ssl: Use TLS_method instead of deprecated SSLv23_method

The SSLv23_method() function has been an alias for TLS_method since
2015 (OpenSSL commit 32ec41539b5b) so we should use the appropriate
name to avoid confusion.

Author: Daniel Gustafsson <daniel@yesql.se>
Reviewed-by: Tristan Partin <tristan@partin.io>
Reviewed-by: Andreas Karlsson <andreas@proxel.se>
Reviewed-by: Yilin Zhang <jiezhilove@126.com>
Discussion: https://postgr.es/m/68B9881D-DAA8-467D-A251-C96E98E57BA0@yesql.se

diff --git a/src/backend/libpq/be-secure-openssl.c b/src/backend/libpq/be-secure-openssl.c
index 4748c056db6b75b8b561153a3afd91e530d76952..5e036cc60d2a9ed4dbdb3e55a57b2b11f2ed1fb8 100644 (file)
--- a/src/backend/libpq/be-secure-openssl.c
+++ b/src/backend/libpq/be-secure-openssl.c
@@ -377,13 +377,8 @@ be_tls_init(bool isServerStart)
         * Create a new SSL context into which we'll load all the configuration
         * settings.  If we fail partway through, we can avoid memory leakage by
         * freeing this context; we don't install it as active until the end.
-        *
-        * We use SSLv23_method() because it can negotiate use of the highest
-        * mutually supported protocol version, while alternatives like
-        * TLSv1_2_method() permit only one specific version.  Note that we don't
-        * actually allow SSL v2 or v3, only TLS protocols (see below).
         */
-       context = SSL_CTX_new(SSLv23_method());
+       context = SSL_CTX_new(TLS_method());
        if (!context)
        {
                ereport(isServerStart ? FATAL : LOG,
@@ -627,7 +622,7 @@ host_context_cleanup_cb(void *arg)
 static bool
 init_host_context(HostsLine *host, bool isServerStart, bool *hasWarned)
 {
-       SSL_CTX    *ctx = SSL_CTX_new(SSLv23_method());
+       SSL_CTX    *ctx = SSL_CTX_new(TLS_method());
 
        if (!ctx)
        {

diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c
index 3e9b87940b218522dc72d21998f101b753da3a27..de65486d20483e1ab6ad1030c732967f4b40b61f 100644 (file)
--- a/src/interfaces/libpq/fe-secure-openssl.c
+++ b/src/interfaces/libpq/fe-secure-openssl.c
@@ -800,7 +800,7 @@ initialize_SSL(PGconn *conn)
         * complicated if connections used different certificates. So now we
         * create a separate context for each connection, and accept the overhead.
         */
-       SSL_context = SSL_CTX_new(SSLv23_method());
+       SSL_context = SSL_CTX_new(TLS_method());
        if (!SSL_context)
        {
                char       *err = SSLerrmessage(ERR_get_error());