Remove support for OpenSSL 0.9.8 and 1.0.0

Support is out of scope from all the major vendors for these versions
(for example RHEL5 uses a version based on 0.9.8, and RHEL6 uses 1.0.1),
and it created some extra maintenance work.  Upstream has stopped
support of 0.9.8 in December 2015 and of 1.0.0 in February 2016.

Since b1abfec, note that the default SSL protocol version set with
ssl_min_protocol_version is TLSv1.2, whose support was added in OpenSSL
1.0.1, so there is no point to enforce ssl_min_protocol_version to TLSv1
in the SSL tests.

Author: Michael Paquier
Reviewed-by: Daniel Gustafsson, Tom Lane
Discussion: https://postgr.es/m/20191205083252.GE5064@paquier.xyz

diff --git a/doc/src/sgml/installation.sgml b/doc/src/sgml/installation.sgml
index 9c10a897f19523389d9a2e06040d35d833b5ef0a..d4904bf5a06fd66705cbf39e308cf5008c4344ee 100644 (file)
--- a/doc/src/sgml/installation.sgml
+++ b/doc/src/sgml/installation.sgml
@@ -254,7 +254,7 @@ su - postgres
       encrypted client connections.  <productname>OpenSSL</productname> is
       also required for random number generation on platforms that do not
       have <filename>/dev/urandom</filename> (except Windows).  The minimum
-      version required is 0.9.8.
+      version required is 1.0.1.
      </para>
     </listitem>
 

diff --git a/doc/src/sgml/libpq.sgml b/doc/src/sgml/libpq.sgml
index 66b09da06f128c0d215b50be56c9edf660b8485f..64cff49c4d7231baeb6d2102ca9a1cf56d5440af 100644 (file)
--- a/doc/src/sgml/libpq.sgml
+++ b/doc/src/sgml/libpq.sgml
@@ -1608,10 +1608,6 @@ postgresql://%2Fvar%2Flib%2Fpostgresql/dbname
         compression by default, and many operating system distributions
         disable it in prior versions as well, so setting this parameter to on
         will not have any effect if the server does not accept compression.
-        On the other hand, <productname>OpenSSL</productname> before 1.0.0
-        does not support disabling compression, so this parameter is ignored
-        with those versions, and whether compression is used depends on the
-        server.
        </para>
 
        <para>

diff --git a/src/backend/libpq/be-secure-openssl.c b/src/backend/libpq/be-secure-openssl.c
index 7ad32116eab2b7a677e4abddabc6f0ac1ad4942a..62f1fcab2b031539e060068225b0c89a81f401c6 100644 (file)
--- a/src/backend/libpq/be-secure-openssl.c
+++ b/src/backend/libpq/be-secure-openssl.c
@@ -223,9 +223,7 @@ be_tls_init(bool isServerStart)
    }
 
    /* disallow SSL session tickets */
-#ifdef SSL_OP_NO_TICKET            /* added in OpenSSL 0.9.8f */
    SSL_CTX_set_options(context, SSL_OP_NO_TICKET);
-#endif
 
    /* disallow SSL session caching, too */
    SSL_CTX_set_session_cache_mode(context, SSL_SESS_CACHE_OFF);

diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c
index ce8e252c091936c5dba08405647e3c912ea1712c..0e84fc8ac6f6662df95150ebce89e9e2cfcd4abe 100644 (file)
--- a/src/interfaces/libpq/fe-secure-openssl.c
+++ b/src/interfaces/libpq/fe-secure-openssl.c
@@ -1192,15 +1192,12 @@ initialize_SSL(PGconn *conn)
        SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, verify_cb);
 
    /*
-    * Set compression option if the OpenSSL version used supports it (from
-    * 1.0.0 on).
+    * Set compression option if necessary.
     */
-#ifdef SSL_OP_NO_COMPRESSION
    if (conn->sslcompression && conn->sslcompression[0] == '0')
        SSL_set_options(conn->ssl, SSL_OP_NO_COMPRESSION);
    else
        SSL_clear_options(conn->ssl, SSL_OP_NO_COMPRESSION);
-#endif
 
    return 0;
 }

diff --git a/src/test/ssl/t/SSLServer.pm b/src/test/ssl/t/SSLServer.pm
index 26b5964f4fe23a93d9663203c53ae384a6d66a83..005955a2ff736ea094c4bee504c47a66f8566026 100644 (file)
--- a/src/test/ssl/t/SSLServer.pm
+++ b/src/test/ssl/t/SSLServer.pm
@@ -132,10 +132,6 @@ sub configure_test_server_for_ssl
    print $conf "listen_addresses='$serverhost'\n";
    print $conf "log_statement=all\n";
 
-   # Accept even old TLS versions so that builds with older OpenSSL
-   # can run the test suite.
-   print $conf "ssl_min_protocol_version='TLSv1'\n";
-
    # enable SSL and set up server key
    print $conf "include 'sslconfig.conf'\n";