From: Jacob Champion <pchampion@vmware.com>
To: tgl@sss.pgh.pa.us <tgl@sss.pgh.pa.us>
Cc: daniel@yesql.se <daniel@yesql.se>
Cc: andrew@dunslane.net <andrew@dunslane.net>
Cc: robertmhaas@gmail.com <robertmhaas@gmail.com>
Cc: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH] Enable SSL library detection via PQsslAttribute
Date: Fri, 25 Mar 2022 22:45:33 +0000
Message-ID: <d2037f5b2804089e7c9be176c7c7c976d06ed5a7.camel@vmware.com> (raw)
In-Reply-To: <3482589.1648245622@sss.pgh.pa.us>
References: <4c8b76ef434a96627170a31c3acd33cbfd6e41f1.camel@vmware.com>
<6c4b2233-a8ad-4952-960c-6293243f1f96@dunslane.net>
<83541b1e7873f2adb862f7f3ec763fae30a731b5.camel@vmware.com>
<db90aae8107531c5f6b9d1924ffb6fba0ca62607.camel@vmware.com>
<CA+TgmoajSahpyBmd=fgOb9YfLb1ke+6qShTez7hzaXo12bdv7Q@mail.gmail.com>
<b47defe38ba7ae3928624c7fac3a7754f12d8b1b.camel@vmware.com>
<3482589.1648245622@sss.pgh.pa.us>
On Fri, 2022-03-25 at 18:00 -0400, Tom Lane wrote:
> Jacob Champion <pchampion@vmware.com> writes:
> > Do I need to merge my tiny test program into the libpq_pipeline tests?
>
> Doesn't seem worth the trouble to me, notably because you'd
> then have to cope with non-SSL builds too.
Fine by me.
v5 moves the docs out of the Note, as requested by Daniel.
Thanks,
--Jacob
Attachments:since-v4.diff.txt (text/plain, 2.0K) download
commit 585bf50bdd9ffc1b7c07b65e500a19bf50fbddff
Author: Jacob Champion <pchampion@vmware.com>
Date: Fri Mar 25 15:36:09 2022 -0700
squash! Enable SSL library detection via PQsslAttribute()
Move new docs out of a Note into the main body.
diff --git a/doc/src/sgml/libpq.sgml b/doc/src/sgml/libpq.sgmlindex 82f3092715..aa400d1b7c 100644--- a/doc/src/sgml/libpq.sgml+++ b/doc/src/sgml/libpq.sgml@@ -2538,17 +2538,6 @@ const char *PQsslAttribute(const PGconn *conn, const char *attribute_name);
Name of the SSL implementation in use. (Currently, only
<literal>"OpenSSL"</literal> is implemented)
</para>
- <note>- <para>- As a special case, the <literal>library</literal> attribute may be- queried without an existing connection by passing NULL as the- <literal>conn</literal> argument. The historical behavior was to- return NULL for any attribute when a NULL <literal>conn</literal>- was provided; client programs needing to differentiate between the- newer and older implementations may check the- <literal>LIBPQ_HAS_SSL_LIBRARY_DETECTION</literal> feature macro.- </para>- </note>
</listitem>
</varlistentry>
<varlistentry>
@@ -2592,6 +2581,16 @@ const char *PQsslAttribute(const PGconn *conn, const char *attribute_name);
</varlistentry>
</variablelist>
</para>
++ <para>+ As a special case, the <literal>library</literal> attribute may be+ queried without an existing connection by passing NULL as the+ <literal>conn</literal> argument. The historical behavior was to return+ NULL for any attribute when a NULL <literal>conn</literal> was provided;+ client programs needing to differentiate between the newer and older+ implementations may check the+ <literal>LIBPQ_HAS_SSL_LIBRARY_DETECTION</literal> feature macro.+ </para>
</listitem>
</varlistentry>
v5-0001-Enable-SSL-library-detection-via-PQsslAttribute.patch (text/x-patch, 6.0K) download
From 6ea7a272a4cf316d4bf94da07c1d3538fcaa333e Mon Sep 17 00:00:00 2001
From: Jacob Champion <pchampion@vmware.com>
Date: Mon, 29 Nov 2021 14:36:38 -0800
Subject: [PATCH v5] Enable SSL library detection via PQsslAttribute()
Currently, libpq client code must have a connection handle before it can
query the "library" SSL attribute. This poses problems if the client
needs to know what SSL library is in use before constructing a
connection string. (For example, with the NSS proposal, a client would
have to decide whether to use the "ssldatabase" connection setting
rather than "sslcert" et al.)
Allow PQsslAttribute(NULL, "library") to return the library in use --
currently, just "OpenSSL" or NULL. The new behavior is announced with
the LIBPQ_HAS_SSL_LIBRARY_DETECTION feature macro, allowing clients to
differentiate between a libpq that was compiled without SSL support and
a libpq that's just too old to tell.
---
doc/src/sgml/libpq.sgml | 10 +++++++
src/interfaces/libpq/Makefile | 1 +
src/interfaces/libpq/fe-secure-openssl.c | 6 ++--
src/interfaces/libpq/libpq-fe.h | 2 ++
src/interfaces/libpq/t/002_api.pl | 23 +++++++++++++++
src/interfaces/libpq/test/.gitignore | 1 +
src/interfaces/libpq/test/Makefile | 2 +-
src/interfaces/libpq/test/testclient.c | 37 ++++++++++++++++++++++++
8 files changed, 78 insertions(+), 4 deletions(-)
create mode 100644 src/interfaces/libpq/t/002_api.pl
create mode 100644 src/interfaces/libpq/test/testclient.c
diff --git a/doc/src/sgml/libpq.sgml b/doc/src/sgml/libpq.sgmlindex 3998b1781b..aa400d1b7c 100644--- a/doc/src/sgml/libpq.sgml+++ b/doc/src/sgml/libpq.sgml@@ -2581,6 +2581,16 @@ const char *PQsslAttribute(const PGconn *conn, const char *attribute_name);
</varlistentry>
</variablelist>
</para>
++ <para>+ As a special case, the <literal>library</literal> attribute may be+ queried without an existing connection by passing NULL as the+ <literal>conn</literal> argument. The historical behavior was to return+ NULL for any attribute when a NULL <literal>conn</literal> was provided;+ client programs needing to differentiate between the newer and older+ implementations may check the+ <literal>LIBPQ_HAS_SSL_LIBRARY_DETECTION</literal> feature macro.+ </para>
</listitem>
</varlistentry>
diff --git a/src/interfaces/libpq/Makefile b/src/interfaces/libpq/Makefileindex 3c53393fa4..89bf5e0126 100644--- a/src/interfaces/libpq/Makefile+++ b/src/interfaces/libpq/Makefile@@ -13,6 +13,7 @@ subdir = src/interfaces/libpq
top_builddir = ../../..
include $(top_builddir)/src/Makefile.global
+export with_ssl
PGFILEDESC = "PostgreSQL Access Library"
diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.cindex d81218a4cc..d3bf57b850 100644--- a/src/interfaces/libpq/fe-secure-openssl.c+++ b/src/interfaces/libpq/fe-secure-openssl.c@@ -1631,14 +1631,14 @@ PQsslAttributeNames(PGconn *conn)
const char *
PQsslAttribute(PGconn *conn, const char *attribute_name)
{
+ if (strcmp(attribute_name, "library") == 0)+ return "OpenSSL";+
if (!conn)
return NULL;
if (conn->ssl == NULL)
return NULL;
- if (strcmp(attribute_name, "library") == 0)- return "OpenSSL";-
if (strcmp(attribute_name, "key_bits") == 0)
{
static char sslbits_str[12];
diff --git a/src/interfaces/libpq/libpq-fe.h b/src/interfaces/libpq/libpq-fe.hindex 20eb855abc..7986445f1a 100644--- a/src/interfaces/libpq/libpq-fe.h+++ b/src/interfaces/libpq/libpq-fe.h@@ -36,6 +36,8 @@ extern "C"
#define LIBPQ_HAS_PIPELINING 1
/* Indicates presence of PQsetTraceFlags; also new PQtrace output format */
#define LIBPQ_HAS_TRACE_FLAGS 1
+/* Indicates that PQsslAttribute(NULL, "library") is useful */+#define LIBPQ_HAS_SSL_LIBRARY_DETECTION 1
/*
* Option flags for PQcopyResult
diff --git a/src/interfaces/libpq/t/002_api.pl b/src/interfaces/libpq/t/002_api.plnew file mode 100644index 0000000000..bcf91bc558--- /dev/null+++ b/src/interfaces/libpq/t/002_api.pl@@ -0,0 +1,23 @@+#!/usr/bin/perl++# Copyright (c) 2022, PostgreSQL Global Development Group++use strict;+use warnings;++use PostgreSQL::Test::Utils;+use Test::More;++# Test PQsslAttribute(NULL, "library")+my ($out, $err) = run_command(['testclient', '--ssl']);++if ($ENV{with_ssl} eq 'openssl')+{+ is($out, 'OpenSSL', 'PQsslAttribute(NULL, "library") returns "OpenSSL"');+}+else+{+ is($err, 'SSL is not enabled', 'PQsslAttribute(NULL, "library") returns NULL');+}++done_testing();diff --git a/src/interfaces/libpq/test/.gitignore b/src/interfaces/libpq/test/.gitignoreindex 5e803d8816..4b17210483 100644--- a/src/interfaces/libpq/test/.gitignore+++ b/src/interfaces/libpq/test/.gitignore@@ -1 +1,2 @@+/testclient
/uri-regress
diff --git a/src/interfaces/libpq/test/Makefile b/src/interfaces/libpq/test/Makefileindex 5421215906..1d45be0c37 100644--- a/src/interfaces/libpq/test/Makefile+++ b/src/interfaces/libpq/test/Makefile@@ -11,7 +11,7 @@ endif
override CPPFLAGS := -I$(libpq_srcdir) $(CPPFLAGS)
LDFLAGS_INTERNAL += $(libpq_pgport)
-PROGS = uri-regress+PROGS = testclient uri-regress
all: $(PROGS)
diff --git a/src/interfaces/libpq/test/testclient.c b/src/interfaces/libpq/test/testclient.cnew file mode 100644index 0000000000..2c730d83fa--- /dev/null+++ b/src/interfaces/libpq/test/testclient.c@@ -0,0 +1,37 @@+/*+ * testclient.c+ * A test program for the libpq public API+ *+ * Copyright (c) 2022, PostgreSQL Global Development Group+ *+ * IDENTIFICATION+ * src/interfaces/libpq/test/testclient.c+ */++#include "postgres_fe.h"++#include "libpq-fe.h"++static void+print_ssl_library()+{+ const char *lib = PQsslAttribute(NULL, "library");++ if (!lib)+ fprintf(stderr, "SSL is not enabled\n");+ else+ printf("%s\n", lib);+}++int+main(int argc, char *argv[])+{+ if ((argc > 1) && !strcmp(argv[1], "--ssl"))+ {+ print_ssl_library();+ return 0;+ }++ printf("currently only --ssl is supported\n");+ return 1;+}--
2.25.1
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: pchampion@vmware.com, tgl@sss.pgh.pa.us, daniel@yesql.se, andrew@dunslane.net, robertmhaas@gmail.com
Subject: Re: [PATCH] Enable SSL library detection via PQsslAttribute
In-Reply-To: <d2037f5b2804089e7c9be176c7c7c976d06ed5a7.camel@vmware.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox