Use BIO_{get,set}_app_data instead of BIO_{get,set}_data.

We should have done it this way all along, but we accidentally got
away with using the wrong BIO field up until OpenSSL 3.2.  There,
the library's BIO routines that we rely on use the "data" field
for their own purposes, and our conflicting use causes assorted
weird behaviors up to and including core dumps when SSL connections
are attempted.  Switch to using the approved field for the purpose,
i.e. app_data.

While at it, remove our configure probes for BIO_get_data as well
as the fallback implementation.  BIO_{get,set}_app_data have been
there since long before any OpenSSL version that we still support,
even in the back branches.

Also, update src/test/ssl/t/001_ssltests.pl to allow for a minor
change in an error message spelling that evidently came in with 3.2.

Tristan Partin and Bo Andreson.  Back-patch to all supported branches.

Discussion: https://postgr.es/m/CAN55FZ1eDDYsYaL7mv+oSLUij2h_u6hvD4Qmv-7PK7jkji0uyQ@mail.gmail.com

diff --git a/configure b/configure
index 2fc7dca504a06ad4afaa3c94fba8042ce2895004..b7caf88229c1086765cff3f906be17fcbc65a488 100755 (executable)
--- a/configure
+++ b/configure
@@ -12713,7 +12713,7 @@ done
   # defines OPENSSL_VERSION_NUMBER to claim version 2.0.0, even though it
   # doesn't have these OpenSSL 1.1.0 functions. So check for individual
   # functions.
-  for ac_func in OPENSSL_init_ssl BIO_get_data BIO_meth_new ASN1_STRING_get0_data
+  for ac_func in OPENSSL_init_ssl BIO_meth_new ASN1_STRING_get0_data
 do :
   as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
 ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"

diff --git a/configure.in b/configure.in
index eaca13260752087e1cf99ec79da942858e7fa02c..9aec28c8d16877cf5e12d304c0166e137db7c979 100644 (file)
--- a/configure.in
+++ b/configure.in
@@ -1275,7 +1275,7 @@ if test "$with_openssl" = yes ; then
   # defines OPENSSL_VERSION_NUMBER to claim version 2.0.0, even though it
   # doesn't have these OpenSSL 1.1.0 functions. So check for individual
   # functions.
-  AC_CHECK_FUNCS([OPENSSL_init_ssl BIO_get_data BIO_meth_new ASN1_STRING_get0_data])
+  AC_CHECK_FUNCS([OPENSSL_init_ssl BIO_meth_new ASN1_STRING_get0_data])
   # OpenSSL versions before 1.1.0 required setting callback functions, for
   # thread-safety. In 1.1.0, it's no longer required, and CRYPTO_lock()
   # function was removed.

diff --git a/src/backend/libpq/be-secure-openssl.c b/src/backend/libpq/be-secure-openssl.c
index 55fe59276a94003463b4115943681d414748a0ed..9e22911379a1773c756524463642506845c4a6ee 100644 (file)
--- a/src/backend/libpq/be-secure-openssl.c
+++ b/src/backend/libpq/be-secure-openssl.c
@@ -748,11 +748,6 @@ be_tls_write(Port *port, void *ptr, size_t len, int *waitfor)
  * to retry; do we need to adopt their logic for that?
  */
 
-#ifndef HAVE_BIO_GET_DATA
-#define BIO_get_data(bio) (bio->ptr)
-#define BIO_set_data(bio, data) (bio->ptr = data)
-#endif
-
 static BIO_METHOD *my_bio_methods = NULL;
 
 static int
@@ -762,7 +757,7 @@ my_sock_read(BIO *h, char *buf, int size)
 
    if (buf != NULL)
    {
-       res = secure_raw_read(((Port *) BIO_get_data(h)), buf, size);
+       res = secure_raw_read(((Port *) BIO_get_app_data(h)), buf, size);
        BIO_clear_retry_flags(h);
        if (res <= 0)
        {
@@ -782,7 +777,7 @@ my_sock_write(BIO *h, const char *buf, int size)
 {
    int         res = 0;
 
-   res = secure_raw_write(((Port *) BIO_get_data(h)), buf, size);
+   res = secure_raw_write(((Port *) BIO_get_app_data(h)), buf, size);
    BIO_clear_retry_flags(h);
    if (res <= 0)
    {
@@ -858,7 +853,7 @@ my_SSL_set_fd(Port *port, int fd)
        SSLerr(SSL_F_SSL_SET_FD, ERR_R_BUF_LIB);
        goto err;
    }
-   BIO_set_data(bio, port);
+   BIO_set_app_data(bio, port);
 
    BIO_set_fd(bio, fd, BIO_NOCLOSE);
    SSL_set_bio(port->ssl, bio, bio);

diff --git a/src/include/pg_config.h.in b/src/include/pg_config.h.in
index 13fc4e0db62695fdec1fde66891dde5285ce2963..978e685c7043988549283b84ab82d539e4a913f4 100644 (file)
--- a/src/include/pg_config.h.in
+++ b/src/include/pg_config.h.in
@@ -86,9 +86,6 @@
 /* Define to 1 if you have the `backtrace_symbols' function. */
 #undef HAVE_BACKTRACE_SYMBOLS
 
-/* Define to 1 if you have the `BIO_get_data' function. */
-#undef HAVE_BIO_GET_DATA
-
 /* Define to 1 if you have the `BIO_meth_new' function. */
 #undef HAVE_BIO_METH_NEW
 

diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c
index 05fa05aa3eded06be123c8511d684eb0c4fcd6c0..524563aa4374b84d9b4bd975c59349a2b7613279 100644 (file)
--- a/src/interfaces/libpq/fe-secure-openssl.c
+++ b/src/interfaces/libpq/fe-secure-openssl.c
@@ -1602,11 +1602,6 @@ PQsslAttribute(PGconn *conn, const char *attribute_name)
  * to retry; do we need to adopt their logic for that?
  */
 
-#ifndef HAVE_BIO_GET_DATA
-#define BIO_get_data(bio) (bio->ptr)
-#define BIO_set_data(bio, data) (bio->ptr = data)
-#endif
-
 /* protected by ssl_config_mutex */
 static BIO_METHOD *my_bio_methods;
 
@@ -1615,7 +1610,7 @@ my_sock_read(BIO *h, char *buf, int size)
 {
    int         res;
 
-   res = pqsecure_raw_read((PGconn *) BIO_get_data(h), buf, size);
+   res = pqsecure_raw_read((PGconn *) BIO_get_app_data(h), buf, size);
    BIO_clear_retry_flags(h);
    if (res < 0)
    {
@@ -1645,7 +1640,7 @@ my_sock_write(BIO *h, const char *buf, int size)
 {
    int         res;
 
-   res = pqsecure_raw_write((PGconn *) BIO_get_data(h), buf, size);
+   res = pqsecure_raw_write((PGconn *) BIO_get_app_data(h), buf, size);
    BIO_clear_retry_flags(h);
    if (res < 0)
    {
@@ -1764,7 +1759,7 @@ my_SSL_set_fd(PGconn *conn, int fd)
        SSLerr(SSL_F_SSL_SET_FD, ERR_R_BUF_LIB);
        goto err;
    }
-   BIO_set_data(bio, conn);
+   BIO_set_app_data(bio, conn);
 
    SSL_set_bio(conn->ssl, bio, bio);
    BIO_set_fd(bio, fd, BIO_NOCLOSE);

diff --git a/src/tools/msvc/Solution.pm b/src/tools/msvc/Solution.pm
index 78328e1fac0d60b581d6ab5fd16dc2bf41dacffa..e88e3967cd02fef76773f44f8fa687d6447765fc 100644 (file)
--- a/src/tools/msvc/Solution.pm
+++ b/src/tools/msvc/Solution.pm
@@ -226,7 +226,6 @@ sub GenerateFiles
        HAVE_ATOMICS               => 1,
        HAVE_ATOMIC_H              => undef,
        HAVE_BACKTRACE_SYMBOLS     => undef,
-       HAVE_BIO_GET_DATA          => undef,
        HAVE_BIO_METH_NEW          => undef,
        HAVE_CLOCK_GETTIME         => undef,
        HAVE_COMPUTED_GOTO         => undef,
@@ -543,7 +542,6 @@ sub GenerateFiles
            || ($digit1 >= '1' && $digit2 >= '1' && $digit3 >= '0'))
        {
            $define{HAVE_ASN1_STRING_GET0_DATA} = 1;
-           $define{HAVE_BIO_GET_DATA}          = 1;
            $define{HAVE_BIO_METH_NEW}          = 1;
            $define{HAVE_OPENSSL_INIT_SSL}      = 1;
        }