Use explicit fetching for digests in cryptohash (OpenSSL >= 3.0) cryptohash_openssl.c initialized the EVP_MD_CTX with the implicit static digest objects (EVP_sha256() and friends). These do not dispatch through a loaded provider. OpenSSL 3.0 and newer versions recommend to switch to an explicit fetch, using EVP_MD_fetch(), the older routines being deprecated, available for backward-compatibility purposes.
Now, when building with OpenSSL 3.0 or a newer bersion, we fetch the digest by name with EVP_MD_fetch(), cache it in the context, and free it on teardown. This has as consequence to feed the hash from a provider. The implicit path is kept for older OpenSSL, 1.1.1 being the oldest version still supported on HEAD, and for LibreSSL. This is a slight change in the hashing logic. No backpatch is done as that looks safer, and the code in the back-branches is also able to work. This has been locally tested across OpenSSL 1.1.1 up to 3.5, so hopefully nothing is broken. Note: The submitted code was clearly AI-generated. I have spend a bit of time cleaning it up, making it more consistent with the project style in terms of coding, adjusting a few more things on the way. Author: Mark Atwood <[email protected]> Co-authored-by: Michael Paquier <[email protected]> Discussion: https://postgr.es/m/[email protected] Branch ------ master Details ------- https://git.postgresql.org/pg/commitdiff/b91f79cd08abba7a800d3faf79bb96e8adc8752e Modified Files -------------- src/common/cryptohash_openssl.c | 47 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+)
