Fix handling of OpenSSL's SSL_clear_options

This function is supported down to OpenSSL 0.9.8, which is the oldest
version supported since 593d4e4 (from Postgres 10 onwards), and is used
since e3bdb2d (from 11 onwards).  It is defined as a macro from OpenSSL
0.9.8 to 1.0.2, and as a function in 1.1.0 and newer versions.  However,
the configure check present is only adapted for functions.  So, even if
the code would be able to compile, configure fails to detect the macro,
causing it to be ignored when compiling the code with OpenSSL from 0.9.8
to 1.0.2.

The code needs a configure check as per a364dfa, which has fixed a
compilation issue with a past version of LibreSSL in NetBSD 5.1.  On
HEAD, just remove the configure check as the last release of NetBSD 5 is
from 2014 (and we have no more buildfarm members for it).  In 11 and 12,
improve the configure logic so as both macros and functions are
correctly detected.  This makes NetBSD 5 still work on already-released
branches, but not for 13 onwards.

The patch for HEAD is from me, and Daniel has written the version to use
for the back-branches.

Author: Michael Paquier, Daniel Gustaffson
Reviewed-by: Tom Lane
Discussion: https://postgr.es/m/20191205083252.GE5064@paquier.xyz
Discussion: https://postgr.es/m/98F7F99E-1129-41D8-B86B-FE3B1E286881@yesql.se
Backpatch-through: 11

diff --git a/configure b/configure
index 56c4aaa95bca50d50014003da7f75c562236fa67..3d9bd0bdf873664403d93eb2d2bd546ef764d089 100755 (executable)
--- a/configure
+++ b/configure
@@ -12094,13 +12094,13 @@ else
 fi
 
   fi
-  for ac_func in SSL_clear_options X509_get_signature_nid
+  # Function introduced in OpenSSL 1.0.2.
+  for ac_func in X509_get_signature_nid
 do :
-  as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
-ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
-if eval test \"x\$"$as_ac_var"\" = x"yes"; then :
+  ac_fn_c_check_func "$LINENO" "X509_get_signature_nid" "ac_cv_func_X509_get_signature_nid"
+if test "x$ac_cv_func_X509_get_signature_nid" = xyes; then :
   cat >>confdefs.h <<_ACEOF
-#define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1
+#define HAVE_X509_GET_SIGNATURE_NID 1
 _ACEOF
 
 fi

diff --git a/configure.in b/configure.in
index 9fd9c390e6baf48caf9d267dc8e9f3b257bce2d1..34aea0b4ace8fc8009f84180dadb80c1c5e3c6a4 100644 (file)
--- a/configure.in
+++ b/configure.in
@@ -1186,7 +1186,8 @@ if test "$with_openssl" = yes ; then
      AC_SEARCH_LIBS(CRYPTO_new_ex_data, [eay32 crypto], [], [AC_MSG_ERROR([library 'eay32' or 'crypto' is required for OpenSSL])])
      AC_SEARCH_LIBS(SSL_new, [ssleay32 ssl], [], [AC_MSG_ERROR([library 'ssleay32' or 'ssl' is required for OpenSSL])])
   fi
-  AC_CHECK_FUNCS([SSL_clear_options X509_get_signature_nid])
+  # Function introduced in OpenSSL 1.0.2.
+  AC_CHECK_FUNCS([X509_get_signature_nid])
   # Functions introduced in OpenSSL 1.1.0. We used to check for
   # OPENSSL_VERSION_NUMBER, but that didn't work with 1.1.0, because LibreSSL
   # defines OPENSSL_VERSION_NUMBER to claim version 2.0.0, even though it

diff --git a/src/include/pg_config.h.in b/src/include/pg_config.h.in
index 0d77f2aafd119a9f11c37a073b4f40c721b7fe52..050c48b108b860369848717852063aeb03e4a7c2 100644 (file)
--- a/src/include/pg_config.h.in
+++ b/src/include/pg_config.h.in
@@ -512,9 +512,6 @@
 /* Define to 1 if you have the `srandom' function. */
 #undef HAVE_SRANDOM
 
-/* Define to 1 if you have the `SSL_clear_options' function. */
-#undef HAVE_SSL_CLEAR_OPTIONS
-
 /* Define to 1 if stdbool.h conforms to C99. */
 #undef HAVE_STDBOOL_H
 

diff --git a/src/include/pg_config.h.win32 b/src/include/pg_config.h.win32
index 467fb89ee61d41cd2f496a86448fbfe15e9fe6ba..09cedd0bda15feacb0adc609b7dd2161c08b270b 100644 (file)
--- a/src/include/pg_config.h.win32
+++ b/src/include/pg_config.h.win32
@@ -370,9 +370,6 @@
 /* Define to 1 if you have the `srandom' function. */
 /* #undef HAVE_SRANDOM */
 
-/* Define to 1 if you have the `SSL_clear_options' function. */
-#define HAVE_SSL_CLEAR_OPTIONS 1
-
 /* Define to 1 if stdbool.h conforms to C99. */
 #define HAVE_STDBOOL_H 1
 

diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c
index cba81f63c0d812615fbbb12194cdfd030333a846..c71da75cfd540a5e237574af525f5fc08f765f4a 100644 (file)
--- a/src/interfaces/libpq/fe-secure-openssl.c
+++ b/src/interfaces/libpq/fe-secure-openssl.c
@@ -1198,17 +1198,8 @@ initialize_SSL(PGconn *conn)
 #ifdef SSL_OP_NO_COMPRESSION
    if (conn->sslcompression && conn->sslcompression[0] == '0')
        SSL_set_options(conn->ssl, SSL_OP_NO_COMPRESSION);
-
-   /*
-    * Mainline OpenSSL introduced SSL_clear_options() before
-    * SSL_OP_NO_COMPRESSION, so this following #ifdef should not be
-    * necessary, but some old NetBSD version have a locally modified libssl
-    * that has SSL_OP_NO_COMPRESSION but not SSL_clear_options().
-    */
-#ifdef HAVE_SSL_CLEAR_OPTIONS
    else
        SSL_clear_options(conn->ssl, SSL_OP_NO_COMPRESSION);
-#endif
 #endif
 
    return 0;