git.postgresql.org Git - postgresql.git/commitdiff

git projects / postgresql.git / commitdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | patch | inline | side by side (parent: a70e01d)
Only perform pg_strong_random init when required
author Daniel Gustafsson <dgustafsson@postgresql.org>
Mon, 2 Sep 2024 11:52:27 +0000 (13:52 +0200)
committer Daniel Gustafsson <dgustafsson@postgresql.org>
Mon, 2 Sep 2024 11:52:27 +0000 (13:52 +0200)
The random number generator in OpenSSL 1.1.1 was redesigned to provide
fork safety by default, thus removing the need for calling RAND_poll
after forking to ensure that two processes cannot share the same state.
Since we now support 1.1.0 as the minumum version, and 1.1.0 is being
increasingly phased out from production use, only perform the RAND_poll
initialization for installations running 1.1.0 by checking the OpenSSL
version number.

LibreSSL changed random number generator when forking OpenSSL and has
provided fork safety since version 2.0.2.

This removes the overhead of initializing the RNG for strong random
for the vast majority of users for whom it is no longer required.

Reviewed-by: Jacob Champion <jacob.champion@enterprisedb.com>
Reviewed-by: Peter Eisentraut <peter@eisentraut.org>
Reviewed-by: Michael Paquier <michael@paquier.xyz>
Discussion: https://postgr.es/m/CA+hUKGKh7QrYzu=8yWEUJvXtMVm_CNWH1L_TLWCbZMwbi1XP2Q@mail.gmail.com

src/port/pg_strong_random.c patch | blob | blame | history

diff --git a/src/port/pg_strong_random.c b/src/port/pg_strong_random.c
index 5f2b24842528242e54d3b59d48e66709d1046afb..a8efb2b188635312a9dbe9188d5ffa7f25343c00 100644 (file)
--- a/src/port/pg_strong_random.c
+++ b/src/port/pg_strong_random.c
@@ -50,17 +50,20 @@
#ifdef USE_OPENSSL
+#include <openssl/opensslv.h>
#include <openssl/rand.h>
void
pg_strong_random_init(void)
{
+#if (OPENSSL_VERSION_NUMBER < 0x10101000L)
/*
- * Make sure processes do not share OpenSSL randomness state. This is no
- * longer required in OpenSSL 1.1.1 and later versions, but until we drop
- * support for version < 1.1.1 we need to do this.
+ * Make sure processes do not share OpenSSL randomness state. This is not
+ * required on LibreSSL and no longer required in OpenSSL 1.1.1 and later
+ * versions.
*/
RAND_poll();
+#endif
}
bool
This is the main PostgreSQL git repository.
RSS Atom

AltStyle によって変換されたページ (->オリジナル) /