ssl: Use the correct feature macros for TLS protocol support

Our test for if the underlying TLS library supported a specific
version tested against the TLSX_Y_VERSION set of macros. These
are however always defined, regardless of if the library was
built without support for the specific protocol version.  Fix
by using the feature test macros OPENSSL_NO_TLSX_Y which are
intended for this usecase.

The previous coding held no risk of protocol downgrade against
the underlying library, a library not supporting the protocol
version selected would simply error out as the feature isn't
available.  This can be easily verified using a modern version
of LibreSSL, which in version 3.8 disabled TLS1 and 1.1 by
default.  Once we bump our minimum supported version of LibreSSL
to 3.8+ we can add a test for this.

Author: Daniel Gustafsson <daniel@yesql.se>
Reviewed-by: Tristan Partin <tristan@partin.io>
Reviewed-by: Andreas Karlsson <andreas@proxel.se>
Reviewed-by: Yilin Zhang <jiezhilove@126.com>
Discussion: https://postgr.es/m/68B9881D-DAA8-467D-A251-C96E98E57BA0@yesql.se

diff --git a/src/backend/libpq/be-secure-openssl.c b/src/backend/libpq/be-secure-openssl.c
index 71e20e058eb12c2f7be13763e48994abe2dde25b..0476470084586da6735791b39021355d53adac7e 100644 (file)
--- a/src/backend/libpq/be-secure-openssl.c
+++ b/src/backend/libpq/be-secure-openssl.c
@@ -2421,21 +2421,25 @@ ssl_protocol_version_to_openssl(int v)
                case PG_TLS_ANY:
                        return 0;
                case PG_TLS1_VERSION:
+#ifndef OPENSSL_NO_TLS1
                        return TLS1_VERSION;
+#else
+                       break;
+#endif
                case PG_TLS1_1_VERSION:
-#ifdef TLS1_1_VERSION
+#ifndef OPENSSL_NO_TLS1_1
                        return TLS1_1_VERSION;
 #else
                        break;
 #endif
                case PG_TLS1_2_VERSION:
-#ifdef TLS1_2_VERSION
+#ifndef OPENSSL_NO_TLS1_2
                        return TLS1_2_VERSION;
 #else
                        break;
 #endif
                case PG_TLS1_3_VERSION:
-#ifdef TLS1_3_VERSION
+#ifndef OPENSSL_NO_TLS1_3
                        return TLS1_3_VERSION;
 #else
                        break;

diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c
index de65486d20483e1ab6ad1030c732967f4b40b61f..91c1fa9bb95ce11e4e873221c04efc208385b382 100644 (file)
--- a/src/interfaces/libpq/fe-secure-openssl.c
+++ b/src/interfaces/libpq/fe-secure-openssl.c
@@ -1991,20 +1991,22 @@ PQssl_passwd_cb(char *buf, int size, int rwflag, void *userdata)
 static int
 ssl_protocol_version_to_openssl(const char *protocol)
 {
+#ifndef OPENSSL_NO_TLS1
        if (pg_strcasecmp("TLSv1", protocol) == 0)
                return TLS1_VERSION;
+#endif
 
-#ifdef TLS1_1_VERSION
+#ifndef OPENSSL_NO_TLS1_1
        if (pg_strcasecmp("TLSv1.1", protocol) == 0)
                return TLS1_1_VERSION;
 #endif
 
-#ifdef TLS1_2_VERSION
+#ifndef OPENSSL_NO_TLS1_2
        if (pg_strcasecmp("TLSv1.2", protocol) == 0)
                return TLS1_2_VERSION;
 #endif
 
-#ifdef TLS1_3_VERSION
+#ifndef OPENSSL_NO_TLS1_3
        if (pg_strcasecmp("TLSv1.3", protocol) == 0)
                return TLS1_3_VERSION;
 #endif