homebrew-core: openssl@3.2.0 update makes psql crash when connecting with TLS

Does someone have the steps to downgrade to 3.1.4?

curl -L https://raw.githubusercontent.com/Homebrew/homebrew-core/e68186ba5a05a6ea9a30d6c7744de9a46bd3aadd/Formula/o/openssl@3.rb > openssl@3.rb && brew install openssl@3.rb

That’s the commit that upgraded the formula from 3.1.4 to 3.2. Feel free to confirm for yourself though.

Homebrew’s Postgreses now are compatible with openssl 3.2, please run brew upgrade postgresql@<YOUR POSTGRES VERSION> or brew upgrade libpq to get the fixed version.

Does someone have the steps to downgrade to 3.1.4?

curl -L https://raw.githubusercontent.com/Homebrew/homebrew-core/e68186ba5a05a6ea9a30d6c7744de9a46bd3aadd/Formula/o/openssl@3.rb > openssl@3.rb && brew install openssl@3.rb

That’s the commit that upgraded the formula from 3.1.4 to 3.2. Feel free to confirm for yourself though.

Thanks so much for this.

FYI to anyone who runs this: the first time I ran this, it didn’t work, giving the error:

Error: openssl@3 3.2.0 is already installed
To install 3.1.4, first run:
  brew unlink openssl@3

Following these instructions and running brew unlink openssl@3 before the above command worked for me and got postgres up and running again.

For those curious: https://www.postgresql.org/message-id/CX9SU44GH3P4.17X6ZZUJ5D40N@neon.tech.

@Bo98 thanks for your work on this! I will CC you on the email that I send to the list.

psql -h xxx -p 5432 -U xxx -d xxx

psql: error: connection to server at “xxx” (x.x.x.x), port 5432 failed: FATAL: no PostqreSQL user name specified in startup packet connection to server at xxx" (x.x.x.x), port 5432 failed: FATAL no PostgreSQL user name specified in startup packet psql(6636,0x10f1de600) malloc: *** error for object 0x7f916b00bc00: pointer being freed was not allocated psql(6636,0x10f1de600) malloc: *** set a breakpoint in malloc _error break to debug

@thomas-shirley it was in pgsql. OpenSSL just exposed an incorrect API usage within pgsql

Yes, this is a misuse of BIO_set_data from the Postgres side. This fixes it:

diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.c
index 4aeaf08312..e669bdbf1d 100644
--- a/src/interfaces/libpq/fe-secure-openssl.c
+++ b/src/interfaces/libpq/fe-secure-openssl.c
@@ -1815,11 +1815,6 @@ PQsslAttribute(PGconn *conn, const char *attribute_name)
  * see sock_read() and sock_write() in OpenSSL's crypto/bio/bss_sock.c.
  */
 
-#ifndef HAVE_BIO_GET_DATA
-#define BIO_get_data(bio) (bio->ptr)
-#define BIO_set_data(bio, data) (bio->ptr = data)
-#endif
-
 /* protected by ssl_config_mutex */
 static BIO_METHOD *my_bio_methods;
 
@@ -1828,7 +1823,7 @@ my_sock_read(BIO *h, char *buf, int size)
 {
 	int			res;
 
-	res = pqsecure_raw_read((PGconn *) BIO_get_data(h), buf, size);
+	res = pqsecure_raw_read((PGconn *) BIO_get_app_data(h), buf, size);
 	BIO_clear_retry_flags(h);
 	if (res < 0)
 	{
@@ -1858,7 +1853,7 @@ my_sock_write(BIO *h, const char *buf, int size)
 {
 	int			res;
 
-	res = pqsecure_raw_write((PGconn *) BIO_get_data(h), buf, size);
+	res = pqsecure_raw_write((PGconn *) BIO_get_app_data(h), buf, size);
 	BIO_clear_retry_flags(h);
 	if (res < 0)
 	{
@@ -1968,7 +1963,7 @@ my_SSL_set_fd(PGconn *conn, int fd)
 		SSLerr(SSL_F_SSL_SET_FD, ERR_R_BUF_LIB);
 		goto err;
 	}
-	BIO_set_data(bio, conn);
+	BIO_set_app_data(bio, conn);
 
 	SSL_set_bio(conn->ssl, bio, bio);
 	BIO_set_fd(bio, fd, BIO_NOCLOSE);

(+ could also remove configure checks for BIO_get_data)

Does someone have the steps to downgrade to 3.1.4?