8000 Use abstracted SSL API in server connection log messages · zepfred/postgres@c186954 · GitHub
[go: up one dir, main page]
Skip to content

Commit c186954

Browse files
peterepetere
committed
Use abstracted SSL API in server connection log messages
The existing "connection authorized" server log messages used OpenSSL API calls directly, even though similar abstracted API calls exist. Change to use the latter instead. Change the function prototype for the functions that return the TLS version and the cipher to return const char * directly instead of copying into a buffer. That makes them slightly easier to use. Add bits= to the message. psql shows that, so we might as well show the same information on the client and server. Reviewed-by: Daniel Gustafsson <daniel@yesql.se> Reviewed-by: Michael Paquier <michael.paquier@gmail.com>
1 parent a6ef00b commit c186954

File tree

4 files changed

+26
-20
lines changed

4 files changed

+26
-20
lines changed

‎src/backend/libpq/be-secure-openssl.c

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1047,22 +1047,22 @@ be_tls_get_compression(Port *port)
10471047
return false;
10481048
}
10491049

1050-
void
1051-
be_tls_get_version(Port *port, char *ptr, size_t len)
1050+
const char *
1051+
be_tls_get_version(Port *port)
10521052
{
10531053
if (port->ssl)
1054-
strlcpy(ptr, SSL_get_version(port->ssl), len);
1054+
return SSL_get_version(port->ssl);
10551055
else
1056-
ptr[0] = '\0';
1056+
return NULL;
10571057
}
10581058

1059-
void
1060-
be_tls_get_cipher(Port *port, char *ptr, size_t len)
1059+
const char *
1060+
be_tls_get_cipher(Port *port)
10611061
{
10621062
if (port->ssl)
1063-
strlcpy(ptr, SSL_get_cipher(port->ssl), len);
1063+
return SSL_get_cipher(port->ssl);
10641064
else
1065-
ptr[0] = '\0';
1065+
return NULL;
10661066
}
10671067

10681068
void

‎src/backend/postmaster/pgstat.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2909,8 +2909,8 @@ pgstat_bestart(void)
29092909
beentry->st_ssl = true;
29102910
beentry->st_sslstatus->ssl_bits = be_tls_get_cipher_bits(MyProcPort);
29112911
beentry->st_sslstatus->ssl_compression = be_tls_get_compression(MyProcPort);
2912-
be_tls_get_version(MyProcPort, beentry->st_sslstatus->ssl_version, NAMEDATALEN);
2913-
be_tls_get_cipher(MyProcPort, beentry->st_sslstatus->ssl_cipher, NAMEDATALEN);
2912+
strlcpy(beentry->st_sslstatus->ssl_version, be_tls_get_version(MyProcPort), NAMEDATALEN);
2913+
strlcpy(beentry->st_sslstatus->ssl_cipher, be_tls_get_cipher(MyProcPort), NAMEDATALEN);
29142914
be_tls_get_peerdn_name(MyProcPort, beentry->st_sslstatus->ssl_clientdn, NAMEDATALEN);
29152915
}
29162916
else

‎src/backend/utils/init/postinit.c

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -246,12 +246,15 @@ PerformAuthentication(Port *port)
246246
{
247247
if (am_walsender)
248248
{
249-
#ifdef USE_OPENSSL
249+
#ifdef USE_SSL
250250
if (port->ssl_in_use)
251251
ereport(LOG,
252-
(errmsg("replication connection authorized: user=%s SSL enabled (protocol=%s, cipher=%s, compression=%s)",
253-
port->user_name, SSL_get_version(port->ssl), SSL_get_cipher(port->ssl),
254-
SSL_get_current_compression(port->ssl) ? _("on") : _("off"))));
252+
(errmsg("replication connection authorized: user=%s SSL enabled (protocol=%s, cipher=%s, bits=%d, compression=%s)",
253+
port->user_name,
254+
be_tls_get_version(port),
255+
be_tls_get_cipher(port),
256+
be_tls_get_cipher_bits(port),
257+
be_tls_get_compression(port) ? _("on") : _("off"))));
255258
else
256259
#endif
257260
ereport(LOG,
@@ -260,12 +263,15 @@ PerformAuthentication(Port *port)
260263
}
261264
else
262265
{
263-
#ifdef USE_OPENSSL
266+
#ifdef USE_SSL
264267
if (port->ssl_in_use)
265268
ereport(LOG,
266-
(errmsg("connection authorized: user=%s database=%s SSL enabled (protocol=%s, cipher=%s, compression=%s)",
267-
port->user_name, port->database_name, SSL_get_version(port->ssl), SSL_get_cipher(port->ssl),
268-
SSL_get_current_compression(port->ssl) ? _("on") : _("off"))));
269+
(errmsg("connection authorized: user=%s database=%s SSL enabled (protocol=%s, cipher=%s, bits=%d, compression=%s)",
270+
port->user_name, port->database_name,
271+
be_tls_get_version(port),
272+
be_tls_get_cipher(port),
273+
be_tls_get_cipher_bits(port),
274+
be_tls_get_compression(port) ? _("on") : _("off"))));
269275
else
270276
#endif
271277
ereport(LOG,

‎src/include/libpq/libpq-be.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -256,8 +256,8 @@ extern ssize_t be_tls_write(Port *port, void *ptr, size_t len, int *waitfor);
256256
*/
257257
extern int be_tls_get_cipher_bits(Port *port);
258258
extern bool be_tls_get_compression(Port *port);
259-
extern void be_tls_get_version(Port *port, char *ptr, size_t len);
260-
extern void be_tls_get_cipher(Port *port, char *ptr, size_t len);
259+
extern const char *be_tls_get_version(Port *port);
260+
extern const char *be_tls_get_cipher(Port *port);
261261
extern void be_tls_get_peerdn_name(Port *port, char *ptr, size_t len);
262262

263263
/*

0 commit comments

Comments
 (0)
0