Remove incorrect OpenSSL feature guards

Commit 316472146 introduced support for ECDH key exchange with an ifdef
guard to ensure support in the underlying OpenSSL installation.  Commit
10bf4fc2c3 in OpenSSL removed this guard in 2015 which effectively made
our check a no-op.  There has been no complaints that this doesn't work
and OpenSSL installations without ECDH support are likely very rare, so
remove the checks rather than re-implementing support.  Not backpatched
since this fix doesn't alter functionality.

Also fix a typo introduced in the original commit which had survived
till this day.

Author: Daniel Gustafsson <daniel@yesql.se>
Reviewed-by: Tom Lane <tgl@sss.pgh.pa.us>
Reviewed-by: Jacob Champion <jacob.champion@enterprisedb.com>
Discussion: https://postgr.es/m/1787BA9F-A11C-4A7A-9252-94C470D5CBE3@yesql.se

diff --git a/src/backend/libpq/be-secure-openssl.c b/src/backend/libpq/be-secure-openssl.c
index 877851a73cd8bcdad445a44a8cd452f21ed78c3a..f2738c351f9c646d5282fe9512515fcff9bcceda 100644 (file)
--- a/src/backend/libpq/be-secure-openssl.c
+++ b/src/backend/libpq/be-secure-openssl.c
@@ -48,9 +48,7 @@
 #include <openssl/bn.h>
 #include <openssl/conf.h>
 #include <openssl/dh.h>
-#ifndef OPENSSL_NO_ECDH
 #include <openssl/ec.h>
-#endif
 #include <openssl/x509v3.h>
 
 /*
@@ -2115,7 +2113,6 @@ initialize_dh(SSL_CTX *context, bool isServerStart)
 static bool
 initialize_ecdh(SSL_CTX *context, bool isServerStart)
 {
-#ifndef OPENSSL_NO_ECDH
        if (SSL_CTX_set1_groups_list(context, SSLECDHCurve) != 1)
        {
                /*
@@ -2133,7 +2130,6 @@ initialize_ecdh(SSL_CTX *context, bool isServerStart)
                                errhint("Ensure that each group name is spelled correctly and supported by the installed version of OpenSSL."));
                return false;
        }
-#endif
 
        return true;
 }

diff --git a/src/backend/libpq/be-secure.c b/src/backend/libpq/be-secure.c
index 617704bb99338c29db4e034a203af248350da461..86ceea72e6408effcde9aaff8c50d7c9a9ea3574 100644 (file)
--- a/src/backend/libpq/be-secure.c
+++ b/src/backend/libpq/be-secure.c
@@ -52,7 +52,7 @@ bool          ssl_loaded_verify_locations = false;
 char      *SSLCipherSuites = NULL;
 char      *SSLCipherList = NULL;
 
-/* GUC variable for default ECHD curve. */
+/* GUC variable for default ECDH curve. */
 char      *SSLECDHCurve;
 
 /* GUC variable: if false, prefer client ciphers */