Remove code relevant to OpenSSL 0.9.6 in be/fe-secure-openssl.c

michaelpq · michaelpq · commit 55282fa20f46 · 2019-09-28T15:22:49.000+09:00
HEAD supports OpenSSL 0.9.8 and newer versions, and this code likely got forgotten as its surrounding comments mention an incorrect version number. Author: Michael Paquier Reviewed-by: Peter Eisentraut Discussion: https://postgr.es/m/20190927032311.GB8485@paquier.xyz
diff --git a/src/backend/libpq/be-secure-openssl.c b/src/backend/libpq/be-secure-openssl.c
@@ -269,17 +269,8 @@ be_tls_init(bool isServerStart)
 			/* Set the flags to check against the complete CRL chain */
 			if (X509_STORE_load_locations(cvstore, ssl_crl_file, NULL) == 1)
 			{
-				/* OpenSSL 0.96 does not support X509_V_FLAG_CRL_CHECK */
-#ifdef X509_V_FLAG_CRL_CHECK
 				X509_STORE_set_flags(cvstore,
 									 X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
-#else
-				ereport(LOG,
-						(errcode(ERRCODE_CONFIG_FILE_ERROR),
-						 errmsg("SSL certificate revocation list file \"%s\" ignored",
-								ssl_crl_file),
-						 errdetail("SSL library does not support certificate revocation lists.")));
-#endif
 			}
 			else
 			{
diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c
@@ -869,20 +869,8 @@ initialize_SSL(PGconn *conn)
 			if (fnbuf[0] != '\0' &&
 				X509_STORE_load_locations(cvstore, fnbuf, NULL) == 1)
 			{
-				/* OpenSSL 0.96 does not support X509_V_FLAG_CRL_CHECK */
-#ifdef X509_V_FLAG_CRL_CHECK
 				X509_STORE_set_flags(cvstore,
 									 X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
-#else
-				char	   *err = SSLerrmessage(ERR_get_error());
-
-				printfPQExpBuffer(&conn->errorMessage,
-								  libpq_gettext("SSL library does not support CRL certificates (file \"%s\")\n"),
-								  fnbuf);
-				SSLerrfree(err);
-				SSL_CTX_free(SSL_context);
-				return -1;
-#endif
 			}
 			/* if not found, silently ignore;  we do not require CRL */
 			ERR_clear_error();

Original file line number	Diff line number	Diff line change
`@@ -269,17 +269,8 @@ be_tls_init(bool isServerStart)`
`269`	`269`	`/* Set the flags to check against the complete CRL chain */`
`270`	`270`	`if (X509_STORE_load_locations(cvstore, ssl_crl_file, NULL) == 1)`
`271`	`271`	`{`
`272`		`- /* OpenSSL 0.96 does not support X509_V_FLAG_CRL_CHECK */`
`273`		`-#ifdef X509_V_FLAG_CRL_CHECK`
`274`	`272`	`X509_STORE_set_flags(cvstore,`
`275`	`273`	`X509_V_FLAG_CRL_CHECK \| X509_V_FLAG_CRL_CHECK_ALL);`
`276`		`-#else`
`277`		`- ereport(LOG,`
`278`		`- (errcode(ERRCODE_CONFIG_FILE_ERROR),`
`279`		`- errmsg("SSL certificate revocation list file \"%s\" ignored",`
`280`		`- ssl_crl_file),`
`281`		`- errdetail("SSL library does not support certificate revocation lists.")));`
`282`		`-#endif`
`283`	`274`	`}`
`284`	`275`	`else`
`285`	`276`	`{`