-
Notifications
You must be signed in to change notification settings - Fork 123
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add missing symbols for postgres #979
Conversation
9b8e900
to
774eefa
Compare
6a5c0ac
to
8ca077e
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I looked into some of our concerns for adding back Cast from decrepit and wanted to make the following points.
- This had already existed in AWS-LC when we were working on removing decrepit. During the work for that, we had the consensus that we would remove everything that did not have usage internally and incrementally add back functions if customers needed the functionality.
- We can consider influencing the Postgres upstream by submitting a PR to them to ifdef out the Cast ciphersuites. However, this change would only be added in new Postgres releases and won't be applicable to old releases. We can take a look at PostGres's versioning policy here: https://www.postgresql.org/support/versioning/
PostgreSQL Versions 11-15 are currently supported, with each major version of PostgreSQL having a support timeline of 5 years. Any upstream influence we make now, won't truly be felt until PostgreSQL15 is deprecated in 2027 (assuming an upstream contribution makes it to Version 16).
Considering these factors, we should look to add minimal support for the Cast ciphersuites through EVP now, so we can gain adoption in existing versions of PostGreSQL. We can still make an upstream contribution to ifdef the CAST, blowfish, and des usage out of PostGres when building with AWS-LC, so that new versions of PostGres don't continue rely on this behavior.
We're making sure to only expose the minimal amount of symbols needed, which are the EVP_CIPHER
s in this case. We're also adding the AWS_LC_DEPRECATED
macro in front of the CAST ciphersuites to indicate that these function should not be relied on. This will intentionally cause current builds of PostGres to complain about deprecated symbols. We can make an upstream contribution to ifdef these deprecated symbols to silence these warnings.
8ca077e
to
a96ee81
Compare
a96ee81
to
674b86c
Compare
This had already existed in AWS-LC when we were working on removing decrepit. During the work for that, we had the consensus that we would remove everything that did not have usage internally and incrementally add back functions if customers needed the functionality. We can consider influencing the Postgres upstream by submitting a PR to them to ifdef out the Cast ciphersuites. However, this change would only be added in new Postgres releases and won't be applicable to old releases. PostgreSQL Versions 11-15 are currently supported, with each major version of PostgreSQL having a support timeline of 5 years. Any upstream influence we make now, won't truly be felt until PostgreSQL15 is deprecated in 2027 (assuming an upstream contribution makes it to Version 16). Considering these factors, we should look to add minimal support for the Cast ciphersuites through EVP now, so we can gain adoption in existing versions of PostGres. We can still make an upstream contribution to ifdef the CAST, blowfish, and des usage out of PostGres when building with AWS-LC, so that new versions of PostGres don't continue rely on this behavior. We're making sure to only expose the minimal amount of symbols needed, which are the EVP_CIPHERs in this case. We're also adding the AWS_LC_DEPRECATED macro in front of the CAST ciphersuites to indicate that these function should not be relied on. This will intentionally cause current builds of PostGres to complain about deprecated symbols. We can make an upstream contribution to ifdef these deprecated symbols to silence these warnings.
This had already existed in AWS-LC when we were working on removing decrepit. During the work for that, we had the consensus that we would remove everything that did not have usage internally and incrementally add back functions if customers needed the functionality. We can consider influencing the Postgres upstream by submitting a PR to them to ifdef out the Cast ciphersuites. However, this change would only be added in new Postgres releases and won't be applicable to old releases. PostgreSQL Versions 11-15 are currently supported, with each major version of PostgreSQL having a support timeline of 5 years. Any upstream influence we make now, won't truly be felt until PostgreSQL15 is deprecated in 2027 (assuming an upstream contribution makes it to Version 16). Considering these factors, we should look to add minimal support for the Cast ciphersuites through EVP now, so we can gain adoption in existing versions of PostGres. We can still make an upstream contribution to ifdef the CAST, blowfish, and des usage out of PostGres when building with AWS-LC, so that new versions of PostGres don't continue rely on this behavior. We're making sure to only expose the minimal amount of symbols needed, which are the EVP_CIPHERs in this case. We're also adding the AWS_LC_DEPRECATED macro in front of the CAST ciphersuites to indicate that these function should not be relied on. This will intentionally cause current builds of PostGres to complain about deprecated symbols. We can make an upstream contribution to ifdef these deprecated symbols to silence these warnings.
This had already existed in AWS-LC when we were working on removing decrepit. During the work for that, we had the consensus that we would remove everything that did not have usage internally and incrementally add back functions if customers needed the functionality. We can consider influencing the Postgres upstream by submitting a PR to them to ifdef out the Cast ciphersuites. However, this change would only be added in new Postgres releases and won't be applicable to old releases. PostgreSQL Versions 11-15 are currently supported, with each major version of PostgreSQL having a support timeline of 5 years. Any upstream influence we make now, won't truly be felt until PostgreSQL15 is deprecated in 2027 (assuming an upstream contribution makes it to Version 16). Considering these factors, we should look to add minimal support for the Cast ciphersuites through EVP now, so we can gain adoption in existing versions of PostGres. We can still make an upstream contribution to ifdef the CAST, blowfish, and des usage out of PostGres when building with AWS-LC, so that new versions of PostGres don't continue rely on this behavior. We're making sure to only expose the minimal amount of symbols needed, which are the EVP_CIPHERs in this case. We're also adding the AWS_LC_DEPRECATED macro in front of the CAST ciphersuites to indicate that these function should not be relied on. This will intentionally cause current builds of PostGres to complain about deprecated symbols. We can make an upstream contribution to ifdef these deprecated symbols to silence these warnings.
Issues:
Resolves
CryptoAlg-1746
andCryptoAlg-1747
Description of changes:
Postgres has some "missing symbols" that we need to add back to support.
cast
had originally been removed along withdecrepit
, so this is just putting them back. The test file had not been removed, so we only need to add backcast.c
.SSL_CTX_set_min_proto_version
to be a macro, which was OpenSSL's way of wrapping around theSSL_CTX_ctrl
functions. The simplest way around this is to redefine theSSL_CTX_set_min_proto_version
as a macro at the end ofssl.h
, like we've been doing for other instances of this.Call-outs:
N/A
Testing:
Confirmed by building with Postgres.
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and
the ISC license.