| From: | Michael Paquier <michael(at)paquier(dot)xyz> |
|---|---|
| To: | pgsql-committers(at)lists(dot)postgresql(dot)org |
| Subject: | pgsql: Use explicit fetching for digests in cryptohash (OpenSSL >= 3.0) |
| Date: | 2026-08-10 00:14:26 |
| Message-ID: | E1wtDes-00000000tCh-1KXr@gemulon.postgresql.org |
| Views: | Whole Thread | Raw Message | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-committers |
Use explicit fetching for digests in cryptohash (OpenSSL >= 3.0)
cryptohash_openssl.c initialized the EVP_MD_CTX with the implicit static
digest objects (EVP_sha256() and friends). These do not dispatch
through a loaded provider. OpenSSL 3.0 and newer versions recommend to
switch to an explicit fetch, using EVP_MD_fetch(), the older routines
being deprecated, available for backward-compatibility purposes.
Now, when building with OpenSSL 3.0 or a newer bersion, we fetch the
digest by name with EVP_MD_fetch(), cache it in the context, and free it
on teardown. This has as consequence to feed the hash from a provider.
The implicit path is kept for older OpenSSL, 1.1.1 being the oldest
version still supported on HEAD, and for LibreSSL.
This is a slight change in the hashing logic. No backpatch is done as
that looks safer, and the code in the back-branches is also able to
work. This has been locally tested across OpenSSL 1.1.1 up to 3.5, so
hopefully nothing is broken.
Note: The submitted code was clearly AI-generated. I have spend a bit
of time cleaning it up, making it more consistent with the project style
in terms of coding, adjusting a few more things on the way.
Author: Mark Atwood <mark(at)reviewcommit(dot)com>
Co-authored-by: Michael Paquier <michael(at)paquier(dot)xyz>
Discussion: https://postgr.es/m/178596055358.1584287.8485463954311014881@reviewcommit.com
Branch
------
master
Details
-------
https://git.postgresql.org/pg/commitdiff/b91f79cd08abba7a800d3faf79bb96e8adc8752e
Modified Files
--------------
src/common/cryptohash_openssl.c | 47 +++++++++++++++++++++++++++++++++++++++++
1 file changed, 47 insertions(+)
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Michael Paquier | 2026-08-10 05:54:13 | pgsql: Use EVP_MAC for HMAC (OpenSSL >= 3.0) |
| Previous Message | Michael Paquier | 2026-08-09 23:38:01 | pgsql: Use OOM-safe routine for pgstats shared hashtable insert |