database/postgres
1
0
Fork 0
mirror of https://github.com/postgres/postgres.git synced 2025-07-28 23:42:10 +03:00
Code Activity

libpq: Add support for dumping SSL key material to file

Browse Source 
This adds a new connection parameter which instructs libpq to
write out keymaterial clientside into a file in order to make
connection debugging with Wireshark and similar tools possible.
The file format used is the standardized NSS format.

Author: Abhishek Chanda <abhishek.becs@gmail.com>
Co-authored-by: Daniel Gustafsson <daniel@yesql.se>
Reviewed-by: Jacob Champion <jacob.champion@enterprisedb.com>
Discussion: https://postgr.es/m/CAKiP-K85C8uQbzXKWf5wHQPkuygGUGcufke713iHmYWOe9q2dA@mail.gmail.com
This commit is contained in:
Daniel Gustafsson
2025-04-03 13:16:43 +02:00
parent e4309f73f6
commit 2da74d8d64
9 changed files with 120 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
doc/src/sgml/libpq.sgml
View File

@ -1918,6 +1918,30 @@ postgresql://%2Fvar%2Flib%2Fpostgresql/dbname
</listitem>
</varlistentry>
<varlistentry id="libpq-connect-sslkeylogfile" xreflabel="sslkeylogfile">
<term><literal>sslkeylogfile</literal></term>
<listitem>
<para>
This parameter specifies the location where <literal>libpq</literal>
will log keys used in this SSL context. This is useful for debugging
<productname>PostgreSQL</productname> protocol interactions or client
connections using network inspection tools like
<productname>Wireshark</productname>. This parameter is ignored if an
SSL connection is not made, or if <productname>LibreSSL</productname>
is used (<productname>LibreSSL</productname> does not support key
logging). Keys are logged using the <productname>NSS</productname>
format.
<warning>
<para>
Key logging will expose potentially sensitive information in the
keylog file. Keylog files should be handled with the same care as
<xref linkend="libpq-connect-sslkey" /> files.
</para>
</warning>
</para>
</listitem>
</varlistentry>
<varlistentry id="libpq-connect-sslpassword" xreflabel="sslpassword">
<term><literal>sslpassword</literal></term>
<listitem>