diff options
| author | Michael Paquier <michael@paquier.xyz> | 2021-03-10 09:35:42 +0900 |
|---|---|---|
| committer | Michael Paquier <michael@paquier.xyz> | 2021-03-10 09:35:42 +0900 |
| commit | 0ba71107efeeccde9158f47118f95043afdca0bb (patch) | |
| tree | 88e76f41af9d3fe66ecee5b4d4bb552d1210bd67 /src/interfaces/libpq/fe-secure-openssl.c | |
| parent | 6540cc517dd452874a4e0fb268aee9b92e5136c6 (diff) | |
Revert changes for SSL compression in libpq
This partially reverts 096bbf7 and 9d2d457, undoing the libpq changes as
it could cause breakages in distributions that share one single libpq
version across multiple major versions of Postgres for extensions and
applications linking to that.
Note that the backend is unchanged here, and it still disables SSL
compression while simplifying the underlying catalogs that tracked if
compression was enabled or not for a SSL connection.
Per discussion with Tom Lane and Daniel Gustafsson.
Discussion: https://postgr.es/m/YEbq15JKJwIX+S6m@paquier.xyz
Diffstat (limited to 'src/interfaces/libpq/fe-secure-openssl.c')
| -rw-r--r-- | src/interfaces/libpq/fe-secure-openssl.c | 15 |
1 files changed, 8 insertions, 7 deletions
diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c index c88dd3a1183..0fa10a23b4a 100644 --- a/src/interfaces/libpq/fe-secure-openssl.c +++ b/src/interfaces/libpq/fe-secure-openssl.c @@ -1257,8 +1257,13 @@ initialize_SSL(PGconn *conn) if (have_rootcert) SSL_set_verify(conn->ssl, SSL_VERIFY_PEER, verify_cb); - /* disable SSL compression */ - SSL_set_options(conn->ssl, SSL_OP_NO_COMPRESSION); + /* + * Set compression option if necessary. + */ + if (conn->sslcompression && conn->sslcompression[0] == '0') + SSL_set_options(conn->ssl, SSL_OP_NO_COMPRESSION); + else + SSL_clear_options(conn->ssl, SSL_OP_NO_COMPRESSION); return 0; } @@ -1548,12 +1553,8 @@ PQsslAttribute(PGconn *conn, const char *attribute_name) if (strcmp(attribute_name, "cipher") == 0) return SSL_get_cipher(conn->ssl); - /* - * SSL compression is disabled, so even if connecting to an older server - * which still supports it, it will not be active. - */ if (strcmp(attribute_name, "compression") == 0) - return "off"; + return SSL_get_current_compression(conn->ssl) ? "on" : "off"; if (strcmp(attribute_name, "protocol") == 0) return SSL_get_version(conn->ssl); |