From: Tom Lane <tgl@sss.pgh.pa.us>
To: Daniel Gustafsson <daniel@yesql.se>
Cc: Jacob Champion <jchampion@timescale.com>
Cc: heath.lord@crunchydata.com
Cc: pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #17625: In PG15 PQsslAttribute returns different values than PG14 when SSL is not in use for the connection
Date: Thu, 29 Sep 2022 17:58:11 -0400
Message-ID: <467714.1664488691@sss.pgh.pa.us> (raw)
In-Reply-To: <8F5DD45F-8A0D-4CBE-93B9-844C55886B85@yesql.se>
References: <17625-fc47c78b7d71b534@postgresql.org>
<346263.1664480998@sss.pgh.pa.us>
<360379.1664482591@sss.pgh.pa.us>
<CAAWbhmhYNOubS2qTx3rG8V2STZ9F0SrtRBuPJimCwRYAQ6r3BQ@mail.gmail.com>
<395956.1664484332@sss.pgh.pa.us>
<398499.1664485687@sss.pgh.pa.us>
<8F5DD45F-8A0D-4CBE-93B9-844C55886B85@yesql.se>
Daniel Gustafsson <daniel@yesql.se> writes:
>> On 29 Sep 2022, at 23:08, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>> A definition that'd be consistent with what we just agreed to for
>> PQsslAttribute is:
>> PQsslAttributeNames(NULL): the attributes for the default SSL library,
>> or an empty list if there is none.
>> PQsslAttributeNames(conn): the attributes for the SSL library in use
>> on this connection, or an empty list if not encrypted.
> I think that makes sense, it keeps the API consistent.
So more or less as attached, then.
Since this is mostly about future-proofing, I'd personally be content
to put it in HEAD. Is there a case for shoehorning this into
v15 at this late date? Consistency with PQsslAttribute would be
good, but I'm not sure we want to make this kind of change post-RC1.
regards, tom lane
Attachments:clean-up-PQsslAttributeNames.patch (text/x-diff, 2.1K) downloaddiff --git a/doc/src/sgml/libpq.sgml b/doc/src/sgml/libpq.sgmlindex 8908f775df..41864c6cf1 100644--- a/doc/src/sgml/libpq.sgml+++ b/doc/src/sgml/libpq.sgml@@ -2592,12 +2592,22 @@ const char *PQsslAttribute(const PGconn *conn, const char *attribute_name);
<term><function>PQsslAttributeNames</function><indexterm><primary>PQsslAttributeNames</primary></indexterm></term>
<listitem>
<para>
- Returns an array of SSL attribute names available.+ Returns an array of SSL attribute names that can be used+ in <function>PQsslAttribute()</function>.
The array is terminated by a NULL pointer.
<synopsis>
const char * const * PQsslAttributeNames(const PGconn *conn);
</synopsis>
</para>
++ <para>+ If <literal>conn</literal> is NULL, the attributes available for the+ default SSL library are returned, or an empty list+ if <application>libpq</application> was compiled without any SSL+ support. If <literal>conn</literal> is not NULL, the attributes+ available for the SSL library in use for the connection are returned,+ or an empty list if the connection is not encrypted.+ </para>
</listitem>
</varlistentry>
diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.cindex 74b5c5987a..b42a908733 100644--- a/src/interfaces/libpq/fe-secure-openssl.c+++ b/src/interfaces/libpq/fe-secure-openssl.c@@ -1730,7 +1730,7 @@ PQsslStruct(PGconn *conn, const char *struct_name)
const char *const *
PQsslAttributeNames(PGconn *conn)
{
- static const char *const result[] = {+ static const char *const openssl_attrs[] = {
"library",
"key_bits",
"cipher",
@@ -1738,8 +1738,19 @@ PQsslAttributeNames(PGconn *conn)
"protocol",
NULL
};
+ static const char *const empty_attrs[] = {NULL};- return result;+ if (!conn)+ {+ /* Return attributes of default SSL library */+ return openssl_attrs;+ }++ /* No attrs for unencrypted connection */+ if (conn->ssl == NULL)+ return empty_attrs;++ return openssl_attrs;
}
const char *
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-bugs@postgresql.org
Cc: tgl@sss.pgh.pa.us, daniel@yesql.se, jchampion@timescale.com, heath.lord@crunchydata.com, pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #17625: In PG15 PQsslAttribute returns different values than PG14 when SSL is not in use for the connection
In-Reply-To: <467714.1664488691@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox