mirror of
https://github.com/postgres/postgres.git
synced 2026-10-23 13:29:09 +03:00
76cdf922b0
After a recent macOS update, building Postgres produces warnings
that look like this:
ranlib: warning: 'libpgport_shlib.a(pg_cpu_x86.c.o)' has no symbols
ranlib: warning: 'libpgport_shlib.a(pg_popcount_x86.c.o)' has no symbols
To fix, add a dummy symbol to files that may otherwise have none.
Per project policy, this is a candidate for back-patching into
out-of-support branches: it suppresses annoying compiler warnings
but changes no behavior.
Reported-by: Zhang Mingli <zmlpostgres@gmail.com>
Reviewed-by: John Naylor <johncnaylorls@gmail.com>
Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us>
Discussion: https://postgr.es/m/229aaaf3-f529-44ed-8e50-00cb6909af21%40Spark
Backpatch-through: 13
124 lines
2.6 KiB
C
124 lines
2.6 KiB
C
/*-------------------------------------------------------------------------
|
|
*
|
|
* protocol_openssl.c
|
|
* OpenSSL functionality shared between frontend and backend
|
|
*
|
|
* This should only be used if code is compiled with OpenSSL support.
|
|
*
|
|
* Portions Copyright (c) 1996-2022, PostgreSQL Global Development Group
|
|
* Portions Copyright (c) 1994, Regents of the University of California
|
|
*
|
|
* IDENTIFICATION
|
|
* src/common/protocol_openssl.c
|
|
*
|
|
*-------------------------------------------------------------------------
|
|
*/
|
|
|
|
#ifndef FRONTEND
|
|
#include "postgres.h"
|
|
#else
|
|
#include "postgres_fe.h"
|
|
#endif
|
|
|
|
#include "common/openssl.h"
|
|
|
|
/*
|
|
* Replacements for APIs introduced in OpenSSL 1.1.0.
|
|
*/
|
|
#ifndef SSL_CTX_set_min_proto_version
|
|
|
|
/*
|
|
* OpenSSL versions that support TLS 1.3 shouldn't get here because they
|
|
* already have these functions. So we don't have to keep updating the below
|
|
* code for every new TLS version, and eventually it can go away. But let's
|
|
* just check this to make sure ...
|
|
*/
|
|
#ifdef TLS1_3_VERSION
|
|
#error OpenSSL version mismatch
|
|
#endif
|
|
|
|
int
|
|
SSL_CTX_set_min_proto_version(SSL_CTX *ctx, int version)
|
|
{
|
|
int ssl_options = SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3;
|
|
|
|
if (version > TLS1_VERSION)
|
|
ssl_options |= SSL_OP_NO_TLSv1;
|
|
|
|
/*
|
|
* Some OpenSSL versions define TLS*_VERSION macros but not the
|
|
* corresponding SSL_OP_NO_* macro, so in those cases we have to return
|
|
* unsuccessfully here.
|
|
*/
|
|
#ifdef TLS1_1_VERSION
|
|
if (version > TLS1_1_VERSION)
|
|
{
|
|
#ifdef SSL_OP_NO_TLSv1_1
|
|
ssl_options |= SSL_OP_NO_TLSv1_1;
|
|
#else
|
|
return 0;
|
|
#endif
|
|
}
|
|
#endif
|
|
#ifdef TLS1_2_VERSION
|
|
if (version > TLS1_2_VERSION)
|
|
{
|
|
#ifdef SSL_OP_NO_TLSv1_2
|
|
ssl_options |= SSL_OP_NO_TLSv1_2;
|
|
#else
|
|
return 0;
|
|
#endif
|
|
}
|
|
#endif
|
|
|
|
SSL_CTX_set_options(ctx, ssl_options);
|
|
|
|
return 1; /* success */
|
|
}
|
|
|
|
int
|
|
SSL_CTX_set_max_proto_version(SSL_CTX *ctx, int version)
|
|
{
|
|
int ssl_options = 0;
|
|
|
|
AssertArg(version != 0);
|
|
|
|
/*
|
|
* Some OpenSSL versions define TLS*_VERSION macros but not the
|
|
* corresponding SSL_OP_NO_* macro, so in those cases we have to return
|
|
* unsuccessfully here.
|
|
*/
|
|
#ifdef TLS1_1_VERSION
|
|
if (version < TLS1_1_VERSION)
|
|
{
|
|
#ifdef SSL_OP_NO_TLSv1_1
|
|
ssl_options |= SSL_OP_NO_TLSv1_1;
|
|
#else
|
|
return 0;
|
|
#endif
|
|
}
|
|
#endif
|
|
#ifdef TLS1_2_VERSION
|
|
if (version < TLS1_2_VERSION)
|
|
{
|
|
#ifdef SSL_OP_NO_TLSv1_2
|
|
ssl_options |= SSL_OP_NO_TLSv1_2;
|
|
#else
|
|
return 0;
|
|
#endif
|
|
}
|
|
#endif
|
|
|
|
SSL_CTX_set_options(ctx, ssl_options);
|
|
|
|
return 1; /* success */
|
|
}
|
|
|
|
#else /* !SSL_CTX_set_min_proto_version */
|
|
|
|
/* prevent linker complaints about empty module */
|
|
extern int protocol_openssl_dummy_variable;
|
|
int protocol_openssl_dummy_variable = 0;
|
|
|
|
#endif /* SSL_CTX_set_min_proto_version */
|