Skip to content

Navigation Menu

Sign in

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit c8e4030

Browse filesBrowse files
peterepetere
committed
Make finding openssl program a configure or meson option
Various test suites use the "openssl" program as part of their setup. There isn't a way to override which openssl program is to be used, other than by fiddling with the path, perhaps. This has gotten increasingly problematic because different versions of openssl have different capabilities and do different things by default. This patch checks for an openssl binary in configure and meson setup, with appropriate ways to override it. This is similar to how "lz4" and "zstd" are handled, for example. The meson build system actually already did this, but the result was only used in some places. This is now applied more uniformly. Reviewed-by: Michael Paquier <michael@paquier.xyz> Discussion: https://www.postgresql.org/message-id/flat/dc638b75-a16a-007d-9e1c-d16ed6cf0ad2%40enterprisedb.com
1 parent 40c7fcb commit c8e4030
Copy full SHA for c8e4030

16 files changed

+107
-29
lines changed

‎configure

Copy file name to clipboardExpand all lines: configure
+55Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -648,6 +648,7 @@ PG_CRC32C_OBJS
648648
CFLAGS_ARMV8_CRC32C
649649
CFLAGS_SSE42
650650
LIBOBJS
651+
OPENSSL
651652
ZSTD
652653
LZ4
653654
UUID_LIBS
@@ -14112,6 +14113,60 @@ done
1411214113

1411314114
fi
1411414115

14116+
if test -z "$OPENSSL"; then
14117+
for ac_prog in openssl
14118+
do
14119+
# Extract the first word of "$ac_prog", so it can be a program name with args.
14120+
set dummy $ac_prog; ac_word=$2
14121+
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
14122+
$as_echo_n "checking for $ac_word... " >&6; }
14123+
if ${ac_cv_path_OPENSSL+:} false; then :
14124+
$as_echo_n "(cached) " >&6
14125+
else
14126+
case $OPENSSL in
14127+
[\\/]* | ?:[\\/]*)
14128+
ac_cv_path_OPENSSL="$OPENSSL" # Let the user override the test with a path.
14129+
;;
14130+
*)
14131+
as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
14132+
for as_dir in $PATH
14133+
do
14134+
IFS=$as_save_IFS
14135+
test -z "$as_dir" && as_dir=.
14136+
for ac_exec_ext in '' $ac_executable_extensions; do
14137+
if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
14138+
ac_cv_path_OPENSSL="$as_dir/$ac_word$ac_exec_ext"
14139+
$as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
14140+
break 2
14141+
fi
14142+
done
14143+
done
14144+
IFS=$as_save_IFS
14145+
14146+
;;
14147+
esac
14148+
fi
14149+
OPENSSL=$ac_cv_path_OPENSSL
14150+
if test -n "$OPENSSL"; then
14151+
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $OPENSSL" >&5
14152+
$as_echo "$OPENSSL" >&6; }
14153+
else
14154+
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
14155+
$as_echo "no" >&6; }
14156+
fi
14157+
14158+
14159+
test -n "$OPENSSL" && break
14160+
done
14161+
14162+
else
14163+
# Report the value of OPENSSL in configure's output in all cases.
14164+
{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for OPENSSL" >&5
14165+
$as_echo_n "checking for OPENSSL... " >&6; }
14166+
{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $OPENSSL" >&5
14167+
$as_echo "$OPENSSL" >&6; }
14168+
fi
14169+
1411514170
if test "$with_ssl" = openssl ; then
1411614171
ac_fn_c_check_header_mongrel "$LINENO" "openssl/ssl.h" "ac_cv_header_openssl_ssl_h" "$ac_includes_default"
1411714172
if test "x$ac_cv_header_openssl_ssl_h" = xyes; then :

‎configure.ac

Copy file name to clipboardExpand all lines: configure.ac
+1Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1542,6 +1542,7 @@ if test "$with_gssapi" = yes ; then
15421542
[AC_CHECK_HEADERS(gssapi.h, [], [AC_MSG_ERROR([gssapi.h header file is required for GSSAPI])])])
15431543
fi
15441544

1545+
PGAC_PATH_PROGS(OPENSSL, openssl)
15451546
if test "$with_ssl" = openssl ; then
15461547
AC_CHECK_HEADER(openssl/ssl.h, [], [AC_MSG_ERROR([header file <openssl/ssl.h> is required for OpenSSL])])
15471548
AC_CHECK_HEADER(openssl/err.h, [], [AC_MSG_ERROR([header file <openssl/err.h> is required for OpenSSL])])

‎doc/src/sgml/install-windows.sgml

Copy file name to clipboardExpand all lines: doc/src/sgml/install-windows.sgml
+9Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -541,6 +541,15 @@ $ENV{PROVE_TESTS}='t/020*.pl t/010*.pl'
541541
</para></listitem>
542542
</varlistentry>
543543

544+
<varlistentry>
545+
<term><varname>OPENSSL</varname></term>
546+
<listitem><para>
547+
Path to a <application>openssl</application> command. The default is
548+
<literal>openssl</literal>, which will search for a command by that
549+
name in the configured <envar>PATH</envar>.
550+
</para></listitem>
551+
</varlistentry>
552+
544553
<varlistentry>
545554
<term><varname>TAR</varname></term>
546555
<listitem><para>

‎meson.build

Copy file name to clipboardExpand all lines: meson.build
+1Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -328,6 +328,7 @@ tar = find_program(get_option('TAR'), native: true)
328328
gzip = find_program(get_option('GZIP'), native: true)
329329
program_lz4 = find_program(get_option('LZ4'), native: true, required: false)
330330
touch = find_program('touch', native: true)
331+
openssl = find_program(get_option('OPENSSL'), native: true, required: false)
331332
program_zstd = find_program(get_option('ZSTD'), native: true, required: false)
332333
dtrace = find_program(get_option('DTRACE'), native: true, required: get_option('dtrace'))
333334
missing = find_program('config/missing', native: true)

‎meson_options.txt

Copy file name to clipboardExpand all lines: meson_options.txt
+3Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -157,6 +157,9 @@ option('GZIP', type : 'string', value: 'gzip',
157157
option('LZ4', type : 'string', value: 'lz4',
158158
description: 'path to lz4 binary')
159159

160+
option('OPENSSL', type : 'string', value: 'openssl',
161+
description: 'path to openssl binary')
162+
160163
option('PERL', type : 'string', value: 'perl',
161164
description: 'path to perl binary')
162165

‎src/Makefile.global.in

Copy file name to clipboardExpand all lines: src/Makefile.global.in
+1Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -343,6 +343,7 @@ LN_S = @LN_S@
343343
MSGFMT = @MSGFMT@
344344
MSGFMT_FLAGS = @MSGFMT_FLAGS@
345345
MSGMERGE = @MSGMERGE@
346+
OPENSSL = @OPENSSL@
346347
PYTHON = @PYTHON@
347348
TAR = @TAR@
348349
XGETTEXT = @XGETTEXT@

‎src/test/ldap/Makefile

Copy file name to clipboardExpand all lines: src/test/ldap/Makefile
+1Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ top_builddir = ../../..
1414
include $(top_builddir)/src/Makefile.global
1515

1616
export with_ldap
17+
export OPENSSL
1718

1819
check:
1920
$(prove_check)

‎src/test/ldap/meson.build

Copy file name to clipboardExpand all lines: src/test/ldap/meson.build
+4-1Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ tests += {
66
'tests': [
77
't/001_auth.pl',
88
],
9-
'env': {'with_ldap': ldap.found() ? 'yes' : 'no'},
9+
'env': {
10+
'with_ldap': ldap.found() ? 'yes' : 'no',
11+
'OPENSSL': openssl.path(),
12+
},
1013
},
1114
}

‎src/test/ldap/t/001_auth.pl

Copy file name to clipboardExpand all lines: src/test/ldap/t/001_auth.pl
+5-3Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -113,13 +113,15 @@
113113
mkdir $ldap_datadir or die;
114114
mkdir $slapd_certs or die;
115115

116-
system_or_bail "openssl", "req", "-new", "-nodes", "-keyout",
116+
my $openssl = $ENV{OPENSSL};
117+
118+
system_or_bail $openssl, "req", "-new", "-nodes", "-keyout",
117119
"$slapd_certs/ca.key", "-x509", "-out", "$slapd_certs/ca.crt", "-subj",
118120
"/CN=CA";
119-
system_or_bail "openssl", "req", "-new", "-nodes", "-keyout",
121+
system_or_bail $openssl, "req", "-new", "-nodes", "-keyout",
120122
"$slapd_certs/server.key", "-out", "$slapd_certs/server.csr", "-subj",
121123
"/CN=server";
122-
system_or_bail "openssl", "x509", "-req", "-in", "$slapd_certs/server.csr",
124+
system_or_bail $openssl, "x509", "-req", "-in", "$slapd_certs/server.csr",
123125
"-CA", "$slapd_certs/ca.crt", "-CAkey", "$slapd_certs/ca.key",
124126
"-CAcreateserial", "-out", "$slapd_certs/server.crt";
125127

‎src/test/modules/ssl_passphrase_callback/Makefile

Copy file name to clipboardExpand all lines: src/test/modules/ssl_passphrase_callback/Makefile
+2-2Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,9 +31,9 @@ PASS = FooBaR1
3131
.PHONY: ssl-files ssl-files-clean
3232

3333
ssl-files:
34-
openssl req -new -x509 -days 10000 -nodes -out server.crt \
34+
$(OPENSSL) req -new -x509 -days 10000 -nodes -out server.crt \
3535
-keyout server.ckey -subj "/CN=localhost"
36-
openssl rsa -aes256 -in server.ckey -out server.key -passout pass:$(PASS)
36+
$(OPENSSL) rsa -aes256 -in server.ckey -out server.key -passout pass:$(PASS)
3737
rm server.ckey
3838

3939
ssl-files-clean:

‎src/test/modules/ssl_passphrase_callback/meson.build

Copy file name to clipboardExpand all lines: src/test/modules/ssl_passphrase_callback/meson.build
-2Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,8 +25,6 @@ testprep_targets += ssl_passphrase_callback
2525
# Targets to generate or remove the ssl certificate and key. Need to be copied
2626
# to the source afterwards. Normally not needed.
2727

28-
openssl = find_program('openssl', native: true, required: false)
29-
3028
if openssl.found()
3129
cert = custom_target('server.crt',
3230
output: ['server.crt', 'server.ckey'],

‎src/test/ssl/Makefile

Copy file name to clipboardExpand all lines: src/test/ssl/Makefile
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ subdir = src/test/ssl
1515
top_builddir = ../../..
1616
include $(top_builddir)/src/Makefile.global
1717

18-
export with_ssl
18+
export OPENSSL with_ssl
1919

2020
# The sslfiles targets are separated into their own file due to interactions
2121
# with settings in Makefile.global.

‎src/test/ssl/meson.build

Copy file name to clipboardExpand all lines: src/test/ssl/meson.build
+4-1Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,10 @@ tests += {
33
'sd': meson.current_source_dir(),
44
'bd': meson.current_build_dir(),
55
'tap': {
6-
'env': {'with_ssl': get_option('ssl')},
6+
'env': {
7+
'with_ssl': get_option('ssl'),
8+
'OPENSSL': openssl.path(),
9+
},
710
'tests': [
811
't/001_ssltests.pl',
912
't/002_scram.pl',

‎src/test/ssl/sslfiles.mk

Copy file name to clipboardExpand all lines: src/test/ssl/sslfiles.mk
+17-17Lines changed: 17 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ sslfiles: $(SSLFILES) $(SSLDIRS)
8484

8585
# Root CA is self-signed.
8686
ssl/root_ca.crt: ssl/root_ca.key conf/root_ca.config
87-
openssl req -new -x509 -config conf/root_ca.config -days 10000 -key $< -out $@
87+
$(OPENSSL) req -new -x509 -config conf/root_ca.config -days 10000 -key $< -out $@
8888

8989
#
9090
# Special-case keys
@@ -94,20 +94,20 @@ ssl/root_ca.crt: ssl/root_ca.key conf/root_ca.config
9494

9595
# Password-protected version of server-cn-only.key
9696
ssl/server-password.key: ssl/server-cn-only.key
97-
openssl rsa -aes256 -in $< -out $@ -passout 'pass:secret1'
97+
$(OPENSSL) rsa -aes256 -in $< -out $@ -passout 'pass:secret1'
9898

9999
# DER-encoded version of client.key
100100
ssl/client-der.key: ssl/client.key
101-
openssl rsa -in $< -outform DER -out $@
101+
$(OPENSSL) rsa -in $< -outform DER -out $@
102102

103103
# Convert client.key to encrypted PEM (X.509 text) and DER (X.509 ASN.1)
104104
# formats to test libpq's support for the sslpassword= option.
105105
ssl/client-encrypted-pem.key: ssl/client.key
106-
openssl rsa -in $< -outform PEM -aes128 -passout 'pass:dUmmyP^#+' -out $@
106+
$(OPENSSL) rsa -in $< -outform PEM -aes128 -passout 'pass:dUmmyP^#+' -out $@
107107
# TODO Explicitly choosing -aes128 generates a key unusable to PostgreSQL with
108108
# OpenSSL 3.0.0, so fall back on the default for now.
109109
ssl/client-encrypted-der.key: ssl/client.key
110-
openssl rsa -in $< -outform DER -passout 'pass:dUmmyP^#+' -out $@
110+
$(OPENSSL) rsa -in $< -outform DER -passout 'pass:dUmmyP^#+' -out $@
111111

112112
#
113113
# Combined files
@@ -145,7 +145,7 @@ $(COMBINATIONS):
145145
#
146146

147147
$(STANDARD_KEYS):
148-
openssl genrsa -out $@ 2048
148+
$(OPENSSL) genrsa -out $@ 2048
149149
chmod 0600 $@
150150

151151
#
@@ -165,18 +165,18 @@ client_ca_state_files := ssl/client_ca-certindex ssl/client_ca-certindex.attr ss
165165
# parallel processes, so we must mark the entire Makefile .NOTPARALLEL.
166166
.NOTPARALLEL:
167167
$(CA_CERTS): ssl/%.crt: ssl/%.csr conf/%.config conf/cas.config ssl/root_ca.crt | ssl/new_certs_dir $(root_ca_state_files)
168-
openssl ca -batch -config conf/cas.config -name root_ca -notext -in $< -out $@
168+
$(OPENSSL) ca -batch -config conf/cas.config -name root_ca -notext -in $< -out $@
169169

170170
$(SERVER_CERTS): ssl/%.crt: ssl/%.csr conf/%.config conf/cas.config ssl/server_ca.crt | ssl/new_certs_dir $(server_ca_state_files)
171-
openssl ca -batch -config conf/cas.config -name server_ca -notext -in $< -out $@
171+
$(OPENSSL) ca -batch -config conf/cas.config -name server_ca -notext -in $< -out $@
172172

173173
$(CLIENT_CERTS): ssl/%.crt: ssl/%.csr conf/%.config conf/cas.config ssl/client_ca.crt | ssl/new_certs_dir $(client_ca_state_files)
174-
openssl ca -batch -config conf/cas.config -name client_ca -notext -in $< -out $@
174+
$(OPENSSL) ca -batch -config conf/cas.config -name client_ca -notext -in $< -out $@
175175

176176
# The CSRs don't need to persist after a build.
177177
.INTERMEDIATE: $(CERTIFICATES:%=ssl/%.csr)
178178
ssl/%.csr: ssl/%.key conf/%.config
179-
openssl req -new -utf8 -key $< -out $@ -config conf/$*.config
179+
$(OPENSSL) req -new -utf8 -key $< -out $@ -config conf/$*.config
180180

181181
#
182182
# CA State
@@ -210,16 +210,16 @@ ssl/%.srl:
210210
#
211211

212212
ssl/root.crl: ssl/root_ca.crt | $(root_ca_state_files)
213-
openssl ca -config conf/cas.config -name root_ca -gencrl -out $@
213+
$(OPENSSL) ca -config conf/cas.config -name root_ca -gencrl -out $@
214214

215215
ssl/server.crl: ssl/server-revoked.crt ssl/server_ca.crt | $(server_ca_state_files)
216-
openssl ca -config conf/cas.config -name server_ca -revoke $<
217-
openssl ca -config conf/cas.config -name server_ca -gencrl -out $@
216+
$(OPENSSL) ca -config conf/cas.config -name server_ca -revoke $<
217+
$(OPENSSL) ca -config conf/cas.config -name server_ca -gencrl -out $@
218218

219219
ssl/client.crl: ssl/client-revoked.crt ssl/client-revoked-utf8.crt ssl/client_ca.crt | $(client_ca_state_files)
220-
openssl ca -config conf/cas.config -name client_ca -revoke ssl/client-revoked.crt
221-
openssl ca -config conf/cas.config -name client_ca -revoke ssl/client-revoked-utf8.crt
222-
openssl ca -config conf/cas.config -name client_ca -gencrl -out $@
220+
$(OPENSSL) ca -config conf/cas.config -name client_ca -revoke ssl/client-revoked.crt
221+
$(OPENSSL) ca -config conf/cas.config -name client_ca -revoke ssl/client-revoked-utf8.crt
222+
$(OPENSSL) ca -config conf/cas.config -name client_ca -gencrl -out $@
223223

224224
#
225225
# CRL hash directories
@@ -230,7 +230,7 @@ ssl/root+client-crldir: ssl/client.crl ssl/root.crl
230230
ssl/server-crldir: ssl/server.crl
231231
ssl/client-crldir: ssl/client.crl
232232

233-
crlhashfile = $(shell openssl crl -hash -noout -in $(1)).r0
233+
crlhashfile = $(shell $(OPENSSL) crl -hash -noout -in $(1)).r0
234234

235235
ssl/%-crldir:
236236
mkdir -p $@

‎src/test/ssl/t/001_ssltests.pl

Copy file name to clipboardExpand all lines: src/test/ssl/t/001_ssltests.pl
+2-2Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -611,7 +611,7 @@ sub switch_server_cert
611611

612612
# pg_stat_ssl
613613

614-
my $serialno = `openssl x509 -serial -noout -in ssl/client.crt`;
614+
my $serialno = `$ENV{OPENSSL} x509 -serial -noout -in ssl/client.crt`;
615615
if ($? == 0)
616616
{
617617
# OpenSSL prints serial numbers in hexadecimal and converting the serial
@@ -633,7 +633,7 @@ sub switch_server_cert
633633
{
634634
# OpenSSL isn't functioning on the user's PATH. This probably isn't worth
635635
# skipping the test over, so just fall back to a generic integer match.
636-
warn 'couldn\'t run `openssl x509` to get client cert serialno';
636+
warn "couldn't run \"$ENV{OPENSSL} x509\" to get client cert serialno";
637637
$serialno = '\d+';
638638
}
639639

‎src/tools/msvc/vcregress.pl

Copy file name to clipboardExpand all lines: src/tools/msvc/vcregress.pl
+1Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -146,6 +146,7 @@ sub set_command_env
146146
{
147147
set_single_env('GZIP_PROGRAM', 'gzip');
148148
set_single_env('LZ4', 'lz4');
149+
set_single_env('OPENSSL', 'openssl');
149150
set_single_env('ZSTD', 'zstd');
150151
}
151152

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.