Does the function PQinitOpenSSL need to be called with libpq?

Question

I built the libpq static library using USE_SSL=1 option. The syntax used was:

nmake.exe /f win32.mak USE_SSL=1 SSL_INC=C:\OpenSSL-Win32\include SSL_LIB_PATH=C:\OpenSSL-Win32\lib

I am able to connect to DB server Using below command command

strconnection="hostaddr= machine_ip port=5432 user=postgres password=postgres dbname=postgres sslmode=require" ;

ptr_db_conn = (_TCHAR*)LPCTSTR(strconnection);
_conn = PQconnectdb(ptr_db_conn);
if ( PQstatus(m_conn) != CONNECTION_OK)
{    
    T_RESULT=FALSE;     
}
else
{
    T_RESULT=TRUE;
}

...

I am not using the two functions below with sslmode=require as discussed in documentation at 31.18.1. Client Verification of Server Certificates:

void PQinitOpenSSL(int do_ssl, int do_crypto);
void PQinitSSL(int do_ssl);

Is it mandatory to use PQinitOpenSSL and PQinitSSL in postgreSQL 9.4?

score 1 · Answer 1 · answered Feb 25 '16 at 14:46

Is it mandatory to use PQinitOpenSSL and PQinitSSL in postgreSQL 9.4?

The controlling document is 31.18.5. SSL Library Initialization:

If your application initializes libssl and/or libcrypto libraries and libpq is built with SSL support, you should call PQinitOpenSSL to tell libpq that the libssl and/or libcrypto libraries have been initialized by your application, so that libpq will not also initialize those libraries.
void PQinitOpenSSL(int do_ssl, int do_crypto);
When do_ssl is non-zero, libpq will initialize the OpenSSL library before first opening a database connection. When do_crypto is non-zero, the libcrypto library will be initialized. By default (if PQinitOpenSSL is not called), both libraries are initialized. When SSL support is not compiled in, this function is present but does nothing.

If your application uses and initializes either OpenSSL or its underlying libcrypto library, you must call this function with zeroes for the appropriate parameter(s) before first opening a database connection. Also be sure that you have done that initialization before opening a database connection.

So, if your application calls OpenSSL's SSL_library_init and SSL_load_error_strings, then you call Postgres' PQinitOpenSSL with 0's. Also see Library Initialization on the OpenSSL wiki.

If your application does not initialize the OpenSSL library, then you should call call Postgres' PQinitOpenSSL with non-0's.

The corner case appears to be: you include a second library such that the second library does in fact initialize the OpenSSL library. In this case, you need to ensure the second library loads before libpq, and then your app calls PQinitOpenSSL with 0's because the second library invokes the initialization.

It also appears PQinitSSL(int do_ssl) with 0 or non-0 will work, too. There's no explicit libcrypto initialization in OpenSSL as far as I know, so PQinitOpenSSL's do_crypto is simply not needed in this case. Other libraries may need it, and OpenSSL 1.1.0 may change that. But I don't think it applies in this case.

Does the function PQinitOpenSSL need to be called with libpq?

1 Answers1