database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-06-16 06:01:02 +03:00
Code Activity

Remove support for OpenSSL older than 1.1.0

Browse Source 
OpenSSL 1.0.2 has been EOL from the upstream OpenSSL project for
some time, and is no longer the default OpenSSL version with any
vendor which package PostgreSQL. By retiring support for OpenSSL
1.0.2 we can remove a lot of no longer required complexity for
managing state within libcrypto which is now handled by OpenSSL.

Reviewed-by: Jacob Champion <jacob.champion@enterprisedb.com>
Reviewed-by: Peter Eisentraut <peter@eisentraut.org>
Reviewed-by: Michael Paquier <michael@paquier.xyz>
Discussion: https://postgr.es/m/ZG3JNursG69dz1lr@paquier.xyz
Discussion: https://postgr.es/m/CA+hUKGKh7QrYzu=8yWEUJvXtMVm_CNWH1L_TLWCbZMwbi1XP2Q@mail.gmail.com
This commit is contained in:
Daniel Gustafsson
2024-09-02 13:51:48 +02:00
parent 6ebeeae296
commit a70e01d430
18 changed files with 53 additions and 574 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
doc/src/sgml/installation.sgml
View File

@ -293,7 +293,7 @@
encrypted client connections. <productname>OpenSSL</productname> is
also required for random number generation on platforms that do not
have <filename>/dev/urandom</filename> (except Windows). The minimum
required version is 1.0.2.
required version is 1.1.0.
</para>
</listitem>

36
doc/src/sgml/libpq.sgml
View File

@ -9865,9 +9865,11 @@ ldap://ldap.acme.com/cn=dbserver,cn=hosts?pgconnectinfo?base?(objectclass=*)
<title>SSL Library Initialization</title>
<para>
If your application initializes <literal>libssl</literal> and/or
<literal>libcrypto</literal> libraries and <application>libpq</application>
is built with <acronym>SSL</acronym> support, you should call
Applications which need to be compatible with older versions of
<productname>PostgreSQL</productname>, using <productname>OpenSSL</productname>
version 1.0.2 or older, need to initialize the SSL library before using it.
Applications which initialize <literal>libssl</literal> and/or
<literal>libcrypto</literal> libraries should call
<xref linkend="libpq-PQinitOpenSSL"/> to tell <application>libpq</application>
that the <literal>libssl</literal> and/or <literal>libcrypto</literal> libraries
have been initialized by your application, so that
@ -9875,6 +9877,10 @@ ldap://ldap.acme.com/cn=dbserver,cn=hosts?pgconnectinfo?base?(objectclass=*)
However, this is unnecessary when using <productname>OpenSSL</productname>
version 1.1.0 or later, as duplicate initializations are no longer problematic.
</para>
<para>
Refer to the documentation for the version of <productname>PostgreSQL</productname>
that you are targeting for details on their use.
</para>
<para>
<variablelist>
@ -9890,21 +9896,8 @@ void PQinitOpenSSL(int do_ssl, int do_crypto);
</para>
<para>
When <parameter>do_ssl</parameter> is non-zero, <application>libpq</application>
will initialize the <productname>OpenSSL</productname> library before first
opening a database connection. When <parameter>do_crypto</parameter> is
non-zero, the <literal>libcrypto</literal> library will be initialized. By
default (if <xref linkend="libpq-PQinitOpenSSL"/> is not called), both libraries
are initialized. When SSL support is not compiled in, this function is
present but does nothing.
</para>
<para>
If your application uses and initializes either <productname>OpenSSL</productname>
or its underlying <literal>libcrypto</literal> library, you <emphasis>must</emphasis>
call this function with zeroes for the appropriate parameter(s)
before first opening a database connection. Also be sure that you
have done that initialization before opening a database connection.
This function is deprecated and only present for backwards compatibility,
it does nothing.
</para>
</listitem>
</varlistentry>
@ -9921,11 +9914,14 @@ void PQinitSSL(int do_ssl);
<para>
This function is equivalent to
<literal>PQinitOpenSSL(do_ssl, do_ssl)</literal>.
It is sufficient for applications that initialize both or neither
of <productname>OpenSSL</productname> and <literal>libcrypto</literal>.
This function is deprecated and only present for backwards compatibility,
it does nothing.
</para>
<para>
<xref linkend="libpq-PQinitSSL"/> and <xref linkend="libpq-PQinitOpenSSL"/>
are maintained for backwards compatibility, but are no longer required
since <productname>PostgreSQL</productname> 18.
<xref linkend="libpq-PQinitSSL"/> has been present since
<productname>PostgreSQL</productname> 8.0, while <xref linkend="libpq-PQinitOpenSSL"/>
was added in <productname>PostgreSQL</productname> 8.4, so <xref linkend="libpq-PQinitSSL"/>