From: Jacob Champion <pchampion@vmware.com>
To: andrew@dunslane.net <andrew@dunslane.net>
To: pgsql-hackers@postgresql.org <pgsql-hackers@postgresql.org>
Subject: Re: [PATCH] Enable SSL library detection via PQsslAttribute
Date: Mon, 28 Feb 2022 20:21:45 +0000
Message-ID: <db90aae8107531c5f6b9d1924ffb6fba0ca62607.camel@vmware.com> (raw)
In-Reply-To: <83541b1e7873f2adb862f7f3ec763fae30a731b5.camel@vmware.com>
References: <4c8b76ef434a96627170a31c3acd33cbfd6e41f1.camel@vmware.com>
<6c4b2233-a8ad-4952-960c-6293243f1f96@dunslane.net>
<83541b1e7873f2adb862f7f3ec763fae30a731b5.camel@vmware.com>
On Wed, 2022-02-23 at 23:20 +0000, Jacob Champion wrote:
> First stab in v2-0002. Though I see that Andres is overhauling the
> tests in this folder today [1], so I'll need to watch that thread. :)
v3 rebases over Andres' changes and actually adds the Perl driver that
I missed the git-add for.
--Jacob
Attachments:v3-0001-Enable-SSL-library-detection-via-PQsslAttribute.patch (text/x-patch, 5.1K) download
From f5f3d39dbcdfd0c53ab9dce6c7a9dbdd94b2584c Mon Sep 17 00:00:00 2001
From: Jacob Champion <pchampion@vmware.com>
Date: Mon, 29 Nov 2021 14:36:38 -0800
Subject: [PATCH v3] Enable SSL library detection via PQsslAttribute()
Currently, libpq client code must have a connection handle before it can
query the "library" SSL attribute. This poses problems if the client
needs to know what SSL library is in use before constructing a
connection string. (For example, with the NSS proposal, a client would
have to decide whether to use the "ssldatabase" connection setting
rather than "sslcert" et al.)
Allow PQsslAttribute(NULL, "library") to return the library in use --
currently, just "OpenSSL" or NULL. The new behavior is announced with
the LIBPQ_HAS_SSL_LIBRARY_DETECTION feature macro, allowing clients to
differentiate between a libpq that was compiled without SSL support and
a libpq that's just too old to tell.
---
src/interfaces/libpq/Makefile | 1 +
src/interfaces/libpq/fe-secure-openssl.c | 6 ++--
src/interfaces/libpq/libpq-fe.h | 2 ++
src/interfaces/libpq/t/002_api.pl | 23 +++++++++++++++
src/interfaces/libpq/test/.gitignore | 1 +
src/interfaces/libpq/test/Makefile | 2 +-
src/interfaces/libpq/test/testclient.c | 37 ++++++++++++++++++++++++
7 files changed, 68 insertions(+), 4 deletions(-)
create mode 100644 src/interfaces/libpq/t/002_api.pl
create mode 100644 src/interfaces/libpq/test/testclient.c
diff --git a/src/interfaces/libpq/Makefile b/src/interfaces/libpq/Makefileindex 3c53393fa4..89bf5e0126 100644--- a/src/interfaces/libpq/Makefile+++ b/src/interfaces/libpq/Makefile@@ -13,6 +13,7 @@ subdir = src/interfaces/libpq
top_builddir = ../../..
include $(top_builddir)/src/Makefile.global
+export with_ssl
PGFILEDESC = "PostgreSQL Access Library"
diff --git a/src/interfaces/libpq/fe-secure-openssl.c b/src/interfaces/libpq/fe-secure-openssl.cindex f6e563a2e5..e095a0f538 100644--- a/src/interfaces/libpq/fe-secure-openssl.c+++ b/src/interfaces/libpq/fe-secure-openssl.c@@ -1597,14 +1597,14 @@ PQsslAttributeNames(PGconn *conn)
const char *
PQsslAttribute(PGconn *conn, const char *attribute_name)
{
+ if (strcmp(attribute_name, "library") == 0)+ return "OpenSSL";+
if (!conn)
return NULL;
if (conn->ssl == NULL)
return NULL;
- if (strcmp(attribute_name, "library") == 0)- return "OpenSSL";-
if (strcmp(attribute_name, "key_bits") == 0)
{
static char sslbits_str[12];
diff --git a/src/interfaces/libpq/libpq-fe.h b/src/interfaces/libpq/libpq-fe.hindex 20eb855abc..7986445f1a 100644--- a/src/interfaces/libpq/libpq-fe.h+++ b/src/interfaces/libpq/libpq-fe.h@@ -36,6 +36,8 @@ extern "C"
#define LIBPQ_HAS_PIPELINING 1
/* Indicates presence of PQsetTraceFlags; also new PQtrace output format */
#define LIBPQ_HAS_TRACE_FLAGS 1
+/* Indicates that PQsslAttribute(NULL, "library") is useful */+#define LIBPQ_HAS_SSL_LIBRARY_DETECTION 1
/*
* Option flags for PQcopyResult
diff --git a/src/interfaces/libpq/t/002_api.pl b/src/interfaces/libpq/t/002_api.plnew file mode 100644index 0000000000..bcf91bc558--- /dev/null+++ b/src/interfaces/libpq/t/002_api.pl@@ -0,0 +1,23 @@+#!/usr/bin/perl++# Copyright (c) 2022, PostgreSQL Global Development Group++use strict;+use warnings;++use PostgreSQL::Test::Utils;+use Test::More;++# Test PQsslAttribute(NULL, "library")+my ($out, $err) = run_command(['testclient', '--ssl']);++if ($ENV{with_ssl} eq 'openssl')+{+ is($out, 'OpenSSL', 'PQsslAttribute(NULL, "library") returns "OpenSSL"');+}+else+{+ is($err, 'SSL is not enabled', 'PQsslAttribute(NULL, "library") returns NULL');+}++done_testing();diff --git a/src/interfaces/libpq/test/.gitignore b/src/interfaces/libpq/test/.gitignoreindex 5e803d8816..4b17210483 100644--- a/src/interfaces/libpq/test/.gitignore+++ b/src/interfaces/libpq/test/.gitignore@@ -1 +1,2 @@+/testclient
/uri-regress
diff --git a/src/interfaces/libpq/test/Makefile b/src/interfaces/libpq/test/Makefileindex 5421215906..1d45be0c37 100644--- a/src/interfaces/libpq/test/Makefile+++ b/src/interfaces/libpq/test/Makefile@@ -11,7 +11,7 @@ endif
override CPPFLAGS := -I$(libpq_srcdir) $(CPPFLAGS)
LDFLAGS_INTERNAL += $(libpq_pgport)
-PROGS = uri-regress+PROGS = testclient uri-regress
all: $(PROGS)
diff --git a/src/interfaces/libpq/test/testclient.c b/src/interfaces/libpq/test/testclient.cnew file mode 100644index 0000000000..2c730d83fa--- /dev/null+++ b/src/interfaces/libpq/test/testclient.c@@ -0,0 +1,37 @@+/*+ * testclient.c+ * A test program for the libpq public API+ *+ * Copyright (c) 2022, PostgreSQL Global Development Group+ *+ * IDENTIFICATION+ * src/interfaces/libpq/test/testclient.c+ */++#include "postgres_fe.h"++#include "libpq-fe.h"++static void+print_ssl_library()+{+ const char *lib = PQsslAttribute(NULL, "library");++ if (!lib)+ fprintf(stderr, "SSL is not enabled\n");+ else+ printf("%s\n", lib);+}++int+main(int argc, char *argv[])+{+ if ((argc > 1) && !strcmp(argv[1], "--ssl"))+ {+ print_ssl_library();+ return 0;+ }++ printf("currently only --ssl is supported\n");+ return 1;+}--
2.25.1
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-hackers@postgresql.org
Cc: pchampion@vmware.com, andrew@dunslane.net
Subject: Re: [PATCH] Enable SSL library detection via PQsslAttribute
In-Reply-To: <db90aae8107531c5f6b9d1924ffb6fba0ca62607.camel@vmware.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox