Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
Skip to content

Commit f9264d1

Browse files
michaelpqmichaelpq
committed
Remove support for SSL compression
PostgreSQL disabled compression as of e3bdb2d and the documentation recommends against using it since. Additionally, SSL compression has been disabled in OpenSSL since version 1.1.0, and was disabled in many distributions long before that. The most recent TLS version, TLSv1.3, disallows compression at the protocol level. This commit removes the feature itself, removing support for the libpq parameter sslcompression (parameter still listed for compatibility reasons with existing connection strings, just ignored), and removes the equivalent field in pg_stat_ssl and de facto PgBackendSSLStatus. Note that, on top of removing the ability to activate compression by configuration, compression is actively disabled in both frontend and backend to avoid overrides from local configurations. A TAP test is added for deprecated SSL parameters to check after backwards compatibility. Bump catalog version. Author: Daniel Gustafsson Reviewed-by: Peter Eisentraut, Magnus Hagander, Michael Paquier Discussion: https://postgr.es/m/7E384D48-11C5-441B-9EC3-F7DB1F8518F6@yesql.se
1 parent d4545dc commit f9264d1

File tree

19 files changed

+60
-112
lines changed

19 files changed

+60
-112
lines changed

‎contrib/postgres_fdw/expected/postgres_fdw.out

+1-2
Original file line numberDiff line numberDiff line change
@@ -163,7 +163,6 @@ ALTER SERVER testserver1 OPTIONS (
163163
keepalives_interval 'value',
164164
tcp_user_timeout 'value',
165165
-- requiressl 'value',
166-
sslcompression 'value',
167166
sslmode 'value',
168167
sslcert 'value',
169168
sslkey 'value',
@@ -8946,7 +8945,7 @@ DO $d$
89468945
END;
89478946
$d$;
89488947
ERROR: invalid option "password"
8949-
HINT: Valid options in this context are: service, passfile, channel_binding, connect_timeout, dbname, host, hostaddr, port, options, application_name, keepalives, keepalives_idle, keepalives_interval, keepalives_count, tcp_user_timeout, sslmode, sslcompression, sslcert, sslkey, sslrootcert, sslcrl, sslcrldir, requirepeer, ssl_min_protocol_version, ssl_max_protocol_version, gssencmode, krbsrvname, gsslib, target_session_attrs, use_remote_estimate, fdw_startup_cost, fdw_tuple_cost, extensions, updatable, fetch_size, batch_size
8948+
HINT: Valid options in this context are: service, passfile, channel_binding, connect_timeout, dbname, host, hostaddr, port, options, application_name, keepalives, keepalives_idle, keepalives_interval, keepalives_count, tcp_user_timeout, sslmode, sslcert, sslkey, sslrootcert, sslcrl, sslcrldir, requirepeer, ssl_min_protocol_version, ssl_max_protocol_version, gssencmode, krbsrvname, gsslib, target_session_attrs, use_remote_estimate, fdw_startup_cost, fdw_tuple_cost, extensions, updatable, fetch_size, batch_size
89508949
CONTEXT: SQL statement "ALTER SERVER loopback_nopw OPTIONS (ADD password 'dummypw')"
89518950
PL/pgSQL function inline_code_block line 3 at EXECUTE
89528951
-- If we add a password for our user mapping instead, we should get a different

‎contrib/postgres_fdw/sql/postgres_fdw.sql

-1
Original file line numberDiff line numberDiff line change
@@ -177,7 +177,6 @@ ALTER SERVER testserver1 OPTIONS (
177177
keepalives_interval 'value',
178178
tcp_user_timeout 'value',
179179
-- requiressl 'value',
180-
sslcompression 'value',
181180
sslmode 'value',
182181
sslcert 'value',
183182
sslkey 'value',

‎doc/src/sgml/libpq.sgml

+2-31
Original file line numberDiff line numberDiff line change
@@ -1635,24 +1635,7 @@ postgresql://%2Fvar%2Flib%2Fpostgresql/dbname
16351635
<term><literal>sslcompression</literal></term>
16361636
<listitem>
16371637
<para>
1638-
If set to 1, data sent over SSL connections will be compressed. If
1639-
set to 0, compression will be disabled. The default is 0. This
1640-
parameter is ignored if a connection without SSL is made.
1641-
</para>
1642-
1643-
<para>
1644-
SSL compression is nowadays considered insecure and its use is no
1645-
longer recommended. <productname>OpenSSL</productname> 1.1.0 disables
1646-
compression by default, and many operating system distributions
1647-
disable it in prior versions as well, so setting this parameter to on
1648-
will not have any effect if the server does not accept compression.
1649-
</para>
1650-
1651-
<para>
1652-
If security is not a primary concern, compression can improve
1653-
throughput if the network is the bottleneck. Disabling compression
1654-
can improve response time and throughput if CPU performance is the
1655-
limiting factor.
1638+
Ignored (formerly, this specified whether to attempt SSL compression).
16561639
</para>
16571640
</listitem>
16581641
</varlistentry>
@@ -2545,9 +2528,7 @@ const char *PQsslAttribute(const PGconn *conn, const char *attribute_name);
25452528
<term><literal>compression</literal></term>
25462529
<listitem>
25472530
<para>
2548-
If SSL compression is in use, returns the name of the compression
2549-
algorithm, or "on" if compression is used but the algorithm is
2550-
not known. If compression is not in use, returns "off".
2531+
SSL compression is no longer supported, always returns "off".
25512532
</para>
25522533
</listitem>
25532534
</varlistentry>
@@ -7182,16 +7163,6 @@ myEventProc(PGEventId evtId, void *evtInfo, void *passThrough)
71827163
</para>
71837164
</listitem>
71847165

7185-
<listitem>
7186-
<para>
7187-
<indexterm>
7188-
<primary><envar>PGSSLCOMPRESSION</envar></primary>
7189-
</indexterm>
7190-
<envar>PGSSLCOMPRESSION</envar> behaves the same as the <xref
7191-
linkend="libpq-connect-sslcompression"/> connection parameter.
7192-
</para>
7193-
</listitem>
7194-
71957166
<listitem>
71967167
<para>
71977168
<indexterm>

‎doc/src/sgml/monitoring.sgml

-10
Original file line numberDiff line numberDiff line change
@@ -3065,16 +3065,6 @@ SELECT pid, wait_event_type, wait_event FROM pg_stat_activity WHERE wait_event i
30653065
</para></entry>
30663066
</row>
30673067

3068-
<row>
3069-
<entry role="catalog_table_entry"><para role="column_definition">
3070-
<structfield>compression</structfield> <type>boolean</type>
3071-
</para>
3072-
<para>
3073-
True if SSL compression is in use, false if not,
3074-
or NULL if SSL is not in use on this connection
3075-
</para></entry>
3076-
</row>
3077-
30783068
<row>
30793069
<entry role="catalog_table_entry"><para role="column_definition">
30803070
<structfield>client_dn</structfield> <type>text</type>

‎src/backend/catalog/system_views.sql

-1
Original file line numberDiff line numberDiff line change
@@ -863,7 +863,6 @@ CREATE VIEW pg_stat_ssl AS
863863
S.sslversion AS version,
864864
S.sslcipher AS cipher,
865865
S.sslbits AS bits,
866-
S.sslcompression AS compression,
867866
S.ssl_client_dn AS client_dn,
868867
S.ssl_client_serial AS client_serial,
869868
S.ssl_issuer_dn AS issuer_dn

‎src/backend/libpq/be-secure-openssl.c

+3-9
Original file line numberDiff line numberDiff line change
@@ -245,6 +245,9 @@ be_tls_init(bool isServerStart)
245245
/* disallow SSL session caching, too */
246246
SSL_CTX_set_session_cache_mode(context, SSL_SESS_CACHE_OFF);
247247

248+
/* disallow SSL compression */
249+
SSL_CTX_set_options(context, SSL_OP_NO_COMPRESSION);
250+
248251
/* set up ephemeral DH and ECDH keys */
249252
if (!initialize_dh(context, isServerStart))
250253
goto error;
@@ -1182,15 +1185,6 @@ be_tls_get_cipher_bits(Port *port)
11821185
return 0;
11831186
}
11841187

1185-
bool
1186-
be_tls_get_compression(Port *port)
1187-
{
1188-
if (port->ssl)
1189-
return (SSL_get_current_compression(port->ssl) != NULL);
1190-
else
1191-
return false;
1192-
}
1193-
11941188
const char *
11951189
be_tls_get_version(Port *port)
11961190
{

‎src/backend/postmaster/pgstat.c

-1
Original file line numberDiff line numberDiff line change
@@ -3215,7 +3215,6 @@ pgstat_bestart(void)
32153215
{
32163216
lbeentry.st_ssl = true;
32173217
lsslstatus.ssl_bits = be_tls_get_cipher_bits(MyProcPort);
3218-
lsslstatus.ssl_compression = be_tls_get_compression(MyProcPort);
32193218
strlcpy(lsslstatus.ssl_version, be_tls_get_version(MyProcPort), NAMEDATALEN);
32203219
strlcpy(lsslstatus.ssl_cipher, be_tls_get_cipher(MyProcPort), NAMEDATALEN);
32213220
be_tls_get_peer_subject_name(MyProcPort, lsslstatus.ssl_client_dn, NAMEDATALEN);

‎src/backend/utils/adt/pgstatfuncs.c

+17-19
Original file line numberDiff line numberDiff line change
@@ -569,7 +569,7 @@ pg_stat_get_progress_info(PG_FUNCTION_ARGS)
569569
Datum
570570
pg_stat_get_activity(PG_FUNCTION_ARGS)
571571
{
572-
#define PG_STAT_GET_ACTIVITY_COLS 30
572+
#define PG_STAT_GET_ACTIVITY_COLS 29
573573
int num_backends = pgstat_fetch_stat_numbackends();
574574
int curr_backend;
575575
int pid = PG_ARGISNULL(0) ? -1 : PG_GETARG_INT32(0);
@@ -708,7 +708,7 @@ pg_stat_get_activity(PG_FUNCTION_ARGS)
708708
pfree(clipped_activity);
709709

710710
/* leader_pid */
711-
nulls[29] = true;
711+
nulls[28] = true;
712712

713713
proc = BackendPidGetProc(beentry->st_procpid);
714714

@@ -745,8 +745,8 @@ pg_stat_get_activity(PG_FUNCTION_ARGS)
745745
*/
746746
if (leader && leader->pid != beentry->st_procpid)
747747
{
748-
values[29] = Int32GetDatum(leader->pid);
749-
nulls[29] = false;
748+
values[28] = Int32GetDatum(leader->pid);
749+
nulls[28] = false;
750750
}
751751
}
752752

@@ -875,44 +875,43 @@ pg_stat_get_activity(PG_FUNCTION_ARGS)
875875
values[19] = CStringGetTextDatum(beentry->st_sslstatus->ssl_version);
876876
values[20] = CStringGetTextDatum(beentry->st_sslstatus->ssl_cipher);
877877
values[21] = Int32GetDatum(beentry->st_sslstatus->ssl_bits);
878-
values[22] = BoolGetDatum(beentry->st_sslstatus->ssl_compression);
879878

880879
if (beentry->st_sslstatus->ssl_client_dn[0])
881-
values[23] = CStringGetTextDatum(beentry->st_sslstatus->ssl_client_dn);
880+
values[22] = CStringGetTextDatum(beentry->st_sslstatus->ssl_client_dn);
882881
else
883-
nulls[23] = true;
882+
nulls[22] = true;
884883

885884
if (beentry->st_sslstatus->ssl_client_serial[0])
886-
values[24] = DirectFunctionCall3(numeric_in,
885+
values[23] = DirectFunctionCall3(numeric_in,
887886
CStringGetDatum(beentry->st_sslstatus->ssl_client_serial),
888887
ObjectIdGetDatum(InvalidOid),
889888
Int32GetDatum(-1));
890889
else
891-
nulls[24] = true;
890+
nulls[23] = true;
892891

893892
if (beentry->st_sslstatus->ssl_issuer_dn[0])
894-
values[25] = CStringGetTextDatum(beentry->st_sslstatus->ssl_issuer_dn);
893+
values[24] = CStringGetTextDatum(beentry->st_sslstatus->ssl_issuer_dn);
895894
else
896-
nulls[25] = true;
895+
nulls[24] = true;
897896
}
898897
else
899898
{
900899
values[18] = BoolGetDatum(false); /* ssl */
901-
nulls[19] = nulls[20] = nulls[21] = nulls[22] = nulls[23] = nulls[24] = nulls[25] = true;
900+
nulls[19] = nulls[20] = nulls[21] = nulls[22] = nulls[23] = nulls[24] = true;
902901
}
903902

904903
/* GSSAPI information */
905904
if (beentry->st_gss)
906905
{
907-
values[26] = BoolGetDatum(beentry->st_gssstatus->gss_auth); /* gss_auth */
908-
values[27] = CStringGetTextDatum(beentry->st_gssstatus->gss_princ);
909-
values[28] = BoolGetDatum(beentry->st_gssstatus->gss_enc); /* GSS Encryption in use */
906+
values[25] = BoolGetDatum(beentry->st_gssstatus->gss_auth); /* gss_auth */
907+
values[26] = CStringGetTextDatum(beentry->st_gssstatus->gss_princ);
908+
values[27] = BoolGetDatum(beentry->st_gssstatus->gss_enc); /* GSS Encryption in use */
910909
}
911910
else
912911
{
913-
values[26] = BoolGetDatum(false); /* gss_auth */
914-
nulls[27] = true; /* No GSS principal */
915-
values[28] = BoolGetDatum(false); /* GSS Encryption not in
912+
values[25] = BoolGetDatum(false); /* gss_auth */
913+
nulls[26] = true; /* No GSS principal */
914+
values[27] = BoolGetDatum(false); /* GSS Encryption not in
916915
* use */
917916
}
918917
}
@@ -942,7 +941,6 @@ pg_stat_get_activity(PG_FUNCTION_ARGS)
942941
nulls[26] = true;
943942
nulls[27] = true;
944943
nulls[28] = true;
945-
nulls[29] = true;
946944
}
947945

948946
tuplestore_putvalues(tupstore, tupdesc, values, nulls);

‎src/backend/utils/init/postinit.c

+2-3
Original file line numberDiff line numberDiff line change
@@ -264,11 +264,10 @@ PerformAuthentication(Port *port)
264264

265265
#ifdef USE_SSL
266266
if (port->ssl_in_use)
267-
appendStringInfo(&logmsg, _(" SSL enabled (protocol=%s, cipher=%s, bits=%d, compression=%s)"),
267+
appendStringInfo(&logmsg, _(" SSL enabled (protocol=%s, cipher=%s, bits=%d)"),
268268
be_tls_get_version(port),
269269
be_tls_get_cipher(port),
270-
be_tls_get_cipher_bits(port),
271-
be_tls_get_compression(port) ? _("on") : _("off"));
270+
be_tls_get_cipher_bits(port));
272271
#endif
273272
#ifdef ENABLE_GSS
274273
if (port->gss)

‎src/bin/psql/command.c

+2-5
Original file line numberDiff line numberDiff line change
@@ -3509,21 +3509,18 @@ printSSLInfo(void)
35093509
const char *protocol;
35103510
const char *cipher;
35113511
const char *bits;
3512-
const char *compression;
35133512

35143513
if (!PQsslInUse(pset.db))
35153514
return; /* no SSL */
35163515

35173516
protocol = PQsslAttribute(pset.db, "protocol");
35183517
cipher = PQsslAttribute(pset.db, "cipher");
35193518
bits = PQsslAttribute(pset.db, "key_bits");
3520-
compression = PQsslAttribute(pset.db, "compression");
35213519

3522-
printf(_("SSL connection (protocol: %s, cipher: %s, bits: %s, compression: %s)\n"),
3520+
printf(_("SSL connection (protocol: %s, cipher: %s, bits: %s)\n"),
35233521
protocol ? protocol : _("unknown"),
35243522
cipher ? cipher : _("unknown"),
3525-
bits ? bits : _("unknown"),
3526-
(compression && strcmp(compression, "off") != 0) ? _("on") : _("off"));
3523+
bits ? bits : _("unknown"));
35273524
}
35283525

35293526
/*

‎src/include/catalog/catversion.h

+1-1
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,6 @@
5353
*/
5454

5555
/* yyyymmddN */
56-
#define CATALOG_VERSION_NO 202103081
56+
#define CATALOG_VERSION_NO 202103091
5757

5858
#endif

‎src/include/catalog/pg_proc.dat

+3-3
Original file line numberDiff line numberDiff line change
@@ -5249,9 +5249,9 @@
52495249
proname => 'pg_stat_get_activity', prorows => '100', proisstrict => 'f',
52505250
proretset => 't', provolatile => 's', proparallel => 'r',
52515251
prorettype => 'record', proargtypes => 'int4',
5252-
proallargtypes => '{int4,oid,int4,oid,text,text,text,text,text,timestamptz,timestamptz,timestamptz,timestamptz,inet,text,int4,xid,xid,text,bool,text,text,int4,bool,text,numeric,text,bool,text,bool,int4}',
5253-
proargmodes => '{i,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o}',
5254-
proargnames => '{pid,datid,pid,usesysid,application_name,state,query,wait_event_type,wait_event,xact_start,query_start,backend_start,state_change,client_addr,client_hostname,client_port,backend_xid,backend_xmin,backend_type,ssl,sslversion,sslcipher,sslbits,sslcompression,ssl_client_dn,ssl_client_serial,ssl_issuer_dn,gss_auth,gss_princ,gss_enc,leader_pid}',
5252+
proallargtypes => '{int4,oid,int4,oid,text,text,text,text,text,timestamptz,timestamptz,timestamptz,timestamptz,inet,text,int4,xid,xid,text,bool,text,text,int4,text,numeric,text,bool,text,bool,int4}',
5253+
proargmodes => '{i,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o,o}',
5254+
proargnames => '{pid,datid,pid,usesysid,application_name,state,query,wait_event_type,wait_event,xact_start,query_start,backend_start,state_change,client_addr,client_hostname,client_port,backend_xid,backend_xmin,backend_type,ssl,sslversion,sslcipher,sslbits,ssl_client_dn,ssl_client_serial,ssl_issuer_dn,gss_auth,gss_princ,gss_enc,leader_pid}',
52555255
prosrc => 'pg_stat_get_activity' },
52565256
{ oid => '3318',
52575257
descr => 'statistics: information about progress of backends running maintenance command',

‎src/include/libpq/libpq-be.h

-1
Original file line numberDiff line numberDiff line change
@@ -266,7 +266,6 @@ extern ssize_t be_tls_write(Port *port, void *ptr, size_t len, int *waitfor);
266266
* Return information about the SSL connection.
267267
*/
268268
extern int be_tls_get_cipher_bits(Port *port);
269-
extern bool be_tls_get_compression(Port *port);
270269
extern const char *be_tls_get_version(Port *port);
271270
extern const char *be_tls_get_cipher(Port *port);
272271
extern void be_tls_get_peer_subject_name(Port *port, char *ptr, size_t len);

‎src/include/pgstat.h

-1
Original file line numberDiff line numberDiff line change
@@ -1135,7 +1135,6 @@ typedef struct PgBackendSSLStatus
11351135
{
11361136
/* Information about SSL connection */
11371137
int ssl_bits;
1138-
bool ssl_compression;
11391138
char ssl_version[NAMEDATALEN];
11401139
char ssl_cipher[NAMEDATALEN];
11411140
char ssl_client_dn[NAMEDATALEN];

‎src/interfaces/libpq/fe-connect.c

+6-5
Original file line numberDiff line numberDiff line change
@@ -293,9 +293,12 @@ static const internalPQconninfoOption PQconninfoOptions[] = {
293293
"SSL-Mode", "", 12, /* sizeof("verify-full") == 12 */
294294
offsetof(struct pg_conn, sslmode)},
295295

296-
{"sslcompression", "PGSSLCOMPRESSION", "0", NULL,
297-
"SSL-Compression", "", 1,
298-
offsetof(struct pg_conn, sslcompression)},
296+
/*
297+
* "sslcompression" is no longer used, but keep it present for backwards
298+
* compatibility.
299+
*/
300+
{"sslcompression", NULL, NULL, NULL,
301+
"SSL-Compression", "D", 1, -1},
299302

300303
{"sslcert", "PGSSLCERT", NULL, NULL,
301304
"SSL-Client-Cert", "", 64,
@@ -4080,8 +4083,6 @@ freePGconn(PGconn *conn)
40804083
free(conn->sslcrl);
40814084
if (conn->sslcrldir)
40824085
free(conn->sslcrldir);
4083-
if (conn->sslcompression)
4084-
free(conn->sslcompression);
40854086
if (conn->requirepeer)
40864087
free(conn->requirepeer);
40874088
if (conn->ssl_min_protocol_version)

‎src/interfaces/libpq/fe-secure-openssl.c

+7-8
Original file line numberDiff line numberDiff line change
@@ -1257,13 +1257,8 @@ initialize_SSL(PGconn *conn)
12571257
if (have_rootcert)
12581258
SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, verify_cb);
12591259

1260-
/*
1261-
* Set compression option if necessary.
1262-
*/
1263-
if (conn->sslcompression && conn->sslcompression[0] == '0')
1264-
SSL_set_options(conn->ssl, SSL_OP_NO_COMPRESSION);
1265-
else
1266-
SSL_clear_options(conn->ssl, SSL_OP_NO_COMPRESSION);
1260+
/* disable SSL compression */
1261+
SSL_set_options(conn->ssl, SSL_OP_NO_COMPRESSION);
12671262

12681263
return 0;
12691264
}
@@ -1553,8 +1548,12 @@ PQsslAttribute(PGconn *conn, const char *attribute_name)
15531548
if (strcmp(attribute_name, "cipher") == 0)
15541549
return SSL_get_cipher(conn->ssl);
15551550

1551+
/*
1552+
* SSL compression is disabled, so even if connecting to an older server
1553+
* which still supports it, it will not be active.
1554+
*/
15561555
if (strcmp(attribute_name, "compression") == 0)
1557-
return SSL_get_current_compression(conn->ssl) ? "on" : "off";
1556+
return "off";
15581557

15591558
if (strcmp(attribute_name, "protocol") == 0)
15601559
return SSL_get_version(conn->ssl);

‎src/interfaces/libpq/libpq-int.h

-1
Original file line numberDiff line numberDiff line change
@@ -360,7 +360,6 @@ struct pg_conn
360360
char *keepalives_count; /* maximum number of TCP keepalive
361361
* retransmits */
362362
char *sslmode; /* SSL mode (require,prefer,allow,disable) */
363-
char *sslcompression; /* SSL compression (0 or 1) */
364363
char *sslkey; /* client key filename */
365364
char *sslcert; /* client certificate filename */
366365
char *sslpassword; /* client key file password */

0 commit comments

Comments
 (0)