Extracted from the GnuTLS thread/patch, here is a patch to add a
server-side read-only parameter ssl_library, which currently reports
either 'OpenSSL' or an empty string, depending on what SSL library was
built with. This is analogous to the libpq function call
PQsslAttribute(conn, "library"), but there was no equivalent
functionality on the server side.
--
Peter Eisentraut http://www.2ndQuadrant.com/
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
From e9fe0423edb388a39b8d53e55d2be1cb37809256 Mon Sep 17 00:00:00 2001
From: Peter Eisentraut <pete...@gmx.net>
Date: Tue, 26 Jun 2018 10:19:35 +0200
Subject: [PATCH] Add ssl_library preset parameter
This allows querying the SSL implementation used on the server side.
It's analogous to using PQsslAttribute(conn, "library") in libpq.
---
doc/src/sgml/config.sgml | 16 ++++++++++++++++
src/backend/libpq/be-secure.c | 1 +
src/backend/utils/misc/guc.c | 15 +++++++++++++++
src/include/libpq/libpq.h | 1 +
src/test/ssl/t/001_ssltests.pl | 7 ++++++-
5 files changed, 39 insertions(+), 1 deletion(-)
diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml
index 7bfbc87109..d3c8823746 100644
--- a/doc/src/sgml/config.sgml
+++ b/doc/src/sgml/config.sgml
@@ -8370,6 +8370,22 @@ <title>Preset Options</title>
</listitem>
</varlistentry>
+ <varlistentry id="guc-ssl-library" xreflabel="ssl_library">
+ <term><varname>ssl_library</varname> (<type>string</type>)
+ <indexterm>
+ <primary><varname>ssl_library</varname> configuration
parameter</primary>
+ </indexterm>
+ </term>
+ <listitem>
+ <para>
+ Reports the name of the SSL library that this PostgreSQL server was
+ built with (even if SSL is not currently configured or in use on this
+ instance), for example <literal>OpenSSL</literal>, or an empty string
+ if none.
+ </para>
+ </listitem>
+ </varlistentry>
+
<varlistentry id="guc-wal-block-size" xreflabel="wal_block_size">
<term><varname>wal_block_size</varname> (<type>integer</type>)
<indexterm>
diff --git a/src/backend/libpq/be-secure.c b/src/backend/libpq/be-secure.c
index edfe2c0751..d349d7c2c7 100644
--- a/src/backend/libpq/be-secure.c
+++ b/src/backend/libpq/be-secure.c
@@ -38,6 +38,7 @@
#include "storage/proc.h"
+char *ssl_library;
char *ssl_cert_file;
char *ssl_key_file;
char *ssl_ca_file;
diff --git a/src/backend/utils/misc/guc.c b/src/backend/utils/misc/guc.c
index 859ef931e7..bdbb6ad528 100644
--- a/src/backend/utils/misc/guc.c
+++ b/src/backend/utils/misc/guc.c
@@ -3715,6 +3715,21 @@ static struct config_string ConfigureNamesString[] =
check_canonical_path, NULL, NULL
},
+ {
+ {"ssl_library", PGC_INTERNAL, PRESET_OPTIONS,
+ gettext_noop("Name of the SSL library."),
+ NULL,
+ GUC_NOT_IN_SAMPLE | GUC_DISALLOW_IN_FILE
+ },
+ &ssl_library,
+#ifdef USE_SSL
+ "OpenSSL",
+#else
+ "",
+#endif
+ NULL, NULL, NULL
+ },
+
{
{"ssl_cert_file", PGC_SIGHUP, CONN_AUTH_SSL,
gettext_noop("Location of the SSL server certificate
file."),
diff --git a/src/include/libpq/libpq.h b/src/include/libpq/libpq.h
index 7bf06c65e9..36baf6b919 100644
--- a/src/include/libpq/libpq.h
+++ b/src/include/libpq/libpq.h
@@ -75,6 +75,7 @@ extern int pq_putbytes(const char *s, size_t len);
/*
* prototypes for functions in be-secure.c
*/
+extern char *ssl_library;
extern char *ssl_cert_file;
extern char *ssl_key_file;
extern char *ssl_ca_file;
diff --git a/src/test/ssl/t/001_ssltests.pl b/src/test/ssl/t/001_ssltests.pl
index e550207454..2b875a3c95 100644
--- a/src/test/ssl/t/001_ssltests.pl
+++ b/src/test/ssl/t/001_ssltests.pl
@@ -8,7 +8,7 @@
if ($ENV{with_openssl} eq 'yes')
{
- plan tests => 64;
+ plan tests => 65;
}
else
{
@@ -49,6 +49,11 @@
$ENV{PGHOST} = $node->host;
$ENV{PGPORT} = $node->port;
$node->start;
+
+# Run this before we lock down access below.
+my $result = $node->safe_psql('postgres', "SHOW ssl_library");
+is($result, 'OpenSSL', 'ssl_library parameter');
+
configure_test_server_for_ssl($node, $SERVERHOSTADDR, 'trust');
note "testing password-protected keys";
--
2.18.0
