From 7ad544fd8e4528e920f994098a587c7ffd8ea595 Mon Sep 17 00:00:00 2001
From: Michael Paquier <michael@paquier.xyz>
Date: Fri, 6 Dec 2019 15:14:31 +0900
Subject: [PATCH] Fix handling of OpenSSL's SSL_clear_options

This function is supported down to OpenSSL 0.9.8, which is the oldest
version supported since 593d4e4 (from Postgres 10 onwards), and is used
since e3bdb2d (from 11 onwards).  It is defined as a macro from OpenSSL
0.9.8 to 1.0.2, and as a function in 1.1.0 and newer versions.  However,
the configure check present is only adapted for functions.  So, even if
the code would be able to compile, configure fails to detect the macro,
causing it to be ignored when compiling the code with OpenSSL from 0.9.8
to 1.0.2.

The code needs a configure check as per a364dfa, which has fixed a
compilation issue with a past version of LibreSSL in NetBSD 5.1.  On
HEAD, just remove the configure check as the last release of NetBSD 5 is
from 2014 (and we have no more buildfarm members for it).  In 11 and 12,
improve the configure logic so as both macros and functions are
correctly detected.  This makes NetBSD 5 still work on already-released
branches, but not for 13 onwards.

The patch for HEAD is from me, and Daniel has written the version to use
for the back-branches.

Author: Michael Paquier, Daniel Gustaffson
Reviewed-by: Tom Lane
Discussion: https://postgr.es/m/20191205083252.GE5064@paquier.xyz
Discussion: https://postgr.es/m/98F7F99E-1129-41D8-B86B-FE3B1E286881@yesql.se
Backpatch-through: 11
---
 configure    | 39 ++++++++++++++++++++++++++++++++++++++-
 configure.in | 16 +++++++++++++++-
 2 files changed, 53 insertions(+), 2 deletions(-)

diff --git a/configure b/configure
index cbf2d77ec6..81aa86af8e 100755
--- a/configure
+++ b/configure
@@ -11786,7 +11786,7 @@ else
 fi
 
   fi
-  for ac_func in SSL_clear_options SSL_get_current_compression X509_get_signature_nid
+  for ac_func in SSL_get_current_compression X509_get_signature_nid
 do :
   as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
 ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
@@ -11829,6 +11829,43 @@ _ACEOF
 fi
 done
 
+  # SSL_clear_options is a macro in OpenSSL from 0.9.8 to 1.0.2, and
+  # a function from 1.1.0 onwards so we cannot use AC_CHECK_FUNCS.
+  { $as_echo "$as_me:${as_lineno-$LINENO}: checking for SSL_clear_options" >&5
+$as_echo_n "checking for SSL_clear_options... " >&6; }
+if ${ac_cv_func_ssl_clear_options+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+  #include <openssl/ssl.h>
+  #include <openssl/bio.h>
+  SSL *ssl;
+
+int
+main ()
+{
+return SSL_clear_options(ssl, 0);
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+  ac_cv_func_ssl_clear_options=yes
+else
+  ac_cv_func_ssl_clear_options=no
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext conftest.$ac_ext
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_func_ssl_clear_options" >&5
+$as_echo "$ac_cv_func_ssl_clear_options" >&6; }
+  if test $ac_cv_func_ssl_clear_options = yes ; then
+
+$as_echo "#define HAVE_SSL_CLEAR_OPTIONS 1" >>confdefs.h
+
+  fi
 fi
 
 if test "$with_pam" = yes ; then
diff --git a/configure.in b/configure.in
index 047fa0f774..6a0c1758b5 100644
--- a/configure.in
+++ b/configure.in
@@ -1203,7 +1203,7 @@ if test "$with_openssl" = yes ; then
      AC_SEARCH_LIBS(CRYPTO_new_ex_data, [eay32 crypto], [], [AC_MSG_ERROR([library 'eay32' or 'crypto' is required for OpenSSL])])
      AC_SEARCH_LIBS(SSL_new, [ssleay32 ssl], [], [AC_MSG_ERROR([library 'ssleay32' or 'ssl' is required for OpenSSL])])
   fi
-  AC_CHECK_FUNCS([SSL_clear_options SSL_get_current_compression X509_get_signature_nid])
+  AC_CHECK_FUNCS([SSL_get_current_compression X509_get_signature_nid])
   # Functions introduced in OpenSSL 1.1.0. We used to check for
   # OPENSSL_VERSION_NUMBER, but that didn't work with 1.1.0, because LibreSSL
   # defines OPENSSL_VERSION_NUMBER to claim version 2.0.0, even though it
@@ -1214,6 +1214,20 @@ if test "$with_openssl" = yes ; then
   # thread-safety. In 1.1.0, it's no longer required, and CRYPTO_lock()
   # function was removed.
   AC_CHECK_FUNCS([CRYPTO_lock])
+  # SSL_clear_options is a macro in OpenSSL from 0.9.8 to 1.0.2, and
+  # a function from 1.1.0 onwards so we cannot use AC_CHECK_FUNCS.
+  AC_CACHE_CHECK([for SSL_clear_options], ac_cv_func_ssl_clear_options,
+  [AC_LINK_IFELSE([AC_LANG_PROGRAM([
+  #include <openssl/ssl.h>
+  #include <openssl/bio.h>
+  SSL *ssl;
+  ],
+  [return SSL_clear_options(ssl, 0);])],
+  [ac_cv_func_ssl_clear_options=yes],
+  [ac_cv_func_ssl_clear_options=no])])
+  if test $ac_cv_func_ssl_clear_options = yes ; then
+    AC_DEFINE(HAVE_SSL_CLEAR_OPTIONS, 1, [Define to 1 if you have SSL_clear_options()])
+  fi
 fi
 
 if test "$with_pam" = yes ; then