rdelaage
/
postgresql
mirror of https://git.postgresql.org/git/postgresql.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Remove support for OpenSSL 0.9.8 and 1.0.0 

Support is out of scope from all the major vendors for these versions
(for example RHEL5 uses a version based on 0.9.8, and RHEL6 uses 1.0.1),
and it created some extra maintenance work.  Upstream has stopped
support of 0.9.8 in December 2015 and of 1.0.0 in February 2016.

Since b1abfec, note that the default SSL protocol version set with
ssl_min_protocol_version is TLSv1.2, whose support was added in OpenSSL
1.0.1, so there is no point to enforce ssl_min_protocol_version to TLSv1
in the SSL tests.

Author: Michael Paquier
Reviewed-by: Daniel Gustafsson, Tom Lane
Discussion: https://postgr.es/m/20191205083252.GE5064@paquier.xyz
This commit is contained in:
Michael Paquier 2020-01-06 12:51:44 +09:00
parent fc31001123
commit 7b283d0e1d
5 changed files with 2 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
doc/src/sgml/installation.sgml
View File

@ -254,7 +254,7 @@ su - postgres
encrypted client connections. <productname>OpenSSL</productname> is
also required for random number generation on platforms that do not
have <filename>/dev/urandom</filename> (except Windows). The minimum
version required is 0.9.8.
version required is 1.0.1.
</para>
</listitem>

4
doc/src/sgml/libpq.sgml
View File

@ -1608,10 +1608,6 @@ postgresql://%2Fvar%2Flib%2Fpostgresql/dbname
compression by default, and many operating system distributions
disable it in prior versions as well, so setting this parameter to on
will not have any effect if the server does not accept compression.
On the other hand, <productname>OpenSSL</productname> before 1.0.0
does not support disabling compression, so this parameter is ignored
with those versions, and whether compression is used depends on the
server.
</para>
<para>

2
src/backend/libpq/be-secure-openssl.c
View File

@ -223,9 +223,7 @@ be_tls_init(bool isServerStart)
}
/* disallow SSL session tickets */
#ifdef SSL_OP_NO_TICKET /* added in OpenSSL 0.9.8f */
SSL_CTX_set_options(context, SSL_OP_NO_TICKET);
#endif
/* disallow SSL session caching, too */
SSL_CTX_set_session_cache_mode(context, SSL_SESS_CACHE_OFF);

5
src/interfaces/libpq/fe-secure-openssl.c
View File

@ -1192,15 +1192,12 @@ initialize_SSL(PGconn *conn)
SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, verify_cb);
/*
* Set compression option if the OpenSSL version used supports it (from
* 1.0.0 on).
* Set compression option if necessary.
*/
#ifdef SSL_OP_NO_COMPRESSION
if (conn->sslcompression && conn->sslcompression[0] == '0')
SSL_set_options(conn->ssl, SSL_OP_NO_COMPRESSION);
else
SSL_clear_options(conn->ssl, SSL_OP_NO_COMPRESSION);
#endif
return 0;
}

4
src/test/ssl/t/SSLServer.pm
View File

@ -132,10 +132,6 @@ sub configure_test_server_for_ssl
print $conf "listen_addresses='$serverhost'\n";
print $conf "log_statement=all\n";
# Accept even old TLS versions so that builds with older OpenSSL
# can run the test suite.
print $conf "ssl_min_protocol_version='TLSv1'\n";
# enable SSL and set up server key
print $conf "include 'sslconfig.conf'\n";