Date: Fri, 16 Feb 2024 09:54:49 -0600
From: Nathan Bossart <nathandbossart@gmail.com>
To: Jim Jones <jim.jones@uni-muenster.de>
Cc: Maiquel Grassi <grassi@hotmail.com.br>,
	Pavel Luzanov <p.luzanov@postgrespro.ru>,
	Erik Wienhold <ewie@ewie.name>,
	"pgsql-hackers@postgresql.org" <pgsql-hackers@postgresql.org>
Subject: Re: Psql meta-command conninfo+
Message-ID: <20240216155449.GA1236054@nathanxps13>
References: <e289dada-543d-495f-9cd3-5783a8412bc0@postgrespro.ru>
 <CP4P284MB24830F5BF17FFA7F3D733142EC452@CP4P284MB2483.BRAP284.PROD.OUTLOOK.COM>
 <f34b2134-85d6-4615-8f3f-e29a2f6f04ab@postgrespro.ru>
 <CP8P284MB249652F5F0BE828C20A38348EC442@CP8P284MB2496.BRAP284.PROD.OUTLOOK.COM>
 <49edac91-d47f-4cac-ae12-d51cabbd87c9@postgrespro.ru>
 <CP8P284MB2496C7F14594722472C9FEBAEC482@CP8P284MB2496.BRAP284.PROD.OUTLOOK.COM>
 <49635a5b-3d32-4f05-8ce4-c55c70181888@uni-muenster.de>
 <CP8P284MB24969B39579E808F9F44CCF8EC4D2@CP8P284MB2496.BRAP284.PROD.OUTLOOK.COM>
 <CP8P284MB249664C44A1793823C4546F8EC4D2@CP8P284MB2496.BRAP284.PROD.OUTLOOK.COM>
 <8a93f6c0-795f-4260-a5fd-07ccbddbc88f@uni-muenster.de>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <8a93f6c0-795f-4260-a5fd-07ccbddbc88f@uni-muenster.de>
Archived-At: <https://www.postgresql.org/message-id/20240216155449.GA1236054%40nathanxps13>
Precedence: bulk

Thanks for your work on this.  I haven't been keeping up with the
discussion, but I took a quick look at the latest patch.

+        <para>
+        "Database", "Authenticated User", "System User" (only for PostgreSQL 16 or higher),
+        "Current User", "Session User", "Backend PID", "Server Address", "Server Port",
+        "Client Address", "Client Port", "Socket Directory", and "Host" columns are listed
+        by default when <literal>\conninfo+</literal> is invoked. The columns "Encryption",
+        "Protocol", "Cipher", and "Compression" are added to this output when TLS (SSL)
+        authentication is used. The same applies to GSS authentication is used, where the
+        "GSSAPI" column is also added to the <literal>\conninfo+</literal> output.
         </para>

I might be alone on this, but I think this command should output the same
columns regardless of the version, whether it's using SSL, etc. and just
put NULL in any that do not apply.  IMHO that would simplify the code and
help prevent confusion.  Plus, I'm not aware of any existing meta-commands
that provide certain columns conditionally.

+	if (PQsslInUse(pset.db))
+	{
+		protocol = PQsslAttribute(pset.db, "protocol");
+		cipher = PQsslAttribute(pset.db, "cipher");
+		compression = PQsslAttribute(pset.db, "compression");
+		appendPQExpBuffer(&buf,
+						  "  ,'SSL' AS \"Encryption\",\n"
+						  "  '%s' AS \"Protocol\",\n"
+						  "  '%s' AS \"Cipher\",\n"
+						  "  '%s' AS \"Compression\"\n",
+						  protocol ? protocol : _("unknown"),
+						  cipher ? cipher : _("unknown"),
+						  (compression && strcmp(compression, "off") != 0) ? _("on") : _("off"));
+	}

Could we pull some of this information from pg_stat_ssl instead of from
libpq?  The reason I suggest this is because I think it would be nice if
the query that \conninfo+ uses could be copy/pasted as needed and not rely
on hard-coded values chosen by the client.

-- 
Nathan Bossart
Amazon Web Services: https://aws.amazon.com