From: Tom Lane <tgl@sss.pgh.pa.us>
To: Jacob Champion <jchampion@timescale.com>
cc: heath.lord@crunchydata.com, Daniel Gustafsson <daniel@yesql.se>,
        pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #17625: In PG15 PQsslAttribute returns different values than
 PG14 when SSL is not in use for the connection
In-reply-to: <395956.1664484332@sss.pgh.pa.us>
References: <17625-fc47c78b7d71b534@postgresql.org>
 <346263.1664480998@sss.pgh.pa.us> <360379.1664482591@sss.pgh.pa.us>
 <CAAWbhmhYNOubS2qTx3rG8V2STZ9F0SrtRBuPJimCwRYAQ6r3BQ@mail.gmail.com>
 <395956.1664484332@sss.pgh.pa.us>
Comments: In-reply-to Tom Lane <tgl@sss.pgh.pa.us>
	message dated "Thu, 29 Sep 2022 16:45:32 -0400"
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <398498.1664485687.1@sss.pgh.pa.us>
Date: Thu, 29 Sep 2022 17:08:07 -0400
Message-ID: <398499.1664485687@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/398499.1664485687%40sss.pgh.pa.us>
Precedence: bulk

BTW ... while I'm looking at this, it seems like PQsslAttributeNames
is defined in a pretty schizophrenic way.  It takes a "conn" argument
but does nothing whatever with that argument.  You get back OpenSSL's
attribute list, or an empty attribute list, depending on compilation
options but not on the properties of the connection.  None of this
is explained in the docs, and it would not scale to multiple supported
libraries either.  Should we clean that up while we're at it?

A definition that'd be consistent with what we just agreed to for
PQsslAttribute is:

PQsslAttributeNames(NULL): the attributes for the default SSL library,
or an empty list if there is none.

PQsslAttributeNames(conn): the attributes for the SSL library in use
on this connection, or an empty list if not encrypted.

This doesn't cover how to find out the attributes for a non-default
SSL library in advance of using it, but since PQsslAttribute would
also need extension for multiple libraries, we could leave that
for later.

			regards, tom lane