helping).
https://buildfarm.postgresql.org/cgi-bin/show_log.pl?nm=snakefly&dt=2024-09-03%2009%3A56%3A46
-
Thanks
Robins
On 3 Sep 2024, at 12:36, Robins Tharakan <tharakan@gmail.com> wrote:
I am trying to update my buildfarm animals for this, and although I fixed massasauga (essentially by skipping the test for now), I am unclear why snakefly still fails (now, much later into the cycle).
Could you point me on how to fix snakefly?
(I've tried to disable SSL tests, but that doesn't seem to be helping).https://buildfarm.postgresql.org/cgi-bin/show_log.pl?nm=snakefly&dt=2024-09-03%2009%3A56%3A46
The BF run entry claims it's failing in the ssl_passphrase_callbackCheck stage
which is odd, since without SSL it shouldn't recurse into that test module at
all.
Looking at massasauga it did recurse into there but then subsequently skipped
the test due to OpenSSL being missing. However, it would first need to compile
the test module in order to reach the SKIP statement in the TAP test, and I
believe that's where snakefly is failing. If I recompile postgres without SSL
and ensure that it cannot see any OpenSSL headers via standard includes I can
reproduce the error, the excerpt from install.log being the expected
compilation failure:
ssl_passphrase_func.c:29:23: error: unknown type name 'SSL_CTX'
static void set_rot13(SSL_CTX *context, bool isServerStart);
^
ssl_passphrase_func.c:52:3: error: use of undeclared identifier 'openssl_tls_init_hook'
openssl_tls_init_hook = set_rot13;
^
ssl_passphrase_func.c:56:11: error: unknown type name 'SSL_CTX'
set_rot13(SSL_CTX *context, bool isServerStart)
^
ssl_passphrase_func.c:63:2: error: call to undeclared function 'SSL_CTX_set_default_passwd_cb'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
SSL_CTX_set_default_passwd_cb(context, rot13_passphrase);
^
4 errors generated.
Does massasauga have OpenSSL headers such that the compiler can find them via
standard includes, and snakefly doesn't?
The buildfarm client should honor the rules in the src/test/modules Makefile
which skips the subdirectory when OpenSSL isn't present, but since the TAP test
have a SKIP clause I guess we should support it. The attached diff fixes it
for me, are you able to test that on snakefly?
--
Daniel Gustafsson