diff --git a/doc/src/sgml/libpq.sgml b/doc/src/sgml/libpq.sgml index c39a2273ce3..ebaf4ea0513 100644 --- a/doc/src/sgml/libpq.sgml +++ b/doc/src/sgml/libpq.sgml @@ -6710,6 +6710,9 @@ myEventProc(PGEventId evtId, void *evtInfo, void *passThrough) </indexterm> <envar>PGREQUIRESSL</envar> behaves the same as the <xref linkend="libpq-connect-requiressl"> connection parameter. + This environment variable is deprecated in favor of the + <envar>PGSSLMODE</envar> variable; setting both variables suppresses the + effect of this one. </para> </listitem> diff --git a/src/interfaces/libpq/fe-connect.c b/src/interfaces/libpq/fe-connect.c index 0748c00ac9f..9e813d6f000 100644 --- a/src/interfaces/libpq/fe-connect.c +++ b/src/interfaces/libpq/fe-connect.c @@ -4608,6 +4608,30 @@ conninfo_add_defaults(PQconninfoOption *options, PQExpBuffer errorMessage) } } + /* + * Interpret the deprecated PGREQUIRESSL environment variable. Per + * tradition, translate values starting with "1" to sslmode=require, + * and ignore other values. Given both PGREQUIRESSL=1 and PGSSLMODE, + * PGSSLMODE takes precedence; the opposite was true before v9.3. + */ + if (strcmp(option->keyword, "sslmode") == 0) + { + const char *requiresslenv = getenv("PGREQUIRESSL"); + + if (requiresslenv != NULL && requiresslenv[0] == '1') + { + option->val = strdup("require"); + if (!option->val) + { + if (errorMessage) + printfPQExpBuffer(errorMessage, + libpq_gettext("out of memory\n")); + return false; + } + continue; + } + } + /* * No environment variable specified or the variable isn't set - try * compiled-in default