From: Tom Lane <tgl@sss.pgh.pa.us>
To: Daniel Gustafsson <daniel@yesql.se>
cc: Jacob Champion <jchampion@timescale.com>, heath.lord@crunchydata.com,
        pgsql-bugs@lists.postgresql.org
Subject: Re: BUG #17625: In PG15 PQsslAttribute returns different values than
 PG14 when SSL is not in use for the connection
In-reply-to: <8F5DD45F-8A0D-4CBE-93B9-844C55886B85@yesql.se>
References: <17625-fc47c78b7d71b534@postgresql.org>
 <346263.1664480998@sss.pgh.pa.us> <360379.1664482591@sss.pgh.pa.us>
 <CAAWbhmhYNOubS2qTx3rG8V2STZ9F0SrtRBuPJimCwRYAQ6r3BQ@mail.gmail.com>
 <395956.1664484332@sss.pgh.pa.us> <398499.1664485687@sss.pgh.pa.us>
 <8F5DD45F-8A0D-4CBE-93B9-844C55886B85@yesql.se>
Comments: In-reply-to Daniel Gustafsson <daniel@yesql.se>
	message dated "Thu, 29 Sep 2022 23:37:15 +0200"
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----- =_aaaaaaaaaa0"
Content-ID: <467582.1664488678.0@sss.pgh.pa.us>
Date: Thu, 29 Sep 2022 17:58:11 -0400
Message-ID: <467714.1664488691@sss.pgh.pa.us>
Archived-At: 
 <https://www.postgresql.org/message-id/467714.1664488691%40sss.pgh.pa.us>
Precedence: bulk

------- =_aaaaaaaaaa0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <467582.1664488678.1@sss.pgh.pa.us>

Daniel Gustafsson <daniel@yesql.se> writes:
>> On 29 Sep 2022, at 23:08, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>> A definition that'd be consistent with what we just agreed to for
>> PQsslAttribute is:
>> PQsslAttributeNames(NULL): the attributes for the default SSL library,
>> or an empty list if there is none.
>> PQsslAttributeNames(conn): the attributes for the SSL library in use
>> on this connection, or an empty list if not encrypted.

> I think that makes sense, it keeps the API consistent.

So more or less as attached, then.

Since this is mostly about future-proofing, I'd personally be content
to put it in HEAD.  Is there a case for shoehorning this into
v15 at this late date?  Consistency with PQsslAttribute would be
good, but I'm not sure we want to make this kind of change post-RC1.

			regards, tom lane


------- =_aaaaaaaaaa0
Content-Type: text/x-diff; name="clean-up-PQsslAttributeNames.patch";
	charset="us-ascii"
Content-ID: <467582.1664488678.2@sss.pgh.pa.us>
Content-Description: clean-up-PQsslAttributeNames.patch
Content-Transfer-Encoding: quoted-printable

diff --git a/doc/src/sgml/libpq.sgml b/doc/src/sgml/libpq.sgml
index 8908f775df..41864c6cf1 100644
--- a/doc/src/sgml/libpq.sgml
+++ b/doc/src/sgml/libpq.sgml
@@ -2592,12 +2592,22 @@ const char *PQsslAttribute(const PGconn *conn, con=
st char *attribute_name);
      <term><function>PQsslAttributeNames</function><indexterm><primary>PQ=
sslAttributeNames</primary></indexterm></term>
      <listitem>
       <para>
-       Returns an array of SSL attribute names available.
+       Returns an array of SSL attribute names that can be used
+       in <function>PQsslAttribute()</function>.
        The array is terminated by a NULL pointer.
 <synopsis>
 const char * const * PQsslAttributeNames(const PGconn *conn);
 </synopsis>
       </para>
+
+      <para>
+       If <literal>conn</literal> is NULL, the attributes available for t=
he
+       default SSL library are returned, or an empty list
+       if <application>libpq</application> was compiled without any SSL
+       support.  If <literal>conn</literal> is not NULL, the attributes
+       available for the SSL library in use for the connection are return=
ed,
+       or an empty list if the connection is not encrypted.
+      </para>
      </listitem>
     </varlistentry>
 =

diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/lib=
pq/fe-secure-openssl.c
index 74b5c5987a..b42a908733 100644
--- a/src/interfaces/libpq/fe-secure-openssl.c
+++ b/src/interfaces/libpq/fe-secure-openssl.c
@@ -1730,7 +1730,7 @@ PQsslStruct(PGconn *conn, const char *struct_name)
 const char *const *
 PQsslAttributeNames(PGconn *conn)
 {
-	static const char *const result[] =3D {
+	static const char *const openssl_attrs[] =3D {
 		"library",
 		"key_bits",
 		"cipher",
@@ -1738,8 +1738,19 @@ PQsslAttributeNames(PGconn *conn)
 		"protocol",
 		NULL
 	};
+	static const char *const empty_attrs[] =3D {NULL};
 =

-	return result;
+	if (!conn)
+	{
+		/* Return attributes of default SSL library */
+		return openssl_attrs;
+	}
+
+	/* No attrs for unencrypted connection */
+	if (conn->ssl =3D=3D NULL)
+		return empty_attrs;
+
+	return openssl_attrs;
 }
 =

 const char *

------- =_aaaaaaaaaa0--