At 2026-07-27 16:50:44, "Daniel Gustafsson" <[email protected]> wrote:
>> On 26 Jul 2026, at 16:12, Andreas Karlsson <[email protected]> wrote:
>>
>> On 7/15/26 16:20, Daniel Gustafsson wrote:
>>>> On 14 Jul 2026, at 22:50, Tristan Partin <[email protected]> wrote:
>>>> I wonder if it is worth leaving your justification in a comment. Other
>>>> than that, nothing to add.
>>> Not sure if it's all that interesting, I did however add a function comment
>>> on
>>> ssl_init_context which explains the hasWarned parameter as that was lacking.
>>> The attached v3 removes the openssl-owned comment and fixed the compiler
>>> warning, both mentioned upthread.
>>
>> The patches all look good now.
>
>Thanks everyone for review, I'll go ahead applying these.
Hi,
I have a minor comment on the v3 patch.
In v3-0004-ssl-Use-the-correct-feature-macros-for-TLS-protoc.patch:
diff --git a/src/backend/libpq/be-secure-openssl.c
b/src/backend/libpq/be-secure-openssl.c
index 00d7519957d..aaea6bedfca 100644
--- a/src/backend/libpq/be-secure-openssl.c
+++ b/src/backend/libpq/be-secure-openssl.c
@@ -2421,21 +2421,25 @@ ssl_protocol_version_to_openssl(int v)
case PG_TLS_ANY:
return 0;
case PG_TLS1_VERSION:
+#ifndef OPENSSL_NO_TLS1
return TLS1_VERSION;
+#else
+ break;
+#endif
case PG_TLS1_1_VERSION:
-#ifdef TLS1_1_VERSION
+#ifndef OPENSSL_NO_TLS1_1
return TLS1_1_VERSION;
#else
break;
#endif
case PG_TLS1_2_VERSION:
-#ifdef TLS1_2_VERSION
+#ifndef OPENSSL_NO_TLS1_2
return TLS1_2_VERSION;
#else
break;
#endif
case PG_TLS1_3_VERSION:
-#ifdef TLS1_3_VERSION
+#ifdef OPENSSL_NO_TLS1_3
return TLS1_3_VERSION;
#else
break;
For all other protocol versions (TLS 1.0/1.1/1.2, both frontend and backend),
we uniformly use `#ifndef OPENSSL_NO_TLSx` — return if the library supports the
protocol.
Only the backend TLS 1.3 path uses `#ifdef OPENSSL_NO_TLS1_3` — return when the
library lacks support.
I believe this is a one-character mistake introduced during copy-paste: `ifdef`
was not changed to `ifndef`.
Best regards,
--
Yilin Zhang
